From res at AUSICS.NET Mon Aug 1 07:56:25 2005 From: res at AUSICS.NET (Res) Date: Thu Jan 12 21:30:29 2006 Subject: List ping Message-ID: On Fri, 29 Jul 2005, Steen, Glenn wrote: > (Sorry for the top post) > Now, here's the strange thing: Why did this one go through, but not > the 5-10 others I've sent the last couple of days? Aaargh. Maybe this answers the question :) Received: from LISTSERV.JISCMAIL.AC.UK (jiscmail.ac.uk) by smtp.jiscmail.ac.uk (LSMTP for Windows NT v1.1b) with *shakes head* -- Cheers Res ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at AP1.SE Mon Aug 1 12:05:43 2005 From: glenn.steen at AP1.SE (Glenn Steen) Date: Thu Jan 12 21:30:29 2006 Subject: List ping Message-ID: Yet another ping to kili.jiscmail.ac.uk (via telnet). Please ignore. -- Glenn ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at AP1.SE Mon Aug 1 12:10:46 2005 From: glenn.steen at AP1.SE (Glenn Steen) Date: Thu Jan 12 21:30:29 2006 Subject: List ping Message-ID: Yet another ping to fili.jiscmail.ac.uk (via telnet). Please ignore. -- Glenn ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at gmail.com Mon Aug 1 12:14:44 2005 From: glenn.steen at gmail.com (Glenn Steen) Date: Thu Jan 12 21:30:29 2006 Subject: List ping Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 01/08/05, Glenn Steen wrote: > Yet another ping to fili.jiscmail.ac.uk (via telnet). Please ignore. > > -- Glenn > Wondeful, now both fili and kili want to play with us again:-). -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From stef at L5NET.NET Mon Aug 1 12:37:20 2005 From: stef at L5NET.NET (Stef Morrell) Date: Thu Jan 12 21:30:29 2006 Subject: Grinding to a halt processing Postfix messages Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field > Sent: 31 July 2005 17:38 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Grinding to a halt processing Postfix messages > > If you have been having a problem where MailScanner gives up > processing messages after a few hours, causing it to just sit > there and not process anything, I have a fix I would like you to try. I have seen this happen, but only once, maybe twice in several months of using PF and MS. So - I'll certainly add in the patch, but useful diagnostics will unfortunately be hard to provide. Stef ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From remy at UNIX-ASP.COM Mon Aug 1 12:41:33 2005 From: remy at UNIX-ASP.COM (Remy de Ruysscher) Date: Thu Jan 12 21:30:29 2006 Subject: Grinding to a halt processing Postfix messages Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I've applied this patch today, and it seems to work wonderfully. Normally I've had about 8 messages "stuck" in the queue, but today the queue is empty. Thanks. Stef Morrell wrote: -----Original Message----- From: MailScanner mailing list ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pete at ENITECH.COM.AU Mon Aug 1 12:47:26 2005 From: pete at ENITECH.COM.AU (Pete Russell) Date: Thu Jan 12 21:30:29 2006 Subject: Grinding to a halt processing Postfix messages Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] SHould we all be trying it, even if we havent experienced the symptoms exactly as described by Julian? And should we be change lin 1099 instead? Remy de Ruysscher wrote: > > I've applied this patch today, and it seems to work wonderfully. > Normally I've had about 8 messages "stuck" in the queue, but today the > queue is empty. > > Thanks. > > Stef Morrell wrote: > >>>-----Original Message----- >>>From: MailScanner mailing list >>> >>>------------------------ MailScanner list ------------------------ >>> >>>To unsubscribe, email jiscmail@jiscmail.ac.uk >>>with the words: >>> >>>'leave mailscanner' in the body of the email. >>> >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) >>>and >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> >>> >>>*Support MailScanner development - buy the book off the website!* >>> >>> >>> >>> ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Aug 1 13:47:17 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:29 2006 Subject: List ping Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] They have found and fixed the problem. Hi The problem has now been fixed. Apologies for any inconvenience. Regards Spencer JISCmail Julian Field wrote: > I have just mailed the helpline myself, to see if I can extract any > fix from them. I will post what I hear back from them. > > Glenn Steen wrote: > >> I've now determined (via telnet.... which this is sent with) that >> fili is OK, but kili is unable to run it's^H^Hs virus-scanner. How hard >> can this be to fix:-). >> >> Cheers everyone >> -- Glenn >> >> -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Aug 1 13:48:52 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:29 2006 Subject: Grinding to a halt processing Postfix messages Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I will put out 4.44.5 containing this fix. Pete Russell wrote: > SHould we all be trying it, even if we havent experienced the symptoms > exactly as described by Julian? And should we be change lin 1099 instead? > > Remy de Ruysscher wrote: > >> >> I've applied this patch today, and it seems to work wonderfully. >> Normally I've had about 8 messages "stuck" in the queue, but today >> the queue is empty. >> >> Thanks. >> >> Stef Morrell wrote: >> >>>> -----Original Message----- >>>> From: MailScanner mailing list >>>> ------------------------ MailScanner list ------------------------ >>>> >>>> To unsubscribe, email jiscmail@jiscmail.ac.uk >>>> with the words: >>>> >>>> 'leave mailscanner' in the body of the email. >>>> >>>> Before posting, read the Wiki (http://wiki.mailscanner.info/) >>>> and >>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>> >>>> >>>> *Support MailScanner development - buy the book off the website!* >>>> >>>> >>>> >>>> > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Aug 1 14:03:08 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:29 2006 Subject: MalScanner ANNOUNCE: Stable 4.44.5 released Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have just released the August stable edition of MailScanner 4.44.5. The major new features and improvements are an optimisation when the spam archive is being kept clean but most messages (eg your spam) is being deleted, and a "Scan Messages" option which can be used to control the total functionality of MailScanner which greatly simplifies the settings when some customers don't want any scanning services at all. The main fixes are for those using Postfix. The "corrupt" message problem has been fixed for good, as has the problem of the scanning slowly stopping after a few hours. You can download it as usual from www.mailscanner.info. The full Change Log for the month is: * New Features and Improvements * - Published new version of the book, but advise you don't purchase until 3rd week of August so I get to check a copy off the press first. - Optimised situation where spam archive is being kept clean but many messages are being deleted. Thanks to yavor.trapkov@wipe.int for that. - Improved logging to show what sort of HTML tags have been disarmed. - Added "Scan Messages" option (intended to be a ruleset) which is an easy way of disabling all scanning and processing of messages. Great for customers who don't want scanning of any sort on their messages. - More phishing net improvements and additions to the safe sites list. * Fixes * - Added more Postfix temporarily-invalid-message checks. This is working perfectly reliably now. - Added disk full checks for MailScanner/incoming space. - Added missing object instantiate in the generic spam scanner. - Fixed reporting and scoring bugs in Custom Spam Scanner. - Made Postfix hash depth measurement more tolerant of stray files such as Razor logs appearing in the hold queue directories. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Mon Aug 1 14:16:14 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:29 2006 Subject: tnef screwed up my queue Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Please can you copy a TNEF Postfix message file on a web site and mail > me a URL? > I need something to try it with. I suspect I'm just missing a chdir > somewhere. > Julian, I also get leftover tnef files in mqueue.in and I am using sendmail on RHEL 3/4 with various MS versions (4 different from 4.34 to 4.40). Fortunately sendmail is not affected my those leftovers. Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From adrik at SALESMANAGER.NL Mon Aug 1 14:26:28 2005 From: adrik at SALESMANAGER.NL (Adri Koppes) Date: Thu Jan 12 21:30:29 2006 Subject: tnef screwed up my queue Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Denis Beauchemin > Sent: Monday, August 01, 2005 15:16 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: tnef screwed up my queue > > Julian Field wrote: > > > Please can you copy a TNEF Postfix message file on a web > site and mail > > me a URL? > > I need something to try it with. I suspect I'm just missing a chdir > > somewhere. > > > > Julian, > > I also get leftover tnef files in mqueue.in and I am using > sendmail on RHEL 3/4 with various MS versions (4 different > from 4.34 to 4.40). > Fortunately sendmail is not affected my those leftovers. > > Denis Julian, I also get occasional tnef files in my mqueue.in, using sendmail 8.13.1 and MS 4.4x. Adri. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Aug 1 14:36:24 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:29 2006 Subject: tnef screwed up my queue Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Adri Koppes wrote: >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Denis Beauchemin >>Sent: Monday, August 01, 2005 15:16 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: tnef screwed up my queue >> >>Julian Field wrote: >> >> >> >>>Please can you copy a TNEF Postfix message file on a web >>> >>> >>site and mail >> >> >>>me a URL? >>>I need something to try it with. I suspect I'm just missing a chdir >>>somewhere. >>> >>> >>> >>Julian, >> >>I also get leftover tnef files in mqueue.in and I am using >>sendmail on RHEL 3/4 with various MS versions (4 different >>from 4.34 to 4.40). >>Fortunately sendmail is not affected my those leftovers. >> >>Denis >> >> > >Julian, > >I also get occasional tnef files in my mqueue.in, using sendmail 8.13.1 >and MS 4.4x. > > What filenames are they? -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ebruce at HPMICH.COM Mon Aug 1 14:38:43 2005 From: ebruce at HPMICH.COM (Ed Bruce) Date: Thu Jan 12 21:30:29 2006 Subject: Another Postfix Question Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mike Kercher wrote: >hash_queue_depth = 1 >hash_queue_names = incoming, active, deferred, bounce, defer, flush, hold, >trace > >This is on postfix-2.1.5-4.2.RHEL4 > > What should this be? My results are: hash_queue_depth = 1 hash_queue_names = deferred, defer later, Ed ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Mon Aug 1 14:43:17 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:29 2006 Subject: tnef screwed up my queue Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Adri Koppes wrote: > >>> -----Original Message----- >>> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] >>> On Behalf Of Denis Beauchemin >>> Sent: Monday, August 01, 2005 15:16 >>> To: MAILSCANNER@JISCMAIL.AC.UK >>> Subject: Re: tnef screwed up my queue >>> >>> Julian Field wrote: >>> >>> >>> >>>> Please can you copy a TNEF Postfix message file on a web >>> >>> site and mail >>> >>>> me a URL? >>>> I need something to try it with. I suspect I'm just missing a chdir >>>> somewhere. >>>> >>>> >>> >>> Julian, >>> >>> I also get leftover tnef files in mqueue.in and I am using sendmail >>> on RHEL 3/4 with various MS versions (4 different from 4.34 to >>> 4.40). Fortunately sendmail is not affected my those leftovers. >>> >>> Denis >>> >> >> >> Julian, >> >> I also get occasional tnef files in my mqueue.in, using sendmail 8.13.1 >> and MS 4.4x. >> >> > What filenames are they? > -rw------- 1 root root 30336 Jun 23 15:54 tnef-3737-1.doc -rw------- 1 root root 44295 Jun 22 14:37 tnef-8386-2.doc -rw------- 1 root root 79872 jui 12 23:48 tnef-8734-2.doc Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From adrik at SALESMANAGER.NL Mon Aug 1 14:48:08 2005 From: adrik at SALESMANAGER.NL (Adri Koppes) Date: Thu Jan 12 21:30:29 2006 Subject: tnef screwed up my queue Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field > Sent: Monday, August 01, 2005 15:36 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: tnef screwed up my queue > > Adri Koppes wrote: > > >>-----Original Message----- > >>From: MailScanner mailing list > >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Denis Beauchemin > >>Sent: Monday, August 01, 2005 15:16 > >>To: MAILSCANNER@JISCMAIL.AC.UK > >>Subject: Re: tnef screwed up my queue > >> > >>Julian Field wrote: > >> > >> > >> > >>>Please can you copy a TNEF Postfix message file on a web > >>> > >>> > >>site and mail > >> > >> > >>>me a URL? > >>>I need something to try it with. I suspect I'm just > missing a chdir > >>>somewhere. > >>> > >>> > >>> > >>Julian, > >> > >>I also get leftover tnef files in mqueue.in and I am using > sendmail on > >>RHEL 3/4 with various MS versions (4 different from 4.34 to 4.40). > >>Fortunately sendmail is not affected my those leftovers. > >> > >>Denis > >> > >> > > > >Julian, > > > >I also get occasional tnef files in my mqueue.in, using > sendmail 8.13.1 > >and MS 4.4x. > > > > > What filenames are they? Julian, Here an example of my config, mqueue.in and maillog. MailScanner.conf contains: Expand TNEF = yes Deliver Unparsable TNEF = no TNEF Expander = internal TNEF Timeout = 120 /var/spool/mqueue.in contains: # ls -l /var/spool/mqueue.in total 84 -rw-r--r-- 1 root daemon 7344 Jun 10 06:35 tnef-7769-1.doc -rw-r--r-- 1 root daemon 76800 Jun 10 06:35 tnef-7769-2.doc /var/log/maillog contains: Jun 10 06:35:44 mail MailScanner[7769]: New Batch: Scanning 1 messages, 116569 bytes Jun 10 06:35:51 mail MailScanner[7769]: Expanding TNEF archive at /var/spool/MailScanner/incoming/7769/j5A4ZUTm008140/winmail.dat Jun 10 06:35:51 mail MailScanner[7769]: Corrupt TNEF winmail.dat that cannot be analysed in message j5A4ZUTm008140 Jun 10 06:35:51 mail MailScanner[7769]: Virus and Content Scanning: Starting Jun 10 06:35:51 mail MailScanner[7769]: SophosSAVI::ERROR:: Sweep could not proceed, the file was corrupted (538):: ./j5A4ZUTm008140/winmail.dat Jun 10 06:35:52 mail MailScanner[7769]: Virus Scanning: SophosSAVI found 1 infections Jun 10 06:35:52 mail MailScanner[7769]: ClamAVModule::LibClamAV Error: Error reading TNEF message Jun 10 06:35:52 mail MailScanner[7769]: Virus Scanning: ClamAV Module found 1 infections Jun 10 06:35:53 mail MailScanner[7769]: Infected message j5A4ZUTm008140 came from xxx.xx.xxx.xx Adri. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at LISTS.COM.AR Mon Aug 1 15:21:25 2005 From: mailscanner at LISTS.COM.AR (Leonardo Helman) Date: Thu Jan 12 21:30:29 2006 Subject: Version Performance Message-ID: yes, I know you changed a lot of code. same for the SA people. thanks for answering I didn't have the time (yet) to see if this performance change was on the SA or the MS side. I did a little test on the SA alone (spamassassin executable) and got no useful results. I have to give this matter a litle more time, but I'm taking off a few days. I'll post the results when I come back. (maybe 3.1.0 directly?) Thank you very much Saludos -- Leonardo Helman Pert Consultores Argentina On Sat, Jul 30, 2005 at 01:27:46PM +0100, Julian Field wrote: > What would be really helpful would be if you could try some intervening > versions as well, and see exactly what version change caused the > slow-down. A lot of code changed between 4.37 and 4.44. > > Leonardo Helman wrote: > > >this is frustrating > > > >DOESN'T MATTER THE HARDWARE. > > > >I have made a SOFTWARE upgrade, WITHOUT any change > >to the hardware or hardware parameters. > > > >Only software. > > > >MS4-37.1 -> MS 4.44.1 > >SA3.02 -> SA3.04 > > > >And I MEASURED a drop in the performance something like > >more or less 10% (email processed on a certain time) > > > >So (I think) it's a simple cuestion about anyone > >measuring performance before/after upgrading. > > > >Do any of you measure top quantity of mails per second processed? > >Something like "Upgraded, didn't change the hardware and get x% more/less" > > > >Saludos > > > >-- > >Leonardo Helman > >Pert Consultores > >Argentina > > > >On Thu, Jul 28, 2005 at 10:03:04PM +0200, Koen Teugels wrote: > > > > > >> On what hardware are you running this?? > >> Thanks > >> > >> Ugo Bellavance > >> Sent by: MailScanner mailing list > >> > >> 27/07/2005 15:38 > >> > >> Please respond to > >> MailScanner mailing list > >> > >> To > >> > >> MAILSCANNER@JISCMAIL.AC.UK > >> > >> cc > >> > >> Subject > >> > >> Re: Version Performance > >> > >> Leonardo Helman wrote: > >> > Hi I have been seen a small drop in performance > >> > between MS4-37.7/SA-3.02 to MS-4.44-1/SA-3.04 > >> > > >> > Under very heavy load we had been procesing about 15500 mails > >> > per hour, but with the new setup that number gets only to 13400 > >> > > >> > There where no changes at MTA, or the machine. > >> > I only change MS+SA+some perl modules > >> > Compress-Zlib, ExtUtils-MakeMaker File-Spec File-Temp IO-stringy > >> > MailTools MIME-Base64 Storable Time-HiRes > >> > > >> > All the surbls/rbls are the same. > >> > > >> > The other rules are all the same but the default ones. > >> > > >> > I'm triyng to see where the problem is. (modules? SA? MS?) > >> Please start here: > >> http://wiki.mailscanner.info/doku.php?id=documentation:test_troublesho > >> ot:performance > >> and here > >> http://wiki.mailscanner.info/doku.php?id=maq:index#optimization_tips > >> -- > >> Ugo > >> -> Please don't send a copy of your reply by e-mail. I read the list. > >> -> Please avoid top-posting, long signatures and HTML, and cut the > >> irrelevant parts in your replies. > >> ------------------------ MailScanner list ------------------------ > >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >> 'leave mailscanner' in the body of the email. > >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> Support MailScanner development - buy the book off the website! > >> ------------------------ MailScanner list ------------------------ > >> To unsubscribe, email [1]jiscmail@jiscmail.ac.uk with the words: > >> 'leave mailscanner' in the body of the email. > >> Before posting, read the Wiki ([2]http://wiki.mailscanner.info/) > >> and the archives > >> ([3]http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> Support MailScanner development - buy the book off the website! > >> > >>References > >> > >> 1. file://localhost/tmp/jiscmail@jiscmail.ac.uk > >> 2. http://wiki.mailscanner.info/ > >> 3. http://www.jiscmail.ac.uk/lists/mailscanner.html > >> > >> > > > >------------------------ MailScanner list ------------------------ > >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >'leave mailscanner' in the body of the email. > >Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >Support MailScanner development - buy the book off the website! > > > > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Aug 1 15:58:06 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:29 2006 Subject: Version Performance Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Also, it's worth trying 4.44.5 which I have just released, as it may have been the introduction of the facility of keeping the spam archive clean that was causing the performance hit. Leonardo Helman wrote: >yes, I know you changed a lot of code. same for the SA people. >thanks for answering > >I didn't have the time (yet) to see if this performance change >was on the SA or the MS side. >I did a little test on the SA alone (spamassassin executable) >and got no useful results. I have to give this matter a litle >more time, but I'm taking off a few days. > >I'll post the results when I come back. (maybe 3.1.0 directly?) > > >Thank you very much > >Saludos >-- >Leonardo Helman >Pert Consultores >Argentina > >On Sat, Jul 30, 2005 at 01:27:46PM +0100, Julian Field wrote: > > >>What would be really helpful would be if you could try some intervening >>versions as well, and see exactly what version change caused the >>slow-down. A lot of code changed between 4.37 and 4.44. >> >>Leonardo Helman wrote: >> >> >> >>>this is frustrating >>> >>>DOESN'T MATTER THE HARDWARE. >>> >>>I have made a SOFTWARE upgrade, WITHOUT any change >>>to the hardware or hardware parameters. >>> >>>Only software. >>> >>>MS4-37.1 -> MS 4.44.1 >>>SA3.02 -> SA3.04 >>> >>>And I MEASURED a drop in the performance something like >>>more or less 10% (email processed on a certain time) >>> >>>So (I think) it's a simple cuestion about anyone >>>measuring performance before/after upgrading. >>> >>>Do any of you measure top quantity of mails per second processed? >>>Something like "Upgraded, didn't change the hardware and get x% more/less" >>> >>>Saludos >>> >>>-- >>>Leonardo Helman >>>Pert Consultores >>>Argentina >>> >>>On Thu, Jul 28, 2005 at 10:03:04PM +0200, Koen Teugels wrote: >>> >>> >>> >>> >>>> On what hardware are you running this?? >>>> Thanks >>>> >>>> Ugo Bellavance >>>> Sent by: MailScanner mailing list >>>> >>>> 27/07/2005 15:38 >>>> >>>> Please respond to >>>> MailScanner mailing list >>>> >>>> To >>>> >>>> MAILSCANNER@JISCMAIL.AC.UK >>>> >>>> cc >>>> >>>> Subject >>>> >>>> Re: Version Performance >>>> >>>> Leonardo Helman wrote: >>>> > Hi I have been seen a small drop in performance >>>> > between MS4-37.7/SA-3.02 to MS-4.44-1/SA-3.04 >>>> > >>>> > Under very heavy load we had been procesing about 15500 mails >>>> > per hour, but with the new setup that number gets only to 13400 >>>> > >>>> > There where no changes at MTA, or the machine. >>>> > I only change MS+SA+some perl modules >>>> > Compress-Zlib, ExtUtils-MakeMaker File-Spec File-Temp IO-stringy >>>> > MailTools MIME-Base64 Storable Time-HiRes >>>> > >>>> > All the surbls/rbls are the same. >>>> > >>>> > The other rules are all the same but the default ones. >>>> > >>>> > I'm triyng to see where the problem is. (modules? SA? MS?) >>>> Please start here: >>>> http://wiki.mailscanner.info/doku.php?id=documentation:test_troublesho >>>> ot:performance >>>> and here >>>> http://wiki.mailscanner.info/doku.php?id=maq:index#optimization_tips >>>> -- >>>> Ugo >>>> -> Please don't send a copy of your reply by e-mail. I read the list. >>>> -> Please avoid top-posting, long signatures and HTML, and cut the >>>> irrelevant parts in your replies. >>>> ------------------------ MailScanner list ------------------------ >>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>> 'leave mailscanner' in the body of the email. >>>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> Support MailScanner development - buy the book off the website! >>>> ------------------------ MailScanner list ------------------------ >>>> To unsubscribe, email [1]jiscmail@jiscmail.ac.uk with the words: >>>> 'leave mailscanner' in the body of the email. >>>> Before posting, read the Wiki ([2]http://wiki.mailscanner.info/) >>>> and the archives >>>> ([3]http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> Support MailScanner development - buy the book off the website! >>>> >>>>References >>>> >>>> 1. file://localhost/tmp/jiscmail@jiscmail.ac.uk >>>> 2. http://wiki.mailscanner.info/ >>>> 3. http://www.jiscmail.ac.uk/lists/mailscanner.html >>>> >>>> >>>> >>>> >>>------------------------ MailScanner list ------------------------ >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >>> >>> >>> >>> >>-- >>Julian Field >>www.MailScanner.info >>Buy the MailScanner book at www.MailScanner.info/store >>Professional Support Services at www.MailScanner.biz >>MailScanner thanks transtec Computers for their support >> >>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >> > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Aug 1 16:29:19 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:29 2006 Subject: tnef screwed up my queue Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Attached is a patch to TNEF.pm to fix this problem. Please let me know how you get on with this. Adri Koppes wrote: >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field >>Sent: Monday, August 01, 2005 15:36 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: tnef screwed up my queue >> >>Adri Koppes wrote: >> >> >> >>>>-----Original Message----- >>>>From: MailScanner mailing list >>>>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Denis Beauchemin >>>>Sent: Monday, August 01, 2005 15:16 >>>>To: MAILSCANNER@JISCMAIL.AC.UK >>>>Subject: Re: tnef screwed up my queue >>>> >>>>Julian Field wrote: >>>> >>>> >>>> >>>> >>>> >>>>>Please can you copy a TNEF Postfix message file on a web >>>>> >>>>> >>>>> >>>>> >>>>site and mail >>>> >>>> >>>> >>>> >>>>>me a URL? >>>>>I need something to try it with. I suspect I'm just >>>>> >>>>> >>missing a chdir >> >> >>>>>somewhere. >>>>> >>>>> >>>>> >>>>> >>>>> >>>>Julian, >>>> >>>>I also get leftover tnef files in mqueue.in and I am using >>>> >>>> >>sendmail on >> >> >>>>RHEL 3/4 with various MS versions (4 different from 4.34 to 4.40). >>>>Fortunately sendmail is not affected my those leftovers. >>>> >>>>Denis >>>> >>>> >>>> >>>> >>>Julian, >>> >>>I also get occasional tnef files in my mqueue.in, using >>> >>> >>sendmail 8.13.1 >> >> >>>and MS 4.4x. >>> >>> >>> >>> >>What filenames are they? >> >> > >Julian, > >Here an example of my config, mqueue.in and maillog. > >MailScanner.conf contains: > >Expand TNEF = yes >Deliver Unparsable TNEF = no >TNEF Expander = internal >TNEF Timeout = 120 > >/var/spool/mqueue.in contains: > ># ls -l /var/spool/mqueue.in >total 84 >-rw-r--r-- 1 root daemon 7344 Jun 10 06:35 tnef-7769-1.doc >-rw-r--r-- 1 root daemon 76800 Jun 10 06:35 tnef-7769-2.doc > >/var/log/maillog contains: > >Jun 10 06:35:44 mail MailScanner[7769]: New Batch: Scanning 1 messages, >116569 bytes Jun 10 06:35:51 mail MailScanner[7769]: Expanding TNEF >archive at >/var/spool/MailScanner/incoming/7769/j5A4ZUTm008140/winmail.dat >Jun 10 06:35:51 mail MailScanner[7769]: Corrupt TNEF winmail.dat that >cannot be analysed in message j5A4ZUTm008140 Jun 10 06:35:51 mail >MailScanner[7769]: Virus and Content Scanning: Starting Jun 10 06:35:51 >mail MailScanner[7769]: SophosSAVI::ERROR:: Sweep could not proceed, the >file was corrupted (538):: ./j5A4ZUTm008140/winmail.dat Jun 10 06:35:52 >mail MailScanner[7769]: Virus Scanning: SophosSAVI found 1 infections >Jun 10 06:35:52 mail MailScanner[7769]: ClamAVModule::LibClamAV Error: >Error reading TNEF message Jun 10 06:35:52 mail MailScanner[7769]: Virus >Scanning: ClamAV Module found 1 infections Jun 10 06:35:53 mail >MailScanner[7769]: Infected message j5A4ZUTm008140 came from >xxx.xx.xxx.xx > >Adri. > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Application/X-GZIP 694bytes. ] [ Unable to print this part. ] From arrasmith at MATH.WICHITA.EDU Mon Aug 1 18:03:48 2005 From: arrasmith at MATH.WICHITA.EDU (Mark Arrasmith) Date: Thu Jan 12 21:30:29 2006 Subject: SpamAssassin: where is my SPAM? Message-ID: I'm running RedHat Enterprise 3, MailScanner 4.43.8, SpamAssassin 3.0.4, DCC, pyzor, RulesDuJour, and Sophos Antivirus. This is an update from previous versions of MailScanner and SpamAssassin. In MailScanner.conf I have the spam action rules as ... Spam Actions = deliver attachment But, ever since I updated SpamAssassin (from 2.55 -> 3.0.4) I now get all the Spam being deleted. What can I do to track this down? I'd like to be able to run on "deliver" for a couple of weeks before just deleting all incoming spam. - mark -- Ozman's Laws: (1) If someone says he will do something "without fail," he won't. (2) The more people talk on the phone, the less money they make. (3) People who go to conferences are the ones who shouldn't. (4) Pizza always burns the roof of your mouth. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Aug 1 18:20:37 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:29 2006 Subject: SpamAssassin: where is my SPAM? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] If you want to store your spam as well (in /var/spool/MailScanner/quarantine by default) then you need to add the word store to your spam actions and high-scoring spam actions. Mark Arrasmith wrote: >I'm running RedHat Enterprise 3, MailScanner 4.43.8, SpamAssassin 3.0.4, DCC, >pyzor, RulesDuJour, and Sophos Antivirus. This is an update from previous >versions of MailScanner and SpamAssassin. > >In MailScanner.conf I have the spam action rules as ... > Spam Actions = deliver attachment > >But, ever since I updated SpamAssassin (from 2.55 -> 3.0.4) I now get all the >Spam being deleted. What can I do to track this down? I'd like to be able >to run on "deliver" for a couple of weeks before just deleting all incoming >spam. > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jaearick at COLBY.EDU Mon Aug 1 18:31:44 2005 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:30:30 2006 Subject: 4.44.5: new perl tarfiles? Message-ID: Julian, Could you say a few words about the new perl tarfiles in 4.44.5? I see that the following were added: Archive-Any-0.06 Carp-Assert-0.17 (0.18 is current at CPAN) Class-Virtual-0.04 (0.05 is current) I installed the newer versions from CPAN. To get these to install, I had to pull the following modules down from CPAN: Archive-Tar-1.24 Test-Simple-0.60 Class-Data-Inheritable--0.02 IO-Zlib-1.04 4.44.5 is otherwise installed and working fine... Jeff Earickson Colby College ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Mon Aug 1 18:42:58 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:30 2006 Subject: MalScanner ANNOUNCE: Stable 4.44.5 released Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > I have just released the August stable edition of MailScanner 4.44.5. > Julian, Some problems here on a RHEL 4: file /usr/bin/instmodsh from install of perl-ExtUtils-MakeMaker-6.30-1 conflicts with file from package perl-5.8.5-12.1 file /usr/lib/perl5/5.8.5/ExtUtils/Command.pm from install of perl-ExtUtils-MakeMaker-6.30-1 conflicts with file from package perl-5.8.5-12.1 ... file /usr/lib/perl5/5.8.5/File/Temp.pm from install of perl-File-Temp-0.16-1 conflicts with file from package perl-5.8.5-12.1 file /usr/share/man/man3/File::Temp.3pm.gz from install of perl-File-Temp-0.16-1 conflicts with file from package perl-5.8.5-12.1 Checking for module MIME::Base64 (version 3.03)... not found. --- Fallback: Checking for module MIME::Base64 (version 2.20)... ok. *** Warning: We can work with version 2.20 of MIME::Base64, but *** we recommend that you upgrade to version 3.03. *** Note that if you type 'make test', then tests *** 4, 5 and 7-11 of t/Misc.t may fail because of the old version *** of MIME::Base64 Output from MailScanner -v gives: 3.05 MIME::Base64 I have the complete install.sh output script if it can be of any help to you. Should I be concerned by those error messages? Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From alex at NKPANAMA.COM Mon Aug 1 18:44:05 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:30 2006 Subject: SpamAssassin: where is my SPAM? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > If you want to store your spam as well (in > /var/spool/MailScanner/quarantine by default) then you need to add the > word store to your spam actions and high-scoring spam actions. > > Mark Arrasmith wrote: > >> I'm running RedHat Enterprise 3, MailScanner 4.43.8, SpamAssassin >> 3.0.4, DCC, pyzor, RulesDuJour, and Sophos Antivirus. This is an >> update from previous versions of MailScanner and SpamAssassin. >> >> In MailScanner.conf I have the spam action rules as ... >> Spam Actions = deliver attachment >> >> But, ever since I updated SpamAssassin (from 2.55 -> 3.0.4) I now get >> all the Spam being deleted. What can I do to track this down? I'd >> like to be able to run on "deliver" for a couple of weeks before just >> deleting all incoming spam. >> >> Also since the newer spamassassin is smarter, it may be that spam that once scored as "spam" is now "high scoring spam". ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Aug 1 19:04:56 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:30 2006 Subject: 4.44.5: new perl tarfiles? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] The files shouldn't have neen there at all. That disk in my main build machine died last night, so I have had to build on a new machine. For some reason cvs doesn't seem to clear out files it knows nothing about in its trees, so these got left behind. I have just released 4.44.6 which doesn't have these files (and also has the TNEF files fix). Jeff A. Earickson wrote: > Julian, > > Could you say a few words about the new perl tarfiles in > 4.44.5? I see that the following were added: > > Archive-Any-0.06 > Carp-Assert-0.17 (0.18 is current at CPAN) > Class-Virtual-0.04 (0.05 is current) > > I installed the newer versions from CPAN. To get these to install, I > had to pull the following modules down from CPAN: > > Archive-Tar-1.24 > Test-Simple-0.60 > Class-Data-Inheritable--0.02 > IO-Zlib-1.04 > > 4.44.5 is otherwise installed and working fine... -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Aug 1 19:07:39 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:30 2006 Subject: MalScanner ANNOUNCE: Stable 4.44.5 released Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Denis Beauchemin wrote: > Julian Field wrote: > >> I have just released the August stable edition of MailScanner 4.44.5. >> > > Julian, > > Some problems here on a RHEL 4: > file /usr/bin/instmodsh from install of perl-ExtUtils-MakeMaker-6.30-1 > conflicts with file from package perl-5.8.5-12.1 > file /usr/lib/perl5/5.8.5/ExtUtils/Command.pm from install of > perl-ExtUtils-MakeMaker-6.30-1 conflicts with file from package > perl-5.8.5-12.1 > ... > > file /usr/lib/perl5/5.8.5/File/Temp.pm from install of > perl-File-Temp-0.16-1 conflicts with file from package perl-5.8.5-12.1 > file /usr/share/man/man3/File::Temp.3pm.gz from install of > perl-File-Temp-0.16-1 conflicts with file from package perl-5.8.5-12.1 They are simply caused by trying to install modules which are already installed as part of the newer version of Perl contained in RHEL 4. Totally harmless. > > Checking for module MIME::Base64 (version 3.03)... not found. > --- Fallback: Checking for module MIME::Base64 (version 2.20)... ok. > > *** Warning: We can work with version 2.20 of MIME::Base64, but > *** we recommend that you upgrade to version 3.03. > > *** Note that if you type 'make test', then tests > *** 4, 5 and 7-11 of t/Misc.t may fail because of the old version > *** of MIME::Base64 > > Output from MailScanner -v gives: > 3.05 MIME::Base64 This is also harmless. Due to the place Perl insists on installing MIME::Base64 by default, I have to install it in a totally separate place which isn't on the Perl search path by default. However, MailScanner finds it as expected. > > I have the complete install.sh output script if it can be of any help > to you. Should I be concerned by those error messages? No, they are all harmless. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Mon Aug 1 19:12:38 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:30 2006 Subject: 4.44.5: new perl tarfiles? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > The files shouldn't have neen there at all. That disk in my main build > machine died last night, so I have had to build on a new machine. For > some reason cvs doesn't seem to clear out files it knows nothing about > in its trees, so these got left behind. > > I have just released 4.44.6 which doesn't have these files (and also > has the TNEF files fix). > > Jeff A. Earickson wrote: > >> Julian, >> >> Could you say a few words about the new perl tarfiles in >> 4.44.5? I see that the following were added: >> >> Archive-Any-0.06 >> Carp-Assert-0.17 (0.18 is current at CPAN) >> Class-Virtual-0.04 (0.05 is current) >> >> I installed the newer versions from CPAN. To get these to install, I >> had to pull the following modules down from CPAN: >> >> Archive-Tar-1.24 >> Test-Simple-0.60 >> Class-Data-Inheritable--0.02 >> IO-Zlib-1.04 >> >> 4.44.5 is otherwise installed and working fine... > > My upgrade went smoothly about 5 minutes ago... I guess there's no need to rush out and re-upgrade, right? :) ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jaearick at COLBY.EDU Mon Aug 1 19:15:55 2005 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:30:30 2006 Subject: 4.44.5: new perl tarfiles? Message-ID: ok, I'll toss these CPAN files overboard. Also note that file /etc/filename.new.rules.conf, dated Jan 25 2004 also mysteriously appeared. Jeff On Mon, 1 Aug 2005, Julian Field wrote: > Date: Mon, 1 Aug 2005 19:04:56 +0100 > From: Julian Field > Reply-To: MailScanner mailing list > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: 4.44.5: new perl tarfiles? > > The files shouldn't have neen there at all. That disk in my main build > machine died last night, so I have had to build on a new machine. For some > reason cvs doesn't seem to clear out files it knows nothing about in its > trees, so these got left behind. > > I have just released 4.44.6 which doesn't have these files (and also has the > TNEF files fix). > > Jeff A. Earickson wrote: > >> Julian, >> >> Could you say a few words about the new perl tarfiles in >> 4.44.5? I see that the following were added: >> >> Archive-Any-0.06 >> Carp-Assert-0.17 (0.18 is current at CPAN) >> Class-Virtual-0.04 (0.05 is current) >> >> I installed the newer versions from CPAN. To get these to install, I had >> to pull the following modules down from CPAN: >> >> Archive-Tar-1.24 >> Test-Simple-0.60 >> Class-Data-Inheritable--0.02 >> IO-Zlib-1.04 >> >> 4.44.5 is otherwise installed and working fine... > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Aug 1 19:24:57 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:30 2006 Subject: 4.44.5: new perl tarfiles? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] That will vanish in the next build too. Not worth doing another release just for that. Thanks for pointing out this stuff guys. Jeff A. Earickson wrote: > ok, I'll toss these CPAN files overboard. Also note that file > /etc/filename.new.rules.conf, dated Jan 25 2004 also mysteriously > appeared. > > Jeff > > On Mon, 1 Aug 2005, Julian Field wrote: > >> Date: Mon, 1 Aug 2005 19:04:56 +0100 >> From: Julian Field >> Reply-To: MailScanner mailing list >> To: MAILSCANNER@JISCMAIL.AC.UK >> Subject: Re: 4.44.5: new perl tarfiles? >> >> The files shouldn't have neen there at all. That disk in my main >> build machine died last night, so I have had to build on a new >> machine. For some reason cvs doesn't seem to clear out files it knows >> nothing about in its trees, so these got left behind. >> >> I have just released 4.44.6 which doesn't have these files (and also >> has the TNEF files fix). >> >> Jeff A. Earickson wrote: >> >>> Julian, >>> >>> Could you say a few words about the new perl tarfiles in >>> 4.44.5? I see that the following were added: >>> >>> Archive-Any-0.06 >>> Carp-Assert-0.17 (0.18 is current at CPAN) >>> Class-Virtual-0.04 (0.05 is current) >>> >>> I installed the newer versions from CPAN. To get these to install, >>> I had to pull the following modules down from CPAN: >>> >>> Archive-Tar-1.24 >>> Test-Simple-0.60 >>> Class-Data-Inheritable--0.02 >>> IO-Zlib-1.04 >>> >>> 4.44.5 is otherwise installed and working fine... >> >> >> -- >> Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> Professional Support Services at www.MailScanner.biz >> MailScanner thanks transtec Computers for their support >> >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From arrasmith at MATH.WICHITA.EDU Mon Aug 1 19:28:51 2005 From: arrasmith at MATH.WICHITA.EDU (Mark Arrasmith) Date: Thu Jan 12 21:30:30 2006 Subject: SpamAssassin: where is my SPAM? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Monday 01 August 2005 12:44 pm, Alex Neuman van der Hans wrote: > Julian Field wrote: > > If you want to store your spam as well (in > > /var/spool/MailScanner/quarantine by default) then you need to add the > > word store to your spam actions and high-scoring spam actions. > > Also since the newer spamassassin is smarter, it may be that spam that > once scored as "spam" is now "high scoring spam". > My problem (actually feature) was I had the following ... High Scoring Spam Actions = attachment for high scoring spam. It seems to just delete high scoring spam then. I set both Spam Actions and High Scoring Spam Actions to "deliver attachment store" and now I see what I was expecting. So far I'm happy with how much better SpamAssassin is labeling high scoring spam. I think I'll just move that action to "delete". Thanks for the help. - mark ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Mon Aug 1 19:32:33 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:30 2006 Subject: MalScanner ANNOUNCE: Stable 4.44.5 released Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Denis Beauchemin wrote: > >> Julian Field wrote: >> >>> I have just released the August stable edition of MailScanner 4.44.5. >>> >> >> Julian, >> >> Some problems here on a RHEL 4: >> file /usr/bin/instmodsh from install of >> perl-ExtUtils-MakeMaker-6.30-1 conflicts with file from package >> perl-5.8.5-12.1 >> file /usr/lib/perl5/5.8.5/ExtUtils/Command.pm from install of >> perl-ExtUtils-MakeMaker-6.30-1 conflicts with file from package >> perl-5.8.5-12.1 >> ... >> >> file /usr/lib/perl5/5.8.5/File/Temp.pm from install of >> perl-File-Temp-0.16-1 conflicts with file from package perl-5.8.5-12.1 >> file /usr/share/man/man3/File::Temp.3pm.gz from install of >> perl-File-Temp-0.16-1 conflicts with file from package perl-5.8.5-12.1 > > > They are simply caused by trying to install modules which are already > installed as part of the newer version of Perl contained in RHEL 4. > Totally harmless. > >> >> Checking for module MIME::Base64 (version 3.03)... not found. >> --- Fallback: Checking for module MIME::Base64 (version 2.20)... ok. >> >> *** Warning: We can work with version 2.20 of MIME::Base64, but >> *** we recommend that you upgrade to version 3.03. >> >> *** Note that if you type 'make test', then tests >> *** 4, 5 and 7-11 of t/Misc.t may fail because of the old version >> *** of MIME::Base64 >> >> Output from MailScanner -v gives: >> 3.05 MIME::Base64 > > > This is also harmless. Due to the place Perl insists on installing > MIME::Base64 by default, I have to install it in a totally separate > place which isn't on the Perl search path by default. However, > MailScanner finds it as expected. > >> >> I have the complete install.sh output script if it can be of any help >> to you. Should I be concerned by those error messages? > > > No, they are all harmless. > As usual, thanks a lot! Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From drew at THEMARSHALLS.CO.UK Mon Aug 1 19:53:48 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:30:30 2006 Subject: Another Postfix Question Message-ID: On 1 Aug 2005, at 14:38, Ed Bruce wrote: > Mike Kercher wrote: > > >> hash_queue_depth = 1 >> hash_queue_names = incoming, active, deferred, bounce, defer, >> flush, hold, >> trace >> >> This is on postfix-2.1.5-4.2.RHEL4 >> >> > What should this be? My results are: > > hash_queue_depth = 1 > hash_queue_names = deferred, defer These are fine and are the defaults for 2.1.x (As newer disks and machines are able to find queue files quicker/ easier. As for what they should be, well that's up to you, your system load and the amount of 'bursty' mail you are processing. You may find hashed queues useful if you are handling large volumes of mail (Such as mailing list traffic). Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From sailer at BNL.GOV Mon Aug 1 19:58:28 2005 From: sailer at BNL.GOV (Tim Sailer) Date: Thu Jan 12 21:30:30 2006 Subject: 'St*ck Picks' spam Message-ID: Has anyone figured out how to keep these things under control? Tim -- Tim Sailer Information and Special Technologies Program Office of CounterIntelligence Brookhaven National Laboratory (631) 344-3001 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rpoe at PLATTESHERIFF.ORG Mon Aug 1 21:58:15 2005 From: rpoe at PLATTESHERIFF.ORG (Rob Poe) Date: Thu Jan 12 21:30:30 2006 Subject: Happy Sysadmin Day! Message-ID: Well, I'll drink a chocolate shake for you. I'm on a liquid diet. Too much BTK time. (Behind the Keyboard, that is). ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From abridge at HQTRS.COM Mon Aug 1 21:57:59 2005 From: abridge at HQTRS.COM (Aaron Bridge) Date: Thu Jan 12 21:30:30 2006 Subject: Want to be sure this program is what I need Message-ID: This program was recommended to me. I just want to be sure what I want to do is possible with mailscanner. My companys user's POP email directly to their client from an outside provider. I would like to set a server up that would POP the email for the clients then filter the SPAM, and finally send the legit messages to the proper user. Is Mailscanner with SpamAssasin what I need to be looking for to accomplish this? Preferred method? Software? Thank you in advance Aaron ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jamesp at MUSICREPORTS.COM Mon Aug 1 22:16:03 2005 From: Jamesp at MUSICREPORTS.COM (James D. Parra) Date: Thu Jan 12 21:30:30 2006 Subject: unable to write pid to sendmail.pid Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello, Whenever I start MailScanner I get the following error: MailScanner # cat /var/log/mail.err Jul 28 18:21:34 sendmail-out[12986]: unable to write pid to /var/run/sendmail.pid: file in use by another process Jul 29 15:46:35 sendmail-out[5624]: unable to write pid to /var/run/sendmail.pid: file in use by another process Aug 1 11:14:54 sendmail-out[25226]: unable to write pid to /var/run/sendmail.pid: file in use by another process Aug 1 13:12:13 sendmail-out[25885]: unable to write pid to /var/run/sendmail.pid: file in use by another process Aug 1 13:15:43 sendmail-out[26006]: unable to write pid to /var/run/sendmail.pid: file in use by another process Aug 1 13:57:47 sendmail-out[26165]: unable to write pid to /var/run/sendmail.pid: file in use by another process No other application, outside of MailScanner starting sendmail, is running. Can someone point me in the right direction? Thank you, James ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHT.IE Mon Aug 1 22:27:04 2005 From: michele at BLACKNIGHT.IE (Michele Neylon :: Blacknight) Date: Thu Jan 12 21:30:30 2006 Subject: Want to be sure this program is what I need Message-ID: On Mon, 2005-08-01 at 21:57 +0100, Aaron Bridge wrote: > This program was recommended to me. I just want to be sure what I want to > do is possible with mailscanner. > > My companys user's POP email directly to their client from an outside > provider. I would like to set a server up that would POP the email for the > clients then filter the SPAM, and finally send the legit messages to the > proper user. > > Is Mailscanner with SpamAssasin what I need to be looking for to accomplish > this? Preferred method? Software? It is possible if you use fetchmail on the machine running MailScanner. We've done this for a number of clients in the past. It may not be as effective as scanning the mail on the SMTP, but it will work YMMV Michele -- Mr. Michele Neylon Blacknight Solutions Hosting, Co-location & Domain Registration http://www.blacknight.ie/ Phone: 1850 927 280 Intl: +353 (0)59 9183072 Fax: +353 (0)59 9164239 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jrudd at UCSC.EDU Mon Aug 1 22:27:26 2005 From: jrudd at UCSC.EDU (John Rudd) Date: Thu Jan 12 21:30:30 2006 Subject: Happy Sysadmin Day! Message-ID: On Aug 1, 2005, at 13:58, Rob Poe wrote: > Well, I'll drink a chocolate shake for you. > > I'm on a liquid diet. Too much BTK time. (Behind the Keyboard, that > is). > For a half second, I wondered if you were referring to the Kansas Serial Killer, BTK. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve.swaney at fsl.com Mon Aug 1 22:48:17 2005 From: steve.swaney at fsl.com (Stephen Swaney) Date: Thu Jan 12 21:30:30 2006 Subject: unable to write pid to sendmail.pid Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of James D. Parra > Sent: Monday, August 01, 2005 5:16 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: unable to write pid to sendmail.pid > > Hello, > > Whenever I start MailScanner I get the following error: > > MailScanner # cat /var/log/mail.err > Jul 28 18:21:34 sendmail-out[12986]: unable to write pid to > /var/run/sendmail.pid: file in use by another process > Jul 29 15:46:35 sendmail-out[5624]: unable to write pid to > /var/run/sendmail.pid: file in use by another process > Aug 1 11:14:54 sendmail-out[25226]: unable to write pid to > /var/run/sendmail.pid: file in use by another process > Aug 1 13:12:13 sendmail-out[25885]: unable to write pid to > /var/run/sendmail.pid: file in use by another process > Aug 1 13:15:43 sendmail-out[26006]: unable to write pid to > /var/run/sendmail.pid: file in use by another process > Aug 1 13:57:47 sendmail-out[26165]: unable to write pid to > /var/run/sendmail.pid: file in use by another process > > No other application, outside of MailScanner starting sendmail, is > running. > > Can someone point me in the right direction? > > Thank you, > > James I'm pretty sure that this is in the MAQ but what's happening is that when you try to start Sendmail - It's already running. You don't say what OS you are running so I can only tell you the processes, not the commands. Also the init processes are a bit different if you're running Debian, Solaris or FreeBSD 1. Make sure that sendmail is not running or (for linix) started by an init script. 2. Restart MailScanner 3. Make sure that MailScanner is started by a init script. If you're running Red Hat Linux or a Red Hat variant (CentOS) the command would be: service sendmail stop chkconfig sendmail off service MailScanner restart chkconfig MailScanner on Steve Stephen Swaney Fort Systems Ltd. stephen.swaney@fsl.com www.fsl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Mon Aug 1 22:48:24 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:30:30 2006 Subject: Want to be sure this program is what I need Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Aaron Bridge wrote: > This program was recommended to me. I just want to be sure what I want to > do is possible with mailscanner. > > My companys user's POP email directly to their client from an outside > provider. I would like to set a server up that would POP the email for the > clients then filter the SPAM, and finally send the legit messages to the > proper user. > > Is Mailscanner with SpamAssasin what I need to be looking for to accomplish > this? Preferred method? Software? No. MailScanner is meant to work with an MTA (smtp server) and you won't have one. If you must pop from an outside server you probably want to use fetchmail to get the mail from the outside server, then have procmail call spamc to scan the mail with SA as it's delivered to the users' mbox. From there, set up a pop server for your users to pop from your server instead of the outside one. The problem you'll have is it's rather difficult to do this for any decent number of user accounts on the outside server, as fectchmail will need to store the access credentials to connect to the outside server. Not very secure. Ideally you should set up a MTA, and get the outside server to relay to you. If you can get that working, then you can use MailScanner. You'll still need a local pop server, but you won't need to use procmail. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jamesp at MUSICREPORTS.COM Mon Aug 1 23:09:13 2005 From: Jamesp at MUSICREPORTS.COM (James D. Parra) Date: Thu Jan 12 21:30:30 2006 Subject: unable to write pid to sendmail.pid Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >If you're running Red Hat Linux or a Red Hat variant (CentOS) the command >would be: > service sendmail stop > chkconfig sendmail off > service MailScanner restart > chkconfig MailScanner on Running Suse 9.3. Ran the above commands after installing MailScanner. Reran them again at your suggestion. # rcsendmail stop Shutting down SMTP port done # chkconfig sendmail off # rcMailScanner restart Shutting down sendmail and MailScanner done Initializing incoming sendmail done Initializing outgoing sendmail done Initializing MailScanner # chkconfig MailScanner on ...and yet I still get the following; Aug 1 15:01:44 sendmail-out[26592]: unable to write pid to /var/run/sendmail.pid: file in use by another process Very odd. Any other clues? Thank you, again. ~James ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve.swaney at fsl.com Mon Aug 1 23:22:28 2005 From: steve.swaney at fsl.com (Stephen Swaney) Date: Thu Jan 12 21:30:30 2006 Subject: unable to write pid to sendmail.pid Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of James D. Parra > Sent: Monday, August 01, 2005 6:09 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: unable to write pid to sendmail.pid > > >If you're running Red Hat Linux or a Red Hat variant (CentOS) the command > >would be: > > > service sendmail stop > > chkconfig sendmail off > > service MailScanner restart > > chkconfig MailScanner on > > Running Suse 9.3. > > Ran the above commands after installing MailScanner. Reran them again at > your suggestion. > > # rcsendmail stop > Shutting down SMTP port done > # chkconfig sendmail off > # rcMailScanner restart > Shutting down sendmail and MailScanner done > Initializing incoming sendmail done > Initializing outgoing sendmail done > Initializing MailScanner > # chkconfig MailScanner on > > ...and yet I still get the following; > > Aug 1 15:01:44 sendmail-out[26592]: unable to write pid to > /var/run/sendmail.pid: file in use by another process > > Very odd. > > Any other clues? > > Thank you, again. > > ~James Try running: /etc/init.d/sendmail stop /etc/init.d/MailScanner stop Wait a minute or two, then run: killall sendmail service MailScanner start Steve Stephen Swaney Fort Systems Ltd. stephen.swaney@fsl.com www.fsl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve.swaney at fsl.com Mon Aug 1 23:40:39 2005 From: steve.swaney at fsl.com (Stephen Swaney) Date: Thu Jan 12 21:30:30 2006 Subject: Want to be sure this program is what I need Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Aaron Bridge > Sent: Monday, August 01, 2005 4:58 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Want to be sure this program is what I need > > This program was recommended to me. I just want to be sure what I want to > do is possible with mailscanner. > > My companys user's POP email directly to their client from an outside > provider. I would like to set a server up that would POP the email for > the > clients then filter the SPAM, and finally send the legit messages to the > proper user. > > Is Mailscanner with SpamAssasin what I need to be looking for to > accomplish > this? Preferred method? Software? > > Thank you in advance > > Aaron You don't say anything about the number of users / volume of mail. This would be useful to know before recommending a configuration. One other question I like to ask is how critical email is to your business. Can you take a four hour hit or a day without email? We have some customers for whom business (and the money) stops or come to a crawl when email stops. Steve Stephen Swaney Fort Systems Ltd. stephen.swaney@fsl.com www.fsl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jamesp at MUSICREPORTS.COM Mon Aug 1 23:44:32 2005 From: Jamesp at MUSICREPORTS.COM (James D. Parra) Date: Thu Jan 12 21:30:30 2006 Subject: unable to write pid to sendmail.pid Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >Try running: > > /etc/init.d/sendmail stop > /etc/init.d/MailScanner stop > >Wait a minute or two, then run: > > killall sendmail > > service MailScanner start Sadly, the same thing occurs; Aug 1 15:30:12 sendmail-out[26867]: unable to write pid to /var/run/sendmail.pid: file in use by another process I wonder if MailScanner is starting multiple instances of sendmail. ~James ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve.swaney at fsl.com Tue Aug 2 00:05:01 2005 From: steve.swaney at fsl.com (Stephen Swaney) Date: Thu Jan 12 21:30:30 2006 Subject: unable to write pid to sendmail.pid Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of James D. Parra > Sent: Monday, August 01, 2005 6:45 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: unable to write pid to sendmail.pid > > >Try running: > > > > /etc/init.d/sendmail stop > > /etc/init.d/MailScanner stop > > > >Wait a minute or two, then run: > > > > killall sendmail > > > > service MailScanner start > > Sadly, the same thing occurs; > > Aug 1 15:30:12 sendmail-out[26867]: unable to write pid to > /var/run/sendmail.pid: file in use by another process > > I wonder if MailScanner is starting multiple instances of sendmail. > > ~James > After you stop sendmail what does ps -ef | grep sendmail report? Stephen Swaney Fort Systems Ltd. stephen.swaney@fsl.com www.fsl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bpumphrey at WOODMACLAW.COM Tue Aug 2 00:02:01 2005 From: bpumphrey at WOODMACLAW.COM (Billy A. Pumphrey) Date: Thu Jan 12 21:30:30 2006 Subject: Basic Rules question Message-ID: I would be amazed if the answer to this question was not in the archives; I just cannot find it though. I need to set up a rule so that all local attachments are allowed. So that when I have MailWatch release the message, it does not get scanned and blocked again. Thank you for your help. Billy Pumphrey IT Manager Wooden & McLaughlin ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jfagan at FIRSTLIGHTNETWORKS.COM Tue Aug 2 00:00:38 2005 From: jfagan at FIRSTLIGHTNETWORKS.COM (James Fagan) Date: Thu Jan 12 21:30:30 2006 Subject: unable to write pid to sendmail.pid Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of James D. Parra > Sent: Monday, August 01, 2005 3:45 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: [MAILSCANNER] unable to write pid to sendmail.pid > > >Try running: > > > > /etc/init.d/sendmail stop > > /etc/init.d/MailScanner stop > > > >Wait a minute or two, then run: > > > > killall sendmail > > > > service MailScanner start > > Sadly, the same thing occurs; > > Aug 1 15:30:12 sendmail-out[26867]: unable to write pid to > /var/run/sendmail.pid: file in use by another process > > I wonder if MailScanner is starting multiple instances of sendmail. > > ~James > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > Try running: ps -auxf That should show you what 'lead' proccess is running sendmail. Then kill that pid. Run the 'ps -auxf' command again to be sure you got it. I believe MailScanner runs 5 children by default. James Fagan ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Tue Aug 2 00:39:26 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:30 2006 Subject: unable to write pid to sendmail.pid Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] James D. Parra wrote: >Hello, > >Whenever I start MailScanner I get the following error: > >MailScanner # cat /var/log/mail.err >Jul 28 18:21:34 sendmail-out[12986]: unable to write pid to >/var/run/sendmail.pid: file in use by another process >Jul 29 15:46:35 sendmail-out[5624]: unable to write pid to >/var/run/sendmail.pid: file in use by another process >Aug 1 11:14:54 sendmail-out[25226]: unable to write pid to >/var/run/sendmail.pid: file in use by another process >Aug 1 13:12:13 sendmail-out[25885]: unable to write pid to >/var/run/sendmail.pid: file in use by another process >Aug 1 13:15:43 sendmail-out[26006]: unable to write pid to >/var/run/sendmail.pid: file in use by another process >Aug 1 13:57:47 sendmail-out[26165]: unable to write pid to >/var/run/sendmail.pid: file in use by another process > >No other application, outside of MailScanner starting sendmail, is running. > >Can someone point me in the right direction? > >Thank you, > >James > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > Your logs indicate otherwise. Try (I always get clobbered on this list when I say it :) ) "killall -9 sendmail; killall -9 MailScanner" and then start mailscanner again. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jamesp at MUSICREPORTS.COM Tue Aug 2 01:01:50 2005 From: Jamesp at MUSICREPORTS.COM (James D. Parra) Date: Thu Jan 12 21:30:30 2006 Subject: unable to write pid to sendmail.pid Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >Your logs indicate otherwise. Try (I always get clobbered on this list >when I say it :) ) "killall -9 sendmail; killall -9 MailScanner" and >then start mailscanner again. Still the same pesky error after stopping MailScanner and starting a fresh instance; # killall -9 sendmail sendmail: no process killed # killall -9 MailScanner MailScanner: no process killed # rcMailScanner start Initializing incoming sendmail done Initializing outgoing sendmail done Initializing MailScanner Aug 1 16:45:35 postmaster sendmail-out[27681]: unable to write pid to /var/run/sendmail.pid: file in use by another process Noticed that "Initializing MailScanner" doesn't show "done", although I do get the following; # ps auxf |grep MailScanner root 27904 0.0 0.0 1564 392 pts/0 R+ 16:48 0:00 \_ grep MailScanner root 27696 0.0 3.6 20396 17636 ? Ss 16:45 0:00 /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf root 27697 1.5 7.0 36688 33984 ? S 16:45 0:02 \_ /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf root 27699 2.0 7.0 36648 33980 ? S 16:45 0:02 \_ /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf root 27700 2.2 7.0 36648 33980 ? S 16:46 0:02 \_ /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf root 27886 2.2 7.0 36648 33980 ? S 16:46 0:02 \_ /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf root 27887 2.8 7.0 36672 33980 ? S 16:46 0:02 \_ /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf # rcMailScanner status Checking for service MailScanner: running ~James ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From abridge at HQTRS.COM Tue Aug 2 01:32:08 2005 From: abridge at HQTRS.COM (Aaron Bridge) Date: Thu Jan 12 21:30:30 2006 Subject: Want to be sure this program is what I need Message-ID: We have 55 users. Email is extremely important. Four hour downtime would be extremely bad for me. I don't even want to think about a full day of no email. Aaron -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Stephen Swaney Sent: Monday, August 01, 2005 6:41 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Want to be sure this program is what I need > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Aaron Bridge > Sent: Monday, August 01, 2005 4:58 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Want to be sure this program is what I need > > This program was recommended to me. I just want to be sure what I > want to do is possible with mailscanner. > > My companys user's POP email directly to their client from an outside > provider. I would like to set a server up that would POP the email > for the clients then filter the SPAM, and finally send the legit > messages to the proper user. > > Is Mailscanner with SpamAssasin what I need to be looking for to > accomplish this? Preferred method? Software? > > Thank you in advance > > Aaron You don't say anything about the number of users / volume of mail. This would be useful to know before recommending a configuration. One other question I like to ask is how critical email is to your business. Can you take a four hour hit or a day without email? We have some customers for whom business (and the money) stops or come to a crawl when email stops. Steve Stephen Swaney Fort Systems Ltd. stephen.swaney@fsl.com www.fsl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From stiret at ONEREDSHOE.NET Tue Aug 2 01:34:20 2005 From: stiret at ONEREDSHOE.NET (Scott Tiret) Date: Thu Jan 12 21:30:30 2006 Subject: unable to write pid to sendmail.pid Message-ID: On Mon, 2005-08-01 at 17:01 -0700, James D. Parra wrote: > >Your logs indicate otherwise. Try (I always get clobbered on this list > >when I say it :) ) "killall -9 sendmail; killall -9 MailScanner" and > >then start mailscanner again. Perhaps the two separate instances of Sendmail (incoming and outgoing) are trying to write to the same pid. Is there a way to make one of the processes write to a different pid? -- Scott Tiret ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "This is a digitally signed message part" ] [ Application/PGP-SIGNATURE 196bytes. ] [ Unable to print this part. ] From steve.swaney at fsl.com Tue Aug 2 01:59:50 2005 From: steve.swaney at fsl.com (Stephen Swaney) Date: Thu Jan 12 21:30:30 2006 Subject: unable to write pid to sendmail.pid Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of James D. Parra > Sent: Monday, August 01, 2005 8:02 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: unable to write pid to sendmail.pid > > >Your logs indicate otherwise. Try (I always get clobbered on this list > >when I say it :) ) "killall -9 sendmail; killall -9 MailScanner" and > >then start mailscanner again. > > Still the same pesky error after stopping MailScanner and starting a fresh > instance; > > # killall -9 sendmail > sendmail: no process killed > # killall -9 MailScanner > MailScanner: no process killed > > # rcMailScanner start > Initializing incoming sendmail done > Initializing outgoing sendmail done > Initializing MailScanner > > Aug 1 16:45:35 postmaster sendmail-out[27681]: unable to write pid to > /var/run/sendmail.pid: file in use by another process > > Noticed that "Initializing MailScanner" doesn't show "done", although I do > get the following; > > # ps auxf |grep MailScanner > root 27904 0.0 0.0 1564 392 pts/0 R+ 16:48 0:00 > \_ > grep MailScanner > root 27696 0.0 3.6 20396 17636 ? Ss 16:45 0:00 > /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner > /etc/MailScanner/MailScanner.conf > root 27697 1.5 7.0 36688 33984 ? S 16:45 0:02 \_ > /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner > /etc/MailScanner/MailScanner.conf > root 27699 2.0 7.0 36648 33980 ? S 16:45 0:02 \_ > /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner > /etc/MailScanner/MailScanner.conf > root 27700 2.2 7.0 36648 33980 ? S 16:46 0:02 \_ > /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner > /etc/MailScanner/MailScanner.conf > root 27886 2.2 7.0 36648 33980 ? S 16:46 0:02 \_ > /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner > /etc/MailScanner/MailScanner.conf > root 27887 2.8 7.0 36672 33980 ? S 16:46 0:02 \_ > /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner > /etc/MailScanner/MailScanner.conf > # rcMailScanner status > Checking for service MailScanner: > running > > > ~James Try: Stopping all sendmail and MailScanner processes rm /var/run/sendmail.pid starting MailScanner Steve Stephen Swaney Fort Systems Ltd. stephen.swaney@fsl.com www.fsl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bg.mahesh at INDIAINFO.COM Tue Aug 2 07:52:45 2005 From: bg.mahesh at INDIAINFO.COM (BG Mahesh) Date: Thu Jan 12 21:30:30 2006 Subject: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 Message-ID: I have installed Archive-Zip-1.16. The error message I get while installing MS 4.44.6-1 is, Oh good, module Convert::TNEF version 0.17 is already installed. Oh good, module Compress::Zlib version 1.34 is already installed. Oh good, module Archive::Zip version 1.14 is already installed. Installing tnef decoder Preparing... ########################################### [100%] package tnef-1.2.3.1-1 is already installed Now to install MailScanner itself. error: Failed dependencies: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 -- B.G. Mahesh bg.mahesh@indiainfo.com http://www.indiainfo.com/ -- ______________________________________________ IndiaInfo Mail - the free e-mail service with a difference! www.indiainfo.com Check out our value-added Premium features, such as an extra 20MB for mail storage, POP3, e-mail forwarding, and ads-free mailboxes! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From anders.andersson at LTKALMAR.SE Tue Aug 2 07:54:36 2005 From: anders.andersson at LTKALMAR.SE (Anders Andersson, IT) Date: Thu Jan 12 21:30:30 2006 Subject: Basic Rules question Message-ID: > -----Original Message----- > Subject: Basic Rules question > > I would be amazed if the answer to this question was not in > the archives; I just cannot find it though. > > I need to set up a rule so that all local attachments are > allowed. So that when I have MailWatch release the message, > it does not get scanned and blocked again. > > Thank you for your help. > > > Billy Pumphrey > IT Manager > Wooden & McLaughlin Shouldnt that be a rules stating that when localhost sending dont do filname/filetype check. I guess you still want AV-check to run ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 2 08:23:00 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:30 2006 Subject: Basic Rules question Message-ID: This is covered in the new version of The Book. You need to use a different filename.rules.conf for localhost from the one you use for everywhere else. On 2 Aug 2005, at 00:02, Billy A. Pumphrey wrote: > I would be amazed if the answer to this question was not in the > archives; I just cannot find it though. > > I need to set up a rule so that all local attachments are allowed. So > that when I have MailWatch release the message, it does not get > scanned > and blocked again. > > Thank you for your help. > > > Billy Pumphrey > IT Manager > Wooden & McLaughlin > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 2 08:24:09 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:30 2006 Subject: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 Message-ID: Install Archive::Zip using CPAN and see if that clears the error. Is there a chance you have 2 copies of perl installed? On 2 Aug 2005, at 07:52, BG Mahesh wrote: > I have installed Archive-Zip-1.16. The error message I get while > installing MS 4.44.6-1 is, > > Oh good, module Convert::TNEF version 0.17 is already installed. > Oh good, module Compress::Zlib version 1.34 is already installed. > Oh good, module Archive::Zip version 1.14 is already installed. > > Installing tnef decoder > > Preparing... > ########################################### [100%] > package tnef-1.2.3.1-1 is already installed > > Now to install MailScanner itself. > > error: Failed dependencies: > perl(Archive::Zip) is needed by mailscanner-4.44.6-1 > > > -- > B.G. Mahesh > bg.mahesh@indiainfo.com > http://www.indiainfo.com/ > > > -- > ______________________________________________ > IndiaInfo Mail - the free e-mail service with a difference! > www.indiainfo.com > Check out our value-added Premium features, such as an extra 20MB > for mail storage, POP3, e-mail forwarding, and ads-free mailboxes! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pete at ENITECH.COM.AU Tue Aug 2 08:35:29 2005 From: pete at ENITECH.COM.AU (Pete Russell) Date: Thu Jan 12 21:30:30 2006 Subject: tnef screwed up my queue Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] will 4.44-6 version of MailScanner fix this? Julian Field wrote: > Attached is a patch to TNEF.pm to fix this problem. > > Please let me know how you get on with this. > > Adri Koppes wrote: > >>> -----Original Message----- >>> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >>> Behalf Of Julian Field >>> Sent: Monday, August 01, 2005 15:36 >>> To: MAILSCANNER@JISCMAIL.AC.UK >>> Subject: Re: tnef screwed up my queue >>> >>> Adri Koppes wrote: >>> >>> >>> >>>>> -----Original Message----- >>>>> From: MailScanner mailing list >>>>> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Denis Beauchemin >>>>> Sent: Monday, August 01, 2005 15:16 >>>>> To: MAILSCANNER@JISCMAIL.AC.UK >>>>> Subject: Re: tnef screwed up my queue >>>>> >>>>> Julian Field wrote: >>>>> >>>>> >>>>> >>>>> >>>>>> Please can you copy a TNEF Postfix message file on a web >>>>>> >>>>>> >>>>> >>>>> site and mail >>>>> >>>>> >>>>> >>>>>> me a URL? >>>>>> I need something to try it with. I suspect I'm just >>> >>> missing a chdir >>> >>>>>> somewhere. >>>>>> >>>>>> >>>>>> >>>>> >>>>> Julian, >>>>> >>>>> I also get leftover tnef files in mqueue.in and I am using >>> >>> sendmail on >>> >>>>> RHEL 3/4 with various MS versions (4 different from 4.34 to 4.40). >>>>> Fortunately sendmail is not affected my those leftovers. >>>>> >>>>> Denis >>>>> >>>>> >>>> >>>> Julian, >>>> >>>> I also get occasional tnef files in my mqueue.in, using >>> >>> sendmail 8.13.1 >>> >>>> and MS 4.4x. >>>> >>>> >>>> >>> >>> What filenames are they? >>> >> >> >> Julian, >> >> Here an example of my config, mqueue.in and maillog. >> >> MailScanner.conf contains: >> >> Expand TNEF = yes >> Deliver Unparsable TNEF = no >> TNEF Expander = internal >> TNEF Timeout = 120 >> >> /var/spool/mqueue.in contains: >> >> # ls -l /var/spool/mqueue.in >> total 84 >> -rw-r--r-- 1 root daemon 7344 Jun 10 06:35 tnef-7769-1.doc >> -rw-r--r-- 1 root daemon 76800 Jun 10 06:35 tnef-7769-2.doc >> >> /var/log/maillog contains: >> >> Jun 10 06:35:44 mail MailScanner[7769]: New Batch: Scanning 1 messages, >> 116569 bytes Jun 10 06:35:51 mail MailScanner[7769]: Expanding TNEF >> archive at >> /var/spool/MailScanner/incoming/7769/j5A4ZUTm008140/winmail.dat >> Jun 10 06:35:51 mail MailScanner[7769]: Corrupt TNEF winmail.dat that >> cannot be analysed in message j5A4ZUTm008140 Jun 10 06:35:51 mail >> MailScanner[7769]: Virus and Content Scanning: Starting Jun 10 06:35:51 >> mail MailScanner[7769]: SophosSAVI::ERROR:: Sweep could not proceed, the >> file was corrupted (538):: ./j5A4ZUTm008140/winmail.dat Jun 10 06:35:52 >> mail MailScanner[7769]: Virus Scanning: SophosSAVI found 1 infections >> Jun 10 06:35:52 mail MailScanner[7769]: ClamAVModule::LibClamAV Error: >> Error reading TNEF message Jun 10 06:35:52 mail MailScanner[7769]: Virus >> Scanning: ClamAV Module found 1 infections Jun 10 06:35:53 mail >> MailScanner[7769]: Infected message j5A4ZUTm008140 came from >> xxx.xx.xxx.xx >> >> Adri. >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at gmail.com Tue Aug 2 09:12:24 2005 From: glenn.steen at gmail.com (Glenn Steen) Date: Thu Jan 12 21:30:30 2006 Subject: Want to be sure this program is what I need Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 02/08/05, Aaron Bridge wrote: > We have 55 users. Email is extremely important. Four hour downtime would be > extremely bad for me. I don't even want to think about a full day of no > email. > > Aaron > Sounds to me as if you should explore setting up your own MTA and POP/IMAP server then (bringing the email home, so to speak:-). This might sound as a lot of wourk, and it actually might be that initially (reading up on things, configuring&testing&....), but in the long run you'll be gratified by having more control over the whole email process. If you decide to do that, then MailScanner is definitely for you. -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pz at CHRIST-NET.SK Tue Aug 2 09:13:17 2005 From: pz at CHRIST-NET.SK (Peter Zimen) Date: Thu Jan 12 21:30:30 2006 Subject: Failed install of mailscanner-4.44.6-1 Message-ID: In last step - mailscanner install itself i see error: error: Failed dependencies: perl(HTML::Entities) is needed by mailscanner-4.44.6-1 perl(HTML::Parser) is needed by mailscanner-4.44.6-1 perl(HTML::TokeParser) is needed by mailscanner-4.44.6-1 I was check this perl modules via CPAN and this modules are installed up to date version. --- S pozdravom Peter Zimen ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Application/PKCS7-SIGNATURE 3.2KB. ] [ Unable to print this part. ] From MailScanner at ecs.soton.ac.uk Tue Aug 2 09:24:14 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:30 2006 Subject: Failed install of mailscanner-4.44.6-1 Message-ID: Did you run the ./install.sh script in the download tar.gz file? Sounds like HTML-Parser failed to install properly. Check the output of the install.sh script when it is building HTML-Parser, there should be some clues there. On 2 Aug 2005, at 09:13, Peter Zimen wrote: > In last step - mailscanner install itself i see error: > > error: Failed dependencies: > perl(HTML::Entities) is needed by mailscanner-4.44.6-1 > perl(HTML::Parser) is needed by mailscanner-4.44.6-1 > perl(HTML::TokeParser) is needed by mailscanner-4.44.6-1 > > > I was check this perl modules via CPAN and this modules are > installed up to date version. > > > > --- > > S pozdravom > > Peter Zimen > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pz at CHRIST-NET.SK Tue Aug 2 09:40:21 2005 From: pz at CHRIST-NET.SK (Peter Zimen) Date: Thu Jan 12 21:30:30 2006 Subject: Failed install of mailscanner-4.44.6-1 Message-ID: I install RPM distribution. Oh good, module HTML::Parser version 3.45 is already installed. --- S pozdravom Peter Zimen On 2.8.2005, at 10:24, Julian Field wrote: > Did you run the ./install.sh script in the download tar.gz file? > Sounds like HTML-Parser failed to install properly. Check the > output of the install.sh script when it is building HTML-Parser, > there should be some clues there. > > On 2 Aug 2005, at 09:13, Peter Zimen wrote: > > >> In last step - mailscanner install itself i see error: >> >> error: Failed dependencies: >> perl(HTML::Entities) is needed by mailscanner-4.44.6-1 >> perl(HTML::Parser) is needed by mailscanner-4.44.6-1 >> perl(HTML::TokeParser) is needed by mailscanner-4.44.6-1 >> >> >> I was check this perl modules via CPAN and this modules are >> installed up to date version. >> >> >> >> --- >> >> S pozdravom >> >> Peter Zimen >> >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Application/PKCS7-SIGNATURE 3.2KB. ] [ Unable to print this part. ] From dhawal at NETMAGICSOLUTIONS.COM Tue Aug 2 10:12:48 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:30:30 2006 Subject: 'St*ck Picks' spam Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Tim Sailer wrote: > Has anyone figured out how to keep these things under control? > > Tim > Check http://www.wormbytes.ca/software/spamassassin/rules.cf and search for FSR_MASKED_FINANCIAL, this rule is what you need to add your local.cf (or wherever you add local rules) You could expand the rule to include pr*fit, auth*rity, l*w and st*cks (as compared to st*ck) or remove the '\b' from the rule. - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 2 09:51:52 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:30 2006 Subject: Failed install of mailscanner-4.44.6-1 Message-ID: In which case try installing HTML-Parser from CPAN. On 2 Aug 2005, at 09:40, Peter Zimen wrote: > I install RPM distribution. > > Oh good, module HTML::Parser version 3.45 is already installed. > > > --- > > S pozdravom > > Peter Zimen > > On 2.8.2005, at 10:24, Julian Field wrote: > > >> Did you run the ./install.sh script in the download tar.gz file? >> Sounds like HTML-Parser failed to install properly. Check the >> output of the install.sh script when it is building HTML-Parser, >> there should be some clues there. >> >> On 2 Aug 2005, at 09:13, Peter Zimen wrote: >> >> >> >>> In last step - mailscanner install itself i see error: >>> >>> error: Failed dependencies: >>> perl(HTML::Entities) is needed by mailscanner-4.44.6-1 >>> perl(HTML::Parser) is needed by mailscanner-4.44.6-1 >>> perl(HTML::TokeParser) is needed by mailscanner-4.44.6-1 >>> >>> >>> I was check this perl modules via CPAN and this modules are >>> installed up to date version. >>> >>> >>> >>> --- >>> >>> S pozdravom >>> >>> Peter Zimen >>> >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >>> >> >> -- >> Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bjoern.koester at MEDIATA.NET Tue Aug 2 10:25:27 2005 From: bjoern.koester at MEDIATA.NET ([utf-8] BjĂśrn [utf-8] KĂśster) Date: Thu Jan 12 21:30:30 2006 Subject: Failed install of mailscanner-4.44.6-1 Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I always get the same error. First I tried to install version 4.44.5-1. It failed. Trying version 4.44.6-1, it failed too. The install of version 4.44.6-1 always fails with tihs error: Now to install MailScanner itself. error: failed dependencies: perl(AnyDBM_File) is needed by mailscanner-4.44.6-1 perl(Archive::Zip) is needed by mailscanner-4.44.6-1 perl(bytes) is needed by mailscanner-4.44.6-1 perl(Carp) is needed by mailscanner-4.44.6-1 perl(Cwd) is needed by mailscanner-4.44.6-1 perl(Data::Dumper) is needed by mailscanner-4.44.6-1 perl(DirHandle) is needed by mailscanner-4.44.6-1 perl(Env) is needed by mailscanner-4.44.6-1 perl(Fcntl) is needed by mailscanner-4.44.6-1 perl(File::Basename) is needed by mailscanner-4.44.6-1 perl(File::Copy) is needed by mailscanner-4.44.6-1 perl(FileHandle) is needed by mailscanner-4.44.6-1 perl(File::Path) is needed by mailscanner-4.44.6-1 perl(HTML::Entities) is needed by mailscanner-4.44.6-1 perl(HTML::Parser) is needed by mailscanner-4.44.6-1 perl(HTML::TokeParser) is needed by mailscanner-4.44.6-1 perl(IO) is needed by mailscanner-4.44.6-1 perl(IO::File) is needed by mailscanner-4.44.6-1 perl(IO::Handle) is needed by mailscanner-4.44.6-1 perl(IO::Pipe) is needed by mailscanner-4.44.6-1 perl(IPC::Open2) is needed by mailscanner-4.44.6-1 perl(MIME::Decoder::BinHex) is needed by mailscanner-4.44.6-1 perl(MIME::Decoder::UU) is needed by mailscanner-4.44.6-1 perl(MIME::Head) is needed by mailscanner-4.44.6-1 perl(MIME::Parser) is needed by mailscanner-4.44.6-1 perl(MIME::WordDecoder) is needed by mailscanner-4.44.6-1 perl(Net::CIDR) is needed by mailscanner-4.44.6-1 perl(Net::FTP) is needed by mailscanner-4.44.6-1 perl(POSIX) is needed by mailscanner-4.44.6-1 perl(Socket) is needed by mailscanner-4.44.6-1 perl(strict) is needed by mailscanner-4.44.6-1 perl(Sys::Syslog) is needed by mailscanner-4.44.6-1 perl(Time::localtime) is needed by mailscanner-4.44.6-1 perl(vars) is needed by mailscanner-4.44.6-1 Please buy the MailScanner book from www.mailscanner.info! It is a very useful administration guide and introduction to MailScanner. All the proceeds go directly to making MailScanner a better supported package than it is today. I checked all this module in my cpan. They are all installed and nearly up to date. Any hints? BjĂśrn Quoting Peter Zimen : > In last step - mailscanner install itself i see error: > > error: Failed dependencies: > perl(HTML::Entities) is needed by mailscanner-4.44.6-1 > perl(HTML::Parser) is needed by mailscanner-4.44.6-1 > perl(HTML::TokeParser) is needed by mailscanner-4.44.6-1 > > > I was check this perl modules via CPAN and this modules are installed > up to date version. > > > > --- > > S pozdravom > > Peter Zimen > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > Mit freundlichem GrĂźĂ^ßen Best Regards BjĂśrn KĂśster ====================================================================== MEDIATA Communications GmbH KĂślner StraĂ^ße 94-96 / 53840 Troisdorf / Germany Email: info@mediata.net / Web: www.mediata.net Tel: +49 (0)2241 809 323 / Fax: +49 (0)2241 809 324 ====================================================================== ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bjoern.koester at MEDIATA.NET Tue Aug 2 09:46:12 2005 From: bjoern.koester at MEDIATA.NET ([utf-8] BjĂśrn [utf-8] KĂśster) Date: Thu Jan 12 21:30:30 2006 Subject: Failed install of mailscanner-4.44.6-1 Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I always get the same error. First I tried to install version 4.44.5-1. It failed. Trying version 4.44.6-1, it failed too. The install of version 4.44.6-1 always fails with tihs error: Now to install MailScanner itself. error: failed dependencies: perl(AnyDBM_File) is needed by mailscanner-4.44.6-1 perl(Archive::Zip) is needed by mailscanner-4.44.6-1 perl(bytes) is needed by mailscanner-4.44.6-1 perl(Carp) is needed by mailscanner-4.44.6-1 perl(Cwd) is needed by mailscanner-4.44.6-1 perl(Data::Dumper) is needed by mailscanner-4.44.6-1 perl(DirHandle) is needed by mailscanner-4.44.6-1 perl(Env) is needed by mailscanner-4.44.6-1 perl(Fcntl) is needed by mailscanner-4.44.6-1 perl(File::Basename) is needed by mailscanner-4.44.6-1 perl(File::Copy) is needed by mailscanner-4.44.6-1 perl(FileHandle) is needed by mailscanner-4.44.6-1 perl(File::Path) is needed by mailscanner-4.44.6-1 perl(HTML::Entities) is needed by mailscanner-4.44.6-1 perl(HTML::Parser) is needed by mailscanner-4.44.6-1 perl(HTML::TokeParser) is needed by mailscanner-4.44.6-1 perl(IO) is needed by mailscanner-4.44.6-1 perl(IO::File) is needed by mailscanner-4.44.6-1 perl(IO::Handle) is needed by mailscanner-4.44.6-1 perl(IO::Pipe) is needed by mailscanner-4.44.6-1 perl(IPC::Open2) is needed by mailscanner-4.44.6-1 perl(MIME::Decoder::BinHex) is needed by mailscanner-4.44.6-1 perl(MIME::Decoder::UU) is needed by mailscanner-4.44.6-1 perl(MIME::Head) is needed by mailscanner-4.44.6-1 perl(MIME::Parser) is needed by mailscanner-4.44.6-1 perl(MIME::WordDecoder) is needed by mailscanner-4.44.6-1 perl(Net::CIDR) is needed by mailscanner-4.44.6-1 perl(Net::FTP) is needed by mailscanner-4.44.6-1 perl(POSIX) is needed by mailscanner-4.44.6-1 perl(Socket) is needed by mailscanner-4.44.6-1 perl(strict) is needed by mailscanner-4.44.6-1 perl(Sys::Syslog) is needed by mailscanner-4.44.6-1 perl(Time::localtime) is needed by mailscanner-4.44.6-1 perl(vars) is needed by mailscanner-4.44.6-1 Please buy the MailScanner book from www.mailscanner.info! It is a very useful administration guide and introduction to MailScanner. All the proceeds go directly to making MailScanner a better supported package than it is today. I checked all this module in my cpan. They are all installed and nearly up to date. Any hints? BjĂśrn Quoting Peter Zimen : > In last step - mailscanner install itself i see error: > > error: Failed dependencies: > perl(HTML::Entities) is needed by mailscanner-4.44.6-1 > perl(HTML::Parser) is needed by mailscanner-4.44.6-1 > perl(HTML::TokeParser) is needed by mailscanner-4.44.6-1 > > > I was check this perl modules via CPAN and this modules are installed > up to date version. > > > > --- > > S pozdravom > > Peter Zimen > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > Mit freundlichem GrĂźĂ^ßen Best Regards BjĂśrn KĂśster ====================================================================== MEDIATA Communications GmbH KĂślner StraĂ^ße 94-96 / 53840 Troisdorf / Germany Email: info@mediata.net / Web: www.mediata.net Tel: +49 (0)2241 809 323 / Fax: +49 (0)2241 809 324 ====================================================================== ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "Digitale PGP-Unterschrift" Application/PGP-SIGNATURE ] [ 205bytes. ] [ Unable to print this part. ] From bg.mahesh at INDIAINFO.COM Tue Aug 2 11:25:36 2005 From: bg.mahesh at INDIAINFO.COM (BG Mahesh) Date: Thu Jan 12 21:30:30 2006 Subject: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 Message-ID: ----- Original Message ----- From: "Julian Field" > > Install Archive::Zip using CPAN and see if that clears the error. # perl -MCPAN -e "install Archive::Zip" Can't locate object method "install" via package "Archive::Zip" at -e line 1. > Is there a chance you have 2 copies of perl installed? > Nops..just one # whereis perl perl: /usr/bin/perl /usr/local/bin/perl /usr/share/man/man1/perl.1.gz # ls -al /usr/bin/perl /usr/local/bin/perl lrwxrwxrwx 1 root root 19 Mar 5 2004 /usr/bin/perl -> /usr/local/bin/perl -rwxr-xr-x 2 root root 1004651 Mar 5 2004 /usr/local/bin/perl > On 2 Aug 2005, at 07:52, BG Mahesh wrote: > > > I have installed Archive-Zip-1.16. The error message I get while > > installing MS 4.44.6-1 is, > > > > Oh good, module Convert::TNEF version 0.17 is already installed. > > Oh good, module Compress::Zlib version 1.34 is already installed. > > Oh good, module Archive::Zip version 1.14 is already installed. > > > > Installing tnef decoder > > > > Preparing... > > ########################################### [100%] > > package tnef-1.2.3.1-1 is already installed > > > > Now to install MailScanner itself. > > > > error: Failed dependencies: > > perl(Archive::Zip) is needed by mailscanner-4.44.6-1 > > > > > > -- > > B.G. Mahesh > > bg.mahesh@indiainfo.com > > http://www.indiainfo.com/ > > > > > > -- ______________________________________________ > > IndiaInfo Mail - the free e-mail service with a difference! > > www.indiainfo.com > > Check out our value-added Premium features, such as an extra 20MB > > for mail storage, POP3, e-mail forwarding, and ads-free > > mailboxes! > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > -- Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- B.G. Mahesh bg.mahesh@indiainfo.com http://www.indiainfo.com/ -- ______________________________________________ IndiaInfo Mail - the free e-mail service with a difference! www.indiainfo.com Check out our value-added Premium features, such as an extra 20MB for mail storage, POP3, e-mail forwarding, and ads-free mailboxes! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Carl.Boberg at NRM.SE Tue Aug 2 12:27:42 2005 From: Carl.Boberg at NRM.SE (Carl Boberg) Date: Thu Jan 12 21:30:30 2006 Subject: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 Message-ID: Hi, I have the same error. Install works fine with ./install.sh nodeps and MailScanner works ok after that. / C > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of BG Mahesh > Sent: den 2 augusti 2005 12:26 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 > > ----- Original Message ----- > From: "Julian Field" > > > > > > Install Archive::Zip using CPAN and see if that clears the error. > > # perl -MCPAN -e "install Archive::Zip" > Can't locate object method "install" via package > "Archive::Zip" at -e line 1. > > > > Is there a chance you have 2 copies of perl installed? > > > > Nops..just one > > # whereis perl > perl: /usr/bin/perl /usr/local/bin/perl /usr/share/man/man1/perl.1.gz > > # ls -al /usr/bin/perl /usr/local/bin/perl > lrwxrwxrwx 1 root root 19 Mar 5 2004 > /usr/bin/perl -> /usr/local/bin/perl > -rwxr-xr-x 2 root root 1004651 Mar 5 2004 > /usr/local/bin/perl > > > > On 2 Aug 2005, at 07:52, BG Mahesh wrote: > > > > > I have installed Archive-Zip-1.16. The error message I get while > > > installing MS 4.44.6-1 is, > > > > > > Oh good, module Convert::TNEF version 0.17 is already installed. > > > Oh good, module Compress::Zlib version 1.34 is already installed. > > > Oh good, module Archive::Zip version 1.14 is already installed. > > > > > > Installing tnef decoder > > > > > > Preparing... > > > ########################################### [100%] > > > package tnef-1.2.3.1-1 is already installed > > > > > > Now to install MailScanner itself. > > > > > > error: Failed dependencies: > > > perl(Archive::Zip) is needed by mailscanner-4.44.6-1 > > > > > > > > > -- > > > B.G. Mahesh > > > bg.mahesh@indiainfo.com > > > http://www.indiainfo.com/ > > > > > > > > > -- ______________________________________________ > > > IndiaInfo Mail - the free e-mail service with a difference! > > > www.indiainfo.com > > > Check out our value-added Premium features, such as an > extra 20MB > > > for mail storage, POP3, e-mail forwarding, and ads-free mailboxes! > > > > > > ------------------------ MailScanner list > ------------------------ > > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > > 'leave mailscanner' in the body of the email. > > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > -- Julian Field > > www.MailScanner.info > > Buy the MailScanner book at www.MailScanner.info/store PGP > footprint: > > EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki > (http://wiki.mailscanner.info/) and the > > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > -- > B.G. Mahesh > bg.mahesh@indiainfo.com > http://www.indiainfo.com/ > > > -- > ______________________________________________ > IndiaInfo Mail - the free e-mail service with a difference! > www.indiainfo.com Check out our value-added Premium features, > such as an extra 20MB for mail storage, POP3, e-mail > forwarding, and ads-free mailboxes! > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at gmail.com Tue Aug 2 12:44:24 2005 From: glenn.steen at gmail.com (Glenn Steen) Date: Thu Jan 12 21:30:30 2006 Subject: unable to write pid to sendmail.pid Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] (This time to the list, not only Steve:-) Um, why not try determine exactly what is keeping it open? fuser -u /var/run/sendmail.pid could be a start. -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From gmatt at nerc.ac.uk Tue Aug 2 13:10:50 2005 From: gmatt at nerc.ac.uk (Greg Matthews) Date: Thu Jan 12 21:30:30 2006 Subject: IE vulnerability Message-ID: I have this in my MailScanner.conf which I think was put in by my predecessor: # IE explorer spoofing uri IE_VULN /%([01][0-9a-f]|7f).*@/i score IE_VULN 100.0 describe IE_VULN Internet Explorer vulnerability I think this is stopping some legit mail and I cant find much regarding this from google. Does anyone else use this? is it (still) necessary? GREG -- Greg Matthews 01491 692445 Head of UNIX/Linux, iTSS Wallingford ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 2 13:42:46 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:30 2006 Subject: IE vulnerability Message-ID: Please do not send mail to the list with the Reply-To set to be just you. Half the point of having a list is to allow other people to see the solutions. I wrote that rule quite a long time ago now, and I believe that Microsoft patched the hole. You should be able to delete it now. If it is causing problems, I'll remove it from the distribution. On 2 Aug 2005, at 13:10, Greg Matthews wrote: > I have this in my MailScanner.conf which I think was put in by my > predecessor: > > # IE explorer spoofing > uri IE_VULN /%([01][0-9a-f]|7f).*@/i > score IE_VULN 100.0 > describe IE_VULN Internet Explorer vulnerability > > I think this is stopping some legit mail and I cant find much > regarding > this from google. Does anyone else use this? is it (still) necessary? -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ebruce at HPMICH.COM Tue Aug 2 13:47:36 2005 From: ebruce at HPMICH.COM (Ed Bruce) Date: Thu Jan 12 21:30:30 2006 Subject: Basic Rules question Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > This is covered in the new version of The Book. > You need to use a different filename.rules.conf for localhost from > the one you use for everywhere else. > I now have three different filename and filetype rules. I've added allow for 127.0.0.1 and a relaxed for privileged users, i.e. all the company officers that want to send/receive mpeg and avi files :) ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Tue Aug 2 14:11:57 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:30 2006 Subject: SpamAssassin: where is my SPAM? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mark Arrasmith wrote: > I'm running RedHat Enterprise 3, MailScanner 4.43.8, SpamAssassin 3.0.4, DCC, > pyzor, RulesDuJour, and Sophos Antivirus. This is an update from previous > versions of MailScanner and SpamAssassin. > > In MailScanner.conf I have the spam action rules as ... > Spam Actions = deliver attachment > > But, ever since I updated SpamAssassin (from 2.55 -> 3.0.4) I now get all the > Spam being deleted. What can I do to track this down? I'd like to be able > to run on "deliver" for a couple of weeks before just deleting all incoming > spam. Are you sure it is not high-scoring spam that gets deleted? > > - mark > -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Tue Aug 2 14:12:53 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:30 2006 Subject: Failed install of mailscanner-4.44.6-1 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Björn Köster wrote: > I always get the same error. First I tried to install version 4.44.5-1. It > failed. Trying version 4.44.6-1, it failed too. > > The install of version 4.44.6-1 always fails with tihs error: > > Now to install MailScanner itself. > > error: failed dependencies: > perl(AnyDBM_File) is needed by mailscanner-4.44.6-1 > perl(Archive::Zip) is needed by mailscanner-4.44.6-1 > perl(bytes) is needed by mailscanner-4.44.6-1 > perl(Carp) is needed by mailscanner-4.44.6-1 > perl(Cwd) is needed by mailscanner-4.44.6-1 > perl(Data::Dumper) is needed by mailscanner-4.44.6-1 > perl(DirHandle) is needed by mailscanner-4.44.6-1 > perl(Env) is needed by mailscanner-4.44.6-1 > perl(Fcntl) is needed by mailscanner-4.44.6-1 > perl(File::Basename) is needed by mailscanner-4.44.6-1 > perl(File::Copy) is needed by mailscanner-4.44.6-1 > perl(FileHandle) is needed by mailscanner-4.44.6-1 > perl(File::Path) is needed by mailscanner-4.44.6-1 > perl(HTML::Entities) is needed by mailscanner-4.44.6-1 > perl(HTML::Parser) is needed by mailscanner-4.44.6-1 > perl(HTML::TokeParser) is needed by mailscanner-4.44.6-1 > perl(IO) is needed by mailscanner-4.44.6-1 > perl(IO::File) is needed by mailscanner-4.44.6-1 > perl(IO::Handle) is needed by mailscanner-4.44.6-1 > perl(IO::Pipe) is needed by mailscanner-4.44.6-1 > perl(IPC::Open2) is needed by mailscanner-4.44.6-1 > perl(MIME::Decoder::BinHex) is needed by mailscanner-4.44.6-1 > perl(MIME::Decoder::UU) is needed by mailscanner-4.44.6-1 > perl(MIME::Head) is needed by mailscanner-4.44.6-1 > perl(MIME::Parser) is needed by mailscanner-4.44.6-1 > perl(MIME::WordDecoder) is needed by mailscanner-4.44.6-1 > perl(Net::CIDR) is needed by mailscanner-4.44.6-1 > perl(Net::FTP) is needed by mailscanner-4.44.6-1 > perl(POSIX) is needed by mailscanner-4.44.6-1 > perl(Socket) is needed by mailscanner-4.44.6-1 > perl(strict) is needed by mailscanner-4.44.6-1 > perl(Sys::Syslog) is needed by mailscanner-4.44.6-1 > perl(Time::localtime) is needed by mailscanner-4.44.6-1 > perl(vars) is needed by mailscanner-4.44.6-1 Are you using the install.sh script? -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From gmatt at NERC.AC.UK Tue Aug 2 14:35:33 2005 From: gmatt at NERC.AC.UK (Greg Matthews) Date: Thu Jan 12 21:30:30 2006 Subject: IE vulnerability Message-ID: On Tue, 2005-08-02 at 13:42 +0100, Julian Field wrote: > Please do not send mail to the list with the Reply-To set to be just > you. Half the point of having a list is to allow other people to see > the solutions. beg pardon - didnt realise it was set at all until now....! > I wrote that rule quite a long time ago now, and I believe that > Microsoft patched the hole. You should be able to delete it now. If > it is causing problems, I'll remove it from the distribution. great - I'll lower the score for now with a view to discontinuing it. Thanks for the quick response. GREG > > On 2 Aug 2005, at 13:10, Greg Matthews wrote: > > > I have this in my MailScanner.conf which I think was put in by my > > predecessor: > > > > # IE explorer spoofing > > uri IE_VULN /%([01][0-9a-f]|7f).*@/i > > score IE_VULN 100.0 > > describe IE_VULN Internet Explorer vulnerability > > > > I think this is stopping some legit mail and I cant find much > > regarding > > this from google. Does anyone else use this? is it (still) necessary? > -- Greg Matthews 01491 692445 Head of UNIX/Linux, iTSS Wallingford ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dannyh at aac-services.co.uk Tue Aug 2 15:28:53 2005 From: dannyh at aac-services.co.uk (Dan Harris) Date: Thu Jan 12 21:30:30 2006 Subject: New eBay phishing Message-ID: Hi, Would MailScanner's phishing detection catch this: http://www.techworld.com/security/news/index.cfm?NewsID=4142&email? Dan Harris. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From remy at UNIX-ASP.COM Tue Aug 2 15:59:19 2005 From: remy at UNIX-ASP.COM (Remy de Ruysscher) Date: Thu Jan 12 21:30:30 2006 Subject: MailScanner won'r run anymore? *URGENT* Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] MailScanner won't start anymore after stopping. I can't figure out what's causing the trouble. Nothing is showing up in the maillogs at all! When I use debug = yes I get: Starting MailScanner... In Debugging mode, not forking... unix dgram connect: No such file or directory at /usr/local/lib/MailScanner/MailScanner/Log.pm line 143 no connection to syslog available at /usr/local/lib/MailScanner/MailScanner/Log.pm line 143 --- FreeBSD 5.4-RELEASE-p4 FreeBSD 5.4-RELEASE-p4 #6: Mon Jul 11 13:23:43 CEST 2005 This is Perl version 5.008007 (5.8.7) This is MailScanner version 4.43.8 Module versions are: 1.00 AnyDBM_File 1.16 Archive::Zip 1.04 Carp 1.119 Convert::BinHex 1.00 DirHandle 1.05 Fcntl 2.73 File::Basename 2.08 File::Copy 2.01 FileHandle 1.07 File::Path 0.16 File::Temp 1.29 HTML::Entities 3.45 HTML::Parser 2.30 HTML::TokeParser 1.21 IO 1.11 IO::File 1.123 IO::Pipe 1.67 Mail::Header 3.05 MIME::Base64 5.417 MIME::Decoder 5.417 MIME::Decoder::UU 5.417 MIME::Head 5.417 MIME::Parser 3.03 MIME::QuotedPrint 5.417 MIME::Tools 0.10 Net::CIDR 1.08 POSIX 1.77 Socket 0.06 Sys::Syslog 1.02 Time::localtime Optional module versions are: 1.811 DB_File 1.10 Digest missing Digest::HMAC 2.33 Digest::MD5 missing Digest::SHA1 missing Inline missing Mail::ClamAV missing Mail::SpamAssassin missing Mail::SPF::Query missing Net::CIDR::Lite missing Net::DNS missing Net::LDAP missing Parse::RecDescent missing SAVI missing Sys::Hostname::Long 2.52 Test::Harness 0.6 Test::Simple 1.95 Text::Balanced missing URI Please help me out! Regards, Remy. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From davidj at synaq.com Tue Aug 2 16:01:43 2005 From: davidj at synaq.com (David Jacobson) Date: Thu Jan 12 21:30:30 2006 Subject: MailScanner won'r run anymore? *URGENT* Message-ID: Is your Syslog Daemon running? On Tue, 2005-08-02 at 16:59 +0200, Remy de Ruysscher wrote: > MailScanner won't start anymore after stopping. I can't figure out > what's causing the trouble. > Nothing is showing up in the maillogs at all! > > When I use debug = yes I get: > > Starting MailScanner... > In Debugging mode, not forking... > unix dgram connect: No such file or directory at > /usr/local/lib/MailScanner/MailScanner/Log.pm line 143 > no connection to syslog available at > /usr/local/lib/MailScanner/MailScanner/Log.pm line 143 > > --- > > FreeBSD 5.4-RELEASE-p4 FreeBSD 5.4-RELEASE-p4 #6: Mon Jul 11 13:23:43 > CEST 2005 > This is Perl version 5.008007 (5.8.7) > > This is MailScanner version 4.43.8 > Module versions are: > 1.00 AnyDBM_File > 1.16 Archive::Zip > 1.04 Carp > 1.119 Convert::BinHex > 1.00 DirHandle > 1.05 Fcntl > 2.73 File::Basename > 2.08 File::Copy > 2.01 FileHandle > 1.07 File::Path > 0.16 File::Temp > 1.29 HTML::Entities > 3.45 HTML::Parser > 2.30 HTML::TokeParser > 1.21 IO > 1.11 IO::File > 1.123 IO::Pipe > 1.67 Mail::Header > 3.05 MIME::Base64 > 5.417 MIME::Decoder > 5.417 MIME::Decoder::UU > 5.417 MIME::Head > 5.417 MIME::Parser > 3.03 MIME::QuotedPrint > 5.417 MIME::Tools > 0.10 Net::CIDR > 1.08 POSIX > 1.77 Socket > 0.06 Sys::Syslog > 1.02 Time::localtime > > Optional module versions are: > 1.811 DB_File > 1.10 Digest > missing Digest::HMAC > 2.33 Digest::MD5 > missing Digest::SHA1 > missing Inline > missing Mail::ClamAV > missing Mail::SpamAssassin > missing Mail::SPF::Query > missing Net::CIDR::Lite > missing Net::DNS > missing Net::LDAP > missing Parse::RecDescent > missing SAVI > missing Sys::Hostname::Long > 2.52 Test::Harness > 0.6 Test::Simple > 1.95 Text::Balanced > missing URI > > > Please help me out! > > Regards, > Remy. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- Regards, David Jacobson Technical Director SYNAQ (Pty) Ltd Tel: 0860 0 SYNAQ (79627) Direct: 011 290 6388 Fax: 011 290 6389 Cell: 083 235 0760 Mail: davidj@synaq.com Web: http://www.synaq.com Key Fingerprint 8246 FCE1 3C22 7EFB E61B 18DF 6E8B 65E8 BD50 78A1 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "This is a digitally signed message part" ] [ Application/PGP-SIGNATURE 196bytes. ] [ Unable to print this part. ] From sailer at BNL.GOV Tue Aug 2 15:56:30 2005 From: sailer at BNL.GOV (Tim Sailer) Date: Thu Jan 12 21:30:30 2006 Subject: 'St*ck Picks' spam Message-ID: On Tue, Aug 02, 2005 at 02:42:48PM +0530, Dhawal Doshy wrote: > Tim Sailer wrote: > >Has anyone figured out how to keep these things under control? > > > >Tim > > > > Check http://www.wormbytes.ca/software/spamassassin/rules.cf and search > for FSR_MASKED_FINANCIAL, this rule is what you need to add your > local.cf (or wherever you add local rules) > > You could expand the rule to include pr*fit, auth*rity, l*w and st*cks > (as compared to st*ck) or remove the '\b' from the rule. Cool. Thanks. I get clobbered by these emails on a daily basis. For some reason, the users seem to feel they need to forward me a copy. Like I needed 2000 copies of the same spam... jeez. Tim -- Tim Sailer Information and Special Technologies Program Office of CounterIntelligence Brookhaven National Laboratory (631) 344-3001 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at TC3NET.COM Tue Aug 2 16:08:52 2005 From: mike at TC3NET.COM (Michael Baird) Date: Thu Jan 12 21:30:30 2006 Subject: MailScanner won'r run anymore? *URGENT* Message-ID: Restart syslog? Regards Michael Baird > MailScanner won't start anymore after stopping. I can't figure out > what's causing the trouble. > Nothing is showing up in the maillogs at all! > > When I use debug = yes I get: > > Starting MailScanner... > In Debugging mode, not forking... > unix dgram connect: No such file or directory at > /usr/local/lib/MailScanner/MailScanner/Log.pm line 143 > no connection to syslog available at > /usr/local/lib/MailScanner/MailScanner/Log.pm line 143 > > --- > > FreeBSD 5.4-RELEASE-p4 FreeBSD 5.4-RELEASE-p4 #6: Mon Jul 11 13:23:43 > CEST 2005 > This is Perl version 5.008007 (5.8.7) > > This is MailScanner version 4.43.8 > Module versions are: > 1.00 AnyDBM_File > 1.16 Archive::Zip > 1.04 Carp > 1.119 Convert::BinHex > 1.00 DirHandle > 1.05 Fcntl > 2.73 File::Basename > 2.08 File::Copy > 2.01 FileHandle > 1.07 File::Path > 0.16 File::Temp > 1.29 HTML::Entities > 3.45 HTML::Parser > 2.30 HTML::TokeParser > 1.21 IO > 1.11 IO::File > 1.123 IO::Pipe > 1.67 Mail::Header > 3.05 MIME::Base64 > 5.417 MIME::Decoder > 5.417 MIME::Decoder::UU > 5.417 MIME::Head > 5.417 MIME::Parser > 3.03 MIME::QuotedPrint > 5.417 MIME::Tools > 0.10 Net::CIDR > 1.08 POSIX > 1.77 Socket > 0.06 Sys::Syslog > 1.02 Time::localtime > > Optional module versions are: > 1.811 DB_File > 1.10 Digest > missing Digest::HMAC > 2.33 Digest::MD5 > missing Digest::SHA1 > missing Inline > missing Mail::ClamAV > missing Mail::SpamAssassin > missing Mail::SPF::Query > missing Net::CIDR::Lite > missing Net::DNS > missing Net::LDAP > missing Parse::RecDescent > missing SAVI > missing Sys::Hostname::Long > 2.52 Test::Harness > 0.6 Test::Simple > 1.95 Text::Balanced > missing URI > > > Please help me out! > > Regards, > Remy. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Tue Aug 2 16:20:56 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:30 2006 Subject: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Carl Boberg wrote: >Hi, >I have the same error. Install works fine with ./install.sh nodeps and >MailScanner works ok after that. > >/ C > > > >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of BG Mahesh >>Sent: den 2 augusti 2005 12:26 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 >> >>----- Original Message ----- >>From: "Julian Field" >> >> >> >> >>>Install Archive::Zip using CPAN and see if that clears the error. >>> >>> >># perl -MCPAN -e "install Archive::Zip" >> Can't locate object method "install" via package >>"Archive::Zip" at -e line 1. >> >> >> >> >>>Is there a chance you have 2 copies of perl installed? >>> >>> >>> >>Nops..just one >> >># whereis perl >>perl: /usr/bin/perl /usr/local/bin/perl /usr/share/man/man1/perl.1.gz >> >># ls -al /usr/bin/perl /usr/local/bin/perl >>lrwxrwxrwx 1 root root 19 Mar 5 2004 >>/usr/bin/perl -> /usr/local/bin/perl >>-rwxr-xr-x 2 root root 1004651 Mar 5 2004 >>/usr/local/bin/perl >> >> >> >> >>>On 2 Aug 2005, at 07:52, BG Mahesh wrote: >>> >>> >>> >>>>I have installed Archive-Zip-1.16. The error message I get while >>>>installing MS 4.44.6-1 is, >>>> >>>>Oh good, module Convert::TNEF version 0.17 is already installed. >>>>Oh good, module Compress::Zlib version 1.34 is already installed. >>>>Oh good, module Archive::Zip version 1.14 is already installed. >>>> >>>>Installing tnef decoder >>>> >>>>Preparing... >>>>########################################### [100%] >>>> package tnef-1.2.3.1-1 is already installed >>>> >>>>Now to install MailScanner itself. >>>> >>>>error: Failed dependencies: >>>> perl(Archive::Zip) is needed by mailscanner-4.44.6-1 >>>> >>>> >>>>-- >>>>B.G. Mahesh >>>>bg.mahesh@indiainfo.com >>>>http://www.indiainfo.com/ >>>> >>>> >>>>-- ______________________________________________ >>>>IndiaInfo Mail - the free e-mail service with a difference! >>>>www.indiainfo.com >>>>Check out our value-added Premium features, such as an >>>> >>>> >>extra 20MB >> >> >>>>for mail storage, POP3, e-mail forwarding, and ads-free mailboxes! >>>> >>>>------------------------ MailScanner list >>>> >>>> >>------------------------ >> >> >>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>'leave mailscanner' in the body of the email. >>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>>Support MailScanner development - buy the book off the website! >>>> >>>> >>>> >>>-- Julian Field >>>www.MailScanner.info >>>Buy the MailScanner book at www.MailScanner.info/store PGP >>> >>> >>footprint: >> >> >>>EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>> >>>------------------------ MailScanner list >>> >>> >>------------------------ To >> >> >>>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the Wiki >>> >>> >>(http://wiki.mailscanner.info/) and the >> >> >>>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >>> >>> >> >>-- >>B.G. Mahesh >>bg.mahesh@indiainfo.com >>http://www.indiainfo.com/ >> >> >>-- >>______________________________________________ >>IndiaInfo Mail - the free e-mail service with a difference! >>www.indiainfo.com Check out our value-added Premium features, >>such as an extra 20MB for mail storage, POP3, e-mail >>forwarding, and ads-free mailboxes! >> >>------------------------ MailScanner list >>------------------------ To unsubscribe, email >>jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) >>and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >> >> > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > I've almost always had problems installing MailScanner from the rpm install because it seems to depend on RPM versions of CPAN modules. I always make it a point to untar the rpm.tar.gz file, install each module I see listed as "perl-blahblah.src.rpm" from CPAN (just in case) and then run the install. After the install chokes (which is 9 times out of 10) because of some "I need perl-blahblah-rpm" I then try to install the supposedly missing modules (I know they're there, I just installed them from CPAN!) using up2date/yum/apt/urpmi/whatever; if that doesn't work, I go out and look for it on rpm search sites or that rpmpan place. If I *don't* find it for any reason, I just "rpm -Uvh mailscanner-whatever.rpm --nodeps" since I *know* the modules are present - especially when MailScanner -V reports them as existing and equal or newer than the ones that came with the rpms when I run it right after the install. It's kind of "the nuisance I've learned to live with" since I've never been stopped from getting mailscanner working because of it. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Tue Aug 2 16:06:22 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:30 2006 Subject: MailScanner won'r run anymore? *URGENT* Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Remy de Ruysscher wrote: > MailScanner won't start anymore after stopping. I can't figure out > what's causing the trouble. > Nothing is showing up in the maillogs at all! > > When I use debug = yes I get: > > Starting MailScanner... > In Debugging mode, not forking... > unix dgram connect: No such file or directory at > /usr/local/lib/MailScanner/MailScanner/Log.pm line 143 > no connection to syslog available at > /usr/local/lib/MailScanner/MailScanner/Log.pm line 143 > Is syslog running? -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From arrasmith at MATH.WICHITA.EDU Tue Aug 2 16:29:59 2005 From: arrasmith at MATH.WICHITA.EDU (Mark Arrasmith) Date: Thu Jan 12 21:30:30 2006 Subject: SpamAssassin: where is my SPAM? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Tuesday 02 August 2005 08:11 am, Ugo Bellavance wrote: > Mark Arrasmith wrote: > > But, ever since I updated SpamAssassin (from 2.55 -> 3.0.4) I now get all > > the Spam being deleted. What can I do to track this down? I'd like to > > be able to run on "deliver" for a couple of weeks before just deleting > > all incoming spam. > > Are you sure it is not high-scoring spam that gets deleted? > Yeah, that was happening because I had the high-score action as "attachment". Rather than "deliver attachment". After running on deliver attachment for a day I bumped my high-score to 12 and changed the action to "delete". Users are much happier with the clean mailboxes. - mark -- You can't fall off the floor. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ryanw at FALSEHOPE.COM Tue Aug 2 17:37:03 2005 From: ryanw at FALSEHOPE.COM (Ryan Weaver) Date: Thu Jan 12 21:30:30 2006 Subject: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Alex Neuman > van der Hans > Sent: Tuesday, August 02, 2005 10:21 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 > > Carl Boberg wrote: > > >Hi, > >I have the same error. Install works fine with ./install.sh > nodeps and > >MailScanner works ok after that. > > > >>-----Original Message----- > >>From: MailScanner mailing list > >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of BG Mahesh > >>Sent: den 2 augusti 2005 12:26 > >>To: MAILSCANNER@JISCMAIL.AC.UK > >>Subject: Re: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 > >> > >>----- Original Message ----- > >>From: "Julian Field" > >> > >>>Install Archive::Zip using CPAN and see if that clears the error. > >>> > >>> > >># perl -MCPAN -e "install Archive::Zip" > >> Can't locate object method "install" via package > >>"Archive::Zip" at -e line 1. > >> > >>>Is there a chance you have 2 copies of perl installed? > >>> > >>Nops..just one > >> > >># whereis perl > >>perl: /usr/bin/perl /usr/local/bin/perl > /usr/share/man/man1/perl.1.gz > >> > >># ls -al /usr/bin/perl /usr/local/bin/perl > >>lrwxrwxrwx 1 root root 19 Mar 5 2004 > >>/usr/bin/perl -> /usr/local/bin/perl > >>-rwxr-xr-x 2 root root 1004651 Mar 5 2004 > >>/usr/local/bin/perl > >> > >>>On 2 Aug 2005, at 07:52, BG Mahesh wrote: > >>> > >>>>I have installed Archive-Zip-1.16. The error message I get while > >>>>installing MS 4.44.6-1 is, > >>>> > >>>>Oh good, module Convert::TNEF version 0.17 is already installed. > >>>>Oh good, module Compress::Zlib version 1.34 is already installed. > >>>>Oh good, module Archive::Zip version 1.14 is already installed. > >>>> > >>>>Installing tnef decoder > >>>> > >>>>Preparing... > >>>>########################################### [100%] > >>>> package tnef-1.2.3.1-1 is already installed > >>>> > >>>>Now to install MailScanner itself. > >>>> > >>>>error: Failed dependencies: > >>>> perl(Archive::Zip) is needed by mailscanner-4.44.6-1 > >>>> > >>>> > >>extra 20MB > >> > >> > > > I've almost always had problems installing MailScanner from the rpm > install because it seems to depend on RPM versions of CPAN modules. I > always make it a point to untar the rpm.tar.gz file, install > each module I see listed as "perl-blahblah.src.rpm" from CPAN > (just in case) and then run the install. After the install chokes > (which is 9 times out of 10) because of some "I need perl-blahblah-rpm" > I then try to install the supposedly missing modules (I know they're > there, I just installed them from CPAN!) using > up2date/yum/apt/urpmi/whatever; if that doesn't work, > I go out and look for it on rpm search sites or that rpmpan > place. If I *don't* find it for any reason, I just "rpm -Uvh > mailscanner-whatever.rpm --nodeps" since I *know* the modules are > present - especially when MailScanner -V reports them as existing and > equal or newer than the ones that came with the rpms when I > run it right after the install. It's kind of "the nuisance I've > learned to live with" since I've never been stopped from getting > mailscanner working because of it. Fortunately, DAG (http://dag.wieers.com) has the CPAN modules as rpms that MailScanner needs. Using yum to keep those installed/updated I've never had a problem with the rpm installation of MailScanner Thanks, Ryan ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 2 18:30:48 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:30 2006 Subject: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Alex Neuman van der Hans wrote: > I've almost always had problems installing MailScanner from the rpm > install because it seems to depend on RPM versions of CPAN modules. I > always make it a point to untar the rpm.tar.gz file, install each > module I see listed as "perl-blahblah.src.rpm" from CPAN (just in > case) and then run the install. After the install chokes (which is 9 > times out of 10) because of some "I need perl-blahblah-rpm" I then try > to install the supposedly missing modules (I know they're there, I > just installed them from CPAN!) using up2date/yum/apt/urpmi/whatever; > if that doesn't work, I go out and look for it on rpm search sites or > that rpmpan place. If I *don't* find it for any reason, I just "rpm > -Uvh mailscanner-whatever.rpm --nodeps" since I *know* the modules are > present - especially when MailScanner -V reports them as existing and > equal or newer than the ones that came with the rpms when I run it > right after the install. It's kind of "the nuisance I've learned to > live with" since I've never been stopped from getting mailscanner > working because of it. This strikes me as very odd, as 99% of people have no dependency problems at all. I added the "nodeps" command-line option, but I have never had a need for it myself. Any ideas on what might be causing your problems? It would be good to get this resolved, as the installation clearly doesn't work properly for you at all. :-( - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQu+tyhH2WUcUFbZUEQIs0QCguvDO+R+6QYv/CwS18qtQQs28CxUAn1iS 77A3bjfI+Q1SAGHCKbiVE1Ku =4Vku -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Tue Aug 2 18:54:24 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:30 2006 Subject: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >Alex Neuman van der Hans wrote: > > >>module I see listed as "perl-blahblah.src.rpm" from CPAN (just in >>case) and then run the install. After the install chokes (which is 9 >>times out of 10) because of some "I need perl-blahblah-rpm" I then try >>to install the supposedly missing modules (I know they're there, I >>just installed them from CPAN!) using up2date/yum/apt/urpmi/whatever; >>if that doesn't work, I go out and look for it on rpm search sites or >>that rpmpan place. If I *don't* find it for any reason, I just "rpm >>-Uvh mailscanner-whatever.rpm --nodeps" since I *know* the modules are >> >> > >This strikes me as very odd, as 99% of people have no dependency >problems at all. I added the "nodeps" command-line option, but I have >never had a need for it myself. > >Any ideas on what might be causing your problems? It would be good to >get this resolved, as the installation clearly doesn't work properly for >you at all. >:-( > > I can always make a note of everything next time I install - but I repeat, I've never considered this a "problem" - mostly because whoever complains about anything similar usually winds up having some other problem (two perls, LANG=somethingweird, etc.) to attribute this to. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jamesp at MUSICREPORTS.COM Tue Aug 2 19:51:37 2005 From: Jamesp at MUSICREPORTS.COM (James D. Parra) Date: Thu Jan 12 21:30:30 2006 Subject: unable to write pid to sendmail.pid Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >(This time to the list, not only Steve:-) >Um, why not try determine exactly what is keeping it open? >fuser -u /var/run/sendmail.pid >could be a start. # fuser -u /var/run/sendmail.pid /var/run/sendmail.pid: 27670(root) # ps auxf |grep 27670 root 27670 0.0 0.5 6684 2724 ? Ss Aug01 0:00 sendmail: accepting connections Scott mentioned that maybe the incoming and out going sendmail instances were writing to the same pid. If this is correct, how can I fix it? "Perhaps the two separate instances of Sendmail (incoming and outgoing) are trying to write to the same pid. Is there a way to make one of the processes write to a different pid?" Many thanks, ~James ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From abridge at HQTRS.COM Tue Aug 2 20:16:08 2005 From: abridge at HQTRS.COM (Aaron Bridge) Date: Thu Jan 12 21:30:30 2006 Subject: Want to be sure this program is what I need Message-ID: What would you suggest for the MTA and POP/IMAP Server? -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Glenn Steen Sent: Tuesday, August 02, 2005 4:12 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Want to be sure this program is what I need On 02/08/05, Aaron Bridge wrote: > We have 55 users. Email is extremely important. Four hour downtime > would be extremely bad for me. I don't even want to think about a > full day of no email. > > Aaron > Sounds to me as if you should explore setting up your own MTA and POP/IMAP server then (bringing the email home, so to speak:-). This might sound as a lot of wourk, and it actually might be that initially (reading up on things, configuring&testing&....), but in the long run you'll be gratified by having more control over the whole email process. If you decide to do that, then MailScanner is definitely for you. -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 2 20:36:21 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:30 2006 Subject: unable to write pid to sendmail.pid Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 James D. Parra wrote: >>(This time to the list, not only Steve:-) >>Um, why not try determine exactly what is keeping it open? >>fuser -u /var/run/sendmail.pid >>could be a start. >> >> > ># fuser -u /var/run/sendmail.pid >/var/run/sendmail.pid: 27670(root) > ># ps auxf |grep 27670 >root 27670 0.0 0.5 6684 2724 ? Ss Aug01 0:00 sendmail: >accepting connections > >Scott mentioned that maybe the incoming and out going sendmail instances >were writing to the same pid. If this is correct, how can I fix it? > >"Perhaps the two separate instances of Sendmail (incoming and outgoing) >are trying to write to the same pid. Is there a way to make one of the >processes write to a different pid?" > > You can add a -OPidFile=/var/run/sendmail.out.pid to the sendmail command line for the outgoing sendmail queue runner. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQu/LNhH2WUcUFbZUEQI4/QCg1l4R/Yql0EHdKApjcym85ozXa8wAnjG0 FMIZTa4BPwO5H+n4FsXByQrY =E9ID -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve.swaney at fsl.com Tue Aug 2 20:42:45 2005 From: steve.swaney at fsl.com (Stephen Swaney) Date: Thu Jan 12 21:30:30 2006 Subject: Want to be sure this program is what I need Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Aaron Bridge > Sent: Tuesday, August 02, 2005 3:16 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Want to be sure this program is what I need > > What would you suggest for the MTA and POP/IMAP Server? > > > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf > Of Glenn Steen > Sent: Tuesday, August 02, 2005 4:12 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Want to be sure this program is what I need > > > On 02/08/05, Aaron Bridge wrote: > > We have 55 users. Email is extremely important. Four hour downtime > > would be extremely bad for me. I don't even want to think about a > > full day of no email. > > > > Aaron > > > Sounds to me as if you should explore setting up your own MTA and POP/IMAP > server then (bringing the email home, so to speak:-). This might sound as > a > lot of wourk, and it actually might be that initially (reading up on > things, > configuring&testing&....), but in the long run you'll be gratified by > having > more control over the whole email process. If you decide to do that, then > MailScanner is definitely for you. > > -- > -- Glenn Everybody has their favorites so let's no start a war but my preferences would be: MTA: sendmail or exim IMAP / POP: dovecot http://www.dovecot.org/ Note that Dovecot ships with CentOS 4.x and I believe it's also part of Red Hat 4.x. Steve Stephen Swaney Fort Systems Ltd. stephen.swaney@fsl.com www.fsl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Tue Aug 2 20:47:59 2005 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:30:30 2006 Subject: No Virus-Scanning if.. Message-ID: Hi there, i am using MS 4.42.9 But this was seen just right now: In the Past i asked Julian to work around the Problem if some User does not want his Mails to be scanned, all other User shoud receive a scanned mail. This worked in the Past. eg: Mail enters recipient 2: User A and User B User does not want his mails to be scanned, so i put up a RuleSet fromorto User a no scanning and default yes for scanning.. No some of my users received a virus infected mail. They where in the Recipient List with the User who does not want his mails to be scanned. So i checked it out. Sended a mail with a rar file attached, in which you could find an ordinary exe-file. If i do send the mail only to the users who want their mails to be scanned, this exe got caught and filtered out. But, if the user who does not want his mails to be scanned, all other users also receive the exe-file. :( In the past everything worked fine, without changing things on my sendmail setup. As all incoming mails got one mailfile for every recipient. :( Any ideas?? Thanks in advance Greetings Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 2 21:02:54 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:31 2006 Subject: No Virus-Scanning if.. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 There is now a "Scan Messages" configuration option which enables/disables *all* scanning and processing of mail. If any of the sender+recipients of the message want scanning, then it is scanned for everyone. This may well be a simpler solution to what you are trying to achieve. The only function that is not covered by "Scan Messages" is the "Archive Mail" archiving (as that isn't really scanning or processing, and is very useful at times). Marcel Blenkers wrote: >Hi there, > >i am using MS 4.42.9 > >But this was seen just right now: > >In the Past i asked Julian to work around the Problem if some User does >not want his Mails to be scanned, all other User shoud receive a scanned >mail. > >This worked in the Past. > >eg: > >Mail enters >recipient 2: User A and User B > >User does not want his mails to be scanned, so i put up a RuleSet fromorto >User a no scanning and default yes for scanning.. > >No some of my users received a virus infected mail. >They where in the Recipient List with the User who does not want his mails >to be scanned. > >So i checked it out. > >Sended a mail with a rar file attached, in which you could find an >ordinary exe-file. > >If i do send the mail only to the users who want their mails to be >scanned, this exe got caught and filtered out. > >But, if the user who does not want his mails to be scanned, all other >users also receive the exe-file. :( > >In the past everything worked fine, without changing things on my sendmail >setup. > >As all incoming mails got one mailfile for every recipient. > >:( > >Any ideas?? > >Thanks in advance > > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQu/RbxH2WUcUFbZUEQJIoQCgiAlPpTOdUHbkQ2g9cKQUiah3/mYAn0dS 5+/qUjeO1sDoT0ujScNmhFg6 =YYVy -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Tue Aug 2 21:34:20 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:31 2006 Subject: Want to be sure this program is what I need Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Aaron Bridge wrote: >What would you suggest for the MTA and POP/IMAP Server? > > >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf >Of Glenn Steen >Sent: Tuesday, August 02, 2005 4:12 AM >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: Want to be sure this program is what I need > > >On 02/08/05, Aaron Bridge wrote: > > >>We have 55 users. Email is extremely important. Four hour downtime >>would be extremely bad for me. I don't even want to think about a >>full day of no email. >> >>Aaron >> >> >> >Sounds to me as if you should explore setting up your own MTA and POP/IMAP >server then (bringing the email home, so to speak:-). This might sound as a >lot of wourk, and it actually might be that initially (reading up on things, >configuring&testing&....), but in the long run you'll be gratified by having >more control over the whole email process. If you decide to do that, then >MailScanner is definitely for you. > > > sendmail + dovecot ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Tue Aug 2 21:38:59 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:30:31 2006 Subject: Want to be sure this program is what I need Message-ID: On 2 Aug 2005, at 20:42, Stephen Swaney wrote: >> -----Original Message----- >> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >> Behalf Of Aaron Bridge >> Sent: Tuesday, August 02, 2005 3:16 PM >> To: MAILSCANNER@JISCMAIL.AC.UK >> Subject: Re: Want to be sure this program is what I need >> >> What would you suggest for the MTA and POP/IMAP Server? >> I think I have seen riots and wars started for lesser questions :-) >> >> > > Everybody has their favorites so let's no start a war but my > preferences > would be: > > MTA: sendmail or exim > IMAP / POP: dovecot http://www.dovecot.org/ > > Note that Dovecot ships with CentOS 4.x and I believe it's also > part of Red > Hat 4.x. > [oops and this time to the list...] Personally I prefer Postfix and Courier-IMAP as I prefer Maildir format but as you can see already it's quite a minefield. If you have time I would set up a test box and try those that interest you. There is some good info in the wiki (Address in the footers of all messages from the list) and there is also some good info here http:// www.gentoo.org/doc/en/virt-mail-howto.xml which although written for Gentoo can quite easily be adapted for your distro. It will certainly give you the general idea. Have fun Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Tue Aug 2 23:44:06 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:30:31 2006 Subject: The Same Errors in all my log files Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, I get this error message in all my log files Aug 2 23:48:12 mailhost sendmail-in[3733]: OTP unavailable because can't read/write key database /etc/opiekeys: No such file or directory Aug 2 23:50:49 mailhost sendmail-in[4067]: OTP unavailable because can't read/write key database /etc/opiekeys: No such file or directory I have googled and everything i find that references that error talks about a POP or IMAP server. I do not have either of those on my MS box. Can someone point me in the right direction. Thanks Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jamesp at MUSICREPORTS.COM Tue Aug 2 23:57:46 2005 From: Jamesp at MUSICREPORTS.COM (James D. Parra) Date: Thu Jan 12 21:30:31 2006 Subject: unable to write pid to sendmail.pid Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >You can add a -OPidFile=/var/run/sendmail.out.pid to the sendmail >command line for the outgoing sendmail queue runner. Thank you. I see the "PID file = /var/run/MailScanner.pid" in the MailScanner.conf, but can't find where to put the line you suggested. Can you point me in the right spot. Again, thank you for your help. ~James ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Wed Aug 3 00:28:32 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:31 2006 Subject: unable to write pid to sendmail.pid Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] James D. Parra spake the following on 8/2/2005 3:57 PM: >>You can add a -OPidFile=/var/run/sendmail.out.pid to the sendmail >>command line for the outgoing sendmail queue runner. > > > Thank you. I see the "PID file = /var/run/MailScanner.pid" in the > MailScanner.conf, but can't find where to put the line you suggested. > Can you point me in the right spot. > > Again, thank you for your help. > > ~James > Are you running a RedHat derived OS? -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jamesp at MUSICREPORTS.COM Wed Aug 3 00:49:09 2005 From: Jamesp at MUSICREPORTS.COM (James D. Parra) Date: Thu Jan 12 21:30:31 2006 Subject: unable to write pid to sendmail.pid Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >Are you running a RedHat derived OS? Yes, SuSe 9.3 ~James ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jamesp at MUSICREPORTS.COM Wed Aug 3 01:08:28 2005 From: Jamesp at MUSICREPORTS.COM (James D. Parra) Date: Thu Jan 12 21:30:31 2006 Subject: unable to write pid to sendmail.pid Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >You can add a -OPidFile=/var/run/sendmail.out.pid to the sendmail >command line for the outgoing sendmail queue runner. >Thank you. I see the "PID file = /var/run/MailScanner.pid" in the >MailScanner.conf, but can't find where to put the line you suggested. >Can you point me in the right spot. After looking in /etc/init.d/rc3, I found the following in the MailScanner file; msppid=/var/spool/clientmqueue/sm-client.pid srvpid=/var/run/sendmail.pid srvoutpid=/var/run/sendmail-out.pid mspid=/var/run/MailScanner.pid Not sure where to put the "-OPidFile=/var/run/sendmail.out.pid" command. Thanks again, ~James ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jamesp at MUSICREPORTS.COM Wed Aug 3 01:19:09 2005 From: Jamesp at MUSICREPORTS.COM (James D. Parra) Date: Thu Jan 12 21:30:31 2006 Subject: unable to write pid to sendmail.pid Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >You can add a -OPidFile=/var/run/sendmail.out.pid to the sendmail >command line for the outgoing sendmail queue runner. >Thank you. I see the "PID file = /var/run/MailScanner.pid" in the >MailScanner.conf, but can't find where to put the line you suggested. >Can you point me in the right spot. >After looking in /etc/init.d/rc3, I found the following in the MailScanner >file; >msppid=/var/spool/clientmqueue/sm-client.pid >srvpid=/var/run/sendmail.pid >srvoutpid=/var/run/sendmail-out.pid >mspid=/var/run/MailScanner.pid >Not sure where to put the "-OPidFile=/var/run/sendmail.out.pid" command. Hello, Found more oddities. After looking on another MailScanner system, Mandrake 9.1, found; ls /var/run/sendmail sendmail.in.pid sendmail.out.pid However, in Suse 9.3 found this; # ls /var/run/sendmail sendmail.pid Very strange. ~James ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From naolson at GMAIL.COM Wed Aug 3 04:00:55 2005 From: naolson at GMAIL.COM (Nathan Olson) Date: Thu Jan 12 21:30:31 2006 Subject: The Same Errors in all my log files Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 8/2/05, Lance Haig wrote: > Hi, > > I get this error message in all my log files > > can't read/write key database /etc/opiekeys: No such file or directory Opie = One-time pad authentication. 'man opiekeys' or 'man opie'? Nate ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From brad at BECKENHAUER.COM Wed Aug 3 06:29:45 2005 From: brad at BECKENHAUER.COM (Brad Beckenhauer) Date: Thu Jan 12 21:30:31 2006 Subject: MS 44.5 perl warning during install Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello. Just upgraded from 4.43.7 to 4.44.5 this evening using the tarball and got a perl warning that I've not seen before: Once you have checked that MailScanner.new contains what you want, you can then save your old one and move the new one into place, using commands like these: mv -f MailScanner.conf MailScanner.old mv -f MailScanner.new MailScanner.conf perl: warning: Setting locale failed. perl: warning: Please check that your locale settings: LANGUAGE = (unset), LC_ALL = (unset), LC_COLLATE = "C", LANG = "etc/reports/en/languages.conf" are supported and installed on your system. perl: warning: Falling back to the standard locale ("C"). My perl version: [root@mail]# perl -v This is perl, v5.8.7 built for i686-linux-thread-multi I reboot the system and then checked the environment [root@mail]# set LANG=en_US LC_COLLATE=C Note: LC_ALL is not set I re-ran the install and got the same warning. I've not activated the 4.44.5 version yet, so I don't know if there are any possible MS Run issues. I'm not a perl whiz and I'm not sure from my research if this is an MS install issue or if I need to be looking more at my system config. Is anyone else getting this perl warning? Something in the MS install script? Suggestions on what I should look at? thanks Brad ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Wed Aug 3 06:45:07 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:31 2006 Subject: MS 44.5 perl warning during install Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Brad Beckenhauer wrote: >Hello. > >Just upgraded from 4.43.7 to 4.44.5 this evening using the tarball and got a perl warning that I've not seen before: > > >Once you have checked that MailScanner.new contains what >you want, you can then save your old one and move the new >one into place, using commands like these: > mv -f MailScanner.conf MailScanner.old > mv -f MailScanner.new MailScanner.conf >perl: warning: Setting locale failed. >perl: warning: Please check that your locale settings: > LANGUAGE = (unset), > LC_ALL = (unset), > LC_COLLATE = "C", > LANG = "etc/reports/en/languages.conf" > are supported and installed on your system. >perl: warning: Falling back to the standard locale ("C"). > > > >My perl version: >[root@mail]# perl -v >This is perl, v5.8.7 built for i686-linux-thread-multi > >I reboot the system and then checked the environment >[root@mail]# set > >LANG=en_US >LC_COLLATE=C > > >Note: LC_ALL is not set > >I re-ran the install and got the same warning. > >I've not activated the 4.44.5 version yet, so I don't know if there are any possible MS Run issues. > >I'm not a perl whiz and I'm not sure from my research if this is an MS install issue or if I need to be looking more at my system config. >Is anyone else getting this perl warning? >Something in the MS install script? >Suggestions on what I should look at? > >thanks >Brad > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > export LANG=C before you install... better yet, set LANG=C to be your default locale (in RH it's in /etc/sysconfig/i18n)... ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Wed Aug 3 06:58:53 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:30:31 2006 Subject: The Same Errors in all my log files Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Thanks Nathan Lance Nathan Olson wrote: On 8/2/05, Lance Haig wrote: Hi, I get this error message in all my log files can't read/write key database /etc/opiekeys: No such file or directory Opie = One-time pad authentication. 'man opiekeys' or 'man opie'? Nate ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Tue Aug 2 21:54:34 2005 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:30:31 2006 Subject: No Virus-Scanning if.. Message-ID: Hi Julian, first thanks for the fast reply > There is now a "Scan Messages" configuration option which > enables/disables *all* scanning and processing of mail. If any of the > sender+recipients of the message want scanning, then it is scanned for > everyone. This may well be a simpler solution to what you are trying to > achieve. so..let me check if i got it right: Two recipients: User A and User B User A does not want his Mails to be scanned, due to paranoia reasons. User B does his mails to be scanned. So..even if User A does his Mails not to be scanned, his mails will got scanned? :( But in the past everything worked as wished before :(( User A received his Mails unscanned and User B scanned. So..did i got it right? :) Greetings Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at blacknight.ie Wed Aug 3 08:49:44 2005 From: michele at blacknight.ie (Michele Neylon:: Blacknight.ie) Date: Thu Jan 12 21:30:31 2006 Subject: Perl Dependency Frustration on Latest Stable Message-ID: Hi all I've been trying to install the latest stable this morning on a Redhat 9 machine. I get: Now to install MailScanner itself. error: Failed dependencies: perl(HTML::Entities) is needed by mailscanner-4.44.6-1 perl(HTML::Parser) is needed by mailscanner-4.44.6-1 perl(HTML::TokeParser) is needed by mailscanner-4.44.6-1 At which point the installer dies The required modules are installed. I reinstalled them via CPAN and no change. I reinstalled them manually - no change Any ideas? Michele Mr Michele Neylon Blacknight Internet Solutions Ltd Quality Hosting, co-location & domains http://www.blacknight.ie/ Lo-call: 1850 927 280 Tel. +353 59 9183072 Fax. +353 59 9164239 Tired of your current host? Save 15% when you move to us! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Wed Aug 3 09:20:09 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:31 2006 Subject: unable to write pid to sendmail.pid Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > >After looking in /etc/init.d/rc3, I found the following in the MailScanner > >file; > > >msppid=/var/spool/clientmqueue/sm-client.pid > >srvpid=/var/run/sendmail.pid > >srvoutpid=/var/run/sendmail-out.pid > >mspid=/var/run/MailScanner.pid > > >Not sure where to put the "-OPidFile=/var/run/sendmail.out.pid" command. Looks like it's already there, provided the invocation (in the start "action" actually use that srvoutpid variable), so it is something else the matter. > > Hello, > > Found more oddities. After looking on another MailScanner system, Mandrake > 9.1, found; > > ls /var/run/sendmail > sendmail.in.pid sendmail.out.pid > > However, in Suse 9.3 found this; > > # ls /var/run/sendmail > sendmail.pid > > Very strange. Not really. SuSE isn't really as closely related to RH as Mandriva-that-used-to-be-Mandrake is, so I'd guess that you'd have completely (well:-) different init scripts. But assuming it is _not_ the outgoing sendmail that is causing grief, something makes the incoming sendmail carp... so... First thing to try is to simply change the pid filename for the incoming server... perhaps srvpid=/var/run/sendmail.in.pid ... Then restart MailScanner. You should see if it is a problem with the init script now, since it should complain about the sendmail.in.pid file in that case. If so, perhaps it's time to sdtart tracing the init-script ("set -x" early and run it by hand....). -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bjoern.koester at MEDIATA.NET Wed Aug 3 09:25:17 2005 From: bjoern.koester at MEDIATA.NET ([utf-8] BjĂśrn [utf-8] KĂśster) Date: Thu Jan 12 21:30:31 2006 Subject: Failed install of mailscanner-4.44.6-1 Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] yes of cause. there is also only one installed perl version, too. currently I am using the 4.43.8-1 version of Mailscanner. BjĂśrn Quoting Ugo Bellavance : > BjĂśrn KĂśster wrote: >> I always get the same error. First I tried to install version 4.44.5-1. It >> failed. Trying version 4.44.6-1, it failed too. >> >> The install of version 4.44.6-1 always fails with tihs error: >> >> Now to install MailScanner itself. >> >> error: failed dependencies: >> perl(AnyDBM_File) is needed by mailscanner-4.44.6-1 >> perl(Archive::Zip) is needed by mailscanner-4.44.6-1 >> perl(bytes) is needed by mailscanner-4.44.6-1 >> perl(Carp) is needed by mailscanner-4.44.6-1 >> perl(Cwd) is needed by mailscanner-4.44.6-1 >> perl(Data::Dumper) is needed by mailscanner-4.44.6-1 >> perl(DirHandle) is needed by mailscanner-4.44.6-1 >> perl(Env) is needed by mailscanner-4.44.6-1 >> perl(Fcntl) is needed by mailscanner-4.44.6-1 >> perl(File::Basename) is needed by mailscanner-4.44.6-1 >> perl(File::Copy) is needed by mailscanner-4.44.6-1 >> perl(FileHandle) is needed by mailscanner-4.44.6-1 >> perl(File::Path) is needed by mailscanner-4.44.6-1 >> perl(HTML::Entities) is needed by mailscanner-4.44.6-1 >> perl(HTML::Parser) is needed by mailscanner-4.44.6-1 >> perl(HTML::TokeParser) is needed by mailscanner-4.44.6-1 >> perl(IO) is needed by mailscanner-4.44.6-1 >> perl(IO::File) is needed by mailscanner-4.44.6-1 >> perl(IO::Handle) is needed by mailscanner-4.44.6-1 >> perl(IO::Pipe) is needed by mailscanner-4.44.6-1 >> perl(IPC::Open2) is needed by mailscanner-4.44.6-1 >> perl(MIME::Decoder::BinHex) is needed by mailscanner-4.44.6-1 >> perl(MIME::Decoder::UU) is needed by mailscanner-4.44.6-1 >> perl(MIME::Head) is needed by mailscanner-4.44.6-1 >> perl(MIME::Parser) is needed by mailscanner-4.44.6-1 >> perl(MIME::WordDecoder) is needed by mailscanner-4.44.6-1 >> perl(Net::CIDR) is needed by mailscanner-4.44.6-1 >> perl(Net::FTP) is needed by mailscanner-4.44.6-1 >> perl(POSIX) is needed by mailscanner-4.44.6-1 >> perl(Socket) is needed by mailscanner-4.44.6-1 >> perl(strict) is needed by mailscanner-4.44.6-1 >> perl(Sys::Syslog) is needed by mailscanner-4.44.6-1 >> perl(Time::localtime) is needed by mailscanner-4.44.6-1 >> perl(vars) is needed by mailscanner-4.44.6-1 > > Are you using the install.sh script? > > -- > Ugo > > -> Please don't send a copy of your reply by e-mail. I read the list. > -> Please avoid top-posting, long signatures and HTML, and cut the > irrelevant parts in your replies. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > Mit freundlichem GrĂźĂ^ßen Best Regards BjĂśrn KĂśster ====================================================================== MEDIATA Communications GmbH KĂślner StraĂ^ße 94-96 / 53840 Troisdorf / Germany Email: info@mediata.net / Web: www.mediata.net Tel: +49 (0)2241 809 323 / Fax: +49 (0)2241 809 324 ====================================================================== ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Aug 3 09:54:34 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:31 2006 Subject: Failed install of mailscanner-4.44.6-1 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Did the rest of the install.sh work okay? What happens if you rpm -q perl-Archive-Zip rpm -q --provides perl-Archive-Zip ? I have had to switch to a new build machine, the old one died :( On 3 Aug 2005, at 09:25, Björn Köster wrote: > yes of cause. there is also only one installed perl version, too. > currently I am using the 4.43.8-1 version of Mailscanner. > > Björn > > Quoting Ugo Bellavance : > > >> Björn Köster wrote: >> >>> I always get the same error. First I tried to install version >>> 4.44.5-1. It >>> failed. Trying version 4.44.6-1, it failed too. >>> >>> The install of version 4.44.6-1 always fails with tihs error: >>> >>> Now to install MailScanner itself. >>> >>> error: failed dependencies: >>> perl(AnyDBM_File) is needed by mailscanner-4.44.6-1 >>> perl(Archive::Zip) is needed by mailscanner-4.44.6-1 >>> perl(bytes) is needed by mailscanner-4.44.6-1 >>> perl(Carp) is needed by mailscanner-4.44.6-1 >>> perl(Cwd) is needed by mailscanner-4.44.6-1 >>> perl(Data::Dumper) is needed by mailscanner-4.44.6-1 >>> perl(DirHandle) is needed by mailscanner-4.44.6-1 >>> perl(Env) is needed by mailscanner-4.44.6-1 >>> perl(Fcntl) is needed by mailscanner-4.44.6-1 >>> perl(File::Basename) is needed by mailscanner-4.44.6-1 >>> perl(File::Copy) is needed by mailscanner-4.44.6-1 >>> perl(FileHandle) is needed by mailscanner-4.44.6-1 >>> perl(File::Path) is needed by mailscanner-4.44.6-1 >>> perl(HTML::Entities) is needed by mailscanner-4.44.6-1 >>> perl(HTML::Parser) is needed by mailscanner-4.44.6-1 >>> perl(HTML::TokeParser) is needed by mailscanner-4.44.6-1 >>> perl(IO) is needed by mailscanner-4.44.6-1 >>> perl(IO::File) is needed by mailscanner-4.44.6-1 >>> perl(IO::Handle) is needed by mailscanner-4.44.6-1 >>> perl(IO::Pipe) is needed by mailscanner-4.44.6-1 >>> perl(IPC::Open2) is needed by mailscanner-4.44.6-1 >>> perl(MIME::Decoder::BinHex) is needed by >>> mailscanner-4.44.6-1 >>> perl(MIME::Decoder::UU) is needed by mailscanner-4.44.6-1 >>> perl(MIME::Head) is needed by mailscanner-4.44.6-1 >>> perl(MIME::Parser) is needed by mailscanner-4.44.6-1 >>> perl(MIME::WordDecoder) is needed by mailscanner-4.44.6-1 >>> perl(Net::CIDR) is needed by mailscanner-4.44.6-1 >>> perl(Net::FTP) is needed by mailscanner-4.44.6-1 >>> perl(POSIX) is needed by mailscanner-4.44.6-1 >>> perl(Socket) is needed by mailscanner-4.44.6-1 >>> perl(strict) is needed by mailscanner-4.44.6-1 >>> perl(Sys::Syslog) is needed by mailscanner-4.44.6-1 >>> perl(Time::localtime) is needed by mailscanner-4.44.6-1 >>> perl(vars) is needed by mailscanner-4.44.6-1 >>> >> >> Are you using the install.sh script? >> >> -- >> Ugo >> >> -> Please don't send a copy of your reply by e-mail. I read the >> list. >> -> Please avoid top-posting, long signatures and HTML, and cut the >> irrelevant parts in your replies. >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> > > > > Mit freundlichem Grüßen > Best Regards > > Björn Köster > > > ====================================================================== > MEDIATA Communications GmbH > Kölner Straße 94-96 / 53840 Troisdorf / Germany > > Email: info@mediata.net / Web: www.mediata.net > Tel: +49 (0)2241 809 323 / Fax: +49 (0)2241 809 324 > ====================================================================== > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Carl.Boberg at NRM.SE Wed Aug 3 09:55:10 2005 From: Carl.Boberg at NRM.SE (Carl Boberg) Date: Thu Jan 12 21:30:31 2006 Subject: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 Message-ID: Hi people, I think there are 2 different problemse here. First, its people like me who never have had any dep. problems but now with the 2 latest stable versions Ive run in to a dep. problem with Archive::Zip (wich I know I have) wich I solved bu using the nodeps arg for install.sh Secondly, there seems to be a few people who has had dep. problems with alot of different perl modules for a lot longer... Is this 2 separate problems or one and the same? Cheers Carl > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field > Sent: den 2 augusti 2005 19:31 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Alex Neuman van der Hans wrote: > > > I've almost always had problems installing MailScanner from the rpm > > install because it seems to depend on RPM versions of CPAN > modules. I > > always make it a point to untar the rpm.tar.gz file, install each > > module I see listed as "perl-blahblah.src.rpm" from CPAN (just in > > case) and then run the install. After the install chokes > (which is 9 > > times out of 10) because of some "I need perl-blahblah-rpm" > I then try > > to install the supposedly missing modules (I know they're there, I > > just installed them from CPAN!) using > up2date/yum/apt/urpmi/whatever; > > if that doesn't work, I go out and look for it on rpm > search sites or > > that rpmpan place. If I *don't* find it for any reason, I just "rpm > > -Uvh mailscanner-whatever.rpm --nodeps" since I *know* the > modules are > > present - especially when MailScanner -V reports them as > existing and > > equal or newer than the ones that came with the rpms when I run it > > right after the install. It's kind of "the nuisance I've learned to > > live with" since I've never been stopped from getting mailscanner > > working because of it. > > This strikes me as very odd, as 99% of people have no > dependency problems at all. I added the "nodeps" command-line > option, but I have never had a need for it myself. > > Any ideas on what might be causing your problems? It would be > good to get this resolved, as the installation clearly > doesn't work properly for you at all. > :-( > > - -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > -----BEGIN PGP SIGNATURE----- > Version: PGP Desktop 9.0.2 (Build 2424) > > iQA/AwUBQu+tyhH2WUcUFbZUEQIs0QCguvDO+R+6QYv/CwS18qtQQs28CxUAn1iS > 77A3bjfI+Q1SAGHCKbiVE1Ku > =4Vku > -----END PGP SIGNATURE----- > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Wed Aug 3 10:00:16 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:31 2006 Subject: Want to be sure this program is what I need Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 02/08/05, Aaron Bridge wrote: > What would you suggest for the MTA and POP/IMAP Server? > Postfix is my current MTA-love, and if I had a choice (we're M-Sexchanged by will of the upper echelons) I'd use dovecot... But you'll probably find a lot of people swearing by Cyrus, Courier and even the simplistic (but workable) university of washington imap server (or for that matter: swearing at:-).... And swearing by/at any particular MTA... You have a rather small group of users there (55 was it?) so any MTA and any IMAP server would probably do. Choose one that seem simple to manage to you (since that will probably make you do less misstakes) and that you deem have the functionality you need. The MailScanner wiki is actually a good read here;). For example: One could in factors as "ability to do TLS, IMAPS ..." and reach one conclusion (or a couple:-), but if those don't matter... Then one probably reach some _other_ conclusion;).. This is the fun thing with having control... You decide;-) -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Aug 3 11:15:54 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:31 2006 Subject: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 Message-ID: Can you do the same things I requested in the other thread on this subject: Did the rest of the install.sh work okay? What happens if you rpm -q perl-Archive-Zip rpm -q --provides perl-Archive-Zip ? I have had to switch to a new build machine, the old one died :( On 3 Aug 2005, at 09:55, Carl Boberg wrote: > Hi people, > I think there are 2 different problemse here. > First, its people like me who never have had any dep. problems but now > with the 2 latest stable versions Ive run in to a dep. problem with > Archive::Zip (wich I know I have) wich I solved bu using the nodeps > arg > for install.sh > Secondly, there seems to be a few people who has had dep. problems > with > alot of different perl modules for a lot longer... > > Is this 2 separate problems or one and the same? > > Cheers > Carl > > >> -----Original Message----- >> From: MailScanner mailing list >> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field >> Sent: den 2 augusti 2005 19:31 >> To: MAILSCANNER@JISCMAIL.AC.UK >> Subject: Re: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 >> >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> Alex Neuman van der Hans wrote: >> >> >>> I've almost always had problems installing MailScanner from the rpm >>> install because it seems to depend on RPM versions of CPAN >>> >> modules. I >> >>> always make it a point to untar the rpm.tar.gz file, install each >>> module I see listed as "perl-blahblah.src.rpm" from CPAN (just in >>> case) and then run the install. After the install chokes >>> >> (which is 9 >> >>> times out of 10) because of some "I need perl-blahblah-rpm" >>> >> I then try >> >>> to install the supposedly missing modules (I know they're there, I >>> just installed them from CPAN!) using >>> >> up2date/yum/apt/urpmi/whatever; >> >>> if that doesn't work, I go out and look for it on rpm >>> >> search sites or >> >>> that rpmpan place. If I *don't* find it for any reason, I just "rpm >>> -Uvh mailscanner-whatever.rpm --nodeps" since I *know* the >>> >> modules are >> >>> present - especially when MailScanner -V reports them as >>> >> existing and >> >>> equal or newer than the ones that came with the rpms when I run it >>> right after the install. It's kind of "the nuisance I've learned to >>> live with" since I've never been stopped from getting mailscanner >>> working because of it. >>> >> >> This strikes me as very odd, as 99% of people have no >> dependency problems at all. I added the "nodeps" command-line >> option, but I have never had a need for it myself. >> >> Any ideas on what might be causing your problems? It would be >> good to get this resolved, as the installation clearly >> doesn't work properly for you at all. >> :-( >> >> - -- >> Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> Professional Support Services at www.MailScanner.biz >> MailScanner thanks transtec Computers for their support >> >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> >> -----BEGIN PGP SIGNATURE----- >> Version: PGP Desktop 9.0.2 (Build 2424) >> >> iQA/AwUBQu+tyhH2WUcUFbZUEQIs0QCguvDO+R+6QYv/CwS18qtQQs28CxUAn1iS >> 77A3bjfI+Q1SAGHCKbiVE1Ku >> =4Vku >> -----END PGP SIGNATURE----- >> >> ------------------------ MailScanner list >> ------------------------ To unsubscribe, email >> jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) >> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bjoern.koester at MEDIATA.NET Wed Aug 3 11:45:29 2005 From: bjoern.koester at MEDIATA.NET ([utf-8] BjĂśrn [utf-8] KĂśster) Date: Thu Jan 12 21:30:31 2006 Subject: Failed install of mailscanner-4.44.6-1 Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Quoting Julian Field : > Did the rest of the install.sh work okay? The rest of the install.sh seems to work fine. just installing the mailscanner version hangs. I logged the whole install to a logfile 8see attached). What happens if you > rpm -q perl-Archive-Zip perl-Archive-Zip-1.14-4 > rpm -q --provides perl-Archive-Zip no output is generated > ? > I have had to switch to a new build machine, the old one died :( bjĂśrn > > On 3 Aug 2005, at 09:25, BjĂśrn KĂśster wrote: > >> yes of cause. there is also only one installed perl version, too. >> currently I am using the 4.43.8-1 version of Mailscanner. >> >> BjĂśrn >> >> Quoting Ugo Bellavance : >> >> >>> BjĂśrn KĂśster wrote: >>> >>>> I always get the same error. First I tried to install version >>>> 4.44.5-1. It >>>> failed. Trying version 4.44.6-1, it failed too. >>>> >>>> The install of version 4.44.6-1 always fails with tihs error: >>>> >>>> Now to install MailScanner itself. >>>> >>>> error: failed dependencies: >>>> perl(AnyDBM_File) is needed by mailscanner-4.44.6-1 >>>> perl(Archive::Zip) is needed by mailscanner-4.44.6-1 >>>> perl(bytes) is needed by mailscanner-4.44.6-1 >>>> perl(Carp) is needed by mailscanner-4.44.6-1 >>>> perl(Cwd) is needed by mailscanner-4.44.6-1 >>>> perl(Data::Dumper) is needed by mailscanner-4.44.6-1 >>>> perl(DirHandle) is needed by mailscanner-4.44.6-1 >>>> perl(Env) is needed by mailscanner-4.44.6-1 >>>> perl(Fcntl) is needed by mailscanner-4.44.6-1 >>>> perl(File::Basename) is needed by mailscanner-4.44.6-1 >>>> perl(File::Copy) is needed by mailscanner-4.44.6-1 >>>> perl(FileHandle) is needed by mailscanner-4.44.6-1 >>>> perl(File::Path) is needed by mailscanner-4.44.6-1 >>>> perl(HTML::Entities) is needed by mailscanner-4.44.6-1 >>>> perl(HTML::Parser) is needed by mailscanner-4.44.6-1 >>>> perl(HTML::TokeParser) is needed by mailscanner-4.44.6-1 >>>> perl(IO) is needed by mailscanner-4.44.6-1 >>>> perl(IO::File) is needed by mailscanner-4.44.6-1 >>>> perl(IO::Handle) is needed by mailscanner-4.44.6-1 >>>> perl(IO::Pipe) is needed by mailscanner-4.44.6-1 >>>> perl(IPC::Open2) is needed by mailscanner-4.44.6-1 >>>> perl(MIME::Decoder::BinHex) is needed by mailscanner-4.44.6-1 >>>> perl(MIME::Decoder::UU) is needed by mailscanner-4.44.6-1 >>>> perl(MIME::Head) is needed by mailscanner-4.44.6-1 >>>> perl(MIME::Parser) is needed by mailscanner-4.44.6-1 >>>> perl(MIME::WordDecoder) is needed by mailscanner-4.44.6-1 >>>> perl(Net::CIDR) is needed by mailscanner-4.44.6-1 >>>> perl(Net::FTP) is needed by mailscanner-4.44.6-1 >>>> perl(POSIX) is needed by mailscanner-4.44.6-1 >>>> perl(Socket) is needed by mailscanner-4.44.6-1 >>>> perl(strict) is needed by mailscanner-4.44.6-1 >>>> perl(Sys::Syslog) is needed by mailscanner-4.44.6-1 >>>> perl(Time::localtime) is needed by mailscanner-4.44.6-1 >>>> perl(vars) is needed by mailscanner-4.44.6-1 >>>> >>> >>> Are you using the install.sh script? >>> >>> -- >>> Ugo >>> >>> -> Please don't send a copy of your reply by e-mail. I read the list. >>> -> Please avoid top-posting, long signatures and HTML, and cut the >>> irrelevant parts in your replies. >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> >> >> >> Mit freundlichem GrĂźĂ^ßen >> Best Regards >> >> BjĂśrn KĂśster >> >> >> ====================================================================== >> MEDIATA Communications GmbH >> KĂślner StraĂ^ße 94-96 / 53840 Troisdorf / Germany >> >> Email: info@mediata.net / Web: www.mediata.net >> Tel: +49 (0)2241 809 323 / Fax: +49 (0)2241 809 324 >> ====================================================================== >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > Mit freundlichem GrĂźĂ^ßen Best Regards BjĂśrn KĂśster ====================================================================== MEDIATA Communications GmbH KĂślner StraĂ^ße 94-96 / 53840 Troisdorf / Germany Email: info@mediata.net / Web: www.mediata.net Tel: +49 (0)2241 809 323 / Fax: +49 (0)2241 809 324 ====================================================================== ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Text/PLAIN (charset: UTF-8 "Internet-standard Unicode") ] [ (Name: "logfile.log") 915 lines. ] [ Unable to print this part. ] From Carl.Boberg at NRM.SE Wed Aug 3 11:57:55 2005 From: Carl.Boberg at NRM.SE (Carl Boberg) Date: Thu Jan 12 21:30:31 2006 Subject: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 Message-ID: Hi, Archive::Zip is installed from CPAN and "rpm -q --provides perl-Archive-Zip" says it cant find it (since it is not an rpm install) Doing an up2date perl-Archive-Zip (im running redhat) says it cant find it, i.e RedHat does not supply a package by that name. What next? Carl > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field > Sent: den 3 augusti 2005 12:16 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 > > Can you do the same things I requested in the other thread on this > subject: > > Did the rest of the install.sh work okay? What happens if you > rpm -q perl-Archive-Zip > rpm -q --provides perl-Archive-Zip > ? > I have had to switch to a new build machine, the old one died :( > > On 3 Aug 2005, at 09:55, Carl Boberg wrote: > > > Hi people, > > I think there are 2 different problemse here. > > First, its people like me who never have had any dep. > problems but now > > with the 2 latest stable versions Ive run in to a dep. problem with > > Archive::Zip (wich I know I have) wich I solved bu using the nodeps > > arg for install.sh Secondly, there seems to be a few people who has > > had dep. problems with alot of different perl modules for a lot > > longer... > > > > Is this 2 separate problems or one and the same? > > > > Cheers > > Carl > > > > > >> -----Original Message----- > >> From: MailScanner mailing list > >> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field > >> Sent: den 2 augusti 2005 19:31 > >> To: MAILSCANNER@JISCMAIL.AC.UK > >> Subject: Re: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 > >> > >> -----BEGIN PGP SIGNED MESSAGE----- > >> Hash: SHA1 > >> > >> Alex Neuman van der Hans wrote: > >> > >> > >>> I've almost always had problems installing MailScanner > from the rpm > >>> install because it seems to depend on RPM versions of CPAN > >>> > >> modules. I > >> > >>> always make it a point to untar the rpm.tar.gz file, install each > >>> module I see listed as "perl-blahblah.src.rpm" from CPAN (just in > >>> case) and then run the install. After the install chokes > >>> > >> (which is 9 > >> > >>> times out of 10) because of some "I need perl-blahblah-rpm" > >>> > >> I then try > >> > >>> to install the supposedly missing modules (I know they're > there, I > >>> just installed them from CPAN!) using > >>> > >> up2date/yum/apt/urpmi/whatever; > >> > >>> if that doesn't work, I go out and look for it on rpm > >>> > >> search sites or > >> > >>> that rpmpan place. If I *don't* find it for any reason, I > just "rpm > >>> -Uvh mailscanner-whatever.rpm --nodeps" since I *know* the > >>> > >> modules are > >> > >>> present - especially when MailScanner -V reports them as > >>> > >> existing and > >> > >>> equal or newer than the ones that came with the rpms when > I run it > >>> right after the install. It's kind of "the nuisance I've > learned to > >>> live with" since I've never been stopped from getting mailscanner > >>> working because of it. > >>> > >> > >> This strikes me as very odd, as 99% of people have no dependency > >> problems at all. I added the "nodeps" command-line option, > but I have > >> never had a need for it myself. > >> > >> Any ideas on what might be causing your problems? It would > be good to > >> get this resolved, as the installation clearly doesn't > work properly > >> for you at all. > >> :-( > >> > >> - -- > >> Julian Field > >> www.MailScanner.info > >> Buy the MailScanner book at www.MailScanner.info/store > Professional > >> Support Services at www.MailScanner.biz MailScanner thanks > transtec > >> Computers for their support > >> > >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >> > >> > >> -----BEGIN PGP SIGNATURE----- > >> Version: PGP Desktop 9.0.2 (Build 2424) > >> > >> iQA/AwUBQu+tyhH2WUcUFbZUEQIs0QCguvDO+R+6QYv/CwS18qtQQs28CxUAn1iS > >> 77A3bjfI+Q1SAGHCKbiVE1Ku > >> =4Vku > >> -----END PGP SIGNATURE----- > >> > >> ------------------------ MailScanner list > >> ------------------------ To unsubscribe, email > >> jiscmail@jiscmail.ac.uk with the words: > >> 'leave mailscanner' in the body of the email. > >> Before posting, read the Wiki > (http://wiki.mailscanner.info/) and the > >> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >> Support MailScanner development - buy the book off the website! > >> > >> > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki > (http://wiki.mailscanner.info/) and the > > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store PGP > footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ryanw at FALSEHOPE.COM Wed Aug 3 12:34:04 2005 From: ryanw at FALSEHOPE.COM (Ryan Weaver) Date: Thu Jan 12 21:30:31 2006 Subject: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Carl Boberg > Sent: Wednesday, August 03, 2005 5:58 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 > > Hi, > Archive::Zip is installed from CPAN and "rpm -q --provides > perl-Archive-Zip" says it cant find it (since it is not an > rpm install) Doing an up2date perl-Archive-Zip (im running > redhat) says it cant find it, i.e RedHat does not supply a > package by that name. > > What next? > > Carl DAG's yum installation: http://dag.wieers.com/home-made/apt/FAQ.php#B Or, if you don't want to use yum to update all packages: http://dag.wieers.com/packages/perl-Archive-Zip/ > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field > > Sent: den 3 augusti 2005 12:16 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 > > > > Can you do the same things I requested in the other thread on this > > subject: > > > > Did the rest of the install.sh work okay? What happens if you > > rpm -q perl-Archive-Zip > > rpm -q --provides perl-Archive-Zip > > ? > > I have had to switch to a new build machine, the old one died :( > > > > On 3 Aug 2005, at 09:55, Carl Boberg wrote: > > > > > Hi people, > > > I think there are 2 different problemse here. > > > First, its people like me who never have had any dep. > > problems but now > > > with the 2 latest stable versions Ive run in to a dep. > problem with > > > Archive::Zip (wich I know I have) wich I solved bu using > the nodeps > > > arg for install.sh Secondly, there seems to be a few > people who has > > > had dep. problems with alot of different perl modules for a lot > > > longer... > > > > > > Is this 2 separate problems or one and the same? > > > > > > Cheers > > > Carl > > > > > > > > >> -----Original Message----- > > >> From: MailScanner mailing list > > >> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field > > >> Sent: den 2 augusti 2005 19:31 > > >> To: MAILSCANNER@JISCMAIL.AC.UK > > >> Subject: Re: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 > > >> > > >> -----BEGIN PGP SIGNED MESSAGE----- > > >> Hash: SHA1 > > >> > > >> Alex Neuman van der Hans wrote: > > >> > > >> > > >>> I've almost always had problems installing MailScanner > > from the rpm > > >>> install because it seems to depend on RPM versions of CPAN > > >>> > > >> modules. I > > >> > > >>> always make it a point to untar the rpm.tar.gz file, > install each > > >>> module I see listed as "perl-blahblah.src.rpm" from > CPAN (just in > > >>> case) and then run the install. After the install chokes > > >>> > > >> (which is 9 > > >> > > >>> times out of 10) because of some "I need perl-blahblah-rpm" > > >>> > > >> I then try > > >> > > >>> to install the supposedly missing modules (I know they're > > there, I > > >>> just installed them from CPAN!) using > > >>> > > >> up2date/yum/apt/urpmi/whatever; > > >> > > >>> if that doesn't work, I go out and look for it on rpm > > >>> > > >> search sites or > > >> > > >>> that rpmpan place. If I *don't* find it for any reason, I > > just "rpm > > >>> -Uvh mailscanner-whatever.rpm --nodeps" since I *know* the > > >>> > > >> modules are > > >> > > >>> present - especially when MailScanner -V reports them as > > >>> > > >> existing and > > >> > > >>> equal or newer than the ones that came with the rpms when > > I run it > > >>> right after the install. It's kind of "the nuisance I've > > learned to > > >>> live with" since I've never been stopped from getting > mailscanner > > >>> working because of it. > > >>> > > >> > > >> This strikes me as very odd, as 99% of people have no dependency > > >> problems at all. I added the "nodeps" command-line option, > > but I have > > >> never had a need for it myself. > > >> > > >> Any ideas on what might be causing your problems? It would > > be good to > > >> get this resolved, as the installation clearly doesn't > > work properly > > >> for you at all. > > >> :-( > > >> > > >> - -- > > >> Julian Field > > >> www.MailScanner.info > > >> Buy the MailScanner book at www.MailScanner.info/store > > Professional > > >> Support Services at www.MailScanner.biz MailScanner thanks > > transtec > > >> Computers for their support > > >> > > >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > >> > > >> > > >> -----BEGIN PGP SIGNATURE----- > > >> Version: PGP Desktop 9.0.2 (Build 2424) > > >> > > >> iQA/AwUBQu+tyhH2WUcUFbZUEQIs0QCguvDO+R+6QYv/CwS18qtQQs28CxUAn1iS > > >> 77A3bjfI+Q1SAGHCKbiVE1Ku > > >> =4Vku > > >> -----END PGP SIGNATURE----- > > >> > > >> ------------------------ MailScanner list > > >> ------------------------ To unsubscribe, email > > >> jiscmail@jiscmail.ac.uk with the words: > > >> 'leave mailscanner' in the body of the email. > > >> Before posting, read the Wiki > > (http://wiki.mailscanner.info/) and the > > >> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > >> > > >> Support MailScanner development - buy the book off the website! > > >> > > >> > > > > > > ------------------------ MailScanner list > > ------------------------ To > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > > 'leave mailscanner' in the body of the email. > > > Before posting, read the Wiki > > (http://wiki.mailscanner.info/) and the > > > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > -- > > Julian Field > > www.MailScanner.info > > Buy the MailScanner book at www.MailScanner.info/store PGP > > footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > > ------------------------ MailScanner list > > ------------------------ To unsubscribe, email > > jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) > > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Wed Aug 3 12:40:04 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:30:31 2006 Subject: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ryan Weaver wrote: >>Hi, >>Archive::Zip is installed from CPAN and "rpm -q --provides >>perl-Archive-Zip" says it cant find it (since it is not an >>rpm install) Doing an up2date perl-Archive-Zip (im running >>redhat) says it cant find it, i.e RedHat does not supply a >>package by that name. >> >>What next? >> >>Carl > > > DAG's yum installation: http://dag.wieers.com/home-made/apt/FAQ.php#B > Or, if you don't want to use yum to update all packages: > http://dag.wieers.com/packages/perl-Archive-Zip/ > There also rpmpan (http://rpmpan.sourceforge.net/) for perl rpms and if you wish to roll out your own rpms then theres cpan2rpm (http://perl.arix.com/cpan2rpm/) - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Carl.Boberg at NRM.SE Wed Aug 3 13:09:47 2005 From: Carl.Boberg at NRM.SE (Carl Boberg) Date: Thu Jan 12 21:30:31 2006 Subject: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 Message-ID: DAG and rpman are all well and good but the issue as I see it is that Juians installation should not bail out because of me not having an rpm version of Archive::Zip installed?! I do have Archive::Zip installed, but with CPAN, and that has been fine up until now. There is an src.rpm of perl-Archive-Zip in the MailScanner package, what does that do? Isnt the installer supposed to build and install it if it finds that I dont have Archive::Zip installed? This does not happen. Well thats my thoughts/ideas on the matter anyway :-) Cheers > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Dhawal Doshy > Sent: den 3 augusti 2005 13:40 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 > > Ryan Weaver wrote: > >>Hi, > >>Archive::Zip is installed from CPAN and "rpm -q --provides > >>perl-Archive-Zip" says it cant find it (since it is not an rpm > >>install) Doing an up2date perl-Archive-Zip (im running > >>redhat) says it cant find it, i.e RedHat does not supply a > package by > >>that name. > >> > >>What next? > >> > >>Carl > > > > > > DAG's yum installation: > http://dag.wieers.com/home-made/apt/FAQ.php#B > > Or, if you don't want to use yum to update all packages: > > http://dag.wieers.com/packages/perl-Archive-Zip/ > > > > There also rpmpan (http://rpmpan.sourceforge.net/) for perl > rpms and if you wish to roll out your own rpms then theres cpan2rpm > (http://perl.arix.com/cpan2rpm/) > > - dhawal > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Wed Aug 3 13:20:27 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:31 2006 Subject: No Virus-Scanning if.. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Marcel Blenkers wrote: >Hi Julian, > >first thanks for the fast reply > > > > >>There is now a "Scan Messages" configuration option which >>enables/disables *all* scanning and processing of mail. If any of the >>sender+recipients of the message want scanning, then it is scanned for >>everyone. This may well be a simpler solution to what you are trying to >>achieve. >> >> > > >so..let me check if i got it right: > >Two recipients: User A and User B > >User A does not want his Mails to be scanned, due to paranoia reasons. >User B does his mails to be scanned. > >So..even if User A does his Mails not to be scanned, his mails will got >scanned? :( > >But in the past everything worked as wished before :(( >User A received his Mails unscanned and User B scanned. > > > Marcel, I think you need to tell your MTA to split messages for multiple recipients into separate messages to achieve what you want. That way MS will only see one recipient per message and do the right thing. Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From KLekas at FOXRIVER.COM Wed Aug 3 14:27:20 2005 From: KLekas at FOXRIVER.COM (Kosta Lekas) Date: Thu Jan 12 21:30:31 2006 Subject: how to right ruleset for filename and filetype checking? Message-ID: I am wondering if it is possible to turn on Attachment Filename Checking and impose it on all messages except for mail going to a specific external recipient that my Exchange system journals to for compliance purposes. How would I right this rule? Right now I have: Filename Rules = %etc-dir%/filename.rules.conf Filetype Rules = %etc-dir%/filetype.rules.conf Would this be the correct way be like this: ***** /etc/MailScanner/MailScanner.conf ***** Filename Rules = %rules-dir%filename.rules Filetype Rules = %rules-dir%filetype.rules ******* /etc/MailScanner/rules/filename.rules ******** Set " Filename Rules = %etc-dir%/filename.rules.conf = ". To: specificrecipient@somedomain.com no FromOrTo: default yes ******* /etc/MailScanner/rules/filetype.rules ******** Set " Filename Rules = %etc-dir%/filetype.rules.conf = ". To: specificrecipient@somedomain.com no FromOrTo: default yes Kosta Lekas Fox River Financial Resources ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Wed Aug 3 15:07:23 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:31 2006 Subject: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Carl Boberg wrote: >Hi, >Archive::Zip is installed from CPAN and "rpm -q --provides >perl-Archive-Zip" says it cant find it (since it is not an rpm install) >Doing an up2date perl-Archive-Zip (im running redhat) says it cant find >it, i.e RedHat does not supply a package by that name. > >What next? > >Carl > > Try using dag's repositories (http://dag.wieers.com/) and install the rpm from there. If that doesn't work, try 'rpmbuild --rebuild' Julian's version of perl-Archive-Zip-whatever.src.rpm to see where it breaks. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Wed Aug 3 15:08:32 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:31 2006 Subject: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Carl Boberg wrote: >DAG and rpman are all well and good but the issue as I see it is that >Juians installation should not bail out because of me not having an rpm >version of Archive::Zip installed?! >I do have Archive::Zip installed, but with CPAN, and that has been fine >up until now. There is an src.rpm of perl-Archive-Zip in the MailScanner >package, what does that do? Isnt the installer supposed to build and >install it if it finds that I dont have Archive::Zip installed? This >does not happen. >Well thats my thoughts/ideas on the matter anyway :-) > >Cheers > > > >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Dhawal Doshy >>Sent: den 3 augusti 2005 13:40 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: perl(Archive::Zip) is needed by mailscanner-4.44.6-1 >> >>Ryan Weaver wrote: >> >> >>>>Hi, >>>>Archive::Zip is installed from CPAN and "rpm -q --provides >>>>perl-Archive-Zip" says it cant find it (since it is not an rpm >>>>install) Doing an up2date perl-Archive-Zip (im running >>>>redhat) says it cant find it, i.e RedHat does not supply a >>>> >>>> >>package by >> >> >>>>that name. >>>> >>>>What next? >>>> >>>>Carl >>>> >>>> >>>DAG's yum installation: >>> >>> >>http://dag.wieers.com/home-made/apt/FAQ.php#B >> >> >>>Or, if you don't want to use yum to update all packages: >>>http://dag.wieers.com/packages/perl-Archive-Zip/ >>> >>> >>> >>There also rpmpan (http://rpmpan.sourceforge.net/) for perl >>rpms and if you wish to roll out your own rpms then theres cpan2rpm >>(http://perl.arix.com/cpan2rpm/) >> >>- dhawal >> >>------------------------ MailScanner list >>------------------------ To unsubscribe, email >>jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) >>and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >> >> > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > The installer is choking somewhere you haven't seen yet. Do it individually (rpmbuild --rebuild juliansarchivezip.src.rpm) and look for the errors. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From brad at BECKENHAUER.COM Wed Aug 3 14:51:30 2005 From: brad at BECKENHAUER.COM (Brad Beckenhauer) Date: Thu Jan 12 21:30:31 2006 Subject: MS 44.5 perl warning during install Message-ID: >>> Alex Neuman van der Hans 8/3/2005 12:45:07 AM >>> Brad Beckenhauer wrote: >Hello. > >Just upgraded from 4.43.7 to 4.44.5 this evening using the tarball and got a perl warning that I've not seen before: > > >Once you have checked that MailScanner.new contains what >you want, you can then save your old one and move the new >one into place, using commands like these: > mv -f MailScanner.conf MailScanner.old > mv -f MailScanner.new MailScanner.conf >perl: warning: Setting locale failed. >perl: warning: Please check that your locale settings: > LANGUAGE = (unset), > LC_ALL = (unset), > LC_COLLATE = "C", > LANG = "etc/reports/en/languages.conf" > are supported and installed on your system. >perl: warning: Falling back to the standard locale ("C"). > > > >My perl version: >[root@mail]# perl -v >This is perl, v5.8.7 built for i686-linux-thread-multi > >I reboot the system and then checked the environment >[root@mail]# set > >LANG=en_US >LC_COLLATE=C > > >Note: LC_ALL is not set > >I re-ran the install and got the same warning. > >I've not activated the 4.44.5 version yet, so I don't know if there are any possible MS Run issues. > >I'm not a perl whiz and I'm not sure from my research if this is an MS install issue or if I need to be looking more at my system config. >Is anyone else getting this perl warning? >Something in the MS install script? >Suggestions on what I should look at? > >thanks >Brad > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > export LANG=C before you install... better yet, set LANG=C to be your default locale (in RH it's in /etc/sysconfig/i18n)... Thanks Alex.. I tried your suggestion that and still get the warning... I've re-install one of my previous versions 4-43.7 and the warning persists, so I'm pretty sure it's a local problem and not something with the MS install script. Then I noticed that version 4-44.6 was current (could not find the announcement), so I installed it... Same warning. I ran v4-44.6 briefly and observed no errors, the perl warning appears only near the end of the install so is the warning only cosmetic?? thanks ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Wed Aug 3 15:29:47 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:31 2006 Subject: MS 44.5 perl warning during install Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Brad Beckenhauer wrote: >>>>Alex Neuman van der Hans 8/3/2005 12:45:07 AM >>> >>>> >>>> >Brad Beckenhauer wrote: > > > >>Hello. >> >>Just upgraded from 4.43.7 to 4.44.5 this evening using the tarball and got a perl warning that I've not seen before: >> >> >>Once you have checked that MailScanner.new contains what >>you want, you can then save your old one and move the new >>one into place, using commands like these: >> mv -f MailScanner.conf MailScanner.old >> mv -f MailScanner.new MailScanner.conf >>perl: warning: Setting locale failed. >>perl: warning: Please check that your locale settings: >> LANGUAGE = (unset), >> LC_ALL = (unset), >> LC_COLLATE = "C", >> LANG = "etc/reports/en/languages.conf" >> are supported and installed on your system. >>perl: warning: Falling back to the standard locale ("C"). >> >> >> >>My perl version: >>[root@mail]# perl -v >>This is perl, v5.8.7 built for i686-linux-thread-multi >> >>I reboot the system and then checked the environment >>[root@mail]# set >> >>LANG=en_US >>LC_COLLATE=C >> >> >>Note: LC_ALL is not set >> >>I re-ran the install and got the same warning. >> >>I've not activated the 4.44.5 version yet, so I don't know if there are any possible MS Run issues. >> >>I'm not a perl whiz and I'm not sure from my research if this is an MS install issue or if I need to be looking more at my system config. >>Is anyone else getting this perl warning? >>Something in the MS install script? >>Suggestions on what I should look at? >> >>thanks >>Brad >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >> >> >> >export LANG=C before you install... better yet, set LANG=C to be your >default locale (in RH it's in /etc/sysconfig/i18n)... > > >Thanks Alex.. I tried your suggestion that and still get the warning... >I've re-install one of my previous versions 4-43.7 and the warning persists, so I'm pretty sure it's a local problem and not something with the MS install script. Then I noticed that version 4-44.6 was current (could not find the announcement), so I installed it... Same warning. > >I ran v4-44.6 briefly and observed no errors, the perl warning appears only near the end of the install so is the warning only cosmetic?? > >thanks > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > Depends of what your definition of 'is' is :) What I've seen is that Julian's install script chokes while rpmbuild --rebuild 'ing the src.rpm's because of a failed dependency. Since perl-Archive-Zip is not installed, it's listed as a missing dependency, even if the corresponding built-from-CPAN module is installed and working. If you don't want to see the error, try: 1. rpmbuild --rebuild perl-Archive-Zip-whatever.src.rpm from Julian's rpm tarfile. What happens there? If it goes through without a problem, you'll have an rpm file sitting somewhere (probably /usr/src/redhat/RPMS/noarch/) called perl-Archive-Zip-whatever.rpm which you can rpm -Uvh to install. 2. If that doesn't work, try getting cpan2rpm from ftp://arix.com/cpan2rpm-2.028-1.noarch.rpm and installing it, then doing a "cpan2rpm Archive::Zip"; this should get you a /usr/src/redhat/RPMS/noarch/perl-Archive-Zip-1.16-1.noarch.rpm which you can then install using rpm -Uvh /usr/src/redhat/RPMS/noarch/perl-Archive-Zip-1.16-1.noarch.rpm - that should take care of the Archive-Zip dependency. Do the same for the other modules. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Wed Aug 3 15:49:17 2005 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:30:31 2006 Subject: No Virus-Scanning if.. Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi there, [...] > > Marcel, > > I think you need to tell your MTA to split messages for multiple recipients > into separate messages to achieve what you want. That way MS will only see > one recipient per message and do the right thing. > see, my Problem is, that it worked and was changed due to my questions before. http://www.jiscmail.ac.uk/cgi-bin/webadmin?A2=ind04&L=MAILSCANNER&D=0&I=-3&X=7B0F882A3121464A75&Y=marcel-ml%40irc-addicts.de&P=1945610 Julian then changed the script to check those recipients and to behave the way it was intended... i do not know what release it was back then, but suddenly those mails got split up for every user and Mailscanner treated them directly for every one individuadly.. suddenly this behaviour stops :( I tried to set up MailScanner as stated in the README for the Quarantine Report, but the text which should be changed is no longer to be found in MailScanner. :( Greetings Marcel -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQFC8NlveuKbXOoTCo8RAofoAKCE1W9d2bSvoWaC526lZMysCVvncQCeIbP8 cW8BTGnY4oSA36OBVvRyHcY= =LgRd -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Wed Aug 3 15:46:53 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:31 2006 Subject: how to right ruleset for filename and filetype checking? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Kosta Lekas wrote: > I am wondering if it is possible to turn on Attachment Filename Checking > and impose it on all messages except for mail going to a specific > external recipient that my Exchange system journals to for compliance > purposes. How would I right this rule? Right now I have: > > > > Filename Rules = %etc-dir%/filename.rules.conf > > Filetype Rules = %etc-dir%/filetype.rules.conf > > > > Would this be the correct way be like this: > > > > ***** /etc/MailScanner/MailScanner.conf ***** > > Filename Rules = %rules-dir%filename.rules > > Filetype Rules = %rules-dir%filetype.rules > > > > ******* /etc/MailScanner/rules/filename.rules ******** > > Set " Filename Rules = %etc-dir%/filename.rules.conf = ". > > To: specificrecipient@somedomain.com no > > FromOrTo: default yes > > > > ******* /etc/MailScanner/rules/filetype.rules ******** > > Set " Filename Rules = %etc-dir%/filetype.rules.conf = ". > > To: specificrecipient@somedomain.com no > > FromOrTo: default yes You cannot set yes/no to this kind of ruleset. You must specify another rulset. -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From KLekas at FOXRIVER.COM Wed Aug 3 16:16:01 2005 From: KLekas at FOXRIVER.COM (Kosta Lekas) Date: Thu Jan 12 21:30:31 2006 Subject: how to right ruleset for filename and filetype checking? Message-ID: Can you please show me an example? Kosta Lekas Fox River Financial Resources From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Ugo Bellavance Sent: Wednesday, August 03, 2005 9:47 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: how to right ruleset for filename and filetype checking? Kosta Lekas wrote: > I am wondering if it is possible to turn on Attachment Filename Checking > and impose it on all messages except for mail going to a specific > external recipient that my Exchange system journals to for compliance > purposes. How would I right this rule? Right now I have: > > > > Filename Rules = %etc-dir%/filename.rules.conf > > Filetype Rules = %etc-dir%/filetype.rules.conf > > > > Would this be the correct way be like this: > > > > ***** /etc/MailScanner/MailScanner.conf ***** > > Filename Rules = %rules-dir%filename.rules > > Filetype Rules = %rules-dir%filetype.rules > > > > ******* /etc/MailScanner/rules/filename.rules ******** > > Set " Filename Rules = %etc-dir%/filename.rules.conf = ". > > To: specificrecipient@somedomain.com no > > FromOrTo: default yes > > > > ******* /etc/MailScanner/rules/filetype.rules ******** > > Set " Filename Rules = %etc-dir%/filetype.rules.conf = ". > > To: specificrecipient@somedomain.com no > > FromOrTo: default yes You cannot set yes/no to this kind of ruleset. You must specify another rulset. -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Aug 3 16:29:11 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:31 2006 Subject: Failed install of mailscanner-4.44.6-1 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] This one is the interesting response. Also, could we merge all these threads into 1 discussion. I'm going to follow this one and ignore the others. Going to Dag's repository etc is not the right answer. I need to fix the RPMs. Please can you try installing this RPM: http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/perl-Archive- Zip-1.14-1.noarch.rpm and then do rpm -q perl-Archive-Zip rpm -q --provides perl-Archive-Zip and see if that is any better. I may just need to explicitly add the Provides: lines to the spec files. Please let me know, and please kill all the other threads. On 3 Aug 2005, at 11:45, Björn Köster wrote: > Quoting Julian Field : > > >> Did the rest of the install.sh work okay? >> > > The rest of the install.sh seems to work fine. just installing the > mailscanner > version hangs. I logged the whole install to a logfile 8see attached). > > What happens if you > >> rpm -q perl-Archive-Zip >> > > perl-Archive-Zip-1.14-4 > > > >> rpm -q --provides perl-Archive-Zip >> > > no output is generated > > >> ? >> I have had to switch to a new build machine, the old one died :( >> > > > björn > > > >> >> On 3 Aug 2005, at 09:25, Björn Köster wrote: >> >> >>> yes of cause. there is also only one installed perl version, too. >>> currently I am using the 4.43.8-1 version of Mailscanner. >>> >>> Björn >>> >>> Quoting Ugo Bellavance : >>> >>> >>> >>>> Björn Köster wrote: >>>> >>>> >>>>> I always get the same error. First I tried to install version >>>>> 4.44.5-1. It >>>>> failed. Trying version 4.44.6-1, it failed too. >>>>> >>>>> The install of version 4.44.6-1 always fails with tihs error: >>>>> >>>>> Now to install MailScanner itself. >>>>> >>>>> error: failed dependencies: >>>>> perl(AnyDBM_File) is needed by mailscanner-4.44.6-1 >>>>> perl(Archive::Zip) is needed by mailscanner-4.44.6-1 >>>>> perl(bytes) is needed by mailscanner-4.44.6-1 >>>>> perl(Carp) is needed by mailscanner-4.44.6-1 >>>>> perl(Cwd) is needed by mailscanner-4.44.6-1 >>>>> perl(Data::Dumper) is needed by mailscanner-4.44.6-1 >>>>> perl(DirHandle) is needed by mailscanner-4.44.6-1 >>>>> perl(Env) is needed by mailscanner-4.44.6-1 >>>>> perl(Fcntl) is needed by mailscanner-4.44.6-1 >>>>> perl(File::Basename) is needed by mailscanner-4.44.6-1 >>>>> perl(File::Copy) is needed by mailscanner-4.44.6-1 >>>>> perl(FileHandle) is needed by mailscanner-4.44.6-1 >>>>> perl(File::Path) is needed by mailscanner-4.44.6-1 >>>>> perl(HTML::Entities) is needed by mailscanner-4.44.6-1 >>>>> perl(HTML::Parser) is needed by mailscanner-4.44.6-1 >>>>> perl(HTML::TokeParser) is needed by mailscanner-4.44.6-1 >>>>> perl(IO) is needed by mailscanner-4.44.6-1 >>>>> perl(IO::File) is needed by mailscanner-4.44.6-1 >>>>> perl(IO::Handle) is needed by mailscanner-4.44.6-1 >>>>> perl(IO::Pipe) is needed by mailscanner-4.44.6-1 >>>>> perl(IPC::Open2) is needed by mailscanner-4.44.6-1 >>>>> perl(MIME::Decoder::BinHex) is needed by >>>>> mailscanner-4.44.6-1 >>>>> perl(MIME::Decoder::UU) is needed by mailscanner-4.44.6-1 >>>>> perl(MIME::Head) is needed by mailscanner-4.44.6-1 >>>>> perl(MIME::Parser) is needed by mailscanner-4.44.6-1 >>>>> perl(MIME::WordDecoder) is needed by mailscanner-4.44.6-1 >>>>> perl(Net::CIDR) is needed by mailscanner-4.44.6-1 >>>>> perl(Net::FTP) is needed by mailscanner-4.44.6-1 >>>>> perl(POSIX) is needed by mailscanner-4.44.6-1 >>>>> perl(Socket) is needed by mailscanner-4.44.6-1 >>>>> perl(strict) is needed by mailscanner-4.44.6-1 >>>>> perl(Sys::Syslog) is needed by mailscanner-4.44.6-1 >>>>> perl(Time::localtime) is needed by mailscanner-4.44.6-1 >>>>> perl(vars) is needed by mailscanner-4.44.6-1 >>>>> >>>>> >>>> >>>> Are you using the install.sh script? >>>> >>>> -- >>>> Ugo >>>> >>>> -> Please don't send a copy of your reply by e-mail. I read >>>> the list. >>>> -> Please avoid top-posting, long signatures and HTML, and cut the >>>> irrelevant parts in your replies. >>>> >>>> ------------------------ MailScanner list ------------------------ >>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>> 'leave mailscanner' in the body of the email. >>>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>>> >>> >>> >>> >>> Mit freundlichem Grüßen >>> Best Regards >>> >>> Björn Köster >>> >>> >>> ==================================================================== >>> == >>> MEDIATA Communications GmbH >>> Kölner Straße 94-96 / 53840 Troisdorf / Germany >>> >>> Email: info@mediata.net / Web: www.mediata.net >>> Tel: +49 (0)2241 809 323 / Fax: +49 (0)2241 809 324 >>> ==================================================================== >>> == >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> >> -- >> Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> > > > > Mit freundlichem Grüßen > Best Regards > > Björn Köster > > > ====================================================================== > MEDIATA Communications GmbH > Kölner Straße 94-96 / 53840 Troisdorf / Germany > > Email: info@mediata.net / Web: www.mediata.net > Tel: +49 (0)2241 809 323 / Fax: +49 (0)2241 809 324 > ====================================================================== > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Wed Aug 3 16:30:14 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:31 2006 Subject: how to right ruleset for filename and filetype checking? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Kosta Lekas wrote: > Can you please show me an example? Please avoid top posting. http://www.fsl.com/support/MailScanner-Manual-Version-1.0.1.pdf See page 75 of the document (81 in acrobat). > > Kosta Lekas > Fox River Financial Resources > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Ugo Bellavance > Sent: Wednesday, August 03, 2005 9:47 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: how to right ruleset for filename and filetype checking? > > Kosta Lekas wrote: > >>I am wondering if it is possible to turn on Attachment Filename > > Checking > >>and impose it on all messages except for mail going to a specific >>external recipient that my Exchange system journals to for compliance >>purposes. How would I right this rule? Right now I have: >> >> >> >>Filename Rules = %etc-dir%/filename.rules.conf >> >>Filetype Rules = %etc-dir%/filetype.rules.conf >> >> >> >>Would this be the correct way be like this: >> >> >> >>***** /etc/MailScanner/MailScanner.conf ***** >> >>Filename Rules = %rules-dir%filename.rules >> >>Filetype Rules = %rules-dir%filetype.rules >> >> >> >>******* /etc/MailScanner/rules/filename.rules ******** >> >>Set " Filename Rules = %etc-dir%/filename.rules.conf = ". >> >> To: specificrecipient@somedomain.com no >> >> FromOrTo: default yes >> >> >> >>******* /etc/MailScanner/rules/filetype.rules ******** >> >>Set " Filename Rules = %etc-dir%/filetype.rules.conf = ". >> >> To: specificrecipient@somedomain.com no >> >> FromOrTo: default yes > > > You cannot set yes/no to this kind of ruleset. You must specify another > rulset. > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Aug 3 17:38:23 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:31 2006 Subject: Failed install of mailscanner-4.44.6-1 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] One more thing: If you install the mailscanner rpm using --nodeps does it then start up and work properly? A temporary fix would be to always install the final rpm with -- nodeps, while I work on trying to fix it properly. On 3 Aug 2005, at 16:29, Julian Field wrote: > This one is the interesting response. > > Also, could we merge all these threads into 1 discussion. I'm going > to follow this one and ignore the others. > Going to Dag's repository etc is not the right answer. I need to > fix the RPMs. > > Please can you try installing this RPM: > http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/perl-Archive- > Zip-1.14-1.noarch.rpm > and then do > rpm -q perl-Archive-Zip > rpm -q --provides perl-Archive-Zip > and see if that is any better. > > I may just need to explicitly add the Provides: lines to the spec > files. > > Please let me know, and please kill all the other threads. > > On 3 Aug 2005, at 11:45, Björn Köster wrote: > > >> Quoting Julian Field : >> >> >> >>> Did the rest of the install.sh work okay? >>> >>> >> >> The rest of the install.sh seems to work fine. just installing the >> mailscanner >> version hangs. I logged the whole install to a logfile 8see >> attached). >> >> What happens if you >> >> >>> rpm -q perl-Archive-Zip >>> >>> >> >> perl-Archive-Zip-1.14-4 >> >> >> >> >>> rpm -q --provides perl-Archive-Zip >>> >>> >> >> no output is generated >> >> >> >>> ? >>> I have had to switch to a new build machine, the old one died :( >>> >>> >> >> >> björn >> >> >> >> >>> >>> On 3 Aug 2005, at 09:25, Björn Köster wrote: >>> >>> >>> >>>> yes of cause. there is also only one installed perl version, too. >>>> currently I am using the 4.43.8-1 version of Mailscanner. >>>> >>>> Björn >>>> >>>> Quoting Ugo Bellavance : >>>> >>>> >>>> >>>> >>>>> Björn Köster wrote: >>>>> >>>>> >>>>> >>>>>> I always get the same error. First I tried to install version >>>>>> 4.44.5-1. It >>>>>> failed. Trying version 4.44.6-1, it failed too. >>>>>> >>>>>> The install of version 4.44.6-1 always fails with tihs error: >>>>>> >>>>>> Now to install MailScanner itself. >>>>>> >>>>>> error: failed dependencies: >>>>>> perl(AnyDBM_File) is needed by mailscanner-4.44.6-1 >>>>>> perl(Archive::Zip) is needed by mailscanner-4.44.6-1 >>>>>> perl(bytes) is needed by mailscanner-4.44.6-1 >>>>>> perl(Carp) is needed by mailscanner-4.44.6-1 >>>>>> perl(Cwd) is needed by mailscanner-4.44.6-1 >>>>>> perl(Data::Dumper) is needed by mailscanner-4.44.6-1 >>>>>> perl(DirHandle) is needed by mailscanner-4.44.6-1 >>>>>> perl(Env) is needed by mailscanner-4.44.6-1 >>>>>> perl(Fcntl) is needed by mailscanner-4.44.6-1 >>>>>> perl(File::Basename) is needed by mailscanner-4.44.6-1 >>>>>> perl(File::Copy) is needed by mailscanner-4.44.6-1 >>>>>> perl(FileHandle) is needed by mailscanner-4.44.6-1 >>>>>> perl(File::Path) is needed by mailscanner-4.44.6-1 >>>>>> perl(HTML::Entities) is needed by mailscanner-4.44.6-1 >>>>>> perl(HTML::Parser) is needed by mailscanner-4.44.6-1 >>>>>> perl(HTML::TokeParser) is needed by mailscanner-4.44.6-1 >>>>>> perl(IO) is needed by mailscanner-4.44.6-1 >>>>>> perl(IO::File) is needed by mailscanner-4.44.6-1 >>>>>> perl(IO::Handle) is needed by mailscanner-4.44.6-1 >>>>>> perl(IO::Pipe) is needed by mailscanner-4.44.6-1 >>>>>> perl(IPC::Open2) is needed by mailscanner-4.44.6-1 >>>>>> perl(MIME::Decoder::BinHex) is needed by >>>>>> mailscanner-4.44.6-1 >>>>>> perl(MIME::Decoder::UU) is needed by mailscanner-4.44.6-1 >>>>>> perl(MIME::Head) is needed by mailscanner-4.44.6-1 >>>>>> perl(MIME::Parser) is needed by mailscanner-4.44.6-1 >>>>>> perl(MIME::WordDecoder) is needed by mailscanner-4.44.6-1 >>>>>> perl(Net::CIDR) is needed by mailscanner-4.44.6-1 >>>>>> perl(Net::FTP) is needed by mailscanner-4.44.6-1 >>>>>> perl(POSIX) is needed by mailscanner-4.44.6-1 >>>>>> perl(Socket) is needed by mailscanner-4.44.6-1 >>>>>> perl(strict) is needed by mailscanner-4.44.6-1 >>>>>> perl(Sys::Syslog) is needed by mailscanner-4.44.6-1 >>>>>> perl(Time::localtime) is needed by mailscanner-4.44.6-1 >>>>>> perl(vars) is needed by mailscanner-4.44.6-1 >>>>>> >>>>>> >>>>>> >>>>> >>>>> Are you using the install.sh script? >>>>> >>>>> -- >>>>> Ugo >>>>> >>>>> -> Please don't send a copy of your reply by e-mail. I read >>>>> the list. >>>>> -> Please avoid top-posting, long signatures and HTML, and cut the >>>>> irrelevant parts in your replies. >>>>> >>>>> ------------------------ MailScanner list ------------------------ >>>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>> 'leave mailscanner' in the body of the email. >>>>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>> >>>>> Support MailScanner development - buy the book off the website! >>>>> >>>>> >>>>> >>>>> >>>> >>>> >>>> >>>> Mit freundlichem Grüßen >>>> Best Regards >>>> >>>> Björn Köster >>>> >>>> >>>> =================================================================== >>>> === >>>> MEDIATA Communications GmbH >>>> Kölner Straße 94-96 / 53840 Troisdorf / Germany >>>> >>>> Email: info@mediata.net / Web: www.mediata.net >>>> Tel: +49 (0)2241 809 323 / Fax: +49 (0)2241 809 324 >>>> =================================================================== >>>> === >>>> >>>> ------------------------ MailScanner list ------------------------ >>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>> 'leave mailscanner' in the body of the email. >>>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>>> >>> >>> -- >>> Julian Field >>> www.MailScanner.info >>> Buy the MailScanner book at www.MailScanner.info/store >>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >>> >> >> >> >> Mit freundlichem Grüßen >> Best Regards >> >> Björn Köster >> >> >> ===================================================================== >> = >> MEDIATA Communications GmbH >> Kölner Straße 94-96 / 53840 Troisdorf / Germany >> >> Email: info@mediata.net / Web: www.mediata.net >> Tel: +49 (0)2241 809 323 / Fax: +49 (0)2241 809 324 >> ===================================================================== >> = >> >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> >> >> > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mcalnek at PCPLACE.CA Wed Aug 3 18:22:07 2005 From: mcalnek at PCPLACE.CA (Milton R. Calnek) Date: Thu Jan 12 21:30:31 2006 Subject: Spamassassin always scores 0. Message-ID: Hi, First I want to thank Matt Kettler for his help to date. I really appreciate it. I sent my-self the sample gtube message... this is what mailscanner wrote in maillog: Aug 3 11:16:38 wilma MailScanner[6232]: Message j73HGWNw011514 from 216.197.160.28 (root@dudleycompany.ca) to pcplace.ca is not spam, SpamAssassin (score=0, required 4) It seems to me that mailscanner is simply not calling spamassassin or calling it incorrectly. -- Milton Calnek mcalnek@pcplace.ca +1 306 359 6939 > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Matt Kettler > Sent: Friday, July 29, 2005 1:33 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: [MAILSCANNER] Spamassassin always scores 0. > > Milton R. Calnek wrote: > >>Do you have skip_rbl_checks 1 in your spam.assassin.prefs.conf? > > > > It's commented out. What should it be? > > Commented out, or set to 0. (0 is the default) > > >>Without seeing the message, I couldn't tell you what should or should > >> not have hit. > > I understand what you're saying. Maybe I'll have to intercept some mail. > > This shouldn't be hard. Worst-case you should be able to grab a spam sent > to > your own account > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- DISCLAIMER: The information transmitted is intended only for the addressee and may contain confidential, proprietary and/or privileged material. Any unauthorized review, distribution or other use of or the taking of any action in reliance upon this information is prohibited. If you received this in error, please contact the sender and delete or destroy this message and any copies. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From arrasmith at MATH.WICHITA.EDU Wed Aug 3 18:31:20 2005 From: arrasmith at MATH.WICHITA.EDU (Mark Arrasmith) Date: Thu Jan 12 21:30:31 2006 Subject: Spamassassin always scores 0. Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Wednesday 03 August 2005 12:22 pm, Milton R. Calnek wrote: > I sent my-self the sample gtube message... this is what mailscanner > wrote in maillog: > > Aug 3 11:16:38 wilma MailScanner[6232]: Message j73HGWNw011514 from > 216.197.160.28 (root@dudleycompany.ca) to pcplace.ca is not spam, > SpamAssassin (score=0, required 4) I had the same problem using spamassassin 2.55. I upgraded to 3.0.4 and it started working. Don't know why ... but it worked plus I got *much better* recognition of spam. Down from getting ~ 200 per day to only 2-3 that are scored from 6 to 12 (my deliver range, I delete anything that scores above 12). - mark -- /* * At first I thought these guys were on crack, but then I discovered the * LART. */ - comment from include/linux/mtd/cfi_endian.h ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Wed Aug 3 18:31:01 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:31 2006 Subject: Spamassassin always scores 0. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Milton R. Calnek spake the following on 8/3/2005 10:22 AM: > Hi, > > First I want to thank Matt Kettler for his help to date. I really > appreciate it. > > I sent my-self the sample gtube message... this is what mailscanner > wrote in maillog: > > Aug 3 11:16:38 wilma MailScanner[6232]: Message j73HGWNw011514 from > 216.197.160.28 (root@dudleycompany.ca) to pcplace.ca is not spam, > SpamAssassin (score=0, required 4) > > > It seems to me that mailscanner is simply not calling spamassassin or > calling it incorrectly. Try this; spamassassin --lint -D -p /etc/MailScanner/spam.assassin.prefs.conf if that is where your spam.assassin.prefs.conf file is. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mcalnek at PCPLACE.CA Wed Aug 3 18:46:57 2005 From: mcalnek at PCPLACE.CA (Milton R. Calnek) Date: Thu Jan 12 21:30:31 2006 Subject: Spamassassin always scores 0. Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Mark Arrasmith > Sent: Wednesday, August 03, 2005 11:31 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: [MAILSCANNER] Spamassassin always scores 0. > > On Wednesday 03 August 2005 12:22 pm, Milton R. Calnek wrote: > > I sent my-self the sample gtube message... this is what mailscanner > > wrote in maillog: > > > > Aug 3 11:16:38 wilma MailScanner[6232]: Message j73HGWNw011514 from > > 216.197.160.28 (root@dudleycompany.ca) to pcplace.ca is not spam, > > SpamAssassin (score=0, required 4) > > I had the same problem using spamassassin 2.55. I upgraded to 3.0.4 and > it > started working. Don't know why ... but it worked plus I got *much > better* > recognition of spam. Down from getting ~ 200 per day to only 2-3 that are > scored from 6 to 12 (my deliver range, I delete anything that scores above > 12). > I am currently running 3.0.2... before I upgrade... I ran MailScanner in debug mode and sent the gtube again. This is some of the output. I'm concerned that it starts with score set 0 and then proceeds to score set 1. Also, it's not reading the sa configuration file correctly. Any hints and or suggestions? debug: Score set 0 chosen. debug: running in taint mode? no debug: Failed to parse line in SpamAssassin configuration, skipping: use_razor1 0 debug: Failed to parse line in SpamAssassin configuration, skipping: decode_attachments 1 debug: Score set 0 chosen. SA bayes lock is /root/.spamassassin/bayes.lock Bayes lock is at /root/.spamassassin/bayes.lock debug: Failed to parse line in SpamAssassin configuration, skipping: bayes_file_mode 0660 debug: Failed to parse line in SpamAssassin configuration, skipping: lock_method flock debug: Failed to parse line in SpamAssassin configuration, skipping: use_auto_whitelist 0 debug: Failed to parse line in SpamAssassin configuration, skipping: dcc_path /usr/local/bin/dccproc debug: Failed to parse line in SpamAssassin configuration, skipping: envelope_sender_header X-MailScanner-From debug: Failed to parse line in SpamAssassin configuration, skipping: header FRIEND_GREETINGS Subject =~ /you have an E-Card from/i debug: Failed to parse line in SpamAssassin configuration, skipping: header FRIEND_GREETINGS2 Subject =~ /you have a greeting card from/i debug: Failed to parse line in SpamAssassin configuration, skipping: uri IE_VULN /%([01][0-9a-f]|7f).*@/i debug: Failed to parse line in SpamAssassin configuration, skipping: urirhssub URIBL_JP_SURBL multi.surbl.org. A 64 debug: Failed to parse line in SpamAssassin configuration, skipping: body URIBL_JP_SURBL eval:check_uridnsbl('URIBL_JP_SURBL') debug: Failed to parse line in SpamAssassin configuration, skipping: tflags URIBL_JP_SURBL net debug: using "/etc/MailScanner/mcp" for default rules dir debug: using "/etc/MailScanner/mcp" for site rules dir debug: using "/etc/MailScanner/mcp/mcp.spam.assassin.prefs.conf" for user prefs file debug: Failed to parse line in SpamAssassin configuration, skipping: use_razor1 0 debug: Failed to parse line in SpamAssassin configuration, skipping: decode_attachments 1 debug: Score set 1 chosen. debug: Initialising learner -- Milton Calnek mcalnek@pcplace.ca +1 306 359 6939 -- DISCLAIMER: The information transmitted is intended only for the addressee and may contain confidential, proprietary and/or privileged material. Any unauthorized review, distribution or other use of or the taking of any action in reliance upon this information is prohibited. If you received this in error, please contact the sender and delete or destroy this message and any copies. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Wed Aug 3 19:02:46 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:30:31 2006 Subject: Spamassassin always scores 0. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Milton R. Calnek wrote: > I am currently running 3.0.2... before I upgrade... > > I ran MailScanner in debug mode and sent the gtube again. > > This is some of the output. I'm concerned that it starts with score set > 0 and then proceeds to score set 1. Also, it's not reading the sa > configuration file correctly. Scoreset switches are NORMAL for SA unless you've hard-coded dns available. We've discussed this much before. > > > Any hints and or suggestions? Yes... all those "failed to parse line" errors.. fix them. ASAP. > > debug: Score set 0 chosen. > debug: running in taint mode? no > debug: Failed to parse line in SpamAssassin configuration, skipping: > use_razor1 0 Delete option. SA no longer supports razor1, so this option was dropped. > debug: Failed to parse line in SpamAssassin configuration, skipping: > decode_attachments 1 Not a valid SA option, and AFAIK, it never has been. > debug: Score set 0 chosen. > SA bayes lock is /root/.spamassassin/bayes.lock > Bayes lock is at /root/.spamassassin/bayes.lock > debug: Failed to parse line in SpamAssassin configuration, skipping: > bayes_file_mode 0660 Well, I don't know why it failed to parse, it should honor this in every version of SA starting with 2.50. Are you *sure* your install is really SA 3.0.2 and not some old version. Double check. Look for duplicate installs. The behavior I see from your errors would be consistent with SA 2.43 trying to parse SA 3.0 configfiles and a mixture of outdated and buggy options. That said 660 would be a very bad idea to use as a bayes_file_mode. This appears to be Julian's default in spam.assassin.prefs.conf. I'll take that up with him in a separate message. You *MUST* include the "x" bit in bayes_file_mode. It's used in creating directories and very bad things will happen if you set it to anything other than 700, 770 or 777. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Aug 3 19:41:09 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:31 2006 Subject: MailScanner revision: 4.44 installation issues resolved Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 There were problems with the release of version 4.44 that caused installation difficulties on some RPM-based systems. These have now been resolved, and the installation should work normally again now. Please download the latest release from www.mailscanner.info Many thanks for your patience while this was being resolved. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQvEPxhH2WUcUFbZUEQKkjwCghIGzzWF4Fzts64vJdi33NWlTSrkAoOLa gTZJ0hlY8E0fhVwxo8Y9RkQI =MdP+ -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mcalnek at PCPLACE.CA Wed Aug 3 21:16:01 2005 From: mcalnek at PCPLACE.CA (Milton R. Calnek) Date: Thu Jan 12 21:30:31 2006 Subject: Solved!! RE: [MAILSCANNER] Spamassassin always scores 0. Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Matt Kettler > Sent: Wednesday, August 03, 2005 12:03 PM > > debug: Score set 0 chosen. > > SA bayes lock is /root/.spamassassin/bayes.lock > > Bayes lock is at /root/.spamassassin/bayes.lock > > debug: Failed to parse line in SpamAssassin configuration, skipping: > > bayes_file_mode 0660 > > Well, I don't know why it failed to parse, it should honor this in every > version > of SA starting with 2.50. Are you *sure* your install is really SA 3.0.2 > and not > some old version. > > Double check. Look for duplicate installs. > > The behavior I see from your errors would be consistent with SA 2.43 > trying to > parse SA 3.0 configfiles and a mixture of outdated and buggy options. How about 2.63? I found a non-rpm'd version installed. Once I removed it and restarted msilscanner, spam scores are no longer 0. Thanks Matt. > You *MUST* include the "x" bit in bayes_file_mode. It's used in creating > directories and very bad things will happen if you set it to anything > other than > 700, 770 or 777. I'll keep that in mind when I start using baynes. -- Milton Calnek mcalnek@pcplace.ca +1 306 359 6939 -- DISCLAIMER: The information transmitted is intended only for the addressee and may contain confidential, proprietary and/or privileged material. Any unauthorized review, distribution or other use of or the taking of any action in reliance upon this information is prohibited. If you received this in error, please contact the sender and delete or destroy this message and any copies. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dstraka at CASPERCOLLEGE.EDU Wed Aug 3 21:05:51 2005 From: dstraka at CASPERCOLLEGE.EDU (Daniel Straka) Date: Thu Jan 12 21:30:31 2006 Subject: Load balancing spamd Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Is my SpamAssassin working? This is in my maillog: Aug 3 14:47:53 mail1 MailScanner[30264]: SpamAssassin returned 7424 What does the 7424 mean? ** The following is output from runing the command (see next line) to help debug SpamAssassin [root@mail1 spamassassin]# spamassassin -D -p /etc/MailScanner/spam.assassin.prefs.conf \--lint debug: Score set 0 chosen. debug: running in taint mode? yes debug: Running in taint mode, removing unsafe env vars, and resetting PATH debug: PATH included '/usr/local/bin', keeping. debug: PATH included '/bin', keeping. debug: PATH included '/usr/bin', keeping. debug: PATH included '/usr/X11R6/bin', keeping. debug: PATH included '/home/dstraka/bin', which doesn't exist, dropping. debug: PATH included '/sbin', keeping. debug: Final PATH set to: /usr/local/bin:/bin:/usr/bin:/usr/X11R6/bin:/sbin debug: ignore: using a test message to lint rules debug: using "/usr/share/spamassassin" for default rules dir debug: using "/etc/mail/spamassassin" for site rules dir debug: using "/root/.spamassassin" for user state dir debug: using "/etc/MailScanner/spam.assassin.prefs.conf" for user prefs file Failed to parse line in SpamAssassin configuration, skipping: /etc/mail/spamassassin/local.cf Failed to parse line in SpamAssassin configuration, skipping: /etc/mail/spamassassin/local.cf.saved Failed to parse line in SpamAssassin configuration, skipping: /etc/MailScanner/rules/spam.whitelist.rules Failed to parse line in SpamAssassin configuration, skipping: /etc/MailScanner/rules/spam.blacklist.rules Failed to parse line in SpamAssassin configuration, skipping: lock_method flock Failed to parse line in SpamAssassin configuration, skipping: use_auto_whitelist 0 Failed to parse line in SpamAssassin configuration, skipping: envelope_sender_header X-MailScanner-From Failed to parse line in SpamAssassin configuration, skipping: urirhssub URIBL_JP_SURBL multi.surbl.org. A 64 debug: bayes: no dbs present, cannot scan: /usr/log/spamassassin_toks debug: Score set 1 chosen. debug: Initialising learner debug: bayes: no dbs present, cannot scan: /usr/log/spamassassin_toks debug: dns_available set to yes in config file, skipping test debug: is Net::DNS::Resolver available? no debug: is Net::DNS::Resolver available? no debug: is Net::DNS::Resolver available? no debug: is Net::DNS::Resolver available? no debug: is Net::DNS::Resolver available? no debug: is Net::DNS::Resolver available? no debug: is Net::DNS::Resolver available? no debug: all '*From' addrs: ignore@compiling.spamassassin.taint.org debug: is Net::DNS::Resolver available? no Failed to run DNS_FROM_RFCI_DSN RBL SpamAssassin test, skipping: (Can't call method "bgsend" on an undefined value at /usr/lib/perl5/site_perl/5.6.0/Mail/SpamAssassin/Dns.pm line 153. ) debug: is Net::DNS::Resolver available? no debug: is Net::DNS::Resolver available? no debug: is Net::DNS::Resolver available? no debug: is Net::DNS::Resolver available? no debug: running header regexp tests; score so far=0 debug: running body-text per-line regexp tests; score so far=1.27 debug: Razor2 is not available Failed to run URIBL_JP_SURBL SpamAssassin test, skipping: (Can't locate object method "check_uridnsbl" via package "Mail::SpamAssassin::PerMsgStatus" at /usr/lib/perl5/site_perl/5.6.0/Mail/SpamAssassin/PerMsgStatus.pm line 2293. ) debug: running raw-body-text per-line regexp tests; score so far=1.27 debug: running uri tests; score so far=1.27 debug: uri tests: Done uriRE debug: running full-text regexp tests; score so far=1.27 debug: Razor2 is not available debug: DCCifd is not available: no r/w dccifd socket found. debug: DCC is not available: no executable dccproc found. debug: Pyzor is not available: pyzor not found debug: all '*To' addrs: debug: is Net::DNS::Resolver available? no debug: RBL: success for 0 of 0 queries debug: running meta tests; score so far=1.27 debug: is spam? score=1.27 required=5 tests=DATE_MISSING,NO_REAL_NAME [root@mail1 spamassassin]# Dan Straka Casper College (307)268-2399 ** Visit Casper College Online at www.caspercollege.edu ** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dstraka at CASPERCOLLEGE.EDU Wed Aug 3 21:11:57 2005 From: dstraka at CASPERCOLLEGE.EDU (Daniel Straka) Date: Thu Jan 12 21:30:31 2006 Subject: Is my SpamAssassin working? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I'm an idiot...if you caught my last post's subject line... Is my SpamAssassin working? This is in my maillog: Aug 3 14:47:53 mail1 MailScanner[30264]: SpamAssassin returned 7424 What does the 7424 mean? ** The following is output from runing the command (see next line) to help debug SpamAssassin [root@mail1 spamassassin]# spamassassin -D -p /etc/MailScanner/spam.assassin.prefs.conf \--lint debug: Score set 0 chosen. debug: running in taint mode? yes debug: Running in taint mode, removing unsafe env vars, and resetting PATH debug: PATH included '/usr/local/bin', keeping. debug: PATH included '/bin', keeping. debug: PATH included '/usr/bin', keeping. debug: PATH included '/usr/X11R6/bin', keeping. debug: PATH included '/home/dstraka/bin', which doesn't exist, dropping. debug: PATH included '/sbin', keeping. debug: Final PATH set to: /usr/local/bin:/bin:/usr/bin:/usr/X11R6/bin:/sbin debug: ignore: using a test message to lint rules debug: using "/usr/share/spamassassin" for default rules dir debug: using "/etc/mail/spamassassin" for site rules dir debug: using "/root/.spamassassin" for user state dir debug: using "/etc/MailScanner/spam.assassin.prefs.conf" for user prefs file Failed to parse line in SpamAssassin configuration, skipping: /etc/mail/spamassassin/local.cf Failed to parse line in SpamAssassin configuration, skipping: /etc/mail/spamassassin/local.cf.saved Failed to parse line in SpamAssassin configuration, skipping: /etc/MailScanner/rules/spam.whitelist.rules Failed to parse line in SpamAssassin configuration, skipping: /etc/MailScanner/rules/spam.blacklist.rules Failed to parse line in SpamAssassin configuration, skipping: lock_method flock Failed to parse line in SpamAssassin configuration, skipping: use_auto_whitelist 0 Failed to parse line in SpamAssassin configuration, skipping: envelope_sender_header X-MailScanner-From Failed to parse line in SpamAssassin configuration, skipping: urirhssub URIBL_JP_SURBL multi.surbl.org. A 64 debug: bayes: no dbs present, cannot scan: /usr/log/spamassassin_toks debug: Score set 1 chosen. debug: Initialising learner debug: bayes: no dbs present, cannot scan: /usr/log/spamassassin_toks debug: dns_available set to yes in config file, skipping test debug: is Net::DNS::Resolver available? no debug: is Net::DNS::Resolver available? no debug: is Net::DNS::Resolver available? no debug: is Net::DNS::Resolver available? no debug: is Net::DNS::Resolver available? no debug: is Net::DNS::Resolver available? no debug: is Net::DNS::Resolver available? no debug: all '*From' addrs: ignore@compiling.spamassassin.taint.org debug: is Net::DNS::Resolver available? no Failed to run DNS_FROM_RFCI_DSN RBL SpamAssassin test, skipping: (Can't call method "bgsend" on an undefined value at /usr/lib/perl5/site_perl/5.6.0/Mail/SpamAssassin/Dns.pm line 153. ) debug: is Net::DNS::Resolver available? no debug: is Net::DNS::Resolver available? no debug: is Net::DNS::Resolver available? no debug: is Net::DNS::Resolver available? no debug: running header regexp tests; score so far=0 debug: running body-text per-line regexp tests; score so far=1.27 debug: Razor2 is not available Failed to run URIBL_JP_SURBL SpamAssassin test, skipping: (Can't locate object method "check_uridnsbl" via package "Mail::SpamAssassin::PerMsgStatus" at /usr/lib/perl5/site_perl/5.6.0/Mail/SpamAssassin/PerMsgStatus.pm line 2293. ) debug: running raw-body-text per-line regexp tests; score so far=1.27 debug: running uri tests; score so far=1.27 debug: uri tests: Done uriRE debug: running full-text regexp tests; score so far=1.27 debug: Razor2 is not available debug: DCCifd is not available: no r/w dccifd socket found. debug: DCC is not available: no executable dccproc found. debug: Pyzor is not available: pyzor not found debug: all '*To' addrs: debug: is Net::DNS::Resolver available? no debug: RBL: success for 0 of 0 queries debug: running meta tests; score so far=1.27 debug: is spam? score=1.27 required=5 tests=DATE_MISSING,NO_REAL_NAME [root@mail1 spamassassin]# Dan Straka Casper College (307)268-2399 ** Visit Casper College Online at www.caspercollege.edu ** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! Dan Straka Casper College (307)268-2399 ** Visit Casper College Online at www.caspercollege.edu ** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at gmail.com Wed Aug 3 22:32:02 2005 From: glenn.steen at gmail.com (Glenn Steen) Date: Thu Jan 12 21:30:31 2006 Subject: Spamassassin always scores 0. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 03/08/05, Matt Kettler wrote: > > debug: Score set 0 chosen. > > SA bayes lock is /root/.spamassassin/bayes.lock > > Bayes lock is at /root/.spamassassin/bayes.lock > > debug: Failed to parse line in SpamAssassin configuration, skipping: > > bayes_file_mode 0660 > > Well, I don't know why it failed to parse, it should honor this in every version > of SA starting with 2.50. Are you *sure* your install is really SA 3.0.2 and not > some old version. Could it be a line end problem ... perhaps CR/LF or somesuch? -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Thu Aug 4 00:07:38 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:30:31 2006 Subject: Attn Julian - broken bayes_file_mode defaults in spam.assassin.prefs.conf Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian, I noticed recently that your spam.assassin.prefs.conf sets bayes_file_mode 0660 That's broken. You need 0770 as sometimes the mode is used in creating temp directories. (This is also why SA defaults to 0700, so check for yourself) The normal files won't end up with execute bits from this, as the above mode is really a mask. SA will mask maximum sensible permissions, 0666 for file or 777 for directory, against the bayes_file mode. Thus, for bayes_toks SA will mask 666 against 770 and end up with 660. Can you fix that? Or has it already been fixed in a newer version than I'm running? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Thu Aug 4 00:19:29 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:30:31 2006 Subject: Is my SpamAssassin working? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Daniel Straka wrote: > I'm an idiot...if you caught my last post's subject line... > > Is my SpamAssassin working? Decidedly NOT. That lint output is frighteningly scary. > > > [root@mail1 spamassassin]# spamassassin -D -p > /etc/MailScanner/spam.assassin.prefs.conf \--lint > debug: Score set 0 chosen. > debug: using "/usr/share/spamassassin" for default rules dir > debug: using "/etc/mail/spamassassin" for site rules dir > debug: using "/root/.spamassassin" for user state dir > debug: using "/etc/MailScanner/spam.assassin.prefs.conf" for user prefs file > Failed to parse line in SpamAssassin configuration, skipping: > /etc/mail/spamassassin/local.cf > Failed to parse line in SpamAssassin configuration, skipping: > /etc/mail/spamassassin/local.cf.saved It looks like you've got the output of ls in a file somewhere that SA is parsing. Read carefully. It's not complaining it can't parse the file /etc/mail/spamassassin/local.cf, it's complaining that it found a line containing that literal text in one of the configfiles! Clearly no file SA parses should have "/etc/mail/spamassassin/local.cf" as a text line in the file. I'd venture to guess you've got garbage in /etc/mail/spamassassin/*.cf (SA will read all .cf files in that directory) > debug: bayes: no dbs present, cannot scan: /usr/log/spamassassin_toks That looks like you've got: bayes_path /usr/log/spamassassin Which isn't right, you want: bayes_path /usr/log/spamassassin/bayes Bayes_path actually isn't just a path, it's a path plus partial filename, and SA will append "_toks", "_seen", etc. to it. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From darren at TORSION.CO.UK Thu Aug 4 00:27:31 2005 From: darren at TORSION.CO.UK (darren) Date: Thu Jan 12 21:30:31 2006 Subject: BlueQuartz problem Message-ID: Hi I have just tried to install Mailscanner on a BlueQuartz installation, which is Fedora Core 1 and an open source copy of the Cobalt Raq 550. I had to install most of the dependencies by hand because the installer failed over and over. Eventually I managed to install the whole thing, but when I do a MailScanner status I get the following, and it doesn't seem to be scanning emails Cannot open config file status, No such file or directory at /usr/lib/MailScanner/MailScanner/Config.pm line 592. Compilation failed in require at /usr/sbin/MailScanner line 65. BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 65. Can anyone help? Thanks ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at gmail.com Thu Aug 4 09:03:00 2005 From: glenn.steen at gmail.com (Glenn Steen) Date: Thu Jan 12 21:30:31 2006 Subject: BlueQuartz problem Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 04/08/05, darren wrote: > > > Hi > > I have just tried to install Mailscanner on a BlueQuartz installation, which > is Fedora Core 1 and an open source copy of the Cobalt Raq 550. I had to > install most of the dependencies by hand because the installer failed over > and over. > > > Eventually I managed to install the whole thing, but when I do a MailScanner > status I get the following, and it doesn't seem to be scanning emails > > > Cannot open config file status, No such file or directory at > /usr/lib/MailScanner/MailScanner/Config.pm line 592. > Compilation failed in require at /usr/sbin/MailScanner line 65. > BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 65. > > Can anyone help? > > Thanks Um, AFAICS that would require the file "status" to be an alternative MailScanner.conf ... Probably not what you want;-). If BlueQuartz is anything like an RH system you might be after the "service" command(?)... service MailScanner status which would run the init-script (perhaps situated in /etc/init.d/MailScanner) with the status option... Would be equivalent with /etc/init.d/MailScanner status assuming, of course, that /etc/init.d is the path to the init-scripts:-). Using ps ("ps xww|grep MailScanner|grep -v grep") or reading the mail log would be better indicators as to whether it works or not. BTW, I read the list, so no need to mail me directly;-). -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Aug 4 09:07:44 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:31 2006 Subject: Attn Julian - broken bayes_file_mode defaults in spam.assassin.prefs.conf Message-ID: I have just corrected this setting, so it will be in the next release. Why was it apparently working okay on everyone's systems? On 4 Aug 2005, at 00:07, Matt Kettler wrote: > Julian, I noticed recently that your spam.assassin.prefs.conf sets > > bayes_file_mode 0660 > > That's broken. You need 0770 as sometimes the mode is used in > creating temp > directories. (This is also why SA defaults to 0700, so check for > yourself) > > The normal files won't end up with execute bits from this, as the > above mode is > really a mask. SA will mask maximum sensible permissions, 0666 for > file or 777 > for directory, against the bayes_file mode. Thus, for bayes_toks SA > will mask > 666 against 770 and end up with 660. > > Can you fix that? Or has it already been fixed in a newer version > than I'm running? > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at gmail.com Thu Aug 4 09:07:07 2005 From: glenn.steen at gmail.com (Glenn Steen) Date: Thu Jan 12 21:30:31 2006 Subject: Spamassassin always scores 0. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 03/08/05, Glenn Steen wrote: > On 03/08/05, Matt Kettler wrote: > > > > debug: Score set 0 chosen. > > > SA bayes lock is /root/.spamassassin/bayes.lock > > > Bayes lock is at /root/.spamassassin/bayes.lock > > > debug: Failed to parse line in SpamAssassin configuration, skipping: > > > bayes_file_mode 0660 > > > > Well, I don't know why it failed to parse, it should honor this in every version > > of SA starting with 2.50. Are you *sure* your install is really SA 3.0.2 and not > > some old version. > Could it be a line end problem ... perhaps CR/LF or somesuch? > -- > -- Glenn > email: glenn < dot > steen < at > gmail < dot > com > work: glenn < dot > steen < at > ap1 < dot > se > Ah, I see ... Multiple SAs. What a bummer:-). Glad to hear it's resolved. -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at gmail.com Thu Aug 4 09:14:58 2005 From: glenn.steen at gmail.com (Glenn Steen) Date: Thu Jan 12 21:30:31 2006 Subject: BlueQuartz problem Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 04/08/05, Glenn Steen wrote: > Using ps ("ps xww|grep MailScanner|grep -v grep") or reading the mail > log would be better indicators as to whether it works or not. Ooops, the ps should (of course) include "a", since you might be running MS as another user: ps axww|grep MailScanner|grep -v grep ... now, where's that coffee.... -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From amoore at DEKALBMEMORIAL.COM Thu Aug 4 14:22:26 2005 From: amoore at DEKALBMEMORIAL.COM (Aaron K. Moore) Date: Thu Jan 12 21:30:31 2006 Subject: Attn Julian - broken bayes_file_mode defaults in spam.assassin.prefs.conf Message-ID: Maybe Matt isn't running MailScanner as root. -- Aaron Kent Moore Information Technology Services DeKalb Memorial Hospital, Inc. Auburn, IN E-mail: amoore@dekalbmemorial.com Julian Field wrote: > I have just corrected this setting, so it will be in the next release. > Why was it apparently working okay on everyone's systems? > > On 4 Aug 2005, at 00:07, Matt Kettler wrote: > >> Julian, I noticed recently that your spam.assassin.prefs.conf sets >> >> bayes_file_mode 0660 >> >> That's broken. You need 0770 as sometimes the mode is used in >> creating temp directories. (This is also why SA defaults to 0700, so >> check for yourself) >> >> The normal files won't end up with execute bits from this, as the >> above mode is really a mask. SA will mask maximum sensible >> permissions, 0666 for file or 777 for directory, against the >> bayes_file mode. Thus, for bayes_toks SA will mask 666 against 770 >> and end up with 660. >> >> Can you fix that? Or has it already been fixed in a newer version >> than I'm running? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Thu Aug 4 17:24:04 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:30:31 2006 Subject: Attn Julian - broken bayes_file_mode defaults in spam.assassin.prefs.conf Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > I have just corrected this setting, so it will be in the next release. > Why was it apparently working okay on everyone's systems? I just looked at the code.. If the parent directory for the bayes DB doesn't exist, SA will create it with bayes_file_mode & 0777. So it's going to be a rare case for most mailscanner users, only possibly causing problems on a new install. Most admins that encounter this probably wind up fixing the permissions on the dir without much thought. grep BayesStore/DBM.pm for 0777 for more details. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Thu Aug 4 17:26:47 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:30:31 2006 Subject: Attn Julian - broken bayes_file_mode defaults in spam.assassin.prefs.conf Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Aaron K. Moore wrote: > Maybe Matt isn't running MailScanner as root. I'm not encountering problems, as I use neither bayes_path nor bayes_file_mode. I just noticed the error based on remembering Theo chastise a few people on the spamassassin-users list when they set it to 600, 660, or 666. Besides, if everything is running as root, the 660 is irrelevant anyway. The default of 700 would be adequate, which is what I use. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dstraka at CASPERCOLLEGE.EDU Thu Aug 4 18:54:11 2005 From: dstraka at CASPERCOLLEGE.EDU (Daniel Straka) Date: Thu Jan 12 21:30:31 2006 Subject: SpamAssassin not working. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi List, SpamAssassin is not working. I followed the install directions in Julian's book (p.16) and it says this is all that typically needs to be done. Does anyone have a quick-start guide for getting SA to work? Dan Straka Casper College (307)268-2399 ** Visit Casper College Online at www.caspercollege.edu ** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Thu Aug 4 20:09:08 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:31 2006 Subject: SpamAssassin not working. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Daniel Straka wrote: > Hi List, > > SpamAssassin is not working. I followed the install directions in > Julian's book (p.16) and it says this is all that typically needs to be > done. Does anyone have a quick-start guide for getting SA to work? > > Dan Straka > Casper College > (307)268-2399 > > ** Visit Casper College Online at www.caspercollege.edu ** > what gives this command? spamassassin -V what is your OS? Version? Did you enable SpamAssassin in MailScanner.conf? -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dstraka at CASPERCOLLEGE.EDU Thu Aug 4 19:31:47 2005 From: dstraka at CASPERCOLLEGE.EDU (Daniel Straka) Date: Thu Jan 12 21:30:31 2006 Subject: SpamAssassin not working. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Quoting Ugo Bellavance : > Daniel Straka wrote: > > Hi List, > > > > SpamAssassin is not working. I followed the install directions in > > Julian's book (p.16) and it says this is all that typically needs > to be > > done. Does anyone have a quick-start guide for getting SA to work? > > > > Dan Straka > > Casper College > > (307)268-2399 > > > > ** Visit Casper College Online at www.caspercollege.edu ** > > > > what gives this command? > > spamassassin -V > > what is your OS? Version? > > Did you enable SpamAssassin in MailScanner.conf? > > -- > Ugo > > -> Please don't send a copy of your reply by e-mail. I read the > list. > -> Please avoid top-posting, long signatures and HTML, and cut the > irrelevant parts in your replies. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > Ugo...here's what I've got. [root@mail1 log]# spamassassin -V SpamAssassin version 2.64 Red Hat 7.2 MailScanner 4.43.8 MailScanner.conf: # # SpamAssassin # ------------ # # Do you want to find spam using the "SpamAssassin" package? # This can also be the filename of a ruleset. Use SpamAssassin = yes Dan Straka Casper College (307)268-2399 ** Visit Casper College Online at www.caspercollege.edu ** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Thu Aug 4 20:56:41 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:31 2006 Subject: SpamAssassin not working. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Daniel Straka wrote: > Quoting Ugo Bellavance : > > >>Daniel Straka wrote: >> >>>Hi List, >>> >>>SpamAssassin is not working. I followed the install directions in >>>Julian's book (p.16) and it says this is all that typically needs >> >>to be >> >>>done. Does anyone have a quick-start guide for getting SA to work? >>> >>>Dan Straka >>>Casper College >>>(307)268-2399 >>> >>> ** Visit Casper College Online at www.caspercollege.edu ** >>> >> >>what gives this command? >> >>spamassassin -V >> >>what is your OS? Version? >> >>Did you enable SpamAssassin in MailScanner.conf? >> >>-- >>Ugo >> >>-> Please don't send a copy of your reply by e-mail. I read the >>list. >>-> Please avoid top-posting, long signatures and HTML, and cut the >>irrelevant parts in your replies. >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> > > > Ugo...here's what I've got. > > [root@mail1 log]# spamassassin -V > SpamAssassin version 2.64 > Red Hat 7.2 > MailScanner 4.43.8 > MailScanner.conf: > # > # SpamAssassin > # ------------ > # > # Do you want to find spam using the "SpamAssassin" package? > # This can also be the filename of a ruleset. > Use SpamAssassin = yes > Excellent (except from the SA version, you should go to 3.X. Now, how can you tell that SpamAssassin is not working? -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Thu Aug 4 21:34:27 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:30:31 2006 Subject: SpamAssassin not working. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ugo Bellavance wrote: > > Excellent (except from the SA version, you should go to 3.X. While that would be optimal in the long run, he can't just upgrade to 3.x. He needs to upgrade perl or RedHat to do that. (RedHat 7.2 is perl 5.6.0 based) > Now, how can you tell that SpamAssassin is not working? Agreed.. Specific signs of what's going on are important here. Also, try to see if spamassassin itself is working by running: spamassassin -p /etc/MailScanner/spam.assassin.prefs.conf --lint It should run quietly without any complaints. If it's complaining about parse errors, you need to fix those before SA will run well for MailScanner. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dstraka at CASPERCOLLEGE.EDU Thu Aug 4 20:58:40 2005 From: dstraka at CASPERCOLLEGE.EDU (Daniel Straka) Date: Thu Jan 12 21:30:32 2006 Subject: SpamAssassin not working. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Quoting Matt Kettler : > Ugo Bellavance wrote: > > > > Excellent (except from the SA version, you should go to 3.X. > > While that would be optimal in the long run, he can't just upgrade to > 3.x. > > He needs to upgrade perl or RedHat to do that. (RedHat 7.2 is perl > 5.6.0 based) > > > Now, how can you tell that SpamAssassin is not working? > > Agreed.. Specific signs of what's going on are important here. > > Also, try to see if spamassassin itself is working by running: > > spamassassin -p /etc/MailScanner/spam.assassin.prefs.conf --lint > > It should run quietly without any complaints. If it's complaining > about parse > errors, you need to fix those before SA will run well for > MailScanner. > Good point Ugo, how can I tell it IS working? Matt...following is the command results. Things don't look quite right. [root@mail1 rules]# spamassassin -p /etc/MailScanner/spam.assassin.prefs.conf --lint Failed to parse line in SpamAssassin configuration, skipping: /etc/mail/spamassassin/local.cf Failed to parse line in SpamAssassin configuration, skipping: /etc/mail/spamassassin/local.cf.saved Failed to parse line in SpamAssassin configuration, skipping: /etc/MailScanner/rules/spam.whitelist.rules Failed to parse line in SpamAssassin configuration, skipping: /etc/MailScanner/rules/spam.blacklist.rules Failed to parse line in SpamAssassin configuration, skipping: lock_method flock Failed to parse line in SpamAssassin configuration, skipping: use_auto_whitelist 0 Failed to parse line in SpamAssassin configuration, skipping: envelope_sender_header X-MailScanner-From Failed to parse line in SpamAssassin configuration, skipping: urirhssub URIBL_JP_SURBL multi.surbl.org. A 64 Failed to run DNS_FROM_RFCI_DSN RBL SpamAssassin test, skipping: (Can't call method "bgsend" on an undefined value at /usr/lib/perl5/site_perl/5.6.0/Mail/SpamAssassin/Dns.pm line 153. ) Failed to run URIBL_JP_SURBL SpamAssassin test, skipping: (Can't locate object method "check_uridnsbl" via package "Mail::SpamAssassin::PerMsgStatus" at /usr/lib/perl5/site_perl/5.6.0/Mail/SpamAssassin/PerMsgStatus.pm line 2293. ) [root@mail1 rules]# Dan Straka Casper College (307)268-2399 ** Visit Casper College Online at www.caspercollege.edu ** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Thu Aug 4 22:07:34 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:30:32 2006 Subject: SpamAssassin not working. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Daniel Straka wrote: > Good point Ugo, how can I tell it IS working? > Matt...following is the command results. Things don't look quite right. > > [root@mail1 rules]# spamassassin -p > /etc/MailScanner/spam.assassin.prefs.conf --lint > Failed to parse line in SpamAssassin configuration, skipping: > /etc/mail/spamassassin/local.cf Dan, This is the same problem you had before. Re-read my 8/3 post under "Re: Spamassassin always scores 0." ---REQUOTING MYSELF ---- It looks like you've got the output of ls in a file somewhere that SA is parsing. Read carefully. It's not complaining it can't parse the file /etc/mail/spamassassin/local.cf, it's complaining that it found a line containing that literal text in one of the configfiles! Clearly no file SA parses should have "/etc/mail/spamassassin/local.cf" as a text line in the file. I'd venture to guess you've got garbage in /etc/mail/spamassassin/*.cf (SA will read all .cf files in that directory) ----------------------- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From hywel at BURRIS.ORG.UK Thu Aug 4 22:13:17 2005 From: hywel at BURRIS.ORG.UK (Hywel Burris) Date: Thu Jan 12 21:30:32 2006 Subject: OT: Sendmail and Mailertable Problem Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, Sorry for the off topic request for help but i am sure that someone here will have had the same problem. I am using mailertable to route mails to our sister companies after scanning them. The problem is that sendmail refuses to use the value in /etc/mail/mailertable even though it's in brackets and always uses the dns. Config below [root@mail-2 mail]# cat sendmail.mc | grep mailer dnl FEATURE(`mailertable',`hash -o /etc/mail/mailertable.db')dnl FEATURE(`mailertable',`hash /etc/mail/mailertable.db')dnl I have tried both there not sure what the -o is for but it was in there as default on RH9. the domain is in the relay-domains file [root@mail-2 mail]# cat mailertable | grep abcd .abcd.co.uk smtp:[mail.abcd.co.uk] I have overcome this problem by adding a zone file and mx on bind for the host. Thanks in advance. Hywel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dstraka at CASPERCOLLEGE.EDU Thu Aug 4 21:35:46 2005 From: dstraka at CASPERCOLLEGE.EDU (Daniel Straka) Date: Thu Jan 12 21:30:32 2006 Subject: SpamAssassin not working. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Quoting Matt Kettler : > Daniel Straka wrote: > > Good point Ugo, how can I tell it IS working? > > Matt...following is the command results. Things don't look quite > right. > > > > [root@mail1 rules]# spamassassin -p > > /etc/MailScanner/spam.assassin.prefs.conf --lint > > Failed to parse line in SpamAssassin configuration, skipping: > > /etc/mail/spamassassin/local.cf > > Dan, > > This is the same problem you had before. Re-read my 8/3 post under > "Re: > Spamassassin always scores 0." > > > > ---REQUOTING MYSELF ---- > > It looks like you've got the output of ls in a file somewhere that SA > is parsing. > > Read carefully. It's not complaining it can't parse the file > /etc/mail/spamassassin/local.cf, it's complaining that it found a > line > containing that literal text in one of the configfiles! > > > Clearly no file SA parses should have > "/etc/mail/spamassassin/local.cf" as a > text line in the file. > > I'd venture to guess you've got garbage in > /etc/mail/spamassassin/*.cf (SA will > read all .cf files in that directory) > Matt, /etc/mail/spamassassin/local.cf is the only file in that dir. Below is what's in it. Every line is commented out. I'll keep digging around. [root@mail1 spamassassin]# ls local.cf [root@mail1 spamassassin]# cat local.cf # This is the right place to customize your installation of SpamAssassin. # # See 'perldoc Mail::SpamAssassin::Conf' for details of what can be # tweaked. # ########################################################################### # # rewrite_subject 0 # report_safe 1 # trusted_networks 212.17.35. [root@mail1 spamassassin]# Dan Straka Casper College (307)268-2399 ** Visit Casper College Online at www.caspercollege.edu ** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Thu Aug 4 22:48:03 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:32 2006 Subject: OT: Sendmail and Mailertable Problem Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hywel Burris wrote: > Hi, > > Sorry for the off topic request for help but i am sure that someone > here will have had the same problem. > > I am using mailertable to route mails to our sister companies after > scanning them. The problem is that sendmail refuses to use the value > in /etc/mail/mailertable even though it's in brackets and always uses > the dns. > > Config below > > [root@mail-2 mail]# cat sendmail.mc | grep mailer > dnl FEATURE(`mailertable',`hash -o /etc/mail/mailertable.db')dnl > FEATURE(`mailertable',`hash /etc/mail/mailertable.db')dnl > > I have tried both there not sure what the -o is for but it was in > there as default on RH9. > > the domain is in the relay-domains file > > [root@mail-2 mail]# cat mailertable | grep abcd > .abcd.co.uk smtp:[mail.abcd.co.uk] > > I have overcome this problem by adding a zone file and mx on bind for > the host. > > Thanks in advance. > > Hywel > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! Have you tried: To: abcd.co.uk RELAY You're not saying how exactly sendmail refuses, and if any errors come up. Have you run "makemap hash mailertable.db < mailertable"? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From christian.schmidt at CHEMIE.UNI-HAMBURG.DE Thu Aug 4 22:43:57 2005 From: christian.schmidt at CHEMIE.UNI-HAMBURG.DE (Christian Schmidt) Date: Thu Jan 12 21:30:32 2006 Subject: SpamAssassin not working. Message-ID: Hello Daniel, Daniel Straka, 04.08.2005 (d.m.y): > Good point Ugo, how can I tell it IS working? Run a test with the GTUBE test string. Yours, Christian -- Alkoholismus: Gift und Gegengift sind identisch. -- Gerhard Uhlenbruck ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From hywel at BURRIS.ORG.UK Thu Aug 4 22:58:31 2005 From: hywel at BURRIS.ORG.UK (Hywel Burris) Date: Thu Jan 12 21:30:32 2006 Subject: OT: Sendmail and Mailertable Problem Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >> MailScanner development - buy the book off the website! > > > Have you tried: > > To: abcd.co.uk RELAY > No, do you mean in the access file? or in mailertable as .abcd.co.uk relay:[mail.abcd.co.uk] > You're not saying how exactly sendmail refuses, and if any errors come > up. Well its doing an MX lookup on the domain rather than using the value in the mailertable Have you run "makemap hash mailertable.db < mailertable"? yes Thanks again Hywel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Thu Aug 4 23:04:54 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:32 2006 Subject: OT: Sendmail and Mailertable Problem Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hywel Burris wrote: >>> MailScanner development - buy the book off the website! >> >> >> >> Have you tried: >> >> To: abcd.co.uk RELAY >> > No, do you mean in the access file? or in mailertable as > .abcd.co.uk relay:[mail.abcd.co.uk] In the access file. > >> You're not saying how exactly sendmail refuses, and if any errors >> come up. > > > Well its doing an MX lookup on the domain rather than using the value > in the mailertable > > Have you run "makemap hash mailertable.db < mailertable"? > > yes > Have you killed and restarted the processes so they load the new files? Have you tried using IP addresses instead of names? > > > Thanks again > > Hywel > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smf at F2S.COM Thu Aug 4 23:14:12 2005 From: smf at F2S.COM (Steve Freegard) Date: Thu Jan 12 21:30:32 2006 Subject: Attn Julian - broken bayes_file_mode defaults in spam.assassin.prefs.conf Message-ID: Hi Matt/Julian, On Thu, 2005-08-04 at 12:26 -0400, Matt Kettler wrote: > Aaron K. Moore wrote: > > Maybe Matt isn't running MailScanner as root. > > I'm not encountering problems, as I use neither bayes_path nor bayes_file_mode. > > I just noticed the error based on remembering Theo chastise a few people on the > spamassassin-users list when they set it to 600, 660, or 666. > > > Besides, if everything is running as root, the 660 is irrelevant anyway. The > default of 700 would be adequate, which is what I use. > I know where the 'bayes_file_mode 0660' default came from - some time ago spam.assassin.prefs.conf was changed to a version supplied by FSL. The FSL version was written and customized by several of us for FSL customers and SMGateway. The bayes_file_mode and bayes_path changes are both required by MailWatch which is why they were in the FSL version of this file. As noted by Matt - I think the MailScanner default should be 0700 as this will suit the majority. I supply the necessary permissions changes as part of the MailWatch installation instructions anyway and I tend to recommend the use BayesStore::MySQL anyway now. You could probably just comment both out in the file and let SpamAssassin use the defaults as it used to be. Kind regards, Steve. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Thu Aug 4 23:11:35 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:30:32 2006 Subject: SpamAssassin not working. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Daniel Straka wrote: > Matt, > > /etc/mail/spamassassin/local.cf is the only file in that dir. Below is > what's in it. Every line is commented out. I'll keep digging around. > > [root@mail1 spamassassin]# ls > local.cf > [root@mail1 spamassassin]# cat local.cf > # This is the right place to customize your installation of SpamAssassin. > # > # See 'perldoc Mail::SpamAssassin::Conf' for details of what can be > # tweaked. > # > ########################################################################### > # > # rewrite_subject 0 > # report_safe 1 > # trusted_networks 212.17.35. > > [root@mail1 spamassassin]# Hmm, what about /usr/share/spamassassin? Also check /etc/MailScanner/spam.assassin.prefs.conf for weirdness. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From hywel at BURRIS.ORG.UK Thu Aug 4 23:24:56 2005 From: hywel at BURRIS.ORG.UK (Hywel Burris) Date: Thu Jan 12 21:30:32 2006 Subject: OT: Sendmail and Mailertable Problem Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Alex Neuman van der Hans wrote: > Hywel Burris wrote: > >>>> MailScanner development - buy the book off the website! >>> >>> >>> >>> >>> Have you tried: >>> >>> To: abcd.co.uk RELAY >>> >> No, do you mean in the access file? or in mailertable as >> .abcd.co.uk relay:[mail.abcd.co.uk] > > > In the access file. > This didn't work >> >>> You're not saying how exactly sendmail refuses, and if any errors >>> come up. >> >> >> >> Well its doing an MX lookup on the domain rather than using the value >> in the mailertable >> >> Have you run "makemap hash mailertable.db < mailertable"? >> >> yes >> > Have you killed and restarted the processes so they load the new files? Yes > Have you tried using IP addresses instead of names? yes tried that just now, still used DNS > >> >> >> Thanks again >> >> Hywel > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From William.Burns at AEROFLEX.COM Thu Aug 4 23:23:46 2005 From: William.Burns at AEROFLEX.COM (William Burns) Date: Thu Jan 12 21:30:32 2006 Subject: OT: Sendmail and Mailertable Problem Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Alex Neuman van der Hans wrote: > Hywel Burris wrote: > >> Hi, >> >> Sorry for the off topic request for help but i am sure that someone >> here will have had the same problem. >> >> I am using mailertable to route mails to our sister companies after >> scanning them. The problem is that sendmail refuses to use the value >> in /etc/mail/mailertable even though it's in brackets and always uses >> the dns. >> >> Config below >> >> [root@mail-2 mail]# cat sendmail.mc | grep mailer >> dnl FEATURE(`mailertable',`hash -o /etc/mail/mailertable.db')dnl >> FEATURE(`mailertable',`hash /etc/mail/mailertable.db')dnl >> >> I have tried both there not sure what the -o is for but it was in >> there as default on RH9. >> >> the domain is in the relay-domains file >> >> [root@mail-2 mail]# cat mailertable | grep abcd >> .abcd.co.uk smtp:[mail.abcd.co.uk] >> >> I have overcome this problem by adding a zone file and mx on bind for >> the host. >> > > Have you tried: > > To: abcd.co.uk RELAY > > You're not saying how exactly sendmail refuses, and if any errors come > up. Have you run "makemap hash mailertable.db < mailertable"? > Hywel: If I'm reading you correctly, sendmail doesn't refuse these messages, but accepts them, and either doesn't know where to deliver them, or attempt to deliver to the "wrong" place if you don't like how the MX records are configured for that domain. This is what I've got in my sendmail.mc: > FEATURE(`mailertable',`hash -o /etc/mail/mailertable.db')dnl And this is in my sendmail.cf: > Kmailertable hash -o /etc/mail/mailertable.db (If you don't have something like the above line in your sendmail.cf, you'll have to regenerate that file.) If you haven't tried Alex's suggestion yet, it'd be a good idea to run "strings mailertable.db" to see what you've currently got in your mailertable.db file. I'm not familiar w/ the wildcard syntax that you appear to be using in your mailertable entry. For testing purposes, I'd suggest explicitly naming each full subdomain on the left-hand-side of your mailertable entry. (w/ no leading ".") Otherwise, your syntax looks good. -Bill ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve.swaney at fsl.com Thu Aug 4 23:34:16 2005 From: steve.swaney at fsl.com (Stephen Swaney) Date: Thu Jan 12 21:30:32 2006 Subject: Attn Julian - broken bayes_file_mode defaults in spam.assassin.prefs.conf Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Steve Freegard > Sent: Thursday, August 04, 2005 6:14 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Attn Julian - broken bayes_file_mode defaults in > spam.assassin.prefs.conf > > Hi Matt/Julian, > > On Thu, 2005-08-04 at 12:26 -0400, Matt Kettler wrote: > > Aaron K. Moore wrote: > > > Maybe Matt isn't running MailScanner as root. > > > > I'm not encountering problems, as I use neither bayes_path nor > bayes_file_mode. > > > > I just noticed the error based on remembering Theo chastise a few people > on the > > spamassassin-users list when they set it to 600, 660, or 666. > > > > > > Besides, if everything is running as root, the 660 is irrelevant anyway. > The > > default of 700 would be adequate, which is what I use. > > > > I know where the 'bayes_file_mode 0660' default came from - some time > ago spam.assassin.prefs.conf was changed to a version supplied by FSL. > > The FSL version was written and customized by several of us for FSL > customers and SMGateway. > > The bayes_file_mode and bayes_path changes are both required by > MailWatch which is why they were in the FSL version of this file. > > As noted by Matt - I think the MailScanner default should be 0700 as > this will suit the majority. I supply the necessary permissions changes > as part of the MailWatch installation instructions anyway and I tend to > recommend the use BayesStore::MySQL anyway now. > > You could probably just comment both out in the file and let > SpamAssassin use the defaults as it used to be. > > Kind regards, > Steve. I think Matt and Steve are both right and I'll change our defaults also (Although most of our customers are happy MailWatch users :) Steve Stephen Swaney Fort Systems Ltd. stephen.swaney@fsl.com www.fsl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Thu Aug 4 23:39:13 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:32 2006 Subject: OT: Sendmail and Mailertable Problem Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] William Burns wrote: > > If you haven't tried Alex's suggestion yet, it'd be a good idea to > run "strings mailertable.db" to see what you've currently got in your > mailertable.db file. > I'm not familiar w/ the wildcard syntax that you appear to be using in > your mailertable entry. > For testing purposes, I'd suggest explicitly naming each full > subdomain on the left-hand-side of your mailertable entry. (w/ no > leading ".") > > Otherwise, your syntax looks good. > True, I hadn't noticed the leading dots before the name. I've looked into: http://lists.swelltech.com/pipermail/webmin-l-archive/2000-September/005184.html but in... http://www.sendmail.org/m4/mailertables.html ... I see a leading dot. However, I clean-and-relay mail for half a dozen clients and I never use leading dots. In fact, since one of my servers doesn't have a reverse DNS address I have to add: aol.com smtp:[1.2.3.4] netscape.net smtp:[1.2.3.4] ... to my mailertable so that aol and netscape addresses will be sent through my brain-dead isp's mail servers. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From hywel at BURRIS.ORG.UK Thu Aug 4 23:51:33 2005 From: hywel at BURRIS.ORG.UK (Hywel Burris) Date: Thu Jan 12 21:30:32 2006 Subject: OT: Sendmail and Mailertable Problem Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Alex Neuman van der Hans wrote: > William Burns wrote: > >> >> If you haven't tried Alex's suggestion yet, it'd be a good idea to >> run "strings mailertable.db" to see what you've currently got in >> your mailertable.db file. >> I'm not familiar w/ the wildcard syntax that you appear to be using >> in your mailertable entry. >> For testing purposes, I'd suggest explicitly naming each full >> subdomain on the left-hand-side of your mailertable entry. (w/ no >> leading ".") >> >> Otherwise, your syntax looks good. >> > True, I hadn't noticed the leading dots before the name. > > I've looked into: > http://lists.swelltech.com/pipermail/webmin-l-archive/2000-September/005184.html > > > but in... > http://www.sendmail.org/m4/mailertables.html > ... I see a leading dot. > Thanks Alex & William, Removed the leading dot and it started working. Cheers, Hywel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From William.Burns at AEROFLEX.COM Thu Aug 4 23:59:54 2005 From: William.Burns at AEROFLEX.COM (William Burns) Date: Thu Jan 12 21:30:32 2006 Subject: OT: Sendmail and Mailertable Problem Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Alex: I just found some info on the leading dot thing.... It agrees w/ what you found on the sendmail.org site, but also claims that this wildcard syntax only works for resolvable domains. I.E. this syntax can override "A" or MX records, only if they already exist. If these sub-domains are not resolvable, then that may be the, or "a" problem. -Bill Alex Neuman van der Hans wrote: > William Burns wrote: > >> >> If you haven't tried Alex's suggestion yet, it'd be a good idea to >> run "strings mailertable.db" to see what you've currently got in >> your mailertable.db file. >> I'm not familiar w/ the wildcard syntax that you appear to be using >> in your mailertable entry. >> For testing purposes, I'd suggest explicitly naming each full >> subdomain on the left-hand-side of your mailertable entry. (w/ no >> leading ".") >> >> Otherwise, your syntax looks good. >> > > but in... > http://www.sendmail.org/m4/mailertables.html > ... I see a leading dot. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jeff.Mills at POCOLD.COM.AU Thu Aug 4 23:59:24 2005 From: Jeff.Mills at POCOLD.COM.AU (Jeff Mills) Date: Thu Jan 12 21:30:32 2006 Subject: " Your application has been approved" etc slipping through Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I'm getting alot of these loan approved type spam coming through. I have created a public folder called spam on our exchange machine where users can dump their spam, and I have our mailscanner box logging into this folder every hour to learn spam from it. I've been putting these emails in the spam folder, to teach sa, but they are still getting through. The email always seems to have the users own email address in it, and they use a date and time to make the subject different each time. Do any of you have a special way you use th block these? Cheers, Jeff ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From naolson at gmail.com Fri Aug 5 02:22:36 2005 From: naolson at gmail.com (Nathan Olson) Date: Thu Jan 12 21:30:32 2006 Subject: " Your application has been approved" etc slipping through Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 8/4/05, Jeff Mills wrote: > loan approved type spam coming through. You could use razor, if you're not already. That might catch them. Nate ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From deanm at SKYNETMOBILE.COM Fri Aug 5 02:27:52 2005 From: deanm at SKYNETMOBILE.COM (Dean Maunder) Date: Thu Jan 12 21:30:32 2006 Subject: Sending spam back Message-ID: Hi, I once saw some mail scanning software that could receive mail on a certain address, and this mail was scanned as being spam...sort of like an automatic sa-learn. Is there any way to get MailScanner to do this? Thanks! Dean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rpotter at RPCS.NET Fri Aug 5 03:36:33 2005 From: rpotter at RPCS.NET (Richard Potter) Date: Thu Jan 12 21:30:32 2006 Subject: Sendmail and Mailertable Problem Message-ID: Hi there... > the domain is in the relay-domains file > > [root@mail-2 mail]# cat mailertable | grep abcd > .abcd.co.uk smtp:[mail.abcd.co.uk] > > I have overcome this problem by adding a zone file and mx on > bind for the host. I would lose the "dot" and put the ip for testing. abcd.co.uk smtp:[xxx.xxx.xxx.xxx] Regards Richard -- This message has been scanned for viruses and dangerous content and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From naolson at gmail.com Fri Aug 5 04:42:39 2005 From: naolson at gmail.com (Nathan Olson) Date: Thu Jan 12 21:30:32 2006 Subject: Sending spam back Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 8/4/05, Dean Maunder wrote: > > Hi, > I once saw some mail scanning software that could receive mail on a certain > address, and this mail was scanned as being spam...sort of like an automatic > sa-learn. Is there any way to get MailScanner to do this? > Thanks! > Dean. It's called a spamtrap. You could do this with procmail. You'd look for your spamtrap address in the To: header and send the message to sa-learn. I'm pretty sure you could also use the Custom Spam Scanner to call sa-learn. There are probably many other ways I'm missing. Nate ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From P.G.M.Peters at UTWENTE.NL Fri Aug 5 08:32:19 2005 From: P.G.M.Peters at UTWENTE.NL (Peter Peters) Date: Thu Jan 12 21:30:32 2006 Subject: The Book -- new edition Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote on 23-6-2005 12:16: > I am working on a new edition of The Book(tm). Currently, I have just > updated the content to reflect all the new options that have been added > since the last edition, so that it is correct up to and including 4.43. Is this ready? I thought I missed the announcment when I was away on holiday but I couldn't find anything about it in the archives. -- Peter Peters, senior beheerder (Security) Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE) Universiteit Twente, Postbus 217, 7500 AE Enschede telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/itbe ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dl6mpg at gmail.com Fri Aug 5 08:45:55 2005 From: dl6mpg at gmail.com (Uwe) Date: Thu Jan 12 21:30:32 2006 Subject: SpamAssassin not working. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] 2005/8/4, Matt Kettler : > While that would be optimal in the long run, he can't just upgrade to 3.x. > He needs to upgrade perl or RedHat to do that. (RedHat 7.2 is perl 5.6.0 based) We run SA 3.0.4 on perl 5.6.0 too ... get the src and compile it ... ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Aug 5 09:17:52 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:32 2006 Subject: The Book -- new edition Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 5 Aug 2005, at 08:32, Peter Peters wrote: > Julian Field wrote on 23-6-2005 12:16: > >> I am working on a new edition of The Book(tm). Currently, I have just >> updated the content to reflect all the new options that have been >> added >> since the last edition, so that it is correct up to and including >> 4.43. >> > > Is this ready? I thought I missed the announcment when I was away on > holiday but I couldn't find anything about it in the archives. My first prints are still in the post. I'll make an announcement when I have received them. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQvMgshH2WUcUFbZUEQI8FwCgiaHkqshajdgeQxXyeP/Z4HxxXzQAoLPf rVIg44/1MUM5vsXDwZv6mtwk =Hrmv -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Andreas.Doerfler at KEMPTEN.DE Fri Aug 5 09:34:26 2005 From: Andreas.Doerfler at KEMPTEN.DE ([iso-8859-1] Dörfler Andreas) Date: Thu Jan 12 21:30:32 2006 Subject: contains Oversized.Zip Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] hi there, ClamAV: 2005-08-05_Stempelfelder.txt contains Oversized.Zip got this message sometimes but the files are ok, only bad compressed. is there a why to let em through ? or is it a clamav "problem" ? greetings andy --free your mind, use open source http://www.mono-project.com ASCII ribbon campaign ( ) - against HTML email X & vCards / \ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From KevinS at BMRB.CO.UK Fri Aug 5 10:25:07 2005 From: KevinS at BMRB.CO.UK (Spicer, Kevin) Date: Thu Jan 12 21:30:32 2006 Subject: SophosSAVI - All messages treated as Virus Message-ID: Just a heads up to the list on a problem I experienced this morning... If your sophos install becomes outdated SophosSAVI starts generating error messages... SophosSAVI: msg-25649-71.txt caused an error: The main body of virus data is out of date (542) This causes _every_message_ to be treated as a virus! Even the virus alerts sent to the postmaster, as you can imagine this causes the problem to snowball!! I know I should keep my Sophos installation up to date, but I have three other virus scanners anyway and just missed it this time around. The quick fix for me was to add "The main body of virus data is out of date" to Allowed Sophos Error Messages (followed, of course, by a Sophos upgrade). You may like to consider doing the same. Kevin ================================================================= BMRB http://www.bmrb.co.uk _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smhickel at CHARTERMI.NET Fri Aug 5 13:02:16 2005 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:30:32 2006 Subject: Bothersome attachment stripping Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Anybody have any ideas how to fix this? thanks, Steve ** We have a setting somewhere that is driving us nuts...Although we allow ZIP files to pass through, there is a setting somewhere that reads the contents of the ZIP file. If it finds inside the zip file a file with a forbidden extension (BAT, EXE, etc.) it Drops AND DELETES the attachment. We no longer can manually retrieve the attachment like we used to. Here is an example of an error message embedded in the email text....... Warning: This message has had one or more attachments removed (PrintSign.bat, sample.zip). Please read the "gpco.com-Attachment-Warning.txt" attachment(s) for more information. Here is the contents of "sample.com-Attachment-Warning.txt"................. This is a message from the MailScanner E-Mail Virus Protection Service ---------------------------------------------------------------------- The original e-mail attachment "sample.zip" is on the list of unacceptable attachments for this site and has been replaced by this warning message. Due to limitations placed on us by the Regulation of Investigatory Powers Act 2000, we were unable to keep a copy of the original attachment. At Thu Aug 4 19:01:03 2005 the virus scanner said: MailScanner: Batch files are often malicious (PrintSign.bat) MailScanner thanks transtec Computers for their support ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From john at TRADOC.FR Fri Aug 5 13:14:53 2005 From: john at TRADOC.FR (John Wilcock) Date: Thu Jan 12 21:30:32 2006 Subject: Bothersome attachment stripping Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Steve Hickel wrote: > We have a setting somewhere that is driving us nuts...Although we allow > ZIP files to pass through, there is a setting somewhere that reads the > contents of the ZIP file. If you don't want it to look inside zip files, set Maximum Archive Depth = 0 in your MailScanner.conf John. -- -- Over 2500 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dstraka at CASPERCOLLEGE.EDU Fri Aug 5 14:07:54 2005 From: dstraka at CASPERCOLLEGE.EDU (Daniel Straka) Date: Thu Jan 12 21:30:32 2006 Subject: The Book -- new edition Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Quoting Julian Field : > -----BEGIN PGP SIGNED MESSAGE----- > On 5 Aug 2005, at 08:32, Peter Peters wrote: > > > Julian Field wrote on 23-6-2005 12:16: > > > >> I am working on a new edition of The Book(tm). Currently, I have > just > >> updated the content to reflect all the new options that have been > > >> added > >> since the last edition, so that it is correct up to and including > > >> 4.43. I just ordered my second copy of the book 2 days ago. The order website says "Newly updated August 2005." I assumed the revisions were done. Does this thread imply I'm not getting documentation for 4.43?? Dan Straka Casper College (307)268-2399 ** Visit Casper College Online at www.caspercollege.edu ** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Aug 5 15:18:51 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:32 2006 Subject: The Book -- new edition Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 5 Aug 2005, at 14:07, Daniel Straka wrote: > Quoting Julian Field : > > >> -----BEGIN PGP SIGNED MESSAGE----- >> On 5 Aug 2005, at 08:32, Peter Peters wrote: >> >> >>> Julian Field wrote on 23-6-2005 12:16: >>> >>> >>>> I am working on a new edition of The Book(tm). Currently, I have >>>> >> just >> >>>> updated the content to reflect all the new options that have been >>>> >> >> >>>> added >>>> since the last edition, so that it is correct up to and including >>>> >> >> >>>> 4.43. >>>> > > I just ordered my second copy of the book 2 days ago. The order > website > says "Newly updated August 2005." I assumed the revisions were done. > Does this thread imply I'm not getting documentation for 4.43?? I said "up to and including 4.43". So yes, the documentation does include 4.43. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQvN1TRH2WUcUFbZUEQJg4gCfWuQ1S5275znZGii0aSU3oNuUqNsAmQHd 3bRfYvBBeuDAAT2wPTkUU+Fr =GYoO -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bpumphrey at WOODMACLAW.COM Fri Aug 5 16:17:14 2005 From: bpumphrey at WOODMACLAW.COM (Billy A. Pumphrey) Date: Thu Jan 12 21:30:32 2006 Subject: " Your application has been approved" etc slipping through Message-ID: What are some specific subject lines and so forth. I will see how mine is doing. I have not got any complaints so I am assuming that mine are getting caught. Billy Pumphrey IT Manager Wooden & McLaughlin > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Jeff Mills > Sent: Thursday, August 04, 2005 5:59 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: " Your application has been approved" etc > slipping through > > I'm getting alot of these loan approved type spam coming through. > I have created a public folder called spam on our exchange machine where > users can dump their spam, and I have our mailscanner box logging into > this folder every hour to learn spam from it. > I've been putting these emails in the spam folder, to teach sa, but they > are still getting through. > > The email always seems to have the users own email address in it, and they > use a date and time to make the subject different each time. > Do any of you have a special way you use th block these? > > Cheers, > Jeff > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Fri Aug 5 16:28:04 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:30:32 2006 Subject: " Your application has been approved" etc slipping through Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jeff, Billy A. Pumphrey wrote: > What are some specific subject lines and so forth. I will see how mine > is doing. I have not got any complaints so I am assuming that mine are > getting caught. > > Billy Pumphrey > IT Manager > Wooden & McLaughlin > In my case bayes, dcc, razor, uribl, surbl, rhsbl all seem to be detecting these, the average score for such a spam is ~35+ Are you using bayes, surbl and the likes? - dhawal here's my mailwatch summary for one of these 1.80 ADDRESS_IN_SUBJECT To: address appears in Subject 4.00 BAYES_99 Bayesian spam probability is 99 to 100% 1.61 DNS_FROM_RFC_POST Envelope sender in postmaster.rfc-ignorant.org 0.06 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% 1.51 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) 2.18 RCVD_HELO_IP_MISMATCH Received: HELO and IP do not match, but should 1.25 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO 0.42 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist 3.00 URIBL_BLACK Contains an URL listed in the URIBL blacklist 1.00 URIBL_BULK_MPRHS 4.00 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist 3.21 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist 4.00 URIBL_SBL Contains an URL listed in the SBL blocklist 4.26 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist 1.46 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From wglick at NCSA.UIUC.EDU Fri Aug 5 16:54:46 2005 From: wglick at NCSA.UIUC.EDU (Bill Glick) Date: Thu Jan 12 21:30:32 2006 Subject: Notify Senders Ruleset Message-ID: I'm having a hard time getting the various "Notify Senders" options to work with a ruleset. I'm wanting to only notify senders if the sender was one of our users. But MailScanner continues to notify all senders rather than just the few I want it to. Here are my relevant settings: MailScanner.conf: > Notify Senders = /usr/services/MailScanner/etc/rules/notify.rules > Notify Senders Of Viruses = /usr/services/MailScanner/etc/rules/ > notify.rules > Notify Senders Of Blocked Filenames Or Filetypes = /usr/services/ > MailScanner/etc/rules/notify.rules > Notify Senders Of Other Blocked Content = /usr/services/MailScanner/ > etc/rules/notify.rules > Never Notify Senders Of Precedence = list bulk /usr/services/MailScanner/etc/rules/notify.rules: > # Match user@ncsa.uiuc.edu as well as user@sub.ncsa.uiuc.edu > From: /[\@\.]ncsa\.uiuc\.edu$/ yes > From: *@*.ncsa.uiuc.edu yes > FromOrTo: default no Am I missing something? Is my ruleset incorrect? Do rulesets not work like I expect here? I'm currently running MailScanner 4.42.9. -- Bill Glick ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Aug 5 17:15:10 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:32 2006 Subject: Notify Senders Ruleset Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I can't immediately see anything wrong. You did service MailScanner reload or HUP it after making the change, didn't you? On 5 Aug 2005, at 16:54, Bill Glick wrote: > I'm having a hard time getting the various "Notify Senders" options > to work with a ruleset. I'm wanting to only notify senders if the > sender was one of our users. But MailScanner continues to notify > all senders rather than just the few I want it to. > > Here are my relevant settings: > > MailScanner.conf: > >> Notify Senders = /usr/services/MailScanner/etc/rules/notify.rules >> Notify Senders Of Viruses = /usr/services/MailScanner/etc/rules/ >> notify.rules >> Notify Senders Of Blocked Filenames Or Filetypes = /usr/services/ >> MailScanner/etc/rules/notify.rules >> Notify Senders Of Other Blocked Content = /usr/services/ >> MailScanner/etc/rules/notify.rules >> Never Notify Senders Of Precedence = list bulk >> > > /usr/services/MailScanner/etc/rules/notify.rules: > >> # Match user@ncsa.uiuc.edu as well as user@sub.ncsa.uiuc.edu >> From: /[\@\.]ncsa\.uiuc\.edu$/ yes >> From: *@*.ncsa.uiuc.edu yes >> FromOrTo: default no >> > > > Am I missing something? Is my ruleset incorrect? Do rulesets not > work like I expect here? > > I'm currently running MailScanner 4.42.9. > > -- > Bill Glick > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQvOQkBH2WUcUFbZUEQKXqgCgkW0Xn72vdPZx1oezK/CAoJkF+1IAoMKk WWQJe/LUzvihoB51rL3/XEBs =2UMj -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From wglick at NCSA.UIUC.EDU Fri Aug 5 21:38:36 2005 From: wglick at NCSA.UIUC.EDU (Bill Glick) Date: Thu Jan 12 21:30:32 2006 Subject: Notify Senders Ruleset Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Julian, We have restarted MailScanner several times after this change. Any other thoughts? - -- Bill Glick On Aug 5, 2005, at 11:15 AM, Julian Field wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > I can't immediately see anything wrong. You did service MailScanner > reload or HUP it after making the change, didn't you? > > On 5 Aug 2005, at 16:54, Bill Glick wrote: > > >> I'm having a hard time getting the various "Notify Senders" options >> to work with a ruleset. I'm wanting to only notify senders if the >> sender was one of our users. But MailScanner continues to notify >> all senders rather than just the few I want it to. >> >> Here are my relevant settings: >> >> MailScanner.conf: >> >> >>> Notify Senders = /usr/services/MailScanner/etc/rules/notify.rules >>> Notify Senders Of Viruses = /usr/services/MailScanner/etc/rules/ >>> notify.rules >>> Notify Senders Of Blocked Filenames Or Filetypes = /usr/services/ >>> MailScanner/etc/rules/notify.rules >>> Notify Senders Of Other Blocked Content = /usr/services/ >>> MailScanner/etc/rules/notify.rules >>> Never Notify Senders Of Precedence = list bulk >>> >>> >> >> /usr/services/MailScanner/etc/rules/notify.rules: >> >> >>> # Match user@ncsa.uiuc.edu as well as user@sub.ncsa.uiuc.edu >>> From: /[\@\.]ncsa\.uiuc\.edu$/ yes >>> From: *@*.ncsa.uiuc.edu yes >>> FromOrTo: default no >>> >>> >> >> >> Am I missing something? Is my ruleset incorrect? Do rulesets not >> work like I expect here? >> >> I'm currently running MailScanner 4.42.9. >> >> -- >> Bill Glick >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> > > - -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > -----BEGIN PGP SIGNATURE----- > Version: PGP Desktop 9.0.2 (Build 2425) > > iQA/AwUBQvOQkBH2WUcUFbZUEQKXqgCgkW0Xn72vdPZx1oezK/CAoJkF+1IAoMKk > WWQJe/LUzvihoB51rL3/XEBs > =2UMj > -----END PGP SIGNATURE----- > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (Darwin) iD8DBQFC885b7dJ+sj6x464RAgScAJ0fmM2XBORjBzP0cqZxM+EidS3H5gCg7guG eAXXBBK6B65Q+CDMDfZoL/A= =cGsP -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Aug 5 21:51:43 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:32 2006 Subject: Notify Senders Ruleset Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Not immediately, no. I don't quite see why you need both rules the way you have worded them, as the first one should cover the second one. Give this a try and see if it helps: From: *@ncsa.uiuc.edu yes From: *@*.ncsa.uiuc.edu yes FromOrTo: default no I'm going to send you one little request off-list as well. Bill Glick wrote: > * PGP Signed by an unknown key: 08/05/05 at 21:38:51 > > Julian, > We have restarted MailScanner several times after this change. Any > other thoughts? - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQvPRYBH2WUcUFbZUEQLIogCfUO+JmB5X6A1LpE33dgZwrH4bwN0AoLGA RRyTu0B87YmLULb9qG4NEgBR =4idA -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kevins at BMRB.CO.UK Fri Aug 5 21:52:58 2005 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:30:32 2006 Subject: Notify Senders Ruleset Message-ID: On Fri, 2005-08-05 at 15:38 -0500, Bill Glick wrote: > >>> # Match user@ncsa.uiuc.edu as well as user@sub.ncsa.uiuc.edu > >>> From: /[\@\.]ncsa\.uiuc\.edu$/ yes > >>> From: *@*.ncsa.uiuc.edu yes > >>> FromOrTo: default no I can't see why this doesn't work, but one observation... This matches the envelope sender so are you sure that the envelope sender on the messages being notified is not set to one of your domains ( a fairly common trick by spammers and viruses). If possible its best to base rules for this on your internal IP ranges rather than on address, so that your users don't get notified on incoming viruses which are spoofing their address as sender. I notify senders for all rfc1918 private address ranges as I can be sure that covers all bases within our network (things are changing regularly!) but we'll never receive an incoming (external) message from those IP ranges. ================================================================= BMRB http://www.bmrb.co.uk _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rakesh at NETCORE.CO.IN Sat Aug 6 14:44:19 2005 From: rakesh at NETCORE.CO.IN (Rakesh) Date: Thu Jan 12 21:30:32 2006 Subject: Maximum number of files in the Archive Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi We were having a discussion the MailScanner channel about the feature of Maximum number of files that can be there in an Archive. But this feature has the potential to load the system as MailScanner finds the archives by content and not just name. Apparently clamav has a similar feature with clamscan command line options as --max-files=#n Extract first #n files from each archive. This option protects your system against DoS attacks (default: 500) --block-max Mark archives as viruses (e.g. RAR.ExceededFileSize, Zip.ExceededFilesLimit) if max-files, max-space, or max-recursion is reached. What we were thinking of is utilize the Clamav's capability to do the work. Obviously this will apply to the ClamAV users. Say we can have a setting through MailScanner.conf Maximum Number of Files in Archive = 500 (default) Block Attachment if Max number exceeds (yes/no) = yes. # If this is set to know Clamav will scan only the first 500 files and ignore the rest. This will help to keep a tap on the Maximum number files that can be there in the attachment. With causing un-necessary overhead for MailScanner. What do you guys say on this ? Rakesh ---------------------------------------------------------- Netcore Solutions Pvt. Ltd. Website: http://www.netcore.co.in Spamtraps: http://cleanmail.netcore.co.in/directory.html ---------------------------------------------------------- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ja at CONVIATOR.COM Sun Aug 7 17:58:49 2005 From: ja at CONVIATOR.COM (Jan Agermose) Date: Thu Jan 12 21:30:32 2006 Subject: whitelisted mail - how to see why Message-ID: Hi Im running SMGateway 1.65 and Im having some problems with mail beeing whitelisted and I do not know why. How can I see what rule if any that did the whitelisting of the email? There are no whitelistnings for that domain and the spam score is over 36. Where are whitelisted domains/email addresses written to – disk/database? If I have a message ID and look at the details for the “handling” of the mail should I then be able to see what “rule” whitelisted the mail? Mvh Jan ________________________________________________________________________________ [IMAGE] Jan Agermose CEO Conviator Tel. +45 35 266 460 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "image001.gif" Image/GIF 732bytes. ] [ Unable to print this part. ] From steve.swaney at fsl.com Sun Aug 7 18:07:30 2005 From: steve.swaney at fsl.com (Stephen Swaney) Date: Thu Jan 12 21:30:32 2006 Subject: whitelisted mail - how to see why Message-ID: Jan, There will be a lot of announcement this week including the release of version 1.71 which we believe has removed all of the small but annoying bugs J I’ll make sure that you are copied on the announcements. Bets regards, Steve. Stephen Swaney Fort Systems Ltd. stephen.swaney@fsl.com www.fsl.com ________________________________________________________________________________ From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Jan Agermose Sent: Sunday, August 07, 2005 12:59 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: whitelisted mail - how to see why Hi Im running SMGateway 1.65 and Im having some problems with mail beeing whitelisted and I do not know why. How can I see what rule if any that did the whitelisting of the email? There are no whitelistnings for that domain and the spam score is over 36. Where are whitelisted domains/email addresses written to – disk/database? If I have a message ID and look at the details for the “handling” of the mail should I then be able to see what “rule” whitelisted the mail? Mvh Jan ________________________________________________________________________________ [IMAGE] Jan Agermose CEO Conviator Tel. +45 35 266 460 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Image/GIF 732bytes. ] [ Unable to print this part. ] From MailScanner at ecs.soton.ac.uk Sun Aug 7 18:08:30 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:32 2006 Subject: whitelisted mail - how to see why Message-ID: [ The following text is in the "windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] The whitelisting is normally done by either the "Spam Checks" option or the "Is Definitely Not Spam" option. If you have a score for the message, then it will have been done by the Is Definitely Not Spam option. SMGateway-specific questions should be directed to support@fsl.com. Jan Agermose wrote: > Hi > > Im running SMGateway 1.65 and Im having some problems with mail beeing > whitelisted and I do not know why. How can I see what rule if any that > did the whitelisting of the email? There are no whitelistnings for > that domain and the spam score is over 36. > > Where are whitelisted domains/email addresses written to ^Ö > disk/database? If I have a message ID and look at the details for the > ^Óhandling^Ô of the mail should I then be able to see what ^Órule^Ô > whitelisted the mail? > > Mvh > > Jan > > ------------------------------------------------------------------------ > > > > > > *Jan Agermose* > CEO Conviator > > > > Tel. +45 35 266 460 > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From support-lists at PETDOCTORS.CO.UK Mon Aug 8 10:34:38 2005 From: support-lists at PETDOCTORS.CO.UK (Nigel kendrick) Date: Thu Jan 12 21:30:32 2006 Subject: TNEF still a problem? Message-ID: I just noticed that the same 9 emails were getting processed (archived and blacklist checked) by MailScanner (4.44.6) in a loop without actually being submitted for virus scanning and further processing/delivery. I also saw the list messages here about issues with TNEF and, lo, one of the MailScanner messages in the 'loop' referred to expanding a TNEF file. I set 'Expand TNEF = yes' to 'no' and things got moving again (with some very hefty 'delay=' values - i.e.: delay=22295!!!) Other mail was being delivered during this period but obviously this needs a fix. I notice Julian posted a TNEF patch - has this been tried by anyone else yet and (noob hat on...) how do I apply it?? Thanks Nigel Kendrick ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From anders.andersson at LTKALMAR.SE Mon Aug 8 15:30:31 2005 From: anders.andersson at LTKALMAR.SE (Anders Andersson, IT) Date: Thu Jan 12 21:30:32 2006 Subject: OT: Is everyone on vacation or is my mail bad :) Message-ID: ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Mon Aug 8 15:33:57 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:30:32 2006 Subject: OT: Is everyone on vacation or is my mail bad :) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have noticed the list is rather quiet today... Anders Andersson, IT wrote: ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Mon Aug 8 15:37:05 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:32 2006 Subject: OT: Is everyone on vacation or is my mail bad :) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 08/08/05, Matt Kettler wrote: > I have noticed the list is rather quiet today... > > > > Anders Andersson, IT wrote: > Any more quiet and it'll be officiallty dead:-). Might be jiscmail acting up again.... -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From housey at SME-ECOM.CO.UK Mon Aug 8 15:44:17 2005 From: housey at SME-ECOM.CO.UK (Paul Houselander) Date: Thu Jan 12 21:30:32 2006 Subject: Anyone else finding an increase in spam slipping through? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi Ive had a few calls this morning with people complaining about an increase in spam getting through. Doesnt seem to be to much consistent about the mail getting through although DATE_IN_FUTURE_ scores seem to be triggering. I run a fairly default install of MailScanner with Spamassasin - I have DCC, Pyzor and Razor2 enabled + bayes + use the Rules_Du_Jour scripts. Ive not made any recent changes to my setup, ive just increased a couple of scores to try and catch more but just wondered if anyone else had seen an increase? Kind Regards Paul Houselander ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From grantd at AISMEDIA.COM Mon Aug 8 15:37:20 2005 From: grantd at AISMEDIA.COM (Grant) Date: Thu Jan 12 21:30:32 2006 Subject: OT: Is everyone on vacation or is my mail bad :) Message-ID: No I am here... But I was on vacation this weekend.... :) - Thank you, Grant Della Vecchia System Administrator ---------------------------------------------------------------------- AIS Media, Inc. 7000 Central Parkway, Suite 1700 Atlanta, GA 30328 Tel: 770.350.7998 ext. 506 | Fax: 770.350.9409 URL: www.aismedia.com | Email: grantd@aismedia.com ---------------------------------------------------------------------- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Aug 8 16:04:42 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:32 2006 Subject: MailScanner ANNOUNCE: New Book Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I am pleased to announce the publication of the latest update to the MailScanner Book. The new edition covers all new features, facilities and configuration options available in MailScanner up to and including the August 2005 release, version 4.44. The new update adds 30 pages of new content, and also includes more detailed examples of rulesets, showing you how to use them and what they can do. These examples include how to use multiple filename.rules.conf and filetype.rules.conf files, with different restrictions for different users and domains. The cheapest, fastest and most convenient way to purchase it is from the MailScanner Store at         www.mailscanner.info/store Using the MailScanner Store is perfectly safe, all goods come with a 30-day money back warranty, and all credit card information is held by CafePress, a large US company with a very good reputation to protect! It will be significantly faster and cheaper than ordering by Amazon for example. To get the complete picture, I strongly recommend that you buy the latest update of the Book. However, if you either cannot afford to buy the update, or you just want to see what content has been added, then I have made the new content available as a PDF file at http://www.sng.ecs.soton.ac.uk/mailscanner/Book.Dec04-Aug05.pdf which you can download for free. --  Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Application/PGP-SIGNATURE 202bytes. ] [ Unable to print this part. ] From drew at THEMARSHALLS.CO.UK Mon Aug 8 16:13:23 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:30:32 2006 Subject: OT: Is everyone on vacation or is my mail bad :) Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Mon, August 8, 2005 15:37, Grant wrote: > No I am here... > But I was on vacation this weekend.... :) Not sure I have ever seen it so quiet. For once, just briefly, I wondered if all the 'nasties' of the world had gone. Then I checked the mail log :-) I still wonder if this is the lull before the storm. Perhaps virus writers have holidays too... Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard.gray at DNS.CO.UK Mon Aug 8 16:10:57 2005 From: richard.gray at DNS.CO.UK (Gray, Richard) Date: Thu Jan 12 21:30:32 2006 Subject: MailScanner ANNOUNCE: New Book Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > The cheapest, fastest and most convenient way to purchase it is from the MailScanner Store at > www.mailscanner.info/store I'm intrigued by this: http://www.cafepress.com/mailscanner2,mailscanner.4367945. Is there any way to find out how many of these have actually been purchased? :) R This email from dns has been validated by dnsMSSTM Managed Email Security and is free from all known viruses. For further information contact email-integrity@dns.co.uk ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Aug 8 16:21:40 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:32 2006 Subject: MailScanner ANNOUNCE: New Book Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 8 Aug 2005, at 16:10, Gray, Richard wrote: > The cheapest, fastest and most convenient way to purchase it is from the MailScanner Store at >         www.mailscanner.info/store I'm intrigued by this: http://www.cafepress.com/mailscanner2,mailscanner.4367945.   Is there any way to find out how many of these have actually been purchased? :) A few hundred. --  Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Application/PGP-SIGNATURE 202bytes. ] [ Unable to print this part. ] From steve.swaney at fsl.com Mon Aug 8 16:22:22 2005 From: steve.swaney at fsl.com (Stephen Swaney) Date: Thu Jan 12 21:30:32 2006 Subject: Anyone else finding an increase in spam slipping through? Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Paul Houselander > Sent: Monday, August 08, 2005 10:44 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Anyone else finding an increase in spam slipping through? > > Hi > > Ive had a few calls this morning with people complaining about an increase > in spam getting through. > > Doesnt seem to be to much consistent about the mail getting through > although > DATE_IN_FUTURE_ scores seem to be triggering. > > I run a fairly default install of MailScanner with Spamassasin - I have > DCC, > Pyzor and Razor2 enabled + bayes + use the Rules_Du_Jour scripts. > > Ive not made any recent changes to my setup, ive just increased a couple > of > scores to try and catch more but just wondered if anyone else had seen an > increase? > > Kind Regards > > Paul Houselander > Same setup here and at many clients. No noticeable increase or complaints. Are you up to the latest versions on SpamAssassin, DCC, and Razor? Steve Stephen Swaney Fort Systems Ltd. stephen.swaney@fsl.com www.fsl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ivessm at softecusa.com Mon Aug 8 16:25:03 2005 From: ivessm at softecusa.com (Stewart M. Ives) Date: Thu Jan 12 21:30:32 2006 Subject: OT: Is everyone on vacation or is my mail bad :) Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Boy, some guys have all the luck. A vacation on the weekend... I wish! stew ---------- Original Message ----------- From: Grant To: MAILSCANNER@JISCMAIL.AC.UK Sent: Mon, 8 Aug 2005 10:37:20 -0400 Subject: Re: OT: Is everyone on vacation or is my mail bad :) > No I am here... > But I was on vacation this weekend.... :) > - > Thank you, > Grant Della Vecchia > System Administrator > ---------------------------------------------------------------------- > AIS Media, Inc. > 7000 Central Parkway, Suite 1700 > Atlanta, GA 30328 > Tel: 770.350.7998 ext. 506 | Fax: 770.350.9409 > URL: www.aismedia.com | Email: grantd@aismedia.com > ---------------------------------------------------------------------- > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------- End of Original Message ------- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard.gray at DNS.CO.UK Mon Aug 8 16:31:20 2005 From: richard.gray at DNS.CO.UK (Gray, Richard) Date: Thu Jan 12 21:30:32 2006 Subject: MailScanner ANNOUNCE: New Book Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > The cheapest, fastest and most convenient way to purchase it is from the MailScanner Store at > www.mailscanner.info/store I'm intrigued by this: http://www.cafepress.com/mailscanner2,mailscanner.4367945. Is there any way to find out how many of these have actually been purchased? :) > A few hundred. Mmmm, that shines a new light for me on the readers of this list! I wonder if they ride up when your sitting on the floor of a server room :) R This email from dns has been validated by dnsMSSTM Managed Email Security and is free from all known viruses. For further information contact email-integrity@dns.co.uk ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From roger at RUDNICK.COM.BR Mon Aug 8 16:46:21 2005 From: roger at RUDNICK.COM.BR (Roger Jochem) Date: Thu Jan 12 21:30:32 2006 Subject: MailScanner ANNOUNCE: New Book Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Is this real? Really funny... Maybe it protects against viruses and stuff... :) ----- Original Message ----- From: Julian Field To: MAILSCANNER@JISCMAIL.AC.UK Sent: Monday, August 08, 2005 12:21 PM Subject: Re: MailScanner ANNOUNCE: New Book On 8 Aug 2005, at 16:10, Gray, Richard wrote: > The cheapest, fastest and most convenient way to purchase it is from the MailScanner Store at > www.mailscanner.info/store I'm intrigued by this: http://www.cafepress.com/mailscanner2,mailscanner.4367945. Is there any way to find out how many of these have actually been purchased? :) A few hundred. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From KevinS at BMRB.CO.UK Mon Aug 8 16:58:54 2005 From: KevinS at BMRB.CO.UK (Spicer, Kevin) Date: Thu Jan 12 21:30:32 2006 Subject: MailScanner ANNOUNCE: New Book Message-ID: From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Roger Jochem > Is this real? Really funny... Maybe it protects against viruses and stuff... :) Nope, thats another product entirely and I don't think Julian is selling _those_ MailScanner branded (yet). ================================================================= BMRB http://www.bmrb.co.uk _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ebruce at HPMICH.COM Mon Aug 8 17:03:16 2005 From: ebruce at HPMICH.COM (Ed Bruce) Date: Thu Jan 12 21:30:32 2006 Subject: MailScanner ANNOUNCE: New Book Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Spicer, Kevin wrote: From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Roger Jochem Is this real? Really funny... Maybe it protects against viruses and stuff... :) Nope, thats another product entirely and I don't think Julian is selling _those_ MailScanner branded (yet). Yeah I saw those when I order the book a couple of months ago. I showed the guys here and they thought it was funny. So why is there such a product then with that logo??? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Aug 8 17:09:27 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:32 2006 Subject: MailScanner ANNOUNCE: New Book Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 8 Aug 2005, at 17:03, Ed Bruce wrote: Spicer, Kevin wrote: From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Roger Jochem Is this real? Really funny... Maybe it protects against viruses and stuff... :) Nope, thats another product entirely and I don't think Julian is selling _those_ MailScanner branded (yet). Yeah I saw those when I order the book a couple of months ago. I showed the guys here and they thought it was funny. So why is there such a product then with that logo??? Ah, I have just got the joke. :-(Sorry, thought you were talking about the book. The answer to those is about 2, of which 1 was an Italian (surprise, surprise) and the other was an American. And I assume you have read the wording carefully :-) --  Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Application/PGP-SIGNATURE 202bytes. ] [ Unable to print this part. ] From KevinS at BMRB.CO.UK Mon Aug 8 17:15:26 2005 From: KevinS at BMRB.CO.UK (Spicer, Kevin) Date: Thu Jan 12 21:30:32 2006 Subject: MailScanner ANNOUNCE: New Book Message-ID: From: Roger Jochem Is this real? Really funny... Maybe it protects against viruses and stuff... :) Spicer, Kevin wrote: Nope, thats another product entirely and I don't think Julian is selling _those_ MailScanner branded (yet). From: Ed Bruce Yeah I saw those when I order the book a couple of months ago. I showed the guys here and they thought it was funny. So why is there such a product then with that logo??? Er, sorry my sense of humour has caused some confusion - the thong is real, I was making a (poor) joke about Rogers 'protects against viruses and stuuf' line. /Scuttles back under stone. ================================================================= BMRB http://www.bmrb.co.uk _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bpumphrey at WOODMACLAW.COM Mon Aug 8 17:56:16 2005 From: bpumphrey at WOODMACLAW.COM (Billy A. Pumphrey) Date: Thu Jan 12 21:30:32 2006 Subject: Is everyone on vacation or is my mail bad :) Message-ID: -----Original Message----- > From: Anders Andersson, IT [mailto:anders.andersson@LTKALMAR.SE] > Sent: Monday, August 08, 2005 9:31 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: OT: Is everyone on vacation or is my mail bad :) > Importance: High > I am thinking that it is just lack of posting. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bpumphrey at WOODMACLAW.COM Mon Aug 8 18:01:10 2005 From: bpumphrey at WOODMACLAW.COM (Billy A. Pumphrey) Date: Thu Jan 12 21:30:32 2006 Subject: MailScanner ANNOUNCE: New Book Message-ID: I bought the book! Keep up the good work. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From raymond at PROLOCATION.NET Mon Aug 8 18:54:10 2005 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:30:32 2006 Subject: Anyone else finding an increase in spam slipping through? Message-ID: Hi! >> Pyzor and Razor2 enabled + bayes + use the Rules_Du_Jour scripts. >> Ive not made any recent changes to my setup, ive just increased a couple >> scores to try and catch more but just wondered if anyone else had seen an >> increase? > Same setup here and at many clients. No noticeable increase or complaints. > Are you up to the latest versions on SpamAssassin, DCC, and Razor? There is a LOT of spam sended out with geocities URLs. # # Abusive public hosting # uri PROLO_PUBWEB_UKGEO_CHECK1 /^http:\/\/uk\.geocities\.com\// score PROLO_PUBWEB_UKGEO_CHECK1 4.0 describe PROLO_PUBWEB_UKGEO_CHECK1 PROLO_PUBWEB_UKGEO_CHECK1, Body That should at least mark then. Bye, Raymond. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From HancockS at MORGANCO.COM Mon Aug 8 19:06:36 2005 From: HancockS at MORGANCO.COM (Hancock, Scott) Date: Thu Jan 12 21:30:32 2006 Subject: MailScanner ANNOUNCE: New Book Message-ID: > > I bought the book! Me too And many thanks. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Mon Aug 8 19:09:32 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:32 2006 Subject: OT: Is everyone on vacation or is my mail bad :) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Stewart M. Ives spake the following on 8/8/2005 8:25 AM: > Boy, some guys have all the luck. > > A vacation on the weekend... I wish! > > stew What is a vacation? -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Mon Aug 8 19:15:29 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:32 2006 Subject: MailScanner ANNOUNCE: New Book Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Gray, Richard spake the following on 8/8/2005 8:10 AM: > > >> The cheapest, fastest and most convenient way to purchase it is from > the MailScanner Store at >> www.mailscanner.info/store > > > > I'm intrigued by this: > http://www.cafepress.com/mailscanner2,mailscanner.4367945. > > Is there any way to find out how many of these have actually been > purchased? :) > I doubt if you could get Julian to model one! Not even after a few pints! -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From remy at UNIX-ASP.COM Mon Aug 8 19:36:36 2005 From: remy at UNIX-ASP.COM (Remy de Ruysscher) Date: Thu Jan 12 21:30:32 2006 Subject: Anyone else finding an increase in spam slipping through? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Thanks Raymond, I was waiting for this! We are burried by geocities spam too. I'll try this one out! Regards, Remy Raymond Dijkxhoorn wrote: > Hi! > >>> Pyzor and Razor2 enabled + bayes + use the Rules_Du_Jour scripts. >>> Ive not made any recent changes to my setup, ive just increased a >>> couple >>> scores to try and catch more but just wondered if anyone else had >>> seen an >>> increase? >> > >> Same setup here and at many clients. No noticeable increase or >> complaints. >> Are you up to the latest versions on SpamAssassin, DCC, and Razor? > > > There is a LOT of spam sended out with geocities URLs. > > # > # Abusive public hosting > # > > uri PROLO_PUBWEB_UKGEO_CHECK1 /^http:\/\/uk\.geocities\.com\// > score PROLO_PUBWEB_UKGEO_CHECK1 4.0 > describe PROLO_PUBWEB_UKGEO_CHECK1 PROLO_PUBWEB_UKGEO_CHECK1, Body > > That should at least mark then. > > Bye, > Raymond. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Mon Aug 8 19:26:20 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:32 2006 Subject: MailScanner ANNOUNCE: New Book Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Gray, Richard spake the following on 8/8/2005 8:31 AM: >> The cheapest, fastest and most convenient way to purchase it is from > the MailScanner Store at > >> > www.mailscanner.info/store >> I'm intrigued by this: >> http://www.cafepress.com/mailscanner2,mailscanner.4367945. >> >> Is there any way to find out how many of these have actually been >> purchased? :) > > > > A few hundred. > > Mmmm, that shines a new light for me on the readers of this list! I > wonder if they ride up when your sitting on the floor of a server room :) > > R I would think they ride up no matter what you are doing! -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Aug 8 19:44:14 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:32 2006 Subject: OT: Is everyone on vacation or is my mail bad :) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Scott Silva wrote: >Stewart M. Ives spake the following on 8/8/2005 8:25 AM: > > >>Boy, some guys have all the luck. >> >>A vacation on the weekend... I wish! >> >>stew >> >> > >What is a vacation? > > Surely you mean "the", not "a"? I think it's this: /usr/sbin/vacation: ELF N32 MSB mips-3 dynamic executable MIPS - version 1 but why people would want to book annual leave for a mips-3 executable defeats me. Maybe they spend time studying the source or something? I've worked out that I can spend my remaining leave this year by watching TV at work for 3 hours every day. Time to put my feet up :-) - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQven/xH2WUcUFbZUEQL4uQCg02o4EnlzfOjFco5eabWY/DhfFPEAnA5z 2a0/p659q4AZG+zR7L5FEuC+ =/Kta -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Aug 8 19:45:01 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:32 2006 Subject: MailScanner ANNOUNCE: New Book Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Scott Silva wrote: >Gray, Richard spake the following on 8/8/2005 8:10 AM: > > >> >> >> >>>The cheapest, fastest and most convenient way to purchase it is from >>> >>> >>the MailScanner Store at >> >> >>> www.mailscanner.info/store >>> >>> >> >>I'm intrigued by this: >>http://www.cafepress.com/mailscanner2,mailscanner.4367945. >> >>Is there any way to find out how many of these have actually been >>purchased? :) >> >> >> > >I doubt if you could get Julian to model one! > >Not even after a few pints! > The closest you'll get is my mugshot on the back of the book! - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQveoLxH2WUcUFbZUEQJHYwCg0JbmnwCuT1WN+qWcONb4Tc2j03IAoPwy uiCvz0wkAeatY+cLzocNwzqS =/Pkf -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Mon Aug 8 19:28:52 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:32 2006 Subject: Is everyone on vacation or is my mail bad :) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Billy A. Pumphrey spake the following on 8/8/2005 9:56 AM: > -----Original Message----- > >>From: Anders Andersson, IT [mailto:anders.andersson@LTKALMAR.SE] >>Sent: Monday, August 08, 2005 9:31 AM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: OT: Is everyone on vacation or is my mail bad :) >>Importance: High >> > > > I am thinking that it is just lack of posting. > Just a stable period. Probably won't last long... -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Aug 8 19:51:18 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:32 2006 Subject: MailScanner ANNOUNCE: New Book Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Scott Silva wrote: >Gray, Richard spake the following on 8/8/2005 8:31 AM: > > >>>The cheapest, fastest and most convenient way to purchase it is from >>> >>> >>the MailScanner Store at >> >> >> >>>> www.mailscanner.info/store >>>> >>>> >>>I'm intrigued by this: >>>http://www.cafepress.com/mailscanner2,mailscanner.4367945. >>> >>>Is there any way to find out how many of these have actually been >>>purchased? :) >>> >>> >> > A few hundred. >> >>Mmmm, that shines a new light for me on the readers of this list! I >>wonder if they ride up when your sitting on the floor of a server room :) >> >>R >> >> > >I would think they ride up no matter what you are doing! > > I'm afraid we don't get to ask the customers, neither of the 2 of them are on the mailing lists. I thought it was worth checking... Assuming of course that they either spent their money or subscribed to the list in their real names, a lot of people on this list aren't who they say they are, for security reasons. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQvepqBH2WUcUFbZUEQLNyACfbAkxpHvggKF/zeEZVDcgINEybzUAnAnm YdgIJ0nKOHAAAp3IE0UNmKNi =9AF1 -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Mon Aug 8 21:29:00 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:32 2006 Subject: OT: Is everyone on vacation or is my mail bad :) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field spake the following on 8/8/2005 11:44 AM: > Scott Silva wrote: > > >>>Stewart M. Ives spake the following on 8/8/2005 8:25 AM: >>> >>> >>> >>>>Boy, some guys have all the luck. >>>> >>>>A vacation on the weekend... I wish! >>>> >>>>stew >>>> >>>> >>> >>>What is a vacation? >>> >>> > > Surely you mean "the", not "a"? I think it's this: > /usr/sbin/vacation: ELF N32 MSB mips-3 dynamic executable MIPS - > version 1 > but why people would want to book annual leave for a mips-3 executable > defeats me. Maybe they spend time studying the source or something? > > I've worked out that I can spend my remaining leave this year by > watching TV at work for 3 hours every day. Time to put my feet up :-) > But will they respect "your time" and not ring you or bother you during your 3 hours? I don't know if I could find 3 hours of TV I'd like to watch! -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ebruce at HPMICH.COM Mon Aug 8 21:41:52 2005 From: ebruce at HPMICH.COM (Ed Bruce) Date: Thu Jan 12 21:30:32 2006 Subject: MailScanner ANNOUNCE: New Book Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I really need to proof my messages better. I'm famous for making statements that are easily misunderstood. Anyway I have the book and its been helpful. I will be ordering the latest version soon. So just to let you know I really do appreciate the power of MailScanner and now that I have MailWatch working its making my life easier. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Aug 8 21:53:47 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:32 2006 Subject: MailScanner ANNOUNCE: New Book Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Thankyou! Comment much appreciated. Ed Bruce wrote: > I really need to proof my messages better. I'm famous for making > statements that are easily misunderstood. Anyway I have the book and > its been helpful. I will be ordering the latest version soon. So just > to let you know I really do appreciate the power of MailScanner and > now that I have MailWatch working its making my life easier. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQvfGXBH2WUcUFbZUEQLCigCgl8weeeEFI5NlYOMCJvnvx42CJpIAoNCL Tpl2KGCexqIcmeWDp1cqgtHA =J42b -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Tue Aug 9 09:04:55 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:30:32 2006 Subject: Anyone else finding an increase in spam slipping through? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Raymond Dijkxhoorn wrote: > > There is a LOT of spam sended out with geocities URLs. > > # > # Abusive public hosting > # > > uri PROLO_PUBWEB_UKGEO_CHECK1 /^http:\/\/uk\.geocities\.com\// > score PROLO_PUBWEB_UKGEO_CHECK1 4.0 > describe PROLO_PUBWEB_UKGEO_CHECK1 PROLO_PUBWEB_UKGEO_CHECK1, Body > A harmless warning, but anyways.. warning: rule 'PROLO_PUBWEB_UKGEO_CHECK1' is over 22 chars - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From remy at UNIX-ASP.COM Tue Aug 9 09:16:24 2005 From: remy at UNIX-ASP.COM (Remy de Ruysscher) Date: Thu Jan 12 21:30:32 2006 Subject: Anyone else finding an increase in spam slipping through? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi there, I'm having a bit of a problem with URIBL. Some mails are slipping through SA, specifically those with URIBL scores. When I manually check the URI found in the spam it's listed on URIBL, but the headers don't show any URIBL spam score? Anyone? Regards, Remy ---- X-Account-Key: account2 X-UIDL: :F6"!h;S"!Y,N!!o1P!! X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: X-Original-To: remy@unix-asp.com Delivered-To: remy@unix-asp.com Received: from mx1.sinew-it.nl (mx1.sinew-it.nl [80.127.164.18]) by mx1.unix-asp.com (Postfix) with ESMTP id C653E8A021 for ; Tue, 9 Aug 2005 08:02:06 +0200 (CEST) Received: from mxdrop35.xs4all.nl (mxdrop35.xs4all.nl [194.109.24.88]) by mx1.sinew-it.nl (8.13.4/8.13.4) with ESMTP id j795DB8f026294 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 9 Aug 2005 07:13:21 +0200 Received: from 221.219.8.199 ([221.219.8.199]) by mxdrop35.xs4all.nl (8.13.3/8.13.3) with SMTP id j795CS1H059724 for ; Tue, 9 Aug 2005 07:12:37 +0200 (CEST) (envelope-from tomobxzg@next-co.co.jp) Received: from mail-fwd.wh.ocn.ne.jp by 221.219.8.199 (8.9.3/8.9.3) with SMTP id qzF6Zfflloli for ; Tue, 9 Aug 2005 00:13:56 -0400 Received: from nobody (165.131.210.118) by mail-fwd.wh.ocn.ne.jp with ESMTP (Exim 4.05) id 3rBmTNYei1DA for ; Tue, 9 Aug 2005 00:13:56 -0400 Reply-To: "Leland Starks" From: "Leland" Message-ID: <5966090017.860353132267@next-co.co.jp> Date: Tue, 9 Aug 2005 00:13:56 -0400 To: Subject: cute redhead teen absolutely naked MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-XS4ALL-DNSBL-Checked: mxdrop35.xs4all.nl checked 221.219.8.199 against DNS blacklists X-Virus-Scanned: by XS4ALL Virus Scanner X-XS4ALL-Spam-Score: 0 () X-XS4ALL-Spam: NO Received-SPF: pass (mx1.sinew-it.nl: 194.109.24.88 is authenticated by a trusted mechanism) X-Sinew-MailScanner: Found to be clean X-Sinew-MailScanner-SpamCheck: X-MailScanner-Information: Please contact root@unix-asp.com for more information X-MailScanner: Found to be clean X-unix-asp.com-MailScanner-SpamCheck: not spam, SpamAssassin (score=5.338, required 6, INFO_TLD 0.48, ISO_7BITS 0.50, NO_RDNS2 0.01, RAZOR2_CF_RANGE_51_100 1.48, RAZOR2_CHECK 0.15, RCVD_BY_IP 0.02, RCVD_IN_SORBS 1.00, RCVD_NUMERIC_HELO 1.53, SARE_ADULT1 0.66, SMILEY -0.50) X-MailScanner-SpamScore: 5.34 X-unix-asp.com-MailScanner-From: srs0+riv+w7ow=wm=next-co.co.jp=tomobxzg@sinew-it.nl X-UIDL: :F6"!h;S"!Y,N!!o1P!! Hello, stranger! :) Black bitches playing Plumper fucks a dildo Huge dildo and candles Nylon blonde shows pink Older whore getting suck Latin twink loves sucking cocks Lesbians dirty wet panties http://www.agoflash.info/jemba.html?bshwizxl stockings blonde fuck in all holes ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From raymond at PROLOCATION.NET Tue Aug 9 09:19:33 2005 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:30:33 2006 Subject: Anyone else finding an increase in spam slipping through? Message-ID: Hi! >> # >> # Abusive public hosting >> # >> >> uri PROLO_PUBWEB_UKGEO_CHECK1 /^http:\/\/uk\.geocities\.com\// >> score PROLO_PUBWEB_UKGEO_CHECK1 4.0 >> describe PROLO_PUBWEB_UKGEO_CHECK1 PROLO_PUBWEB_UKGEO_CHECK1, Body > A harmless warning, but anyways.. > warning: rule 'PROLO_PUBWEB_UKGEO_CHECK1' is over 22 chars Depending on the SA version you are running, but sure, thats right. Bye, Raymond. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Tue Aug 9 09:24:06 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:30:33 2006 Subject: Anyone else finding an increase in spam slipping through? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Raymond Dijkxhoorn wrote: > Hi! > >>> # >>> # Abusive public hosting >>> # >>> >>> uri PROLO_PUBWEB_UKGEO_CHECK1 /^http:\/\/uk\.geocities\.com\// >>> score PROLO_PUBWEB_UKGEO_CHECK1 4.0 >>> describe PROLO_PUBWEB_UKGEO_CHECK1 PROLO_PUBWEB_UKGEO_CHECK1, Body > > >> A harmless warning, but anyways.. >> warning: rule 'PROLO_PUBWEB_UKGEO_CHECK1' is over 22 chars > > > Depending on the SA version you are running, but sure, thats right. > [root@mx101 ~]# spamassassin --version SpamAssassin version 3.0.4 running on Perl version 5.8.5 What is yours? just curious not doubting.. - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pete at ENITECH.COM.AU Tue Aug 9 09:36:20 2005 From: pete at ENITECH.COM.AU (Pete Russell) Date: Thu Jan 12 21:30:33 2006 Subject: MailScanner ANNOUNCE: New Book Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ordered today - tight arsed company keep claiming to make a donation, "yes we can discuss it next week" yes we will raise that with so and so next week" So while i continue my struggle to procure a donation, i have bought myself the book. Looking forward to it :) ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Tue Aug 9 08:37:18 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:33 2006 Subject: OT: Is everyone on vacation or is my mail bad :) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 08/08/05, Scott Silva wrote: > Julian Field spake the following on 8/8/2005 11:44 AM: (snip) > > I've worked out that I can spend my remaining leave this year by > > watching TV at work for 3 hours every day. Time to put my feet up :-) > > > But will they respect "your time" and not ring you or bother you during > your 3 hours? Of course they will ... not. > I don't know if I could find 3 hours of TV I'd like to watch! > Well.... The IAAF championships in Helsinki come pretty close... At least when it comes to Heptathlon and the high jump! (Man, did you see how close Kajsa was on that first attempt on 2.10? And to think that just a year ago she couldn't even walk...) -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From P.G.M.Peters at UTWENTE.NL Tue Aug 9 09:55:47 2005 From: P.G.M.Peters at UTWENTE.NL (Peter Peters) Date: Thu Jan 12 21:30:33 2006 Subject: MailScanner ANNOUNCE: New Book Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Gray, Richard wrote on 8-8-2005 17:10: >> The cheapest, fastest and most convenient way to purchase it is from > the MailScanner Store at >> www.mailscanner.info/store > > I'm intrigued by this: > http://www.cafepress.com/mailscanner2,mailscanner.4367945. Strange. When I search for mailscanner products on cafepress I don't see it. -- Peter Peters, senior beheerder (Security) Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE) Universiteit Twente, Postbus 217, 7500 AE Enschede telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/itbe ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 9 13:59:49 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:33 2006 Subject: MailScanner ANNOUNCE: New Book Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 9 Aug 2005, at 09:55, Peter Peters wrote: > Gray, Richard wrote on 8-8-2005 17:10: > > >>> The cheapest, fastest and most convenient way to purchase it is from >>> >> the MailScanner Store at >> >>> www.mailscanner.info/store >> store> >>> >> >> I'm intrigued by this: >> http://www.cafepress.com/mailscanner2,mailscanner.4367945. >> > > Strange. When I search for mailscanner products on cafepress I > don't see it. There are 2 MailScanner stores (necessary because of their limitations in "free" shops). MailScanner and MailScanner2. The text at the top of the main shop page mentions the other one. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQvioyBH2WUcUFbZUEQLVJgCg7p9BRhnnMvDvGTgWoH2tKybA+NoAoKQt Z8c/EERLRetaVvkosis7WEs2 =+rdk -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 9 14:00:27 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:33 2006 Subject: MailScanner ANNOUNCE: New Book Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Thankyou for persevering with this! And also, of course, for buying the book :-) On 9 Aug 2005, at 09:36, Pete Russell wrote: > Ordered today - tight arsed company keep claiming to make a > donation, "yes we can discuss it next week" yes we will raise that > with so and so next week" So while i continue my struggle to > procure a donation, i have bought myself the book. > > Looking forward to it :) - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQvio7RH2WUcUFbZUEQLdIACg3r6Qz6LhrkpRgZRVyLH+B/yv67sAoOWk UWti2QGJhje59gJGCqqEQLxW =rHmi -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From max at KIPNESS.COM Tue Aug 9 17:36:20 2005 From: max at KIPNESS.COM (Max Kipness) Date: Thu Jan 12 21:30:33 2006 Subject: Keep local copy and forward Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I've got a bit of a dilemna, and can't seem to figure out a solution. I have a client that is switching from Sendmail to Exchange. During the transition, they would like a copy of all email to go to the local mbox, and relay to Exchange, all while be processed by MailScanner. I know I can remove remove their domain from local-domains, place it in mailertable, and then use the MailScanner archive method. But then they have access to viruses that I can't have. Is there anyway to get the nonspam rule to deliver to an mbox as a file, ex. /var/spool/mail/useraccount? This would solve my problem, but it doesn't seem to work. Thanks, Max ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Tue Aug 9 17:48:40 2005 From: alex at NKPANAMA.COM (Alex Neuman) Date: Thu Jan 12 21:30:33 2006 Subject: Keep local copy and forward Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Here's how I'd do it. Mail arrives for "company.com", and you've set up a domain called company.local which you receive mail for on the mailscanner box. On mailertable you set "company.com smtp:[the-m-sexchangeboxip] so that mail for that company gets sent directly to your m-sexchange box. On "nonspam actions" set a ruleset like this: to: jdoe@company.com deliver forward jdoe@company.local FromOrTo: default deliver forward someboxtogeteverythingelse@company.local That way no viruses or spam will get to your m-sexchange box. > I've got a bit of a dilemna, and can't seem to figure out a solution. > > I have a client that is switching from Sendmail to Exchange. During the > transition, they would like a copy of all email to go to the local mbox, > and relay to Exchange, all while be processed by MailScanner. > > I know I can remove remove their domain from local-domains, place it in > mailertable, and then use the MailScanner archive method. But then they > have access to viruses that I can't have. > > Is there anyway to get the nonspam rule to deliver to an mbox as a file, > ex. /var/spool/mail/useraccount? This would solve my problem, but it > doesn't seem to work. > > Thanks, > Max > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From P.G.M.Peters at UTWENTE.NL Tue Aug 9 18:30:11 2005 From: P.G.M.Peters at UTWENTE.NL (Peter Peters) Date: Thu Jan 12 21:30:33 2006 Subject: MailScanner ANNOUNCE: New Book Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote on 9-8-2005 14:59: >>>Strange. When I search for mailscanner products on cafepress I >>>don't see it. > > There are 2 MailScanner stores (necessary because of their > limitations in "free" shops). MailScanner and MailScanner2. The text > at the top of the main shop page mentions the other one. I ordered the book. And I asked whether we could buy a few other items as wel. Our chief operator thought the boxer would look nice on the male operators. But we both didn't think our female operator would show of her malescanner thong. -- Peter Peters, senior beheerder (Security) Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE) Universiteit Twente, Postbus 217, 7500 AE Enschede telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/itbe ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Tue Aug 9 19:13:23 2005 From: alex at NKPANAMA.COM (Alex Neuman) Date: Thu Jan 12 21:30:33 2006 Subject: Keep local copy and forward Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Oh, and tell sendmail to relay for company.com by adding company.com to /etc/mail/relay-domains or to /etc/mail/access (as in To:company.com RELAY)... > Here's how I'd do it. > > Mail arrives for "company.com", and you've set up a domain called > company.local which you receive mail for on the mailscanner box. On > mailertable you set "company.com smtp:[the-m-sexchangeboxip] so that mail > for that company gets sent directly to your m-sexchange box. > > On "nonspam actions" set a ruleset like this: > > to: jdoe@company.com deliver forward jdoe@company.local > FromOrTo: default deliver forward someboxtogeteverythingelse@company.local > > That way no viruses or spam will get to your m-sexchange box. > >> I've got a bit of a dilemna, and can't seem to figure out a solution. >> >> I have a client that is switching from Sendmail to Exchange. During the >> transition, they would like a copy of all email to go to the local mbox, >> and relay to Exchange, all while be processed by MailScanner. >> >> I know I can remove remove their domain from local-domains, place it in >> mailertable, and then use the MailScanner archive method. But then they >> have access to viruses that I can't have. >> >> Is there anyway to get the nonspam rule to deliver to an mbox as a file, >> ex. /var/spool/mail/useraccount? This would solve my problem, but it >> doesn't seem to work. >> >> Thanks, >> Max >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From max at kipness.com Tue Aug 9 22:40:36 2005 From: max at kipness.com (Max Kipness) Date: Thu Jan 12 21:30:33 2006 Subject: Keep local copy and forward Message-ID: Thanks. I've actually done this method before and it does work good. It's just a lot of work if you have many accounts. I was hoping there was an easier way. I wish the option could be added to archive AFTER doing MailScanner checks. Thanks, Max > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Alex Neuman > Sent: Tuesday, August 09, 2005 1:13 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Keep local copy and forward > > Oh, and tell sendmail to relay for company.com by adding company.com to > /etc/mail/relay-domains or to /etc/mail/access (as in To:company.com > RELAY)... > > > Here's how I'd do it. > > > > Mail arrives for "company.com", and you've set up a domain called > > company.local which you receive mail for on the mailscanner box. On > > mailertable you set "company.com smtp:[the-m-sexchangeboxip] so that > mail > > for that company gets sent directly to your m-sexchange box. > > > > On "nonspam actions" set a ruleset like this: > > > > to: jdoe@company.com deliver forward jdoe@company.local > > FromOrTo: default deliver forward > someboxtogeteverythingelse@company.local > > > > That way no viruses or spam will get to your m-sexchange box. > > > >> I've got a bit of a dilemna, and can't seem to figure out a solution. > >> > >> I have a client that is switching from Sendmail to Exchange. During the > >> transition, they would like a copy of all email to go to the local > mbox, > >> and relay to Exchange, all while be processed by MailScanner. > >> > >> I know I can remove remove their domain from local-domains, place it in > >> mailertable, and then use the MailScanner archive method. But then they > >> have access to viruses that I can't have. > >> > >> Is there anyway to get the nonspam rule to deliver to an mbox as a > file, > >> ex. /var/spool/mail/useraccount? This would solve my problem, but it > >> doesn't seem to work. > >> > >> Thanks, > >> Max > >> > >> ------------------------ MailScanner list ------------------------ > >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >> 'leave mailscanner' in the body of the email. > >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >> Support MailScanner development - buy the book off the website! > >> > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 9 22:59:24 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:33 2006 Subject: Keep local copy and forward Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Max Kipness wrote: >Thanks. I've actually done this method before and it does work good. It's >just a lot of work if you have many accounts. > > It's not a lot of work if you implement it using a very simple Custom Function rather than a huge ruleset. It will be many times faster too. > > > >>-----Original Message----- >>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >>Behalf Of Alex Neuman >>Sent: Tuesday, August 09, 2005 1:13 PM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: Keep local copy and forward >> >>Oh, and tell sendmail to relay for company.com by adding company.com to >>/etc/mail/relay-domains or to /etc/mail/access (as in To:company.com >>RELAY)... >> >> >> >>>Here's how I'd do it. >>> >>>Mail arrives for "company.com", and you've set up a domain called >>>company.local which you receive mail for on the mailscanner box. On >>>mailertable you set "company.com smtp:[the-m-sexchangeboxip] so that >>> >>> >>mail >> >> >>>for that company gets sent directly to your m-sexchange box. >>> >>>On "nonspam actions" set a ruleset like this: >>> >>>to: jdoe@company.com deliver forward jdoe@company.local >>>FromOrTo: default deliver forward >>> >>> >>someboxtogeteverythingelse@company.local >> >> >>>That way no viruses or spam will get to your m-sexchange box. >>> >>> >>> >>>>I've got a bit of a dilemna, and can't seem to figure out a solution. >>>> >>>>I have a client that is switching from Sendmail to Exchange. During the >>>>transition, they would like a copy of all email to go to the local >>>> >>>> >>mbox, >> >> >>>>and relay to Exchange, all while be processed by MailScanner. >>>> >>>>I know I can remove remove their domain from local-domains, place it in >>>>mailertable, and then use the MailScanner archive method. But then they >>>>have access to viruses that I can't have. >>>> >>>>Is there anyway to get the nonspam rule to deliver to an mbox as a >>>> >>>> >>file, >> >> >>>>ex. /var/spool/mail/useraccount? This would solve my problem, but it >>>>doesn't seem to work. >>>> >>>>Thanks, >>>>Max >>>> >>>>------------------------ MailScanner list ------------------------ >>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>'leave mailscanner' in the body of the email. >>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>>Support MailScanner development - buy the book off the website! >>>> >>>> >>>> >>>------------------------ MailScanner list ------------------------ >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >>> >>> >>> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >> > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQvknPhH2WUcUFbZUEQJIogCfQ6jrQwyIRix5WfQVa1SwHirxa2IAn3j/ gStGiiIdoknyupT4W/g0uNiE =QYO6 -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dstraka at CASPERCOLLEGE.EDU Wed Aug 10 14:30:40 2005 From: dstraka at CASPERCOLLEGE.EDU (Daniel Straka) Date: Thu Jan 12 21:30:33 2006 Subject: Content-Transfer-Encoding: base64 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Has anyone ever received any legitimate mail that is encoded base 64? (see header snip-it below) If not, can MailScanner be used to blacklist these? Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: base64 Dan Straka Casper College (307)268-2399 ** Visit Casper College Online at www.caspercollege.edu ** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Aug 10 15:45:28 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:33 2006 Subject: Content-Transfer-Encoding: base64 Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10 Aug 2005, at 14:30, Daniel Straka wrote: > Has anyone ever received any legitimate mail that is encoded base 64? Errr... every attachment I ever get. But not HTML bodies, no. > (see header snip-it below) If not, can MailScanner be used to > blacklist > these? > > Content-Type: text/plain; charset="iso-8859-1" > Content-Transfer-Encoding: base64 A SpamAssassin rule should do the trick. If you aren't happy trying to write this yourself, there are other people on the list who should be able to help you, if they aren't away on holiday. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQvoTChH2WUcUFbZUEQJMbACg012MTCayJAY7Vxo79WsWHoM1vEAAnRa/ /lQnV193AjC0FBUsk1c2iZcA =0CX5 -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From john at TRADOC.FR Wed Aug 10 16:09:35 2005 From: john at TRADOC.FR (John Wilcock) Date: Thu Jan 12 21:30:33 2006 Subject: Content-Transfer-Encoding: base64 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > > Content-Type: text/plain; charset="iso-8859-1" > > Content-Transfer-Encoding: base64 > > > A SpamAssassin rule should do the trick. If you aren't happy trying > to write this yourself, there are other people on the list who should > be able to help you, if they aren't away on holiday. There's already a SA rule that looks for unnecessarily encoded text (MIME_BASE64_TEXT). Increasing the score for that should do the trick. John. -- -- Over 2500 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From vlad at MAZEK.COM Wed Aug 10 17:29:01 2005 From: vlad at MAZEK.COM (Vlad Mazek) Date: Thu Jan 12 21:30:33 2006 Subject: which RulesDuJour do you subscribe to? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Testing quite a few of them here and I wanted to get a general overview as to which ones you use on your systems. Obviously you can't just dump them all, but which ones do you use the most (or which ones produce the best results) for you. -Vlad ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Aug 10 17:45:07 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:33 2006 Subject: which RulesDuJour do you subscribe to? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Vlad Mazek wrote: > Testing quite a few of them here and I wanted to get a general > overview as to which ones you use on your systems. Obviously you can't > just dump them all, but which ones do you use the most (or which ones > produce the best results) for you. I use these: TRUSTED_RULESETS="SARE_REDIRECT_POST300 EVILNUMBERS SARE_BAYES_POISON_NXM SARE_HTML0 SARE_HTML1 SARE_HEADER0 SARE_HEADER1 SARE_SPECIFIC SARE_ADULT SARE_BML SARE_FRAUD SARE_SPOOF SARE_RANDOM SARE_OEM SARE_GENLSUBJ0 SARE_GENLSUBJ1 SARE_UNSUB SARE_URI SARE_HEADER SARE_CODING SARE_SPECIFIC TRIPWIRE" Seem to work well to me, but I am always open to suggestions of ways to improve the set. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQvovFhH2WUcUFbZUEQIOPQCgo6+Nc66/UjINKumX6DYqLUxFblMAoMeh tK08Xb2Rf60/WBkD24pPhrM1 =PNVY -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martelm at QUARK.VSC.EDU Wed Aug 10 18:13:33 2005 From: martelm at QUARK.VSC.EDU (Michael H. Martel) Date: Thu Jan 12 21:30:33 2006 Subject: New versions of F-Prot Antivirus for UNIX (fwd) Message-ID: I just got this from F-Prot. Do the new changes in 4.6 (read the release notes) require any changes to the wrapper in MailScanner ? I'll be applying 4.6 to my test MailScanner shortly. Thanks! ------------ Forwarded Message ------------ Date: August 10, 2005 3:32:39 PM +0000 From: F-Prot Antivirus Alert Service To: Michael H Martel Subject: New versions of F-Prot Antivirus for UNIX Note: This message is only sent to the subscribers of the F-Prot Antivirus Alert Service. To modify your subscription, please click here: http://alerts.f-prot.com/cgi-bin/mf?lang=en&e=martelm@quark.vsc.edu -- FRISK Software has released versions 4.6.0 of all F-Prot Antivirus for UNIX products. More information on these releases can be found on our website: http://www.f-prot.com/news/gen_news/050808_release_unix_all.html We recommend that users of F-Prot Antivirus for Linux x86, for BSD x86, for Solaris x86, for Solaris SPARC, for AIX on IBM pSeries and for Linux on IBM zSeries update their programs to these newest versions as soon as possible. Please visit our update center to update your program now: http://subscription.f-prot.com/login/index.html For information on the most current versions of F-Prot Antivirus products and the latest virus signature files, visit our current versions page: http://www.f-prot.com/currentversions.html -- F-Prot Antivirus Alert Service http://www.f-prot.com ---------- End Forwarded Message ---------- Michael -- --------------------------------o--------------------------------- Michael H. Martel | Systems Administrator michael.martel@vsc.edu | Vermont State Colleges http://www.vsc.edu/~michael | PH:802-241-2544 FX:802-241-3363 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve.swaney at fsl.com Wed Aug 10 18:23:21 2005 From: steve.swaney at fsl.com (Stephen Swaney) Date: Thu Jan 12 21:30:33 2006 Subject: which RulesDuJour do you subscribe to? Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Vlad Mazek > Sent: Wednesday, August 10, 2005 12:29 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: which RulesDuJour do you subscribe to? > > Testing quite a few of them here and I wanted to get a general overview > as to which ones you use on your systems. Obviously you can't just dump > them all, but which ones do you use the most (or which ones produce the > best results) for you. > > -Vlad We've written a wrapper for Rules_Du_Jour that's available on our website http://www.fsl/support There is an installation script (Linux only) for the files and a cron job that updates the rules and the rules_du_jour script (if there is a newer one available) We try to update the rules monthly but I can't guarantee that they are completely accurate. I can say that we've had very good results using the SARE rule sets included in this package. If anyone has any suggestions or corrections for the rules I'll be happy to take them and update the files as appropriate. Steve Stephen Swaney Fort Systems Ltd. stephen.swaney@fsl.com www.fsl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Wed Aug 10 18:32:10 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:33 2006 Subject: which RulesDuJour do you subscribe to? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Stephen Swaney spake the following on 8/10/2005 10:23 AM: >>-----Original Message----- >>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >>Behalf Of Vlad Mazek >>Sent: Wednesday, August 10, 2005 12:29 PM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: which RulesDuJour do you subscribe to? >> >>Testing quite a few of them here and I wanted to get a general overview >>as to which ones you use on your systems. Obviously you can't just dump >>them all, but which ones do you use the most (or which ones produce the >>best results) for you. >> >>-Vlad > > > We've written a wrapper for Rules_Du_Jour that's available on our website > > http://www.fsl/support > > There is an installation script (Linux only) for the files and a cron job > that updates the rules and the rules_du_jour script (if there is a newer one > available) > > We try to update the rules monthly but I can't guarantee that they are > completely accurate. I can say that we've had very good results using the > SARE rule sets included in this package. > > If anyone has any suggestions or corrections for the rules I'll be happy to > take them and update the files as appropriate. > > Steve > > Stephen Swaney > Fort Systems Ltd. > stephen.swaney@fsl.com > www.fsl.com > How about some of the sare_obfu rules? Or are they worth it? -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard.gray at DNS.CO.UK Thu Aug 11 08:54:47 2005 From: richard.gray at DNS.CO.UK (Gray, Richard) Date: Thu Jan 12 21:30:33 2006 Subject: Problem with quarantine/deletion links Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, I've got a small problem with the way MailScanner currently handles messages as they arrive in the system. I've got rules set up so that mail with a spam score > 10 will be automatically deleted. I also have MCP enabled and am using it as a profanity filter. This is set to quarantine everything with a score > 4 The problem I have is that some of the spam that scores > 10 also happens to contain a lot of profanity, and hence scores > 4 on the MCP filters. This means that rather than the message being deleted, it gets quarantined. I would like these messages to be deleted based on their spam score rather than quarantined because of their MCP score. I thought the 'First Check' entry in MailScanner.conf would be where to fix this, so I changed this to 'First Check = spam', but this doesn't seem to have done the trick. Is there somewhere else I need to change this in order to make it work? Or maybe there is a way to define the precedence of the various actions (filetypes, actions, spam, etc.) I guess what I'm suggesting is a new entry in MailScanner.conf for a user to define the priority which each filter has. I personally would have the order be: Virus, Spam, MCP, filetypes .... but I can see that other people would do things differently. I haven't looked into the code itself to make this change, but am happy to do so, if someone could point me in the right direction. Many Thanks, Richard This email from dns has been validated by dnsMSSTM Managed Email Security and is free from all known viruses. For further information contact email-integrity@dns.co.uk ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ja at CONVIATOR.COM Thu Aug 11 11:52:02 2005 From: ja at CONVIATOR.COM (Jan Agermose) Date: Thu Jan 12 21:30:33 2006 Subject: allowiframetag=yes Message-ID: Hi Im trying to get MSGateway to accept iframe mails but I cannot figure where to set this directly in the conf-files or is it in the LDAP setup? Setting this using the webinterface does not work. Mvh Jan ________________________________________________________________________________ [IMAGE] Jan Agermose CEO Conviator Tel. +45 35 266 460 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "image001.gif" Image/GIF 732bytes. ] [ Unable to print this part. ] From ja at CONVIATOR.COM Thu Aug 11 12:44:04 2005 From: ja at CONVIATOR.COM (Jan Agermose) Date: Thu Jan 12 21:30:33 2006 Subject: SV: allowiframetag=yes Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] ________________________________________________________________________________ Fra: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] Pĺ vegne af Jan Agermose Sendt: 11. august 2005 12:52 Til: MAILSCANNER@JISCMAIL.AC.UK Emne: allowiframetag=yes Hi Im trying to get MSGateway to accept iframe mails but I cannot figure where to set this directly in the conf-files or is it in the LDAP setup? Setting this using the webinterface does not work. ********** OK – its part of the settings that are in LDAP – but as I know nothing about modifying LDAP data I’m sort of lost J Does anyone know the commandline to change the “allowiframetag” in LDAP? Regards Jan ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve.swaney at fsl.com Thu Aug 11 13:07:40 2005 From: steve.swaney at fsl.com (Stephen Swaney) Date: Thu Jan 12 21:30:33 2006 Subject: allowiframetag=yes Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Jan Agermose > Sent: Thursday, August 11, 2005 6:52 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: allowiframetag=yes > > Hi > > I'm trying to get MSGateway to accept iframe mails but I cannot figure > where to set this directly in the conf-files or is it in the LDAP setup? > Setting this using the webinterface does not work. > > > Mvh > > Jan > Jan, I'm very sorry for the very late reply but please address any future queries regarding SMGateway directly to me and not the MailScanner list. There will be a new release of the product very soon which should address this issue. We expect to release version 1.8 in early September which will bring all included applications up to their very latest versions and add the functionality and features included in the latest versions. All of the HTML configuration items will also allow rulesets in version 1.8 Look for announcement early next week on the release schedule and other issues. I'll make sure that you are on the announce list. Best regards, Steve Stephen Swaney Fort Systems Ltd. stephen.swaney@fsl.com www.fsl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bill at BFCCOMPUTING.COM Thu Aug 11 18:43:23 2005 From: bill at BFCCOMPUTING.COM (Bill McGonigle) Date: Thu Jan 12 21:30:33 2006 Subject: TNEF still a problem? Message-ID: On Aug 8, 2005, at 05:34, Nigel kendrick wrote: > I just noticed that the same 9 emails were getting processed (archived > and > blacklist checked) by MailScanner (4.44.6) in a loop without actually > being > submitted for virus scanning and further processing/delivery. > > I also saw the list messages here about issues with TNEF and, lo, one > of the > MailScanner messages in the 'loop' referred to expanding a TNEF file. > I set > 'Expand TNEF = yes' to 'no' and things got moving again (with some very > hefty 'delay=' values - i.e.: delay=22295!!!) > > Other mail was being delivered during this period but obviously this > needs a > fix. I notice Julian posted a TNEF patch - has this been tried by > anyone > else yet and (noob hat on...) how do I apply it?? FWIW, I switched to the external tnef processor on a troubled machine and 30 messages blazed by that were chewing up the CPU previously. -Bill ----- Bill McGonigle, Owner Work: 603.448.4440 BFC Computing, LLC Home: 603.448.1668 bill@bfccomputing.com Mobile: 603.252.2606 http://www.bfccomputing.com/ Pager: 603.442.1833 AIM: wpmcgonigle Text: bill+text@bfccomputing.com RSS: http://blog.bfccomputing.com/rss For fastest support contact, please follow: http://bfccomputing.com/support_contact.html ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Aug 11 20:20:45 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:33 2006 Subject: TNEF still a problem? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Bill McGonigle wrote: > On Aug 8, 2005, at 05:34, Nigel kendrick wrote: > >> I just noticed that the same 9 emails were getting processed >> (archived and >> blacklist checked) by MailScanner (4.44.6) in a loop without actually >> being >> submitted for virus scanning and further processing/delivery. >> >> I also saw the list messages here about issues with TNEF and, lo, one >> of the >> MailScanner messages in the 'loop' referred to expanding a TNEF file. >> I set >> 'Expand TNEF = yes' to 'no' and things got moving again (with some very >> hefty 'delay=' values - i.e.: delay=22295!!!) >> >> Other mail was being delivered during this period but obviously this >> needs a >> fix. I notice Julian posted a TNEF patch - has this been tried by anyone >> else yet and (noob hat on...) how do I apply it?? > > > FWIW, I switched to the external tnef processor on a troubled machine > and 30 messages blazed by that were chewing up the CPU previously. That's interesting. Maybe there's a new TNEF version out there that the module doesn't support properly. Has anyone checked the Changelog of the Convert::TNEF module? Am I a long way from the most recent version? As for applying a patch: Say for example that the patch is stored in /tmp/tnef.patch, then do cd /usr/lib/MailScanner/MailScanner patch -p0 < /tmp/tnef.patch It should say that it has successfully applied the hunks of the patch. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Danny_Beland at PCH.GC.CA Thu Aug 11 20:59:24 2005 From: Danny_Beland at PCH.GC.CA (Danny Beland) Date: Thu Jan 12 21:30:33 2006 Subject: Bayes autolearn non-spam, but not spam Message-ID: For some reason Bayes autolearn non-spam but not spam. I use MailScanner 4.40.11 with SpamAssassin 3.0.2 and sendmail. The same setup works fine on another server. I deleted the bayes files and it still doesn't autolearn spam. It seems that I'm missing something... I have the following in my spam.assassin.prefs.conf for bayes. bayes_path /var/spool/spamassassin/bayes bayes_file_mode 0644 use_bayes 1 bayes_auto_learn 1 bayes_auto_learn_threshold_spam 4.5 bayes_auto_learn_threshold_nonspam 0.01 The installation of MailScanner and Spamassassin were made with the rpm packages. Thank you in advance. Danny ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dstraka at caspercollege.edu Thu Aug 11 21:02:49 2005 From: dstraka at caspercollege.edu (Daniel Straka) Date: Thu Jan 12 21:30:33 2006 Subject: SpamCop Block List with MailScanner Message-ID: Can Spamcop's BL be used with MailScanner? What are all the free RBL's that can be used with MailScanner? Dan Straka Academic Systems Specialist Casper College (307) 268-2399 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jaearick at COLBY.EDU Thu Aug 11 21:04:10 2005 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:30:33 2006 Subject: "mailscanner reload" for Solaris? Message-ID: Julian, I was looking at Steve Swaney's Rules_Du_Jour install script, and his script does "/etc/init.d/MailScanner reload", probably in Linux-land. My Solaris /etc/init.d script is attached, having not been touched in a long time. What would a "reload" action be in Solaris? Does MailScanner catch signals? Eg "kill -HUP" to reload? Jeff Earickson Colby College ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "" Text/PLAIN (Name: "COLBY.mailscanner") 9 lines. ] [ Unable to print this part. ] From MailScanner at ecs.soton.ac.uk Thu Aug 11 21:14:27 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:33 2006 Subject: SpamCop Block List with MailScanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Take a look in /etc/MailScanner/spam.lists.conf and in the file 20_dnsbl_tests.cf in your SpamAssassin rules directory. Also the RBL test at www.dnsstuff.com will show you another list of the free ones available. Note that when using the "Spam List" configuration setting in MailScanner.conf, I recommend you don't use more than about 3 or maybe 4 RBL's. The rest should be done by SpamAssassin. MailScanner only checks them in turn, whereas SpamAssassin checks them in parallel. I might rewrite the MailScanner code to do it one day, but there isn't a whole lot of point to be honest, so I haven't done it so far. Daniel Straka wrote: >Can Spamcop's BL be used with MailScanner? What are all the free >RBL's that can be used with MailScanner? > > >Dan Straka >Academic Systems Specialist >Casper College >(307) 268-2399 > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Aug 11 21:16:43 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:33 2006 Subject: "mailscanner reload" for Solaris? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jeff A. Earickson wrote: > Julian, > > I was looking at Steve Swaney's Rules_Du_Jour install script, > and his script does "/etc/init.d/MailScanner reload", probably > in Linux-land. My Solaris /etc/init.d script is attached, having > not been touched in a long time. What would a "reload" action > be in Solaris? Does MailScanner catch signals? Yes. Find the PID of MailScanner from the PID File setting in MailScanner.conf. If this PID is 123 then do kill -HUP -123 Note the -123 as opposed to 123. This will HUP the whole process group, which all the children will catch and commit suicide. They are then respawned by the parent, which ignores the HUP itself. >#!/sbin/sh ># > >#---prevent core dumps >/usr/bin/ulimit -c 0 > >case "$1" in >start) > #---v4 > (/opt/MailScanner/bin/check_mailscanner > /dev/null) && echo "mailscanner started" > status=$? > ;; >stop) > kill `pgrep MailScanner` && echo "mailscanner stopped" > status=$? > ;; >*) > echo "Usage: $0 {start|stop}" > exit 1 > ;; >esac > >if [ $status != 0 ]; then > echo "$status" > exit 1 >fi >exit 0 > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jaearick at COLBY.EDU Thu Aug 11 21:36:36 2005 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:30:33 2006 Subject: "mailscanner reload" for Solaris? Message-ID: Thanks! Updated my script to add a reload option, like so: kill -HUP -`cat /opt/MailScanner/var/MailScanner.pid` Works great, thanks. Jeff Earickson On Thu, 11 Aug 2005, Julian Field wrote: > Date: Thu, 11 Aug 2005 21:16:43 +0100 > From: Julian Field > Reply-To: MailScanner mailing list > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: "mailscanner reload" for Solaris? > > Jeff A. Earickson wrote: > >> Julian, >> >> I was looking at Steve Swaney's Rules_Du_Jour install script, >> and his script does "/etc/init.d/MailScanner reload", probably >> in Linux-land. My Solaris /etc/init.d script is attached, having >> not been touched in a long time. What would a "reload" action >> be in Solaris? Does MailScanner catch signals? > > Yes. > > Find the PID of MailScanner from the PID File setting in MailScanner.conf. > If this PID is 123 then do > > kill -HUP -123 > > Note the -123 as opposed to 123. This will HUP the whole process group, which > all the children will catch and commit suicide. They are then respawned by > the parent, which ignores the HUP itself. > > >> #!/sbin/sh >> # >> >> #---prevent core dumps >> /usr/bin/ulimit -c 0 >> >> case "$1" in >> start) >> #---v4 >> (/opt/MailScanner/bin/check_mailscanner > /dev/null) && echo >> "mailscanner started" >> status=$? >> ;; >> stop) >> kill `pgrep MailScanner` && echo "mailscanner stopped" >> status=$? >> ;; >> *) >> echo "Usage: $0 {start|stop}" >> exit 1 >> ;; >> esac >> >> if [ $status != 0 ]; then >> echo "$status" >> exit 1 >> fi >> exit 0 >> > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Aug 11 22:12:08 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:34 2006 Subject: "mailscanner reload" for Solaris? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] You could do with testing the existence of the pid file first, but otherwise that looks fine. Jeff A. Earickson wrote: > Thanks! Updated my script to add a reload option, like so: > > kill -HUP -`cat /opt/MailScanner/var/MailScanner.pid` > > Works great, thanks. > > Jeff Earickson > > On Thu, 11 Aug 2005, Julian Field wrote: > >> Date: Thu, 11 Aug 2005 21:16:43 +0100 >> From: Julian Field >> Reply-To: MailScanner mailing list >> To: MAILSCANNER@JISCMAIL.AC.UK >> Subject: Re: "mailscanner reload" for Solaris? >> >> Jeff A. Earickson wrote: >> >>> Julian, >>> >>> I was looking at Steve Swaney's Rules_Du_Jour install script, >>> and his script does "/etc/init.d/MailScanner reload", probably >>> in Linux-land. My Solaris /etc/init.d script is attached, having >>> not been touched in a long time. What would a "reload" action >>> be in Solaris? Does MailScanner catch signals? >> >> >> Yes. >> >> Find the PID of MailScanner from the PID File setting in >> MailScanner.conf. >> If this PID is 123 then do >> >> kill -HUP -123 >> >> Note the -123 as opposed to 123. This will HUP the whole process >> group, which all the children will catch and commit suicide. They are >> then respawned by the parent, which ignores the HUP itself. >> >> >>> #!/sbin/sh >>> # >>> >>> #---prevent core dumps >>> /usr/bin/ulimit -c 0 >>> >>> case "$1" in >>> start) >>> #---v4 >>> (/opt/MailScanner/bin/check_mailscanner > /dev/null) && echo >>> "mailscanner started" >>> status=$? >>> ;; >>> stop) >>> kill `pgrep MailScanner` && echo "mailscanner stopped" >>> status=$? >>> ;; >>> *) >>> echo "Usage: $0 {start|stop}" >>> exit 1 >>> ;; >>> esac >>> >>> if [ $status != 0 ]; then >>> echo "$status" >>> exit 1 >>> fi >>> exit 0 >>> >> >> -- >> Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> Professional Support Services at www.MailScanner.biz >> MailScanner thanks transtec Computers for their support >> >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Thu Aug 11 22:42:44 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:30:34 2006 Subject: Bayes autolearn non-spam, but not spam Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Danny Beland wrote: > For some reason Bayes autolearn non-spam but not spam. I use MailScanner > 4.40.11 with SpamAssassin 3.0.2 and sendmail. You're vulnerable to a mime parser DoS. Upgrade to 3.0.4 to fix that. The same setup works fine on > another server. > I deleted the bayes files and it still doesn't autolearn spam. It seems > that I'm missing something... > I have the following in my spam.assassin.prefs.conf for bayes. > > bayes_path /var/spool/spamassassin/bayes > bayes_file_mode 0644 I'd suggest fixing that file mode. Use 755 not 644. There are rare instances it gets used for directory creation. SA won't create regular files with the X bit, but directories need it. > use_bayes 1 > bayes_auto_learn 1 > bayes_auto_learn_threshold_spam 4.5 > bayes_auto_learn_threshold_nonspam 0.01 It's pointless to set a spam threshold under 6.0, as SA will in effect ignore you. SA has a hard-coded requirement that there be at least 3.0 of header hits AND 3.0 of body hits before it will learn as spam. That means that the absolute minimum threshold is 6.0. You'd have to hack the code to change it. If you don't have network checks enabled, spam autolearning can be somewhat rare due to low header rule hits. You might consider adding some header-based rules from rulesemporium.com or other sites. SA also won't autolearn a message as spam if it would have otherwise hit BAYES_00. This is to avoid self-contradictions. Make sure your training is in good shape. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From micoots at YAHOO.COM Thu Aug 11 23:08:29 2005 From: micoots at YAHOO.COM (Michael Mansour) Date: Thu Jan 12 21:30:34 2006 Subject: Stopping MailScanner for everything on domain except virus scanning Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, I have a domain which I host email for, and I'd like MailScanner to _not_ do its job for most things except virus scanning (I don't want to "interfere" too much with their email unless they specifically ask me to). To do this, I've added the following rulesets: use.spamassassin.rules dangerous.content.scanning.rules which contain basically the same thing, and that is: FromOrTo: *@domainname.com no FromOrTo: default yes and I've told the MailScanner.conf file of their relevent ruleset using: Use SpamAssassin = %rules-dir%/use.spamassassin.rules and Dangerous Content Scanning = %rules-dir%/dangerous.content.scanning.rules That's correct in the way I did it yes? Should I be adding more rules? Michael. Send instant messages to your online friends http://au.messenger.yahoo.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve.swaney at fsl.com Thu Aug 11 23:28:17 2005 From: steve.swaney at fsl.com (Stephen Swaney) Date: Thu Jan 12 21:30:34 2006 Subject: Stopping MailScanner for everything on domain except virus scanning Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Michael Mansour > Sent: Thursday, August 11, 2005 6:08 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Stopping MailScanner for everything on domain except virus > scanning > > Hi, > > I have a domain which I host email for, and I'd like > MailScanner to _not_ do its job for most things except > virus scanning (I don't want to "interfere" too much > with their email unless they specifically ask me to). > > To do this, I've added the following rulesets: > > use.spamassassin.rules > dangerous.content.scanning.rules > > which contain basically the same thing, and that is: > > FromOrTo: *@domainname.com no > FromOrTo: default yes > > and I've told the MailScanner.conf file of their > relevent ruleset using: > > Use SpamAssassin = %rules-dir%/use.spamassassin.rules > > and > > Dangerous Content Scanning = > %rules-dir%/dangerous.content.scanning.rules > > That's correct in the way I did it yes? > > Should I be adding more rules? > > Michael. > > You will probably need to also setup rulesets for: Spam Checks = Filename Rules = Filetype Rules = The File* Rules need a level of indirection in the rulesets, see: http://wiki.mailscanner.info/doku.php?id=documentation:configuration:ruleset s:overloading&s=Filename+Rules Steve Stephen Swaney Fort Systems Ltd. stephen.swaney@fsl.com www.fsl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From randyf at SIBERNET.COM Fri Aug 12 07:05:08 2005 From: randyf at SIBERNET.COM (Randy Fishel) Date: Thu Jan 12 21:30:34 2006 Subject: "mailscanner reload" for Solaris? Message-ID: Solaris, for several releases now, has had a "pkill" command, such that: pkill -HUP MailScanner will do the same thing without having to grep the process. This is how my S10 SMF refresh method restarts MailScanner (though it handles the sendmail part by using the /var/run pid file). rf On Thu, 2005-08-11 at 21:16 +0100, Julian Field wrote: > Jeff A. Earickson wrote: > > > Julian, > > > > I was looking at Steve Swaney's Rules_Du_Jour install script, > > and his script does "/etc/init.d/MailScanner reload", probably > > in Linux-land. My Solaris /etc/init.d script is attached, having > > not been touched in a long time. What would a "reload" action > > be in Solaris? Does MailScanner catch signals? > > Yes. > > Find the PID of MailScanner from the PID File setting in MailScanner.conf. > If this PID is 123 then do > > kill -HUP -123 > > Note the -123 as opposed to 123. This will HUP the whole process group, > which all the children will catch and commit suicide. They are then > respawned by the parent, which ignores the HUP itself. > > > >#!/sbin/sh > ># > > > >#---prevent core dumps > >/usr/bin/ulimit -c 0 > > > >case "$1" in > >start) > > #---v4 > > (/opt/MailScanner/bin/check_mailscanner > /dev/null) && echo "mailscanner started" > > status=$? > > ;; > >stop) > > kill `pgrep MailScanner` && echo "mailscanner stopped" > > status=$? > > ;; > >*) > > echo "Usage: $0 {start|stop}" > > exit 1 > > ;; > >esac > > > >if [ $status != 0 ]; then > > echo "$status" > > exit 1 > >fi > >exit 0 > > > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jaearick at COLBY.EDU Fri Aug 12 12:05:52 2005 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:30:34 2006 Subject: "mailscanner reload" for Solaris? Message-ID: Hi, My script (before yesterday) used pgrep and/or pkill. "pgrep MailScanner" gives all of the process numbers. For a reload, I only wanted the group leader. I contemplated the "-o" option of pgrep/pkill to only give me the oldest process to HUP. But it makes more sense (to me anyway) to use the info in the MailScanner.pid file. Jeff Earickson On Thu, 11 Aug 2005, Randy Fishel wrote: > Date: Thu, 11 Aug 2005 23:05:08 -0700 > From: Randy Fishel > Reply-To: MailScanner mailing list > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: "mailscanner reload" for Solaris? > > Solaris, for several releases now, has had a "pkill" command, such > that: > > pkill -HUP MailScanner > > will do the same thing without having to grep the process. This is how > my S10 SMF refresh method restarts MailScanner (though it handles the > sendmail part by using the /var/run pid file). > > rf > > On Thu, 2005-08-11 at 21:16 +0100, Julian Field wrote: >> Jeff A. Earickson wrote: >> >>> Julian, >>> >>> I was looking at Steve Swaney's Rules_Du_Jour install script, >>> and his script does "/etc/init.d/MailScanner reload", probably >>> in Linux-land. My Solaris /etc/init.d script is attached, having >>> not been touched in a long time. What would a "reload" action >>> be in Solaris? Does MailScanner catch signals? >> >> Yes. >> >> Find the PID of MailScanner from the PID File setting in MailScanner.conf. >> If this PID is 123 then do >> >> kill -HUP -123 >> >> Note the -123 as opposed to 123. This will HUP the whole process group, >> which all the children will catch and commit suicide. They are then >> respawned by the parent, which ignores the HUP itself. >> >> >>> #!/sbin/sh >>> # >>> >>> #---prevent core dumps >>> /usr/bin/ulimit -c 0 >>> >>> case "$1" in >>> start) >>> #---v4 >>> (/opt/MailScanner/bin/check_mailscanner > /dev/null) && echo "mailscanner started" >>> status=$? >>> ;; >>> stop) >>> kill `pgrep MailScanner` && echo "mailscanner stopped" >>> status=$? >>> ;; >>> *) >>> echo "Usage: $0 {start|stop}" >>> exit 1 >>> ;; >>> esac >>> >>> if [ $status != 0 ]; then >>> echo "$status" >>> exit 1 >>> fi >>> exit 0 >>> >>> >> > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Aug 12 12:12:29 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:34 2006 Subject: REQUEST: Configuration Change Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 If you aren't already using the signature feature for anything else, please can you set Sign Clean Messages = yes so that MailScanner gets a bit more publicity. The signature text is already set up in %report-dir%/(your language)/ inline.sig.* Thankyou! - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQvyEHxH2WUcUFbZUEQIiAQCg8oTQP7m34zzte+Ye4hcqeODMT2MAn3bM IBhX/cqWeulKEZkgiwyUjSub =JI7K -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Aug 12 14:14:26 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:34 2006 Subject: MailScanner ANNOUNCE: Black shirts Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Black shirts are now available from http://mailscanner.spreadshirt.net They are very high quality polo shirts embroidered with the MailScanner design. Also available in a rather nice light blue. They are made in Europe so the shipping costs should be better for all of us who don't live in the US. Any requests for more colours, styles or products, just let me know. I will be adding some more products (such as black T-shirts printed with the logo) very soon. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQvygtRH2WUcUFbZUEQLlsgCgkkprvvI+gOpPhfalTp8FLrALx9EAn2ix T+y/Afd/JRF3O7bRnMhMKY/y =LVOJ -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From grantd at AISMEDIA.COM Fri Aug 12 14:21:43 2005 From: grantd at AISMEDIA.COM (Grant) Date: Thu Jan 12 21:30:34 2006 Subject: MailScanner ANNOUNCE: Black shirts Message-ID: What about those of us who live in the US? - Thank you, Grant Della Vecchia System Administrator ---------------------------------------------------------------------- AIS Media, Inc. 7000 Central Parkway, Suite 1700 Atlanta, GA 30328 Tel: 770.350.7998 ext. 506 | Fax: 770.350.9409 URL: www.aismedia.com | Email: grantd@aismedia.com ---------------------------------------------------------------------- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Aug 12 14:28:44 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:34 2006 Subject: MailScanner ANNOUNCE: Black shirts Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 You will have to buy them from Europe I'm afraid. These guys in Germany are about the only people I can find to do it. Cafepress (who I use for the other stores) cannot even print white, let alone embroider it. They don't sell black shirts at all. On 12 Aug 2005, at 14:21, Grant wrote: > What about those of us who live in the US? > - > Thank you, > Grant Della Vecchia > System Administrator > ---------------------------------------------------------------------- > AIS Media, Inc. > 7000 Central Parkway, Suite 1700 > Atlanta, GA 30328 > Tel: 770.350.7998 ext. 506 | Fax: 770.350.9409 > URL: www.aismedia.com | Email: grantd@aismedia.com > ---------------------------------------------------------------------- > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQvykEhH2WUcUFbZUEQKWnQCfTcTjKZAVdBblhSd5xjstgGu+he0AnAwG 1QQxztCeHOppbqXxggbrqBqx =t/zS -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jaearick at COLBY.EDU Fri Aug 12 14:35:07 2005 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:30:34 2006 Subject: "mailscanner reload" for Solaris? Message-ID: Gang, FWIW, I have revised and improved my Solaris /etc/init.d script for MailScanner based on suggestions from Julian and others. See attached. It does "start", "reload", and "stop". It either uses var/MailScanner.pid if there, or pkill on the oldest MailScanner process otherwise. I noticed in testing this that MS complains to syslog if the pid file goes missing: Could not read file /opt/MailScanner/var/MailScanner.pid Error in line 165, file "/opt/MailScanner/var/MailScanner.pid" for pidfile does not exist (or can not be read) Jeff Earickson Colby College ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "" Text/PLAIN (Name: "COLBY.mailscanner") 26 lines. ] [ Unable to print this part. ] From ryanw at FALSEHOPE.COM Fri Aug 12 14:51:24 2005 From: ryanw at FALSEHOPE.COM (Ryan Weaver) Date: Thu Jan 12 21:30:34 2006 Subject: MailScanner ANNOUNCE: Black shirts Message-ID: Any chance of getting somewhat larger sizes for those of us with a somewhat larger form factor? :) > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field > Sent: Friday, August 12, 2005 8:14 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: MailScanner ANNOUNCE: Black shirts > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Black shirts are now available from > http://mailscanner.spreadshirt.net > > They are very high quality polo shirts embroidered with the > MailScanner design. > > Also available in a rather nice light blue. > > They are made in Europe so the shipping costs should be better for > all of us who don't live in the US. > > Any requests for more colours, styles or products, just let me know. > I will be adding some more products (such as black T-shirts printed > with the logo) very soon. > > - -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > -----BEGIN PGP SIGNATURE----- > Version: PGP Desktop 9.0.2 (Build 2425) > > iQA/AwUBQvygtRH2WUcUFbZUEQLlsgCgkkprvvI+gOpPhfalTp8FLrALx9EAn2ix > T+y/Afd/JRF3O7bRnMhMKY/y > =LVOJ > -----END PGP SIGNATURE----- > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Aug 12 14:55:40 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:34 2006 Subject: MailScanner ANNOUNCE: Black shirts Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I think so, yes. It will only be a T-shirt, but they do sell a big one. I'll investigate this weekend, check back in the shop on Monday. On 12 Aug 2005, at 14:51, Ryan Weaver wrote: > Any chance of getting somewhat larger sizes for those of us with a > somewhat > larger form factor? :) > > >> -----Original Message----- >> From: MailScanner mailing list >> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field >> Sent: Friday, August 12, 2005 8:14 AM >> To: MAILSCANNER@JISCMAIL.AC.UK >> Subject: MailScanner ANNOUNCE: Black shirts >> >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> Black shirts are now available from >> http://mailscanner.spreadshirt.net >> >> They are very high quality polo shirts embroidered with the >> MailScanner design. >> >> Also available in a rather nice light blue. >> >> They are made in Europe so the shipping costs should be better for >> all of us who don't live in the US. >> >> Any requests for more colours, styles or products, just let me know. >> I will be adding some more products (such as black T-shirts printed >> with the logo) very soon. >> >> - -- >> Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> >> -----BEGIN PGP SIGNATURE----- >> Version: PGP Desktop 9.0.2 (Build 2425) >> >> iQA/AwUBQvygtRH2WUcUFbZUEQLlsgCgkkprvvI+gOpPhfalTp8FLrALx9EAn2ix >> T+y/Afd/JRF3O7bRnMhMKY/y >> =LVOJ >> -----END PGP SIGNATURE----- >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQvyqXxH2WUcUFbZUEQLePACghCMILPIkeWpt22MfgEHj/4k44UQAoLgL 69LYB1JFHxPsUbJRWiVXYM1c =4RP8 -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From raymond at PROLOCATION.NET Fri Aug 12 15:08:15 2005 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:30:34 2006 Subject: MailScanner ANNOUNCE: Black shirts Message-ID: Hi! > Any chance of getting somewhat larger sizes for those of us with a somewhat > larger form factor? :) You can always buy 2 XXL's ;) Bye, Raymond. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHT.IE Fri Aug 12 15:40:17 2005 From: michele at BLACKNIGHT.IE (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:30:34 2006 Subject: MailScanner ANNOUNCE: Black shirts Message-ID: Ryan Weaver <> said on 12 August 2005 14:51: > Any chance of getting somewhat larger sizes for those of us with a > somewhat larger form factor? :) > Isn't XXL big enough? :) Mr Michele Neylon Blacknight Solutions Quality Business Hosting & Colocation http://www.blacknight.ie/ Tel. 1850 927 280 Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 59 9164239 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From itdept at REDRED.COM Fri Aug 12 15:42:56 2005 From: itdept at REDRED.COM (RedRed!com IT Department) Date: Thu Jan 12 21:30:34 2006 Subject: MailScanner ANNOUNCE: Black shirts Message-ID: Not everyone is a 1U rackmount. Some of us are a 7U caster model. LOL Michele Neylon :: Blacknight Solutions wrote: >Ryan Weaver <> said on 12 August 2005 14:51: > > > >>Any chance of getting somewhat larger sizes for those of us with a >>somewhat larger form factor? :) >> >> >> >Isn't XXL big enough? :) > > > >Mr Michele Neylon >Blacknight Solutions >Quality Business Hosting & Colocation >http://www.blacknight.ie/ >Tel. 1850 927 280 >Intl. +353 (0) 59 9183072 >Direct Dial: +353 (0)59 9183090 >Fax. +353 (0) 59 9164239 > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHT.IE Fri Aug 12 16:27:00 2005 From: michele at BLACKNIGHT.IE (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:30:34 2006 Subject: MailScanner ANNOUNCE: Black shirts Message-ID: RedRed!com IT Department <> said on 12 August 2005 15:43: > Not everyone is a 1U rackmount. Some of us are a 7U caster model. LOL > I'm a 3U I think :) Mr Michele Neylon Blacknight Solutions Quality Business Hosting & Colocation http://www.blacknight.ie/ Tel. 1850 927 280 Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 59 9164239 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From itdept at REDRED.COM Fri Aug 12 16:39:46 2005 From: itdept at REDRED.COM (RedRed!com IT Department) Date: Thu Jan 12 21:30:34 2006 Subject: MailScanner ANNOUNCE: Black shirts Message-ID: I'm a 2U with 19" to 23" adapters. :-P Michele Neylon :: Blacknight Solutions wrote: >RedRed!com IT Department <> said on 12 August 2005 15:43: > > > >>Not everyone is a 1U rackmount. Some of us are a 7U caster model. LOL >> >> >> >I'm a 3U I think :) > > > >Mr Michele Neylon >Blacknight Solutions >Quality Business Hosting & Colocation >http://www.blacknight.ie/ >Tel. 1850 927 280 >Intl. +353 (0) 59 9183072 >Direct Dial: +353 (0)59 9183090 >Fax. +353 (0) 59 9164239 > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From amoore at DEKALBMEMORIAL.COM Fri Aug 12 17:18:34 2005 From: amoore at DEKALBMEMORIAL.COM (Aaron K. Moore) Date: Thu Jan 12 21:30:34 2006 Subject: "mailscanner reload" for Solaris? Message-ID: Here's the init script I use on our redhat boxes. It also includes some code to keep MailScanner-MRTG from trying to restart MailScanner when you've shut MailScanner down. -- Aaron Kent Moore Information Technology Services DeKalb Memorial Hospital, Inc. Auburn, IN Jeff A. Earickson wrote: > Gang, > > FWIW, I have revised and improved my Solaris /etc/init.d script > for MailScanner based on suggestions from Julian and others. > See attached. It does "start", "reload", and "stop". It either > uses var/MailScanner.pid if there, or pkill on the oldest MailScanner > process otherwise. I noticed in testing this that MS complains > to syslog if the pid file goes missing: > > Could not read file /opt/MailScanner/var/MailScanner.pid > Error in line 165, file "/opt/MailScanner/var/MailScanner.pid" for > pidfile does not exist (or can not be read) > > Jeff Earickson > Colby College > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "MailScanner" Application/OCTET-STREAM (Name: ] [ "MailScanner") 2.6KB. ] [ Unable to print this part. ] From dstraka at CASPERCOLLEGE.EDU Fri Aug 12 17:03:02 2005 From: dstraka at CASPERCOLLEGE.EDU (Daniel Straka) Date: Thu Jan 12 21:30:34 2006 Subject: Mail with {Spam?} in Subject Being Delivered? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ever since I added spamcop.net and SORBS-SPAM to my MailScanner.conf: "Spam List = ORDB-RBL SBL+XBL spamcop.net SORBS-SPAM" Mail marked with {Spam?} in the subject line by MS is being delivered. I would like it deleted as it was before I made the Spam List change. Where do I need modify MailScanner.conf to make this happen? Thanks List! Dan Straka Casper College (307)268-2399 ** Visit Casper College Online at www.caspercollege.edu ** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From wright at CYBERVALE.COM Fri Aug 12 17:09:04 2005 From: wright at CYBERVALE.COM (Terran Wright) Date: Thu Jan 12 21:30:34 2006 Subject: ClamAV SA upgrade. Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Guy's I know this has been asked already but I'm not seeing it in the archives (maybe I need to search harder) but 2 quick questions. 1. What's the procedure for upgrading ClamAV and SA using the package Julian provides? 2. How do I get rid of this from the logs: "Unrar command /usr/bin/unrar does not exist or is not executable, please either install it or remove the setting from MailScanner.conf" Thanks guys. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kevins at BMRB.CO.UK Fri Aug 12 18:28:13 2005 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:30:34 2006 Subject: "mailscanner reload" for Solaris? Message-ID: On Fri, 2005-08-12 at 11:18 -0500, Aaron K. Moore wrote: > Here's the init script I use on our redhat boxes. It also includes some > code to keep MailScanner-MRTG from trying to restart MailScanner when > you've shut MailScanner down. If you use a recent MailScanner-MRTG it already checks for that. ================================================================= BMRB http://www.bmrb.co.uk _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Aug 12 18:29:07 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:34 2006 Subject: Mail with {Spam?} in Subject Being Delivered? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Daniel Straka wrote: >Ever since I added spamcop.net and SORBS-SPAM to my MailScanner.conf: >"Spam List = ORDB-RBL SBL+XBL spamcop.net SORBS-SPAM" >Mail marked with {Spam?} in the subject line by MS is being delivered. I >would like it deleted as it was before I made the Spam List change. >Where do I need modify MailScanner.conf to make this happen? > > Spam Actions = delete Or else if you don't want to do that, then set Spam Lists To Reach High Score = 1 High Scoring Spam Actions = delete - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQvzcahH2WUcUFbZUEQKA1ACeKz9LZgtLVUtXF08L2EURtMYwKJoAniyw xNsksKk6cof2oKN0+wn0U8QQ =3Omz -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Aug 12 18:34:34 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:34 2006 Subject: ClamAV SA upgrade. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Terran Wright wrote: >Guy's I know this has been asked already but I'm not seeing it in the >archives (maybe I need to search harder) but 2 quick questions. > >1. What's the procedure for upgrading ClamAV and SA using the package Julian >provides? > > Unpack the archive, cd into it and ./install.sh >2. How do I get rid of this from the logs: >"Unrar command /usr/bin/unrar does not exist or is not executable, please >either install it or remove the setting from MailScanner.conf" > > As it says, you can remove the setting with Unrar Command = in MailScanner.conf, or else install unrar. You can get RPMs of unrar from http://dag.wieers.com/packages/unrar/ Best solution is obviously to install unrar :-) Also, make sure you have Find Archives By Content = yes - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQvzdrBH2WUcUFbZUEQLDLQCfYN+s1GSbX342bmFrUIwOuHzqh3IAni+n aG/0Uthm2v81KmheZqTTwXPO =n3QL -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From wright at CYBERVALE.COM Fri Aug 12 17:39:41 2005 From: wright at CYBERVALE.COM (Terran Wright) Date: Thu Jan 12 21:30:34 2006 Subject: Mail with {Spam?} in Subject Being Delivered? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I would imagine that you need to change either Spam actions or High scoring spam actions to delete instead of deliver depending on whether it is marked as {Spam} because it is Spam or High Scoring Spam. ----- Original Message ----- From: "Daniel Straka" To: Sent: Friday, August 12, 2005 12:03 PM Subject: Mail with {Spam?} in Subject Being Delivered? > Ever since I added spamcop.net and SORBS-SPAM to my MailScanner.conf: > "Spam List = ORDB-RBL SBL+XBL spamcop.net SORBS-SPAM" > Mail marked with {Spam?} in the subject line by MS is being delivered. I > would like it deleted as it was before I made the Spam List change. > Where do I need modify MailScanner.conf to make this happen? > > Thanks List! > > Dan Straka > Casper College > (307)268-2399 > > ** Visit Casper College Online at www.caspercollege.edu ** > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dstraka at CASPERCOLLEGE.EDU Fri Aug 12 17:44:08 2005 From: dstraka at CASPERCOLLEGE.EDU (Daniel Straka) Date: Thu Jan 12 21:30:34 2006 Subject: Mail with {Spam?} in Subject Being Delivered? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Quoting Julian Field : > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Daniel Straka wrote: > > >Ever since I added spamcop.net and SORBS-SPAM to my > MailScanner.conf: > >"Spam List = ORDB-RBL SBL+XBL spamcop.net SORBS-SPAM" > >Mail marked with {Spam?} in the subject line by MS is being > delivered. I > >would like it deleted as it was before I made the Spam List change. > >Where do I need modify MailScanner.conf to make this happen? > > > > > Spam Actions = delete > > Or else if you don't want to do that, then set > Spam Lists To Reach High Score = 1 > High Scoring Spam Actions = delete Oddly enough the "Spam Actions = delete" has been set since I installed MS. For some reason it's no longer being honored. ** Visit Casper College Online at www.caspercollege.edu ** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Aug 12 19:16:33 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:34 2006 Subject: Mail with {Spam?} in Subject Being Delivered? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Daniel Straka wrote: >Quoting Julian Field : > > >>-----BEGIN PGP SIGNED MESSAGE----- >>Hash: SHA1 >> >>Daniel Straka wrote: >> >> >> >>>Ever since I added spamcop.net and SORBS-SPAM to my >>> >>> >>MailScanner.conf: >> >> >>>"Spam List = ORDB-RBL SBL+XBL spamcop.net SORBS-SPAM" >>>Mail marked with {Spam?} in the subject line by MS is being >>> >>> >>delivered. I >> >> >>>would like it deleted as it was before I made the Spam List change. >>>Where do I need modify MailScanner.conf to make this happen? >>> >>> >>> >>> >>Spam Actions = delete >> >>Or else if you don't want to do that, then set >>Spam Lists To Reach High Score = 1 >>High Scoring Spam Actions = delete >> >> > >Oddly enough the "Spam Actions = delete" has been set since I installed >MS. For some reason it's no longer being honored. > > But what about "Spam Lists To Reach High Score"? If your mail is hitting on 3 or more "Spam Lists" then it will be using the "High Scoring Spam Actions" and not the "Spam Actions". - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQvzngxH2WUcUFbZUEQLewACcCt5P5Blplu+k4JdmgHEjeuqcLZMAn2DM 3+nKJuxC0cbJzeQHmG2v1YV3 =fo3Q -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From gib at TMISNET.COM Sat Aug 13 00:48:12 2005 From: gib at TMISNET.COM (Gib Gilbertson Jr.) Date: Thu Jan 12 21:30:34 2006 Subject: MailScanner ANNOUNCE: Black shirts Message-ID: > >Black shirts are now available from > http://mailscanner.spreadshirt.net DARN.... And just after I ordered the book and a white shirt :( gib Gib Gilbertson Jr. Tierramiga Info Systems 619-287-8647 Support http://www.tmisnet.com San Diego's Friendly ISP ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From yossimor at HOTMAIL.COM Sat Aug 13 21:17:45 2005 From: yossimor at HOTMAIL.COM (Yossi Mor) Date: Thu Jan 12 21:30:34 2006 Subject: In hebrew emails mail scanner puts gibberish in the Subject line Message-ID: Hi forum, I am facing this problem with several companies that send emails where the subject line is in hebrew is jammed to gibrish(not all of them). I am using MailScanner version 4.38.10.1 that cause unicode translation problems because when the MailScanner service was stopped the problem did not reproduce. On other network enviroment with similar environment and same version of MailScanner (i.e mail relay in the dmz and application fw (Aladdin eSafe in the internal net) i did not have that issue at all. MailScanner was configured to work with spamassassin anti-spam and both clamav and mcafee ani-viruses. Are there other places where i can look for? Maybe adjust the character set to support un resolved unicode? Is it /etc/sysconfig/i18n issue? OS / Sendmail related issue? (MailScanner is installed on top of sendmail that comes with Fedora Core 3. Can the problem is due to spamassassin? since this module scan the subject line and i am using version 3.0.4 Can you please advice on recommended version of mailScanner to use? At the beginning, i have used advanced version of MAilScanner (10-44-1) and comment 'use bytes' statment in some configuration file as adviced from the MAilScanner project. but it did not work. Is there a way to configure MailScanner not to scan the 'Subject' line in the email? What are the risks? or to skip scanning messages that comes from trusted domains? Previous version of MailScanner that was installed on the specific enviroment was 4.24-5 and that was OK. Kindly regards, Yossi ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sun Aug 14 13:27:21 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:34 2006 Subject: In hebrew emails mail scanner puts gibberish in the Subject line Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Yossi Mor wrote: >Hi forum, > >I am facing this problem with several companies that send emails where the >subject line is in hebrew is jammed to gibrish(not all of them). > >I am using MailScanner version 4.38.10.1 that cause unicode translation >problems because when the MailScanner service was stopped the problem did >not reproduce. > >On other network enviroment with similar environment and same version of >MailScanner (i.e mail relay in the dmz and application fw (Aladdin eSafe >in the internal net) i did not have that issue at all. MailScanner was >configured to work with spamassassin anti-spam and both clamav and mcafee >ani-viruses. > >Are there other places where i can look for? Maybe adjust the character >set to support un resolved unicode? > >Is it /etc/sysconfig/i18n issue? > > Could well be. Are the files the same on working and not-working systems? >OS / Sendmail related issue? (MailScanner is installed on top of sendmail >that comes with Fedora Core 3. > > Should not be. >Can the problem is due to spamassassin? since this module scan the subject >line and i am using version 3.0.4 > > No. It is almost certainly my fault, but it is going to take a lot of work to find it. >Can you please advice on recommended version of mailScanner to use? At the >beginning, i have used advanced version of MAilScanner (10-44-1) and >comment 'use bytes' statment in some configuration file as adviced from >the MAilScanner project. but it did not work. > > Interesting. >Is there a way to configure MailScanner not to scan the 'Subject' line in >the email? What are the risks? or to skip scanning messages that comes >from trusted domains? > >Previous version of MailScanner that was installed on the specific >enviroment was 4.24-5 and that was OK. > > >Kindly regards, > >Yossi > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ds at CARIBENET.COM Sun Aug 14 18:57:20 2005 From: ds at CARIBENET.COM (Dirk Enrique Seiffert) Date: Thu Jan 12 21:30:34 2006 Subject: oom-killer - Spamassassin timeout? Message-ID: I run MailScanner 4.43.8-1 with spamassasin 3.0.4-1.1 on SUSE Linux 9.3 Profesional, kernel 2.6.11.4-21.8-smp. The machine is a Dual Xeon, Raid1, 2G Memory, moves about 20.000 mails per day. After working well for about 10 days the server runs out of Memory with a message like: Aug 4 16:17:34 mail kernel: Normal: 74*4kB 1059*8kB 1072*16kB 85*32kB 40*64kB 23*128kB 9*256kB 2*512kB 1*1024kB 1*2048kB 0* 4096kB = 40544kB Aug 4 16:17:34 mail kernel: HighMem: 50*4kB 3*8kB 2*16kB 0*32kB 0*64kB 0*128kB 0*256kB 1*512kB 0*1024kB 0*2048kB 0*4096kB = 768kB Aug 4 16:17:34 mail kernel: Swap cache: add 544992, delete 544786, find 4201134/4202803, race 0+10 Aug 4 16:17:34 mail kernel: Free swap = 0kB Aug 4 16:17:34 mail kernel: Total swap = 2104440kB Aug 4 16:17:34 mail kernel: Out of Memory: Killed process 21212 (MailScanner). This happened two times now, on both crash I could see "SpamAssassin timed out" in the maillogs. Any other users know these problems or even a solution? Best wishes Enrique -- Dirk Enrique Seiffert CaribeNet S.A. - Cartagena - Colombia www.caribenet.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sun Aug 14 19:16:59 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:34 2006 Subject: oom-killer - Spamassassin timeout? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Try reducing the "Restart Every" time. Dirk Enrique Seiffert wrote: >I run MailScanner 4.43.8-1 with spamassasin 3.0.4-1.1 on SUSE Linux 9.3 >Profesional, kernel 2.6.11.4-21.8-smp. The machine is a Dual Xeon, Raid1, 2G >Memory, moves about 20.000 mails per day. After working well for about 10 >days the server runs out of Memory with a message like: > >Aug 4 16:17:34 mail kernel: Normal: 74*4kB 1059*8kB 1072*16kB 85*32kB 40*64kB >23*128kB 9*256kB 2*512kB 1*1024kB 1*2048kB 0* >4096kB = 40544kB >Aug 4 16:17:34 mail kernel: HighMem: 50*4kB 3*8kB 2*16kB 0*32kB 0*64kB >0*128kB 0*256kB 1*512kB 0*1024kB 0*2048kB 0*4096kB = > 768kB >Aug 4 16:17:34 mail kernel: Swap cache: add 544992, delete 544786, find >4201134/4202803, race 0+10 >Aug 4 16:17:34 mail kernel: Free swap = 0kB >Aug 4 16:17:34 mail kernel: Total swap = 2104440kB >Aug 4 16:17:34 mail kernel: Out of Memory: Killed process 21212 >(MailScanner). > >This happened two times now, on both crash I could see "SpamAssassin timed >out" in the maillogs. > >Any other users know these problems or even a solution? > >Best wishes > >Enrique > > > > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From wubba at VIPERSHELLS.COM Sun Aug 14 20:14:45 2005 From: wubba at VIPERSHELLS.COM (Wubba) Date: Thu Jan 12 21:30:34 2006 Subject: oom-killer - Spamassassin timeout? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dirk Enrique Seiffert wrote: >I run MailScanner 4.43.8-1 with spamassasin 3.0.4-1.1 on SUSE Linux 9.3 >Profesional, kernel 2.6.11.4-21.8-smp. The machine is a Dual Xeon, Raid1, 2G >Memory, moves about 20.000 mails per day. After working well for about 10 >days the server runs out of Memory with a message like: > >Aug 4 16:17:34 mail kernel: Normal: 74*4kB 1059*8kB 1072*16kB 85*32kB 40*64kB >23*128kB 9*256kB 2*512kB 1*1024kB 1*2048kB 0* >4096kB = 40544kB >Aug 4 16:17:34 mail kernel: HighMem: 50*4kB 3*8kB 2*16kB 0*32kB 0*64kB >0*128kB 0*256kB 1*512kB 0*1024kB 0*2048kB 0*4096kB = > 768kB >Aug 4 16:17:34 mail kernel: Swap cache: add 544992, delete 544786, find >4201134/4202803, race 0+10 >Aug 4 16:17:34 mail kernel: Free swap = 0kB >Aug 4 16:17:34 mail kernel: Total swap = 2104440kB >Aug 4 16:17:34 mail kernel: Out of Memory: Killed process 21212 >(MailScanner). > >This happened two times now, on both crash I could see "SpamAssassin timed >out" in the maillogs. > >Any other users know these problems or even a solution? > >Best wishes > >Enrique > > > > > > I have seen that, Redhat 9 Turned out to be bad memory. HTH-- Brian @ wubba@Vipershells.com Content Scanning Via MailScanner/ClamAV/Spamassassin -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.2.6 (GNU/Linux) mIsEQvQHzAEEALpJ4nFPlNZgNk0e378VwHp0gSoaVkluT7o/X/wI0iq1ENkAjX0w 7RIFqxuKPLnU01Nn6qKQAFzUEYaaY5hFP0DiQgSFGlRpTMq+YwwOLeLrt+Y8OpeB KngL9ub4PhNb9NrzksUoVdIVUXxsEtz1X3pd7rGmJPTal6TH+tVlyGcdAAYptCJC cmlhbiBQYXVsIDx3dWJiYUBWaXBlclNoZWxscy5jb20+iLEEEwECABsFAkL0B8wG CwkIBwMCAxUCAwMWAgECHgECF4AACgkQb9DMCI78B08m3AP/dm0Gj9wajcgAIdPM k8j/Z/PVfKGsDIwdJ6KO+Rfql7Vqrf6KhWhZSDUNTfLJkOatEA7tdFbgffHtY6rP e9tepvmIdzSPonXpOB+M1KYSA7uyLtNr5bJZFUQ84LM/xTiCqAdk5CCmnNvqGwed es6YoGa7PHwJA8++pm8RjN9lm9o= =wL+/ -----END PGP PUBLIC KEY BLOCK----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From chardlist at CHARD.NET Mon Aug 15 03:56:15 2005 From: chardlist at CHARD.NET (chardlist) Date: Thu Jan 12 21:30:34 2006 Subject: Rule syntax question Message-ID: I have a simple rules file set up for low scoring spam. I would like to have a global rule for a domain that tells MailScanner to deliver low scoring spam, but want to specify a specific address within that domain where it is supposed to be deleted. Right now the rules file says (in this order): To: *@domain.com deliver To: address@domain.com delete To: default deliver But this does not appear to be working. Any advice is appreciated. Thank You, -Brendan ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Mon Aug 15 04:28:56 2005 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:30:34 2006 Subject: Rule syntax question Message-ID: MailScanner mailing list <> scribbled on Sunday, August 14, 2005 9:56 PM: > I have a simple rules file set up for low scoring spam. I > would like to have a global rule for a domain that tells > MailScanner to deliver low scoring spam, but want to specify > a specific address within that domain where it is supposed to > be deleted. > > Right now the rules file says (in this order): > > To: *@domain.com deliver > To: address@domain.com delete > To: default deliver > > But this does not appear to be working. > > Any advice is appreciated. > > Thank You, > -Brendan > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! Move To: address@domain.com delete up in your ruleset. Since the *@domain.com matches first, it stops processing there. Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pete at ENITECH.COM.AU Mon Aug 15 07:34:47 2005 From: pete at ENITECH.COM.AU (Pete Russell) Date: Thu Jan 12 21:30:34 2006 Subject: oom-killer - Spamassassin timeout? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] We had this for a long time, i have do a machine restart on one machine each day. We think its a kernel issue. The freq of event its certainly much much greater since we applied a custom kernel. Julian Field wrote: > Try reducing the "Restart Every" time. > > Dirk Enrique Seiffert wrote: > >> I run MailScanner 4.43.8-1 with spamassasin 3.0.4-1.1 on SUSE Linux >> 9.3 Profesional, kernel 2.6.11.4-21.8-smp. The machine is a Dual Xeon, >> Raid1, 2G Memory, moves about 20.000 mails per day. After working well >> for about 10 days the server runs out of Memory with a message like: >> >> Aug 4 16:17:34 mail kernel: Normal: 74*4kB 1059*8kB 1072*16kB 85*32kB >> 40*64kB 23*128kB 9*256kB 2*512kB 1*1024kB 1*2048kB 0* >> 4096kB = 40544kB >> Aug 4 16:17:34 mail kernel: HighMem: 50*4kB 3*8kB 2*16kB 0*32kB >> 0*64kB 0*128kB 0*256kB 1*512kB 0*1024kB 0*2048kB 0*4096kB = >> 768kB >> Aug 4 16:17:34 mail kernel: Swap cache: add 544992, delete 544786, >> find 4201134/4202803, race 0+10 >> Aug 4 16:17:34 mail kernel: Free swap = 0kB >> Aug 4 16:17:34 mail kernel: Total swap = 2104440kB >> Aug 4 16:17:34 mail kernel: Out of Memory: Killed process 21212 >> (MailScanner). >> >> This happened two times now, on both crash I could see "SpamAssassin >> timed out" in the maillogs. >> Any other users know these problems or even a solution? >> >> Best wishes >> >> Enrique >> >> >> >> >> >> > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Mon Aug 15 14:39:34 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:34 2006 Subject: In hebrew emails mail scanner puts gibberish in the Subject line Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Yossi Mor wrote: >Hi forum, > >I am facing this problem with several companies that send emails where the >subject line is in hebrew is jammed to gibrish(not all of them). > > Yossi, We have no problem here with sendmail and subject lines containing accented characters (but not Hebrew). All Subject lines should not contain any 8-bit or UTF-8 character. All those characters should be converted into "normal" characters, usually using QP (Quoted Printable) by the MUA, but some don't do it. Our sendmail config does not accept 8-bit characters in headers and translates them into "X". Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From vlad at MAZEK.COM Mon Aug 15 15:27:40 2005 From: vlad at MAZEK.COM (Vlad Mazek) Date: Thu Jan 12 21:30:34 2006 Subject: oom-killer - Spamassassin timeout? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] We had a similar issues and it turned out to be running out of handles.. Try this: ulimit -n 4096 service MailScanner start That solved it for us, even though it was saying that there was a memory issue bumping up the limit helped. -Vlad Pete Russell wrote: > We had this for a long time, i have do a machine restart on one > machine each day. We think its a kernel issue. The freq of event its > certainly much much greater since we applied a custom kernel. > > > Julian Field wrote: > >> Try reducing the "Restart Every" time. >> >> Dirk Enrique Seiffert wrote: >> >>> I run MailScanner 4.43.8-1 with spamassasin 3.0.4-1.1 on SUSE Linux >>> 9.3 Profesional, kernel 2.6.11.4-21.8-smp. The machine is a Dual >>> Xeon, Raid1, 2G Memory, moves about 20.000 mails per day. After >>> working well for about 10 days the server runs out of Memory with a >>> message like: >>> >>> Aug 4 16:17:34 mail kernel: Normal: 74*4kB 1059*8kB 1072*16kB >>> 85*32kB 40*64kB 23*128kB 9*256kB 2*512kB 1*1024kB 1*2048kB 0* >>> 4096kB = 40544kB >>> Aug 4 16:17:34 mail kernel: HighMem: 50*4kB 3*8kB 2*16kB 0*32kB >>> 0*64kB 0*128kB 0*256kB 1*512kB 0*1024kB 0*2048kB 0*4096kB = >>> 768kB >>> Aug 4 16:17:34 mail kernel: Swap cache: add 544992, delete 544786, >>> find 4201134/4202803, race 0+10 >>> Aug 4 16:17:34 mail kernel: Free swap = 0kB >>> Aug 4 16:17:34 mail kernel: Total swap = 2104440kB >>> Aug 4 16:17:34 mail kernel: Out of Memory: Killed process 21212 >>> (MailScanner). >>> >>> This happened two times now, on both crash I could see "SpamAssassin >>> timed out" in the maillogs. >>> Any other users know these problems or even a solution? >>> >>> Best wishes >>> >>> Enrique >>> >>> >>> >>> >>> >>> >> > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Mon Aug 15 15:43:40 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:34 2006 Subject: Disarmed messages... Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian, I started tagging disarmed content with: # If HTML tags in the message were "disarmed" by using the HTML "Allow" # options above with the "disarm" settings, do you want to modify the # subject line? # This can also be the filename of a ruleset. Disarmed Modify Subject = yes I was wondering what is triggering this? Are all of the following doing it? Allow IFrame Tags = disarm Allow Form Tags = disarm Allow Script Tags = disarm Allow WebBugs = disarm Allow Object Codebase Tags = disarm Thanks! Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From jkf at ecs.soton.ac.uk Mon Aug 15 17:04:47 2005 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:34 2006 Subject: Disarmed messages... Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 15 Aug 2005, at 15:43, Denis Beauchemin wrote: > * PGP Bad Signature, Signed by a unverified key > Julian, > > I started tagging disarmed content with: > # If HTML tags in the message were "disarmed" by using the HTML > "Allow" > # options above with the "disarm" settings, do you want to modify the > # subject line? > # This can also be the filename of a ruleset. > Disarmed Modify Subject = yes > > I was wondering what is triggering this? Are all of the following > doing it? > Allow IFrame Tags = disarm > Allow Form Tags = disarm > Allow Script Tags = disarm > Allow WebBugs = disarm > Allow Object Codebase Tags = disarm Correct, yes. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwC9IRH2WUcUFbZUEQLf/ACeLEgURjl//89ilwefXLZj8RrFPagAoJkS gg6hcrV/FAEvcWKLGXsnjK1k =XcrP -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ds at CARIBENET.COM Mon Aug 15 22:15:01 2005 From: ds at CARIBENET.COM (Dirk Enrique Seiffert) Date: Thu Jan 12 21:30:34 2006 Subject: oom-killer - Spamassassin timeout? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] El Dom 14 Ago 2005 13:16, Julian Field escribió: > Try reducing the "Restart Every" time. Researching the logs for suspicious processes I found on both crashes a MailScanner process "kernel: Out of Memory: Killed process 2121 (MailScanner)." In the first crash the process had been running for about 4 hours, in the second crash it was about 12 hours. I changed "Restart Every" to hourly restarts. (Usually I restart every 24 hours without having problems.) As this is a brand new machine and I have two more installations with same O/S and application versions running without any problems, I would like to get a better idea of the reason for these crashes. Other posters on this thread asign this problem to bad memory or a kernel bug? Searching the net I find some posts on Spamassassin consuming memory. Anyhow I can see that the machine stays fine for about one week, then it starts slightly to swap out. And very fast and sudden it crashes with the OoM-killer, killing a MailScanner process first. (As this is only a mailserver its not a big suprise that MailScanner ist the first one to die, there is not much more running.) Cahnging the value in "Restart Every" hopefully helps, but isn't it a workaround for other problems? Thanks for your opinion Enrique > > Dirk Enrique Seiffert wrote: > >I run MailScanner 4.43.8-1 with spamassasin 3.0.4-1.1 on SUSE Linux 9.3 > >Profesional, kernel 2.6.11.4-21.8-smp. The machine is a Dual Xeon, Raid1, > > 2G Memory, moves about 20.000 mails per day. After working well for about > > 10 days the server runs out of Memory with a message like: > > > >Aug 4 16:17:34 mail kernel: Normal: 74*4kB 1059*8kB 1072*16kB 85*32kB -- Dirk Enrique Seiffert CaribeNet S.A. - Cartagena - Colombia www.caribenet.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Tue Aug 16 03:15:09 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:34 2006 Subject: In hebrew emails mail scanner puts gibberish in the Subject line Message-ID: How do you do this in Sendmail, exactly? I've got a client who constantly emails me saying "someguy@somewhere.com's mail scanning program bounced my mail, why?" and the bounce always says something about violating RFC's by using unquoted accented characters in the subject line. If I could get sendmail to sanitize the subject lines at least it would get rid of the bounces. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Tue Aug 16 04:39:04 2005 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:30:34 2006 Subject: mailscanner site down again? Message-ID: MailScanner mailing list <> scribbled on Monday, August 15, 2005 10:13 PM: > Hi all, > > I tried to download the latest version of mailscanner and > again the site is sort of down. I tried doing an upgrade a > month back with same problem. I am concern that maybe > mailscanner site is under some sort of attack? Or perhaps the > site is too busy? > > Thanks. > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! Works fine for me here ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kfliong at WOFS.COM Tue Aug 16 04:52:38 2005 From: kfliong at WOFS.COM (kfliong) Date: Thu Jan 12 21:30:34 2006 Subject: mailscanner site down again? Message-ID: Ah...works fine now... But still, I find it quite odd for the site to be perform intermittently...perhaps time to change webhost? At 11:39 AM 8/16/2005, you wrote: >MailScanner mailing list <> scribbled on Monday, August 15, 2005 10:13 PM: > > > Hi all, > > > > I tried to download the latest version of mailscanner and > > again the site is sort of down. I tried doing an upgrade a > > month back with same problem. I am concern that maybe > > mailscanner site is under some sort of attack? Or perhaps the > > site is too busy? > > > > Thanks. > > > > ------------------------ MailScanner list > > ------------------------ To unsubscribe, email > > jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) > > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > >Works fine for me here > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > > > >-- >No virus found in this incoming message. >Checked by AVG Anti-Virus. >Version: 7.0.338 / Virus Database: 267.10.10/73 - Release Date: 8/15/2005 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Tue Aug 16 04:58:26 2005 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:30:34 2006 Subject: mailscanner site down again? Message-ID: MailScanner mailing list <> scribbled on Monday, August 15, 2005 10:53 PM: > Ah...works fine now... > > But still, I find it quite odd for the site to be perform > intermittently...perhaps time to change webhost? > How do you know it wasn't a problem with your ISP or any point between? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kfliong at WOFS.COM Tue Aug 16 05:14:15 2005 From: kfliong at WOFS.COM (kfliong) Date: Thu Jan 12 21:30:34 2006 Subject: RBL in mailscanner and spamassassin Message-ID: Hi, As most of us are already using RBL at MTA level, do we still need to use RBL in mailscanner and spamassassin? I think not as this would waste time doing triple RBL check. So, we need to turn off RBL in both mailscanner and spamassassin. In Mailscanner.conf, I set Spam List = to disable RBL. Then in spam.assassin.prefs.conf, I have skip_rbl_checks 1 This will skip RBL checking on both mailscanner and spamassassin. So now my question is, would SURBL be turned off if I put that statement above on spamassassin? Because I want to leave SURBL on as it can filter some more RBLs that my MTA level RBL can't detect. Thanks in advance. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kfliong at WOFS.COM Tue Aug 16 05:16:52 2005 From: kfliong at WOFS.COM (kfliong) Date: Thu Jan 12 21:30:34 2006 Subject: mailscanner site down again? Message-ID: Because I tried using wget from my webserver located in texas and also from my office ADSL connection located in Malaysia and both could not download the files. Both is geographically located on each corner of the world. Both site having connection problem to mailscanner.info at the same time? What do you think of the odds? At 11:58 AM 8/16/2005, you wrote: >MailScanner mailing list <> scribbled on Monday, August 15, 2005 10:53 PM: > > > Ah...works fine now... > > > > But still, I find it quite odd for the site to be perform > > intermittently...perhaps time to change webhost? > > > > >How do you know it wasn't a problem with your ISP or any point between? > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > > > >-- >No virus found in this incoming message. >Checked by AVG Anti-Virus. >Version: 7.0.338 / Virus Database: 267.10.10/73 - Release Date: 8/15/2005 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michael at MICHAELSHILOH.COM Tue Aug 16 07:27:52 2005 From: michael at MICHAELSHILOH.COM (Michael Shiloh) Date: Thu Jan 12 21:30:34 2006 Subject: how to pre-process forwarded mail for sa-learn Message-ID: Hello, I'm using mailscanner+spamassassin+postfix on a gentoo system and have been very happy with it. It is time to train it further on the spam that slips through. I read my email with pine, and I save all my spam in a mailbox called "spam". I use mbox format, and I simply run sa-learn against my spam mailbox. Other people at my site read email on their windows machines using pop and Microsoft Outlook, so it's a little harder to run their email into sa-learn. I've searched the archives and the web at large, and I have found scripts that will remove forwarding headers, so that I can set up a mailbox for spam and have my windows users forward their missed spam to the appropriate mailbox which will then by filtered and processed by sa-learn. The trouble is, all the scripts I've found are proclaimed (by the authors) to be hacks and don't seem to really work well. It would seem to me that what I am trying to do must be very common, and I am suprised that there aren't better tools for doing this. This leads me to believe that either my approach is wrong, or I am unable to find the answer. So my question is this: How can I best collect the missed spam from my Windows users, and train spamassassin on it? Is there a formal procedure, or is the state of the art really the hacked scripts that I find on the web? At the very least, can someone point me to a good example of such a script? Sincerely, Michael ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHT.IE Tue Aug 16 08:21:43 2005 From: michele at BLACKNIGHT.IE (Michele Neylon) Date: Thu Jan 12 21:30:34 2006 Subject: mailscanner site down again? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] kfliong wrote: > Because I tried using wget from my webserver located in texas and also > from my office ADSL connection located in Malaysia and both could not > download the files. Both is geographically located on each corner of the > world. Both site having connection problem to mailscanner.info at the > same time? What do you think of the odds? Possible. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Tue Aug 16 08:23:59 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:34 2006 Subject: RBL in mailscanner and spamassassin Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] kfliong wrote: > Hi, > > As most of us are already using RBL at MTA level, do we still need to > use RBL in mailscanner and spamassassin? I think not as this would waste > time doing triple RBL check. > > So, we need to turn off RBL in both mailscanner and spamassassin. > > In Mailscanner.conf, I set > > Spam List = > > to disable RBL. > > Then in spam.assassin.prefs.conf, I have > > skip_rbl_checks 1 > > This will skip RBL checking on both mailscanner and spamassassin. So now > my question is, would SURBL be turned off if I put that statement above > on spamassassin? Because I want to leave SURBL on as it can filter some > more RBLs that my MTA level RBL can't detect. > > Thanks in advance. > > ------------------------ MailScanner list ------------------------ I use the RBL's in Spamassassin as I find it less prone to FP's. Julian's recent changes so MS can be told how many of it's RBL checks should be triggered before MS treats it as SPAM helps alot against FP if you are doing ther RBL checks in MS. As to doing it in the MTA , I prefer not to do this here for the same reason, but instead only allow valid email addresses in, this drops overs 66% of my traffic with no FPs. NB: FP = False Positives. Something I care about alot as the previous solution to MS we had was very FP heavy! -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kevins at BMRB.CO.UK Tue Aug 16 08:29:10 2005 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:30:34 2006 Subject: mailscanner site down again? Message-ID: On Tue, 2005-08-16 at 12:16 +0800, kfliong wrote: > Because I tried using wget from my webserver located in texas and also from > my office ADSL connection located in Malaysia and both could not download > the files. Both is geographically located on each corner of the world. Both > site having connection problem to mailscanner.info at the same time? What > do you think of the odds? Geographic dispersion is not the only factor, Are these different ISP's? Even if they are different ISP's they could still be peering with the same (broken) upstream provider, maybe several peers upstream. Or the web server was down ;) ================================================================= BMRB http://www.bmrb.co.uk _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 16 08:48:45 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:34 2006 Subject: mailscanner site down again? Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 16 Aug 2005, at 08:21, Michele Neylon wrote: > kfliong wrote: > >> Because I tried using wget from my webserver located in texas and >> also from my office ADSL connection located in Malaysia and both >> could not download the files. Both is geographically located on >> each corner of the world. Both site having connection problem to >> mailscanner.info at the same time? What do you think of the odds? >> > > Possible. Next time you see it down please do a traceroute to it, rather than just wget. There are a lot of bits of network in common between Malaysia/Texas to our site. We have a 10Gb net connection, so it sure isn't too much traffic :-) - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwGaYhH2WUcUFbZUEQLfTQCgogzqBVEPufFyktxp9TgXUhZhDIoAmgLL j0Z5pgjPY+7oPZ+SEIK7chGf =Mr4r -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 16 08:55:16 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:34 2006 Subject: In hebrew emails mail scanner puts gibberish in the Subject line Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Does anyone have accurate knowledge of: What was the last version that worked properly? What was the first version that changed Subject: to ######## ? Without this, I can't find the problem. On 16 Aug 2005, at 03:15, Alex Neuman van der Hans wrote: > How do you do this in Sendmail, exactly? I've got a client who > constantly > emails me saying "someguy@somewhere.com's mail scanning program > bounced my > mail, why?" and the bounce always says something about violating > RFC's by > using unquoted accented characters in the subject line. If I could get > sendmail to sanitize the subject lines at least it would get rid of > the > bounces. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA+AwUBQwGb6BH2WUcUFbZUEQIHAACYnmJfiIR7XbDtIwTXahI3cQTnBwCdG+rd o7eP4yJJVzvu+YjxmH9OZ0I= =o1Yn -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Tue Aug 16 09:44:58 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:30:34 2006 Subject: how to pre-process forwarded mail for sa-learn Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Tue, August 16, 2005 07:27, Michael Shiloh wrote: > Hello, Hi > So my question is this: How can I best collect the missed spam from my > Windows users, and train spamassassin on it? Is there a formal > procedure, or is the state of the art really the hacked scripts that I > find on the web? At the very least, can someone point me to a good > example of such a script? Try here http://wiki.apache.org/spamassassin/SiteWideBayesFeedback and more interestingly the last link on the page for the Postfix option. Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Tue Aug 16 14:48:13 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:34 2006 Subject: In hebrew emails mail scanner puts gibberish in the Subject line Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Alex Neuman van der Hans wrote: >How do you do this in Sendmail, exactly? I've got a client who constantly >emails me saying "someguy@somewhere.com's mail scanning program bounced my >mail, why?" and the bounce always says something about violating RFC's by >using unquoted accented characters in the subject line. If I could get >sendmail to sanitize the subject lines at least it would get rid of the >bounces. > > Alex, I've looked for close to 1 hour at the bat book (sendmail from O'Reilly) and couldn't find the setup I mentioned. I saw ways to force 8bit to 7bit conversion in emails, but nothing specific to headers. I finally asked another admin here and he told me it wasn't sendmail that did the trick but Cyrus mail that either replaces 8bit characters in subjects with X, or either rejects the email altogether. This may be what you are looking at: some admin that believes it is better to reject an email with 8bit characters in the subject line than to "sanitize" it... Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From glenn.steen at GMAIL.COM Tue Aug 16 15:11:26 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:34 2006 Subject: oom-killer - Spamassassin timeout? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 15/08/05, Dirk Enrique Seiffert wrote: > El Dom 14 Ago 2005 13:16, Julian Field escribió: > > Try reducing the "Restart Every" time. > > Researching the logs for suspicious processes I found on both crashes a > MailScanner process "kernel: Out of Memory: Killed process 2121 > (MailScanner)." In the first crash the process had been running for about 4 > hours, in the second crash it was about 12 hours. I changed "Restart Every" > to hourly restarts. (Usually I restart every 24 hours without having > problems.) > > As this is a brand new machine and I have two more installations with same O/S > and application versions running without any problems, I would like to get a > better idea of the reason for these crashes. Other posters on this thread > asign this problem to bad memory or a kernel bug? Searching the net I find > some posts on Spamassassin consuming memory. Anyhow I can see that the > machine stays fine for about one week, then it starts slightly to swap out. > And very fast and sudden it crashes with the OoM-killer, killing a > MailScanner process first. (As this is only a mailserver its not a big > suprise that MailScanner ist the first one to die, there is not much more > running.) > > Cahnging the value in "Restart Every" hopefully helps, but isn't it a > workaround for other problems? > > Thanks for your opinion > > Enrique > "Brand new" can still mean "not fully operational":-)... I find memtest86 to be a very nice tool when it comes to situations like this, where you suspect dodgy memory... Get it at: http://www.memtest86.com/#download0 -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard.gray at DNS.CO.UK Tue Aug 16 15:35:32 2005 From: richard.gray at DNS.CO.UK (Gray, Richard) Date: Thu Jan 12 21:30:34 2006 Subject: The book Message-ID: Is there a UK source for the book? R ________________________________________________________________________________ richard gray dns ltd 83 princes street, edinburgh, eh2 2er t: +44 (0) 870 085 8555 f: +44 (0) 870 085 8556 m: +44 (0) 777 569 2145 w: http://www.dns.co.uk/ This email from dns has been validated by dnsMSSTM Managed Email Security and is free from all known viruses. For further information contact email-integrity@dns.co.uk ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 16 16:16:05 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:34 2006 Subject: The book Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] No. You can only buy it from the USA, but www.mailscanner.info will place the order direct with the publishers, you just have to pay the shipping costs.If you order it from a bookshop in the UK, it will cost you more as I have to order it, and I charge the bookshop for my shipping costs (both from the USA and then to the bookshop) and they want their profit margin too. So cheapest and fastest is to order it from www.mailscanner.info. On 16 Aug 2005, at 15:35, Gray, Richard wrote: Is there a UK source for the book?   R   ________________________________________________________________________________ richard gray dns ltd   83 princes street, edinburgh, eh2 2er   t:      +44 (0) 870 085 8555  f:      +44 (0) 870 085 8556 m:    +44 (0) 777 569 2145 w:     http://www.dns.co.uk/   ________________________________________________________________________________ This email from dns has been validated by dnsMSSTM Managed Email Security and is free from all known viruses. For further information contact email-integrity@dns.co.uk ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! --  Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Application/PGP-SIGNATURE 202bytes. ] [ Unable to print this part. ] From michael at MICHAELSHILOH.COM Tue Aug 16 17:24:25 2005 From: michael at MICHAELSHILOH.COM (Michael Shiloh) Date: Thu Jan 12 21:30:34 2006 Subject: how to pre-process forwarded mail for sa-learn Message-ID: Thanks Drew, That looks perfect. I will study it in detail tonight and implement it. Michael On Tue, 16 Aug 2005, Drew Marshall wrote: > On Tue, August 16, 2005 07:27, Michael Shiloh wrote: >> Hello, > Hi > >> So my question is this: How can I best collect the missed spam from my >> Windows users, and train spamassassin on it? Is there a formal >> procedure, or is the state of the art really the hacked scripts that I >> find on the web? At the very least, can someone point me to a good >> example of such a script? > > Try here http://wiki.apache.org/spamassassin/SiteWideBayesFeedback and > more interestingly the last link on the page for the Postfix option. > > Drew > > > -- > In line with our policy, this message has > been scanned for viruses and dangerous > content by MailScanner, and is believed to be clean. > www.themarshalls.co.uk/policy > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Tue Aug 16 17:40:43 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:30:34 2006 Subject: how to pre-process forwarded mail for sa-learn Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Tue, August 16, 2005 17:24, Michael Shiloh wrote: > Thanks Drew, > > That looks perfect. I will study it in detail tonight and implement it. > > Michael No worries. Gotchas to watch out for are file permissions for the bayes files and the user that runs the script (You will need to consider who Postfix will pipe the mail to the script as. It won't do it as the Postfix user, nor root). The other one to watch is file locking with MailScanner. HTH Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Tue Aug 16 18:52:30 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:30:34 2006 Subject: how to pre-process forwarded mail for sa-learn Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Michael Shiloh wrote: \ > > So my question is this: How can I best collect the missed spam from my > Windows users, and train spamassassin on it? Is there a formal > procedure, or is the state of the art really the hacked scripts that I > find on the web? At the very least, can someone point me to a good > example of such a script? > Recovering a message that has been forwarded in the normal way is impossible. The whole message will be re-encoded, body text added, headers removed, etc. As far as sa-learn is concerned, half the message has been completely replaced by new content. For example, a spammer sends you a multipart/alternative message with a text/plain and a text/html. When you forward that message, only the text/html is likely to be used. Although the client might generate a new text/plain based on the HTML part, this isn't always the same as the original. In particular spammers often insert "book quotes" in the text/plain section and have a porn-site ad in the HTML section. Also, all the original headers from the message will be gone and will be replaced by new headers. The subject gets copied, but the Received: headers, the Message-ID, Return-Path and other important headers are toast. The only thing you can do is use a "redirect" "bounce" or "forward as attachment" feature of the mail client. Those all require some pre-processing, but at least all the information you need is present. Generally speaking, the forward as attachment is easiest to deal with, you just need to have a script rip off the attachment and feed that to sa-learn. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ebruce at HPMICH.COM Tue Aug 16 19:34:14 2005 From: ebruce at HPMICH.COM (Ed Bruce) Date: Thu Jan 12 21:30:34 2006 Subject: how to pre-process forwarded mail for sa-learn Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Michael Shiloh wrote: > > So my question is this: How can I best collect the missed spam from my > Windows users, and train spamassassin on it? Is there a formal > procedure, or is the state of the art really the hacked scripts that I > find on the web? At the very least, can someone point me to a good > example of such a script? I'm using MailScanner on a Linux box and recently installed MailWatch. I reconfigured MS to save a copy of every message for a couple of weeks. I just have the users forward a copy of the spam email to a spam email account. I can then search for that message using MailWatch and then submit the original to the sa-learn. I find it much easier then trying to teach Outlook users how to resend a message so the original info is preserved. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cstone at AXINT.NET Tue Aug 16 20:32:47 2005 From: cstone at AXINT.NET (Chris Stone) Date: Thu Jan 12 21:30:34 2006 Subject: mailscanner site down again? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Monday 15 August 2005 09:13 pm, kfliong wrote: > I tried to download the latest version of mailscanner and again the site is > sort of down. I tried doing an upgrade a month back with same problem. I am > concern that maybe mailscanner site is under some sort of attack? Or > perhaps the site is too busy? Been having problems from here (Denver, CO, USA) for the last couple of days also. Can ping the site www.mailscanner.info (which is a CNAME for augur.ecs.soton.ac.uk - 152.78.68.160), but can't bring the site up. Chris ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Tue Aug 16 20:22:00 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:34 2006 Subject: In hebrew emails mail scanner puts gibberish in the Subject line Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I'd rather sanitize... So I guess I'll have to look and see if any milters do this. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Denis Beauchemin Sent: Tuesday, August 16, 2005 8:48 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: In hebrew emails mail scanner puts gibberish in the Subject line Alex Neuman van der Hans wrote: >How do you do this in Sendmail, exactly? I've got a client who >constantly emails me saying "someguy@somewhere.com's mail scanning >program bounced my mail, why?" and the bounce always says something >about violating RFC's by using unquoted accented characters in the >subject line. If I could get sendmail to sanitize the subject lines at >least it would get rid of the bounces. > > Alex, I've looked for close to 1 hour at the bat book (sendmail from O'Reilly) and couldn't find the setup I mentioned. I saw ways to force 8bit to 7bit conversion in emails, but nothing specific to headers. I finally asked another admin here and he told me it wasn't sendmail that did the trick but Cyrus mail that either replaces 8bit characters in subjects with X, or either rejects the email altogether. This may be what you are looking at: some admin that believes it is better to reject an email with 8bit characters in the subject line than to "sanitize" it... Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Tue Aug 16 20:56:46 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:34 2006 Subject: mailscanner site down again? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Chris Stone spake the following on 8/16/2005 12:37 PM: > On Tuesday 16 August 2005 01:48 am, Julian Field wrote: > >>On 16 Aug 2005, at 08:21, Michele Neylon wrote: >> >>>kfliong wrote: >>> >>>>Because I tried using wget from my webserver located in texas and >>>>also from my office ADSL connection located in Malaysia and both >>>>could not download the files. Both is geographically located on >>>>each corner of the world. Both site having connection problem to >>>>mailscanner.info at the same time? What do you think of the odds? >> >>Next time you see it down please do a traceroute to it, rather than >>just wget. There are a lot of bits of network in common between >>Malaysia/Texas to our site. > > > I can't get there now from Denver, CO - here's a traceroute (note that pings > do work): > > root@cs:/home/cstone/Downloads # traceroute www.mailscanner.info > traceroute to augur.ecs.soton.ac.uk (152.78.68.160), 30 hops max, 38 byte > packets > 1 10.10.1.254 (10.10.1.254) 0.769 ms 0.408 ms 0.382 ms > 2 ai-core.axint.net (38.116.133.1) 0.881 ms 0.756 ms 0.631 ms > 3 f0-2.na01.b009854-0.den01.atlas.cogentco.com (38.112.6.145) 1.140 ms > 1.159 ms 1.023 ms > 4 g9-3.core01.den01.atlas.cogentco.com (66.250.10.221) 1.372 ms 1.257 ms > 1.165 ms > 5 p5-0.core01.mci01.atlas.cogentco.com (66.28.4.30) 32.999 ms 23.535 ms > 23.878 ms > 6 p6-0.core01.stl02.atlas.cogentco.com (154.54.3.70) 30.073 ms 23.435 ms > 23.377 ms > 7 p6-0.core01.ord01.atlas.cogentco.com (154.54.3.65) 23.911 ms 23.706 ms > 24.490 ms > 8 p15-0.core02.ord01.atlas.cogentco.com (66.28.4.62) 23.666 ms 23.361 ms > 24.029 ms > 9 p15-0.core01.ord01.atlas.cogentco.com (66.28.4.61) 25.224 ms 23.752 ms > 24.640 ms > 10 p14-0.core01.bos01.atlas.cogentco.com (66.28.4.109) 44.321 ms 45.032 ms > 44.630 ms > 11 p3-0.core01.lon02.atlas.cogentco.com (130.117.0.45) 115.045 ms 115.776 > ms 114.991 ms > 12 linx-gw1.ja.net (195.66.224.15) 115.099 ms 115.027 ms 114.933 ms > 13 po2-1.lond-scr4.ja.net (146.97.35.241) 115.193 ms 114.845 ms 114.919 ms > 14 po0-0.lond-scr.ja.net (146.97.33.33) 171.551 ms 115.486 ms 115.117 ms > 15 po2-0.cosh-scr.ja.net (146.97.33.42) 117.534 ms 117.423 ms 117.239 ms > 16 po0-0.cosham-bar.ja.net (146.97.35.22) 117.159 ms 117.132 ms 119.090 ms > 17 146.97.40.2 (146.97.40.2) 117.762 ms 117.141 ms 119.594 ms > 18 * * * > My traceroute hangs at the next hop after 146.97.40.2, then goes on. Now if someone could figure out who's router that is... -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Tue Aug 16 20:51:34 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:34 2006 Subject: mailscanner site down again? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Chris Stone wrote: >On Tuesday 16 August 2005 01:48 am, Julian Field wrote: > > >>On 16 Aug 2005, at 08:21, Michele Neylon wrote: >> >> >>>kfliong wrote: >>> >>> >>>>Because I tried using wget from my webserver located in texas and >>>>also from my office ADSL connection located in Malaysia and both >>>>could not download the files. Both is geographically located on >>>>each corner of the world. Both site having connection problem to >>>>mailscanner.info at the same time? What do you think of the odds? >>>> >>>> >>Next time you see it down please do a traceroute to it, rather than >>just wget. There are a lot of bits of network in common between >>Malaysia/Texas to our site. >> >> > >I can't get there now from Denver, CO - here's a traceroute (note that pings >do work): > >root@cs:/home/cstone/Downloads # traceroute www.mailscanner.info >traceroute to augur.ecs.soton.ac.uk (152.78.68.160), 30 hops max, 38 byte >packets > 1 10.10.1.254 (10.10.1.254) 0.769 ms 0.408 ms 0.382 ms > 2 ai-core.axint.net (38.116.133.1) 0.881 ms 0.756 ms 0.631 ms > 3 f0-2.na01.b009854-0.den01.atlas.cogentco.com (38.112.6.145) 1.140 ms >1.159 ms 1.023 ms > 4 g9-3.core01.den01.atlas.cogentco.com (66.250.10.221) 1.372 ms 1.257 ms >1.165 ms > 5 p5-0.core01.mci01.atlas.cogentco.com (66.28.4.30) 32.999 ms 23.535 ms >23.878 ms > 6 p6-0.core01.stl02.atlas.cogentco.com (154.54.3.70) 30.073 ms 23.435 ms >23.377 ms > 7 p6-0.core01.ord01.atlas.cogentco.com (154.54.3.65) 23.911 ms 23.706 ms >24.490 ms > 8 p15-0.core02.ord01.atlas.cogentco.com (66.28.4.62) 23.666 ms 23.361 ms >24.029 ms > 9 p15-0.core01.ord01.atlas.cogentco.com (66.28.4.61) 25.224 ms 23.752 ms >24.640 ms >10 p14-0.core01.bos01.atlas.cogentco.com (66.28.4.109) 44.321 ms 45.032 ms >44.630 ms >11 p3-0.core01.lon02.atlas.cogentco.com (130.117.0.45) 115.045 ms 115.776 >ms 114.991 ms >12 linx-gw1.ja.net (195.66.224.15) 115.099 ms 115.027 ms 114.933 ms >13 po2-1.lond-scr4.ja.net (146.97.35.241) 115.193 ms 114.845 ms 114.919 ms >14 po0-0.lond-scr.ja.net (146.97.33.33) 171.551 ms 115.486 ms 115.117 ms >15 po2-0.cosh-scr.ja.net (146.97.33.42) 117.534 ms 117.423 ms 117.239 ms >16 po0-0.cosham-bar.ja.net (146.97.35.22) 117.159 ms 117.132 ms 119.090 ms >17 146.97.40.2 (146.97.40.2) 117.762 ms 117.141 ms 119.594 ms >18 * * * > > > Works OK from Canada: traceroute www.mailscanner.info traceroute to augur.ecs.soton.ac.uk (152.78.68.160), 30 hops max, 38 byte packets 1 132.210.8.121 (132.210.8.121) 1.443 ms 1.131 ms 0.548 ms 2 B4-0106-6500A.telecom.USherbrooke.ca (132.210.9.1) 0.903 ms 0.771 ms 0.732 ms 3 132.210.4.17 (132.210.4.17) 0.940 ms 0.898 ms 1.740 ms 4 132.210.4.2 (132.210.4.2) 2.112 ms 2.043 ms 1.407 ms 5 usherb-intrarisq.dshbk-us.risq.net (132.202.40.157) 1.049 ms 0.975 ms 0.939 ms 6 c4-tierA-new.risq.net (132.202.80.46) 4.358 ms 4.132 ms 4.487 ms 7 c4-tierA-new.risq.net (132.202.80.46) 4.038 ms 4.302 ms 4.263 ms 8 c4-mon01.canet4.net (205.189.32.226) 4.577 ms 4.738 ms 4.417 ms 9 canarie.ny1.ny.geant.net (62.40.103.193) 17.503 ms 17.889 ms 17.636 ms 10 ny.uk1.uk.geant.net (62.40.96.170) 130.311 ms 86.553 ms 85.795 ms 11 janet-gw.uk1.uk.geant.net (62.40.103.150) 86.134 ms 85.933 ms 86.340 ms 12 po2-3.lond-scr3.ja.net (146.97.35.69) 85.831 ms 86.516 ms 86.308 ms 13 po1-0.lond-scr.ja.net (146.97.33.29) 86.489 ms 86.385 ms 86.505 ms 14 po2-0.cosh-scr.ja.net (146.97.33.42) 88.185 ms 88.241 ms 88.246 ms 15 po0-0.cosham-bar.ja.net (146.97.35.22) 88.374 ms 88.822 ms 88.369 ms 16 146.97.40.2 (146.97.40.2) 88.033 ms 88.595 ms 88.822 ms 17 * * * 18 212.219.151.121 (212.219.151.121) 89.853 ms 89.425 ms 89.130 ms MPLS Label=81 CoS=6 TTL=1 S=0 19 212.219.151.122 (212.219.151.122) 89.965 ms 90.095 ms 89.611 ms 20 212.219.151.114 (212.219.151.114) 90.686 ms 96.887 ms 90.513 ms 21 b54hafw1-ga2.net.soton.ac.uk (152.78.0.19) 90.467 ms 91.701 ms 91.310 ms 22 b54gagesw1-fwint.net.soton.ac.uk (152.78.109.14) 92.395 ms 92.326 ms 91.852 ms 23 b54aagesw1-ga.net.soton.ac.uk (152.78.108.61) 105.300 ms 93.743 ms 94.204 ms 24 augur.ecs.soton.ac.uk (152.78.68.160) 149.536 ms 140.766 ms 141.398 ms Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cstone at AXINT.NET Tue Aug 16 20:37:23 2005 From: cstone at AXINT.NET (Chris Stone) Date: Thu Jan 12 21:30:34 2006 Subject: mailscanner site down again? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Tuesday 16 August 2005 01:48 am, Julian Field wrote: > On 16 Aug 2005, at 08:21, Michele Neylon wrote: > > kfliong wrote: > >> Because I tried using wget from my webserver located in texas and > >> also from my office ADSL connection located in Malaysia and both > >> could not download the files. Both is geographically located on > >> each corner of the world. Both site having connection problem to > >> mailscanner.info at the same time? What do you think of the odds? > > Next time you see it down please do a traceroute to it, rather than > just wget. There are a lot of bits of network in common between > Malaysia/Texas to our site. I can't get there now from Denver, CO - here's a traceroute (note that pings do work): root@cs:/home/cstone/Downloads # traceroute www.mailscanner.info traceroute to augur.ecs.soton.ac.uk (152.78.68.160), 30 hops max, 38 byte packets 1 10.10.1.254 (10.10.1.254) 0.769 ms 0.408 ms 0.382 ms 2 ai-core.axint.net (38.116.133.1) 0.881 ms 0.756 ms 0.631 ms 3 f0-2.na01.b009854-0.den01.atlas.cogentco.com (38.112.6.145) 1.140 ms 1.159 ms 1.023 ms 4 g9-3.core01.den01.atlas.cogentco.com (66.250.10.221) 1.372 ms 1.257 ms 1.165 ms 5 p5-0.core01.mci01.atlas.cogentco.com (66.28.4.30) 32.999 ms 23.535 ms 23.878 ms 6 p6-0.core01.stl02.atlas.cogentco.com (154.54.3.70) 30.073 ms 23.435 ms 23.377 ms 7 p6-0.core01.ord01.atlas.cogentco.com (154.54.3.65) 23.911 ms 23.706 ms 24.490 ms 8 p15-0.core02.ord01.atlas.cogentco.com (66.28.4.62) 23.666 ms 23.361 ms 24.029 ms 9 p15-0.core01.ord01.atlas.cogentco.com (66.28.4.61) 25.224 ms 23.752 ms 24.640 ms 10 p14-0.core01.bos01.atlas.cogentco.com (66.28.4.109) 44.321 ms 45.032 ms 44.630 ms 11 p3-0.core01.lon02.atlas.cogentco.com (130.117.0.45) 115.045 ms 115.776 ms 114.991 ms 12 linx-gw1.ja.net (195.66.224.15) 115.099 ms 115.027 ms 114.933 ms 13 po2-1.lond-scr4.ja.net (146.97.35.241) 115.193 ms 114.845 ms 114.919 ms 14 po0-0.lond-scr.ja.net (146.97.33.33) 171.551 ms 115.486 ms 115.117 ms 15 po2-0.cosh-scr.ja.net (146.97.33.42) 117.534 ms 117.423 ms 117.239 ms 16 po0-0.cosham-bar.ja.net (146.97.35.22) 117.159 ms 117.132 ms 119.090 ms 17 146.97.40.2 (146.97.40.2) 117.762 ms 117.141 ms 119.594 ms 18 * * * ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cstone at AXINT.NET Tue Aug 16 22:03:04 2005 From: cstone at AXINT.NET (Chris Stone) Date: Thu Jan 12 21:30:35 2006 Subject: mailscanner site down again? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Tuesday 16 August 2005 01:56 pm, Scott Silva wrote: > > 9 p15-0.core01.ord01.atlas.cogentco.com (66.28.4.61) 25.224 ms 23.752 > > ms 24.640 ms > > 10 p14-0.core01.bos01.atlas.cogentco.com (66.28.4.109) 44.321 ms > > 45.032 ms 44.630 ms > > 11 p3-0.core01.lon02.atlas.cogentco.com (130.117.0.45) 115.045 ms > > 115.776 ms 114.991 ms > > 12 linx-gw1.ja.net (195.66.224.15) 115.099 ms 115.027 ms 114.933 ms > > 13 po2-1.lond-scr4.ja.net (146.97.35.241) 115.193 ms 114.845 ms > > 114.919 ms 14 po0-0.lond-scr.ja.net (146.97.33.33) 171.551 ms 115.486 > > ms 115.117 ms 15 po2-0.cosh-scr.ja.net (146.97.33.42) 117.534 ms > > 117.423 ms 117.239 ms 16 po0-0.cosham-bar.ja.net (146.97.35.22) > > 117.159 ms 117.132 ms 119.090 ms 17 146.97.40.2 (146.97.40.2) 117.762 > > ms 117.141 ms 119.594 ms 18 * * * > > My traceroute hangs at the next hop after 146.97.40.2, then goes on. > Now if someone could figure out who's router that is... Mine is still hanging there but does now continue afterwards, with +300ms times on average.... Chris ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Tue Aug 16 22:17:54 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:30:35 2006 Subject: mailscanner site down again? Message-ID: On 16 Aug 2005, at 20:56, Scott Silva wrote: >> I can't get there now from Denver, CO - here's a traceroute (note >> that pings >> do work): >> >> root@cs:/home/cstone/Downloads # traceroute www.mailscanner.info >> traceroute to augur.ecs.soton.ac.uk (152.78.68.160), 30 hops max, >> 38 byte >> packets >> 1 10.10.1.254 (10.10.1.254) 0.769 ms 0.408 ms 0.382 ms >> 2 ai-core.axint.net (38.116.133.1) 0.881 ms 0.756 ms 0.631 ms >> 3 f0-2.na01.b009854-0.den01.atlas.cogentco.com (38.112.6.145) >> 1.140 ms >> 1.159 ms 1.023 ms >> 4 g9-3.core01.den01.atlas.cogentco.com (66.250.10.221) 1.372 >> ms 1.257 ms >> 1.165 ms >> 5 p5-0.core01.mci01.atlas.cogentco.com (66.28.4.30) 32.999 ms >> 23.535 ms >> 23.878 ms >> 6 p6-0.core01.stl02.atlas.cogentco.com (154.54.3.70) 30.073 ms >> 23.435 ms >> 23.377 ms >> 7 p6-0.core01.ord01.atlas.cogentco.com (154.54.3.65) 23.911 ms >> 23.706 ms >> 24.490 ms >> 8 p15-0.core02.ord01.atlas.cogentco.com (66.28.4.62) 23.666 ms >> 23.361 ms >> 24.029 ms >> 9 p15-0.core01.ord01.atlas.cogentco.com (66.28.4.61) 25.224 ms >> 23.752 ms >> 24.640 ms >> 10 p14-0.core01.bos01.atlas.cogentco.com (66.28.4.109) 44.321 >> ms 45.032 ms >> 44.630 ms >> 11 p3-0.core01.lon02.atlas.cogentco.com (130.117.0.45) 115.045 >> ms 115.776 >> ms 114.991 ms >> 12 linx-gw1.ja.net (195.66.224.15) 115.099 ms 115.027 ms >> 114.933 ms >> 13 po2-1.lond-scr4.ja.net (146.97.35.241) 115.193 ms 114.845 >> ms 114.919 ms >> 14 po0-0.lond-scr.ja.net (146.97.33.33) 171.551 ms 115.486 ms >> 115.117 ms >> 15 po2-0.cosh-scr.ja.net (146.97.33.42) 117.534 ms 117.423 ms >> 117.239 ms >> 16 po0-0.cosham-bar.ja.net (146.97.35.22) 117.159 ms 117.132 >> ms 119.090 ms >> 17 146.97.40.2 (146.97.40.2) 117.762 ms 117.141 ms 119.594 ms >> 18 * * * >> >> > My traceroute hangs at the next hop after 146.97.40.2, then goes on. > Now if someone could figure out who's router that is... That's a JANET router (According to the RIPE database) From the UK traceroute to augur.ecs.soton.ac.uk (152.78.68.160), 64 hops max, 60 byte packets 1 lo0-plusnet.ptn-ag1.plus.net (195.166.128.123) 17.806 ms 16.876 ms 28.864 ms 2 lo0-plusnet.ptn-ag1.plus.net (195.166.128.123) 16.241 ms 17.924 ms 24.774 ms 3 ge0-0-0-103.ptn-gw1.plus.net (84.92.3.17) 15.649 ms 17.011 ms 16.635 ms 4 gi1-1-22.pte-gw5.plus.net (212.159.4.7) 15.625 ms 16.312 ms 21.039 ms 5 linx-gw1.ja.net (195.66.224.15) 15.154 ms 16.566 ms 21.040 ms 6 po2-1.lond-scr4.ja.net (146.97.35.241) 16.357 ms 15.788 ms 15.586 ms 7 po0-0.lond-scr.ja.net (146.97.33.33) 24.658 ms 15.669 ms 16.298 ms 8 po2-0.cosh-scr.ja.net (146.97.33.42) 28.366 ms 51.688 ms 39.708 ms 9 po0-0.cosham-bar.ja.net (146.97.35.22) 19.999 ms 18.156 ms 17.760 ms 10 146.97.40.2 (146.97.40.2) 17.774 ms 28.150 ms 18.200 ms 11 * * * 12 212.219.151.121 (212.219.151.121) 21.597 ms 22.602 ms 22.196 ms 13 212.219.151.122 (212.219.151.122) 20.574 ms 20.138 ms 23.501 ms 14 212.219.151.114 (212.219.151.114) 29.344 ms 21.901 ms 22.315 ms 15 b54hafw1-ga2.net.soton.ac.uk (152.78.0.19) 23.043 ms 21.474 ms 24.649 ms 16 b54gagesw1-fwint.net.soton.ac.uk (152.78.109.14) 23.632 ms 22.532 ms 22.388 ms 17 b54aagesw1-ga.net.soton.ac.uk (152.78.108.61) 29.266 ms 24.441 ms 22.886 ms 18 152.78.108.1 (152.78.108.1) 25.443 ms 22.535 ms 24.410 ms 19 * * * 20 augur.ecs.soton.ac.uk (152.78.68.160) 28.535 ms 24.346 ms 25.509 ms It works but there a few routers who don't like ICMP and the site loads fine. Sorry, doesn't really help :-( Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jgg at GIVERSEN.NET Tue Aug 16 22:44:53 2005 From: jgg at GIVERSEN.NET (J[ISO-8859-1] řrgen Giversen) Date: Thu Jan 12 21:30:35 2006 Subject: Exim acting odd Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dear all This evening our mail sever started to write this in the messages log Aug 16 21:39:44 mail-web exim: Process did not exit cleanly, returned 13 with signal 0 ........ Aug 16 23:00:09 mail-web exim: Process did not exit cleanly, returned 13 with signal 0 Aug 16 23:00:20 mail-web exim: Process did not exit cleanly, returned 13 with signal 0 Aug 16 23:00:31 mail-web exim: Process did not exit cleanly, returned 13 with signal 0 Aug 16 23:01:09 mail-web exim: Process did not exit cleanly, returned 13 with signal 0 and it continues In /tmp it genereates a lot of empty folders named tnef.5595 tnef.5614 tnef.5655 tnef.5675 ....... owned by exim any ideas whats going on OS: RHEL4 MTA: exim 4.43 Mailscanner: 4.44.6-2 spamassassin: 3.0.4-1 Best regards Jřrgen Giversen ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Tue Aug 16 23:11:51 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:35 2006 Subject: Exim acting odd Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jřrgen Giversen spake the following on 8/16/2005 2:44 PM: > Dear all > This evening our mail sever started to write this in the messages log > Aug 16 21:39:44 mail-web exim: Process did not exit cleanly, returned 13 > with signal 0 > ........ > Aug 16 23:00:09 mail-web exim: Process did not exit cleanly, returned 13 > with signal 0 > Aug 16 23:00:20 mail-web exim: Process did not exit cleanly, returned 13 > with signal 0 > Aug 16 23:00:31 mail-web exim: Process did not exit cleanly, returned 13 > with signal 0 > Aug 16 23:01:09 mail-web exim: Process did not exit cleanly, returned 13 > with signal 0 > and it continues > In /tmp it genereates a lot of empty folders named > tnef.5595 > tnef.5614 > tnef.5655 > tnef.5675 > ....... > owned by exim > any ideas whats going on > > OS: RHEL4 > MTA: exim 4.43 > Mailscanner: 4.44.6-2 > spamassassin: 3.0.4-1 > > Best regards > Jřrgen Giversen > Sounds like it is choking on expanding the tnef encoded attachment of some mail. If you look at the incomming queue at the oldest file there, it might be what it is choking on. You could try the other tnef decoder from the one you currently use (internal vs the binary). -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve.swaney at fsl.com Wed Aug 17 01:50:47 2005 From: steve.swaney at fsl.com (Stephen Swaney) Date: Thu Jan 12 21:30:35 2006 Subject: mailscanner site down again? Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Denis Beauchemin > Sent: Tuesday, August 16, 2005 3:52 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: mailscanner site down again? > > Chris Stone wrote: > > >On Tuesday 16 August 2005 01:48 am, Julian Field wrote: > > > > > >>On 16 Aug 2005, at 08:21, Michele Neylon wrote: > >> > >> > >>>kfliong wrote: > >>> > >>> > >>>>Because I tried using wget from my webserver located in texas and > >>>>also from my office ADSL connection located in Malaysia and both > >>>>could not download the files. Both is geographically located on > >>>>each corner of the world. Both site having connection problem to > >>>>mailscanner.info at the same time? What do you think of the odds? > >>>> > >>>> > >>Next time you see it down please do a traceroute to it, rather than > >>just wget. There are a lot of bits of network in common between > >>Malaysia/Texas to our site. > >> > >> > > > >I can't get there now from Denver, CO - here's a traceroute (note that > pings > >do work): > > > >root@cs:/home/cstone/Downloads # traceroute www.mailscanner.info > >traceroute to augur.ecs.soton.ac.uk (152.78.68.160), 30 hops max, 38 byte > >packets > > 1 10.10.1.254 (10.10.1.254) 0.769 ms 0.408 ms 0.382 ms > > 2 ai-core.axint.net (38.116.133.1) 0.881 ms 0.756 ms 0.631 ms > > 3 f0-2.na01.b009854-0.den01.atlas.cogentco.com (38.112.6.145) 1.140 ms > >1.159 ms 1.023 ms > > 4 g9-3.core01.den01.atlas.cogentco.com (66.250.10.221) 1.372 ms 1.257 > ms > >1.165 ms > > 5 p5-0.core01.mci01.atlas.cogentco.com (66.28.4.30) 32.999 ms 23.535 > ms > >23.878 ms > > 6 p6-0.core01.stl02.atlas.cogentco.com (154.54.3.70) 30.073 ms 23.435 > ms > >23.377 ms > > 7 p6-0.core01.ord01.atlas.cogentco.com (154.54.3.65) 23.911 ms 23.706 > ms > >24.490 ms > > 8 p15-0.core02.ord01.atlas.cogentco.com (66.28.4.62) 23.666 ms 23.361 > ms > >24.029 ms > > 9 p15-0.core01.ord01.atlas.cogentco.com (66.28.4.61) 25.224 ms 23.752 > ms > >24.640 ms > >10 p14-0.core01.bos01.atlas.cogentco.com (66.28.4.109) 44.321 ms > 45.032 ms > >44.630 ms > >11 p3-0.core01.lon02.atlas.cogentco.com (130.117.0.45) 115.045 ms > 115.776 > >ms 114.991 ms > >12 linx-gw1.ja.net (195.66.224.15) 115.099 ms 115.027 ms 114.933 ms > >13 po2-1.lond-scr4.ja.net (146.97.35.241) 115.193 ms 114.845 ms > 114.919 ms > >14 po0-0.lond-scr.ja.net (146.97.33.33) 171.551 ms 115.486 ms 115.117 > ms > >15 po2-0.cosh-scr.ja.net (146.97.33.42) 117.534 ms 117.423 ms 117.239 > ms > >16 po0-0.cosham-bar.ja.net (146.97.35.22) 117.159 ms 117.132 ms > 119.090 ms > >17 146.97.40.2 (146.97.40.2) 117.762 ms 117.141 ms 119.594 ms > >18 * * * > > > > > > > Works OK from Canada: > traceroute www.mailscanner.info > traceroute to augur.ecs.soton.ac.uk (152.78.68.160), 30 hops max, 38 > byte packets > 1 132.210.8.121 (132.210.8.121) 1.443 ms 1.131 ms 0.548 ms > 2 B4-0106-6500A.telecom.USherbrooke.ca (132.210.9.1) 0.903 ms 0.771 > ms 0.732 ms > 3 132.210.4.17 (132.210.4.17) 0.940 ms 0.898 ms 1.740 ms > 4 132.210.4.2 (132.210.4.2) 2.112 ms 2.043 ms 1.407 ms > 5 usherb-intrarisq.dshbk-us.risq.net (132.202.40.157) 1.049 ms 0.975 > ms 0.939 ms > 6 c4-tierA-new.risq.net (132.202.80.46) 4.358 ms 4.132 ms 4.487 ms > 7 c4-tierA-new.risq.net (132.202.80.46) 4.038 ms 4.302 ms 4.263 ms > 8 c4-mon01.canet4.net (205.189.32.226) 4.577 ms 4.738 ms 4.417 ms > 9 canarie.ny1.ny.geant.net (62.40.103.193) 17.503 ms 17.889 ms > 17.636 ms > 10 ny.uk1.uk.geant.net (62.40.96.170) 130.311 ms 86.553 ms 85.795 ms > 11 janet-gw.uk1.uk.geant.net (62.40.103.150) 86.134 ms 85.933 ms > 86.340 ms > 12 po2-3.lond-scr3.ja.net (146.97.35.69) 85.831 ms 86.516 ms 86.308 ms > 13 po1-0.lond-scr.ja.net (146.97.33.29) 86.489 ms 86.385 ms 86.505 ms > 14 po2-0.cosh-scr.ja.net (146.97.33.42) 88.185 ms 88.241 ms 88.246 ms > 15 po0-0.cosham-bar.ja.net (146.97.35.22) 88.374 ms 88.822 ms 88.369 > ms > 16 146.97.40.2 (146.97.40.2) 88.033 ms 88.595 ms 88.822 ms > 17 * * * > 18 212.219.151.121 (212.219.151.121) 89.853 ms 89.425 ms 89.130 ms > MPLS Label=81 CoS=6 TTL=1 S=0 > 19 212.219.151.122 (212.219.151.122) 89.965 ms 90.095 ms 89.611 ms > 20 212.219.151.114 (212.219.151.114) 90.686 ms 96.887 ms 90.513 ms > 21 b54hafw1-ga2.net.soton.ac.uk (152.78.0.19) 90.467 ms 91.701 ms > 91.310 ms > 22 b54gagesw1-fwint.net.soton.ac.uk (152.78.109.14) 92.395 ms 92.326 > ms 91.852 ms > 23 b54aagesw1-ga.net.soton.ac.uk (152.78.108.61) 105.300 ms 93.743 > ms 94.204 ms > 24 augur.ecs.soton.ac.uk (152.78.68.160) 149.536 ms 140.766 ms > 141.398 ms > > Denis Don't blame the MailScanner site! #$^&#$*&*$!!! I just got through two hours of watching routes go up and down from various places on the Internet to our DNS servers :( At times it looked like our DNS servers were down (twern't) or our mail was broken (twasn't). Our servers were fine; they were just hard to get to at times. The ISP at one of our DNS server locations was even having intermittent problems routing within their own data center! It looks like all is settling down now but I have to say - today was not a good day on the Internet. "Tomorrow is another day" Steve Stephen Swaney Fort Systems Ltd. stephen.swaney@fsl.com www.fsl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From hden at KCBBS.GEN.NZ Wed Aug 17 02:22:17 2005 From: hden at KCBBS.GEN.NZ (Hendrik den Hartog) Date: Thu Jan 12 21:30:35 2006 Subject: Location Sophos IDEs Message-ID: Hello Just updated the Sophos Virus Engine on our Linux Server, and noted that the 'blurb' mentioned a new location (/usr/local/sophos/lib) as oppossed to the 'old' location /usr/local/sophos/ide. Which location does mailscanner use? If it's changed, do what else do we need to check? change? Any help, pointers to Docs or correcting my understanding appreciated. Cheers! Hendrik ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From evanderleun at HAL9000.NL Wed Aug 17 07:47:50 2005 From: evanderleun at HAL9000.NL (Erik van der Leun) Date: Thu Jan 12 21:30:35 2006 Subject: Location Sophos IDEs Message-ID: *nod* I've noticed the same thing... in /usr/local/Sophos/ide now symlinks are created to ../lib/*.vdb... Kind regards, Erik van der Leun On Wed, 17 Aug 2005, Hendrik den Hartog wrote: > Hello > > Just updated the Sophos Virus Engine on our Linux Server, and noted that > the 'blurb' mentioned a new location (/usr/local/sophos/lib) as oppossed > to the 'old' location /usr/local/sophos/ide. > > Which location does mailscanner use? If it's changed, do what else do > we need to check? change? > > Any help, pointers to Docs or correcting my understanding appreciated. > > Cheers! > Hendrik > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Aug 17 08:57:15 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:35 2006 Subject: Location Sophos IDEs Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 As long as you install it with Sophos.install then you will be fine. I made this change for the vdb files a long time ago. On 17 Aug 2005, at 07:47, Erik van der Leun wrote: > *nod* I've noticed the same thing... > in /usr/local/Sophos/ide now symlinks are created to ../lib/*.vdb... > > Kind regards, > Erik van der Leun > > On Wed, 17 Aug 2005, Hendrik den Hartog wrote: > > >> Hello >> >> Just updated the Sophos Virus Engine on our Linux Server, and >> noted that >> the 'blurb' mentioned a new location (/usr/local/sophos/lib) as >> oppossed >> to the 'old' location /usr/local/sophos/ide. >> >> Which location does mailscanner use? If it's changed, do what else do >> we need to check? change? >> >> Any help, pointers to Docs or correcting my understanding >> appreciated. >> >> Cheers! >> Hendrik >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwLt4xH2WUcUFbZUEQKVQACffFKW8CxY/2WicAybd8Igc6xS/PcAoMtK 5twI5+GQ1gWJ7hSIJuQ/PUJY =Tg8z -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marks at BIT.NL Wed Aug 17 15:08:30 2005 From: marks at BIT.NL (Mark Schouten) Date: Thu Jan 12 21:30:35 2006 Subject: Various Nod32 packages, which one should be used? Message-ID: Hi all, I am asked to test a (for us) new virusscanner, nod32. I saw that MailScanner has a default wrapper, but I am doubting that I have the correct Nod32-package. There are two different version that are possible: NOD32 for Linux File Server (Debian) NOD32 for Linux Mail Server (Debian) Now, I have the last one. But my guess is that I need the first one, since the times that I saw nod32 on the mailscanner-site, it was the command 'nod32'. That is also the command that's defined in the wrapper. The closest thing I have is nod32cli which connects to the nod32d, but nod32cli doesn't accept the cmd-line arguments that MailScanner feeds.. So, can anyone clearify this for me? :) thanks! -- Mark Schouten BIT BV ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "This is a digitally signed message part" ] [ Application/PGP-SIGNATURE 196bytes. ] [ Unable to print this part. ] From yossimor at HOTMAIL.COM Wed Aug 17 16:06:31 2005 From: yossimor at HOTMAIL.COM (Yossi Mor) Date: Thu Jan 12 21:30:35 2006 Subject: In hebrew emails mail scanner puts gibberish in the Subject line Message-ID: Hi, In our company i am using mailscanner version 4.32.5-1. However i am not sure that the cahnge has started from this point. Is there a way to config sendmail to try and fix the problem? Regards. Yossi ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Wed Aug 17 19:36:44 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:35 2006 Subject: New virus intercepted Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello All, Last night we received many hundreds EXE files infected by Backdoor.Win32.Dumador.dk, according to Kaspersky. No other virus scanner I have detected anything suspicious: McAfee, Bitdefender and ClamAV all said there was nothing wrong in the files. All files seem to be the same length (26112 bytes) and came from many different IPs. They all have strange names (looks like random characters) ending in .exe. I'm glad I don't let EXE/BAT/PIF/... files through! Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From hden at KCBBS.GEN.NZ Wed Aug 17 20:23:03 2005 From: hden at KCBBS.GEN.NZ (Hendrik den Hartog) Date: Thu Jan 12 21:30:35 2006 Subject: Location Sophos IDEs Message-ID: Can I just get some clarification here [sorry not a techo, am a teacher]... Should there be a symbolic link in the sophos folder to the ide folder? or is the link created someway else? (Just want to make sure it's in place) Cheers! Hendrik On Wed, Aug 17, 2005 at 08:57:15AM +0100, Julian Field wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > As long as you install it with Sophos.install then you will be fine. > I made this change for the vdb files a long time ago. > > On 17 Aug 2005, at 07:47, Erik van der Leun wrote: > > > *nod* I've noticed the same thing... > > in /usr/local/Sophos/ide now symlinks are created to ../lib/*.vdb... > > > > Kind regards, > > Erik van der Leun > > > > On Wed, 17 Aug 2005, Hendrik den Hartog wrote: > > > > > >> Hello > >> > >> Just updated the Sophos Virus Engine on our Linux Server, and > >> noted that > >> the 'blurb' mentioned a new location (/usr/local/sophos/lib) as > >> oppossed > >> to the 'old' location /usr/local/sophos/ide. > >> > >> Which location does mailscanner use? If it's changed, do what else do > >> we need to check? change? > >> > >> Any help, pointers to Docs or correcting my understanding > >> appreciated. > >> > >> Cheers! > >> Hendrik > >> > >> ------------------------ MailScanner list ------------------------ > >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >> 'leave mailscanner' in the body of the email. > >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >> Support MailScanner development - buy the book off the website! > >> > >> > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > - -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > -----BEGIN PGP SIGNATURE----- > Version: PGP Desktop 9.0.2 (Build 2425) > > iQA/AwUBQwLt4xH2WUcUFbZUEQKVQACffFKW8CxY/2WicAybd8Igc6xS/PcAoMtK > 5twI5+GQ1gWJ7hSIJuQ/PUJY > =Tg8z > -----END PGP SIGNATURE----- > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Aug 17 20:29:29 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:35 2006 Subject: Location Sophos IDEs Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 It should look like this: (from /usr/local/Sophos) [root@lapwing Sophos]# ls -al total 28 drwxr-xr-x 6 root root 4096 Aug 17 20:10 . drwxr-xr-x 15 root root 4096 Jul 22 11:24 .. drwxr-xr-x 2 root root 4096 Aug 17 20:10 396.200508172010 drwxr-xr-x 2 root root 4096 Jul 30 14:43 bin lrwxrwxrwx 1 root root 34 Aug 17 20:10 ide -> /usr/local/Sophos/396.200508172010 drwxr-xr-x 2 root root 4096 Jul 30 14:43 lib drwxr-xr-x 11 root root 4096 Jun 30 15:23 man and the 396.200508172010 directory contains this lot: 396_ides.zip *.ide lrwxrwxrwx 1 root root 16 Aug 17 20:10 svext.dat -> ../lib/svext.dat lrwxrwxrwx 1 root root 18 Aug 17 20:10 swpmess.dat -> ../lib/swpmess.dat lrwxrwxrwx 1 root root 16 Aug 17 20:10 vdl01.vdb -> ../lib/vdl01.vdb lrwxrwxrwx 1 root root 16 Aug 17 20:10 vdl02.vdb -> ../lib/vdl02.vdb lrwxrwxrwx 1 root root 16 Aug 17 20:10 vdl03.vdb -> ../lib/vdl03.vdb lrwxrwxrwx 1 root root 16 Aug 17 20:10 vdl04.vdb -> ../lib/vdl04.vdb lrwxrwxrwx 1 root root 16 Aug 17 20:10 vdl05.vdb -> ../lib/vdl05.vdb lrwxrwxrwx 1 root root 16 Aug 17 20:10 vdl06.vdb -> ../lib/vdl06.vdb lrwxrwxrwx 1 root root 16 Aug 17 20:10 vdl07.vdb -> ../lib/vdl07.vdb lrwxrwxrwx 1 root root 16 Aug 17 20:10 vdl08.vdb -> ../lib/vdl08.vdb lrwxrwxrwx 1 root root 16 Aug 17 20:10 vdl09.vdb -> ../lib/vdl09.vdb lrwxrwxrwx 1 root root 16 Aug 17 20:10 vdl10.vdb -> ../lib/vdl10.vdb lrwxrwxrwx 1 root root 16 Aug 17 20:10 vdl11.vdb -> ../lib/vdl11.vdb lrwxrwxrwx 1 root root 16 Aug 17 20:10 vdl12.vdb -> ../lib/vdl12.vdb lrwxrwxrwx 1 root root 16 Aug 17 20:10 vdl13.vdb -> ../lib/vdl13.vdb lrwxrwxrwx 1 root root 16 Aug 17 20:10 vdl14.vdb -> ../lib/vdl14.vdb lrwxrwxrwx 1 root root 16 Aug 17 20:10 vdl15.vdb -> ../lib/vdl15.vdb lrwxrwxrwx 1 root root 16 Aug 17 20:10 vdl16.vdb -> ../lib/vdl16.vdb lrwxrwxrwx 1 root root 16 Aug 17 20:10 vdl17.vdb -> ../lib/vdl17.vdb lrwxrwxrwx 1 root root 16 Aug 17 20:10 vdl18.vdb -> ../lib/vdl18.vdb lrwxrwxrwx 1 root root 16 Aug 17 20:10 vdl19.vdb -> ../lib/vdl19.vdb lrwxrwxrwx 1 root root 19 Aug 17 20:10 vdl.dat -> ../lib/vdl-3.96.dat And /usr/local/Sophos/lib contains: - -rwxr-xr-x 1 root root 28415 Jul 30 14:43 eminstall.sh lrwxrwxrwx 1 root root 12 Jul 30 14:43 libsavi.so -> libsavi.so.3 lrwxrwxrwx 1 root root 21 Jul 30 14:43 libsavi.so.2 -> libsavi.so.3.2.07.107 lrwxrwxrwx 1 root root 21 Jul 30 14:43 libsavi.so.3 -> libsavi.so.3.2.07.107 - -r-xr-xr-x 1 root bin 1662844 Jun 30 15:23 libsavi.so.3.2.07.102 - -r-xr-xr-x 1 bin bin 1664028 Jul 30 14:43 libsavi.so.3.2.07.107 - -rw-r--r-- 1 bin bin 15 Jul 30 14:43 svext.dat - -rw-r--r-- 1 root root 115045 Jul 30 14:43 swpmess.dat - -rw-r--r-- 1 bin bin 443637 Jul 30 14:43 vdl01.vdb - -rw-r--r-- 1 bin bin 401446 Jul 30 14:43 vdl02.vdb - -rw-r--r-- 1 bin bin 389383 Jul 30 14:43 vdl03.vdb - -rw-r--r-- 1 bin bin 418961 Jul 30 14:43 vdl04.vdb - -rw-r--r-- 1 bin bin 431331 Jul 30 14:43 vdl05.vdb - -rw-r--r-- 1 bin bin 340521 Jul 30 14:43 vdl06.vdb - -rw-r--r-- 1 bin bin 309387 Jul 30 14:43 vdl07.vdb - -rw-r--r-- 1 bin bin 269374 Jul 30 14:43 vdl08.vdb - -rw-r--r-- 1 bin bin 221208 Jul 30 14:43 vdl09.vdb - -rw-r--r-- 1 bin bin 268018 Jul 30 14:43 vdl10.vdb - -rw-r--r-- 1 bin bin 291710 Jul 30 14:43 vdl11.vdb - -rw-r--r-- 1 bin bin 363250 Jul 30 14:43 vdl12.vdb - -rw-r--r-- 1 bin bin 351298 Jul 30 14:43 vdl13.vdb - -rw-r--r-- 1 bin bin 361046 Jul 30 14:43 vdl14.vdb - -rw-r--r-- 1 bin bin 392477 Jul 30 14:43 vdl15.vdb - -rw-r--r-- 1 bin bin 465987 Jul 30 14:43 vdl16.vdb - -rw-r--r-- 1 bin bin 411387 Jul 30 14:43 vdl17.vdb - -rw-r--r-- 1 bin bin 370567 Jul 30 14:43 vdl18.vdb - -rw-r--r-- 1 bin bin 371938 Jul 30 14:43 vdl19.vdb - -rw-r--r-- 1 bin bin 455680 Jul 30 14:43 vdl-3.96.dat lrwxrwxrwx 1 root root 12 Jul 30 14:43 vdl.dat -> vdl-3.96.dat Hendrik den Hartog wrote: >Can I just get some clarification here [sorry not a techo, >am a teacher]... >Should there be a symbolic link in the sophos folder to the ide >folder? or is the link created someway else? > >(Just want to make sure it's in place) > >Cheers! >Hendrik > > >On Wed, Aug 17, 2005 at 08:57:15AM +0100, Julian Field wrote: > > >>-----BEGIN PGP SIGNED MESSAGE----- >>Hash: SHA1 >> >>As long as you install it with Sophos.install then you will be fine. >>I made this change for the vdb files a long time ago. >> >>On 17 Aug 2005, at 07:47, Erik van der Leun wrote: >> >> >> >>>*nod* I've noticed the same thing... >>>in /usr/local/Sophos/ide now symlinks are created to ../lib/*.vdb... >>> >>>Kind regards, >>>Erik van der Leun >>> >>>On Wed, 17 Aug 2005, Hendrik den Hartog wrote: >>> >>> >>> >>> >>>>Hello >>>> >>>>Just updated the Sophos Virus Engine on our Linux Server, and >>>>noted that >>>>the 'blurb' mentioned a new location (/usr/local/sophos/lib) as >>>>oppossed >>>>to the 'old' location /usr/local/sophos/ide. >>>> >>>>Which location does mailscanner use? If it's changed, do what else do >>>>we need to check? change? >>>> >>>>Any help, pointers to Docs or correcting my understanding >>>>appreciated. >>>> >>>>Cheers! >>>>Hendrik >>>> >>>>------------------------ MailScanner list ------------------------ >>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>'leave mailscanner' in the body of the email. >>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>>Support MailScanner development - buy the book off the website! >>>> >>>> >>>> >>>> >>>------------------------ MailScanner list ------------------------ >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >>> >>> >>> >>- -- >>Julian Field >>www.MailScanner.info >>Buy the MailScanner book at www.MailScanner.info/store >>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> >>-----BEGIN PGP SIGNATURE----- >>Version: PGP Desktop 9.0.2 (Build 2425) >> >>iQA/AwUBQwLt4xH2WUcUFbZUEQKVQACffFKW8CxY/2WicAybd8Igc6xS/PcAoMtK >>5twI5+GQ1gWJ7hSIJuQ/PUJY >>=Tg8z >>-----END PGP SIGNATURE----- >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >> > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQwOQGhH2WUcUFbZUEQK4IQCeIOsrH0yI7VNo+jJ0+GDB6e4L0dIAnjyW Pi4JDRJM+X0RpxQss+RJEivt =Kfa8 -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Wed Aug 17 20:53:25 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:35 2006 Subject: McAfee not being updated to 4561 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello All, Another problem today: McAfee does not get updated to 4561 because they forgot to update http://download.nai.com/products/datfiles/4.x/nai/update.ini That file says that the current DAT is 4560, so mcafee-autoupdate says everything is up to date... which is not true... Had to manually install 4561 on my servers... Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From hden at KCBBS.GEN.NZ Wed Aug 17 22:47:44 2005 From: hden at KCBBS.GEN.NZ (Hendrik den Hartog) Date: Thu Jan 12 21:30:35 2006 Subject: Location Sophos IDEs Message-ID: Thanks for the reply, peace of mind is nice thing. Appreciated. So if I've got this right, MailScanner uses the ide folder, and sweep uses the lib folder. Cheers! > [snip] > It should look like this: > [snip] > total 28 > drwxr-xr-x 6 root root 4096 Aug 17 20:10 . > drwxr-xr-x 15 root root 4096 Jul 22 11:24 .. > drwxr-xr-x 2 root root 4096 Aug 17 20:10 396.200508172010 > drwxr-xr-x 2 root root 4096 Jul 30 14:43 bin > lrwxrwxrwx 1 root root 34 Aug 17 20:10 ide -> > /usr/local/Sophos/396.200508172010 > drwxr-xr-x 2 root root 4096 Jul 30 14:43 lib > drwxr-xr-x 11 root root 4096 Jun 30 15:23 man > [snip] ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Wed Aug 17 23:20:17 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:35 2006 Subject: New virus intercepted Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Noone should... -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Denis Beauchemin Sent: Wednesday, August 17, 2005 1:37 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: New virus intercepted Hello All, Last night we received many hundreds EXE files infected by Backdoor.Win32.Dumador.dk, according to Kaspersky. No other virus scanner I have detected anything suspicious: McAfee, Bitdefender and ClamAV all said there was nothing wrong in the files. All files seem to be the same length (26112 bytes) and came from many different IPs. They all have strange names (looks like random characters) ending in .exe. I'm glad I don't let EXE/BAT/PIF/... files through! Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From nerijus at USERS.SOURCEFORGE.NET Thu Aug 18 00:11:44 2005 From: nerijus at USERS.SOURCEFORGE.NET (Nerijus Baliunas) Date: Thu Jan 12 21:30:35 2006 Subject: kaspersky 5.5 Virusscan Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Fri, 29 Jul 2005 09:40:45 +0100 Julian Field wrote: > > I finally got MS work together with Kaspersky 5.5. > > First I had to change some access rights for the kaspersky > > installation, > > so user postfix could call some subprogramms of kaspersky. This should probably be added to the wiki. > > Next I changed the ScanOptions within wrapper-kaspersky to "-i0" > > and took > > the -j3 and -q out of the call: "${PackageDir}/$Scanner $ScanOptions > > -o$Report "$@ > > Is this agreed as a change I should make to the main source tree? > Does everyone have 5.5? Or are most/many people still running the > previous version? I tried removing only one of the options at a time, and found out that removing only -j3 helps. So the diff is: --- kaspersky-wrapper.orig 2005-08-03 21:33:28.000000000 +0300 +++ kaspersky-wrapper 2005-08-18 01:36:39.079616824 +0300 @@ -51,7 +51,7 @@ Args=`echo "$@" | sed -e 's/ -I/ -i/g; s/^-I/-i/g; s/-- / /g;'` rm -f $Report - ${PackageDir}/$Scanner $ScanOptions -o$Report -j3 -q "$@" + ${PackageDir}/$Scanner $ScanOptions -o$Report -q "$@" cat $Report rm -f $Report exit And Kaspersky 5.0 still works with this change, so it can be safelly applied. I tested with both archived and plain viruses. Regards, Nerijus ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jgouveia at GMAIL.COM Thu Aug 18 00:39:49 2005 From: jgouveia at GMAIL.COM ([ISO-8859-1] Joăo Gouveia) Date: Thu Jan 12 21:30:35 2006 Subject: Anti fraud FPs Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi all, We're getting some FPs with the standard "claiming to be" anti fraud message. This happens because people send (ham) HTML email messages that contain HREFs with content that's beeing wrongly interpreted as a URI. Some examples of messages triggering the anti fraud warning * [a href="http://www.google.com"]This triggers. Info it's beeing interpreted as a TL.D.[/a] * Check this article about [a href="http://www.google.com"]standard features of Microsoft .NET[/a] Is this the standard behaviour for recent versions of MailScanner? We're using 4.41. Although right now we have only a few complains, I'm thinking about turning of this anti-fraud mechanism because I feal it's prone to cause too many FPs. What does your experience say? Thanks. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard at AK.PLANET.GEN.NZ Thu Aug 18 04:58:41 2005 From: richard at AK.PLANET.GEN.NZ (Richard Haakma) Date: Thu Jan 12 21:30:35 2006 Subject: OT: Sendmail and Mailertable Problem Message-ID: On Thu, Aug 04, 2005 at 10:13:17PM +0100, Hywel Burris wrote: > Hi, > > Sorry for the off topic request for help but i am sure that someone here > will have had the same problem. > > I am using mailertable to route mails to our sister companies after > scanning them. The problem is that sendmail refuses to use the value in > /etc/mail/mailertable even though it's in brackets and always uses the dns. > > Config below > > [root@mail-2 mail]# cat sendmail.mc | grep mailer > dnl FEATURE(`mailertable',`hash -o /etc/mail/mailertable.db')dnl > FEATURE(`mailertable',`hash /etc/mail/mailertable.db')dnl > > I have tried both there not sure what the -o is for but it was in there > as default on RH9. > > the domain is in the relay-domains file > > [root@mail-2 mail]# cat mailertable | grep abcd > .abcd.co.uk smtp:[mail.abcd.co.uk] > .abcd.co.uk means all subdomains of abcd.co.uk, but not abcd.co.uk itself. If you really mean to forward all subdomains and the domain name itself, use: abcd.co.uk smtp:[mail.server.whereever.co.uk] .abcd.co.uk smtp:[mail.server.whereever.co.uk] I recommend not using wildcard subdomains as they will get abused by spammers. Regards, RH. -- Do NOT reply to SPAM. Do NOT buy anything that is offered by SPAM. Every time someone buys, the spammers can economically justify sending out thousands more messages. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Thu Aug 18 08:59:52 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:35 2006 Subject: McAfee not being updated to 4561 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 17/08/05, Denis Beauchemin wrote: > Hello All, > > Another problem today: McAfee does not get updated to 4561 because they > forgot to update > http://download.nai.com/products/datfiles/4.x/nai/update.ini > > That file says that the current DAT is 4560, so mcafee-autoupdate says > everything is up to date... which is not true... > > Had to manually install 4561 on my servers... > > Denis > > -- > _ > °v° Denis Beauchemin, analyste > /(_)\ Université de Sherbrooke, S.T.I. > ^ ^ T: 819.821.8000x2252 F: 819.821.8045 > > Thanks for the heads-up Denis. I think I'll add a blurb about this (and the easy -f fix) to the wiki sometime later today. -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Aug 18 09:22:41 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:35 2006 Subject: kaspersky 5.5 Virusscan Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Can one or two people using Kaspersky verify and confirm this change please? And Nerijus, please can you add your bit to the wiki. On 18 Aug 2005, at 00:11, Nerijus Baliunas wrote: > On Fri, 29 Jul 2005 09:40:45 +0100 Julian Field > wrote: > > >>> I finally got MS work together with Kaspersky 5.5. >>> First I had to change some access rights for the kaspersky >>> installation, >>> so user postfix could call some subprogramms of kaspersky. >>> > > This should probably be added to the wiki. > > >>> Next I changed the ScanOptions within wrapper-kaspersky to "-i0" >>> and took >>> the -j3 and -q out of the call: "${PackageDir}/$Scanner $ScanOptions >>> -o$Report "$@ >>> >> >> Is this agreed as a change I should make to the main source tree? >> Does everyone have 5.5? Or are most/many people still running the >> previous version? >> > > I tried removing only one of the options at a time, and found out that > removing only -j3 helps. So the diff is: > > --- kaspersky-wrapper.orig 2005-08-03 21:33:28.000000000 +0300 > +++ kaspersky-wrapper 2005-08-18 01:36:39.079616824 +0300 > @@ -51,7 +51,7 @@ > > Args=`echo "$@" | sed -e 's/ -I/ -i/g; s/^-I/-i/g; s/-- / /g;'` > rm -f $Report > - ${PackageDir}/$Scanner $ScanOptions -o$Report -j3 -q "$@" > + ${PackageDir}/$Scanner $ScanOptions -o$Report -q "$@" > cat $Report > rm -f $Report > exit > > And Kaspersky 5.0 still works with this change, so it can be > safelly applied. > I tested with both archived and plain viruses. > > Regards, > Nerijus > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwRFVRH2WUcUFbZUEQL9ygCdEJLR/G6YuFSbutRAvmg65HzJNi4AoJyi tfFzRBmgljCu7Is/s6IE/TYP =oQak -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Aug 18 09:25:15 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:35 2006 Subject: Anti fraud FPs Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Well your posting to the list reached me perfectly intact, so that would imply that more recent versions do not suffer this problem. The phishing net is a constantly changing beast (if a net can be a beast :-) On 18 Aug 2005, at 00:39, Joăo Gouveia wrote: > Hi all, > > We're getting some FPs with the standard "claiming to be" anti > fraud message. > This happens because people send (ham) HTML email messages that > contain HREFs with content that's beeing wrongly interpreted as a URI. > Some examples of messages triggering the anti fraud warning > > * [a href="http://www.google.com"]This triggers. Info it's beeing > interpreted as a TL.D.[/a] > > * Check this article about [a href="http://www.google.com"]standard > features of Microsoft .NET[/a] > > Is this the standard behaviour for recent versions of MailScanner? > We're using 4.41. > Although right now we have only a few complains, I'm thinking about > turning of this anti-fraud mechanism because I feal it's prone to > cause too many FPs. > What does your experience say? > > Thanks. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwRF7BH2WUcUFbZUEQJ+fQCfUdk6d1S6rwxzlV1LpZgRen7iWZAAoL/T jfGQG+4rrEKTCCsMjCEVZcEU =p7pF -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kevind at GO2.IE Thu Aug 18 10:01:54 2005 From: kevind at GO2.IE (Kevin Dermody) Date: Thu Jan 12 21:30:35 2006 Subject: oom-killer - Spamassassin timeout? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] This may help others to resolve the problem, it certainly seems to match my own situation. It appears there is a memory leak in MD (RAID driver) in the 2.6.10 kernel some more details can be found at : http://groups-beta.google.com/group/fa.linux.kernel/tree/browse_frm/thread/2eac97926485bb06/dc30b8807f846340?rnum=1&hl=en&q=tracking+down+a+memory+leak&_done=%2Fgroup%2Ffa.linux.kernel%2Fbrowse_frm%2Fthread%2F2eac97926485bb06%2Fe397048fb11cc309%3Flnk%3Dst%26q%3Dtracking+down+a+memory+leak%26rnum%3D1%26#doc_dc30b8807f846340 and http://lists.debian.org/debian-kernel/2005/07/msg00231.html The command "sort -rn +1 /proc/slabinfo | head -5" shows large amounts of slab cache allocated for bio and biovec-1 which is a tell tale sign that we are experiencing this problem. Appears fixed for 2.6.11 kevind ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rabellino at DI.UNITO.IT Thu Aug 18 09:59:33 2005 From: rabellino at DI.UNITO.IT (Rabellino Sergio) Date: Thu Jan 12 21:30:35 2006 Subject: Phishing Trouble Message-ID: Dear list, I have a trouble with the phishing detection as stated below: MailScanner has detected a possible fraud attempt from "www.informit.com" claiming to be MailScanner has detected a possible fraud attempt from "www.informit.com" claiming to be Having trouble viewing the e-mail below?
http://www.informit.com/newsletters/whatsnew.asp?ni=101&st=45774
I understand why the link is a phishing link, but why the MailScanner fraud message is repeated twice ? Regular expression bug ? I'm using MailScanner 4.44.6 with SA 3.0.4 on Solaris 9/perl 5.8.0. Thanks. -- Dott. Mag. Sergio Rabellino Technical Staff Department of Computer Science University of Torino (Italy) http://www.di.unito.it/~rabser Tel. +39-0116706701 Fax. +39-011751603 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Aug 18 10:11:47 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:35 2006 Subject: Phishing Trouble Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I would suspect you are going through 2 MailScanner servers. I need to add a bit more intelligence so that it notices it has already been tagged once and doesn't tag it a second time. On 18 Aug 2005, at 09:59, Rabellino Sergio wrote: > Dear list, > I have a trouble with the phishing detection as stated below: > > color="red">MailScanner has detected a possible fraud attempt > from "www.informit.com" claiming to be color="red">MailScanner has detected a possible fraud attempt > from "www.informit.com" claiming to be Having trouble viewing the e- > mail below?
http://www.informit.com/newsletters/whatsnew.asp? > ni=101&st=45774
> > I understand why the link is a phishing link, but why the > MailScanner fraud message is repeated twice ? > Regular expression bug ? > > I'm using MailScanner 4.44.6 with SA 3.0.4 on Solaris 9/perl 5.8.0. > > Thanks. > -- > Dott. Mag. Sergio Rabellino > > Technical Staff > Department of Computer Science > University of Torino (Italy) > > http://www.di.unito.it/~rabser > Tel. +39-0116706701 > Fax. +39-011751603 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwRQ1hH2WUcUFbZUEQIVUgCfV1xJmYcQKuyIQwBvewNA3RPc3ssAn0Sr biKGOlDgsLVpbTGVV01C5sPT =eACq -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Thu Aug 18 10:07:17 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:35 2006 Subject: McAfee not being updated to 4561 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 18/08/05, Glenn Steen wrote: (snip) > > Thanks for the heads-up Denis. > I think I'll add a blurb about this (and the easy -f fix) to the wiki > sometime later today. > Hm, spoke too soon... This is the usual cr*p with them... Sloppy updating of all their mirrors. If any of you've ever made an update script that use their ftp mirrors, you know what I'm talking about;-). Seems speedownload.nai.com is OK, so a simple and probably very temporary fix could be to alter the mcafee-autoupdate script to use that. Sigh. Suggestions for the notes section of the wiki (that don't contain too many profanities) much appreciated:). -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rabellino at DI.UNITO.IT Thu Aug 18 10:53:10 2005 From: rabellino at DI.UNITO.IT (Rabellino Sergio) Date: Thu Jan 12 21:30:35 2006 Subject: Phishing Trouble Message-ID: Julian Field wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > I would suspect you are going through 2 MailScanner servers. > I need to add a bit more intelligence so that it notices it has > already been tagged once and doesn't tag it a second time. > > On 18 Aug 2005, at 09:59, Rabellino Sergio wrote: > > >>Dear list, >> I have a trouble with the phishing detection as stated below: >> >>>color="red">MailScanner has detected a possible fraud attempt >>from "www.informit.com" claiming to be >color="red">MailScanner has detected a possible fraud attempt >>from "www.informit.com" claiming to be Having trouble viewing the e- >>mail below?
http://www.informit.com/newsletters/whatsnew.asp? >>ni=101&st=45774
>> >>I understand why the link is a phishing link, but why the >>MailScanner fraud message is repeated twice ? >>Regular expression bug ? >> >>I'm using MailScanner 4.44.6 with SA 3.0.4 on Solaris 9/perl 5.8.0. >> >>Thanks. These are the full headers (blanked where needed with XXX) Return-Path: Received: via tmail-2002(14) for pXXXris; Thu, 18 Aug 2005 09:56:16 +0200 (MEST) Received: from mailer.informit.com (mailer.informit.com [168.215.198.88]) by pianeta.di.unito.it (INFO-DIP) with ESMTP id j7I7rXXX0324 for ; Thu, 18 Aug 2005 09:56:09 +0200 (MEST) Message-Id: <200508180756.j7I7rXXX00324@pianeta.di.unito.it> Received: from indims101 (mailer.informit.com) by mailer.informit.com (LSMTP for Windows NT v1.1b) with SMTP id <0.000003EB@mailer.informit.com>; Thu, 18 Aug 2005 2:17:45 -0500 To: pXXXis@DI.UNITO.IT From: "InformIT Promotions" Date: Thu, 18 Aug 2005 02:14:51 -0500 Subject: -- DISARMED CONTENT -- The Art of Computer Programming Revisited MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="_=_nextpart_INFORMIT_PROMO_20050818" X-dipinfo-MailScanner-Information: Please contact Department of Computer Science technical staff for more information X-SpamCheck: not spam, SpamAssassin (score=-0.775, required 5, BAYES_00 -2.60, HTML_MESSAGE 0.00, HTML_WEB_BUGS 0.04, MSGID_FROM_MTA_HEADER 0.05, MSGID_FROM_MTA_ID 1.72, URI_REDIRECTOR 0.01) X-MailScanner-From: owner-nolist-informit_promo-20050818-#*pXXXs**di*-unito*-it@mailer.informit.com Only a MailScanner was run on this message, I believe. -- Dott. Mag. Sergio Rabellino Technical Staff Department of Computer Science University of Torino (Italy) http://www.di.unito.it/~rabser Tel. +39-0116706701 Fax. +39-011751603 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rabellino at DI.UNITO.IT Thu Aug 18 11:01:24 2005 From: rabellino at DI.UNITO.IT (Rabellino Sergio) Date: Thu Jan 12 21:30:35 2006 Subject: McAfee not being updated to 4561 Message-ID: Glenn Steen wrote: > On 18/08/05, Glenn Steen wrote: > (snip) > >>Thanks for the heads-up Denis. >>I think I'll add a blurb about this (and the easy -f fix) to the wiki >>sometime later today. >> > > Hm, spoke too soon... This is the usual cr*p with them... Sloppy > updating of all their mirrors. > If any of you've ever made an update script that use their ftp > mirrors, you know what I'm talking about;-). > > Seems speedownload.nai.com is OK, so a simple and probably very > temporary fix could be to alter the mcafee-autoupdate script to use > that. Sigh. > > Suggestions for the notes section of the wiki (that don't contain too > many profanities) much appreciated:). > As I see on the nai site, the update.ini reports 4560, but rel. 4561 is available from Aug 17. I've no problem in downloading from download.nai.com, but the update script check that field, so believe that latest release is the 4560. I've done the job by hands..... -- Dott. Mag. Sergio Rabellino Technical Staff Department of Computer Science University of Torino (Italy) http://www.di.unito.it/~rabser Tel. +39-0116706701 Fax. +39-011751603 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Aug 18 11:11:30 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:35 2006 Subject: Phishing Trouble Message-ID: Attached is a patch for Message.pm which should stop this happening again. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 1.2, Application/X-GZIP 1KB. ] [ Unable to print this part. ] [ Part 1.3: "Attached Text" ] On 18 Aug 2005, at 10:11, Julian Field wrote: > * PGP Signed: 08/18/05 at 10:11:50 > > I would suspect you are going through 2 MailScanner servers. > I need to add a bit more intelligence so that it notices it has > already been tagged once and doesn't tag it a second time. > > On 18 Aug 2005, at 09:59, Rabellino Sergio wrote: > > >> Dear list, >> I have a trouble with the phishing detection as stated below: >> >> > color="red">MailScanner has detected a possible fraud attempt >> from "www.informit.com" claiming to be > color="red">MailScanner has detected a possible fraud attempt >> from "www.informit.com" claiming to be Having trouble viewing the >> e-mail below?
http://www.informit.com/newsletters/ >> whatsnew.asp?ni=101&st=45774
>> >> I understand why the link is a phishing link, but why the >> MailScanner fraud message is repeated twice ? >> Regular expression bug ? >> >> I'm using MailScanner 4.44.6 with SA 3.0.4 on Solaris 9/perl 5.8.0. >> >> Thanks. >> -- >> Dott. Mag. Sergio Rabellino >> >> Technical Staff >> Department of Computer Science >> University of Torino (Italy) >> >> http://www.di.unito.it/~rabser >> Tel. +39-0116706701 >> Fax. +39-011751603 >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > * Julian Field > * 0x1415B654 (L) > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Application/PGP-SIGNATURE 202bytes. ] [ Unable to print this part. ] From jgouveia at GMAIL.COM Thu Aug 18 11:11:22 2005 From: jgouveia at GMAIL.COM ([ISO-8859-1] Joăo Gouveia) Date: Thu Jan 12 21:30:35 2006 Subject: Anti fraud FPs Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, On 8/18/05, Julian Field wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Well your posting to the list reached me perfectly intact, so that That would be because I've replaced all < and > with [ and ], and sent a plain text message (no html in it), so it WOULD reach you. :-) I can send the HTML message, but if that one is blocked, it doesn't make much sense sending it does it? > would imply that more recent versions do not suffer this problem. The > phishing net is a constantly changing beast (if a net can be a beast :-) > > On 18 Aug 2005, at 00:39, Joăo Gouveia wrote: > > > Hi all, > > > > We're getting some FPs with the standard "claiming to be" anti > > fraud message. > > This happens because people send (ham) HTML email messages that > > contain HREFs with content that's beeing wrongly interpreted as a URI. > > Some examples of messages triggering the anti fraud warning > > > > * [a href="http://www.google.com"]This triggers. Info it's beeing > > interpreted as a TL.D.[/a] > > > > * Check this article about [a href="http://www.google.com"]standard > > features of Microsoft .NET[/a] > > > > Is this the standard behaviour for recent versions of MailScanner? > > We're using 4.41. > > Although right now we have only a few complains, I'm thinking about > > turning of this anti-fraud mechanism because I feal it's prone to > > cause too many FPs. > > What does your experience say? > > > > Thanks. > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > - -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > -----BEGIN PGP SIGNATURE----- > Version: PGP Desktop 9.0.2 (Build 2425) > > iQA/AwUBQwRF7BH2WUcUFbZUEQJ+fQCfUdk6d1S6rwxzlV1LpZgRen7iWZAAoL/T > jfGQG+4rrEKTCCsMjCEVZcEU > =p7pF > -----END PGP SIGNATURE----- > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Aug 18 11:18:47 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:35 2006 Subject: Anti fraud FPs Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Ah, okay, I misunderstood you. The phishing net does handle certain text within square brackets specially, so you're putting other text inside squares brackets would have been a perfectly valid problem to raise. All you need to do is add the site to your phishing.safe.sites.conf file, that's what it is there for. If you can come up with a way of differentiating ".NET",".Net" or ".net" from ".net" then I am all ears :-) On 18 Aug 2005, at 11:11, Joăo Gouveia wrote: > Hi, > > On 8/18/05, Julian Field wrote: > >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> Well your posting to the list reached me perfectly intact, so that >> > > That would be because I've replaced all < and > with [ and ], and sent > a plain text message (no html in it), so it WOULD reach you. :-) > I can send the HTML message, but if that one is blocked, it doesn't > make much sense sending it does it? > > >> would imply that more recent versions do not suffer this problem. The >> phishing net is a constantly changing beast (if a net can be a >> beast :-) >> >> On 18 Aug 2005, at 00:39, Joăo Gouveia wrote: >> >> >>> Hi all, >>> >>> We're getting some FPs with the standard "claiming to be" anti >>> fraud message. >>> This happens because people send (ham) HTML email messages that >>> contain HREFs with content that's beeing wrongly interpreted as a >>> URI. >>> Some examples of messages triggering the anti fraud warning >>> >>> * [a href="http://www.google.com"]This triggers. Info it's beeing >>> interpreted as a TL.D.[/a] >>> >>> * Check this article about [a href="http://www.google.com"]standard >>> features of Microsoft .NET[/a] >>> >>> Is this the standard behaviour for recent versions of MailScanner? >>> We're using 4.41. >>> Although right now we have only a few complains, I'm thinking about >>> turning of this anti-fraud mechanism because I feal it's prone to >>> cause too many FPs. >>> What does your experience say? >>> >>> Thanks. >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> >> - -- >> Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> >> -----BEGIN PGP SIGNATURE----- >> Version: PGP Desktop 9.0.2 (Build 2425) >> >> iQA/AwUBQwRF7BH2WUcUFbZUEQJ+fQCfUdk6d1S6rwxzlV1LpZgRen7iWZAAoL/T >> jfGQG+4rrEKTCCsMjCEVZcEU >> =p7pF >> -----END PGP SIGNATURE----- >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwRgixH2WUcUFbZUEQII2wCgw5VRYqfv0AtoLbKWyYUjivNfFp4An3tU 7FtEV3K4j48eHegLeVB0EfmU =DXAY -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Thu Aug 18 11:44:35 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:35 2006 Subject: McAfee not being updated to 4561 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 18/08/05, Rabellino Sergio wrote: > Glenn Steen wrote: (snip) > > Seems speedownload.nai.com is OK, so a simple and probably very > > temporary fix could be to alter the mcafee-autoupdate script to use > > that. Sigh. > > > > Suggestions for the notes section of the wiki (that don't contain too > > many profanities) much appreciated:). > > > As I see on the nai site, the update.ini reports 4560, but rel. 4561 is available from Aug 17. > I've no problem in downloading from download.nai.com, but the update script check that field, so believe that latest > release is the 4560. Yes. And if you check update.ini on their speedownload (which is where we really get things from) you'll see that they've got it set correctly to 4561 there. Also, if we were to go "back to ftp.nai.com" we'd see that _most_ of those carry the correct update.ini too (I do this for a mirror of the CommonUpdater thing). > > I've done the job by hands..... Fine. Just (temporarily) changing to speedownload and running the update would've given it to you too, is all I'm saying. -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jgouveia at GMAIL.COM Thu Aug 18 11:44:14 2005 From: jgouveia at GMAIL.COM ([ISO-8859-1] Joăo Gouveia) Date: Thu Jan 12 21:30:35 2006 Subject: Anti fraud FPs Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 8/18/05, Julian Field wrote: (..) > Ah, okay, I misunderstood you. The phishing net does handle certain > text within square brackets specially, so you're putting other text > inside squares brackets would have been a perfectly valid problem to > raise. > > All you need to do is add the site to your phishing.safe.sites.conf > file, that's what it is there for. That would be a solution for specific sites that trigger the rules. Not as a generic solution to avoid the FPs generated by common sentences. > If you can come up with a way of differentiating ".NET",".Net" or > ".net" from ".net" then I am all ears :-) The problem is that a simple sentence is beeing indicated as a fraud attempt. There's nothing diferenciating a sentence from a URL or URI, besides from the TLD check that can match normal sentences when they contain words like "info" or "biz", or any TLD that's a regular word. For example, I've wrote above: "That would be a solution for specific sites that trigger the rules. Not as a generic solution to avoid the FPs. " If "not" would be a valid TLD, and that sentence was inside a link, the message would be flagged as fraud attempt with something like: " MailScanner has detected a possible fraud attempt from "www.google.com" claiming to be That would be a solution for specific sites that trigger the rules. Not as a generic solution to avoid the FPs " I understand that fixing that might open a window for other kind of attacks, but I cannot afford having my boss (just an example) to complaint that our system said that his mail was a "fraud attempt", so at the moment I'm facing two choices: 1) Deactivate that trigger 2) Patch mailscanner so it would trigger only if there's a good chance of the content beeing a URI. A good way to do this is to look at the URIDBSNL plugin code from SpamAssassin. It seams to work ok. Best regards, Joao Gouveia ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lists at NORCOMCABLE.CA Thu Aug 18 12:20:04 2005 From: lists at NORCOMCABLE.CA (Dan) Date: Thu Jan 12 21:30:35 2006 Subject: kaspersky 5.5 Virusscan Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field > Sent: August 18, 2005 3:23 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: kaspersky 5.5 Virusscan > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Can one or two people using Kaspersky verify and confirm this > change please? > > And Nerijus, please can you add your bit to the wiki. > > On 18 Aug 2005, at 00:11, Nerijus Baliunas wrote: > > > On Fri, 29 Jul 2005 09:40:45 +0100 Julian Field > > wrote: > > > > > >>> I finally got MS work together with Kaspersky 5.5. > >>> First I had to change some access rights for the kaspersky > >>> installation, so user postfix could call some subprogramms of > >>> kaspersky. > >>> > > > > This should probably be added to the wiki. > > > > > >>> Next I changed the ScanOptions within wrapper-kaspersky to "-i0" > >>> and took > >>> the -j3 and -q out of the call: "${PackageDir}/$Scanner > $ScanOptions > >>> -o$Report "$@ > >>> > >> > >> Is this agreed as a change I should make to the main source tree? > >> Does everyone have 5.5? Or are most/many people still running the > >> previous version? > >> > > > > I tried removing only one of the options at a time, and > found out that > > removing only -j3 helps. So the diff is: > > > > --- kaspersky-wrapper.orig 2005-08-03 21:33:28.000000000 +0300 > > +++ kaspersky-wrapper 2005-08-18 01:36:39.079616824 +0300 > > @@ -51,7 +51,7 @@ > > > > Args=`echo "$@" | sed -e 's/ -I/ -i/g; s/^-I/-i/g; s/-- / /g;'` > > rm -f $Report > > - ${PackageDir}/$Scanner $ScanOptions -o$Report -j3 -q "$@" > > + ${PackageDir}/$Scanner $ScanOptions -o$Report -q "$@" > > cat $Report > > rm -f $Report > > exit > > > > And Kaspersky 5.0 still works with this change, so it can > be safelly > > applied. > > I tested with both archived and plain viruses. > > > > Regards, > > Nerijus > > I used the attached patches on my system. So far it seems to be working fine. I found that by making the one change listed above, MailScanner could not do the auto update. As well, I didn't want to break compatibility with older versions of Kaspersky. regards, -dan ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Text/PLAIN (Name: "kaspersky5_5.txt") 171 lines. ] [ Unable to print this part. ] From Denis.Beauchemin at USHERBROOKE.CA Thu Aug 18 13:58:16 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:35 2006 Subject: New virus intercepted Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Denis Beauchemin wrote: > Hello All, > > Last night we received many hundreds EXE files infected by > Backdoor.Win32.Dumador.dk, according to Kaspersky. No other virus > scanner I have detected anything suspicious: McAfee, Bitdefender and > ClamAV all said there was nothing wrong in the files. > > All files seem to be the same length (26112 bytes) and came from many > different IPs. They all have strange names (looks like random > characters) ending in .exe. > > I'm glad I don't let EXE/BAT/PIF/... files through! > > Denis > Overall we blocked 512 EXE on one of our external servers yesterday and no more than 3 came from the same IP. On the other external server, we blocked 525 EXE and no more than 4 came from the same IP... Funny thing: we received them from midnight to 1:35 and then nothing until 17:36 (5:36PM). It stopped at about 19:36 (7:36PM) to not be seen again... Still nothing detected by McAfee, Bitdefender or ClamAV... Denis PS: We've been told that McAfee will detect it with the extra.dat so I am about to download it. It would be nice it mcafee-autoupdate -e worked as advertised... usage: /usr/lib/MailScanner/mcafee-autoupdate [-dfrtv] [-Rnnn] [-Innn] [proxy] [prefix] -d delete old files -e get extra.dat -f force update -r show README -t timestamp output -v verbose -R number of retries -I retry interval proxy URL of FTP/HTTP proxy server prefix uvscan installation directory -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From prandal at HEREFORDSHIRE.GOV.UK Thu Aug 18 14:33:35 2005 From: prandal at HEREFORDSHIRE.GOV.UK (Randal, Phil) Date: Thu Jan 12 21:30:35 2006 Subject: New virus intercepted Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] This should be a FAQ: Submit samples to: http://virusscan.jotti.org/ http://www.virustotal.com/ http://cgi.clamav.net/sendvirus.cgi Cheers, Phil ---- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Denis Beauchemin > Sent: 18 August 2005 13:58 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: New virus intercepted > > Denis Beauchemin wrote: > > > Hello All, > > > > Last night we received many hundreds EXE files infected by > > Backdoor.Win32.Dumador.dk, according to Kaspersky. No other virus > > scanner I have detected anything suspicious: McAfee, > Bitdefender and > > ClamAV all said there was nothing wrong in the files. > > > > All files seem to be the same length (26112 bytes) and came > from many > > different IPs. They all have strange names (looks like random > > characters) ending in .exe. > > > > I'm glad I don't let EXE/BAT/PIF/... files through! > > > > Denis > > > Overall we blocked 512 EXE on one of our external servers > yesterday and no more than 3 came from the same IP. On the > other external server, we blocked 525 EXE and no more than 4 > came from the same IP... > > Funny thing: we received them from midnight to 1:35 and then > nothing until 17:36 (5:36PM). It stopped at about 19:36 > (7:36PM) to not be seen again... > > Still nothing detected by McAfee, Bitdefender or ClamAV... > > Denis > PS: We've been told that McAfee will detect it with the > extra.dat so I am about to download it. It would be nice it > mcafee-autoupdate -e worked as advertised... > usage: /usr/lib/MailScanner/mcafee-autoupdate [-dfrtv] > [-Rnnn] [-Innn] [proxy] [prefix] > -d delete old files > -e get extra.dat > -f force update > -r show README > -t timestamp output > -v verbose > -R number of retries > -I retry interval > proxy URL of FTP/HTTP proxy server > prefix uvscan installation directory > > -- > _ > °v° Denis Beauchemin, analyste > /(_)\ Université de Sherbrooke, S.T.I. > ^ ^ T: 819.821.8000x2252 F: 819.821.8045 > > > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Thu Aug 18 14:54:19 2005 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:30:35 2006 Subject: No longer spamchecks? Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi there, currently i am using the latest Version of MailScanner (updated right now) and the latest Version of SpamAssassin. Suddenly, for about a few days now, Mailscanner does no longer use SpamAssassin. It seems that MailScanner does not scan any incoming mails for spam. :( It seems that the ruleset is no longer read, so that i only could use Yes or no for SpamChecks and use of Spamassassin. .. This is the rule-set .. FromOrTo: default yes and the commandin MailScanner was : Spam Checks = %rules-dir%/spam.scanner.rules Use SpamAssassin = %rules-dir%/spam.scanner.rules Any ideas in here?? no i set the above settings to yes.. and mails got scanned again.. Greetings Marcel -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iD8DBQFDBJMOeuKbXOoTCo8RAs2UAJoCntaHt0CRKTrrg1zQQGzltbrCrgCeKMWE I+s9kzHGmjtN7xpY5enZ27Q= =TtOQ -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Thu Aug 18 15:54:18 2005 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:30:36 2006 Subject: No Scanner rules to be exact Message-ID: Hi there, i would like to have the mails from an adress not to be scanned, so i added into the ruleset Scan Messages the ruleset. And into this ruleset i put the following: From Denis.Beauchemin at USHERBROOKE.CA Thu Aug 18 16:03:40 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:36 2006 Subject: New virus intercepted Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Denis Beauchemin wrote: > Denis Beauchemin wrote: > >> Hello All, >> >> Last night we received many hundreds EXE files infected by >> Backdoor.Win32.Dumador.dk, according to Kaspersky. No other virus >> scanner I have detected anything suspicious: McAfee, Bitdefender and >> ClamAV all said there was nothing wrong in the files. >> >> All files seem to be the same length (26112 bytes) and came from many >> different IPs. They all have strange names (looks like random >> characters) ending in .exe. >> >> I'm glad I don't let EXE/BAT/PIF/... files through! >> >> Denis >> > Overall we blocked 512 EXE on one of our external servers yesterday > and no more than 3 came from the same IP. On the other external > server, we blocked 525 EXE and no more than 4 came from the same IP... > > Funny thing: we received them from midnight to 1:35 and then nothing > until 17:36 (5:36PM). It stopped at about 19:36 (7:36PM) to not be > seen again... > > Still nothing detected by McAfee, Bitdefender or ClamAV... > The new DAT file (4562) detects them as BackDoor-CCT trojan. Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at YETICOMPUTERS.COM Thu Aug 18 16:24:45 2005 From: mailscanner at YETICOMPUTERS.COM (Rick Chadderdon) Date: Thu Jan 12 21:30:36 2006 Subject: Startup Problem Message-ID: When I execute /opt/MailScanner/bin/check_mailscanner as root with: Run As User = postfix Run As Group = postfix in MailScanner.conf, I get the error: --- Starting MailScanner... Cannot open config file /opt/MailScanner/etc/MailScanner.conf, Permission denied at /opt/MailScanner/lib/MailScanner/Config.pm line 592. --- Seems easy enough, but I'm stuck. I've chowned /opt/MailScanner/etc/MailScanner.conf to postfix:postfix. I've chmodded the file all the way to 777 and done the same for every file and directory in the opt/MailScanner/ tree (including /opt/MailScanner). None of this helped, so I got more creative... I temporarily gave the postix user a shell. When I ran /opt/MailScanner/bin/check_mailscanner directly while logged in as the postfix user, it worked fine. If I did "su postfix -c /opt/MailScanner/bin/check_mailscanner" as root, it worked fine. So, I thought it must have something to do with the uid change. The log shows: Aug 18 10:50:59 mail root: MailScanner setting GID to postfix (207) Aug 18 10:50:59 mail root: MailScanner setting UID to postfix (207) and a line I added to the SetUidGid function in MailScanner confirms that both real and effective ids are being set. I tried using the POSIX routine instead of the perlvars, but got the same result. I've tried both the emerged perl modules and the ones installed by the MailScanner and completely rebuilt Perl once. Nothing changes. The apparently relevant lines from strace show: [pid 7106] write(3, "<14>root: MailScanner setting UI"..., 52) = 52 [pid 7106] setresuid32(207, 207, -1) = 0 [pid 7106] getuid32() = 207 [pid 7106] geteuid32() = 207 [pid 7106] open("/opt/MailScanner/etc/MailScanner.conf", O_RDONLY|O_LARGEFILE) = -1 EACCES (Permission denied) [pid 7106] write(2, "Cannot open config file /opt/Mai"..., 137Cannot open config file /opt/MailScanner/etc/MailScanner.conf, Permission denied at /opt/MailScanner/lib/MailScanner/Config.pm line 592. ) = 137 Right now I'm making it work by giving the postfix user a shell and then setting it back to /bin/false after MailScanner is running. I can function like this if necessary but I'd *really* like to know what's going on here. Any ideas? My system: P4 1.8GHz, 512M, 40G Gentoo Linux 2005.1 EXT3 filesystem without extended attributes or security labels MySQL/Postfix/Cyrus MailScanner 4.44.6 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bpumphrey at WOODMACLAW.COM Thu Aug 18 16:57:07 2005 From: bpumphrey at WOODMACLAW.COM (Billy A. Pumphrey) Date: Thu Jan 12 21:30:36 2006 Subject: Queue is slow to empty, and another thing Message-ID: My MailScanner machine is: Dual 600mhz 1024 RAM 5x hard drives @ RAID 5 MailScanner version 4.43.8 Running razor, DCC, pyzor, rulesdujour, various other rules, ClamAV, Bitdefender (all latest versions as of about 2 months ago) 1. My MailScanner is a gateway between the internet and Exchange. I put missed spam in a exchange folder Use fetchmail to get the spam mail to the linux machine Run sa-learn --- ALL WORKS FINE --- I usually have between 100-300 emails that I do at once. This fills up the inbound queue (looking at mailstats). It always takes a long time to get it emptied and processed, about 30min or a little longer. On normal operation, when I am not slamming it with 300 emails, it keeps up just fine. Mailwatch shows: Load Average: 5.12 4.84 4.49 I telnet in and "top", cpu usage isn't 100% all the time, average maybe 60-70. RAM is ok = about 700-800 used out of 1024. Common sense pretty much tells me that the machine is chuggin and just cannot keep up. Can anyone recommend any changes to speed up this machine with settings? 2. Also when I do this process. It seems that when the missed spam emails go through mailscanner again, some of it gets tagged as spam. Why would it get tagged as spam the second time and not the first time? Billy Pumphrey IT Manager Wooden & McLaughlin ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Thu Aug 18 17:00:30 2005 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:30:36 2006 Subject: Queue is slow to empty, and another thing Message-ID: MailScanner mailing list <> scribbled on Thursday, August 18, 2005 10:57 AM: > My MailScanner machine is: > Dual 600mhz > 1024 RAM > 5x hard drives @ RAID 5 > > MailScanner version 4.43.8 > Running razor, DCC, pyzor, rulesdujour, various other rules, > ClamAV, Bitdefender (all latest versions as of about 2 months ago) > > 1. > My MailScanner is a gateway between the internet and Exchange. > I put missed spam in a exchange folder > Use fetchmail to get the spam mail to the linux machine Run sa-learn > > > --- ALL WORKS FINE --- > > I usually have between 100-300 emails that I do at once. > This fills up the inbound queue (looking at mailstats). It > always takes a long time to get it emptied and processed, > about 30min or a little longer. > > On normal operation, when I am not slamming it with 300 > emails, it keeps up just fine. Mailwatch shows: > Load Average: 5.12 4.84 4.49 > > I telnet in and "top", cpu usage isn't 100% all the time, > average maybe 60-70. RAM is ok = about 700-800 used out of 1024. > > Common sense pretty much tells me that the machine is chuggin > and just cannot keep up. Can anyone recommend any changes to > speed up this machine with settings? > > 2. > Also when I do this process. It seems that when the missed > spam emails go through mailscanner again, some of it gets > tagged as spam. Why would it get tagged as spam the second > time and not the first time? > You may be getting killed by disk IO. Have you tried mounting /var/spool/MailScanner/incoming on a tmpfs? Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Aug 18 17:03:18 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:36 2006 Subject: No Scanner rules to be exact Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 18 Aug 2005, at 15:54, Marcel Blenkers wrote: > From xyc@xyc.com AND From: 255.255.255.255 (this ip is for > example > only ;) no > > Is this possible? Yes. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwSxSRH2WUcUFbZUEQL3OgCeLlfORupvMfrUrEy6AbK6mrpEH1wAoMAW SQyl1xaPmN0nPicEYVVLvJG5 =TISj -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Aug 18 17:06:08 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:36 2006 Subject: Queue is slow to empty, and another thing Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 18 Aug 2005, at 17:00, Mike Kercher wrote: > You may be getting killed by disk IO. Have you tried mounting > /var/spool/MailScanner/incoming on a tmpfs? Put /tmp on tmpfs while you're at it. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwSx9BH2WUcUFbZUEQKyrgCg7s41ff5BthwP5YdZ0v4WnfWGG6cAoPqB sBqI7NdSSLTPQMdMufuEaH1w =HQBu -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bpumphrey at WOODMACLAW.COM Thu Aug 18 17:07:00 2005 From: bpumphrey at WOODMACLAW.COM (Billy A. Pumphrey) Date: Thu Jan 12 21:30:36 2006 Subject: Queue is slow to empty, and another thing Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Mike Kercher > Sent: Thursday, August 18, 2005 11:00 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Queue is slow to empty, and another thing > > MailScanner mailing list <> scribbled on Thursday, August 18, 2005 10:57 > AM: > > > My MailScanner machine is: > > Dual 600mhz > > 1024 RAM > > 5x hard drives @ RAID 5 > > > > MailScanner version 4.43.8 > > Running razor, DCC, pyzor, rulesdujour, various other rules, > > ClamAV, Bitdefender (all latest versions as of about 2 months ago) > > > > 1. > > My MailScanner is a gateway between the internet and Exchange. > > I put missed spam in a exchange folder > > Use fetchmail to get the spam mail to the linux machine Run sa-learn > > > > > > --- ALL WORKS FINE --- > > > > I usually have between 100-300 emails that I do at once. > > This fills up the inbound queue (looking at mailstats). It > > always takes a long time to get it emptied and processed, > > about 30min or a little longer. > > > > On normal operation, when I am not slamming it with 300 > > emails, it keeps up just fine. Mailwatch shows: > > Load Average: 5.12 4.84 4.49 > > > > I telnet in and "top", cpu usage isn't 100% all the time, > > average maybe 60-70. RAM is ok = about 700-800 used out of 1024. > > > > Common sense pretty much tells me that the machine is chuggin > > and just cannot keep up. Can anyone recommend any changes to > > speed up this machine with settings? > > > > 2. > > Also when I do this process. It seems that when the missed > > spam emails go through mailscanner again, some of it gets > > tagged as spam. Why would it get tagged as spam the second > > time and not the first time? > > > > You may be getting killed by disk IO. Have you tried mounting > /var/spool/MailScanner/incoming on a tmpfs? > > Mike I have not tried that. I would not have a clue as to how to do it. Any pointers? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Thu Aug 18 16:55:42 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:36 2006 Subject: Phishing Trouble Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field spake the following on 8/18/2005 2:11 AM: > I would suspect you are going through 2 MailScanner servers. > I need to add a bit more intelligence so that it notices it has > already been tagged once and doesn't tag it a second time. > A feature like that would be great! I run 2 servers in different domains that backup MX for each other. But this can play hell with rbl lookups. If MailScanner could have some kind of header with the system name, and another system could be looking for that header? I was going to add some spamassassin rules to look for the headers added by the other MX and bump the score. That is when I can find the time! -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve.swaney at fsl.com Thu Aug 18 20:37:22 2005 From: steve.swaney at fsl.com (Stephen Swaney) Date: Thu Jan 12 21:30:36 2006 Subject: mailscanner with clamav an spamassasin howto Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Bj řrn-Sverre Nřttum > Sent: Thursday, August 18, 2005 3:13 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: mailscanner with clamav an spamassasin howto > > Hello! > > I am running a mailgateway with sendmail. After getting sendmail to work > properly I installed clamav and spamassasin. On top of this I installed > mailscanner. By pure luck (I think) I got the mailscanner to work properly > with both sendmail and clamav, but it did not work that easily with > spamasassin. > > I have told mailscanner to use spamassin in the comfiguration file, but > the mails are clearly not scanned for spam. > > Does anyone know of a howto for sendmail/ clamav/ spamassasin/ > mailscanner, or can anyone tell me what I should to to make spamassasin > work with mailscanner? > > Thnaks a lot! > > Bjorn There is a lot of useful information in the Wiki :) A little more information would be helpful: What Operating System are you using? How did you install SpamAssassin, i.e. CPAN, tarball, rpm? What versions of MailScanner, and Spam Assassin are you installing? Do you logs show any errors? What does the output of the following command return: spamassassin -D -p --lint On a Linux system typically = /etc/MailScanner/spam.assassin.prefs.conf Steve Stephen Swaney Fort Systems Ltd. stephen.swaney@fsl.com www.fsl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ds at CARIBENET.COM Thu Aug 18 21:37:37 2005 From: ds at CARIBENET.COM (Dirk Enrique Seiffert) Date: Thu Jan 12 21:30:36 2006 Subject: oom-killer - Spamassassin timeout? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] El Jue 18 Ago 2005 04:01, Kevin Dermody escribió: > > The command "sort -rn +1 /proc/slabinfo | head -5" shows large amounts > of slab cache allocated for bio and biovec-1 which is a tell tale sign > that we are experiencing this problem. > > Appears fixed for 2.6.11 Kernel version is 2.6.11.4 (SuSE 9.3), sort -rn +1 /proc/slabinfo | head -5 gives me following output: reiser_inode_cache 91028 119889 408 9 1 : tunables 54 27 8 : slabdata 13321 13321 0 buffer_head 76268 172650 52 75 1 : tunables 120 60 8 : slabdata 2302 2302 48 dentry_cache 71005 169204 140 28 1 : tunables 120 60 8 : slabdata 6043 6043 0 vm_area_struct 14627 17595 88 45 1 : tunables 120 60 8 : slabdata 391 391 0 radix_tree_node 12200 15638 284 14 1 : tunables 54 27 8 : slabdata 1117 1117 0 ...but I have no idea how slabinfo output should look like. These 2 OOM-killer crashes appeared after about 10-12 days uptime. The machine has 2 Giga of RAM. Fist 2 days after reboot memory usage stays very low, starts growing from about 500M until it reaches 2G within about 3 days uptime. Then ist starts slighly to swap, swap grows until crash. Attached send a png of mailscanner-mrtg. You can clearly see the two crashes. (Last reboot was planned). Thanks for your comments. Enrique -- Dirk Enrique Seiffert CaribeNet S.A. - Cartagena - Colombia www.caribenet.com -- Este mensaje ha sido analizado por MailScanner en busca de viruses y otros contenidos peligrosos, y se considera que est limpio. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Image/PNG 5.3KB. ] [ Unable to print this part. ] From mcampbell at ITCONVERGENCE.COM Fri Aug 19 00:14:29 2005 From: mcampbell at ITCONVERGENCE.COM (Mark Campbell) Date: Thu Jan 12 21:30:36 2006 Subject: mailwatch upgrade - MailScanner no longer logging to MySQL Message-ID: Hey Guys, I was trying to upgrade mailwatch(1.0.2) on a test box and now MailScanner no longer can log messages to MySQL, I have ensured that I have the latest CustomConfig and MailWatch pm files I get the following errors: Aug 18 17:57:25 palprx01 MailScanner[17654]: Unable to initialise database connection: Access denied for user: 'root@localhost' (Using password: NO) Aug 18 17:57:25 palprx01 MailScanner[17654]: Could not use Custom Function code MailScanner::CustomConfig::InitMailWatchLogging, it could not be "eval"ed. Make sure the module is correct with perl -wc I don't understand a) why it is trying to connect using root and secondly why I cannot see that init mail watch Mark Campbell -- IT Convergence OS Administrator < mcampbell@itconvergence.com> US/Canada: [800] 675-0032 Ext. 2630 Int, Direct: [415] 962-8683 Fax: [608] 255-2267 Mobile: [415] 359 82 93 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From scott at HOLLOMON.US Fri Aug 19 03:50:40 2005 From: scott at HOLLOMON.US (Scott Hollomon) Date: Thu Jan 12 21:30:36 2006 Subject: Problem with x86_64? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I am running fully updated CentOS 4 for x86_64 on a relatively clean install.   I have installed Cyrus-IMAPD and sendmail using yum and have the two working sending and receiving mail.  I downloaded the Mailscanner install package and ran the installation.  All seemed to proceed normally, the vast majority of the packages tested ok and all of the rpm's seemed to compile and install, the mailscanner rpm did not complain when it installed. However, when I try and start Mailscanner with service MailScanner start I get the following: Starting MailScanner daemons:          incoming sendmail:                                [  OK  ]          outgoing sendmail:                                [  OK  ]          MailScanner:       Can't locate Archive/Zip.pm in @INC (@INC contains: /usr/lib/MailScanner /usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi /usr/lib/perl5/5.8.5 /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi /usr/lib64/perl5/site_perl/5.8.4/x86_64-linux-thread-multi /usr/lib64/perl5/site_perl/5.8.3/x86_64-linux-thread-multi /usr/lib64/perl5/site_perl/5.8.2/x86_64-linux-thread-multi /usr/lib64/perl5/site_perl/5.8.1/x86_64-linux-thread-multi /usr/lib64/perl5/site_perl/5.8.0/x86_64-linux-thread-multi /usr/lib/perl5/site_perl/5.8.5 /usr/lib/perl5/site_perl/5.8.4 /usr/lib/perl5/site_perl/5.8.3 /usr/lib/perl5/site_perl/5.8.2 /usr/lib/perl5/site_perl/5.8.1 /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl /usr/lib64/perl5/vendor_perl/5.8.5/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.4/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.3/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.2/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.1/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.0/x86_64-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.5 /usr/lib/perl5/vendor_perl/5.8.4 /usr/lib/perl5/vendor_perl/5.8.3 /usr/lib/perl5/vendor_perl/5.8.2 /usr/lib/perl5/vendor_perl/5.8.1 /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl . /usr/lib/MailScanner/5.8.5/x86_64-linux-thread-multi /usr/lib/MailScanner/5.8.5 /usr/lib/MailScanner/x86_64-linux-thread-multi /usr/lib/MailScanner/5.8.4 /usr/lib/MailScanner/5.8.3 /usr/lib/MailScanner/5.8.2 /usr/lib/MailScanner/5.8.1 /usr/lib/MailScanner/5.8.0 /usr/lib/MailScanner) at /usr/lib/MailScanner/MailScanner/Message.pm line 47. BEGIN failed--compilation aborted at /usr/lib/MailScanner/MailScanner/Message.pm line 47. Compilation failed in require at /usr/sbin/MailScanner line 75. BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 75.                                                            [  OK  ] I did not experience this when installing with the same OS i386 version on another machine.  I have googled this extensively and posted on the CentOS board with no response.  I have also attempted to rebuild the rpms with rpm-build and install them by hand.  This seemed to work but got the same result in the end. -- Scott ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard at AK.PLANET.GEN.NZ Fri Aug 19 05:07:05 2005 From: richard at AK.PLANET.GEN.NZ (Richard Haakma) Date: Thu Jan 12 21:30:36 2006 Subject: TNEF still a problem? Message-ID: On Thu, Aug 11, 2005 at 01:43:23PM -0400, Bill McGonigle wrote: > On Aug 8, 2005, at 05:34, Nigel kendrick wrote: > > >I just noticed that the same 9 emails were getting processed (archived > >and > >blacklist checked) by MailScanner (4.44.6) in a loop without actually > >being > >submitted for virus scanning and further processing/delivery. > > > >I also saw the list messages here about issues with TNEF and, lo, one > >of the > >MailScanner messages in the 'loop' referred to expanding a TNEF file. > >I set > >'Expand TNEF = yes' to 'no' and things got moving again (with some very > >hefty 'delay=' values - i.e.: delay=22295!!!) > > > >Other mail was being delivered during this period but obviously this > >needs a > >fix. I notice Julian posted a TNEF patch - has this been tried by > >anyone > >else yet and (noob hat on...) how do I apply it?? > > FWIW, I switched to the external tnef processor on a troubled machine > and 30 messages blazed by that were chewing up the CPU previously. > > -Bill I'll agree with this observed behaviour. I saw some messages stalling in the hold queue, and it cleared up soon after I changed from internal to external tnef decoding. I will add that it seemed that the MailScanner process was crashing when it was doing this as the maillog file showed "MailScanner Starting" a few times a minute. Regards, RH. -- Do NOT reply to SPAM. Do NOT buy anything that is offered by SPAM. Every time someone buys, the spammers can economically justify sending out thousands more messages. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner-user at NELAND.DK Fri Aug 19 06:24:47 2005 From: mailscanner-user at NELAND.DK (Leif Neland) Date: Thu Jan 12 21:30:36 2006 Subject: mailwatch upgrade - MailScanner no longer logging to MySQL Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mark Campbell wrote: > Hey Guys, > > I was trying to upgrade mailwatch(1.0.2) on a test box and now > MailScanner no longer can log messages to MySQL, I have ensured that I > have the latest CustomConfig and MailWatch pm files I get the > following errors: > > Aug 18 17:57:25 palprx01 MailScanner[17654]: Unable to initialise > database connection: Access denied for user: 'root@localhost' (Using > password: NO) > Aug 18 17:57:25 palprx01 MailScanner[17654]: Could not use Custom > Function code MailScanner::CustomConfig::InitMailWatchLogging, it > could not be "eval"ed. Make sure the module is correct with perl -wc > > I don't understand a) why it is trying to connect using root and > secondly why I cannot see that init mail watch The username and password is hardcoded in MailWatch.pm, change to correct values. Leif -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Fri Aug 19 07:07:09 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:30:36 2006 Subject: Startup Problem Message-ID: On 18 Aug 2005, at 16:24, Rick Chadderdon wrote: > When I execute /opt/MailScanner/bin/check_mailscanner as root with: > > Run As User = postfix > Run As Group = postfix > > in MailScanner.conf, I get the error: > > --- > Starting MailScanner... > Cannot open config file /opt/MailScanner/etc/MailScanner.conf, > Permission > denied at /opt/MailScanner/lib/MailScanner/Config.pm line 592. > --- > > Seems easy enough, but I'm stuck. I've chowned > /opt/MailScanner/etc/MailScanner.conf to postfix:postfix. I've > chmodded the > file all the way to 777 and done the same for every file and > directory in > the opt/MailScanner/ tree (including /opt/MailScanner). None of this > helped, so I got more creative... My MailScanner.conf is owned by root and sits with 644 permissions and MailScanner is started by root. As part of it's start up it moves to the Postfix user. Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at BARENDSE.TO Fri Aug 19 07:52:16 2005 From: mailscanner at BARENDSE.TO (Remco Barendse) Date: Thu Jan 12 21:30:36 2006 Subject: Feature request : silent filename block? Message-ID: Would it be possible to silently drop e-mails that contain filenames with a certain extension? (Like silent virii list) Virii using the standard .scr garbage keep coming in and people that are sending screensavers deserve to be dropped silently :) Thx! Remco ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Aug 19 08:56:31 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:36 2006 Subject: Phishing Trouble Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have already posted the patch. Check the whole of this thread and you'll see it. On 18 Aug 2005, at 16:55, Scott Silva wrote: > Julian Field spake the following on 8/18/2005 2:11 AM: > >> I would suspect you are going through 2 MailScanner servers. >> I need to add a bit more intelligence so that it notices it has >> already been tagged once and doesn't tag it a second time. >> >> > A feature like that would be great! I run 2 servers in different > domains > that backup MX for each other. But this can play hell with rbl > lookups. > If MailScanner could have some kind of header with the system name, > and > another system could be looking for that header? > I was going to add some spamassassin rules to look for the headers > added > by the other MX and bump the score. That is when I can find the time! - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwWQshH2WUcUFbZUEQIJHQCfRXDuA7WE8EOA2Ig/+N2vLPL/BAUAoND2 qbPtbyM3i4SPt+hQv9P9+TqJ =bofA -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Aug 19 08:59:47 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:36 2006 Subject: Feature request : silent filename block? Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Yes, see the comments at the top of filename.rules.conf, there is a "deny+delete" operation that does what you want. I should improve the docs of that bit. On 19 Aug 2005, at 07:52, Remco Barendse wrote: > Would it be possible to silently drop e-mails that contain > filenames with a certain extension? (Like silent virii list) > > Virii using the standard .scr garbage keep coming in and people > that are sending screensavers deserve to be dropped silently :) - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwWRdhH2WUcUFbZUEQKwJwCfScHUqVmPyFyTMcUscg7ETpS6+XAAoPdz h/Z5aKT19z9DjGZaKKrRmz4S =709F -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Aug 19 08:55:00 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:36 2006 Subject: In hebrew emails mail scanner puts gibberish in the Subject line Message-ID: Please try out the attached short patch for Message.pm. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 1.2, Application/X-GZIP 396bytes. ] [ Unable to print this part. ] [ Part 1.3: "Attached Text" ] This may well fix the problem. On 16 Aug 2005, at 08:55, Julian Field wrote: > * PGP Signed: 08/16/05 at 08:55:20 > > Does anyone have accurate knowledge of: > What was the last version that worked properly? > What was the first version that changed Subject: to ######## ? > > Without this, I can't find the problem. > > On 16 Aug 2005, at 03:15, Alex Neuman van der Hans wrote: > > >> How do you do this in Sendmail, exactly? I've got a client who >> constantly >> emails me saying "someguy@somewhere.com's mail scanning program >> bounced my >> mail, why?" and the bounce always says something about violating >> RFC's by >> using unquoted accented characters in the subject line. If I could >> get >> sendmail to sanitize the subject lines at least it would get rid >> of the >> bounces. >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > * Julian Field > * 0x1415B654 (L) > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Application/PGP-SIGNATURE 202bytes. ] [ Unable to print this part. ] From bsnottum at HKSKOLE.NO Thu Aug 18 20:12:54 2005 From: bsnottum at HKSKOLE.NO (Bj[ISO-8859-1] řrn-Sverre Nřttum) Date: Thu Jan 12 21:30:36 2006 Subject: mailscanner with clamav an spamassasin howto Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello! I am running a mailgateway with sendmail. After getting sendmail to work properly I installed clamav and spamassasin. On top of this I installed mailscanner. By pure luck (I think) I got the mailscanner to work properly with both sendmail and clamav, but it did not work that easily with spamasassin. I have told mailscanner to use spamassin in the comfiguration file, but the mails are clearly not scanned for spam. Does anyone know of a howto for sendmail/ clamav/ spamassasin/ mailscanner, or can anyone tell me what I should to to make spamassasin work with mailscanner? Thnaks a lot! Bjorn ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From housey at SME-ECOM.CO.UK Thu Aug 18 17:11:46 2005 From: housey at SME-ECOM.CO.UK (Paul Houselander) Date: Thu Jan 12 21:30:36 2006 Subject: Queue is slow to empty, and another thing Message-ID: Take a look at http://wiki.mailscanner.info/doku.php?id=maq:index#optimization_tips Click the Instructions link for how to use tmpfs - has some other tips for optimization. Cheers Paul -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On Behalf Of Billy A. Pumphrey Sent: 18 August 2005 17:07 To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Queue is slow to empty, and another thing > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Mike Kercher > Sent: Thursday, August 18, 2005 11:00 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Queue is slow to empty, and another thing > > MailScanner mailing list <> scribbled on Thursday, August 18, 2005 10:57 > AM: > > > My MailScanner machine is: > > Dual 600mhz > > 1024 RAM > > 5x hard drives @ RAID 5 > > > > MailScanner version 4.43.8 > > Running razor, DCC, pyzor, rulesdujour, various other rules, > > ClamAV, Bitdefender (all latest versions as of about 2 months ago) > > > > 1. > > My MailScanner is a gateway between the internet and Exchange. > > I put missed spam in a exchange folder > > Use fetchmail to get the spam mail to the linux machine Run sa-learn > > > > > > --- ALL WORKS FINE --- > > > > I usually have between 100-300 emails that I do at once. > > This fills up the inbound queue (looking at mailstats). It > > always takes a long time to get it emptied and processed, > > about 30min or a little longer. > > > > On normal operation, when I am not slamming it with 300 > > emails, it keeps up just fine. Mailwatch shows: > > Load Average: 5.12 4.84 4.49 > > > > I telnet in and "top", cpu usage isn't 100% all the time, > > average maybe 60-70. RAM is ok = about 700-800 used out of 1024. > > > > Common sense pretty much tells me that the machine is chuggin > > and just cannot keep up. Can anyone recommend any changes to > > speed up this machine with settings? > > > > 2. > > Also when I do this process. It seems that when the missed > > spam emails go through mailscanner again, some of it gets > > tagged as spam. Why would it get tagged as spam the second > > time and not the first time? > > > > You may be getting killed by disk IO. Have you tried mounting > /var/spool/MailScanner/incoming on a tmpfs? > > Mike I have not tried that. I would not have a clue as to how to do it. Any pointers? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! This message has been scanned for unacceptable content by 'VITANIUM' the industry leading email virus and content management service from Vitanium Systems. Contact details are available at www.vitanium.com. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From yossimor at HOTMAIL.COM Fri Aug 19 09:29:19 2005 From: yossimor at HOTMAIL.COM (Yossi Mor) Date: Thu Jan 12 21:30:36 2006 Subject: In hebrew emails mail scanner puts gibberish in the Subject line Message-ID: Julian good morning, Thank you for the patch i will try it at the beginning of the next week. I got few questions related to the patch: 1. Which version of MailScanner should i try the patch? 2. Just to make it clear - the patch should be copied to /usr/lib/MailScanner/MailScanner ? 3. Is there a special command to apply the patch or just 'tar -zxvf' and copy it to the location specified above? If that is ok with you i can send you an email in Hebrew from my home account to try in advance the work around and get your feedback. What do you think? May i suggest an improvement to the MailScanner. I think that MailScanner.conf should contain sections to control the Unicode of the subject line and the email body. If this functionality can be added, I think that it gain a better control to admin to adjust the Unicode of incoming emails to avoid such cases. Kindly regards, Yossi Mor On Fri, 19 Aug 2005 08:55:00 +0100, Julian Field wrote: >Please try out the attached short patch for Message.pm. > > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > >This may well fix the problem. > >On 16 Aug 2005, at 08:55, Julian Field wrote: > >> * PGP Signed: 08/16/05 at 08:55:20 >> >> Does anyone have accurate knowledge of: >> What was the last version that worked properly? >> What was the first version that changed Subject: to ######## ? >> >> Without this, I can't find the problem. >> >> On 16 Aug 2005, at 03:15, Alex Neuman van der Hans wrote: >> >> >>> How do you do this in Sendmail, exactly? I've got a client who >>> constantly >>> emails me saying "someguy@somewhere.com's mail scanning program >>> bounced my >>> mail, why?" and the bounce always says something about violating >>> RFC's by >>> using unquoted accented characters in the subject line. If I could >>> get >>> sendmail to sanitize the subject lines at least it would get rid >>> of the >>> bounces. >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> >> -- >> Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> >> * Julian Field >> * 0x1415B654 (L) >> >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > >-- >Julian Field >www.MailScanner.info >Buy the MailScanner book at www.MailScanner.info/store >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From yossimor at HOTMAIL.COM Fri Aug 19 09:36:12 2005 From: yossimor at HOTMAIL.COM (Yossi Mor) Date: Thu Jan 12 21:30:36 2006 Subject: In hebrew emails mail scanner puts gibberish in the Subject line Message-ID: Julian good morning, Thank you for the patch i will try it at the beginning of the next week. I got few questions related to the patch: 1. Which version of MailScanner should i try the patch? 2. Just to make it clear - the patch should be copied to /usr/lib/MailScanner/MailScanner ? 3. Is there a special command to apply the patch or just 'tar -zxvf' and copy it to the location specified above? If that is ok with you i can send you an email in Hebrew from my home account to try in advance the work around and get your feedback. What do you think? May i suggest an improvement to the MailScanner. I think that MailScanner.conf should contain sections to control the Unicode of the subject line and the email body. If this functionality can be added, I think that it gain a better control to admin to adjust the Unicode of incoming emails to avoid such cases. Kindly regards, Yossi Mor On Fri, 19 Aug 2005 08:55:00 +0100, Julian Field wrote: >Please try out the attached short patch for Message.pm. > > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > >This may well fix the problem. > >On 16 Aug 2005, at 08:55, Julian Field wrote: > >> * PGP Signed: 08/16/05 at 08:55:20 >> >> Does anyone have accurate knowledge of: >> What was the last version that worked properly? >> What was the first version that changed Subject: to ######## ? >> >> Without this, I can't find the problem. >> >> On 16 Aug 2005, at 03:15, Alex Neuman van der Hans wrote: >> >> >>> How do you do this in Sendmail, exactly? I've got a client who >>> constantly >>> emails me saying "someguy@somewhere.com's mail scanning program >>> bounced my >>> mail, why?" and the bounce always says something about violating >>> RFC's by >>> using unquoted accented characters in the subject line. If I could >>> get >>> sendmail to sanitize the subject lines at least it would get rid >>> of the >>> bounces. >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> >> -- >> Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> >> * Julian Field >> * 0x1415B654 (L) >> >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > >-- >Julian Field >www.MailScanner.info >Buy the MailScanner book at www.MailScanner.info/store >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > From yossimor at HOTMAIL.COM Fri Aug 19 09:37:36 2005 From: yossimor at HOTMAIL.COM (Yossi Mor) Date: Thu Jan 12 21:30:36 2006 Subject: In hebrew emails mail scanner puts gibberish in the Subject line Message-ID: Julian good morning, I resend it. Thank you for the patch i will try it at the beginning of the next week. I got few questions related to the patch: 1. Which version of MailScanner should i try the patch? 2. Just to make it clear - the patch should be copied to /usr/lib/MailScanner/MailScanner ? 3. Is there a special command to apply the patch or just 'tar -zxvf' and copy it to the location specified above? If that is ok with you i can send you an email in Hebrew from my home account to try in advance the work around and get your feedback. What do you think? May i suggest an improvement to the MailScanner. I think that MailScanner.conf should contain sections to control the Unicode of the subject line and the email body. If this functionality can be added, I think that it gain a better control to admin to adjust the Unicode of incoming emails to avoid such cases. Kindly regards, Yossi Mor On Fri, 19 Aug 2005 08:55:00 +0100, Julian Field wrote: >Please try out the attached short patch for Message.pm. > > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > >This may well fix the problem. > >On 16 Aug 2005, at 08:55, Julian Field wrote: > >> * PGP Signed: 08/16/05 at 08:55:20 >> >> Does anyone have accurate knowledge of: >> What was the last version that worked properly? >> What was the first version that changed Subject: to ######## ? >> >> Without this, I can't find the problem. >> >> On 16 Aug 2005, at 03:15, Alex Neuman van der Hans wrote: >> >> >>> How do you do this in Sendmail, exactly? I've got a client who >>> constantly >>> emails me saying "someguy@somewhere.com's mail scanning program >>> bounced my >>> mail, why?" and the bounce always says something about violating >>> RFC's by >>> using unquoted accented characters in the subject line. If I could >>> get >>> sendmail to sanitize the subject lines at least it would get rid >>> of the >>> bounces. >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> >> -- >> Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> >> * Julian Field >> * 0x1415B654 (L) >> >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > >-- >Julian Field >www.MailScanner.info >Buy the MailScanner book at www.MailScanner.info/store >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > From yossimor at HOTMAIL.COM Fri Aug 19 09:37:36 2005 From: yossimor at HOTMAIL.COM (Yossi Mor) Date: Thu Jan 12 21:30:36 2006 Subject: In hebrew emails mail scanner puts gibberish in the Subject line Message-ID: Julian good morning, I resend it. Thank you for the patch i will try it at the beginning of the next week. I got few questions related to the patch: 1. Which version of MailScanner should i try the patch? 2. Just to make it clear - the patch should be copied to /usr/lib/MailScanner/MailScanner ? 3. Is there a special command to apply the patch or just 'tar -zxvf' and copy it to the location specified above? If that is ok with you i can send you an email in Hebrew from my home account to try in advance the work around and get your feedback. What do you think? May i suggest an improvement to the MailScanner. I think that MailScanner.conf should contain sections to control the Unicode of the subject line and the email body. If this functionality can be added, I think that it gain a better control to admin to adjust the Unicode of incoming emails to avoid such cases. Kindly regards, Yossi Mor On Fri, 19 Aug 2005 08:55:00 +0100, Julian Field wrote: >Please try out the attached short patch for Message.pm. > > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > >This may well fix the problem. > >On 16 Aug 2005, at 08:55, Julian Field wrote: > >> * PGP Signed: 08/16/05 at 08:55:20 >> >> Does anyone have accurate knowledge of: >> What was the last version that worked properly? >> What was the first version that changed Subject: to ######## ? >> >> Without this, I can't find the problem. >> >> On 16 Aug 2005, at 03:15, Alex Neuman van der Hans wrote: >> >> >>> How do you do this in Sendmail, exactly? I've got a client who >>> constantly >>> emails me saying "someguy@somewhere.com's mail scanning program >>> bounced my >>> mail, why?" and the bounce always says something about violating >>> RFC's by >>> using unquoted accented characters in the subject line. If I could >>> get >>> sendmail to sanitize the subject lines at least it would get rid >>> of the >>> bounces. >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> >> -- >> Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> >> * Julian Field >> * 0x1415B654 (L) >> >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > >-- >Julian Field >www.MailScanner.info >Buy the MailScanner book at www.MailScanner.info/store >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Aug 19 10:14:01 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:36 2006 Subject: In hebrew emails mail scanner puts gibberish in the Subject line Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 19 Aug 2005, at 09:29, Yossi Mor wrote: > Julian good morning, > > Thank you for the patch i will try it at the beginning of the next > week. > > I got few questions related to the patch: > > 1. Which version of MailScanner should i try the patch? On any version that has the subroutine mentioned in the patch. > 2. Just to make it clear - the patch should be copied > to /usr/lib/MailScanner/MailScanner ? > 3. Is there a special command to apply the patch or just 'tar - > zxvf' and > copy it to the location specified above? No. You need to learn how to use "patch". Copy the Message.pm.patch.gz to /usr/lib/MailScanner/MailScanner/ gunzip Message.pm.patch.gz patch < Message.pm.patch The restart MailScanner as long as the patch command succeeded. > If that is ok with you i can send you an email in Hebrew from my home > account to try in advance the work around and get your feedback. > What do > you think? I haven't implemented the patch on my own systems, so I suggest you send the mail to yourself. > May i suggest an improvement to the MailScanner. I think that > MailScanner.conf should contain sections to control the Unicode of the > subject line and the email body. If this functionality can be added, I > think that it gain a better control to admin to adjust the Unicode of > incoming emails to avoid such cases. I am not sure that RFC822 and RFC2822 allow Unicode in subject lines. > > Kindly regards, > > Yossi Mor > > > On Fri, 19 Aug 2005 08:55:00 +0100, Julian Field > wrote: > > >> Please try out the attached short patch for Message.pm. >> >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> >> This may well fix the problem. >> >> On 16 Aug 2005, at 08:55, Julian Field wrote: >> >> >>>> Old Signed: 08/16/05 at 08:55:20 >>>> >>> >>> Does anyone have accurate knowledge of: >>> What was the last version that worked properly? >>> What was the first version that changed Subject: to ######## ? >>> >>> Without this, I can't find the problem. >>> >>> On 16 Aug 2005, at 03:15, Alex Neuman van der Hans wrote: >>> >>> >>> >>>> How do you do this in Sendmail, exactly? I've got a client who >>>> constantly >>>> emails me saying "someguy@somewhere.com's mail scanning program >>>> bounced my >>>> mail, why?" and the bounce always says something about violating >>>> RFC's by >>>> using unquoted accented characters in the subject line. If I could >>>> get >>>> sendmail to sanitize the subject lines at least it would get rid >>>> of the >>>> bounces. >>>> >>>> ------------------------ MailScanner list ------------------------ >>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>> 'leave mailscanner' in the body of the email. >>>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>>> >>> >>> -- >>> Julian Field >>> www.MailScanner.info >>> Buy the MailScanner book at www.MailScanner.info/store >>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>> >>> >>> * Julian Field >>> * 0x1415B654 (L) >>> >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> >> -- >> Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwWi3RH2WUcUFbZUEQJzmgCg1l+I5jGwtmjIJt7eRVh48vRvrUwAn1BG nKBwbXHnWRwU/W5vSjHyMKpP =wXq5 -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Q.G.Campbell at NEWCASTLE.AC.UK Fri Aug 19 10:15:52 2005 From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell) Date: Thu Jan 12 21:30:36 2006 Subject: Innovative use of MCP - how do I detect and flag certain languages? Message-ID: My question on how to detect and flag Russian (and other language) messages is at the end. The backgroud to the question is as follows: We are a large UK university covering areas of study/research which include Medicine, Agriculture, Engineering and Social Sciences. We also have a large number of overseas students who send/receive e-mail in foreign languages. This means that almost any word or language that commonly appears in real spam may also appear in many genuine messges relating received here. Some users here make unreasonable demands on the University to detect and remove centrally _all_ offensive spam e-mail or all, say, Russian language spam. As an alternative they expect to be able to detect and deal with it in their personal mail filters. We have operational problems doing either of these: 1. For the reasons given above, central detection and deletion is impossible without generating a large number of falsely positive tagged messages. 2. The bulk of our 20,000+ users use mailers that only allow filtering on text in the message headers, not the message body. This last problem is a real pain. It would be nice if users could simply auto-delete any message whose body contains words/languages to which they object and would not expect to see in genuine mail. The way I am dealing with this last problem is by using SpamAssassin rulessets in MCP to generate MCP_NCL_ALERT_* message headers that will appear in a received message if the message body contains certain "objectionable" words/phrases notified to me. The "*" in the header text is replaced by a range of specific "content type tags". All our users' personal mail filters can detect these MCP_NCL_ALERT_* strings in the message headers. This scheme works well enough but may not scale; however that is another matter. I want to extend this MCP detection scheme to use SpamAssassin rules to detect and flag mail whose message body is in particular languages. Russian is my current target. How do I do this? Using "ok_locales" and "ok_languages" does not appear to be appropriate in this context. Quentin --- PHONE: +44 191 222 8209 Information Systems and Services (ISS), University of Newcastle, Newcastle upon Tyne, FAX: +44 191 222 8765 United Kingdom, NE1 7RU. ------------------------------------------------------------------------ Any opinion expressed above is mine. The University can get its own. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From nerijus at USERS.SOURCEFORGE.NET Fri Aug 19 15:31:04 2005 From: nerijus at USERS.SOURCEFORGE.NET (Nerijus Baliunas) Date: Thu Jan 12 21:30:36 2006 Subject: kaspersky 5.5 Virusscan Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Thu, 18 Aug 2005 06:20:04 -0500 Dan wrote: > > > --- kaspersky-wrapper.orig 2005-08-03 21:33:28.000000000 +0300 > > > +++ kaspersky-wrapper 2005-08-18 01:36:39.079616824 +0300 > > > @@ -51,7 +51,7 @@ > > > > > > Args=`echo "$@" | sed -e 's/ -I/ -i/g; s/^-I/-i/g; s/-- / /g;'` > > > rm -f $Report > > > - ${PackageDir}/$Scanner $ScanOptions -o$Report -j3 -q "$@" > > > + ${PackageDir}/$Scanner $ScanOptions -o$Report -q "$@" > > > cat $Report > > > rm -f $Report > > > exit > > > > > > And Kaspersky 5.0 still works with this change, so it can be safelly > > > applied. > > > I tested with both archived and plain viruses. > > I used the attached patches on my system. So far it seems to be working fine. > I found that by making the one change listed above, MailScanner could not do > the auto update. > As well, I didn't want to break compatibility with older versions of > Kaspersky. Could you please be more clear? What "attached patches" did you use? The first patch, which patches more, or my patch, which just removes -j3? What Kaspersky version do you use - 5.0 or 5.5? What breaks auto update? Regards, Nerijus ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smlists at SHAW.CA Fri Aug 19 15:54:59 2005 From: smlists at SHAW.CA (Steve Mason) Date: Thu Jan 12 21:30:36 2006 Subject: mailwatch upgrade - MailScanner no longer logging to MySQL Message-ID: Mark Campbell wrote: > Hey Guys, > > I was trying to upgrade mailwatch(1.0.2) on a test box and now > MailScanner no longer can log messages to MySQL, I have ensured that I > have the latest CustomConfig and MailWatch pm files I get the following > errors: > > Aug 18 17:57:25 palprx01 MailScanner[17654]: Unable to initialise > database connection: Access denied for user: 'root@localhost' (Using > password: NO) > Aug 18 17:57:25 palprx01 MailScanner[17654]: Could not use Custom > Function code MailScanner::CustomConfig::InitMailWatchLogging, it could > not be "eval"ed. Make sure the module is correct with perl -wc > > I don't understand a) why it is trying to connect using root and > secondly why I cannot see that init mail watch > I just went through a similar experience. For the root@localhost, check the entry my($db_user) = in MailWatch.pm should be my($db_user) = 'mailwatch'; or whatever userid you created in your DB. For the other error, my problem turned out to be a missing library, DBD-MySQL even though the previous version had been working... Steve ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Fri Aug 19 16:12:18 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:36 2006 Subject: Problem with x86_64? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Seems all you need is to install Archive::Zip from CPAN. Try: # perl -MCPAN -e 'install Archive::Zip' And see what happens... You can also test for versions and presence of certain modules with MailScanner -V if I recall... -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Scott Hollomon Sent: Thursday, August 18, 2005 9:51 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Problem with x86_64? I am running fully updated CentOS 4 for x86_64 on a relatively clean install. I have installed Cyrus-IMAPD and sendmail using yum and have the two working sending and receiving mail.  I downloaded the Mailscanner install package and ran the installation.  All seemed to proceed normally, the vast majority of the packages tested ok and all of the rpm's seemed to compile and install, the mailscanner rpm did not complain when it installed. However, when I try and start Mailscanner with service MailScanner start I get the following: Starting MailScanner daemons:          incoming sendmail:                                [  OK  ]          outgoing sendmail:                                [  OK  ]          MailScanner:       Can't locate Archive/Zip.pm in @INC (@INC contains: /usr/lib/MailScanner /usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi /usr/lib/perl5/5.8.5 /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi /usr/lib64/perl5/site_perl/5.8.4/x86_64-linux-thread-multi /usr/lib64/perl5/site_perl/5.8.3/x86_64-linux-thread-multi /usr/lib64/perl5/site_perl/5.8.2/x86_64-linux-thread-multi /usr/lib64/perl5/site_perl/5.8.1/x86_64-linux-thread-multi /usr/lib64/perl5/site_perl/5.8.0/x86_64-linux-thread-multi /usr/lib/perl5/site_perl/5.8.5 /usr/lib/perl5/site_perl/5.8.4 /usr/lib/perl5/site_perl/5.8.3 /usr/lib/perl5/site_perl/5.8.2 /usr/lib/perl5/site_perl/5.8.1 /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl /usr/lib64/perl5/vendor_perl/5.8.5/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.4/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.3/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.2/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.1/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.0/x86_64-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.5 /usr/lib/perl5/vendor_perl/5.8.4 /usr/lib/perl5/vendor_perl/5.8.3 /usr/lib/perl5/vendor_perl/5.8.2 /usr/lib/perl5/vendor_perl/5.8.1 /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl . /usr/lib/MailScanner/5.8.5/x86_64-linux-thread-multi /usr/lib/MailScanner/5.8.5 /usr/lib/MailScanner/x86_64-linux-thread-multi /usr/lib/MailScanner/5.8.4 /usr/lib/MailScanner/5.8.3 /usr/lib/MailScanner/5.8.2 /usr/lib/MailScanner/5.8.1 /usr/lib/MailScanner/5.8.0 /usr/lib/MailScanner) at /usr/lib/MailScanner/MailScanner/Message.pm line 47. BEGIN failed--compilation aborted at /usr/lib/MailScanner/MailScanner/Message.pm line 47. Compilation failed in require at /usr/sbin/MailScanner line 75. BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 75.                                                            [  OK  ] I did not experience this when installing with the same OS i386 version on another machine.  I have googled this extensively and posted on the CentOS board with no response.  I have also attempted to rebuild the rpms with rpm-build and install them by hand.  This seemed to work but got the same result in the end. -- Scott ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Fri Aug 19 16:22:53 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:36 2006 Subject: Innovative use of MCP - how do I detect and flag certain languages? Message-ID: [ The following text is in the "windows-1251" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] How about using cyrillic-only characters in rules? I'm sure there's quite a lot of letters you could use in a regex that would indicate the message is in russian. Look for things like (hope this gets interpreted correctly) ¨^Ŕ^ÁŞ˝˛ŻŁ^Ę^Ě^Î^ÍĄ^ĎŔÁĂÄĆÇČÉĘËĎÓÔÖ×ŘŮŮÚŰÜÝŢßá -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Quentin Campbell Sent: Friday, August 19, 2005 4:16 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Innovative use of MCP - how do I detect and flag certain languages? My question on how to detect and flag Russian (and other language) messages is at the end. The backgroud to the question is as follows: We are a large UK university covering areas of study/research which include Medicine, Agriculture, Engineering and Social Sciences. We also have a large number of overseas students who send/receive e-mail in foreign languages. This means that almost any word or language that commonly appears in real spam may also appear in many genuine messges relating received here. Some users here make unreasonable demands on the University to detect and remove centrally _all_ offensive spam e-mail or all, say, Russian language spam. As an alternative they expect to be able to detect and deal with it in their personal mail filters. We have operational problems doing either of these: 1. For the reasons given above, central detection and deletion is impossible without generating a large number of falsely positive tagged messages. 2. The bulk of our 20,000+ users use mailers that only allow filtering on text in the message headers, not the message body. This last problem is a real pain. It would be nice if users could simply auto-delete any message whose body contains words/languages to which they object and would not expect to see in genuine mail. The way I am dealing with this last problem is by using SpamAssassin rulessets in MCP to generate MCP_NCL_ALERT_* message headers that will appear in a received message if the message body contains certain "objectionable" words/phrases notified to me. The "*" in the header text is replaced by a range of specific "content type tags". All our users' personal mail filters can detect these MCP_NCL_ALERT_* strings in the message headers. This scheme works well enough but may not scale; however that is another matter. I want to extend this MCP detection scheme to use SpamAssassin rules to detect and flag mail whose message body is in particular languages. Russian is my current target. How do I do this? Using "ok_locales" and "ok_languages" does not appear to be appropriate in this context. Quentin --- PHONE: +44 191 222 8209 Information Systems and Services (ISS), University of Newcastle, Newcastle upon Tyne, FAX: +44 191 222 8765 United Kingdom, NE1 7RU. ------------------------------------------------------------------------ Any opinion expressed above is mine. The University can get its own. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Fri Aug 19 16:48:40 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:36 2006 Subject: Phishing Trouble Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Attached is a patch for Message.pm which should stop this happening > again. Julian, Tried it yesterday and this morning my server had a huge backlog of messages in mqueue.in. I managed to single out some messages and ran MS in debug mode on them to get the following error: Unmatched ) in regex; marked by <-- HERE in m/^www\.mailscannersoupçonnelelien"www.ipm2005.fr) <-- HERE "/ at /usr/lib/MailScanner/MailScanner/Message.pm line 4954 and line 4954 is: if ($squashedtext =~ /^www\.$squashedpossible\"$linkurl\"/) { So I backed out of the patch and then the messages went by just fine. Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From bpumphrey at WOODMACLAW.COM Fri Aug 19 16:55:55 2005 From: bpumphrey at WOODMACLAW.COM (Billy A. Pumphrey) Date: Thu Jan 12 21:30:36 2006 Subject: Queue is slow to empty, and another thing Message-ID: > > 2. > Also when I do this process. It seems that when the missed spam emails > go through mailscanner again, some of it gets tagged as spam. Why would > it get tagged as spam the second time and not the first time? > > > > Billy Pumphrey > IT Manager > Wooden & McLaughlin > Thoughts?? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Aug 19 17:16:10 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:36 2006 Subject: Phishing Trouble Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 19 Aug 2005, at 16:48, Denis Beauchemin wrote: > * PGP Bad Signature, Signed by a unverified key > Julian Field wrote: > > >> Attached is a patch for Message.pm which should stop this >> happening again. >> > > Julian, > > Tried it yesterday and this morning my server had a huge backlog of > messages in mqueue.in. I managed to single out some messages and > ran MS in debug mode on them to get the following error: > Unmatched ) in regex; marked by <-- HERE in m/^www > \.mailscannersoupçonnelelien"www.ipm2005.fr) <-- HERE "/ at / > usr/lib/MailScanner/MailScanner/Message.pm line 4954 > > and line 4954 is: > if ($squashedtext =~ /^www\.$squashedpossible\"$linkurl\"/) { > > So I backed out of the patch and then the messages went by just fine. Sorry, I forgot to quotemeta the regexp. Change that bit of code so it looks like this instead: my $squashedpossible = lc($possiblefraudstart); $squashedpossible =~ s/\s//g; $squashedpossible =~ s/(\<\/?[^>]*\>)*//ig; # Remove tags $squashedpossible = "www.$squashedpossible\"$linkurl\""; $squashedpossible = quotemeta($squashedpossible); #print STDERR "NEW CODE: SquashedText = $squashedtext\n"; #print STDERR "NEW CODE: SquashedPossible = $squashedpossible\n"; #print STDERR "NEW CODE: LinkURL = $linkurl\n"; if ($squashedtext =~ /^$squashedpossible/) { #print STDERR "FOUND IT\n"; print "$DisarmLinkText$text"; $DisarmLinkText = ""; # Reset state of automaton return; } Then it should work rather better! Sorry about that, I wrote it in too much of a hurry :-( - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwYFzxH2WUcUFbZUEQKvqACg/TImPupNqq/zwd0iHNuGD40nv8oAoKV/ kUp/oOyUbGnVjdVPhL4TP8gB =o1i0 -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at YETICOMPUTERS.COM Fri Aug 19 17:57:31 2005 From: mailscanner at YETICOMPUTERS.COM (Rick Chadderdon) Date: Thu Jan 12 21:30:36 2006 Subject: Startup Problem Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Drew Marshall wrote: > On 18 Aug 2005, at 16:24, Rick Chadderdon wrote: > >> When I execute /opt/MailScanner/bin/check_mailscanner as root with: >> >> Run As User = postfix >> Run As Group = postfix >> >> in MailScanner.conf, I get the error: >> >> --- >> Starting MailScanner... >> Cannot open config file /opt/MailScanner/etc/MailScanner.conf, >> Permission >> denied at /opt/MailScanner/lib/MailScanner/Config.pm line 592. >> --- >> >> Seems easy enough, but I'm stuck. I've chowned >> /opt/MailScanner/etc/MailScanner.conf to postfix:postfix. I've >> chmodded the >> file all the way to 777 and done the same for every file and >> directory in >> the opt/MailScanner/ tree (including /opt/MailScanner). None of this >> helped, so I got more creative... > > > My MailScanner.conf is owned by root and sits with 644 permissions > and MailScanner is started by root. As part of it's start up it moves > to the Postfix user. > > Drew > Thanks, Drew. That's how mine installed by default. My problem is that something that happens when the program switches UID/GID is keeping it from opening the MailScanner.conf file regardless of the ownership or permissions of the file. I'm guessing that it's some kind of locking issue but I don't know where it is. Right now, the file is owned by root and is 644. I'm giving the postfix user a bash shell, using su -c to launch check_mailscanner as the postfix user and then removing the user's shell. It works this way, so I know that it's not a permission problem. This is not the most convenient way to launch MailScanner, however, so I'd like to find a better solution than scripting this workaround. I'm wondering whether Config.pm is locking MailScanner.conf exclusively (as root, since UID hasn't changed yet) while it's doing its QuickPeek and then the postfix user can't get through the lock... But, it doesn't seem as though if that were the case that it would be only affecting this machine. In any case, since I have a workaround it's becoming harder to get myself motivated to figure it out. It will slowly drive me insane, however. If additional info will help anyone else come up with ideas, I'm running kernel 2.6.12-gentoo-r9 (it was -r6 when I started), perl version 5.8.6, spamassassin version 3.0.4 and this is a fresh install from the latest tar file. I installed with the install.sh script and when that produced these problems I used emerge to replace the perl modules from the default Gentoo setup. After that failed to help I removed perl and rebuilt it and then installed the modules with cpan. Didn't help. I'm running out of things to try. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Fri Aug 19 20:01:18 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:36 2006 Subject: Phishing Trouble Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >On 19 Aug 2005, at 16:48, Denis Beauchemin wrote: > > > >>* PGP Bad Signature, Signed by a unverified key >>Julian Field wrote: >> >> >> >> >>>Attached is a patch for Message.pm which should stop this >>>happening again. >>> >>> >>> >>Julian, >> >>Tried it yesterday and this morning my server had a huge backlog of >>messages in mqueue.in. I managed to single out some messages and >>ran MS in debug mode on them to get the following error: >>Unmatched ) in regex; marked by <-- HERE in m/^www >>\.mailscannersoupçonnelelien"www.ipm2005.fr) <-- HERE "/ at / >>usr/lib/MailScanner/MailScanner/Message.pm line 4954 >> >>and line 4954 is: >> if ($squashedtext =~ /^www\.$squashedpossible\"$linkurl\"/) { >> >>So I backed out of the patch and then the messages went by just fine. >> >> > >Sorry, I forgot to quotemeta the regexp. > >Change that bit of code so it looks like this instead: > > my $squashedpossible = lc($possiblefraudstart); > $squashedpossible =~ s/\s//g; > $squashedpossible =~ s/(\<\/?[^>]*\>)*//ig; # Remove tags > $squashedpossible = "www.$squashedpossible\"$linkurl\""; > $squashedpossible = quotemeta($squashedpossible); > #print STDERR "NEW CODE: SquashedText = $squashedtext\n"; > #print STDERR "NEW CODE: SquashedPossible = $squashedpossible\n"; > #print STDERR "NEW CODE: LinkURL = $linkurl\n"; > if ($squashedtext =~ /^$squashedpossible/) { > #print STDERR "FOUND IT\n"; > print "$DisarmLinkText$text"; > $DisarmLinkText = ""; # Reset state of automaton > return; > } > >Then it should work rather better! >Sorry about that, I wrote it in too much of a hurry :-( > > Julian, So far so good. Thanks again! Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From naolson at GMAIL.COM Fri Aug 19 21:22:16 2005 From: naolson at GMAIL.COM (Nathan Olson) Date: Thu Jan 12 21:30:36 2006 Subject: Queue is slow to empty, and another thing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 8/19/05, Billy A. Pumphrey wrote: > 2. > Also when I do this process. It seems that when the missed spam > emails go through mailscanner again, some of it gets tagged as spam. Why > would it get tagged as spam the second time and not the first time? The message or URIs inside the message may have only recently been reported (if you're using network-based checks). Nate ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at BARENDSE.TO Sat Aug 20 11:47:04 2005 From: mailscanner at BARENDSE.TO (Remco Barendse) Date: Thu Jan 12 21:30:36 2006 Subject: mailscanner-mrtg-0.11 rpm small bug Message-ID: When installed the rpm doesn't create the uptime directory in /var/www/html/mailscanner-mrtg :) Cheers! Remco ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHT.IE Sat Aug 20 11:48:21 2005 From: michele at BLACKNIGHT.IE (Michele Neylon) Date: Thu Jan 12 21:30:36 2006 Subject: mailscanner-mrtg-0.11 rpm small bug Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Remco Barendse wrote: > When installed the rpm doesn't create the uptime directory in > /var/www/html/mailscanner-mrtg Why don't you tell the developer? That version is clearly marked as unstable. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ds at CARIBENET.COM Sat Aug 20 23:36:07 2005 From: ds at CARIBENET.COM (Dirk Enrique Seiffert) Date: Thu Jan 12 21:30:36 2006 Subject: (solved) oom-killer - Spamassassin timeout? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] El Dom 14 Ago 2005 12:57, Dirk Enrique Seiffert escribió: > I run MailScanner 4.43.8-1 with spamassasin 3.0.4-1.1 on SUSE Linux 9.3 > Profesional, kernel 2.6.11.4-21.8-smp. The machine is a Dual Xeon, Raid1, > 2G Memory, moves about 20.000 mails per day. After working well for about > 10 days the server runs out of Memory with a message like: After spending hours watching logs, googling and monitoring system state y figured out that saslauthd's memory load is growing permanantly. Just restarting sasluthd once in a few days keeps my server quiet. It looks like saslauthd or pam_mysql 0.6 have a memory leak. So: No problem of MailScanner at all, sorry for bothering this list and thanks a lot for your help! Best wishes Enrique -- Dirk Enrique Seiffert CaribeNet S.A. - Cartagena - Colombia www.caribenet.com -- Este mensaje ha sido analizado por MailScanner en busca de viruses y otros contenidos peligrosos, y se considera que est limpio. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mlm at LOANPROCESSING.NET Sun Aug 21 00:22:40 2005 From: mlm at LOANPROCESSING.NET (Mike McMullen) Date: Thu Jan 12 21:30:36 2006 Subject: OT: greylisting before rbls Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi All, I have greylisting running an a mail server that I also use rbls on. I'm running sendmail on an FC4 box. I've placed the necessary stuff for milter-greylist in my sendmail.mc. I've place that stuff ahead of the dnsbl entries. I thought that greylisting would happen before rbl testing. However watching my logs I see rejects from spamhause and spamcop showing up. Searching the log on the ip address used I don't see any greylisting messages for that address. However greylisting is working because I see messages showing greylisting going on. Long story short, how do I get milter-greylist invoked ahead of rbl queries? Thanks, Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mlm at LOANPROCESSING.NET Sun Aug 21 00:38:36 2005 From: mlm at LOANPROCESSING.NET (Mike McMullen) Date: Thu Jan 12 21:30:36 2006 Subject: greylisting before rbls Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] ----- Original Message ----- From: "Mike McMullen" To: Sent: Saturday, August 20, 2005 4:22 PM Subject: OT: greylisting before rbls > Hi All, > > > Long story short, how do I get milter-greylist invoked ahead of rbl queries? > I found the answer on another lsit. For those ignorant people like me the answer is to add FEATURE(delay_checks)dnl to your sendmail.mc file. Works like a champ! Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mlm at LOANPROCESSING.NET Sun Aug 21 03:30:24 2005 From: mlm at LOANPROCESSING.NET (Mike McMullen) Date: Thu Jan 12 21:30:36 2006 Subject: greylisting before rbls Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > ----- Original Message ----- > From: "Mike McMullen" > To: > Sent: Saturday, August 20, 2005 4:22 PM > Subject: OT: greylisting before rbls > > >> Hi All, >> >> >> Long story short, how do I get milter-greylist invoked ahead of rbl queries? >> > > I found the answer on another lsit. For those ignorant people like me the > answer is to add FEATURE(delay_checks)dnl to your sendmail.mc > file. > > Works like a champ! > > Mike > Maybe I spoke too soon on this working. I added the delay_checks (actually uncommented it) in the sendmail.mc file. I then ran make on it. Saw that sendmail.cf was indeed created. I then restarted my MailScanner and saw greylisting happening first. However, I am still seeing 553 reject messages. If I go back and grep through the maillog on the IP or server name I don't see any greylisting entry. What am I missing here? Thanks, Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jeff.Mills at POCOLD.COM.AU Sun Aug 21 08:04:35 2005 From: Jeff.Mills at POCOLD.COM.AU (Jeff Mills) Date: Thu Jan 12 21:30:36 2006 Subject: help with mcp setup Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi all, I've got MCP setup and working for single profain words in the body of emails, but I'm trying to set up some testing on subjects and cant seem to work it out. I had a read of the man page and looked at the *.cf files in /usr/share/spamassassin. In the example below: header SUBJECT_LOAN2 Subject =~ /Pre-approved\s+Application/i describe SUBJECT_LOAN2 Banned Subject Pre-approved Application score SUBJECT_LOAN2 30 I tried sending myself an email with the subject "Pre-approved Application" and this was allowed through. Should the above config have stopped it? I just did a test by using the body check rather than header check, and it was picked up, even though the words were in the subject, not the body. Is this normal? Does anyone know of a resource to learn more about these expressions that spamassassin uses? Cheers, Jeff ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner-user at NELAND.DK Sun Aug 21 08:11:06 2005 From: mailscanner-user at NELAND.DK (Leif Neland) Date: Thu Jan 12 21:30:36 2006 Subject: greylisting before rbls Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > Maybe I spoke too soon on this working. I added the delay_checks > (actually uncommented it) > in the sendmail.mc file. I then ran make on it. Saw that sendmail.cf > was indeed created. I then restarted my MailScanner and saw > greylisting happening first. However, I am still seeing 553 reject > messages. If I go back and grep through the maillog on the IP or > server name Did you restart Sendmail too? Leif -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mlm at LOANPROCESSING.NET Sun Aug 21 08:45:24 2005 From: mlm at LOANPROCESSING.NET (Mike McMullen) Date: Thu Jan 12 21:30:36 2006 Subject: greylisting before rbls Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] ----- Original Message ----- From: "Leif Neland" To: Sent: Sunday, August 21, 2005 12:11 AM Subject: Re: greylisting before rbls >> Maybe I spoke too soon on this working. I added the delay_checks >> (actually uncommented it) >> in the sendmail.mc file. I then ran make on it. Saw that sendmail.cf >> was indeed created. I then restarted my MailScanner and saw >> greylisting happening first. However, I am still seeing 553 reject >> messages. If I go back and grep through the maillog on the IP or >> server name > > Did you restart Sendmail too? > > Leif > restarting Mailscanner service restarts sendmail as well. Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From KevinS at BMRB.CO.UK Sun Aug 21 11:50:28 2005 From: KevinS at BMRB.CO.UK (Spicer, Kevin) Date: Thu Jan 12 21:30:36 2006 Subject: mailscanner-mrtg-0.11 rpm small bug Message-ID: Remco, Its best to report MailScanner-MRTG stuff through the forums on the sourceforge site. As it happens I've already fixed this bug in CVS, the problem isn't failure to create an uptime directory (there should not be one) but rather it is trying to write an unnecessary file. Internally uptime is stored in the same way as the other measurements and when it came to writing some information out to disk I neglected to exclude uptime from the loop. Thanks for testing! Kevin -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Michele Neylon Sent: 20 August 2005 11:48 To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: mailscanner-mrtg-0.11 rpm small bug Remco Barendse wrote: > When installed the rpm doesn't create the uptime directory in > /var/www/html/mailscanner-mrtg Why don't you tell the developer? That version is clearly marked as unstable. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ================================================================= BMRB http://www.bmrb.co.uk _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner-user at NELAND.DK Sun Aug 21 16:18:48 2005 From: mailscanner-user at NELAND.DK (Leif Neland) Date: Thu Jan 12 21:30:36 2006 Subject: greylisting before rbls Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mike McMullen wrote: > ----- Original Message ----- > From: "Leif Neland" > To: > Sent: Sunday, August 21, 2005 12:11 AM > Subject: Re: greylisting before rbls > > >>> Maybe I spoke too soon on this working. I added the delay_checks >>> (actually uncommented it) >>> in the sendmail.mc file. I then ran make on it. Saw that sendmail.cf >>> was indeed created. I then restarted my MailScanner and saw >>> greylisting happening first. However, I am still seeing 553 reject >>> messages. If I go back and grep through the maillog on the IP or >>> server name >> >> Did you restart Sendmail too? >> >> Leif >> > restarting Mailscanner service restarts sendmail as well. Must be some special setup then. My setup doesn't restart sendmail when I restart MailScanner. Leif > > Mike > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sun Aug 21 16:26:20 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:36 2006 Subject: greylisting before rbls Message-ID: [ The following text is in the "windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Leif Neland wrote: > Mike McMullen wrote: > >> ----- Original Message ----- >> From: "Leif Neland" >> To: >> Sent: Sunday, August 21, 2005 12:11 AM >> Subject: Re: greylisting before rbls >> >> >>>> Maybe I spoke too soon on this working. I added the delay_checks >>>> (actually uncommented it) >>>> in the sendmail.mc file. I then ran make on it. Saw that sendmail.cf >>>> was indeed created. I then restarted my MailScanner and saw >>>> greylisting happening first. However, I am still seeing 553 reject >>>> messages. If I go back and grep through the maillog on the IP or >>>> server name >>> >>> >>> Did you restart Sendmail too? >>> >>> Leif >>> >> restarting Mailscanner service restarts sendmail as well. > > > Must be some special setup then. My setup doesn't restart sendmail > when I restart MailScanner. What OS and distribution are you using? The Linux distributions certainly start and stop sendmail as appropriate. They print out that when you run them. What output do you get when you restart MailScanner? How do you restart MailScanner? -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner-user at NELAND.DK Sun Aug 21 16:52:55 2005 From: mailscanner-user at NELAND.DK (Leif Neland) Date: Thu Jan 12 21:30:36 2006 Subject: greylisting before rbls Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Leif Neland wrote: > >> Mike McMullen wrote: >>> restarting Mailscanner service restarts sendmail as well. >> Must be some special setup then. My setup doesn't restart sendmail >> when I restart MailScanner. > > What OS and distribution are you using? The Linux distributions > certainly start and stop sendmail as appropriate. They print out that > when you run them. What output do you get when you restart > MailScanner? How do you restart MailScanner? FreeBSD. bash-2.05b# /usr/local/etc/rc.d/mailscanner.sh restart Stopping MailScanner... Starting MailScanner... bash-2.05b# Leif -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sun Aug 21 17:00:05 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:36 2006 Subject: greylisting before rbls Message-ID: [ The following text is in the "windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Leif Neland wrote: > Julian Field wrote: > >> Leif Neland wrote: >> >>> Mike McMullen wrote: >> > >>>> restarting Mailscanner service restarts sendmail as well. >>> > >>> Must be some special setup then. My setup doesn't restart sendmail >>> when I restart MailScanner. >> >> >> What OS and distribution are you using? The Linux distributions >> certainly start and stop sendmail as appropriate. They print out that >> when you run them. What output do you get when you restart >> MailScanner? How do you restart MailScanner? > > > FreeBSD. > > bash-2.05b# /usr/local/etc/rc.d/mailscanner.sh restart > Stopping MailScanner... > Starting MailScanner... > bash-2.05b# Ah, yes, the BSD port does require you to start+stop sendmail separately from MailScanner. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bsnottum at HKSKOLE.NO Sun Aug 21 17:06:17 2005 From: bsnottum at HKSKOLE.NO (Bj[ISO-8859-1] řrn-Sverre Nřttum) Date: Thu Jan 12 21:30:36 2006 Subject: Mailscanner and Spamassassin Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hallo! I posted a message a few days ago about problems regarding my mailgateway fc3, sendmail, clamav, spamassassin and mailscanner. I am running a fedora core 3 server. This comes with both sendmail(8.12.11, config V10/Berkeley) and spamassassin(3.0.4) already installed. I have installes clamav(0.85 ClamAV 0.85 / wbmclamav 0.6.0) myself from rpm. No the mailscanner works well when it comes to virus control. I have tried to send for instance eicar, but this is stopped by the mailgateway. My problem now is that the messages are not scanned for spam. Even thou mailscanner is set up to use spamassassin, and spamassassin i s activated, there is nothing in the mailheaders to indicate that the mails are scanned for spam. Spamassassin is configured (this is done in the server installation) to work with procmail, so maybe the problem lies here. If so, how can I change this? Sincerely Bjorn ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sun Aug 21 17:44:23 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:36 2006 Subject: Mailscanner and Spamassassin Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Bjřrn-Sverre Nřttum wrote: >I am running a fedora core 3 server. This comes with both >sendmail(8.12.11, config V10/Berkeley) and spamassassin(3.0.4) already >installed. I have installes clamav(0.85 ClamAV 0.85 / wbmclamav 0.6.0) >myself from rpm. > >No the mailscanner works well when it comes to virus control. I have tried >to send for instance eicar, but this is stopped by the mailgateway. > >My problem now is that the messages are not scanned for spam. Even thou >mailscanner is set up to use spamassassin, and spamassassin i s activated, >there is nothing in the mailheaders to indicate that the mails are scanned >for spam. > >Spamassassin is configured (this is done in the server installation) to >work with procmail, so maybe the problem lies here. If so, how can I >change this? > > You don't need (or want) SpamAssassin to be running with procmail, or be running as a daemon or anything like that. So you can chkconfig spamassassin off service spamassassin stop as those will just be causing extra overhead. Also remove SpamAssassin from your procmail setup. All you need is to put Use SpamAssassin = yes in your /etc/MailScanner/MailScanner.conf file. Personally, rather than use the RPM of ClamAV or SpamAssassin, I download and install the Clam+SA package mentioned at the bottom of the MailScanner downloads page (but there again I would, wouldn't I :-) Then stop MailScanner, put it into Debug mode and check that it is starting up okay. You can do this by: service MailScanner stop Set Debug = yes in /etc/MailScanner/MailScanner.conf, and run the check_MailScanner command to try it out with 1 batch of messages. You will need to have a few messages sitting in your mqueue.in ideally. It should print out a few lines of output, and no error messages. Post here any error messages you get and we will be able to see what is going on. To put it back into normal non-debug mode, set Debug = no in /etc/MailScanner/MailScanner.conf and run service MailScanner restart to properly shut it down and restart it afterwards. You should also ensure you have Log Spam = yes Always Include SpamAssassin Report = yes in your MailScanner.conf to be sure you get all the reports. You should be able to see the spam headers in the full headers of any email processed by it, and you should get spam reports in the maillog. Hopefully that lot will reveal some information to you. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Sun Aug 21 19:43:18 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:30:36 2006 Subject: greylisting before rbls Message-ID: On 21 Aug 2005, at 17:00, Julian Field wrote: >> FreeBSD. >> >> bash-2.05b# /usr/local/etc/rc.d/mailscanner.sh restart >> Stopping MailScanner... >> Starting MailScanner... >> bash-2.05b# >> > > Ah, yes, the BSD port does require you to start+stop sendmail > separately from MailScanner. And personally, I prefer it. My 2p Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From micoots at YAHOO.COM Mon Aug 22 04:00:52 2005 From: micoots at YAHOO.COM (Michael Mansour) Date: Thu Jan 12 21:30:36 2006 Subject: razor-agents with MailScanner Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, I've installed and used the razor-agents RPM: # rpm -q razor-agents razor-agents-2.75-12.rhfc1.at from the ATRPMS repo, and have noticed that while running it with MailScanner, it creates both /.razor and /root/.razor directories with associated files. Reading the man page on razor-agent.conf, I can specify a "razorhome" variable in the conf file, which I've done, but I'm not sure where to put this conf file so it's actually read by razor? I tried putting it in /etc but to no avail. So basically, I have no idea where to put this razor-agent.conf file so that razor can read it when it runs? Note that I use MailScanner to do all my mailscanning, and razor is used (enabled) under the /etc/MailScanner/spam.assassin.prefs file, so that when a SA check is done, the razor command is run to check the email. Any ideas anyone? Michael. Send instant messages to your online friends http://au.messenger.yahoo.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From vlad at MAZEK.COM Mon Aug 22 04:01:10 2005 From: vlad at MAZEK.COM (Vlad Mazek) Date: Thu Jan 12 21:30:36 2006 Subject: OT: spamassassin/mailscanner subject rule Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Here is what I would like to do for our setup and I hope someone has already gone through it so I'm willing to take any suggestions on how to write the rule and any feedback on things to watch out for. I would like to assign a high score to all mail whose subject includes any characters not found on the US keyboard, for example, only allow things like (1234567890-=qwertyuiop[]adgjkl;'zxcvn,./!@#$%&*()_+QWERTYUIOP{}ASDFGHJKL:"ZXCVBM<>>?) and if anything else is found (ie: CIAíS VIAGRRâ) and such, assign a high score to it. Any ideas? -Vlad ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From naolson at GMAIL.COM Mon Aug 22 04:49:47 2005 From: naolson at GMAIL.COM (Nathan Olson) Date: Thu Jan 12 21:30:36 2006 Subject: razor-agents with MailScanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 8/21/05, Michael Mansour wrote: > Hi, > > I've installed and used the razor-agents RPM: > > # rpm -q razor-agents > razor-agents-2.75-12.rhfc1.at > > from the ATRPMS repo, and have noticed that while > running it with MailScanner, it creates both /.razor > and /root/.razor directories with associated files. > It shouldn't create both directories. /root/.razor is fairly normal. You may want to check the source rpm to verify that it doesn't create spurious .razor directories. Are you sure it didn't install a razor-agent.conf? Do a 'find / -name razor-agent.conf'. Where it looks for razor-agent.conf is specified here: http://razor.sourceforge.net/docs/doc.php?type=pod&name=razor-agents Nate ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From micoots at YAHOO.COM Mon Aug 22 05:23:25 2005 From: micoots at YAHOO.COM (Michael Mansour) Date: Thu Jan 12 21:30:36 2006 Subject: razor-agents with MailScanner Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi Nathan, > > Hi, > > > > I've installed and used the razor-agents RPM: > > > > # rpm -q razor-agents > > razor-agents-2.75-12.rhfc1.at > > > > from the ATRPMS repo, and have noticed that while > > running it with MailScanner, it creates both > /.razor > > and /root/.razor directories with associated > files. > > It shouldn't create both directories. /root/.razor > is fairly normal. > You may want to check the source rpm to verify that > it doesn't > create spurious .razor directories. The listing of the RPM is: # rpm -ql razor-agents /usr/bin/razor-admin /usr/bin/razor-check /usr/bin/razor-client /usr/bin/razor-report /usr/bin/razor-revoke /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2 /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/Client /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/Client/Agent.pm /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/Client/Config.pm /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/Client/Core.pm /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/Client/Engine.pm /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/Client/Version.pm /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/Engine /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/Engine/VR8.pm /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/Errorhandler.pm /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/Logger.pm /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/Preproc /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/Preproc/Manager.pm /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/Preproc/deBase64.pm /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/Preproc/deHTML.pm /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/Preproc/deHTML_comment.pm /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/Preproc/deHTMLxs.pm /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/Preproc/deNewline.pm /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/Preproc/deQP.pm /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/Preproc/enBase64.pm /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/Signature /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/Signature/Ephemeral.pm /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/Signature/Whiplash.pm /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/String.pm /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/Razor2/Syslog.pm /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/auto/Razor2 /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/auto/Razor2/Preproc /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/auto/Razor2/Preproc/deHTMLxs /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/auto/Razor2/Preproc/deHTMLxs/autosplit.ix /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/auto/Razor2/Preproc/deHTMLxs/deHTMLxs.so /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/auto/Razor2/Syslog /usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi/auto/Razor2/Syslog/autosplit.ix /usr/share/doc/razor-agents-2.75 /usr/share/doc/razor-agents-2.75/FAQ /usr/share/doc/razor-agents-2.75/MANIFEST /usr/share/doc/razor-agents-2.75/README /usr/share/man/man1/razor-admin.1.gz /usr/share/man/man1/razor-check.1.gz /usr/share/man/man1/razor-report.1.gz /usr/share/man/man1/razor-revoke.1.gz /usr/share/man/man3/Razor2::Errorhandler.3pm.gz /usr/share/man/man3/Razor2::Preproc::deHTMLxs.3pm.gz /usr/share/man/man3/Razor2::Syslog.3pm.gz /usr/share/man/man5/razor-agent.conf.5.gz /usr/share/man/man5/razor-agents.5.gz /usr/share/man/man5/razor-whitelist.5.gz > Are you sure it didn't install a razor-agent.conf? There's nothing in the RPM which shows that a razor-agent.conf file is packaged with it. > Do a 'find / -name razor-agent.conf'. Yep, no razor-agent.conf file on any of the systems I installed this on (2 production, 1 test). > Where it looks for razor-agent.conf is specified > here: >http://razor.sourceforge.net/docs/doc.php?type=pod&name=razor-agents That does explain it more, but Axel (Axel Thimm of ATRPMS) hasn't seemed to package this within his RPM release. I've just emailed the atrpms users list with this query too. I also noticed that Dag packages it too: razor-agents noarch 2.40-1.rhfc1.dag dag but with an older version. Thanks Nate. Michael. > Nate > > ------------------------ MailScanner list > ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with > the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki > (http://wiki.mailscanner.info/) and > the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off > the website! > Send instant messages to your online friends http://au.messenger.yahoo.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From naolson at GMAIL.COM Mon Aug 22 05:39:10 2005 From: naolson at GMAIL.COM (Nathan Olson) Date: Thu Jan 12 21:30:36 2006 Subject: razor-agents with MailScanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Is there anything in the post install section? In our home-grown RPM I run razor-admin to create the initial /root/.razor directory (and associated files). Nate ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From yossimor at HOTMAIL.COM Mon Aug 22 07:14:12 2005 From: yossimor at HOTMAIL.COM (Yossi Mor) Date: Thu Jan 12 21:30:36 2006 Subject: In hebrew emails mail scanner puts gibberish in the Subject line Message-ID: Julian Good morning, It seems that the patch did not resolve the issue. I have also tried to use Message.pm from older version of MailScanner (4.32.5-1) but MAilScanner service failed to restart. Is there any valuable information that i can provide you in order to escalate the issue? I am going to to examine several recipients that receive those gibberish emails. Is there any info that i can provide from that point (Unicode)? Regards, Yossi On Fri, 19 Aug 2005 10:14:01 +0100, Julian Field wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > > >On 19 Aug 2005, at 09:29, Yossi Mor wrote: > >> Julian good morning, >> >> Thank you for the patch i will try it at the beginning of the next >> week. >> >> I got few questions related to the patch: >> >> 1. Which version of MailScanner should i try the patch? > >On any version that has the subroutine mentioned in the patch. > >> 2. Just to make it clear - the patch should be copied >> to /usr/lib/MailScanner/MailScanner ? >> 3. Is there a special command to apply the patch or just 'tar - >> zxvf' and >> copy it to the location specified above? > >No. You need to learn how to use "patch". > >Copy the Message.pm.patch.gz to /usr/lib/MailScanner/MailScanner/ >gunzip Message.pm.patch.gz >patch < Message.pm.patch > >The restart MailScanner as long as the patch command succeeded. > >> If that is ok with you i can send you an email in Hebrew from my home >> account to try in advance the work around and get your feedback. >> What do >> you think? > >I haven't implemented the patch on my own systems, so I suggest you >send the mail to yourself. > >> May i suggest an improvement to the MailScanner. I think that >> MailScanner.conf should contain sections to control the Unicode of the >> subject line and the email body. If this functionality can be added, I >> think that it gain a better control to admin to adjust the Unicode of >> incoming emails to avoid such cases. > >I am not sure that RFC822 and RFC2822 allow Unicode in subject lines. > > >> >> Kindly regards, >> >> Yossi Mor >> >> >> On Fri, 19 Aug 2005 08:55:00 +0100, Julian Field >> wrote: >> >> >>> Please try out the attached short patch for Message.pm. >>> >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >>> This may well fix the problem. >>> >>> On 16 Aug 2005, at 08:55, Julian Field wrote: >>> >>> >>>>> Old Signed: 08/16/05 at 08:55:20 >>>>> >>>> >>>> Does anyone have accurate knowledge of: >>>> What was the last version that worked properly? >>>> What was the first version that changed Subject: to ######## ? >>>> >>>> Without this, I can't find the problem. >>>> >>>> On 16 Aug 2005, at 03:15, Alex Neuman van der Hans wrote: >>>> >>>> >>>> >>>>> How do you do this in Sendmail, exactly? I've got a client who >>>>> constantly >>>>> emails me saying "someguy@somewhere.com's mail scanning program >>>>> bounced my >>>>> mail, why?" and the bounce always says something about violating >>>>> RFC's by >>>>> using unquoted accented characters in the subject line. If I could >>>>> get >>>>> sendmail to sanitize the subject lines at least it would get rid >>>>> of the >>>>> bounces. >>>>> >>>>> ------------------------ MailScanner list ------------------------ >>>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>> 'leave mailscanner' in the body of the email. >>>>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>> >>>>> Support MailScanner development - buy the book off the website! >>>>> >>>>> >>>>> >>>> >>>> -- >>>> Julian Field >>>> www.MailScanner.info >>>> Buy the MailScanner book at www.MailScanner.info/store >>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>>> >>>> >>>> * Julian Field >>>> * 0x1415B654 (L) >>>> >>>> >>>> ------------------------ MailScanner list ------------------------ >>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>> 'leave mailscanner' in the body of the email. >>>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>> >>> -- >>> Julian Field >>> www.MailScanner.info >>> Buy the MailScanner book at www.MailScanner.info/store >>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>> >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > >- -- >Julian Field >www.MailScanner.info >Buy the MailScanner book at www.MailScanner.info/store >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > >-----BEGIN PGP SIGNATURE----- >Version: PGP Desktop 9.0.2 (Build 2425) > >iQA/AwUBQwWi3RH2WUcUFbZUEQJzmgCg1l+I5jGwtmjIJt7eRVh48vRvrUwAn1BG >nKBwbXHnWRwU/W5vSjHyMKpP >=wXq5 >-----END PGP SIGNATURE----- > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! >========================================================================= From yossimor at HOTMAIL.COM Mon Aug 22 07:14:12 2005 From: yossimor at HOTMAIL.COM (Yossi Mor) Date: Thu Jan 12 21:30:36 2006 Subject: In hebrew emails mail scanner puts gibberish in the Subject line Message-ID: Julian Good morning, It seems that the patch did not resolve the issue. I have also tried to use Message.pm from older version of MailScanner (4.32.5-1) but MAilScanner service failed to restart. Is there any valuable information that i can provide you in order to escalate the issue? I am going to to examine several recipients that receive those gibberish emails. Is there any info that i can provide from that point (Unicode)? Regards, Yossi On Fri, 19 Aug 2005 10:14:01 +0100, Julian Field wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > > >On 19 Aug 2005, at 09:29, Yossi Mor wrote: > >> Julian good morning, >> >> Thank you for the patch i will try it at the beginning of the next >> week. >> >> I got few questions related to the patch: >> >> 1. Which version of MailScanner should i try the patch? > >On any version that has the subroutine mentioned in the patch. > >> 2. Just to make it clear - the patch should be copied >> to /usr/lib/MailScanner/MailScanner ? >> 3. Is there a special command to apply the patch or just 'tar - >> zxvf' and >> copy it to the location specified above? > >No. You need to learn how to use "patch". > >Copy the Message.pm.patch.gz to /usr/lib/MailScanner/MailScanner/ >gunzip Message.pm.patch.gz >patch < Message.pm.patch > >The restart MailScanner as long as the patch command succeeded. > >> If that is ok with you i can send you an email in Hebrew from my home >> account to try in advance the work around and get your feedback. >> What do >> you think? > >I haven't implemented the patch on my own systems, so I suggest you >send the mail to yourself. > >> May i suggest an improvement to the MailScanner. I think that >> MailScanner.conf should contain sections to control the Unicode of the >> subject line and the email body. If this functionality can be added, I >> think that it gain a better control to admin to adjust the Unicode of >> incoming emails to avoid such cases. > >I am not sure that RFC822 and RFC2822 allow Unicode in subject lines. > > >> >> Kindly regards, >> >> Yossi Mor >> >> >> On Fri, 19 Aug 2005 08:55:00 +0100, Julian Field >> wrote: >> >> >>> Please try out the attached short patch for Message.pm. >>> >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >>> This may well fix the problem. >>> >>> On 16 Aug 2005, at 08:55, Julian Field wrote: >>> >>> >>>>> Old Signed: 08/16/05 at 08:55:20 >>>>> >>>> >>>> Does anyone have accurate knowledge of: >>>> What was the last version that worked properly? >>>> What was the first version that changed Subject: to ######## ? >>>> >>>> Without this, I can't find the problem. >>>> >>>> On 16 Aug 2005, at 03:15, Alex Neuman van der Hans wrote: >>>> >>>> >>>> >>>>> How do you do this in Sendmail, exactly? I've got a client who >>>>> constantly >>>>> emails me saying "someguy@somewhere.com's mail scanning program >>>>> bounced my >>>>> mail, why?" and the bounce always says something about violating >>>>> RFC's by >>>>> using unquoted accented characters in the subject line. If I could >>>>> get >>>>> sendmail to sanitize the subject lines at least it would get rid >>>>> of the >>>>> bounces. >>>>> >>>>> ------------------------ MailScanner list ------------------------ >>>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>> 'leave mailscanner' in the body of the email. >>>>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>> >>>>> Support MailScanner development - buy the book off the website! >>>>> >>>>> >>>>> >>>> >>>> -- >>>> Julian Field >>>> www.MailScanner.info >>>> Buy the MailScanner book at www.MailScanner.info/store >>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>>> >>>> >>>> * Julian Field >>>> * 0x1415B654 (L) >>>> >>>> >>>> ------------------------ MailScanner list ------------------------ >>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>> 'leave mailscanner' in the body of the email. >>>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>> >>> -- >>> Julian Field >>> www.MailScanner.info >>> Buy the MailScanner book at www.MailScanner.info/store >>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>> >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > >- -- >Julian Field >www.MailScanner.info >Buy the MailScanner book at www.MailScanner.info/store >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > >-----BEGIN PGP SIGNATURE----- >Version: PGP Desktop 9.0.2 (Build 2425) > >iQA/AwUBQwWi3RH2WUcUFbZUEQJzmgCg1l+I5jGwtmjIJt7eRVh48vRvrUwAn1BG >nKBwbXHnWRwU/W5vSjHyMKpP >=wXq5 >-----END PGP SIGNATURE----- > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! >========================================================================= ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rabellino at DI.UNITO.IT Mon Aug 22 10:04:09 2005 From: rabellino at DI.UNITO.IT (Rabellino Sergio) Date: Thu Jan 12 21:30:37 2006 Subject: Disarmed Content quarantine Message-ID: Dear list, i cannot figure out if a "DISARMED CONTENT" can be quarantined. The original email is changed, so if an user (or better the law) wants the original message delivered later, I'vent a copy. How could this be done ? Tks. P.s. For JFK: I've applied the latest patch to message.pm for the phishing trouble. -- Dott. Mag. Sergio Rabellino Technical Staff Department of Computer Science University of Torino (Italy) http://www.di.unito.it/~rabser Tel. +39-0116706701 Fax. +39-011751603 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Mon Aug 22 16:37:55 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:37 2006 Subject: Phishing Trouble Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >On 19 Aug 2005, at 16:48, Denis Beauchemin wrote: > > > >>* PGP Bad Signature, Signed by a unverified key >>Julian Field wrote: >> >> >> >> >>>Attached is a patch for Message.pm which should stop this >>>happening again. >>> >>> >>> >>Julian, >> >>Tried it yesterday and this morning my server had a huge backlog of >>messages in mqueue.in. I managed to single out some messages and >>ran MS in debug mode on them to get the following error: >>Unmatched ) in regex; marked by <-- HERE in m/^www >>\.mailscannersoupçonnelelien"www.ipm2005.fr) <-- HERE "/ at / >>usr/lib/MailScanner/MailScanner/Message.pm line 4954 >> >>and line 4954 is: >> if ($squashedtext =~ /^www\.$squashedpossible\"$linkurl\"/) { >> >>So I backed out of the patch and then the messages went by just fine. >> >> > >Sorry, I forgot to quotemeta the regexp. > >Change that bit of code so it looks like this instead: > > my $squashedpossible = lc($possiblefraudstart); > $squashedpossible =~ s/\s//g; > $squashedpossible =~ s/(\<\/?[^>]*\>)*//ig; # Remove tags > $squashedpossible = "www.$squashedpossible\"$linkurl\""; > $squashedpossible = quotemeta($squashedpossible); > #print STDERR "NEW CODE: SquashedText = $squashedtext\n"; > #print STDERR "NEW CODE: SquashedPossible = $squashedpossible\n"; > #print STDERR "NEW CODE: LinkURL = $linkurl\n"; > if ($squashedtext =~ /^$squashedpossible/) { > #print STDERR "FOUND IT\n"; > print "$DisarmLinkText$text"; > $DisarmLinkText = ""; # Reset state of automaton > return; > } > >Then it should work rather better! >Sorry about that, I wrote it in too much of a hurry :-( > > > Julian, Tested the patch by emailing back the same message twice and I got the following: MailScanner soupçonne le lien "www.usherbrooke.ca" d'être une tentative de fraude de la part de MailScanner soupçonne le lien "www.usherbrooke.ca" d'être une tentative de fraude de la part de www.abc.com
As you can see the text is there twice... so I guess the patch doesn't work... :-( Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Aug 22 16:57:18 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:37 2006 Subject: Phishing Trouble Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 22 Aug 2005, at 16:37, Denis Beauchemin wrote: > Julian Field wrote: > > >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> On 19 Aug 2005, at 16:48, Denis Beauchemin wrote: >> >> >> >>> * PGP Bad Signature, Signed by a unverified key >>> Julian Field wrote: >>> >>> >>> >>> >>>> Attached is a patch for Message.pm which should stop this >>>> happening again. >>>> >>>> >>>> >>> Julian, >>> >>> Tried it yesterday and this morning my server had a huge backlog >>> of messages in mqueue.in. I managed to single out some messages >>> and ran MS in debug mode on them to get the following error: >>> Unmatched ) in regex; marked by <-- HERE in m/^www >>> \.mailscannersoupçonnelelien"www.ipm2005.fr) <-- HERE "/ >>> at / usr/lib/MailScanner/MailScanner/Message.pm line 4954 >>> >>> and line 4954 is: >>> if ($squashedtext =~ /^www\.$squashedpossible\"$linkurl\"/) { >>> >>> So I backed out of the patch and then the messages went by just >>> fine. >>> >>> >> >> Sorry, I forgot to quotemeta the regexp. >> >> Change that bit of code so it looks like this instead: >> >> my $squashedpossible = lc($possiblefraudstart); >> $squashedpossible =~ s/\s//g; >> $squashedpossible =~ s/(\<\/?[^>]*\>)*//ig; # Remove tags >> $squashedpossible = "www.$squashedpossible\"$linkurl\""; >> $squashedpossible = quotemeta($squashedpossible); >> #print STDERR "NEW CODE: SquashedText = $squashedtext\n"; >> #print STDERR "NEW CODE: SquashedPossible = $squashedpossible >> \n"; >> #print STDERR "NEW CODE: LinkURL = $linkurl\n"; >> if ($squashedtext =~ /^$squashedpossible/) { >> #print STDERR "FOUND IT\n"; >> print "$DisarmLinkText$text"; >> $DisarmLinkText = ""; # Reset state of automaton >> return; >> } >> >> Then it should work rather better! >> Sorry about that, I wrote it in too much of a hurry :-( >> >> >> > Julian, > > Tested the patch by emailing back the same message twice and I got > the following: > >
color="red">MailScanner soupçonne le lien > "www.usherbrooke.ca" d'être une tentative de fraude de la > part de MailScanner > soupçonne le lien "www.usherbrooke.ca" d'être une > tentative de fraude de la part de www.abc.com
> > As you can see the text is there twice... so I guess the patch > doesn't work... :-( I'll try out your text tonight. It definitely worked for me. Where did the
right at the start come from? Do you have a copy of the original HTML text before MailScanner hit it? - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwn14RH2WUcUFbZUEQLVEACgomLjluUfLwOVHsOg4PjN34AG0TkAn3oL zqZ9iDwCOfpSem1dvZq3I8AV =1ZT2 -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From yossimor at HOTMAIL.COM Mon Aug 22 17:01:31 2005 From: yossimor at HOTMAIL.COM (yossi mor) Date: Thu Jan 12 21:30:37 2006 Subject: In hebrew emails mail scanner puts gibberish in the Subject line Message-ID: Hi Julian, Good News !!! It seems that the patch solved the problem. I made some testing on the customer site and everything looks OK. Many Many thanks. When you intend to integrate the fix? and on which MailScanner version? Again Tnx alot :) Yossi >From: Julian Field >Reply-To: MailScanner mailing list >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: In hebrew emails mail scanner puts gibberish in the Subject >line >Date: Fri, 19 Aug 2005 10:14:01 +0100 > >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > > >On 19 Aug 2005, at 09:29, Yossi Mor wrote: > > > Julian good morning, > > > > Thank you for the patch i will try it at the beginning of the next > > week. > > > > I got few questions related to the patch: > > > > 1. Which version of MailScanner should i try the patch? > >On any version that has the subroutine mentioned in the patch. > > > 2. Just to make it clear - the patch should be copied > > to /usr/lib/MailScanner/MailScanner ? > > 3. Is there a special command to apply the patch or just 'tar - > > zxvf' and > > copy it to the location specified above? > >No. You need to learn how to use "patch". > >Copy the Message.pm.patch.gz to /usr/lib/MailScanner/MailScanner/ >gunzip Message.pm.patch.gz >patch < Message.pm.patch > >The restart MailScanner as long as the patch command succeeded. > > > If that is ok with you i can send you an email in Hebrew from my home > > account to try in advance the work around and get your feedback. > > What do > > you think? > >I haven't implemented the patch on my own systems, so I suggest you >send the mail to yourself. > > > May i suggest an improvement to the MailScanner. I think that > > MailScanner.conf should contain sections to control the Unicode of the > > subject line and the email body. If this functionality can be added, I > > think that it gain a better control to admin to adjust the Unicode of > > incoming emails to avoid such cases. > >I am not sure that RFC822 and RFC2822 allow Unicode in subject lines. > > > > > > Kindly regards, > > > > Yossi Mor > > > > > > On Fri, 19 Aug 2005 08:55:00 +0100, Julian Field > > wrote: > > > > > >> Please try out the attached short patch for Message.pm. > >> > >> > >> ------------------------ MailScanner list ------------------------ > >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >> 'leave mailscanner' in the body of the email. > >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >> Support MailScanner development - buy the book off the website! > >> > >> > >> This may well fix the problem. > >> > >> On 16 Aug 2005, at 08:55, Julian Field wrote: > >> > >> > >>>> Old Signed: 08/16/05 at 08:55:20 > >>>> > >>> > >>> Does anyone have accurate knowledge of: > >>> What was the last version that worked properly? > >>> What was the first version that changed Subject: to ######## ? > >>> > >>> Without this, I can't find the problem. > >>> > >>> On 16 Aug 2005, at 03:15, Alex Neuman van der Hans wrote: > >>> > >>> > >>> > >>>> How do you do this in Sendmail, exactly? I've got a client who > >>>> constantly > >>>> emails me saying "someguy@somewhere.com's mail scanning program > >>>> bounced my > >>>> mail, why?" and the bounce always says something about violating > >>>> RFC's by > >>>> using unquoted accented characters in the subject line. If I could > >>>> get > >>>> sendmail to sanitize the subject lines at least it would get rid > >>>> of the > >>>> bounces. > >>>> > >>>> ------------------------ MailScanner list ------------------------ > >>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>> 'leave mailscanner' in the body of the email. > >>>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>> > >>>> Support MailScanner development - buy the book off the website! > >>>> > >>>> > >>>> > >>> > >>> -- > >>> Julian Field > >>> www.MailScanner.info > >>> Buy the MailScanner book at www.MailScanner.info/store > >>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >>> > >>> > >>> * Julian Field > >>> * 0x1415B654 (L) > >>> > >>> > >>> ------------------------ MailScanner list ------------------------ > >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>> 'leave mailscanner' in the body of the email. > >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>> > >>> Support MailScanner development - buy the book off the website! > >>> > >>> > >> > >> -- > >> Julian Field > >> www.MailScanner.info > >> Buy the MailScanner book at www.MailScanner.info/store > >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >> > >> > >> ------------------------ MailScanner list ------------------------ > >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >> 'leave mailscanner' in the body of the email. > >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >> Support MailScanner development - buy the book off the website! > >> > >> > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > >- -- >Julian Field >www.MailScanner.info >Buy the MailScanner book at www.MailScanner.info/store >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > >-----BEGIN PGP SIGNATURE----- >Version: PGP Desktop 9.0.2 (Build 2425) > >iQA/AwUBQwWi3RH2WUcUFbZUEQJzmgCg1l+I5jGwtmjIJt7eRVh48vRvrUwAn1BG >nKBwbXHnWRwU/W5vSjHyMKpP >=wXq5 >-----END PGP SIGNATURE----- > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From peter at UCGBOOK.COM Mon Aug 22 17:15:38 2005 From: peter at UCGBOOK.COM (Peter Bonivart) Date: Thu Jan 12 21:30:37 2006 Subject: Disarmed Content quarantine Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Rabellino Sergio wrote: > Dear list, > i cannot figure out if a "DISARMED CONTENT" can be quarantined. > The original email is changed, so if an user (or better the law) wants > the original message delivered later, I'vent a copy. > > How could this be done ? Only blocked mail will be quarantined. If you set the content filters to yes or disarm they are still sent. You can use the archive function though. -- /Peter Bonivart --Unix lovers do it in the Sun ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Aug 22 17:54:08 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:37 2006 Subject: In hebrew emails mail scanner puts gibberish in the Subject line Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 It will be in the next release. yossi mor wrote: > Hi Julian, > > Good News !!! > > It seems that the patch solved the problem. I made some testing on the > customer site and everything looks OK. Many Many thanks. > > When you intend to integrate the fix? and on which MailScanner version? > > Again Tnx alot :) > > Yossi > > >> From: Julian Field >> Reply-To: MailScanner mailing list >> To: MAILSCANNER@JISCMAIL.AC.UK >> Subject: Re: In hebrew emails mail scanner puts gibberish in the >> Subject line >> Date: Fri, 19 Aug 2005 10:14:01 +0100 >> >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> >> On 19 Aug 2005, at 09:29, Yossi Mor wrote: >> >> > Julian good morning, >> > >> > Thank you for the patch i will try it at the beginning of the next >> > week. >> > >> > I got few questions related to the patch: >> > >> > 1. Which version of MailScanner should i try the patch? >> >> On any version that has the subroutine mentioned in the patch. >> >> > 2. Just to make it clear - the patch should be copied >> > to /usr/lib/MailScanner/MailScanner ? >> > 3. Is there a special command to apply the patch or just 'tar - >> > zxvf' and >> > copy it to the location specified above? >> >> No. You need to learn how to use "patch". >> >> Copy the Message.pm.patch.gz to /usr/lib/MailScanner/MailScanner/ >> gunzip Message.pm.patch.gz >> patch < Message.pm.patch >> >> The restart MailScanner as long as the patch command succeeded. >> >> > If that is ok with you i can send you an email in Hebrew from my home >> > account to try in advance the work around and get your feedback. >> > What do >> > you think? >> >> I haven't implemented the patch on my own systems, so I suggest you >> send the mail to yourself. >> >> > May i suggest an improvement to the MailScanner. I think that >> > MailScanner.conf should contain sections to control the Unicode of the >> > subject line and the email body. If this functionality can be added, I >> > think that it gain a better control to admin to adjust the Unicode of >> > incoming emails to avoid such cases. >> >> I am not sure that RFC822 and RFC2822 allow Unicode in subject lines. >> >> >> > >> > Kindly regards, >> > >> > Yossi Mor >> > >> > >> > On Fri, 19 Aug 2005 08:55:00 +0100, Julian Field >> > wrote: >> > >> > >> >> Please try out the attached short patch for Message.pm. >> >> >> >> >> >> ------------------------ MailScanner list ------------------------ >> >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> >> 'leave mailscanner' in the body of the email. >> >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> >> >> Support MailScanner development - buy the book off the website! >> >> >> >> >> >> This may well fix the problem. >> >> >> >> On 16 Aug 2005, at 08:55, Julian Field wrote: >> >> >> >> >> >>>> Old Signed: 08/16/05 at 08:55:20 >> >>>> >> >>> >> >>> Does anyone have accurate knowledge of: >> >>> What was the last version that worked properly? >> >>> What was the first version that changed Subject: to ######## ? >> >>> >> >>> Without this, I can't find the problem. >> >>> >> >>> On 16 Aug 2005, at 03:15, Alex Neuman van der Hans wrote: >> >>> >> >>> >> >>> >> >>>> How do you do this in Sendmail, exactly? I've got a client who >> >>>> constantly >> >>>> emails me saying "someguy@somewhere.com's mail scanning program >> >>>> bounced my >> >>>> mail, why?" and the bounce always says something about violating >> >>>> RFC's by >> >>>> using unquoted accented characters in the subject line. If I could >> >>>> get >> >>>> sendmail to sanitize the subject lines at least it would get rid >> >>>> of the >> >>>> bounces. >> >>>> >> >>>> ------------------------ MailScanner list ------------------------ >> >>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> >>>> 'leave mailscanner' in the body of the email. >> >>>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> >>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>>> >> >>>> Support MailScanner development - buy the book off the website! >> >>>> >> >>>> >> >>>> >> >>> >> >>> -- >> >>> Julian Field >> >>> www.MailScanner.info >> >>> Buy the MailScanner book at www.MailScanner.info/store >> >>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >>> >> >>> >> >>> * Julian Field >> >>> * 0x1415B654 (L) >> >>> >> >>> >> >>> ------------------------ MailScanner list ------------------------ >> >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> >>> 'leave mailscanner' in the body of the email. >> >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>> >> >>> Support MailScanner development - buy the book off the website! >> >>> >> >>> >> >> >> >> -- >> >> Julian Field >> >> www.MailScanner.info >> >> Buy the MailScanner book at www.MailScanner.info/store >> >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> >> >> >> >> ------------------------ MailScanner list ------------------------ >> >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> >> 'leave mailscanner' in the body of the email. >> >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> >> >> Support MailScanner development - buy the book off the website! >> >> >> >> >> > >> > ------------------------ MailScanner list ------------------------ >> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> > 'leave mailscanner' in the body of the email. >> > Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> > >> > Support MailScanner development - buy the book off the website! >> > >> >> - -- >> Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> >> -----BEGIN PGP SIGNATURE----- >> Version: PGP Desktop 9.0.2 (Build 2425) >> >> iQA/AwUBQwWi3RH2WUcUFbZUEQJzmgCg1l+I5jGwtmjIJt7eRVh48vRvrUwAn1BG >> nKBwbXHnWRwU/W5vSjHyMKpP >> =wXq5 >> -----END PGP SIGNATURE----- >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQwoDMRH2WUcUFbZUEQJ4IgCg3m9v34gflHD07+XBOz3iVT3nysAAoKCY mL6/abZnmuqHFAINOVBWdkFW =Dprv -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Mon Aug 22 18:16:54 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:37 2006 Subject: Phishing Trouble Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >On 22 Aug 2005, at 16:37, Denis Beauchemin wrote: > > >>Julian Field wrote: >> >> >> >> >>>-----BEGIN PGP SIGNED MESSAGE----- >>>Hash: SHA1 >>> >>>On 19 Aug 2005, at 16:48, Denis Beauchemin wrote: >>> >>> >>> >>> >>> >>>>* PGP Bad Signature, Signed by a unverified key >>>>Julian Field wrote: >>>> >>>> >>>> >>>> >>>> >>>> >>>>>Attached is a patch for Message.pm which should stop this >>>>>happening again. >>>>> >>>>> >>>>> >>>>> >>>>> >>>>Julian, >>>> >>>>Tried it yesterday and this morning my server had a huge backlog >>>>of messages in mqueue.in. I managed to single out some messages >>>>and ran MS in debug mode on them to get the following error: >>>>Unmatched ) in regex; marked by <-- HERE in m/^www >>>>\.mailscannersoupçonnelelien"www.ipm2005.fr) <-- HERE "/ >>>>at / usr/lib/MailScanner/MailScanner/Message.pm line 4954 >>>> >>>>and line 4954 is: >>>> if ($squashedtext =~ /^www\.$squashedpossible\"$linkurl\"/) { >>>> >>>>So I backed out of the patch and then the messages went by just >>>>fine. >>>> >>>> >>>> >>>> >>>Sorry, I forgot to quotemeta the regexp. >>> >>>Change that bit of code so it looks like this instead: >>> >>> my $squashedpossible = lc($possiblefraudstart); >>> $squashedpossible =~ s/\s//g; >>> $squashedpossible =~ s/(\<\/?[^>]*\>)*//ig; # Remove tags >>> $squashedpossible = "www.$squashedpossible\"$linkurl\""; >>> $squashedpossible = quotemeta($squashedpossible); >>> #print STDERR "NEW CODE: SquashedText = $squashedtext\n"; >>> #print STDERR "NEW CODE: SquashedPossible = $squashedpossible >>>\n"; >>> #print STDERR "NEW CODE: LinkURL = $linkurl\n"; >>> if ($squashedtext =~ /^$squashedpossible/) { >>> #print STDERR "FOUND IT\n"; >>> print "$DisarmLinkText$text"; >>> $DisarmLinkText = ""; # Reset state of automaton >>> return; >>> } >>> >>>Then it should work rather better! >>>Sorry about that, I wrote it in too much of a hurry :-( >>> >>> >>> >>> >>> >>Julian, >> >>Tested the patch by emailing back the same message twice and I got >>the following: >> >>>color="red">MailScanner soupçonne le lien >>"www.usherbrooke.ca" d'être une tentative de fraude de la >>part de MailScanner >>soupçonne le lien "www.usherbrooke.ca" d'être une >>tentative de fraude de la part de www.abc.com
>> >>As you can see the text is there twice... so I guess the patch >>doesn't work... :-( >> >> > >I'll try out your text tonight. It definitely worked for me. Where >did the
right at the start come from? Do you have a copy >of the original HTML text before MailScanner hit it? > > Julian, Background: MS 4.44.6, language.conf contains: PossibleFraudStart = MailScanner soupçonne le lien PossibleFraudEnd = d'être une tentative de fraude de la part de Source of email sent the first time: www.abc.com
Source of email sent the second time: MailScanner soupçonne le lien "www.usherbrooke.ca" d'être une tentative de fraude de la part de www.abc.com
Results in: MailScanner soupçonne le lien "www.usherbrooke.ca" d'être une tentative de fraude de la part de MailScanner soupçonne le lien "www.usherbrooke.ca" d'être une tentative de fraude de la part de www.abc.com
Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From ugob at CAMO-ROUTE.COM Mon Aug 22 18:46:17 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:37 2006 Subject: New virus intercepted Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Randal, Phil wrote: > This should be a FAQ: > > Submit samples to: > > http://virusscan.jotti.org/ > > http://www.virustotal.com/ > > http://cgi.clamav.net/sendvirus.cgi > > Feel free to write something about it on the wiki: http://wiki.mailscanner.info > Cheers, > > Phil > ---- > Phil Randal > Network Engineer > Herefordshire Council > Hereford, UK > > >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Denis Beauchemin >>Sent: 18 August 2005 13:58 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: New virus intercepted >> >>Denis Beauchemin wrote: >> >> >>>Hello All, >>> >>>Last night we received many hundreds EXE files infected by >>>Backdoor.Win32.Dumador.dk, according to Kaspersky. No other virus >>>scanner I have detected anything suspicious: McAfee, >> >>Bitdefender and >> >>>ClamAV all said there was nothing wrong in the files. >>> >>>All files seem to be the same length (26112 bytes) and came >> >>from many >> >>>different IPs. They all have strange names (looks like random >>>characters) ending in .exe. >>> >>>I'm glad I don't let EXE/BAT/PIF/... files through! >>> >>>Denis >>> >> >>Overall we blocked 512 EXE on one of our external servers >>yesterday and no more than 3 came from the same IP. On the >>other external server, we blocked 525 EXE and no more than 4 >>came from the same IP... >> >>Funny thing: we received them from midnight to 1:35 and then >>nothing until 17:36 (5:36PM). It stopped at about 19:36 >>(7:36PM) to not be seen again... >> >>Still nothing detected by McAfee, Bitdefender or ClamAV... >> >>Denis >>PS: We've been told that McAfee will detect it with the >>extra.dat so I am about to download it. It would be nice it >>mcafee-autoupdate -e worked as advertised... >>usage: /usr/lib/MailScanner/mcafee-autoupdate [-dfrtv] >>[-Rnnn] [-Innn] [proxy] [prefix] >> -d delete old files >> -e get extra.dat >> -f force update >> -r show README >> -t timestamp output >> -v verbose >> -R number of retries >> -I retry interval >> proxy URL of FTP/HTTP proxy server >> prefix uvscan installation directory >> >>-- >> _ >> °v° Denis Beauchemin, analyste >> /(_)\ Université de Sherbrooke, S.T.I. >> ^ ^ T: 819.821.8000x2252 F: 819.821.8045 >> >> >> >>------------------------ MailScanner list >>------------------------ To unsubscribe, email >>jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) >>and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> > > -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at BARENDSE.TO Tue Aug 23 08:01:06 2005 From: mailscanner at BARENDSE.TO (Remco Barendse) Date: Thu Jan 12 21:30:37 2006 Subject: geocities spam, why isn't it caught Message-ID: Hi! I know this item was dicussed on the list before but I seen an increasing number of geocities spam mails. They aren't using only uk.geocities.com but also geocities.com and it.geocities.com but I guess they could come up with a 1,000,000 of variants. The mails are only scored by bayes, none of the other checks are triggered. I knos someone posted a rule to block uk.geocities.com (even though I lost the mail) but what worries me more is the fact that they manage to get past all checks incl. SURBL / URI and dcc checks. Anyone have any idea why, is my setup wrong? Thanks! Remco ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHT.IE Tue Aug 23 08:13:46 2005 From: michele at BLACKNIGHT.IE (Michele Neylon) Date: Thu Jan 12 21:30:37 2006 Subject: geocities spam, why isn't it caught Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Check out this list's archives and the archives of the spamassassin users' list. A couple of rulesets have been posted that may help. Michele ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Q.G.Campbell at NEWCASTLE.AC.UK Tue Aug 23 08:16:03 2005 From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell) Date: Thu Jan 12 21:30:37 2006 Subject: help with mcp setup Message-ID: >-----Original Message----- >From: MailScanner mailing list >[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Jeff Mills >Sent: 21 August 2005 08:05 >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: help with mcp setup > >Hi all, >I've got MCP setup and working for single profain words in the >body of emails, but I'm trying to set up some testing on >subjects and cant seem to work it out. >I had a read of the man page and looked at the *.cf files in >/usr/share/spamassassin. >In the example below: > >header SUBJECT_LOAN2 Subject =~ /Pre-approved\s+Application/i >describe SUBJECT_LOAN2 Banned Subject Pre-approved Application >score SUBJECT_LOAN2 30 > >I tried sending myself an email with the subject "Pre-approved >Application" and this was allowed through. >Should the above config have stopped it? You need to tell MailScanner what action to take if one or more MCP rules are triggred. What have you set in MailScanner.conf for: MCP Checks = MCP Required SpamAssassin Score = MCP High SpamAssassin Score = Non MCP Actions = MCP Actions = High Scoring MCP Actions = Look in the messages' headers for the "SUBJECT_LOAN2" string. I always prefix my MCP rule names with "MCP_" so that they are separate from rules triggered by the other SpamAssassin invocation used to check for spam. > >I just did a test by using the body check rather than header >check, and it was picked up, even though the words were in the >subject, not the body. >Is this normal? Yes. A "body check" also implies checking the Subject: line text as well. > >Does anyone know of a resource to learn more about these >expressions that spamassassin uses? There is the Mail::SpamAssassin::Conf POD documentation. See http://spamassassin.apache.org/full/3.0.x/dist/doc/Mail_SpamAssassin_Con f.html for example. > > >Cheers, >Jeff > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From raymond at PROLOCATION.NET Tue Aug 23 08:23:12 2005 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:30:37 2006 Subject: geocities spam, why isn't it caught Message-ID: Hi! > They aren't using only uk.geocities.com but also geocities.com and > it.geocities.com but I guess they could come up with a 1,000,000 of variants. We also have samples with www.geocities.com allready... > The mails are only scored by bayes, none of the other checks are triggered. I > knos someone posted a rule to block uk.geocities.com (even though I lost the > mail) but what worries me more is the fact that they manage to get past all > checks incl. SURBL / URI and dcc checks. > > Anyone have any idea why, is my setup wrong? SURBL wont list them since its a legit site. They suck, since they dont respond to abuse, but they are still legit. You could add some extra rules for this, and feel free to replace the it/uk with * if you want to be on the safe side. Geocities can ignore this, but they risk that people just put them inside a lot of filters, harming much much more. uri PROLO_PUBWEB_UKGEO_CHECK1 /^http:\/\/.*uk\.geocities\.com\// score PROLO_PUBWEB_UKGEO_CHECK1 15.0 describe PROLO_PUBWEB_UKGEO_CHECK1 PROLO_PUBWEB_UKGEO_CHECK1, Body uri PROLO_PUBWEB_ITGEO_CHECK1 /^http:\/\/.*it\.geocities\.com\// score PROLO_PUBWEB_ITGEO_CHECK1 15.0 describe PROLO_PUBWEB_ITGEO_CHECK1 PROLO_PUBWEB_ITGEO_CHECK1, Body Bye, Raymond. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From remy at UNIX-ASP.COM Tue Aug 23 08:27:40 2005 From: remy at UNIX-ASP.COM (Remy de Ruysscher) Date: Thu Jan 12 21:30:37 2006 Subject: geocities spam, why isn't it caught Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Remco Barendse wrote: > Hi! > > I know this item was dicussed on the list before but I seen an > increasing number of geocities spam mails. > > They aren't using only uk.geocities.com but also geocities.com and > it.geocities.com but I guess they could come up with a 1,000,000 of > variants. > > The mails are only scored by bayes, none of the other checks are > triggered. I knos someone posted a rule to block uk.geocities.com > (even though I lost the mail) but what worries me more is the fact > that they manage to get past all checks incl. SURBL / URI and dcc checks. > > Anyone have any idea why, is my setup wrong? > > Thanks! > Remco > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > This works perfectly. Just add a prolo.cf to you spamassassin directory with this content: uri PROLO_PUBWEB_UKGEO_CHECK1 /^http:\/\/uk\.geocities\.com\// uri PROLO_PUBWEB_UKGEO_CHECK2 /^http:\/\/www\.geocities\.com\// score PROLO_PUBWEB_UKGEO_CHECK1 4.0 score PROLO_PUBWEB_UKGEO_CHECK2 4.0 describe PROLO_PUBWEB_UKGEO_CHECK1 PROLO_PUBWEB_UKGEO_CHECK1, Body describe PROLO_PUBWEB_UKGEO_CHECK2 PROLO_PUBWEB_UKGEO_CHECK2, Body (Orginally posted by Raymond Dijkxhoorn). ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at BARENDSE.TO Tue Aug 23 08:41:43 2005 From: mailscanner at BARENDSE.TO (Remco Barendse) Date: Thu Jan 12 21:30:37 2006 Subject: geocities spam, why isn't it caught Message-ID: Thanks for all the replies. >> The mails are only scored by bayes, none of the other checks are triggered. >> I knos someone posted a rule to block uk.geocities.com (even though I lost >> the mail) but what worries me more is the fact that they manage to get past >> all checks incl. SURBL / URI and dcc checks. >> >> Anyone have any idea why, is my setup wrong? > > SURBL wont list them since its a legit site. They suck, since they dont > respond to abuse, but they are still legit. Strange that SURBL won't list them because they are a legit site. I thought it was possible to block based on URLS given, not just domain names? Most teenagers do not send their new geocities homepage to 10 million people so I guess if a url passes a certain number of hits it could safely be blacklisted? > You could add some extra rules for this, and feel free to replace the it/uk > with * if you want to be on the safe side. Geocities can ignore this, but > they risk that people just put them inside a lot of filters, harming much > much more. Well with geocities contributing to spam they do not deserve better than to be blacklisted. I don't understand the format fully but have now added this to prolo.cf: uri PROLO_PUBWEB_GEO_CHECK /^http:\/\/*\.geocities\.com\// score PROLO_PUBWEB_GEO_CHECK 15.0 describe PROLO_PUBWEB_GEO_CHECK PROLO_PUBWEB_GEO_CHECK, Body I hope this will trap any e-mail with geocities domain in it? Thanks! Remco > > uri PROLO_PUBWEB_UKGEO_CHECK1 /^http:\/\/.*uk\.geocities\.com\// > score PROLO_PUBWEB_UKGEO_CHECK1 15.0 > describe PROLO_PUBWEB_UKGEO_CHECK1 PROLO_PUBWEB_UKGEO_CHECK1, Body > > uri PROLO_PUBWEB_ITGEO_CHECK1 /^http:\/\/.*it\.geocities\.com\// > score PROLO_PUBWEB_ITGEO_CHECK1 15.0 > describe PROLO_PUBWEB_ITGEO_CHECK1 PROLO_PUBWEB_ITGEO_CHECK1, Body > > Bye, > Raymond. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHT.IE Tue Aug 23 08:45:09 2005 From: michele at BLACKNIGHT.IE (Michele Neylon) Date: Thu Jan 12 21:30:37 2006 Subject: geocities spam, why isn't it caught Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Remco Barendse wrote: > Strange that SURBL won't list them because they are a legit site. I > thought it was possible to block based on URLS given, not just domain > names? Most teenagers do not send their new geocities homepage to 10 > million people so I guess if a url passes a certain number of hits it > could safely be blacklisted? No. Go and read the listing criteria for SURBL. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From vlad at MAZEK.COM Tue Aug 23 08:45:25 2005 From: vlad at MAZEK.COM (Vlad Mazek) Date: Thu Jan 12 21:30:37 2006 Subject: geocities spam, why isn't it caught Message-ID: Well, you can only go so crazy trying to blacklist the rest of the world based on a valid URI. For example, they are now moving to spaces.msn.com which is not all that popular of a site but concept is pretty interesting as nearly any site accepting unmoderated content can be used in these messages.. blogs, forums, etc. -Vlad ExchangeDefender.com > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Remco Barendse > Sent: Tuesday, August 23, 2005 3:42 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: geocities spam, why isn't it caught > > Thanks for all the replies. > > >> The mails are only scored by bayes, none of the other checks are > triggered. > >> I knos someone posted a rule to block uk.geocities.com (even though I > lost > >> the mail) but what worries me more is the fact that they manage to get > past > >> all checks incl. SURBL / URI and dcc checks. > >> > >> Anyone have any idea why, is my setup wrong? > > > > SURBL wont list them since its a legit site. They suck, since they dont > > respond to abuse, but they are still legit. > > Strange that SURBL won't list them because they are a legit site. I > thought it was possible to block based on URLS given, not just domain > names? Most teenagers do not send their new geocities homepage to 10 > million people so I guess if a url passes a certain number of hits it > could safely be blacklisted? > > > You could add some extra rules for this, and feel free to replace the > it/uk > > with * if you want to be on the safe side. Geocities can ignore this, > but > > they risk that people just put them inside a lot of filters, harming > much > > much more. > > Well with geocities contributing to spam they do not deserve better than > to be blacklisted. > > I don't understand the format fully but have now added this to > prolo.cf: > > uri PROLO_PUBWEB_GEO_CHECK /^http:\/\/*\.geocities\.com\// > score PROLO_PUBWEB_GEO_CHECK 15.0 > describe PROLO_PUBWEB_GEO_CHECK PROLO_PUBWEB_GEO_CHECK, Body > > I hope this will trap any e-mail with geocities domain in it? > > Thanks! Remco > > > > > uri PROLO_PUBWEB_UKGEO_CHECK1 /^http:\/\/.*uk\.geocities\.com\// > > score PROLO_PUBWEB_UKGEO_CHECK1 15.0 > > describe PROLO_PUBWEB_UKGEO_CHECK1 PROLO_PUBWEB_UKGEO_CHECK1, Body > > > > uri PROLO_PUBWEB_ITGEO_CHECK1 /^http:\/\/.*it\.geocities\.com\// > > score PROLO_PUBWEB_ITGEO_CHECK1 15.0 > > describe PROLO_PUBWEB_ITGEO_CHECK1 PROLO_PUBWEB_ITGEO_CHECK1, Body > > > > Bye, > > Raymond. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Tue Aug 23 08:57:29 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:37 2006 Subject: Startup Problem Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Rick Chadderdon wrote: > Drew Marshall wrote: > >> On 18 Aug 2005, at 16:24, Rick Chadderdon wrote: >> >>> When I execute /opt/MailScanner/bin/check_mailscanner as root with: >>> >>> Run As User = postfix >>> Run As Group = postfix >>> >>> in MailScanner.conf, I get the error: >>> >>> --- >>> Starting MailScanner... >>> Cannot open config file /opt/MailScanner/etc/MailScanner.conf, >>> Permission >>> denied at /opt/MailScanner/lib/MailScanner/Config.pm line 592. >>> --- >>> >>> Seems easy enough, but I'm stuck. I've chowned >>> /opt/MailScanner/etc/MailScanner.conf to postfix:postfix. I've >>> chmodded the >>> file all the way to 777 and done the same for every file and >>> directory in >>> the opt/MailScanner/ tree (including /opt/MailScanner). None of this >>> helped, so I got more creative... >> >> >> >> My MailScanner.conf is owned by root and sits with 644 permissions >> and MailScanner is started by root. As part of it's start up it moves >> to the Postfix user. >> >> Drew >> > Thanks, Drew. That's how mine installed by default. My problem is that > something that happens when the program switches UID/GID is keeping it > from opening the MailScanner.conf file regardless of the ownership or > permissions of the file. I'm guessing that it's some kind of locking > issue but I don't know where it is. > Right now, the file is owned by root and is 644. I'm giving the postfix > user a bash shell, using su -c to launch check_mailscanner as the > postfix user and then removing the user's shell. It works this way, so > I know that it's not a permission problem. This is not the most > convenient way to launch MailScanner, however, so I'd like to find a > better solution than scripting this workaround. > > I'm wondering whether Config.pm is locking MailScanner.conf exclusively > (as root, since UID hasn't changed yet) while it's doing its QuickPeek > and then the postfix user can't get through the lock... But, it doesn't > seem as though if that were the case that it would be only affecting > this machine. In any case, since I have a workaround it's becoming > harder to get myself motivated to figure it out. It will slowly drive > me insane, however. > > If additional info will help anyone else come up with ideas, I'm running > kernel 2.6.12-gentoo-r9 (it was -r6 when I started), perl version 5.8.6, > spamassassin version 3.0.4 and this is a fresh install from the latest > tar file. I installed with the install.sh script and when that produced > these problems I used emerge to replace the perl modules from the > default Gentoo setup. After that failed to help I removed perl and > rebuilt it and then installed the modules with cpan. Didn't help. I'm > running out of things to try. > > ------------------------ MailScanner list ------------------------ Rick Postfix is more than likely running in chroot-ed jail and therefor can't see the /opt/MailScanner directories...There's some stuff in the wiki about this but not much.. http://wiki.mailscanner.info/doku.php?id=documentation:configuration:mta:postfix:installation -- -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at BARENDSE.TO Tue Aug 23 09:43:18 2005 From: mailscanner at BARENDSE.TO (Remco Barendse) Date: Thu Jan 12 21:30:37 2006 Subject: Can I see what MailScanner is doing? Message-ID: Hi! I just added the prolo.cf rule but after restarting MailScanner mail just seems to be piling up in /var/spool/mqueue.in I removed the rule and restarted mailscanner again. When I run top I see MailScanner is eating up cpu time but nothing seems to appear in the maillog. Is there any place I can see what MailScanner is doing?? Thanks! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 23 10:21:02 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:37 2006 Subject: Can I see what MailScanner is doing? Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 23 Aug 2005, at 09:43, Remco Barendse wrote: > Hi! > > I just added the prolo.cf rule but after restarting MailScanner > mail just seems to be piling up in /var/spool/mqueue.in > > I removed the rule and restarted mailscanner again. When I run top > I see MailScanner is eating up cpu time but nothing seems to appear > in the maillog. > > Is there any place I can see what MailScanner is doing?? This must be in the MAQ or Wiki somewhere, but I can't find it right now. Shutdown MailScanner, set "Debug = yes" and "Debug SpamAssassin = yes" in MailScanner.conf, then "check_MailScanner". It will probably die with some error message, that will hopefully shed some light on what is wrong. Fix the problem, put the debug options back to no again and restart MailScanner. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwrqgRH2WUcUFbZUEQJgegCcCDDgD4wR0k+TSR+12uaFVwO283QAnjpF j0AtW28+bBHZwOodVM7RbaCQ =jXbT -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jan-Peter.Koopmann at SECEIDOS.DE Tue Aug 23 11:22:44 2005 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:30:37 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi Julian, something strange: I did set Quarantine Group = something Quarantined mails are correctly created with this group. But quarantined/stored spam is not. Spam is always getting the primary group of the user, mailscanner runs under. Bug? Feature? Am I blind? This happens with 4.43.8. I am going to upgrade any moment now... :-) Regards, JP ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Tue Aug 23 11:37:31 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:37 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jan-Peter Koopmann wrote: > Hi Julian, > > something strange: I did set > > Quarantine Group = something > > Quarantined mails are correctly created with this group. But quarantined/stored spam is not. Spam is always getting the primary group of the user, mailscanner runs under. > > Bug? Feature? Am I blind? This happens with 4.43.8. I am going to upgrade any moment now... :-) > > Regards, > JP > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! JP works fine for me using the tar.gz install rather than ports on FreeBSD.. -- -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jan-Peter.Koopmann at SECEIDOS.DE Tue Aug 23 12:02:37 2005 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:30:37 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Tuesday, August 23, 2005 12:38 PM Martin Hepworth wrote: > works fine for me using the tar.gz install rather than ports on > FreeBSD.. Interesting since the port does not change any part of the code... I was just able to reproduce this. Quarantined messages are ok and spam messages still get the wrong group. Very strange.... ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 23 12:13:59 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:37 2006 Subject: Possible bug with spam permissions Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 23 Aug 2005, at 12:02, Jan-Peter Koopmann wrote: > On Tuesday, August 23, 2005 12:38 PM Martin Hepworth wrote: > > >> works fine for me using the tar.gz install rather than ports on >> FreeBSD.. >> > > Interesting since the port does not change any part of the code... > I was just able to reproduce this. Quarantined messages are ok and > spam messages still get the wrong group. Very strange.... Check for the presence or absence of g+s perms on the dir. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwsE+hH2WUcUFbZUEQL6bACglURazAblipTBa+PRjO7gV0RX2FoAn1LN pkN+NwGM1E6zachKhC8sHHTv =IInn -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From remy at UNIX-ASP.COM Tue Aug 23 12:48:25 2005 From: remy at UNIX-ASP.COM (Remy de Ruysscher) Date: Thu Jan 12 21:30:37 2006 Subject: BitDefender Syslog patch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, When I saw the clamav-autoupdate logging to Syslog I wanted logging for BitDefender to Syslog as well. So I made a simple patch for the orginal bitdefender-autoupdate script which logs trough Syslog. Please try it and let me know if it works (or not). It's working on my servers quite nicely. Regards, Remy. --- --- old/bitdefender-autoupdate Tue Aug 23 13:39:04 2005 +++ new/bitdefender-autoupdate Tue Aug 23 13:39:23 2005 @@ -98,6 +98,8 @@ # added to bitdefende report at the end of the update report to "see" # the number of viruses includung families otherwise seen as one virus only # +# 21-08-05 Added Bitdefender sysloging to the standard maillogs (remy@unix-asp.com) +# ############################################################################ use POSIX; @@ -105,6 +107,7 @@ use File::Basename; use IO::File; use Archive::Zip qw(:ERROR_CODES); +use Sys::Syslog; my $PackageDir = shift || "/usr/local/bdc/"; @@ -166,6 +169,9 @@ $LOCK_NB = 4; $LOCK_UN = 8; +eval { Sys::Syslog::setlogsock('unix'); }; # This may fail! +Sys::Syslog::openlog("BitDefender-autoupdate", 'pid, nowait', 'mail'); + &checkLogSize; &updateLog("-----> Starting update..."); @@ -198,7 +204,8 @@ { my $bitDCmd = $bdcBinary . " --update"; &updateLog ( "Starting update using BDC built-in function..."); - &LockBitDefender; # lock it... + &LockBitDefender; # lock it... + Sys::Syslog::syslog('info', "BitDefender starting update"); eval { alarm $MaximumTime; system $bitDCmd; @@ -211,11 +218,13 @@ # We timed out! &UnlockBitDefender; &updateLog("WARNING BitDefender update timed out"); + Sys::Syslog::syslog('warn', "BitDefender update timed out"); alarm 0; } } else { alarm 0; - &updateLog("BitDefender update completed"); + &updateLog("BitDefender updated"); + Sys::Syslog::syslog('info', "BitDefender updated"); } #system ("$bitDCmd"); # update @@ -253,7 +262,8 @@ { $ftp->quit; &updateLog ( "Database is Up to Date - No update is required\n"); - goto ENDING; + Sys::Syslog::syslog('info', "Bitdefender update not needed"); + goto ENDING; } $ftp->get ( $ftpUpdateFile, $zipName); if ( $verbose ==1 ) @@ -311,6 +321,7 @@ else { &updateLog ( "No new definitions found..."); + Sys::Syslog::syslog('info', "Bitdefender update not needed"); $useSMTP = 0; # avoid mail } ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From stef at L5NET.NET Tue Aug 23 13:01:50 2005 From: stef at L5NET.NET (Stef Morrell) Date: Thu Jan 12 21:30:37 2006 Subject: TNEF still a problem? Message-ID: Julian wrote: > That's interesting. Maybe there's a new TNEF version out > there that the > module doesn't support properly. Has anyone checked the > Changelog of the > Convert::TNEF module? Am I a long way from the most recent version? I've just come across the same problem. Email gets caught up in a loop of trying to deal with the TNEF via the internal decoder and never gets delivered. Switching to the external decoder resolves the problem. In the latest MailScanner you are shipping Convert::TNEF 0.17, which seems to be the latest version, as CPAN shell insists my Convert::TNEF is up to date. Here's the wierd thing... MailScanner -v doesn't list Convert::TNEF at all, even though I can clearly see it's in the code... # Are we just printing version numbers and exiting? if (grep /^-+[vV]/, @ARGV) { my @Modules = qw/AnyDBM_File Archive::Zip Carp Convert::BinHex Convert::TNEF D ata::Dumper DirHandle Fcntl File::Basename File::Copy FileHandle File::Path File ::Temp HTML::Entities HTML::Parser HTML::TokeParser IO IO::File IO::Pipe Mail::C lamAV Mail::Header Mail::SpamAssassin MIME::Base64 MIME::Decoder MIME::Decoder:: UU MIME::Head MIME::Parser MIME::QuotedPrint MIME::Tools MIME::WordDecoder Net:: CIDR POSIX SAVI Socket Sys::Syslog Time::localtime/; But, if I do say... use CPAN; print "Convert::TNEF Version is ".CPAN::Shell->expand("Module","Convert::TNEF")- >inst_version."\n"; I get 0.17 as the answer... So - there's something else going on, unrelated to the module version. Further, I've only experienced this since upgrading to 4.44.6 - which unless I'm mistaken, already includes the patch released on 01/08. Regards Stef FYI: Running on Linux cyril 2.6.12.4-Tromix #1 SMP Mon Aug 8 18:15:27 BST 2005 i686 pentium3 i386 GNU/Linux This is Perl version 5.008006 (5.8.6) This is MailScanner version 4.44.6 Module versions are: 1.00 AnyDBM_File 1.14 Archive::Zip 1.03 Carp 1.119 Convert::BinHex 1.00 DirHandle 1.05 Fcntl 2.73 File::Basename 2.08 File::Copy 2.01 FileHandle 1.06 File::Path 0.16 File::Temp 1.29 HTML::Entities 3.45 HTML::Parser 2.30 HTML::TokeParser 1.21 IO 1.10 IO::File 1.123 IO::Pipe 1.50 Mail::Header 3.05 MIME::Base64 5.417 MIME::Decoder 5.417 MIME::Decoder::UU 5.417 MIME::Head 5.417 MIME::Parser 3.03 MIME::QuotedPrint 5.417 MIME::Tools 0.10 Net::CIDR 1.08 POSIX 1.77 Socket 0.05 Sys::Syslog 1.02 Time::localtime Optional module versions are: 1.810 DB_File 1.08 Digest 1.01 Digest::HMAC 2.33 Digest::MD5 2.10 Digest::SHA1 0.44 Inline 0.17 Mail::ClamAV 3.000004 Mail::SpamAssassin 1.997 Mail::SPF::Query 0.15 Net::CIDR::Lite 0.49 Net::DNS missing Net::LDAP 1.94 Parse::RecDescent 0.15 SAVI 1.2 Sys::Hostname::Long 2.42 Test::Harness 0.47 Test::Simple 1.95 Text::Balanced 1.35 URI Stefan Morrell | Director Tel: 0870 365 2813 | Level 5 Internet Ltd Fax: 0192 450 7307 | Part of the Alpha Omega Group stef@l5net.net | stef@aoc-uk.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 23 13:49:44 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:37 2006 Subject: TNEF still a problem? Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 23 Aug 2005, at 13:01, Stef Morrell wrote: > Julian wrote: >> That's interesting. Maybe there's a new TNEF version out >> there that the >> module doesn't support properly. Has anyone checked the >> Changelog of the >> Convert::TNEF module? Am I a long way from the most recent version? >> > > I've just come across the same problem. Email gets caught up in a loop > of trying to deal with the TNEF via the internal decoder and never > gets > delivered. Switching to the external decoder resolves the problem. > > In the latest MailScanner you are shipping Convert::TNEF 0.17, which > seems to be the latest version, as CPAN shell insists my Convert::TNEF > is up to date. > > Here's the wierd thing... > > MailScanner -v doesn't list Convert::TNEF at all, even though I can > clearly see it's in the code... Fixed that now. Add Convert/TNEF.pm to the list of optional modules just after this line: > my @Modules = qw/AnyDBM_File Archive::Zip Carp Convert::BinHex > Convert::TNEF D > ata::Dumper DirHandle Fcntl File::Basename File::Copy FileHandle > File::Path File > ::Temp HTML::Entities HTML::Parser HTML::TokeParser IO IO::File > IO::Pipe > Mail::C > lamAV Mail::Header Mail::SpamAssassin MIME::Base64 MIME::Decoder > MIME::Decoder:: > UU MIME::Head MIME::Parser MIME::QuotedPrint MIME::Tools > MIME::WordDecoder Net:: > CIDR POSIX SAVI Socket Sys::Syslog Time::localtime/; This fix will be in the next release. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwsbaxH2WUcUFbZUEQJ6dgCg0iEflRhkQk63oP6ETUbuol4Ee/kAn0lR 8JjPWAPeg85zCQb8/SCtczBT =OucB -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rabellino at DI.UNITO.IT Tue Aug 23 13:47:41 2005 From: rabellino at DI.UNITO.IT (Rabellino Sergio) Date: Thu Jan 12 21:30:37 2006 Subject: Disarmed Content quarantine Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Peter Bonivart wrote: > Rabellino Sergio wrote: > >> Dear list, >> i cannot figure out if a "DISARMED CONTENT" can be quarantined. >> The original email is changed, so if an user (or better the law) >> wants the original message delivered later, I'vent a copy. >> >> How could this be done ? > > > Only blocked mail will be quarantined. If you set the content filters > to yes or disarm they are still sent. You can use the archive function > though. > Ok, I've figured out how to modify this behaviour, in attachments my patches. Add a new config switch into Mailscanner.conf # Do you want to store copies of the modified messages? Quarantine Modified Body = yes Then changed lib/Mailscanner/ConfigDefs.pl, lib/MailScanner/MessageBatch.pm and bin/Mailscanner to catch if a message had it's body modified in any way (disarming or other checks) and store it in it's untouched form. P.s. I've not understood completely how to define a new conf variable, so my 'method' must be confirmed if it's correct. Bye. -- Dott. Mag. Sergio Rabellino Technical Staff Department of Computer Science University of Torino (Italy) http://www.di.unito.it/~rabser Tel. +39-0116706701 Fax. +39-011751603 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2: "Attached Text" ] 487d486 < QuarantineModifiedBody 1 no 0 yes 1 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 3: "Attached Text" ] 628,630d627 < # Quarantine all the disarmed attachments < $batch->QuarantineModifiedBody(); < ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 4: "Attached Text" ] 625,627d624 < # Store all the disarmed files in the quarantine if they want me to. < # Quarantine decision has to be done on a per-message basis. < sub QuarantineModifiedBody { 629,641d625 < my $this = shift; < < my($id, $message); < < while(($id, $message) = each %{$this->{messages}}) { < next unless $message->{bodymodified}; < next if MailScanner::Config::Value('quarantinemodifiedbody', $message) !~ /1/; < < $global::MS->{quar}->StoreInfections($message); < MailScanner::Log::InfoLog("Quarantining modified message for = " . $id . " bodymodified is " . $message->{bodymodified}); < } < } < ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Tue Aug 23 13:51:55 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:37 2006 Subject: geocities spam, why isn't it caught Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Remco Barendse wrote: > I don't understand the format fully but have now added this to prolo.cf: > > uri PROLO_PUBWEB_GEO_CHECK /^http:\/\/*\.geocities\.com\// > score PROLO_PUBWEB_GEO_CHECK 15.0 > describe PROLO_PUBWEB_GEO_CHECK PROLO_PUBWEB_GEO_CHECK, Body > > I hope this will trap any e-mail with geocities domain in it? > You made a small error in the regex: /^http:\/\/*\.geocities\.com\// will match http://.geocities.com/ or http:/.geocities.com/ or http://////.geocities.com/ What you want is: /^http:\/\/.*\.geocities\.com\// will match http://anything.geocities.com/ or http://.geocities.com/ If you don't want the dot in front of geocities, use: /^http:\/\/.*\bgeocities\.com\// will match http://geocities.com/ or http://anything-geocities.com/ but not http://nogeocities.com/ Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jan-Peter.Koopmann at SECEIDOS.DE Tue Aug 23 14:05:00 2005 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:30:37 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Tuesday, August 23, 2005 1:14 PM Julian Field wrote: > Check for the presence or absence of g+s perms on the dir. g+s is the default FreeBSD behaviour. So that should not be the prroblem. What next? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 23 14:33:49 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:37 2006 Subject: TNEF still a problem? Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Can anyone put up a message on a web server somewhere, that contains one of the bad TNEF messages please? I can't reproduce the problem. I've done a couple of tweaks, but I'm stabbing in the dark at the moment. On 23 Aug 2005, at 13:49, Julian Field wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On 23 Aug 2005, at 13:01, Stef Morrell wrote: > >> Julian wrote: >> >>> That's interesting. Maybe there's a new TNEF version out >>> there that the >>> module doesn't support properly. Has anyone checked the >>> Changelog of the >>> Convert::TNEF module? Am I a long way from the most recent version? >>> >>> >> >> I've just come across the same problem. Email gets caught up in a >> loop >> of trying to deal with the TNEF via the internal decoder and never >> gets >> delivered. Switching to the external decoder resolves the problem. >> >> In the latest MailScanner you are shipping Convert::TNEF 0.17, which >> seems to be the latest version, as CPAN shell insists my >> Convert::TNEF >> is up to date. >> >> Here's the wierd thing... >> >> MailScanner -v doesn't list Convert::TNEF at all, even though I can >> clearly see it's in the code... >> > > Fixed that now. Add > Convert/TNEF.pm > to the list of optional modules just after this line: > > >> my @Modules = qw/AnyDBM_File Archive::Zip Carp Convert::BinHex >> Convert::TNEF D >> ata::Dumper DirHandle Fcntl File::Basename File::Copy FileHandle >> File::Path File >> ::Temp HTML::Entities HTML::Parser HTML::TokeParser IO IO::File >> IO::Pipe >> Mail::C >> lamAV Mail::Header Mail::SpamAssassin MIME::Base64 MIME::Decoder >> MIME::Decoder:: >> UU MIME::Head MIME::Parser MIME::QuotedPrint MIME::Tools >> MIME::WordDecoder Net:: >> CIDR POSIX SAVI Socket Sys::Syslog Time::localtime/; >> > > This fix will be in the next release. > - -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > -----BEGIN PGP SIGNATURE----- > Version: PGP Desktop 9.0.2 (Build 2425) > > iQA/AwUBQwsbaxH2WUcUFbZUEQJ6dgCg0iEflRhkQk63oP6ETUbuol4Ee/kAn0lR > 8JjPWAPeg85zCQb8/SCtczBT > =OucB > -----END PGP SIGNATURE----- > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwslwBH2WUcUFbZUEQJ/egCgoX/tm5+3RW9P7YLMl0kjhB14LaIAoKG6 LkTAlZG+U4bJuHCcd2OegM2Z =nfiT -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dstraka at CASPERCOLLEGE.EDU Tue Aug 23 13:46:41 2005 From: dstraka at CASPERCOLLEGE.EDU (Daniel Straka) Date: Thu Jan 12 21:30:37 2006 Subject: Links in {Disarmed} Messages Still Function Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Should the web links in disarmed messages work? Mine do, what do I need to do? Dan Straka Casper College (307)268-2399 ** Visit Casper College Online at www.caspercollege.edu ** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 23 14:42:54 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:37 2006 Subject: Disarmed Content quarantine Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Forgive me for sounding thick, but... What were you trying to achieve? Saving the original or saving a tweaked copy? If saving a tweaked copy, why? On 23 Aug 2005, at 13:47, Rabellino Sergio wrote: > Peter Bonivart wrote: > > >> Rabellino Sergio wrote: >> >> >>> Dear list, >>> i cannot figure out if a "DISARMED CONTENT" can be quarantined. >>> The original email is changed, so if an user (or better the law) >>> wants the original message delivered later, I'vent a copy. >>> >>> How could this be done ? >>> >> >> >> Only blocked mail will be quarantined. If you set the content >> filters to yes or disarm they are still sent. You can use the >> archive function though. >> >> > Ok, I've figured out how to modify this behaviour, in attachments > my patches. > > Add a new config switch into Mailscanner.conf > > # Do you want to store copies of the modified messages? > Quarantine Modified Body = yes > > Then changed lib/Mailscanner/ConfigDefs.pl, lib/MailScanner/ > MessageBatch.pm and bin/Mailscanner to catch if a message had it's > body > modified in any way (disarming or other checks) and store it in > it's untouched form. > > P.s. I've not understood completely how to define a new conf > variable, so my 'method' must be confirmed if it's correct. > > Bye. > > -- > Dott. Mag. Sergio Rabellino > Technical Staff > Department of Computer Science > University of Torino (Italy) > > http://www.di.unito.it/~rabser > Tel. +39-0116706701 > Fax. +39-011751603 > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > 487d486 > < QuarantineModifiedBody 1 no 0 yes 1 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > 628,630d627 > < # Quarantine all the disarmed attachments > < $batch->QuarantineModifiedBody(); > < > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > 625,627d624 > < # Store all the disarmed files in the quarantine if they want me to. > < # Quarantine decision has to be done on a per-message basis. > < sub QuarantineModifiedBody { > 629,641d625 > < my $this = shift; > < > < my($id, $message); > < > < while(($id, $message) = each %{$this->{messages}}) { > < next unless $message->{bodymodified}; > < next if MailScanner::Config::Value('quarantinemodifiedbody', > $message) !~ /1/; > < > < $global::MS->{quar}->StoreInfections($message); > < MailScanner::Log::InfoLog("Quarantining modified message for > = " . $id . " bodymodified is " . $message->{bodymodified}); > < } > < } > < > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwsn4RH2WUcUFbZUEQJ8tACgu0eCgADRyl7WGb+FSKeOW9A3DesAn0Jc IgqEnuaMPkDIxitkWOMoTmW0 =s1gW -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 23 14:44:16 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:37 2006 Subject: Links in {Disarmed} Messages Still Function Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Yes, they should still work. Due to the nature of the problem, identifying phishing attacks can never be totally free of false alarms. So you need the original link to still work when that happens. On 23 Aug 2005, at 13:46, Daniel Straka wrote: > Should the web links in disarmed messages work? Mine do, what do I > need > to do? - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwsoMhH2WUcUFbZUEQLingCfW0IL493NL+KvwyoVdO8wSnXUgjgAoL0d JbHyHGDn4MEeGitVq7lHvmki =pX28 -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jan-Peter.Koopmann at SECEIDOS.DE Tue Aug 23 14:32:05 2005 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:30:37 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Tuesday, August 23, 2005 1:14 PM Julian Field wrote: > Check for the presence or absence of g+s perms on the dir. I am no perl-guru, but this looks suspicious to me: # Store it if they want that if ($actions{'store'}) { my($dir, $dir2, $spamdir, $uid, $gid, $changeowner); $uid = $global::MS->{quar}->{uid}; $gid = $global::MS->{quar}->{gid}; $changeowner = $global::MS->{quar}->{changeowner}; $dir = MailScanner::Config::Value('quarantinedir', $this); #$dir2 = $dir . '/' . MailScanner::Quarantine::TodayDir(); $dir2 = $dir . '/' . $this->{datenumber}; $spamdir = $dir2 . '/' . $HamSpam; #print STDERR "dir = $dir\ndir2 = $dir2\nspamdir = $spamdir\n"; umask $global::MS->{quar}->{dirumask}; unless (-d $dir) { mkdir $dir, 0777; chown $uid, $gid, $dir if $changeowner; } unless (-d $dir2) { mkdir $dir2, 0777; chown $uid, $gid, $dir2 if $changeowner; } unless (-d $spamdir) { mkdir $spamdir, 0777; chown $uid, $gid, $spamdir if $changeowner; } #print STDERR "Storing spam to $spamdir/" . $this->{id} . "\n"; #print STDERR "uid=$uid gid=$gid changeowner=$changeowner\n"; umask $global::MS->{quar}->{fileumask}; my @paths = $this->{store}->CopyEntireMessage($this, $spamdir, $this->{id}, $uid, $gid, $changeowner); # Remember where we have stored the spam in an archive, so we never # archive infected messages #print STDERR "Added " . join(',', @paths) . " to spamarchive\n"; push @{$this->{spamarchive}}, @paths; chown $uid, $gid, "$spamdir/" . $this->{id}; # Harmless if this fails } umask 0077; # Safety net This will do a chown $uid, $gid on the spam file will it not? I added some debugging code to this. At the time of the chown the variables contain this UID: 26 GID: 6 0 6 UID 26 --> mailnull --> correct GID: 6 --> mail --> not correct. I have Quarantine Group = getqmail which would be GID 8006. And of course the spam files are created belong to group 'mail'. So this looks like a MailScanner problem and not like a setup/FreeBSD problem. Regards, JP ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dstraka at CASPERCOLLEGE.EDU Tue Aug 23 14:05:44 2005 From: dstraka at CASPERCOLLEGE.EDU (Daniel Straka) Date: Thu Jan 12 21:30:37 2006 Subject: Links in {Disarmed} Messages Still Function Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Quoting Julian Field : > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Yes, they should still work. Due to the nature of the problem, > identifying phishing attacks can never be totally free of false > alarms. So you need the original link to still work when that > happens. > > On 23 Aug 2005, at 13:46, Daniel Straka wrote: > > > Should the web links in disarmed messages work? Mine do, what do I > > > need > > to do? > - -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > -----BEGIN PGP SIGNATURE----- > Version: PGP Desktop 9.0.2 (Build 2425) > > iQA/AwUBQwsoMhH2WUcUFbZUEQLingCfW0IL493NL+KvwyoVdO8wSnXUgjgAoL0d > JbHyHGDn4MEeGitVq7lHvmki > =pX28 > -----END PGP SIGNATURE----- > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > What is {Disarmed} telling the users then? Here, they're assuming that any link that works is safe because we've disarmed the bad ones. Dan Straka Casper College (307)268-2399 ** Visit Casper College Online at www.caspercollege.edu ** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rabellino at DI.UNITO.IT Tue Aug 23 15:03:01 2005 From: rabellino at DI.UNITO.IT (Rabellino Sergio) Date: Thu Jan 12 21:30:37 2006 Subject: Disarmed Content quarantine Message-ID: Julian Field wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >Forgive me for sounding thick, but... > >What were you trying to achieve? Saving the original or saving a >tweaked copy? If saving a tweaked copy, why? > > > I've checked the qf/df files, and the message appear as the original, not the modified version. So I believe that i'm saving the original copy, i'm wrong ? >On 23 Aug 2005, at 13:47, Rabellino Sergio wrote: > > > >>Peter Bonivart wrote: >> >> >> >> >>>Rabellino Sergio wrote: >>> >>> >>> >>> >>>>Dear list, >>>> i cannot figure out if a "DISARMED CONTENT" can be quarantined. >>>>The original email is changed, so if an user (or better the law) >>>>wants the original message delivered later, I'vent a copy. >>>> >>>>How could this be done ? >>>> >>>> >>>> >>>Only blocked mail will be quarantined. If you set the content >>>filters to yes or disarm they are still sent. You can use the >>>archive function though. >>> >>> >>> >>> >>Ok, I've figured out how to modify this behaviour, in attachments >>my patches. >> >>Add a new config switch into Mailscanner.conf >> >># Do you want to store copies of the modified messages? >>Quarantine Modified Body = yes >> >>Then changed lib/Mailscanner/ConfigDefs.pl, lib/MailScanner/ >>MessageBatch.pm and bin/Mailscanner to catch if a message had it's >>body >>modified in any way (disarming or other checks) and store it in >>it's untouched form. >> >>P.s. I've not understood completely how to define a new conf >>variable, so my 'method' must be confirmed if it's correct. >> >>Bye. >> >>-- >>Dott. Mag. Sergio Rabellino >>Technical Staff >>Department of Computer Science >>University of Torino (Italy) >> >>http://www.di.unito.it/~rabser >>Tel. +39-0116706701 >>Fax. +39-011751603 >> >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >>487d486 >>< QuarantineModifiedBody 1 no 0 yes 1 >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >>628,630d627 >>< # Quarantine all the disarmed attachments >>< $batch->QuarantineModifiedBody(); >>< >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >>625,627d624 >>< # Store all the disarmed files in the quarantine if they want me to. >>< # Quarantine decision has to be done on a per-message basis. >>< sub QuarantineModifiedBody { >>629,641d625 >>< my $this = shift; >>< >>< my($id, $message); >>< >>< while(($id, $message) = each %{$this->{messages}}) { >>< next unless $message->{bodymodified}; >>< next if MailScanner::Config::Value('quarantinemodifiedbody', >>$message) !~ /1/; >>< >>< $global::MS->{quar}->StoreInfections($message); >>< MailScanner::Log::InfoLog("Quarantining modified message for >>= " . $id . " bodymodified is " . $message->{bodymodified}); >>< } >>< } >>< >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >> >> > >- -- >Julian Field >www.MailScanner.info >Buy the MailScanner book at www.MailScanner.info/store >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > >-----BEGIN PGP SIGNATURE----- >Version: PGP Desktop 9.0.2 (Build 2425) > >iQA/AwUBQwsn4RH2WUcUFbZUEQJ8tACgu0eCgADRyl7WGb+FSKeOW9A3DesAn0Jc >IgqEnuaMPkDIxitkWOMoTmW0 >=s1gW >-----END PGP SIGNATURE----- > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > -- Dott. Mag. Sergio Rabellino Technical Staff Department of Computer Science University of Torino (Italy) http://www.di.unito.it/~rabser Tel. +39-0116706701 Fax. +39-011751603 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ebruce at HPMICH.COM Tue Aug 23 15:29:28 2005 From: ebruce at HPMICH.COM (Ed Bruce) Date: Thu Jan 12 21:30:37 2006 Subject: Links in {Disarmed} Messages Still Function Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Daniel Straka wrote: >What is {Disarmed} telling the users then? Here, they're assuming that >any link that works is safe because we've disarmed the bad ones. Yikes, never thought of that!!! Actually just came accross that the other day. A big email discussion about a {Disarmed} tagged email. In the end we told the CEO not to worry as it was a "Disarmed" link, glad he didn't click on the link. I understand the reason why the link is not actually defeated, but I'm changing that tag right now. Just need to think of something approriate, how about: {There is a subspicous link in this email please consider carefully before you click on it} Ok, just joking, but I need something like that, I'm guessing {Danger, Will Robinson! Danger!} won't work either. Any suggestions? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 23 15:47:40 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:37 2006 Subject: Possible bug with spam permissions Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm having a bit of a stupid day. What do you mean by "GID: 6 0 6" and what is wrong? And which chown are you talking about? I don't see your point at all. On 23 Aug 2005, at 14:32, Jan-Peter Koopmann wrote: > On Tuesday, August 23, 2005 1:14 PM Julian Field wrote: > > >> Check for the presence or absence of g+s perms on the dir. >> > > I am no perl-guru, but this looks suspicious to me: > > # Store it if they want that > if ($actions{'store'}) { > my($dir, $dir2, $spamdir, $uid, $gid, $changeowner); > $uid = $global::MS->{quar}->{uid}; > $gid = $global::MS->{quar}->{gid}; > $changeowner = $global::MS->{quar}->{changeowner}; > $dir = MailScanner::Config::Value('quarantinedir', $this); > #$dir2 = $dir . '/' . MailScanner::Quarantine::TodayDir(); > $dir2 = $dir . '/' . $this->{datenumber}; > $spamdir = $dir2 . '/' . $HamSpam; > #print STDERR "dir = $dir\ndir2 = $dir2\nspamdir = $spamdir\n"; > umask $global::MS->{quar}->{dirumask}; > unless (-d $dir) { > mkdir $dir, 0777; > chown $uid, $gid, $dir if $changeowner; > } > unless (-d $dir2) { > mkdir $dir2, 0777; > chown $uid, $gid, $dir2 if $changeowner; > } > unless (-d $spamdir) { > mkdir $spamdir, 0777; > chown $uid, $gid, $spamdir if $changeowner; > } > #print STDERR "Storing spam to $spamdir/" . $this->{id} . "\n"; > #print STDERR "uid=$uid gid=$gid changeowner=$changeowner\n"; > umask $global::MS->{quar}->{fileumask}; > my @paths = $this->{store}->CopyEntireMessage($this, $spamdir, > $this->{id}, > $uid, $gid, > $changeowner); > # Remember where we have stored the spam in an archive, so we > never > # archive infected messages > #print STDERR "Added " . join(',', @paths) . " to spamarchive\n"; > push @{$this->{spamarchive}}, @paths; > chown $uid, $gid, "$spamdir/" . $this->{id}; # Harmless if this > fails > } > umask 0077; # Safety net > > > This will do a chown $uid, $gid on the spam file will it not? I > added some debugging code to this. At the time of the chown the > variables contain this > > UID: 26 > GID: 6 0 6 > > UID 26 --> mailnull --> correct > GID: 6 --> mail --> not correct. > > I have > > Quarantine Group = getqmail > > which would be GID 8006. And of course the spam files are created > belong to group 'mail'. So this looks like a MailScanner problem > and not like a setup/FreeBSD problem. > > Regards, > JP > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQws3EBH2WUcUFbZUEQIeKACeIUPmyxTzyJtTxOe8ar5q5iug8OwAnie6 SW8HyzC4GYjS0t+Qq71zQAly =i6Ta -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ebruce at HPMICH.COM Tue Aug 23 15:53:27 2005 From: ebruce at HPMICH.COM (Ed Bruce) Date: Thu Jan 12 21:30:37 2006 Subject: Links in {Disarmed} Messages Still Function Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Yes, they should still work. Due to the nature of the problem, > identifying phishing attacks can never be totally free of false > alarms. So you need the original link to still work when that happens. > > On 23 Aug 2005, at 13:46, Daniel Straka wrote: > > >Should the web links in disarmed messages work? Mine do, what do I > >need > >to do? > If I set: Disarmed Modify Subject = yes Is this only fired off for suspicious links or are there other HTML tags that are disarmed? I'm still trying to come up with a tag that doesn't alarm or confuse our PHB :) ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 23 16:46:37 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:37 2006 Subject: Links in {Disarmed} Messages Still Function Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 23 Aug 2005, at 15:53, Ed Bruce wrote: > Julian Field wrote: > > >> Yes, they should still work. Due to the nature of the problem, >> identifying phishing attacks can never be totally free of false >> alarms. So you need the original link to still work when that >> happens. >> >> On 23 Aug 2005, at 13:46, Daniel Straka wrote: >> >> >Should the web links in disarmed messages work? Mine do, what do >> I >need >> >to do? >> >> > If I set: > > Disarmed Modify Subject = yes > > Is this only fired off for suspicious links or are there other HTML > tags that are disarmed? I'm still trying to come up with a tag that > doesn't alarm or confuse our PHB :) As phishing links are not disarmed, but just "brought to your attention", it does not do the "Disarmed Modify Subject" if that is all that was changed. The "Disarmed Modify" does what it says on the tin, it modifies the subject line if any HTML tags were "disarmed", i.e. altered due to a "disarm" request in MailScanner.conf. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwtE3xH2WUcUFbZUEQLUwACfVaC3tOdapV/WqZwFJzEABSrmFEwAoM6s qSbgF/DQHxnAjkQazf5yVEcI =sMM5 -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jaearick at COLBY.EDU Tue Aug 23 16:47:31 2005 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:30:37 2006 Subject: Clamav update problems, mirrors? Message-ID: Hi, Is anybody else seeing this kind of complaint in their ClamAV update log from the last day or so? ClamAV update process started at Tue Aug 23 11:42:28 2005 main.cvd is up to date (version: 33, sigs: 36102, f-level: 5, builder: tkojm) ERROR: Mirrors are not fully synchronized. Please try again later. Trying again in 5 secs... ClamAV update process started at Tue Aug 23 11:42:33 2005 main.cvd is up to date (version: 33, sigs: 36102, f-level: 5, builder: tkojm) The problem is that the daily.cvd file doesn't update. If I wipe out both the main.cvd and daily.cvd files and then rerun update_virus_scanners by hand, then both get updated. Then it fails again on the next cronjob. Scratching my head here... Anybody else seen this problem with ClamAV? Jeff Earickson Colby College ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 23 16:51:38 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:37 2006 Subject: Disarmed Content quarantine Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 23 Aug 2005, at 15:03, Rabellino Sergio wrote: > Julian Field wrote: > > >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> Forgive me for sounding thick, but... >> >> What were you trying to achieve? Saving the original or saving a >> tweaked copy? If saving a tweaked copy, why? >> >> >> > I've checked the qf/df files, and the message appear as the > original, not the modified version. > So I believe that i'm saving the original copy, i'm wrong ? Yes, you are saving the original copy. Is the concensus (general opinion of the majority) that it would be nice to have this as a feature? Will people use it if I include it? > > >> On 23 Aug 2005, at 13:47, Rabellino Sergio wrote: >> >> >> >>> Peter Bonivart wrote: >>> >>> >>> >>> >>>> Rabellino Sergio wrote: >>>> >>>> >>>> >>>> >>>>> Dear list, >>>>> i cannot figure out if a "DISARMED CONTENT" can be quarantined. >>>>> The original email is changed, so if an user (or better the >>>>> law) wants the original message delivered later, I'vent a copy. >>>>> >>>>> How could this be done ? >>>>> >>>>> >>>>> >>>> Only blocked mail will be quarantined. If you set the content >>>> filters to yes or disarm they are still sent. You can use the >>>> archive function though. >>>> >>>> >>>> >>>> >>> Ok, I've figured out how to modify this behaviour, in >>> attachments my patches. >>> >>> Add a new config switch into Mailscanner.conf >>> >>> # Do you want to store copies of the modified messages? >>> Quarantine Modified Body = yes >>> >>> Then changed lib/Mailscanner/ConfigDefs.pl, lib/MailScanner/ >>> MessageBatch.pm and bin/Mailscanner to catch if a message had >>> it's body >>> modified in any way (disarming or other checks) and store it in >>> it's untouched form. >>> >>> P.s. I've not understood completely how to define a new conf >>> variable, so my 'method' must be confirmed if it's correct. >>> >>> Bye. >>> >>> -- >>> Dott. Mag. Sergio Rabellino >>> Technical Staff >>> Department of Computer Science >>> University of Torino (Italy) >>> >>> http://www.di.unito.it/~rabser >>> Tel. +39-0116706701 >>> Fax. +39-011751603 >>> >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> 487d486 >>> < QuarantineModifiedBody 1 no 0 yes 1 >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> 628,630d627 >>> < # Quarantine all the disarmed attachments >>> < $batch->QuarantineModifiedBody(); >>> < >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> 625,627d624 >>> < # Store all the disarmed files in the quarantine if they want >>> me to. >>> < # Quarantine decision has to be done on a per-message basis. >>> < sub QuarantineModifiedBody { >>> 629,641d625 >>> < my $this = shift; >>> < >>> < my($id, $message); >>> < >>> < while(($id, $message) = each %{$this->{messages}}) { >>> < next unless $message->{bodymodified}; >>> < next if MailScanner::Config::Value >>> ('quarantinemodifiedbody', $message) !~ /1/; >>> < >>> < $global::MS->{quar}->StoreInfections($message); >>> < MailScanner::Log::InfoLog("Quarantining modified message >>> for = " . $id . " bodymodified is " . $message->{bodymodified}); >>> < } >>> < } >>> < >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >>> >> >> - -- Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> >> -----BEGIN PGP SIGNATURE----- >> Version: PGP Desktop 9.0.2 (Build 2425) >> >> iQA/AwUBQwsn4RH2WUcUFbZUEQJ8tACgu0eCgADRyl7WGb+FSKeOW9A3DesAn0Jc >> IgqEnuaMPkDIxitkWOMoTmW0 >> =s1gW >> -----END PGP SIGNATURE----- >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> > > > -- > Dott. Mag. Sergio Rabellino > Technical Staff > Department of Computer Science > University of Torino (Italy) > > http://www.di.unito.it/~rabser > Tel. +39-0116706701 > Fax. +39-011751603 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwtGDBH2WUcUFbZUEQJqLwCg3d3B/n2bCSUlNb2WoMZQONAnE/UAoNaq Q+m103QtCzPFtXJ5ceWT1rAn =UjZI -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jfagan at FIRSTLIGHTNETWORKS.COM Tue Aug 23 17:58:18 2005 From: jfagan at FIRSTLIGHTNETWORKS.COM (James Fagan) Date: Thu Jan 12 21:30:37 2006 Subject: Clamav update problems, mirrors? Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Jeff A. Earickson > Sent: Tuesday, August 23, 2005 8:48 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: [MAILSCANNER] Clamav update problems, mirrors? > > Hi, > > Is anybody else seeing this kind of complaint in their ClamAV > update log from the last day or so? > > ClamAV update process started at Tue Aug 23 11:42:28 2005 > main.cvd is up to date (version: 33, sigs: 36102, f-level: 5, > builder: tkojm) > ERROR: Mirrors are not fully synchronized. Please try again later. > Trying again in 5 secs... > ClamAV update process started at Tue Aug 23 11:42:33 2005 > main.cvd is up to date (version: 33, sigs: 36102, f-level: 5, > builder: tkojm) > > The problem is that the daily.cvd file doesn't update. If I > wipe out both the main.cvd and daily.cvd files and then rerun > update_virus_scanners by hand, then both get updated. Then > it fails again on the next cronjob. Scratching my head here... > > Anybody else seen this problem with ClamAV? > > Jeff Earickson > Colby College > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > I have seen that message "ClamAV update warning: ERROR: Mirrors are not fully synchronized. Please try again later." in my logs but only once yesterday. The next message 2 minutes later indicated that ClamAV did update. A little odd. What happens if you run 'freshclam' ? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ebruce at HPMICH.COM Tue Aug 23 18:26:30 2005 From: ebruce at HPMICH.COM (Ed Bruce) Date: Thu Jan 12 21:30:37 2006 Subject: Links in {Disarmed} Messages Still Function Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > > The "Disarmed Modify" does what it says on the tin, it modifies the > subject line if any HTML tags were "disarmed", i.e. altered due to a > "disarm" request in MailScanner.conf. > If I receive an email with no tags that are disarmed the subject is not changed if a link is modified by MS? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jaearick at COLBY.EDU Tue Aug 23 18:28:55 2005 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:30:37 2006 Subject: Clamav update problems, mirrors? Message-ID: On Tue, 23 Aug 2005, James Fagan wrote: > > I have seen that message "ClamAV update warning: ERROR: Mirrors are not > fully synchronized. Please try again later." in my logs but only once > yesterday. The next message 2 minutes later indicated that ClamAV did > update. A little odd. What happens if you run 'freshclam' ? Here is what happened when I ran freshclam by hand: > freshclam -v Current working dir is /opt/clamav-0.86.2/share/clamav Max retries == 3 ClamAV update process started at Tue Aug 23 13:12:01 2005 Querying current.cvd.clamav.net TTL: 900 Software version from DNS: 0.86.2 main.cvd version from DNS: 33 main.cvd is up to date (version: 33, sigs: 36102, f-level: 5, builder: tkojm) daily.cvd version from DNS: 1036 Retrieving http://db.us.clamav.net/daily.cvd Downloading daily.cvd [*] ERROR: Mirrors are not fully synchronized. Please try again later. Trying again in 5 secs... ClamAV update process started at Tue Aug 23 13:12:10 2005 Querying current.cvd.clamav.net TTL: 891 Software version from DNS: 0.86.2 main.cvd version from DNS: 33 main.cvd is up to date (version: 33, sigs: 36102, f-level: 5, builder: tkojm) daily.cvd version from DNS: 1036 Retrieving http://db.us.clamav.net/daily.cvd Downloading daily.cvd [*] ERROR: Mirrors are not fully synchronized. Please try again later. Trying again in 5 secs... ClamAV update process started at Tue Aug 23 13:12:15 2005 Querying current.cvd.clamav.net TTL: 886 Software version from DNS: 0.86.2 main.cvd version from DNS: 33 main.cvd is up to date (version: 33, sigs: 36102, f-level: 5, builder: tkojm) daily.cvd version from DNS: 1036 Retrieving http://db.us.clamav.net/daily.cvd Downloading daily.cvd [*] ERROR: Mirrors are not fully synchronized. Please try again later. Giving up on db.us.clamav.net... ClamAV update process started at Tue Aug 23 13:12:16 2005 Querying current.cvd.clamav.net TTL: 885 Software version from DNS: 0.86.2 main.cvd version from DNS: 33 main.cvd is up to date (version: 33, sigs: 36102, f-level: 5, builder: tkojm) daily.cvd version from DNS: 1036 Retrieving http://database.clamav.net/daily.cvd Downloading daily.cvd [*] daily.cvd updated (version: 1036, sigs: 3290, f-level: 5, builder: arnaud) Database updated (39392 signatures) from database.clamav.net (IP: 84.18.202.162) Freeing option list...done It takes all three retries to succeed. Julian, is there some tweakable setting for max retries, or does MailScanner use whatever is set in the freshclam.conf file? Jeff Earickson Colby College ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 23 18:37:19 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:37 2006 Subject: Links in {Disarmed} Messages Still Function Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Ed Bruce wrote: > Julian Field wrote: > >> >> The "Disarmed Modify" does what it says on the tin, it modifies the >> subject line if any HTML tags were "disarmed", i.e. altered due to a >> "disarm" request in MailScanner.conf. >> > If I receive an email with no tags that are disarmed the subject is > not changed if a link is modified by MS? Correct. I didn't want the phishing net to obviously cry wolf where it got it wrong. The link has not been disarmed, it still works and has only had its appearance changed. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQwte0BH2WUcUFbZUEQI/dACfaS1dNRJIpvkp+TnvtK7T1zev2U8AnjyY XeBPuinc74yE4FJh3XzjUFjF =zwpZ -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 23 18:41:10 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:37 2006 Subject: Clamav update problems, mirrors? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Jeff A. Earickson wrote: > On Tue, 23 Aug 2005, James Fagan wrote: > >> >> I have seen that message "ClamAV update warning: ERROR: Mirrors are not >> fully synchronized. Please try again later." in my logs but only once >> yesterday. The next message 2 minutes later indicated that ClamAV did >> update. A little odd. What happens if you run 'freshclam' ? > > > Here is what happened when I ran freshclam by hand: > >> freshclam -v > > ...SNIP... > It takes all three retries to succeed. Julian, is there some tweakable > setting for max retries, or does MailScanner use whatever is set in > the freshclam.conf file? It just uses whatever is in freshclam.conf, there's nothing fancy in the autoupdate script. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQwtftxH2WUcUFbZUEQLUGACgoZM3D0OATDOA7S9mSzkHtnyMXwYAnjXT 8EL/HnRPK35xqdyg3OSjIhAl =to8k -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jfagan at FIRSTLIGHTNETWORKS.COM Tue Aug 23 19:01:16 2005 From: jfagan at FIRSTLIGHTNETWORKS.COM (James Fagan) Date: Thu Jan 12 21:30:37 2006 Subject: Clamav update problems, mirrors? Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field > Sent: Tuesday, August 23, 2005 10:41 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: [MAILSCANNER] Clamav update problems, mirrors? > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Jeff A. Earickson wrote: > > > On Tue, 23 Aug 2005, James Fagan wrote: > > > >> > >> I have seen that message "ClamAV update warning: ERROR: > Mirrors are > >> not fully synchronized. Please try again later." in my > logs but only > >> once yesterday. The next message 2 minutes later indicated that > >> ClamAV did update. A little odd. What happens if you run > 'freshclam' ? > > > > > > Here is what happened when I ran freshclam by hand: > > > >> freshclam -v > > > > ...SNIP... > > It takes all three retries to succeed. Julian, is there some > > tweakable setting for max retries, or does MailScanner use > whatever is > > set in the freshclam.conf file? > > It just uses whatever is in freshclam.conf, there's nothing > fancy in the autoupdate script. > > - -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > -----BEGIN PGP SIGNATURE----- > Version: PGP Desktop 9.0.2 (Build 2424) > > iQA/AwUBQwtftxH2WUcUFbZUEQLUGACgoZM3D0OATDOA7S9mSzkHtnyMXwYAnjXT > 8EL/HnRPK35xqdyg3OSjIhAl > =to8k > -----END PGP SIGNATURE----- > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > Jeff, You may be stuck and retrieving using the same mirror somehow. In your case, it updates but only from: ============================================================== Software version from DNS: 0.86.2 main.cvd version from DNS: 33 main.cvd is up to date (version: 33, sigs: 36102, f-level: 5, builder: tkojm) daily.cvd version from DNS: 1036 Retrieving http://database.clamav.net/daily.cvd Downloading daily.cvd [*] daily.cvd updated (version: 1036, sigs: 3290, f-level: 5, builder: arnaud) Database updated (39392 signatures) from database.clamav.net (IP: 84.18.202.162) Freeing option list...done ============================================================== That is using the last mirror (last resort and not recommended according to ClamAV) instead of the db.US.clamav.net. However, there is a list of of the mirrors on http://www.clamav.net/mirrors.html . I commented out the other DatabaseMirror entries and added one from the list in the USA, it seemed to work fine and I was able to retrieve an update after I moved the dail.cvd. Might be handy to have a little list of the other US mirrors incase you get stuck. Of cource I have no idea how often those mirrors change. Just an idea. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jaearick at COLBY.EDU Tue Aug 23 19:29:51 2005 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:30:37 2006 Subject: Clamav update problems, mirrors? Message-ID: On Tue, 23 Aug 2005, James Fagan wrote: > > Jeff, > > You may be stuck and retrieving using the same mirror somehow. In your > case, it updates but only from: > > ============================================================== > Software version from DNS: 0.86.2 > main.cvd version from DNS: 33 > main.cvd is up to date (version: 33, sigs: 36102, f-level: 5, builder: > tkojm) daily.cvd version from DNS: 1036 Retrieving > http://database.clamav.net/daily.cvd > Downloading daily.cvd [*] > daily.cvd updated (version: 1036, sigs: 3290, f-level: 5, builder: > arnaud) Database updated (39392 signatures) from database.clamav.net > (IP: 84.18.202.162) Freeing option list...done > ============================================================== > > > That is using the last mirror (last resort and not recommended according > to ClamAV) instead of the db.US.clamav.net. However, there is a list of > of the mirrors on http://www.clamav.net/mirrors.html . I commented out > the other DatabaseMirror entries and added one from the list in the USA, > it seemed to work fine and I was able to retrieve an update after I > moved the dail.cvd. Might be handy to have a little list of the other > US mirrors incase you get stuck. Of cource I have no idea how often > those mirrors change. Just an idea. Ahah! The ClamAV gurus told me to uncomment the line DNSDatabaseInfo current.cvd.clamav.net in my freshclam.conf file, and things started working again. This line had always been commented out before, per the ClamAV default. Jeff Earickson Colby College ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From vachanta at GMAIL.COM Tue Aug 23 19:32:34 2005 From: vachanta at GMAIL.COM (Venkata Achanta) Date: Thu Jan 12 21:30:37 2006 Subject: Spam Actions Message-ID: Hello List, I currently have a MailScanner box which is a MX host (which delivers to exchange) for 3 domains say abc.com def.com ghi.com and my spam actions are set to "forward spam@abc.com". Currently all the spam for the three domains is hitting a single mailbox.Now I want these spam e-mails to be routed to 3 different mailboxes on the exchange based on the source/destination domain. The mailscanner manual says this can be file name of a rule set. I wanted to check if this is the correct way to do it. In MailScanner.conf spam actions = %rules-dir%/spamactions.rules spamactions.rules file will contain the following FromOrTo: *@abc.com forward spam@abc.com FromOrTo: *@def.com forward spam@def.com FromOrTo: *@ghi.com forward spam@ghi.com Is this the way to do it ? Thanks much, Venkata Achanta ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From joost at WAVERSVELD.NL Tue Aug 23 20:17:45 2005 From: joost at WAVERSVELD.NL (Joost Waversveld) Date: Thu Jan 12 21:30:37 2006 Subject: Spam Actions Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] ----- Bericht van vachanta@GMAIL.COM --------- Datum: Tue, 23 Aug 2005 19:32:34 +0100 Van: Venkata Achanta Antwoorden aan:MailScanner mailing list Onderwerp: Spam Actions Aan: MAILSCANNER@JISCMAIL.AC.UK > Hello List, > > I currently have a MailScanner box which is a MX host (which delivers to > exchange) for 3 domains say abc.com def.com ghi.com and my spam actions are > set to "forward spam@abc.com". > > Currently all the spam for the three domains is hitting a single > mailbox.Now I want these spam e-mails to be routed to 3 different mailboxes > on the exchange based on the source/destination domain. > > The mailscanner manual says this can be file name of a rule set. > > I wanted to check if this is the correct way to do it. > > In MailScanner.conf > > spam actions = %rules-dir%/spamactions.rules > > spamactions.rules file will contain the following > > FromOrTo: *@abc.com forward spam@abc.com > FromOrTo: *@def.com forward spam@def.com > FromOrTo: *@ghi.com forward spam@ghi.com > > Is this the way to do it ? > > Thanks much, > Venkata Achanta > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ----- Einde bericht van vachanta@GMAIL.COM ----- Yes, that would the way to do it.... Perhaps it is an idea to also define an default action by adding FromOrTo: default store to the file... just to be sure..... Perhaps there is an way to do this with some kind of regular expression, but that I don't know. Maybe someone else knows? Joost Waversveld ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 23 20:33:26 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:37 2006 Subject: Spam Actions Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 That looks fine to me. Keep an eye on your maillog as MailScanner is starting up. You will see a series of "starting" messages as each of the child processes start up, but no error messages. Venkata Achanta wrote: >Hello List, > > I currently have a MailScanner box which is a MX host (which delivers to >exchange) for 3 domains say abc.com def.com ghi.com and my spam actions are >set to "forward spam@abc.com". > >Currently all the spam for the three domains is hitting a single >mailbox.Now I want these spam e-mails to be routed to 3 different mailboxes >on the exchange based on the source/destination domain. > >The mailscanner manual says this can be file name of a rule set. > >I wanted to check if this is the correct way to do it. > >In MailScanner.conf > >spam actions = %rules-dir%/spamactions.rules > >spamactions.rules file will contain the following > >FromOrTo: *@abc.com forward spam@abc.com >FromOrTo: *@def.com forward spam@def.com >FromOrTo: *@ghi.com forward spam@ghi.com > >Is this the way to do it ? > > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQwt6BxH2WUcUFbZUEQJYxACfdvqfjPWbHcCtI7RpFSk0qTybCSwAn2vE vmOtkdDIcbJRYINPJjACN89+ =NiTA -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Tue Aug 23 20:44:54 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:37 2006 Subject: High CPU system usage Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi everyone, During a period of high load, a server shows a lot of system CPU time in use. We got a big backlog during this period. Here is an excerpt of the sar report for this period. Any ideas welcome... this is kernel 2.4 from Whitebox linux 3. Please ask if you need more details. 09:20:00 AM all 77.69 0.00 15.58 1.03 5.70 09:20:00 AM 0 77.48 0.00 15.87 0.99 5.66 09:20:00 AM 1 77.90 0.00 15.29 1.07 5.74 09:30:00 AM all 74.27 0.00 14.41 1.02 10.30 09:30:00 AM 0 74.38 0.00 14.81 1.01 9.81 09:30:00 AM 1 74.17 0.00 14.00 1.04 10.79 09:40:01 AM all 74.15 0.00 13.85 0.98 11.01 09:40:01 AM 0 73.84 0.00 13.93 1.02 11.21 09:40:01 AM 1 74.46 0.00 13.78 0.95 10.81 09:50:01 AM all 77.80 0.00 14.66 1.12 6.41 09:50:01 AM 0 77.83 0.00 14.81 1.06 6.29 09:50:01 AM 1 77.77 0.00 14.51 1.18 6.53 10:00:00 AM all 79.11 0.00 17.06 0.94 2.89 10:00:00 AM 0 78.97 0.00 17.14 1.02 2.88 10:00:00 AM 1 79.25 0.00 16.98 0.86 2.91 10:10:01 AM all 80.71 0.00 15.30 0.54 3.45 10:10:01 AM 0 80.60 0.00 15.34 0.56 3.50 10:10:01 AM 1 80.82 0.00 15.26 0.53 3.40 10:20:01 AM all 72.02 0.00 12.79 1.01 14.18 10:20:01 AM 0 72.06 0.00 12.81 0.97 14.15 10:20:01 AM 1 71.99 0.00 12.76 1.04 14.22 10:30:01 AM all 69.96 0.00 12.66 1.17 16.21 10:30:01 AM 0 69.86 0.00 12.60 1.16 16.38 10:30:01 AM 1 70.05 0.00 12.73 1.18 16.04 10:40:00 AM all 77.87 0.00 15.42 0.58 6.13 10:40:00 AM 0 77.90 0.00 15.45 0.58 6.07 10:40:00 AM 1 77.85 0.00 15.38 0.59 6.18 10:49:59 AM all 65.56 0.00 17.65 3.93 12.87 10:49:59 AM 0 64.74 0.00 17.76 3.89 13.61 10:49:59 AM 1 66.37 0.00 17.54 3.96 12.13 11:00:01 AM all 64.52 0.00 22.36 6.82 6.30 11:00:01 AM 0 64.78 0.00 22.18 6.75 6.28 11:00:01 AM 1 64.26 0.00 22.55 6.89 6.31 11:10:01 AM all 64.00 0.00 21.29 6.63 8.08 11:10:01 AM 0 63.83 0.00 21.29 6.66 8.23 11:10:01 AM 1 64.17 0.00 21.30 6.60 7.93 11:20:00 AM all 69.71 0.00 21.51 3.57 5.21 11:20:00 AM 0 69.45 0.00 21.55 3.62 5.39 11:20:00 AM 1 69.98 0.00 21.47 3.52 5.03 Average: all 50.51 0.00 10.56 2.32 36.61 Average: 0 50.38 0.00 10.62 2.33 36.68 Average: 1 50.64 0.00 10.50 2.31 36.55 Regards, -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Tue Aug 23 21:18:30 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:37 2006 Subject: High CPU system usage Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ugo Bellavance wrote: >Hi everyone, > > During a period of high load, a server shows a lot of system CPU time >in use. We got a big backlog during this period. Here is an excerpt of >the sar report for this period. Any ideas welcome... this is kernel 2.4 >from Whitebox linux 3. Please ask if you need more details. > >09:20:00 AM all 77.69 0.00 15.58 1.03 5.70 >09:20:00 AM 0 77.48 0.00 15.87 0.99 5.66 >09:20:00 AM 1 77.90 0.00 15.29 1.07 5.74 >09:30:00 AM all 74.27 0.00 14.41 1.02 10.30 >09:30:00 AM 0 74.38 0.00 14.81 1.01 9.81 >09:30:00 AM 1 74.17 0.00 14.00 1.04 10.79 >09:40:01 AM all 74.15 0.00 13.85 0.98 11.01 >09:40:01 AM 0 73.84 0.00 13.93 1.02 11.21 >09:40:01 AM 1 74.46 0.00 13.78 0.95 10.81 >09:50:01 AM all 77.80 0.00 14.66 1.12 6.41 >09:50:01 AM 0 77.83 0.00 14.81 1.06 6.29 >09:50:01 AM 1 77.77 0.00 14.51 1.18 6.53 >10:00:00 AM all 79.11 0.00 17.06 0.94 2.89 >10:00:00 AM 0 78.97 0.00 17.14 1.02 2.88 >10:00:00 AM 1 79.25 0.00 16.98 0.86 2.91 >10:10:01 AM all 80.71 0.00 15.30 0.54 3.45 >10:10:01 AM 0 80.60 0.00 15.34 0.56 3.50 >10:10:01 AM 1 80.82 0.00 15.26 0.53 3.40 >10:20:01 AM all 72.02 0.00 12.79 1.01 14.18 >10:20:01 AM 0 72.06 0.00 12.81 0.97 14.15 >10:20:01 AM 1 71.99 0.00 12.76 1.04 14.22 >10:30:01 AM all 69.96 0.00 12.66 1.17 16.21 >10:30:01 AM 0 69.86 0.00 12.60 1.16 16.38 >10:30:01 AM 1 70.05 0.00 12.73 1.18 16.04 >10:40:00 AM all 77.87 0.00 15.42 0.58 6.13 >10:40:00 AM 0 77.90 0.00 15.45 0.58 6.07 >10:40:00 AM 1 77.85 0.00 15.38 0.59 6.18 >10:49:59 AM all 65.56 0.00 17.65 3.93 12.87 >10:49:59 AM 0 64.74 0.00 17.76 3.89 13.61 >10:49:59 AM 1 66.37 0.00 17.54 3.96 12.13 >11:00:01 AM all 64.52 0.00 22.36 6.82 6.30 >11:00:01 AM 0 64.78 0.00 22.18 6.75 6.28 >11:00:01 AM 1 64.26 0.00 22.55 6.89 6.31 >11:10:01 AM all 64.00 0.00 21.29 6.63 8.08 >11:10:01 AM 0 63.83 0.00 21.29 6.66 8.23 >11:10:01 AM 1 64.17 0.00 21.30 6.60 7.93 >11:20:00 AM all 69.71 0.00 21.51 3.57 5.21 >11:20:00 AM 0 69.45 0.00 21.55 3.62 5.39 >11:20:00 AM 1 69.98 0.00 21.47 3.52 5.03 > >Average: all 50.51 0.00 10.56 2.32 36.61 >Average: 0 50.38 0.00 10.62 2.33 36.68 >Average: 1 50.64 0.00 10.50 2.31 36.55 > >Regards, > > Ugo, I'm guessing your output refers to: Time CPU %user %nice %system %iowait %idle Those numbers are not uncommon here and the server copes well with incoming traffic... Is your server swapping? It doesn't seem to be I/O depraved either (mine show worst iowait but I only have a single disk). What processes are displayed by top when this happens? Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From ugob at CAMO-ROUTE.COM Tue Aug 23 21:06:46 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:37 2006 Subject: Can I see what MailScanner is doing? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > On 23 Aug 2005, at 09:43, Remco Barendse wrote: > > >>>Hi! >>> >>>I just added the prolo.cf rule but after restarting MailScanner >>>mail just seems to be piling up in /var/spool/mqueue.in >>> >>>I removed the rule and restarted mailscanner again. When I run top >>>I see MailScanner is eating up cpu time but nothing seems to appear >>>in the maillog. >>> >>>Is there any place I can see what MailScanner is doing?? > > > This must be in the MAQ or Wiki somewhere, but I can't find it right > now. > Shutdown MailScanner, set "Debug = yes" and "Debug SpamAssassin = > yes" in MailScanner.conf, then "check_MailScanner". It will probably > die with some error message, that will hopefully shed some light on > what is wrong. Fix the problem, put the debug options back to no > again and restart MailScanner. I wrote it here http://wiki.mailscanner.info/doku.php?id=documentation:test_troubleshoot:mailscanner I hope it is okay. -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Tue Aug 23 21:40:03 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:37 2006 Subject: High CPU system usage Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Denis Beauchemin wrote: > Ugo Bellavance wrote: > >> Hi everyone, >> >> During a period of high load, a server shows a lot of system CPU time >> in use. We got a big backlog during this period. Here is an excerpt of >> the sar report for this period. Any ideas welcome... this is kernel 2.4 >> from Whitebox linux 3. Please ask if you need more details. >> >> 09:20:00 AM all 77.69 0.00 15.58 1.03 5.70 >> 11:20:00 AM all 69.71 0.00 21.51 3.57 5.21 >> 11:20:00 AM 0 69.45 0.00 21.55 3.62 5.39 >> 11:20:00 AM 1 69.98 0.00 21.47 3.52 5.03 >> >> Average: all 50.51 0.00 10.56 2.32 36.61 >> Average: 0 50.38 0.00 10.62 2.33 36.68 >> Average: 1 50.64 0.00 10.50 2.31 36.55 >> >> Regards, >> >> > Ugo, > > I'm guessing your output refers to: > Time CPU %user %nice %system %iowait %idle Yes, sorry for not including headers. > > Those numbers are not uncommon here and the server copes well with > incoming traffic... Hmmm :(. > > Is your server swapping? Hmmm, maybe, but I doubt: pgpgin/s pgpgout/s fault/s majflt/s 09:00:00 AM 2187.94 842.26 0.00 0.00 09:10:01 AM 353.43 809.87 0.00 0.00 09:20:00 AM 13.83 1090.68 0.00 0.00 09:30:00 AM 11.58 784.81 0.00 0.00 09:40:01 AM 10.53 879.31 0.00 0.00 09:50:01 AM 16.01 1060.91 0.00 0.00 10:00:00 AM 25.72 1148.84 0.00 0.00 10:10:01 AM 11.08 1240.19 0.00 0.00 10:20:01 AM 7.20 944.66 0.00 0.00 10:30:01 AM 6.74 798.89 0.00 0.00 10:40:00 AM 8.16 1138.00 0.00 0.00 10:49:59 AM 26.20 1299.30 0.00 0.00 11:00:01 AM 48.54 1389.26 0.00 0.00 11:10:01 AM 41.01 1329.57 0.00 0.00 11:20:00 AM 31.18 1134.27 0.00 0.00 11:30:00 AM 12.41 970.13 0.00 0.00 From joshua.hirsh at PARTNERSOLUTIONS.CA Tue Aug 23 22:11:35 2005 From: joshua.hirsh at PARTNERSOLUTIONS.CA (Joshua Hirsh) Date: Thu Jan 12 21:30:37 2006 Subject: High CPU system usage Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > Can't tell right now, i'll check next time such a burst > happens. We are running with 10 child processes on a HT 2.8 P4 with 2 GB RAM. How much mail are you processing? You should be able to handle quite a bit of messages with a server like that. Is your IDE drive connected via SATA? A quick test might be to test the read/write performance of the drive during off-hours and during your peak hours to see how much of a deviation occurs between the two. Although it's probably not the answer you want, you should see a performance boost by moving to a 2.6 based kernel (I'd personally recommend either CentOS or Tao for the task). I definitely noticed an overall system performance boost after migrating my servers to one of the newer RHEL4 rebuilds. Cheers, -Joshua ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Tue Aug 23 23:41:55 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:37 2006 Subject: High CPU system usage Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Joshua Hirsh wrote: >>Can't tell right now, i'll check next time such a burst >>happens. We are running with 10 child processes on a HT 2.8 P4 with 2 GB RAM. > > > How much mail are you processing? You should be able to handle quite a bit of messages with a server like that. Is your IDE drive connected via SATA? > Between 15 000 and 50 000 /day. > A quick test might be to test the read/write performance of the drive during off-hours and during your peak hours to see how much of a deviation occurs between the two. > > > > Although it's probably not the answer you want, you should see a performance boost by moving to a 2.6 based kernel (I'd personally recommend either CentOS or Tao for the task). I definitely noticed an overall system performance boost after migrating my servers to one of the newer RHEL4 rebuilds. > > I already thought about that. Anyone seen a significant improvement in performance on a switch to 2.6? Joshua, can you share your stats about CPU % system usage with a 2.6 kernel? Thanks, > Cheers, > -Joshua > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From nerijus at USERS.SOURCEFORGE.NET Wed Aug 24 00:24:11 2005 From: nerijus at USERS.SOURCEFORGE.NET (Nerijus Baliunas) Date: Thu Jan 12 21:30:38 2006 Subject: Disarmed Content quarantine Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Tue, 23 Aug 2005 16:51:38 +0100 Julian Field wrote: > Yes, you are saving the original copy. > Is the concensus (general opinion of the majority) that it would be > nice to have this as a feature? > Will people use it if I include it? Yes, why not? For example, to verify what exactly was disarmed. Regards, Nerijus ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jan-Peter.Koopmann at SECEIDOS.DE Wed Aug 24 08:26:37 2005 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:30:38 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Tuesday, August 23, 2005 4:48 PM Julian Field wrote: > I'm having a bit of a stupid day. What do you mean by "GID: 6 0 6" > and what is wrong? And which chown are you talking about? I don't see > your point at all. OK, let me start over: Setup: Run as Group = mail Quarantine Group = getqmail Problem: Quarantined virus (etc.) mail is created under /var/spool/Mailscanner/quarantine/date/Message-ID/... The group of those directories and the files in them is correct: getqmail. So far so good. But: Quarantined spam mail is created under /var/spool/Mailscanner/quarantine/date/spam/... The directory belongs to the correct group (getqmail) but the spam mails in there belong to group mail. Which clearly is wrong. Now I debugged a bit in Message.pm and found the following bits of code: >> # Store it if they want that >> if ($actions{'store'}) { >> my($dir, $dir2, $spamdir, $uid, $gid, $changeowner); >> $uid = $global::MS->{quar}->{uid}; >> $gid = $global::MS->{quar}->{gid}; >> $changeowner = $global::MS->{quar}->{changeowner}; >> $dir = MailScanner::Config::Value('quarantinedir', $this); >> #$dir2 = $dir . '/' . MailScanner::Quarantine::TodayDir(); >> $dir2 = $dir . '/' . $this->{datenumber}; >> $spamdir = $dir2 . '/' . $HamSpam; >> #print STDERR "dir = $dir\ndir2 = $dir2\nspamdir = $spamdir\n"; >> umask $global::MS->{quar}->{dirumask}; >> unless (-d $dir) { >> mkdir $dir, 0777; >> chown $uid, $gid, $dir if $changeowner; >> } >> unless (-d $dir2) { >> mkdir $dir2, 0777; >> chown $uid, $gid, $dir2 if $changeowner; >> } >> unless (-d $spamdir) { >> mkdir $spamdir, 0777; >> chown $uid, $gid, $spamdir if $changeowner; >> } >> #print STDERR "Storing spam to $spamdir/" . $this->{id} . "\n"; >> #print STDERR "uid=$uid gid=$gid changeowner=$changeowner\n"; >> umask $global::MS->{quar}->{fileumask}; >> my @paths = $this->{store}->CopyEntireMessage($this, $spamdir, >> $this->{id}, $uid, >> $gid, $changeowner); # Remember where we have stored the spam in >> an archive, so we never # archive infected messages >> #print STDERR "Added " . join(',', @paths) . " to spamarchive\n"; >> push @{$this->{spamarchive}}, @paths; >> chown $uid, $gid, "$spamdir/" . $this->{id}; # Harmless if this >> fails } >> umask 0077; # Safety net If I understand this correctly, this code stores spam-mails. The third last row reads chown $uid, $gid, "$spamdir/" . $this->{id}; I put Print STDERR "UID: $uid / GID: $gid\n"; in front of it and debugged it. The result was: UID: 26 / GID: 6 0 6 uid 26 corresponds to user mailnull --> correct Gid 6 (no idea where the 0 6 come from) corresponds to group mail --> incorrect. This definately explains why stored spam mails have the wrong group however. I suspect the broken part of the code is this: >> $uid = $global::MS->{quar}->{uid}; >> $gid = $global::MS->{quar}->{gid}; Which should probably read something like this $uid = $workarea->{uid}; $gid = $workarea->{gid}; In order to get the correct Ids from the config file. The next remaining question would be, why GID equals "6 0 6" and not only one "6". I have no idea. :-) Kind regards, JP ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Aug 24 08:38:52 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:38 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jan-Peter Koopmann wrote: > On Tuesday, August 23, 2005 4:48 PM Julian Field wrote: > > >>I'm having a bit of a stupid day. What do you mean by "GID: 6 0 6" >>and what is wrong? And which chown are you talking about? I don't see >>your point at all. > > > OK, let me start over: > > Setup: > Run as Group = mail > Quarantine Group = getqmail > > Problem: > Quarantined virus (etc.) mail is created under > > /var/spool/Mailscanner/quarantine/date/Message-ID/... > > The group of those directories and the files in them is correct: getqmail. So far so good. But: > > Quarantined spam mail is created under > > /var/spool/Mailscanner/quarantine/date/spam/... > > The directory belongs to the correct group (getqmail) but the spam mails in there belong to group mail. Which clearly is wrong. Now I debugged a bit in Message.pm and found the following bits of code: > > > Kind regards, > JP Hmm - I need to retract my "it works for me" statement.... I've checked te actual entries and 'cos I'm running with Quarantine Permissions = 0664 for MailWatch I didn't notice that indeed the spam and non-spam contents are still created with the primary group (Run As Group) not the "Quarantine Group". The 'dirty content' (viruses etc) are all fine, just the spam and non-spam contents are the wrong group. -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Aug 24 08:48:13 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:38 2006 Subject: Possible bug with spam permissions Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 24 Aug 2005, at 08:26, Jan-Peter Koopmann wrote: > On Tuesday, August 23, 2005 4:48 PM Julian Field wrote: > > >> I'm having a bit of a stupid day. What do you mean by "GID: 6 0 6" >> and what is wrong? And which chown are you talking about? I don't see >> your point at all. >> > > OK, let me start over: > > Setup: > Run as Group = mail > Quarantine Group = getqmail > > Problem: > Quarantined virus (etc.) mail is created under > > /var/spool/Mailscanner/quarantine/date/Message-ID/... > > The group of those directories and the files in them is correct: > getqmail. So far so good. But: > > Quarantined spam mail is created under > > /var/spool/Mailscanner/quarantine/date/spam/... > > The directory belongs to the correct group (getqmail) but the spam > mails in there belong to group mail. Which clearly is wrong. Now I > debugged a bit in Message.pm and found the following bits of code: > > > >>> # Store it if they want that >>> if ($actions{'store'}) { >>> my($dir, $dir2, $spamdir, $uid, $gid, $changeowner); >>> $uid = $global::MS->{quar}->{uid}; >>> $gid = $global::MS->{quar}->{gid}; >>> $changeowner = $global::MS->{quar}->{changeowner}; >>> $dir = MailScanner::Config::Value('quarantinedir', $this); >>> #$dir2 = $dir . '/' . MailScanner::Quarantine::TodayDir(); >>> $dir2 = $dir . '/' . $this->{datenumber}; >>> $spamdir = $dir2 . '/' . $HamSpam; >>> #print STDERR "dir = $dir\ndir2 = $dir2\nspamdir = $spamdir\n"; >>> umask $global::MS->{quar}->{dirumask}; >>> unless (-d $dir) { >>> mkdir $dir, 0777; >>> chown $uid, $gid, $dir if $changeowner; >>> } >>> unless (-d $dir2) { >>> mkdir $dir2, 0777; >>> chown $uid, $gid, $dir2 if $changeowner; >>> } >>> unless (-d $spamdir) { >>> mkdir $spamdir, 0777; >>> chown $uid, $gid, $spamdir if $changeowner; >>> } >>> #print STDERR "Storing spam to $spamdir/" . $this->{id} . "\n"; >>> #print STDERR "uid=$uid gid=$gid changeowner=$changeowner\n"; >>> umask $global::MS->{quar}->{fileumask}; >>> my @paths = $this->{store}->CopyEntireMessage($this, $spamdir, >>> $this->{id}, $uid, >>> $gid, $changeowner); # Remember where we have stored the spam in >>> an archive, so we never # archive infected messages >>> #print STDERR "Added " . join(',', @paths) . " to spamarchive >>> \n"; >>> push @{$this->{spamarchive}}, @paths; >>> chown $uid, $gid, "$spamdir/" . $this->{id}; # Harmless if this >>> fails } >>> umask 0077; # Safety net >>> > > If I understand this correctly, this code stores spam-mails. The > third last row reads > > chown $uid, $gid, "$spamdir/" . $this->{id}; > > I put > > Print STDERR "UID: $uid / GID: $gid\n"; > > in front of it and debugged it. The result was: > > UID: 26 / GID: 6 0 6 > > uid 26 corresponds to user mailnull --> correct > Gid 6 (no idea where the 0 6 come from) corresponds to group mail -- > > incorrect. This definately explains why stored spam mails have > the wrong group however. I suspect the broken part of the code is > this: > > >>> $uid = $global::MS->{quar}->{uid}; >>> $gid = $global::MS->{quar}->{gid}; >>> > > Which should probably read something like this > > $uid = $workarea->{uid}; > $gid = $workarea->{gid}; > > In order to get the correct Ids from the config file. The next > remaining question would be, why GID equals "6 0 6" and not only > one "6". I have no idea. :-) I don't agree. Your suggested code change will make the spam quarantine be owned by the user/group used for the /var/spool/ MailScanner/incoming directories, whereas it should be owned by the user/group used for the quarantine. In MailScanner.conf, what are these set to: Incoming Work User Incoming Work Group Quarantine User Quarantine Group MTA Run As User Run As Group - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwwmQBH2WUcUFbZUEQLyhgCg0GAw4OyAJ7/HqF9ANwt9ZWcCXYgAnRUg S20TN5wpZD43sNSLuMrrDeJU =HGCj -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jan-Peter.Koopmann at SECEIDOS.DE Wed Aug 24 08:52:17 2005 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:30:38 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Wednesday, August 24, 2005 9:39 AM Martin Hepworth wrote: > Hmm - I need to retract my "it works for me" statement.... Having looked at the code, everything else would have been a miracle... :-) Thanks for the feedback though. Now I am sure it is a bug. Regards, JP ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jan-Peter.Koopmann at SECEIDOS.DE Wed Aug 24 08:58:26 2005 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:30:38 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Wednesday, August 24, 2005 9:48 AM Julian Field wrote: > I don't agree. Your suggested code change will make the spam > quarantine be owned by the user/group used for the /var/spool/ > MailScanner/incoming directories Yep. I misread WorkArea.pm. > , whereas it should be owned by the > user/group used for the quarantine. Correct. We agree and this is exactly what is not happening. > In MailScanner.conf, what are these set to: > Incoming Work User = Incoming Work Group = Quarantine User = Quarantine Group = getqmail MTA = exim Run As User = mailnull Run As Group = mail Even if I am not able to provide the correct code segment, the current code clearly is wrong. Gid should correspond with "Quarantine Group" but it corresponds with "Run As Group". Regards, JP ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Aug 24 09:02:19 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:38 2006 Subject: Possible bug with spam permissions Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 24 Aug 2005, at 08:58, Jan-Peter Koopmann wrote: > On Wednesday, August 24, 2005 9:48 AM Julian Field wrote: > > >> I don't agree. Your suggested code change will make the spam >> quarantine be owned by the user/group used for the /var/spool/ >> MailScanner/incoming directories >> > > Yep. I misread WorkArea.pm. > > >> , whereas it should be owned by the >> user/group used for the quarantine. >> > > Correct. We agree and this is exactly what is not happening. > > >> In MailScanner.conf, what are these set to: >> >> > Incoming Work User = > Incoming Work Group = > Quarantine User = > Quarantine Group = getqmail > MTA = exim > Run As User = mailnull > Run As Group = mail > > Even if I am not able to provide the correct code segment, the > current code clearly is wrong. Gid should correspond with > "Quarantine Group" but it corresponds with "Run As Group". It's possible the "6 0 6" is causing the problem, I can understand why they do it. Can you try adding 0 to the gid just before the chown line? - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwwpjhH2WUcUFbZUEQJOJQCeNmcHxVHRfv6PJvrFYGjU/9aEWo8AoL3u 7L0X1R2VbXpPpdOFxsQEZLhw =c3uM -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jan-Peter.Koopmann at SECEIDOS.DE Wed Aug 24 09:05:27 2005 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:30:38 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Wednesday, August 24, 2005 10:02 AM Julian Field wrote: > It's possible the "6 0 6" is causing the problem, I can understand > why they do it. You can? Fill me in please... > Can you try adding 0 to the gid just before the chown line? ??? No idea what you mean sorry. Regards, JP ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Aug 24 09:12:52 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:38 2006 Subject: Possible bug with spam permissions Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 24 Aug 2005, at 09:05, Jan-Peter Koopmann wrote: > On Wednesday, August 24, 2005 10:02 AM Julian Field wrote: > > >> It's possible the "6 0 6" is causing the problem, I can understand >> why they do it. >> > > You can? Fill me in please... It's a means of supplying a scalar and a list out of the same variable. If you use it with arithmetic, only the first number will be used. If you use it as a string, you get all the numbers, so you can 'split " "' it into a list. In this case, I imagine the list is all the secondary groups. > > >> Can you try adding 0 to the gid just before the chown line? >> > > ??? No idea what you mean sorry. After $gid = $global::MS->{quar}->{gid}; add this: $gid = $gid + 0; If you print $gid after that line, it should just say "6" instead of "6 0 6". > > Regards, > JP > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwwsBhH2WUcUFbZUEQIucQCgu6T6olF8yFabHMAJepB9XMndbCcAoKJS CKDhxIY5vKZ88DS6nrqy5JZR =UE+/ -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Aug 24 09:18:47 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:38 2006 Subject: Possible bug with spam permissions Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 24 Aug 2005, at 09:12, Julian Field wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On 24 Aug 2005, at 09:05, Jan-Peter Koopmann wrote: > > >> On Wednesday, August 24, 2005 10:02 AM Julian Field wrote: >> >> >> >>> It's possible the "6 0 6" is causing the problem, I can understand >>> why they do it. >>> >>> >> >> You can? Fill me in please... >> > > It's a means of supplying a scalar and a list out of the same > variable. If you use it with arithmetic, only the first number will > be used. If you use it as a string, you get all the numbers, so you > can 'split " "' it into a list. In this case, I imagine the list is > all the secondary groups. > > >> >> >> >>> Can you try adding 0 to the gid just before the chown line? >>> >>> >> >> ??? No idea what you mean sorry. >> > > After > $gid = $global::MS->{quar}->{gid}; > add this: > $gid = $gid + 0; > If you print $gid after that line, it should just say "6" instead of > "6 0 6". Hmmm, can't be that. Why is the $gid be picking up the wrong number altogether? The quarantine for viruses and for spam both access the same variables as far as I can see, but obviously they aren't. Can any of you guys spot the difference? - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQA/AwUBQwwtaRH2WUcUFbZUEQIQMgCgh+QtHLd9avoRBgznceOjFX4UZdUAn1lZ 6oO2gMUh4vxwcrnTdrvusBUu =0SPR -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jan-Peter.Koopmann at SECEIDOS.DE Wed Aug 24 09:26:38 2005 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:30:38 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Wednesday, August 24, 2005 10:13 AM Julian Field wrote: > It's a means of supplying a scalar and a list out of the same > variable. If you use it with arithmetic, only the first number will > be used. If you use it as a string, you get all the numbers, so you > can 'split " "' it into a list. In this case, I imagine the list is > all the secondary groups. Thanks! :-) >>> Can you try adding 0 to the gid just before the chown line? > If you print $gid after that line, it should just say "6" instead of > "6 0 6". Which still would result in mail instead of getqmail. :-) Regards, JP ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard.gray at DNS.CO.UK Wed Aug 24 10:59:14 2005 From: richard.gray at DNS.CO.UK (Gray, Richard) Date: Thu Jan 12 21:30:38 2006 Subject: Disarmed Content quarantine Message-ID: > Is the concensus (general opinion of the majority) that it > would be nice to have this as a feature? > Will people use it if I include it? > Yes please! For all the threats that can only be set to be yes/no it would be useful to be able to have yes/no/store. Thanks, R ----------------------- This email from dns has been validated by dnsMSS(TM) Managed Email Security and is free from all known viruses. For further information contact email-integrity@dns.co.uk ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From joost at WAVERSVELD.NL Wed Aug 24 11:33:26 2005 From: joost at WAVERSVELD.NL (Joost Waversveld) Date: Thu Jan 12 21:30:38 2006 Subject: Disarmed Content quarantine Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] ----- Bericht van richard.gray@DNS.CO.UK --------- Datum: Wed, 24 Aug 2005 10:59:14 +0100 Van: "Gray, Richard" Antwoorden aan:MailScanner mailing list Onderwerp: Re: Disarmed Content quarantine Aan: MAILSCANNER@JISCMAIL.AC.UK >> Is the concensus (general opinion of the majority) that it >> would be nice to have this as a feature? >> Will people use it if I include it? >> > > Yes please! For all the threats that can only be set to be yes/no it > would be useful to be able to have yes/no/store. > > Thanks, > > R > > ----------------------- > This email from dns has been validated by dnsMSS(TM) Managed Email > Security and is free from all known viruses. > > For further information contact email-integrity@dns.co.uk > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ----- Einde bericht van richard.gray@DNS.CO.UK ----- Yes, I also think it is an good idea to have this option. You'll always have some customers who are complaining over everything and want the original (unaltered) email. Thanks Joost Waversveld ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jamespifer at HOTMAIL.COM Wed Aug 24 13:09:06 2005 From: jamespifer at HOTMAIL.COM (James Pifer) Date: Thu Jan 12 21:30:38 2006 Subject: Moving MailScanner to new system problems Message-ID: Due to a recent electrical storm I lost my mail server, or least it would not function any longer. I am able to get to the files through linux rescue, but the box will not boot. I wanted to install a new box anyway, it just forced my hand. My new box is running Centos 4, the old was Redhat 8. I copied my /etc/MailScanner directory to the new box then ran the latest MailScanner install. It seemed to go fine, but I'm having the following issues: 1) Had to modify /etc/sysconfig/MailScanner.conf to specify the MTA. Even though it was correct on the MailScanner.conf, it kept complaining (Invalid MTA error) until I modified it there. 2) When I try to start MailScanner I get the following error: # service MailScanner start Starting MailScanner daemons: /): No such file or directory51 4.0.0 can not chdir(/var/spool/mqueue.in [ OK ] outgoing sendmail: [ OK ] MailScanner: [ OK ] # The directory exists and the permissions seem fine as far as I can tell. I've compared the permissions to another MailScanner box and they are the same. 3) When I stop MailScanner I get the following error: # service MailScanner stop Shutting down MailScanner daemons: MailScanner: [ OK ] incoming sendmail: [ OK ] outgoing sendmail: [ OK ] : No such file or directoryne 299: cd: /var/spool/MailScanner/incoming # Again, the directory exists and the permissions seem fine as far as I can tell. I've compared the permissions to another MailScanner box and they are the same. 4) Keeping the above errors in mind, MailScanner does run, but it's not working and port 25 is not open. I've googled and looked at the FAQ and have not found a solution yet. Any suggestions on how to fix these issues? Centos 4 Latest MailScanner (downloaded yesterday) sendmail-8.13.1-2 Thanks, James ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Wed Aug 24 13:22:44 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:38 2006 Subject: High CPU system usage Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Joshua Hirsh wrote: >>Can't tell right now, i'll check next time such a burst >>happens. We are running with 10 child processes on a HT 2.8 P4 with 2 GB RAM. > > > How much mail are you processing? You should be able to handle quite a bit of messages with a server like that. Is your IDE drive connected via SATA? > Yes, 3ware 8006 > A quick test might be to test the read/write performance of the drive during off-hours and during your peak hours to see how much of a deviation occurs between the two. > > > > Although it's probably not the answer you want, you should see a performance boost by moving to a 2.6 based kernel (I'd personally recommend either CentOS or Tao for the task). I definitely noticed an overall system performance boost after migrating my servers to one of the newer RHEL4 rebuilds. > > > Cheers, > -Joshua > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From venkatesh_s at FASTMAIL.FM Wed Aug 24 13:28:47 2005 From: venkatesh_s at FASTMAIL.FM (Venkatesh.S) Date: Thu Jan 12 21:30:38 2006 Subject: content filtering body and subject text Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] hello all, can mailscanner do content filtering in body and subject texts, if any one has written any rulesets for this, plz help me in this, if the body of the mail or the subject contains sex, porn, or viagra or anything related to porn, when we input words related to those things, in a rule set, will it filter those mails, if so, plz help me in writing a ruleset for them, thanks in advance regards venkatesh -- Venkatesh.S venkatesh_s@fastmail.fm -- http://www.fastmail.fm - Same, same, but different^Ĺ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Wed Aug 24 13:27:37 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:38 2006 Subject: High CPU system usage Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Glenn Steen wrote: > On 23/08/05, Ugo Bellavance wrote: > (snip) > >>10:40:00 AM 0 77.90 0.00 15.45 0.58 6.07 >>10:40:00 AM 1 77.85 0.00 15.38 0.59 6.18 >>10:49:59 AM all 65.56 0.00 17.65 3.93 12.87 >>10:49:59 AM 0 64.74 0.00 17.76 3.89 13.61 >>10:49:59 AM 1 66.37 0.00 17.54 3.96 12.13 >>11:00:01 AM all 64.52 0.00 22.36 6.82 6.30 >>11:00:01 AM 0 64.78 0.00 22.18 6.75 6.28 >>11:00:01 AM 1 64.26 0.00 22.55 6.89 6.31 >>11:10:01 AM all 64.00 0.00 21.29 6.63 8.08 >>11:10:01 AM 0 63.83 0.00 21.29 6.66 8.23 >>11:10:01 AM 1 64.17 0.00 21.30 6.60 7.93 >>11:20:00 AM all 69.71 0.00 21.51 3.57 5.21 >>11:20:00 AM 0 69.45 0.00 21.55 3.62 5.39 >>11:20:00 AM 1 69.98 0.00 21.47 3.52 5.03 > > (snip) > Your %iowait seem to be a bit high perhaps (could be normal:-) .... If > you look at the "-d" section for your block device, does it seem to be > close to a .... "measurable max"? > you mean, this part? 07:40:00 tps rtps wtps bread/s bwrtn/s 09:20:00 55.68 2.54 53.14 27.67 2181.37 09:30:00 37.81 2.17 35.64 23.16 1569.62 09:40:01 45.35 1.95 43.41 21.06 1758.61 09:50:01 73.55 2.71 70.85 32.03 2121.82 10:00:00 100.95 4.75 96.20 51.44 2297.69 10:10:01 58.90 2.01 56.90 22.15 2480.38 10:20:01 40.88 1.32 39.56 14.40 1889.31 10:30:01 36.79 1.24 35.54 13.49 1597.77 10:40:00 46.61 1.51 45.10 16.32 2276.00 10:49:59 125.51 4.60 120.90 52.40 2598.60 11:00:01 232.63 8.64 223.98 97.07 2778.52 11:10:01 222.20 7.29 214.91 82.03 2659.14 11:20:00 161.06 5.30 155.76 62.35 2268.54 11:30:00 93.75 2.35 91.39 24.82 1940.26 I can't really think of a way to determine this 'measurable max'. HDparm? Analysis of a sar report while testing hard drive? Thanks, ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jan-Peter.Koopmann at SECEIDOS.DE Wed Aug 24 13:45:25 2005 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:30:38 2006 Subject: Cannot create+lock headers file Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Does this have to worry me? MailScanner[95986]: Cannot create + lock headers file /var/spool/MailScanner/incoming/95986/1E7uIo-0005Xv-5H.header ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jan-Peter.Koopmann at SECEIDOS.DE Wed Aug 24 13:55:29 2005 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:30:38 2006 Subject: SA RBLs not working? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, I just noticed something strange: We received a mail via the following two gateways: 217.72.192.197 mx25.web.de 69.233.133.209 adsl-69-233-133-209.dsl.scrm01.pacbell.net 69.233.133.209 is listed in several lists like Spamcop, SBL+XBL, DSBL etc. But SpamAssassin only reports RCVD_IN_BL_SPAMCOP_NET. No RCVD_IN_DSBL etc. This happens with SA 3.0.4. Net-DNS Module is current. RCVD_IN_DSBL has a score and skip_rbl_checks is set to 0. Any ideas? Regards, JP ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From support-lists at PETDOCTORS.CO.UK Wed Aug 24 13:57:57 2005 From: support-lists at PETDOCTORS.CO.UK (Nigel kendrick) Date: Thu Jan 12 21:30:38 2006 Subject: Whitelisting logged in user Message-ID: One of our users is currently on a dial-up link and it looks like the dial-up IP block has been blacklisted so their mail is being deleted due to "Spam Lists To Be Spam = 3". I get the feeling a ruleset that ups the threshold to, say, 5 would be a workaround, but it would not be watertight. Users have to authenticate before sending - can this be worked into a ruleset? I'm not sure where to start with this one so any pointers would be appreciated. Thanks Nigel Kendrick ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Aug 24 13:59:22 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:38 2006 Subject: SA RBLs not working? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jan-Peter Koopmann wrote: > Hi, > > I just noticed something strange: We received a mail via the following two gateways: > > 217.72.192.197 mx25.web.de > 69.233.133.209 adsl-69-233-133-209.dsl.scrm01.pacbell.net > > 69.233.133.209 is listed in several lists like Spamcop, SBL+XBL, DSBL etc. But SpamAssassin only reports RCVD_IN_BL_SPAMCOP_NET. No RCVD_IN_DSBL etc. This happens with SA 3.0.4. Net-DNS Module is current. RCVD_IN_DSBL has a score and skip_rbl_checks is set to 0. Any ideas? > > Regards, > JP > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! JP so what happens if you run the text over SA manually??? spamassassin -P /spam.assassin.prefs.conf -D --lint ?? -- -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From adrik at SALESMANAGER.NL Wed Aug 24 14:26:00 2005 From: adrik at SALESMANAGER.NL (Adri Koppes) Date: Thu Jan 12 21:30:38 2006 Subject: SA RBLs not working? Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Jan-Peter Koopmann > Sent: Wednesday, August 24, 2005 14:55 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: SA RBLs not working? > Importance: High > > Hi, > > I just noticed something strange: We received a mail via the > following two gateways: > > 217.72.192.197 mx25.web.de > 69.233.133.209 adsl-69-233-133-209.dsl.scrm01.pacbell.net > > 69.233.133.209 is listed in several lists like Spamcop, > SBL+XBL, DSBL etc. But SpamAssassin only reports > RCVD_IN_BL_SPAMCOP_NET. No RCVD_IN_DSBL etc. This happens > with SA 3.0.4. Net-DNS Module is current. RCVD_IN_DSBL has a > score and skip_rbl_checks is set to 0. Any ideas? > > Regards, > JP Jan Peter, Are you missing these in the $longspamreport as generated by the inline.spam.warning.txt report or also from the X-MailScanner-SpamCheck header line? I have noticed for about 6 months, the $longspamreport is sometimes missing pieces of text, resulting in bit of text deleted and then another line concataneted at the end of the chopped line. Here's an example of what I often see: 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60 [cf: 100] 1.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) Notice the BAYES_50 line has [cf: 100] appended, which comes from a chopped RAZOR2_CF_RANGE_51_100 line! In those cases, then X-MailScanner-SpamCheck header line does show all the rules which matched. Regards, Adri. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Wed Aug 24 14:27:27 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:38 2006 Subject: content filtering body and subject text Message-ID: [ The following text is in the "windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Venkatesh.S wrote: > hello all, > > can mailscanner do content filtering in body and subject texts, if any > one has written any rulesets for this, plz help me in this, > > if the body of the mail or the subject contains sex, porn, or viagra or > anything related to porn, when we input words related to those things, > in a rule set, will it filter those mails, if so, plz help me in writing > a ruleset for them, > > thanks in advance Spamassassin and special rules can do that really well. Please read the 'Most asked questions' part of the wiki. > > regards > venkatesh > > -- > Venkatesh.S > venkatesh_s@fastmail.fm > > -- > http://www.fastmail.fm - Same, same, but different^Ĺ > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Wed Aug 24 14:26:24 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:38 2006 Subject: Moving MailScanner to new system problems Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] James Pifer wrote: > Due to a recent electrical storm I lost my mail server, or least it > would not function any longer. I am able to get to the files through > linux rescue, but the box will not boot. I wanted to install a new box > anyway, it just forced my hand. > > My new box is running Centos 4, the old was Redhat 8. I copied my > /etc/MailScanner directory to the new box then ran the latest > MailScanner install. It seemed to go fine, but I'm having the following > issues: > > 1) Had to modify /etc/sysconfig/MailScanner.conf to specify the MTA. > Even though it was correct on the MailScanner.conf, it kept complaining > (Invalid MTA error) until I modified it there. > > 2) When I try to start MailScanner I get the following error: > # service MailScanner start > Starting MailScanner daemons: > /): No such file or directory51 4.0.0 can not chdir(/var/spool/mqueue.in > [ OK ] > outgoing sendmail: [ OK ] > MailScanner: [ OK ] > # > > The directory exists and the permissions seem fine as far as I can tell. > I've compared the permissions to another MailScanner box and they are > the same. > > 3) When I stop MailScanner I get the following error: > # service MailScanner stop > Shutting down MailScanner daemons: > MailScanner: [ OK ] > incoming sendmail: [ OK ] > outgoing sendmail: [ OK ] > : No such file or directoryne 299: cd: /var/spool/MailScanner/incoming > # > > Again, the directory exists and the permissions seem fine as far as I > can tell. I've compared the permissions to another MailScanner box and > they are the same. Is selinux enabled and enforced? > > 4) Keeping the above errors in mind, MailScanner does run, but it's not > working and port 25 is not open. > > I've googled and looked at the FAQ and have not found a solution yet. > Any suggestions on how to fix these issues? > > Centos 4 > Latest MailScanner (downloaded yesterday) > sendmail-8.13.1-2 > > Thanks, > James > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Wed Aug 24 14:28:31 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:38 2006 Subject: Whitelisting logged in user Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Nigel kendrick wrote: > One of our users is currently on a dial-up link and it looks like the > dial-up IP block has been blacklisted so their mail is being deleted due to > "Spam Lists To Be Spam = 3". I get the feeling a ruleset that ups the > threshold to, say, 5 would be a workaround, but it would not be watertight. > Users have to authenticate before sending - can this be worked into a > ruleset? I'm not sure where to start with this one so any pointers would be > appreciated. > > Thanks > > Nigel Kendrick > Maybe implementing SMTP-AUTH at mta level? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at gmail.com Wed Aug 24 10:35:56 2005 From: glenn.steen at gmail.com (Glenn Steen) Date: Thu Jan 12 21:30:38 2006 Subject: High CPU system usage Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 23/08/05, Ugo Bellavance wrote: (snip) > 10:40:00 AM 0 77.90 0.00 15.45 0.58 6.07 > 10:40:00 AM 1 77.85 0.00 15.38 0.59 6.18 > 10:49:59 AM all 65.56 0.00 17.65 3.93 12.87 > 10:49:59 AM 0 64.74 0.00 17.76 3.89 13.61 > 10:49:59 AM 1 66.37 0.00 17.54 3.96 12.13 > 11:00:01 AM all 64.52 0.00 22.36 6.82 6.30 > 11:00:01 AM 0 64.78 0.00 22.18 6.75 6.28 > 11:00:01 AM 1 64.26 0.00 22.55 6.89 6.31 > 11:10:01 AM all 64.00 0.00 21.29 6.63 8.08 > 11:10:01 AM 0 63.83 0.00 21.29 6.66 8.23 > 11:10:01 AM 1 64.17 0.00 21.30 6.60 7.93 > 11:20:00 AM all 69.71 0.00 21.51 3.57 5.21 > 11:20:00 AM 0 69.45 0.00 21.55 3.62 5.39 > 11:20:00 AM 1 69.98 0.00 21.47 3.52 5.03 (snip) Your %iowait seem to be a bit high perhaps (could be normal:-) .... If you look at the "-d" section for your block device, does it seem to be close to a .... "measurable max"? -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Wed Aug 24 15:17:33 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:38 2006 Subject: High CPU system usage Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 24/08/05, Ugo Bellavance wrote: > Glenn Steen wrote: > > On 23/08/05, Ugo Bellavance wrote: > > (snip) > > > >>10:40:00 AM 0 77.90 0.00 15.45 0.58 6.07 > >>10:40:00 AM 1 77.85 0.00 15.38 0.59 6.18 > >>10:49:59 AM all 65.56 0.00 17.65 3.93 12.87 > >>10:49:59 AM 0 64.74 0.00 17.76 3.89 13.61 > >>10:49:59 AM 1 66.37 0.00 17.54 3.96 12.13 > >>11:00:01 AM all 64.52 0.00 22.36 6.82 6.30 > >>11:00:01 AM 0 64.78 0.00 22.18 6.75 6.28 > >>11:00:01 AM 1 64.26 0.00 22.55 6.89 6.31 > >>11:10:01 AM all 64.00 0.00 21.29 6.63 8.08 > >>11:10:01 AM 0 63.83 0.00 21.29 6.66 8.23 > >>11:10:01 AM 1 64.17 0.00 21.30 6.60 7.93 > >>11:20:00 AM all 69.71 0.00 21.51 3.57 5.21 > >>11:20:00 AM 0 69.45 0.00 21.55 3.62 5.39 > >>11:20:00 AM 1 69.98 0.00 21.47 3.52 5.03 > > > > (snip) > > Your %iowait seem to be a bit high perhaps (could be normal:-) .... If > > you look at the "-d" section for your block device, does it seem to be > > close to a .... "measurable max"? > > > you mean, this part? > > 07:40:00 tps rtps wtps bread/s bwrtn/s > 09:20:00 55.68 2.54 53.14 27.67 2181.37 > 09:30:00 37.81 2.17 35.64 23.16 1569.62 > 09:40:01 45.35 1.95 43.41 21.06 1758.61 > 09:50:01 73.55 2.71 70.85 32.03 2121.82 > 10:00:00 100.95 4.75 96.20 51.44 2297.69 > 10:10:01 58.90 2.01 56.90 22.15 2480.38 > 10:20:01 40.88 1.32 39.56 14.40 1889.31 > 10:30:01 36.79 1.24 35.54 13.49 1597.77 > 10:40:00 46.61 1.51 45.10 16.32 2276.00 > 10:49:59 125.51 4.60 120.90 52.40 2598.60 > 11:00:01 232.63 8.64 223.98 97.07 2778.52 > 11:10:01 222.20 7.29 214.91 82.03 2659.14 > 11:20:00 161.06 5.30 155.76 62.35 2268.54 > 11:30:00 93.75 2.35 91.39 24.82 1940.26 Not really, although this should do... I was thinking of 00:01:01 DEV tps rd_sec/s wr_sec/s 00:11:01 dev3-0 3.24 1.93 112.65 .... which perhaps works better in 1.6 anyway, so... You seem to have a "write peak" at ~ 1.36 MiB/s, which shouldn't be partcularily close to your theoretical max, ergo not likely to be close to your real max (whatever that is:-). > > I can't really think of a way to determine this 'measurable max'. > HDparm? Analysis of a sar report while testing hard drive? More or less so, yes. Also try using iostat. Perhaps add in Bonnie there too (http://www.garloff.de/kurt/linux/bonnie/)... and perhaps eye through http://www.netlib.org/performance/papers/bonnie/ ... disk and fs performance measuring isn't easy;-). But... I don't *think* you're I/O-starved. That top someone sugegsted should probably show what's up (or at least "who":). From a.peacock at CHIME.UCL.AC.UK Wed Aug 24 15:08:59 2005 From: a.peacock at CHIME.UCL.AC.UK (Anthony Peacock) Date: Thu Jan 12 21:30:38 2006 Subject: Whitelisting logged in user Message-ID: Hi, > Now, the problem is that (As far as I know) the blacklists wins > against a SA score, even if negative score, so now i've disabled the > blacklist from MS. There's a way to understand the behaviour if > blacklist and SA checks are in contrast by themself ??? This is what I did. I decided that I prefered the scoring mechanism of SA over the 3 strikes and your out of MailScanner. So I disable RBL checks in MailScanner and use the scores in SA. That way you can mix and match your SA rules and scores to do what you want. -- Anthony Peacock CHIME, Royal Free & University College Medical School WWW: http://www.chime.ucl.ac.uk/~rmhiajp/ "I haven't lost my mind...I sold it on eBay!" ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rabellino at DI.UNITO.IT Wed Aug 24 15:01:40 2005 From: rabellino at DI.UNITO.IT (Rabellino Sergio) Date: Thu Jan 12 21:30:38 2006 Subject: Whitelisting logged in user Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ugo Bellavance wrote: >Nigel kendrick wrote: > > >>One of our users is currently on a dial-up link and it looks like the >>dial-up IP block has been blacklisted so their mail is being deleted due to >>"Spam Lists To Be Spam = 3". I get the feeling a ruleset that ups the >>threshold to, say, 5 would be a workaround, but it would not be watertight. >>Users have to authenticate before sending - can this be worked into a >>ruleset? I'm not sure where to start with this one so any pointers would be >>appreciated. >> >>Thanks >> >>Nigel Kendrick >> >> >> > >Maybe implementing SMTP-AUTH at mta level? > > > Using in sendmail the TSL+AUTH, you get into your headers a string like this (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO userCertificateDN= DipinfoAuthUser=YOURUSER ); Then I've inserted into spamassassin this rule: header AUTHENTICATEDUSER Received =~ /(.*)DipinfoAuthUser=\w(.*)/ describe AUTHENTICATEDUSER Email Sender Auth by MY MTA score AUTHENTICATEDUSER -100.0 Where DipinfoAuthUser was choosed by me as a search token. Now, the problem is that (As far as I know) the blacklists wins against a SA score, even if negative score, so now i've disabled the blacklist from MS. There's a way to understand the behaviour if blacklist and SA checks are in contrast by themself ??? Bye. -- Dott. Mag. Sergio Rabellino Technical Staff Department of Computer Science University of Torino (Italy) http://www.di.unito.it/~rabser Tel. +39-0116706701 Fax. +39-011751603 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Aug 24 14:55:37 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:38 2006 Subject: SA RBLs not working? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jan-Peter Koopmann wrote: > Hmm. Let's try this with an attachment... :-) > OK so it scored 45+.....and it should be scoring how many before you things it's high scoring spam. I find the URI-RBL's are hitting miuch more then the traditional RBLs and lot less prone to FP's. So my question is...does it really matter. yes it's maybe a problem, but what impact is it having? -- -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jamespifer at HOTMAIL.COM Wed Aug 24 14:57:48 2005 From: jamespifer at HOTMAIL.COM (James Pifer) Date: Thu Jan 12 21:30:38 2006 Subject: Moving MailScanner to new system problems Message-ID: >James Pifer wrote: > > Due to a recent electrical storm I lost my mail server, or least it > > would not function any longer. I am able to get to the files through > > linux rescue, but the box will not boot. I wanted to install a new box > > anyway, it just forced my hand. > > > > My new box is running Centos 4, the old was Redhat 8. I copied my > > /etc/MailScanner directory to the new box then ran the latest > > MailScanner install. It seemed to go fine, but I'm having the following > > issues: > > > > 1) Had to modify /etc/sysconfig/MailScanner.conf to specify the MTA. > > Even though it was correct on the MailScanner.conf, it kept complaining > > (Invalid MTA error) until I modified it there. > > > > 2) When I try to start MailScanner I get the following error: > > # service MailScanner start > > Starting MailScanner daemons: > > /): No such file or directory51 4.0.0 can not chdir(/var/spool/mqueue.in > > [ OK ] > > outgoing sendmail: [ OK ] > > MailScanner: [ OK ] > > # > > > > The directory exists and the permissions seem fine as far as I can tell. > > I've compared the permissions to another MailScanner box and they are > > the same. > > > > 3) When I stop MailScanner I get the following error: > > # service MailScanner stop > > Shutting down MailScanner daemons: > > MailScanner: [ OK ] > > incoming sendmail: [ OK ] > > outgoing sendmail: [ OK ] > > : No such file or directoryne 299: cd: /var/spool/MailScanner/incoming > > # > > > > Again, the directory exists and the permissions seem fine as far as I > > can tell. I've compared the permissions to another MailScanner box and > > they are the same. > >Is selinux enabled and enforced? > SELinux is disabled. By the way, my apologies if these messages are coming through as HTML. I'm forced to use my hotmail account until I get my mail server fixed.... Thanks, James ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Wed Aug 24 15:31:46 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:30:38 2006 Subject: SA RBLs not working? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jan-Peter Koopmann wrote: > > It is high scoring spam alright. :-) That's not what I am worrying about. I by accident stumbled across the fact that the RBL should have hit but it did not. Some tests with other spam mails shows that it does not work for them either. I just found a mail scoring barely below the High Scoring limit which should have hit a lot of RBL-lists but did not mark any! > > > I am not currently drowning in Spam as everything is at least marked as Spam. But it makes me think. It _is_ a problem after all and I would like to know whether it's a problem with my setup or with SA itself. :-) > > Regards, > JP Ok stupid question.. but have you by any chance changed the default scores to zero for RCVD_IN_DSBL, RCVD_IN_SBL, RCVD_IN_XBL and others in your config (spam.assassin.prefs.conf or some local.cf)? - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From support-lists at PETDOCTORS.CO.UK Wed Aug 24 15:18:04 2005 From: support-lists at PETDOCTORS.CO.UK (Nigel kendrick) Date: Thu Jan 12 21:30:38 2006 Subject: Whitelisting logged in user Message-ID: -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Anthony Peacock Sent: 24 August 2005 15:09 This is what I did. I decided that I prefered the scoring mechanism of SA over the 3 strikes and your out of MailScanner. So I disable RBL checks in MailScanner and use the scores in SA. That way you can mix and match your SA rules and scores to do what you want. Thanks - I see what you mean but I'm not convinced about turning off the RBL checks as they are generally pretty darn good. It would be nice to have a function to override RBL checks for users who have authenticated - perhaps Julian's magic touch with a new parameter such as 'Authentication Overrides RBL Checks = yes' ??!! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jan-Peter.Koopmann at SECEIDOS.DE Wed Aug 24 15:21:05 2005 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:30:38 2006 Subject: SA RBLs not working? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Wednesday, August 24, 2005 3:56 PM Martin Hepworth wrote: > OK so it scored 45+.....and it should be scoring how many before you > things it's high scoring spam. It is high scoring spam alright. :-) That's not what I am worrying about. I by accident stumbled across the fact that the RBL should have hit but it did not. Some tests with other spam mails shows that it does not work for them either. I just found a mail scoring barely below the High Scoring limit which should have hit a lot of RBL-lists but did not mark any! > I find the URI-RBL's are hitting miuch more then the traditional RBLs > and lot less prone to FP's. So my question is...does it really > matter. yes it's maybe a problem, but what impact is it having? I am not currently drowning in Spam as everything is at least marked as Spam. But it makes me think. It _is_ a problem after all and I would like to know whether it's a problem with my setup or with SA itself. :-) Regards, JP ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Wed Aug 24 15:21:28 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:30:38 2006 Subject: Moving MailScanner to new system problems Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] James Pifer wrote: >> > My new box is running Centos 4, the old was Redhat 8. I copied my >> > /etc/MailScanner directory to the new box then ran the latest >> > MailScanner install. It seemed to go fine, but I'm having the following >> > issues: >> > >> > 1) Had to modify /etc/sysconfig/MailScanner.conf to specify the MTA. >> > Even though it was correct on the MailScanner.conf, it kept complaining >> > (Invalid MTA error) until I modified it there. >> > >> > 2) When I try to start MailScanner I get the following error: >> > # service MailScanner start >> > Starting MailScanner daemons: >> > /): No such file or directory51 4.0.0 can not >> chdir(/var/spool/mqueue.in >> > [ OK ] >> > outgoing sendmail: [ OK ] >> > MailScanner: [ OK ] >> > # >> > Would it be possible (and simpler) to just re-install the whole thing, integrate with sendmail, antivirus, sa, razor... and then run a upgrade_MailScanner_conf (and / or upgrade_languages_conf) with reference to the old MailScanner.conf? Changes to the mailscanner sysconfig file shouldn't be required at all. Possibly a task that shouldn't require more than a couple of hours.. Just make sure you follow the practices as outlined in the wiki. http://wiki.mailscanner.info/doku.php?id=maq:index#how_to_setup_a_mailscanner_server - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at gmail.com Wed Aug 24 15:26:25 2005 From: glenn.steen at gmail.com (Glenn Steen) Date: Thu Jan 12 21:30:38 2006 Subject: High CPU system usage Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 24/08/05, Glenn Steen wrote: > which perhaps works better in 1.6 anyway, so... Gah, proofreading after submit. I really need to get more coffee/get enough sleep/work less:-). "1.6" should read "(kernel) 2.6". > But... I don't *think* you're I/O-starved. That top someone sugegsted "sugegsted" -> "suggested" Oh well, off to the coffee machine... -- -- Glenn (a.k.a Le Grand Typo) email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From a.peacock at CHIME.UCL.AC.UK Wed Aug 24 15:38:24 2005 From: a.peacock at CHIME.UCL.AC.UK (Anthony Peacock) Date: Thu Jan 12 21:30:38 2006 Subject: Whitelisting logged in user Message-ID: Hi, Sorry, you have misunderstood me. I don't turn off RBL checks, I just have SA do them and not MailScanner. I can then tweak the scores that SA assigns to those RBLs if I want to. It also allows SAs whitelisting, blacklisting, AWL to work with the RBLs. > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Anthony Peacock Sent: 24 August 2005 15:09 > > This is what I did. I decided that I prefered the scoring mechanism > of SA over the 3 strikes and your out of MailScanner. So I disable > RBL checks in MailScanner and use the scores in SA. That way you can > mix and match your SA rules and scores to do what you want. > > Thanks - I see what you mean but I'm not convinced about turning off > the RBL checks as they are generally pretty darn good. > > It would be nice to have a function to override RBL checks for users > who have authenticated - perhaps Julian's magic touch with a new > parameter such as 'Authentication Overrides RBL Checks = yes' ??!! > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. Before posting, read the Wiki > (http://wiki.mailscanner.info/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Anthony Peacock CHIME, Royal Free & University College Medical School WWW: http://www.chime.ucl.ac.uk/~rmhiajp/ "Whoever said nothing is impossible never tried slamming a revolving door." - Melissa O'Brien ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From joshua.hirsh at PARTNERSOLUTIONS.CA Wed Aug 24 15:39:19 2005 From: joshua.hirsh at PARTNERSOLUTIONS.CA (Joshua Hirsh) Date: Thu Jan 12 21:30:38 2006 Subject: High CPU system usage Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > Joshua, can you share your stats about CPU % system usage > with a 2.6 kernel? This system might not be the best example, but it's the only one I have access to at the moment. It averages between 15k and 20k messages per day (it used to be around 30k to 50k, but I reject at the MTA level with RBLs now). My peak times are always between 9 and 10 am (twice the regular hourly average for the rest of the business day). This particular system is a quad 700 Mhz Xeon (Dell PE 6450), with 2gb of RAM and 1gb for SWAP. My average daily CPU usages is only 25%, but normally between 30 and 50% during peak times. The system CPU usage is between 5 and 10%, the rest is user. IOWait has never reached higher than 3% and averages around 1.5% throughout the day. This system isn't using raid though, as the support for older Dell PERC raid cards was dropped by Dell/Red Hat in the 2.6 series, so I have separate disks in use for /, /var/spool and /var/spool/MailScanner to split up the I/O usages for the system, spooler and quarantine. I also have ATIME disabled on /var/spool, /var/log and /var/spool/MailScanner. The system also runs with 10 children per CPU, and averages only 1mb in swap. When I had originally upgraded to a 2.6 series kernel, I was running on different hardware (a dual 933 P3), but I did see a noticeable performance boost at the time. Unfortunately, it was long enough ago that I can't recall what it was, or how much of a % change it was. I would tentatively say between a 10 and 20% difference. From your sar output, it does appear that you have a very small backlog for I/O, but for the amount of mail you have, that should be pretty normal (writing logs, writing mail queues, writing quarantines). If your I/O wait was dipping into the double digits, than I would definitely pinpoint the problem to your disks, but the peak you posted (just under 7%) looks fine to me. It seems to indicate that you're running out of processing power, but I would expect that you would be able to process more than 50k messages on a 2.8Ghz machine. The last machine I was able to stress test was a dual 3Ghz Xeon, and I peaked it out at around 1.7 million messages per day. The only thing I could recommend at this point is to take a closer look at what your processes are doing. It's possible that a few of them are taking the system down with them by doing extra checks they shouldn't be. Try turning on the speed timings for MS and see if you can pinpoint a specific point that's slowing down your system. Cheers, -Joshua ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From support-lists at PETDOCTORS.CO.UK Wed Aug 24 15:45:25 2005 From: support-lists at PETDOCTORS.CO.UK (Nigel kendrick) Date: Thu Jan 12 21:30:38 2006 Subject: Whitelisting logged in user Message-ID: -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Anthony Peacock Sent: 24 August 2005 15:38 To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Whitelisting logged in user Hi, Sorry, you have misunderstood me. I don't turn off RBL checks, I just have SA do them and not MailScanner. I can then tweak the scores that SA assigns to those RBLs if I want to. It also allows SAs whitelisting, blacklisting, AWL to work with the RBLs. Thanks - with you now. (Still like the idea of my new parameter too though ;-)) NK ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at gmail.com Wed Aug 24 15:49:37 2005 From: glenn.steen at gmail.com (Glenn Steen) Date: Thu Jan 12 21:30:38 2006 Subject: Cannot create+lock headers file Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 24/08/05, Jan-Peter Koopmann wrote: > Does this have to worry me? > > MailScanner[95986]: Cannot create + lock headers file /var/spool/MailScanner/incoming/95986/1E7uIo-0005Xv-5H.header > Don't rightly know, but it sure would scare me:-). As to why... I presume you don't have any premission issues... Do you use tmpfs for it? Is the fs intact? Does a restart of MS "fix" it? -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jan-Peter.Koopmann at SECEIDOS.DE Wed Aug 24 16:14:51 2005 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:30:38 2006 Subject: SA RBLs not working? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Wednesday, August 24, 2005 4:32 PM Dhawal Doshy wrote: > Ok stupid question.. Perfectly valid. No offense taken. :-) > but have you by any chance changed the default > scores to zero for RCVD_IN_DSBL, RCVD_IN_SBL, RCVD_IN_XBL and others > in your config (spam.assassin.prefs.conf or some local.cf)? Nope. Checked that right at the beginning. I even have manual scores for RCVD_IN_SBL etc. I am absolutly sure this worked a few weeks ago. No idea what stopped this from working... Regards, JP ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jan-Peter.Koopmann at SECEIDOS.DE Wed Aug 24 16:18:41 2005 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:30:38 2006 Subject: Cannot create+lock headers file Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Wednesday, August 24, 2005 4:50 PM Glenn Steen wrote: > Don't rightly know, but it sure would scare me:-). :-) > As to why... I presume you don't have any premission issues... So do I. > Do you > use tmpfs for it? No. > Is the fs intact? I suppose. Nothing obvious. > Does a restart of MS "fix" it? I just searched my maillogs from the past weeks. It only shows one occurence (the one I quoted). I will probably just ignore this and see if it ever happens again. Locktype = posix should be ok for exim and FreeBSD, should it not? Regards, JP ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Aug 24 16:42:44 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:38 2006 Subject: Cannot create+lock headers file Message-ID: -----BEGIN PGP SIGNED MESSAGE----- On 24 Aug 2005, at 16:18, Jan-Peter Koopmann wrote: > On Wednesday, August 24, 2005 4:50 PM Glenn Steen wrote: >> Don't rightly know, but it sure would scare me:-). >> > > :-) > >> As to why... I presume you don't have any premission issues... > > So do I. > >> Do you >> use tmpfs for it? > > No. > >> Is the fs intact? > > I suppose. Nothing obvious. > >> Does a restart of MS "fix" it? > > I just searched my maillogs from the past weeks. It only shows one > occurence (the one I quoted). I will probably just ignore this and > see if it ever happens again. Check for anything obvious such as running out of disk space or inodes. > Locktype = posix should be ok for exim and FreeBSD, should it not? Unless you have a good reason to do otherwise, leave this setting blank and let MailScanner work it out for itself. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQwyVd/w32o+k+q+hAQFvvAgAuaCbFT4t61TgSJQ7TOvTqG/sOUwsWfcx /N0s220oK0FKufRiXtpiWjUqYYkazR1LkQ41gyl23VIf5e+MMdUgDNwlOH26UBMd 02nGe+BxU7yunzHAcuNRUyYtyIX+gf7rQaIM6sXYTS1N56nb/AbdzlQU0IbAeks5 8LxVnuy2IchYzlLCBsSIDb668CbbF10dW7TIHLGuReWFYP9zualzASumQXcHKIof yvWwJUojQJRIHq5PSf1Ge9RjTJJwIkVpN2M25bOpA5g7Q5VVltEzceWzWHxqdva7 hd4FAkPSEYr9sT+hOeOaYCtEIm8dAKJAycnF56WXTKzquPEKeK64/A== =yGG8 -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Wed Aug 24 16:38:10 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:38 2006 Subject: High CPU system usage Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Glenn Steen wrote: > On 24/08/05, Ugo Bellavance wrote: > >>Glenn Steen wrote: >> >>>On 23/08/05, Ugo Bellavance wrote: >>>(snip) > > Not really, although this should do... I was thinking of > > 00:01:01 DEV tps rd_sec/s wr_sec/s > 00:11:01 dev3-0 3.24 1.93 112.65 Here it is: 09:50:01 dev8-0 72.46 32.03 2121.82 09:50:01 dev8-1 0.00 0.00 0.00 09:50:01 dev8-2 0.00 0.00 0.00 09:50:01 dev8-3 5.20 0.00 1040.16 09:50:01 dev8-4 0.00 0.00 0.00 09:50:01 dev8-5 55.32 14.43 716.79 09:50:01 dev8-6 11.94 17.60 364.88 10:00:00 dev8-0 99.58 51.44 2297.69 10:00:00 dev8-1 0.00 0.00 0.00 10:00:00 dev8-2 0.02 0.00 2.75 10:00:00 dev8-3 4.76 0.03 925.54 10:00:00 dev8-4 0.00 0.00 0.00 10:00:00 dev8-5 80.35 19.32 985.79 10:00:00 dev8-6 14.46 32.10 383.60 10:10:01 dev8-0 57.68 22.15 2480.38 10:10:01 dev8-1 0.00 0.00 0.00 10:10:01 dev8-2 0.09 0.00 18.95 10:10:01 dev8-3 7.36 0.04 1516.32 10:10:01 dev8-4 0.00 0.00 0.00 10:10:01 dev8-5 38.12 9.07 577.70 10:10:01 dev8-6 12.11 13.04 367.41 10:20:01 dev8-0 40.39 14.40 1889.31 10:20:01 dev8-1 0.00 0.00 0.00 10:20:01 dev8-2 0.00 0.00 0.00 10:20:01 dev8-3 5.85 0.00 1171.87 10:20:01 dev8-4 0.00 0.00 0.00 10:20:01 dev8-5 24.63 6.30 383.94 10:20:01 dev8-6 9.90 8.10 333.50 10:30:01 dev8-0 36.28 13.49 1597.77 10:30:01 dev8-1 0.00 0.00 0.00 10:30:01 dev8-2 0.00 0.00 0.00 10:30:01 dev8-3 4.71 0.00 920.84 10:30:01 dev8-4 0.00 0.00 0.00 10:30:01 dev8-5 21.87 6.10 348.67 10:30:01 dev8-6 9.71 7.39 328.26 10:40:00 dev8-0 46.00 16.32 2276.11 10:40:00 dev8-1 0.00 0.00 0.00 10:40:00 dev8-2 0.00 0.01 0.00 10:40:00 dev8-3 6.62 0.00 1316.00 10:40:00 dev8-4 0.00 0.00 0.00 10:40:00 dev8-5 26.94 7.21 419.03 10:40:00 dev8-6 12.44 9.09 541.09 10:49:59 dev8-0 124.77 52.40 2598.49 10:49:59 dev8-1 0.00 0.00 0.00 10:49:59 dev8-2 0.07 0.11 13.04 10:49:59 dev8-3 3.81 0.00 733.85 10:49:59 dev8-4 0.00 0.00 0.00 10:49:59 dev8-5 99.05 35.33 1098.75 10:49:59 dev8-6 21.85 16.96 752.84 11:00:01 dev8-0 232.24 97.07 2778.52 # mount /dev/sda5 on / type ext3 (rw) none on /proc type proc (rw) none on /dev/pts type devpts (rw,gid=5,mode=620) usbdevfs on /proc/bus/usb type usbdevfs (rw) /dev/sda1 on /boot type ext3 (rw) none on /dev/shm type tmpfs (rw) /dev/sda3 on /tmp type ext3 (rw) /dev/sda6 on /var type ext3 (rw) none on /var/spool/MailScanner/incoming type tmpfs (rw) > .... > which perhaps works better in 1.6 anyway, so... > You seem to have a "write peak" at ~ 1.36 MiB/s, which shouldn't be > partcularily close to your theoretical max, ergo not likely to be > close to your real max (whatever that is:-). I get this from hdparm, while the server has a load of 2.5 (not idle) /dev/sda: Timing buffer-cache reads: 3348 MB in 2.00 seconds = 1674.00 MB/sec Timing buffered disk reads: 168 MB in 3.01 seconds = 55.81 MB/sec > > >>I can't really think of a way to determine this 'measurable max'. >>HDparm? Analysis of a sar report while testing hard drive? > > > More or less so, yes. Also try using iostat. > Perhaps add in Bonnie there too > (http://www.garloff.de/kurt/linux/bonnie/)... and perhaps eye through > http://www.netlib.org/performance/papers/bonnie/ ... disk and fs > performance measuring isn't easy;-). I am affraid of installing bonnie, as it screws Mondorescue, which I use for backups :(. > > > But... I don't *think* you're I/O-starved. That top someone sugegsted > should probably show what's up (or at least "who":). Will do in the next burst. > > From what you show in the previous messages I think we can drop swap > from the picture... there hardly seem to be any taking place. That is what I think too... > What fs do you use? Perhaps an issue with that... ext3, might be worthwhile trying without journalling. We have an UPS and the server is controlled by Apcupsd. > > Or perhaps some really crummy NIC driver and a spell of network > congestion driving the CPU nuts? It has been known to happen (mostly > back in the dark ages, but still:-). Stock driver in RHEL, e1000 driver, Dell poweredge server, intel pro 1000 NIC. > > Oh well, 'nuff rambling > Thanks a lot, -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Wed Aug 24 17:37:44 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:38 2006 Subject: High CPU system usage Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 24/08/05, Ugo Bellavance wrote: > Glenn Steen wrote: > > On 24/08/05, Ugo Bellavance wrote: > > > >>Glenn Steen wrote: > >> > >>>On 23/08/05, Ugo Bellavance wrote: > >>>(snip) > > > > > > > Not really, although this should do... I was thinking of > > > > 00:01:01 DEV tps rd_sec/s wr_sec/s > > 00:11:01 dev3-0 3.24 1.93 112.65 > > Here it is: > (snippety-snip) > 11:00:01 dev8-0 232.24 97.07 2778.52 > > # mount > /dev/sda5 on / type ext3 (rw) > none on /proc type proc (rw) > none on /dev/pts type devpts (rw,gid=5,mode=620) > usbdevfs on /proc/bus/usb type usbdevfs (rw) > /dev/sda1 on /boot type ext3 (rw) > none on /dev/shm type tmpfs (rw) > /dev/sda3 on /tmp type ext3 (rw) > /dev/sda6 on /var type ext3 (rw) > none on /var/spool/MailScanner/incoming type tmpfs (rw) Perfect. And this concurs with what we already saw in the "old style" listing... That is: a bit of write activity, but nothing one should (need to) write home about:-). Of course, you might be having "hidden peaks" that are "killing you in the short term", so when you see one next time, try capture some samples with a shorter interval (I'd perhaps use iostat for that). > > .... > > which perhaps works better in 1.6 anyway, so... > > You seem to have a "write peak" at ~ 1.36 MiB/s, which shouldn't be > > partcularily close to your theoretical max, ergo not likely to be > > close to your real max (whatever that is:-). > > I get this from hdparm, while the server has a load of 2.5 (not idle) > > /dev/sda: > Timing buffer-cache reads: 3348 MB in 2.00 seconds = 1674.00 MB/sec > Timing buffered disk reads: 168 MB in 3.01 seconds = 55.81 MB/sec > Nice. Assuming abysmal write performance of ~ 5MiB/s you'd still not be pushing the limits. > >>I can't really think of a way to determine this 'measurable max'. > >>HDparm? Analysis of a sar report while testing hard drive? > > > > > > More or less so, yes. Also try using iostat. > > Perhaps add in Bonnie there too > > (http://www.garloff.de/kurt/linux/bonnie/)... and perhaps eye through > > http://www.netlib.org/performance/papers/bonnie/ ... disk and fs > > performance measuring isn't easy;-). > > I am affraid of installing bonnie, as it screws Mondorescue, which I use > for backups :(. ? Install ?? Just grab the source, compile it, run a test through, delete it ... Why would Mondorescue take issue with that? Oh well, just don't use it then, we're fairly sure it's perhaps, probably, not that likely disk IO anyway:-). > > (snip) > > What fs do you use? Perhaps an issue with that... > > ext3, might be worthwhile trying without journalling. We have an UPS > and the server is controlled by Apcupsd. Perhaps. And perhaps without atime updating, if you don't do that already. > > Or perhaps some really crummy NIC driver and a spell of network > > congestion driving the CPU nuts? It has been known to happen (mostly > > back in the dark ages, but still:-). > > Stock driver in RHEL, e1000 driver, Dell poweredge server, intel pro > 1000 NIC. Should be OK... Then again, I've only got Broadcoms, so I wouldn't know for sure:-). > > Oh well, 'nuff rambling > > > > Thanks a lot, > > -- > Ugo Glad to help. -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jan-Peter.Koopmann at SECEIDOS.DE Wed Aug 24 17:46:45 2005 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:30:38 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Wednesday, August 24, 2005 10:19 AM Julian Field wrote: > The quarantine for viruses and for spam both access the same > variables as far as I can see, but obviously they aren't. Can any of > you guys spot the difference? - -- Took some time but I found it. The problem is the assigning of extra group memberships. Not sure if this is a perl or FreeBSD bug/feature. Obviouls the second parameter in an $) = assignment is ignored on our systems. Once we patched MailScanner everything started to work: --- /tmp/MailScanner.orig Wed Aug 24 18:39:46 2005 +++ MailScanner Wed Aug 24 18:43:19 2005 @@ -902,7 +902,7 @@ # assign in parallel to avoid tripping taint mode on ($(, $)) = ($gid, $gid); $( == $gid && $) == $gid or die "Can't set GID $gid"; - $) = "$gid $qgid $igid"; # Set the extra group memberships we need + $) = "$gid $gid $qgid $igid"; # Set the extra group memberships we need } else { $) = $(; } Question remains: Is this a FreeBSD or a perl problem. And do you patch MailScanner or shall I patch it in the FreeBSD port? Regards, JP ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Aug 24 17:54:33 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:38 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jan-Peter Koopmann wrote: > On Wednesday, August 24, 2005 10:19 AM Julian Field wrote: > > >>The quarantine for viruses and for spam both access the same >>variables as far as I can see, but obviously they aren't. Can any of >>you guys spot the difference? - -- > > > > Took some time but I found it. The problem is the assigning of extra group memberships. Not sure if this is a perl or FreeBSD bug/feature. Obviouls the second parameter in an > > $) = > > assignment is ignored on our systems. Once we patched MailScanner everything started to work: > > > --- /tmp/MailScanner.orig Wed Aug 24 18:39:46 2005 > +++ MailScanner Wed Aug 24 18:43:19 2005 > @@ -902,7 +902,7 @@ > # assign in parallel to avoid tripping taint mode on > ($(, $)) = ($gid, $gid); > $( == $gid && $) == $gid or die "Can't set GID $gid"; > - $) = "$gid $qgid $igid"; # Set the extra group memberships we need > + $) = "$gid $gid $qgid $igid"; # Set the extra group memberships we need > } else { > $) = $(; > } > > > Question remains: Is this a FreeBSD or a perl problem. And do you patch MailScanner or shall I patch it in the FreeBSD port? > > Regards, > JP > JP I'd suggest Jules should test on Linux etc and then patch - he hates people mucking with his code ;-) Also there's FreeBSd users like myself who use the tar.gz installer rather the the lovely port you provide... -- -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jan-Peter.Koopmann at SECEIDOS.DE Wed Aug 24 18:03:55 2005 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:30:38 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Wednesday, August 24, 2005 6:55 PM Martin Hepworth wrote: > I'd suggest Jules should test on Linux etc and then patch - he hates > people mucking with his code ;-) Would be my favorite option! :-) > Also there's FreeBSd users like myself who use the tar.gz installer > rather the the lovely port you provide... -- Oh well. Too bad! *g* I'm not asking.... I would only put this in the port if Julian refuses (for whatever perfectly valid reason he might have) to patch this for everyone. I am not sure how this behaves under Linux or with other perl versions. However it should not do any harm even on systems behaving differently. I'm only glad we finally found this bugger. :-) Strangly enough this first struck me after upgrading to MailWatch 1.0.x. Took me ages to figure out my problems with MailWatch quarantine handling were file permission based since MailWatch 0.x worked without those problems... Regards, JP ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jan-Peter.Koopmann at SECEIDOS.DE Wed Aug 24 18:27:48 2005 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:30:38 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Wednesday, August 24, 2005 6:47 PM Jan-Peter Koopmann wrote: > Question remains: Is this a FreeBSD or a perl problem. And do you > patch MailScanner or shall I patch it in the FreeBSD port? Ok. We checked this on the following combinations: Linux and perl 5.8.0 --> original version works Solaris and perl 5.8.3 --> original version works FreeBSD 4.11 and perl 5.8.0 --> buggy FreeBSD 5.4 and perl 5.8.6 -> buggy FreeBSD 4.11 and per 5.8.6 --> buggy Looks a lot like a FreeBSD bug! I will try to get this solved in FreeBSD but up to that we need to patch MailScanner for FreeBSD systems. Julian, what's your opinion on this? Regards, JP ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at BARENDSE.TO Wed Aug 24 19:27:41 2005 From: mailscanner at BARENDSE.TO (Remco Barendse) Date: Thu Jan 12 21:30:38 2006 Subject: Can I see what MailScanner is doing? Message-ID: On Tue, 23 Aug 2005, Ugo Bellavance wrote: > Julian Field wrote: >> On 23 Aug 2005, at 09:43, Remco Barendse wrote: >> >> >>>> Hi! >>>> >>>> I just added the prolo.cf rule but after restarting MailScanner >>>> mail just seems to be piling up in /var/spool/mqueue.in >>>> >>>> I removed the rule and restarted mailscanner again. When I run top >>>> I see MailScanner is eating up cpu time but nothing seems to appear >>>> in the maillog. >>>> >>>> Is there any place I can see what MailScanner is doing?? >> >> >> This must be in the MAQ or Wiki somewhere, but I can't find it right >> now. >> Shutdown MailScanner, set "Debug = yes" and "Debug SpamAssassin = >> yes" in MailScanner.conf, then "check_MailScanner". It will probably >> die with some error message, that will hopefully shed some light on >> what is wrong. Fix the problem, put the debug options back to no >> again and restart MailScanner. > > I wrote it here > http://wiki.mailscanner.info/doku.php?id=documentation:test_troubleshoot:mailscanner > > I hope it is okay. Thanks Ugo and Julian! It turned out there wasn't any real problem with MailScanner for some reason it's just slow. It takes forever to process a batch of 30 messages. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Wed Aug 24 20:03:53 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:38 2006 Subject: Can I see what MailScanner is doing? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Remco Barendse wrote: > On Tue, 23 Aug 2005, Ugo Bellavance wrote: > >> I wrote it here >> http://wiki.mailscanner.info/doku.php?id=documentation:test_troubleshoot:mailscanner >> >> >> I hope it is okay. > > > > Thanks Ugo and Julian! > > It turned out there wasn't any real problem with MailScanner for some > reason it's just slow. It takes forever to process a batch of 30 messages. > Ah? Then, http://wiki.mailscanner.info/doku.php?id=documentation:test_troubleshoot:performance -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Aug 24 20:34:01 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:38 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Jan-Peter Koopmann wrote: > Linux and perl 5.8.0 --> original version works > >Solaris and perl 5.8.3 --> original version works >FreeBSD 4.11 and perl 5.8.0 --> buggy >FreeBSD 5.4 and perl 5.8.6 -> buggy >FreeBSD 4.11 and per 5.8.6 --> buggy > > >Looks a lot like a FreeBSD bug! I will try to get this solved in FreeBSD but up to that we need to patch MailScanner for FreeBSD systems. > >Julian, what's your opinion on this? > > Don't know what happened to my reply to this. My opinion was this: Could you try the modified version on Linux and Solaris please? I don't have a FreeBSD box to try it on either. If you want me to, I'll put out a beta with the modification in if that's what you want, but it will cause grief if it doesn't work on Linux at least. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQwzLqhH2WUcUFbZUEQK72wCgmy+u7/qEMqLpTkpCcx2svim5G4kAoJ0i PUP8/WpkUkAav2WxOANjx4pX =Ylu8 -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From remy at UNIX-ASP.COM Wed Aug 24 20:02:03 2005 From: remy at UNIX-ASP.COM (Remy de Ruysscher) Date: Thu Jan 12 21:30:38 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian, FreeBSD can be obtained at: http://www.freebsd.org/where.html Regards, Remy Julian Field wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >Jan-Peter Koopmann wrote: > > > >>On Wednesday, August 24, 2005 6:47 PM Jan-Peter Koopmann wrote: >> >> >> >> >> >>>Question remains: Is this a FreeBSD or a perl problem. And do you >>>patch MailScanner or shall I patch it in the FreeBSD port? >>> >>> >>> >>> >>Ok. We checked this on the following combinations: >> >>Linux and perl 5.8.0 --> original version works >>Solaris and perl 5.8.3 --> original version works >>FreeBSD 4.11 and perl 5.8.0 --> buggy >>FreeBSD 5.4 and perl 5.8.6 -> buggy >>FreeBSD 4.11 and per 5.8.6 --> buggy >> >> >>Looks a lot like a FreeBSD bug! I will try to get this solved in FreeBSD but up to that we need to patch MailScanner for FreeBSD systems. >> >>Julian, what's your opinion on this? >> >> >> >Well done guys, I don't have a FreeBSD box on which I could have tried >this. I must build a VM with FreeBSD in it some time so I can test this >stuff. Maybe that's a job for this weekend. Where's the best place to >get a CD distro of FreeBSD in the UK? > >How about I make the change, put out a beta, and let you guys test it >for me? >Alternatively, as you have already proved the original version works on >Linux and Solaris, could you just make the change and see if it >continues to work? That would involve less potential pain for other people? > >- -- >Julian Field >www.MailScanner.info >Buy the MailScanner book at www.MailScanner.info/store >Professional Support Services at www.MailScanner.biz >MailScanner thanks transtec Computers for their support > >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > >-----BEGIN PGP SIGNATURE----- >Version: PGP Desktop 9.0.2 (Build 2424) > >iQA/AwUBQwy+OhH2WUcUFbZUEQJongCg9ger03Yhqo+Ykt5jzs8tw+W6jhgAoJvo >S8gxT6xnMn9yROnLFzNaBRz4 >=GDBN >-----END PGP SIGNATURE----- > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 3.9KB. ] [ Unable to print this part. ] From glenn.steen at gmail.com Wed Aug 24 17:43:58 2005 From: glenn.steen at gmail.com (Glenn Steen) Date: Thu Jan 12 21:30:38 2006 Subject: High CPU system usage Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 24/08/05, Glenn Steen wrote: (snip) > > > What fs do you use? Perhaps an issue with that... > > > > ext3, might be worthwhile trying without journalling. We have an UPS > > and the server is controlled by Apcupsd. > > Perhaps. And perhaps without atime updating, if you don't do that already. > BTW, as one can see from the "new style" listing, you get hit a fair bit on "/" too, perhaps something to look at... If you decide to revert to ext2, take care with "/" and your initrd. But you knew that:-). -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Aug 24 19:36:41 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:38 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Jan-Peter Koopmann wrote: >On Wednesday, August 24, 2005 6:47 PM Jan-Peter Koopmann wrote: > > > >>Question remains: Is this a FreeBSD or a perl problem. And do you >>patch MailScanner or shall I patch it in the FreeBSD port? >> >> > >Ok. We checked this on the following combinations: > >Linux and perl 5.8.0 --> original version works >Solaris and perl 5.8.3 --> original version works >FreeBSD 4.11 and perl 5.8.0 --> buggy >FreeBSD 5.4 and perl 5.8.6 -> buggy >FreeBSD 4.11 and per 5.8.6 --> buggy > > >Looks a lot like a FreeBSD bug! I will try to get this solved in FreeBSD but up to that we need to patch MailScanner for FreeBSD systems. > >Julian, what's your opinion on this? > Well done guys, I don't have a FreeBSD box on which I could have tried this. I must build a VM with FreeBSD in it some time so I can test this stuff. Maybe that's a job for this weekend. Where's the best place to get a CD distro of FreeBSD in the UK? How about I make the change, put out a beta, and let you guys test it for me? Alternatively, as you have already proved the original version works on Linux and Solaris, could you just make the change and see if it continues to work? That would involve less potential pain for other people? - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQwy+OhH2WUcUFbZUEQJongCg9ger03Yhqo+Ykt5jzs8tw+W6jhgAoJvo S8gxT6xnMn9yROnLFzNaBRz4 =GDBN -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Thu Aug 25 08:32:08 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:38 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Jan-Peter Koopmann wrote: > > >>On Wednesday, August 24, 2005 6:47 PM Jan-Peter Koopmann wrote: >> >> >> >> >>>Question remains: Is this a FreeBSD or a perl problem. And do you >>>patch MailScanner or shall I patch it in the FreeBSD port? >>> >>> >> >>Ok. We checked this on the following combinations: >> >>Linux and perl 5.8.0 --> original version works >>Solaris and perl 5.8.3 --> original version works >>FreeBSD 4.11 and perl 5.8.0 --> buggy >>FreeBSD 5.4 and perl 5.8.6 -> buggy >>FreeBSD 4.11 and per 5.8.6 --> buggy >> >> >>Looks a lot like a FreeBSD bug! I will try to get this solved in FreeBSD but up to that we need to patch MailScanner for FreeBSD systems. >> Might explain a few of the permission oddities people are seeing on non-freebsd Mailwatch 1.0.2 implementations too????? >>Julian, what's your opinion on this? >> > > Well done guys, I don't have a FreeBSD box on which I could have tried > this. I must build a VM with FreeBSD in it some time so I can test this > stuff. Maybe that's a job for this weekend. Where's the best place to > get a CD distro of FreeBSD in the UK? > http://www.mirror.ac.uk/mirror/ftp.freebsd.org/ftp/pub/FreeBSD/ISO-IMAGES-i386 5.4 is latest stable. 6.0 is due to go rc1 shortly I think... > How about I make the change, put out a beta, and let you guys test it > for me? > Alternatively, as you have already proved the original version works on > Linux and Solaris, could you just make the change and see if it > continues to work? That would involve less potential pain for other people? > I you push out a beta I can test it here fairly quickly (but on FreeBSD, othesrs will have to try the other platforms). -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Thu Aug 25 09:41:20 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:38 2006 Subject: Beta 4.45.1 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > -----BEGIN PGP SIGNED MESSAGE----- > > I have just released beta version 4.45.1. > I would be grateful if you could test this release. > One known issue is that the multiple-phishing-net detector does not > work very well. It works some of the time, but needs more work. > > And please support MailScanner by buying the book! > > The Change Log is quite short at the moment: > > * New Features and Improvements * > - - Added MCP patches for SpamAssassin 3.0.4. > - - Added extra output about nodeps switch with install.sh for RPM. > - - Added "no bytes" lines to cancel out "use bytes" as it causes problems > with multi-lingual subject lines. > - - Improved phishing net so that when you have multiple MailScanner > servers > all handling your incoming mail, links caught by the first one > won't also > be caught by the following ones. This caused the final message to > contain > multiple warnings about the same link. There is now just 1 warning. > - - New "Quarantine Modified Body" setting, default is "no". This will > cause > all modified messages to be quarantined, including messages which > have > had their HTML disarmed. > > * Fixes * > - - Corrected bayes_file_mode in spam.assassin.prefs.conf on advice from > Matt Kettler. > - - 'MailScanner -v' now prints out the version number of Convert::TNEF. > - - Group memberships problem on BSD fixed. Spam quarantine membership > should now always be correct on BSD systems. > > - -- > Julian Field Julian installed and running - group membership on the non-spam and spam files in quarantine/[non-]spam is now showing correct on FreeBSD.. (darn that means I'll have to try the MailWatch 1.0x release now ;-) -- -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Aug 25 09:13:07 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:38 2006 Subject: Beta 4.45.1 Message-ID: -----BEGIN PGP SIGNED MESSAGE----- I have just released beta version 4.45.1. I would be grateful if you could test this release. One known issue is that the multiple-phishing-net detector does not work very well. It works some of the time, but needs more work. And please support MailScanner by buying the book! The Change Log is quite short at the moment: * New Features and Improvements * - - Added MCP patches for SpamAssassin 3.0.4. - - Added extra output about nodeps switch with install.sh for RPM. - - Added "no bytes" lines to cancel out "use bytes" as it causes problems with multi-lingual subject lines. - - Improved phishing net so that when you have multiple MailScanner servers all handling your incoming mail, links caught by the first one won't also be caught by the following ones. This caused the final message to contain multiple warnings about the same link. There is now just 1 warning. - - New "Quarantine Modified Body" setting, default is "no". This will cause all modified messages to be quarantined, including messages which have had their HTML disarmed. * Fixes * - - Corrected bayes_file_mode in spam.assassin.prefs.conf on advice from Matt Kettler. - - 'MailScanner -v' now prints out the version number of Convert::TNEF. - - Group memberships problem on BSD fixed. Spam quarantine membership should now always be correct on BSD systems. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQw19lfw32o+k+q+hAQFvcAf/SVK49axnghdZK3nf5kt2ta9W6JjHe+2o yGI5ap5pbmWBGlWiTq7OpwULMOUFC4XYrQXY8mTzuLbf7gskVXM7NoygodAie94G ROX4PLYvJxlGF0nHt2dIxZbdSKRrqX1LgNwpHPNj20uxtrpsxto8Qi7TBn6X1+CV h9X/Rm3MEdt68g9iO+eY1thnCQNTvAnDNSXfV+QDQpaEm+k6GlwDeoRlpYexQtuP 0xHTzrI6zJc1Oi8mEDQxsUpdmNt/wGf++RE4D38cMKGklIVXFOoOiskirR244cRq tX+4DmrGuRiHGYf6IhXMAhhrm4vIwJCzseMLDRVA/tpitHIJDjnr5Q== =yDEE -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jan-Peter.Koopmann at SECEIDOS.DE Thu Aug 25 09:05:55 2005 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:30:38 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Wednesday, August 24, 2005 9:34 PM Julian Field wrote: > Don't know what happened to my reply to this. It arrived... :-) > My opinion was this: > Could you try the modified version on Linux and Solaris please? All our MailScanner installations are FreeBSD based... Sorry. > I > don't have a FreeBSD box to try it on either. If you want me to, I'll > put out a beta with the modification in if that's what you want, but > it will cause grief if it doesn't work on Linux at least. The question is: Why could this cause trouble at all? On FreeBSD GID would be (in my case) 6 8006 0 on Linux e.g. 6 6 8006 0 I cannot think of a way this could result in trouble. Yet again: We should test it of course. Hopefully some Linux/Solaris guys can help out. Regards, JP ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Thu Aug 25 10:21:10 2005 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:30:38 2006 Subject: A way to check for check.. Message-ID: Hi there, it seems that a lot of spam is comming through. As Mailscanner adds Spamassassin-Tags into the Mail, i can see that SA seems to work. I would like to check if Mailscanner really checks the RBLs. This is my setting: Spam List = ORDB-RBL SBL+XBL NJABLDYNA SORBS-DNSBL # MAPS-RBL+ costs money (except .ac.uk) Is there a way to check if MailScanner does check those rbls? Thanks in advance.. Greetings Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHT.IE Thu Aug 25 10:27:12 2005 From: michele at BLACKNIGHT.IE (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:30:38 2006 Subject: A way to check for check.. Message-ID: Marcel Blenkers <> said on 25 August 2005 10:21: > > Is there a way to check if MailScanner does check those rbls? Yes. Read your logs. Mr Michele Neylon Blacknight Solutions Quality Business Hosting & Colocation http://www.blacknight.ie/ Tel. 1850 927 280 Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 59 9164239 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Thu Aug 25 10:31:57 2005 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:30:38 2006 Subject: A way to check for check.. Message-ID: Hi there, > > Yes. Read your logs. > > > oh.. i did.. Log Speed = yes Log Spam = yes Log Non Spam = yes Log Permitted Filenames = yes Log Permitted Filetypes = yes Log Silent Viruses = yes Log Dangerous HTML Tags = yes And there is no entry for RBL-Checks.. or should i set something different to yes? Thanks in advance.. Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Thu Aug 25 10:34:58 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:38 2006 Subject: A way to check for check.. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Marcel Blenkers wrote: > Hi there, > > it seems that a lot of spam is comming through. > As Mailscanner adds Spamassassin-Tags into the Mail, i can see that SA > seems to work. > > I would like to check if Mailscanner really checks the RBLs. > This is my setting: > > Spam List = ORDB-RBL SBL+XBL NJABLDYNA SORBS-DNSBL # MAPS-RBL+ costs money > (except .ac.uk) > > Is there a way to check if MailScanner does check those rbls? > > Thanks in advance.. > > Greetings > > Marcel > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! Marcel I fine the traditional RBL's less and less useful. The URI-RBLS in SA are much better at triggering spam. Also check the extra rules in www.rulesemporium.com as they are very useful in trapping this rubbish. -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Thu Aug 25 11:08:37 2005 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:30:38 2006 Subject: A way to check for check.. Message-ID: Hi Martin, > > > I fine the traditional RBL's less and less useful. The URI-RBLS in SA are much > better at triggering spam. > > Also check the extra rules in www.rulesemporium.com as they are very useful in > trapping this rubbish. i am using rule_du_jour :) guess those mails are not in any rbl.. it seems that those spammers really worked out to create mails with maximum 4,9points..as the usual sa-spam-points are set to 5.. so i guess i set the min.spam-point down to 4.. thanks for the mail =) Greetings Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Thu Aug 25 11:16:42 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:30:38 2006 Subject: New MailScanner Documentation soon Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Stephen Swaney wrote: > We're almost finished with the revisions to the updated MailScanner > Documentation. This effort will update the free documentation available at > www.fsl.com/sopport to match the latest version of MailScanner. If anyone > has some time next week (our deadline for the final documentation is 7/19) > and would like to help with the proof and content reading, please drop me a > line off list and I'll send you a link to the new PDF file. > > Thanks in advance! > > Steve Is there a link to the updated release? the current link on http://www.fsl.com/support/ still points to v1.0.1 - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Thu Aug 25 11:16:42 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:38 2006 Subject: A way to check for check.. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Marcel Blenkers wrote: > Hi Martin, > > >> >>I fine the traditional RBL's less and less useful. The URI-RBLS in SA are much >>better at triggering spam. >> >>Also check the extra rules in www.rulesemporium.com as they are very useful in >>trapping this rubbish. > > > i am using rule_du_jour :) > guess those mails are not in any rbl.. > > it seems that those spammers really worked out to create mails with > maximum 4,9points..as the usual sa-spam-points are set to 5.. > > so i guess i set the min.spam-point down to 4.. > > > thanks for the mail =) > > Greetings > > Marcel Depends on the rules you have in rules-du-jour there's alot more in rulesemporium than comes with the default RDJ set... -- -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From joost at WAVERSVELD.NL Thu Aug 25 11:19:01 2005 From: joost at WAVERSVELD.NL (Joost Waversveld) Date: Thu Jan 12 21:30:38 2006 Subject: A way to check for check.. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] ----- Bericht van martinh@SOLID-STATE-LOGIC.COM --------- Datum: Thu, 25 Aug 2005 11:16:42 +0100 Van: Martin Hepworth Antwoorden aan:MailScanner mailing list Onderwerp: Re: A way to check for check.. Aan: MAILSCANNER@JISCMAIL.AC.UK > Marcel Blenkers wrote: >> Hi Martin, >> >> >>> >>> I fine the traditional RBL's less and less useful. The URI-RBLS in >>> SA are much >>> better at triggering spam. >>> >>> Also check the extra rules in www.rulesemporium.com as they are >>> very useful in >>> trapping this rubbish. >> >> >> i am using rule_du_jour :) >> guess those mails are not in any rbl.. >> >> it seems that those spammers really worked out to create mails with >> maximum 4,9points..as the usual sa-spam-points are set to 5.. >> >> so i guess i set the min.spam-point down to 4.. >> >> >> thanks for the mail =) >> >> Greetings >> >> Marcel > > Depends on the rules you have in rules-du-jour there's alot more in > rulesemporium than comes with the default RDJ set... > > -- > -- > Martin Hepworth > Senior Systems Administrator > Solid State Logic Ltd > tel: +44 (0)1865 842300 > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ----- Einde bericht van martinh@SOLID-STATE-LOGIC.COM ----- Which lists are you guys using?? I'm very curious..... Greetings Joost Waversveld ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Thu Aug 25 11:28:36 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:39 2006 Subject: A way to check for check.. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Joost Waversveld wrote: > ----- Einde bericht van martinh@SOLID-STATE-LOGIC.COM ----- > > Which lists are you guys using?? I'm very curious..... > > Greetings Joost Waversveld > my my_rules_du_jour has the following set.. TRUSTED_RULESETS="TRIPWIRE EVILNUMBERS EVILNUMBERS1 EVILNUMBERS2 SARE_RANDOM RANDOMVAL BOGUSVIRUS SARE_ADULT SARE_BML SARE_URI0 SARE_URI1 SARE_URI3 SARE_URI_ENG SARE_SPOOF SARE_BAYES_POISON_NXM SARE_OEM SARE_RANDOM SARE_HEADER0 SARE_HEADER2 SARE_CODING SARE_SPECIFIC SARE_REDIRECT_POST300 SARE_GENLSUBJ SARE_UNSUB SARE_OBFU SARE_OBFU2 SARE_OBFU3"; I also run a lot of other rules as well, and the black and grey URI-RBL's..... ie its highly tuned! -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ebruce at HPMICH.COM Thu Aug 25 13:54:36 2005 From: ebruce at HPMICH.COM (Ed Bruce) Date: Thu Jan 12 21:30:39 2006 Subject: A way to check for check.. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Marcel Blenkers wrote: >i am using rule_du_jour :) >guess those mails are not in any rbl.. > >it seems that those spammers really worked out to create mails with >maximum 4,9points..as the usual sa-spam-points are set to 5.. > >so i guess i set the min.spam-point down to 4.. > > > I've noticed this happening more and more. MS/SA are still catching the majority of SPAM. But I'm seeing bursts of say 5 emails all having the same subject and body, yet one of them will score 4.8 to 4.9 and the others will be just over 5 points. I'm finding bayes is what is catching most SPAM. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Thu Aug 25 13:58:00 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:39 2006 Subject: A way to check for check.. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Marcel Blenkers wrote: > Hi there, > > > >>Yes. Read your logs. >> >> >> > > oh.. > i did.. > > Log Speed = yes > Log Spam = yes > Log Non Spam = yes > Log Permitted Filenames = yes > Log Permitted Filetypes = yes > Log Silent Viruses = yes > Log Dangerous HTML Tags = yes > > And there is no entry for RBL-Checks.. > > or should i set something different to yes? > > Thanks in advance.. > > Marcel > Not your log settings, your logs. Btw, we are having a similar problem here. Many spam go through undetected. I think that the spammers use many new servers, and RBLs are slow to respond. Ugo ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Thu Aug 25 14:22:23 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:39 2006 Subject: A way to check for check.. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ugo Bellavance wrote: > Marcel Blenkers wrote: > >>Hi there, >> >> >> >> >>>Yes. Read your logs. >>> >>> >>> >> >>oh.. >>i did.. >> >>Log Speed = yes >>Log Spam = yes >>Log Non Spam = yes >>Log Permitted Filenames = yes >>Log Permitted Filetypes = yes >>Log Silent Viruses = yes >>Log Dangerous HTML Tags = yes >> >>And there is no entry for RBL-Checks.. >> >>or should i set something different to yes? >> >>Thanks in advance.. >> >>Marcel >> > > > Not your log settings, your logs. > > Btw, we are having a similar problem here. Many spam go through > undetected. I think that the spammers use many new servers, and RBLs > are slow to respond. > > Ugo FYI Top 20 rule hits over the last 5 days are as following.. URIBL_BLACK BAYES_99 URIBL_JP_SURBL URIBL_WS_SURBL URIBL_OB_SURBL URIBL_SC2_SURBL RCVD_IN_BL_SPAMCOP_NET URIBL_SC_SURBL URIBL_AB_SURBL HTML_MESSAGE URIBL_SBL URIBL_XS_SURBL MIME_HTML_ONLY MSGID_DOLLARS BAYES_00 DBL_12_LETTER_FLDR HTML_90_100 Note the large number of URI-RBL hits......IMHO these are the best defense against spam right now and are very quick to update.. -- -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From imiller at BSD.UCHICAGO.EDU Thu Aug 25 14:22:41 2005 From: imiller at BSD.UCHICAGO.EDU (Sr. Ian) Date: Thu Jan 12 21:30:39 2006 Subject: problems with blank emails Message-ID: It seems that I am have sporadic problems with emails arriving in users inbox's with nothing in the body of the email. This also happens with out going as well. Running Sendmail 8.12.11 MailScanner 4.36.4 (was this a problem with this version?) Anti Virus Mcafee Unix solaris 9 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Thu Aug 25 14:26:57 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:39 2006 Subject: problems with blank emails Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Sr. Ian wrote: > It seems that I am have sporadic problems with emails > arriving in users inbox's with nothing in the body of the email. This also > happens with out going as well. > > Running > Sendmail 8.12.11 > MailScanner 4.36.4 (was this a problem with this version?) > Anti Virus Mcafee > Unix solaris 9 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! Ian Anything in the logs for these message IDs? -- -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve.swaney at fsl.com Thu Aug 25 14:36:43 2005 From: steve.swaney at fsl.com (Stephen Swaney) Date: Thu Jan 12 21:30:39 2006 Subject: New MailScanner Documentation soon Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Dhawal Doshy > Sent: Thursday, August 25, 2005 6:17 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: New MailScanner Documentation soon > > Stephen Swaney wrote: > > We're almost finished with the revisions to the updated MailScanner > > Documentation. This effort will update the free documentation available > at > > www.fsl.com/sopport to match the latest version of MailScanner. If > anyone > > has some time next week (our deadline for the final documentation is > 7/19) > > and would like to help with the proof and content reading, please drop > me a > > line off list and I'll send you a link to the new PDF file. > > > > Thanks in advance! > > > > Steve > > Is there a link to the updated release? the current link on > http://www.fsl.com/support/ still points to v1.0.1 > > - dhawal Sorry for the delay but it's just about ready. It should be up on our web site on or about 9/6. I'll post a short note with the link when it's available. It will be up to date with the current version of MailScanner. Steve Stephen Swaney Fort Systems Ltd. stephen.swaney@fsl.com www.fsl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Aug 25 14:46:47 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:39 2006 Subject: problems with blank emails Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Check your "Lock Type" is correct. I cannot quite remember the sendmail version number (just checked, it's 8.13.1) when they changed their locking code. I think it is mentioned in MailScanner.conf. MailScanner 4.36 is pretty old now, you should consider an upgrade. And I would add ClamAV while you're at it, it's in my Clam+SA easy- install package. On 25 Aug 2005, at 14:22, Sr. Ian wrote: > It seems that I am have sporadic problems with emails > arriving in users inbox's with nothing in the body of the email. > This also > happens with out going as well. > > Running > Sendmail 8.12.11 > MailScanner 4.36.4 (was this a problem with this version?) > Anti Virus Mcafee > Unix solaris 9 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQw3Lyvw32o+k+q+hAQEZIAf9GRkyUq/bsuBFompscJXDcV7d7JepnhwO KW/+oTblvK/mieg8/LqIKJKWZBQwlSHymsc/Zw0vL2hQUafXPBGD4hbNGBPk5KCu D/CnB/ohHWaJTzQ+SwnrKcMPMCGvY4XJvEM7rE8T7ZdABPSpEZjbTatKadX5YJPL K+g2kEctYEWyzr/t6rbFZby+LXhK7Dxq6oUwWnjIyd8D24zNKL/56m4La/3WeHsv tXdfWJnw76ww9V2uTNKy2PckhLvoS17bvuhspHlnNMAtA6q41guRzwbQRCiUw9Re 7ddGGi+RpW7dWSmEOwEDxIKG6K7g2C+A1atF+pJQCgs+BPXUR9tPGQ== =l9TM -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Aug 25 15:00:18 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:39 2006 Subject: problems with blank emails Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Ah! Turns out on our Solaris boxes that with sendmail 8.12.10 I found Lock Type = posix to be rather more reliable. I think that is a quirk of sendmail on Solaris. On 25 Aug 2005, at 14:46, Julian Field wrote: > -----BEGIN PGP SIGNED MESSAGE----- > > Check your "Lock Type" is correct. I cannot quite remember the > sendmail version number (just checked, it's 8.13.1) when they changed > their locking code. I think it is mentioned in MailScanner.conf. > MailScanner 4.36 is pretty old now, you should consider an upgrade. > > And I would add ClamAV while you're at it, it's in my Clam+SA easy- > install package. > > On 25 Aug 2005, at 14:22, Sr. Ian wrote: > > >> It seems that I am have sporadic problems with emails >> arriving in users inbox's with nothing in the body of the email. >> This also >> happens with out going as well. >> >> Running >> Sendmail 8.12.11 >> MailScanner 4.36.4 (was this a problem with this version?) >> Anti Virus Mcafee >> Unix solaris 9 >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> > > - -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > -----BEGIN PGP SIGNATURE----- > Version: PGP Desktop 9.0.2 (Build 2425) > > iQEVAwUBQw3Lyvw32o+k+q+hAQEZIAf9GRkyUq/bsuBFompscJXDcV7d7JepnhwO > KW/+oTblvK/mieg8/LqIKJKWZBQwlSHymsc/Zw0vL2hQUafXPBGD4hbNGBPk5KCu > D/CnB/ohHWaJTzQ+SwnrKcMPMCGvY4XJvEM7rE8T7ZdABPSpEZjbTatKadX5YJPL > K+g2kEctYEWyzr/t6rbFZby+LXhK7Dxq6oUwWnjIyd8D24zNKL/56m4La/3WeHsv > tXdfWJnw76ww9V2uTNKy2PckhLvoS17bvuhspHlnNMAtA6q41guRzwbQRCiUw9Re > 7ddGGi+RpW7dWSmEOwEDxIKG6K7g2C+A1atF+pJQCgs+BPXUR9tPGQ== > =l9TM > -----END PGP SIGNATURE----- > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQw3O9Pw32o+k+q+hAQFi0wgAuFoVuyeDI02IW+MWV961jf/Hc3kT6zCG rlferxU8WZ4Zr0+C5bo+G+USX9+1iN5D0wVkrnaCstoedxdTMEaM243XlUAdGse1 Xcx1G/az2ryTCavjmmFQRucwCwpBCT36SV+98lo6SoQz3qKimtEzW5SSxpvnVq9h 1BjzutCOyHIInPT3RibIZMw2pqtkr254eZKvE0/feDlTYct2+XgTfzG+PodLLjI+ 4btyYjVqMirzLcdGTpJ+5ZHtE2NaGwbv3tQeEEhzsLPHpdrekdZxPxT+HmUdF6dc JngG3gehEIypCXC81ja0zuCn1pB4xmWg5iopojwJhPCk+rGIn68ivw== =EKzd -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jaearick at COLBY.EDU Thu Aug 25 15:17:10 2005 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:30:39 2006 Subject: problems with blank emails Message-ID: Julian, I've been running with sendmail and MailScanner on Solaris 9 for a long time, and I've never defined the Lock type in MS. I've never seen this problem. Jeff Earickson Colby College On Thu, 25 Aug 2005, Julian Field wrote: > Date: Thu, 25 Aug 2005 15:00:18 +0100 > From: Julian Field > Reply-To: MailScanner mailing list > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: problems with blank emails > > -----BEGIN PGP SIGNED MESSAGE----- > > Ah! > Turns out on our Solaris boxes that with sendmail 8.12.10 I found > Lock Type = posix > to be rather more reliable. I think that is a quirk of sendmail on > Solaris. > > On 25 Aug 2005, at 14:46, Julian Field wrote: > >> -----BEGIN PGP SIGNED MESSAGE----- >> >> Check your "Lock Type" is correct. I cannot quite remember the >> sendmail version number (just checked, it's 8.13.1) when they changed >> their locking code. I think it is mentioned in MailScanner.conf. >> MailScanner 4.36 is pretty old now, you should consider an upgrade. >> >> And I would add ClamAV while you're at it, it's in my Clam+SA easy- >> install package. >> >> On 25 Aug 2005, at 14:22, Sr. Ian wrote: >> >> >>> It seems that I am have sporadic problems with emails >>> arriving in users inbox's with nothing in the body of the email. >>> This also >>> happens with out going as well. >>> >>> Running >>> Sendmail 8.12.11 >>> MailScanner 4.36.4 (was this a problem with this version?) >>> Anti Virus Mcafee >>> Unix solaris 9 >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> >> - -- >> Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> >> -----BEGIN PGP SIGNATURE----- >> Version: PGP Desktop 9.0.2 (Build 2425) >> >> iQEVAwUBQw3Lyvw32o+k+q+hAQEZIAf9GRkyUq/bsuBFompscJXDcV7d7JepnhwO >> KW/+oTblvK/mieg8/LqIKJKWZBQwlSHymsc/Zw0vL2hQUafXPBGD4hbNGBPk5KCu >> D/CnB/ohHWaJTzQ+SwnrKcMPMCGvY4XJvEM7rE8T7ZdABPSpEZjbTatKadX5YJPL >> K+g2kEctYEWyzr/t6rbFZby+LXhK7Dxq6oUwWnjIyd8D24zNKL/56m4La/3WeHsv >> tXdfWJnw76ww9V2uTNKy2PckhLvoS17bvuhspHlnNMAtA6q41guRzwbQRCiUw9Re >> 7ddGGi+RpW7dWSmEOwEDxIKG6K7g2C+A1atF+pJQCgs+BPXUR9tPGQ== >> =l9TM >> -----END PGP SIGNATURE----- >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > > - -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > -----BEGIN PGP SIGNATURE----- > Version: PGP Desktop 9.0.2 (Build 2425) > > iQEVAwUBQw3O9Pw32o+k+q+hAQFi0wgAuFoVuyeDI02IW+MWV961jf/Hc3kT6zCG > rlferxU8WZ4Zr0+C5bo+G+USX9+1iN5D0wVkrnaCstoedxdTMEaM243XlUAdGse1 > Xcx1G/az2ryTCavjmmFQRucwCwpBCT36SV+98lo6SoQz3qKimtEzW5SSxpvnVq9h > 1BjzutCOyHIInPT3RibIZMw2pqtkr254eZKvE0/feDlTYct2+XgTfzG+PodLLjI+ > 4btyYjVqMirzLcdGTpJ+5ZHtE2NaGwbv3tQeEEhzsLPHpdrekdZxPxT+HmUdF6dc > JngG3gehEIypCXC81ja0zuCn1pB4xmWg5iopojwJhPCk+rGIn68ivw== > =EKzd > -----END PGP SIGNATURE----- > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From imiller at BSD.UCHICAGO.EDU Thu Aug 25 15:45:50 2005 From: imiller at BSD.UCHICAGO.EDU (Ian Miller) Date: Thu Jan 12 21:30:39 2006 Subject: problems with blank emails Message-ID: Nothing out of the ordinary. ?? But I will try the locking fix. (and an upgrade as well) -Ian -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Martin Hepworth Sent: Thursday, August 25, 2005 8:27 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: problems with blank emails Sr. Ian wrote: > It seems that I am have sporadic problems with emails > arriving in users inbox's with nothing in the body of the email. This also > happens with out going as well. > > Running > Sendmail 8.12.11 > MailScanner 4.36.4 (was this a problem with this version?) > Anti Virus Mcafee > Unix solaris 9 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! Ian Anything in the logs for these message IDs? -- -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jrudd at UCSC.EDU Thu Aug 25 17:06:29 2005 From: jrudd at UCSC.EDU (John Rudd) Date: Thu Jan 12 21:30:39 2006 Subject: A way to check for check.. Message-ID: On Aug 25, 2005, at 3:19 AM, Joost Waversveld wrote: > Which lists are you guys using?? I'm very curious..... Which lists, or which rules? For "which lists": I tend to use SBL+XBL, and an aggressive greet_pause (30 seconds, with exceptions for Mac.com and Verizon). These alone have reduced my spam intake dramatically (and I have only had 2 or 3 false positives in the several 1.25 years I have been using them - those false positives were the mac.com and verizon behaviors that lead to me giving them a greet_pause exception; since then, no false positives). If there is a regular site that leaks through this, I might add them, for rejection, to my access database. I think I have added 2 sites to my access database in the last 2 years, though. For "which rules": I don't add any special rules to SA, but I do increase the weight of the SBL, XBL, and RFCI scores (10 each for SBL and XBL, and the next highest integer for RFCI). I do the above both at home and at work. At home, I tend to get 450 delivered messages per day (that's both myself and my wife). SBL/XBL/Greet_Pause tends to block another 150. For messages that are just to me, Spam Assassin catches about 10 more per day (put into a spam folder), and I end up with 0-2 unflagged spam messages per day in my regular mail folders. (about 2/3 of our home email goes to my wife, and if we make that a general proportion, then that means, on average, I would have gotten about 200 msgs per day at home, of which 61 msgs were spam, with 1 of those spam messages getting through to my regular mail folders, and with a false positive rate that is so low it might as well be 0) At work, my SA engine is rather out of date. The "delivered messages" to "SBL/XBL/Greet_Pause blocked messages" ratio is about the same. In my personal mail feed, though, the "what SA caught" vs "what SA missed" ratio is closer to 50/50. However, my incoming mail volume at work is much higher, so it's more like 10-15 messages/per day that leak through. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Aug 25 19:21:07 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:39 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I've burnt a CD of the -bootonly.iso file for 5.4, and it won't boot off it. And if I try to burn one from my laptop at home, the software refuses to accept it is an ISO at all. And that is separately downloaded from www.mirror.ac.uk, which is usually fine. What am I doing wrong? I can't get this d**n BSD stuff to start at all. Do I need to boot off the -bootonly.iso then use disc 1 then disc 2? The installation guide is at least 10 years old, it tells you to catalogue all your hardware with ISA-bus interrupt numbers and stuff like that, it is so out of date it is useless. /me not impressed by FreeBSD so far... -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Thu Aug 25 19:31:44 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:39 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > I've burnt a CD of the -bootonly.iso file for 5.4, and it won't boot off > it. > And if I try to burn one from my laptop at home, the software refuses to > accept it is an ISO at all. And that is separately downloaded from > www.mirror.ac.uk, which is usually fine. > > What am I doing wrong? > I can't get this d**n BSD stuff to start at all. > Do I need to boot off the -bootonly.iso then use disc 1 then disc 2? > The installation guide is at least 10 years old, it tells you to > catalogue all your hardware with ISA-bus interrupt numbers and stuff > like that, it is so out of date it is useless. > > /me not impressed by FreeBSD so far... > Basic question: You did check the integrity of the .iso? I'm really not a FreeBSD guru (never used it in prod, but I've never had any problem booting off an install disk. Are using vmware? You can just tell vmware to use the .iso image as cdrom drive. hth -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From peter at UCGBOOK.COM Thu Aug 25 20:04:17 2005 From: peter at UCGBOOK.COM (Peter Bonivart) Date: Thu Jan 12 21:30:39 2006 Subject: problems with blank emails Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jeff A. Earickson wrote: > I've been running with sendmail and MailScanner on Solaris 9 for > a long time, and I've never defined the Lock type in MS. I've > never seen this problem. Me too. It defaults to flock and it works like a charm. -- /Peter Bonivart --Unix lovers do it in the Sun ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Thu Aug 25 20:02:31 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:39 2006 Subject: High CPU system usage Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Glenn Steen wrote: > On 24/08/05, Glenn Steen wrote: > (snip) > >>>>What fs do you use? Perhaps an issue with that... >>> >>>ext3, might be worthwhile trying without journalling. We have an UPS >>>and the server is controlled by Apcupsd. >> >>Perhaps. And perhaps without atime updating, if you don't do that already. >> > > > BTW, as one can see from the "new style" listing, you get hit a fair > bit on "/" too, perhaps something to look at... > If you decide to revert to ext2, take care with "/" and your initrd. > But you knew that:-). > I'm wondering what is reading/writing on '/'. Another thing that makes me wonder is the amount of idle CPU. I just logged in as my server had a high load and I saw that even with many MailScanner processes running and using CPU, there was often significant Idle %. (10-30%). -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Thu Aug 25 21:18:09 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:39 2006 Subject: High CPU system usage Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 25/08/05, Ugo Bellavance wrote: > Glenn Steen wrote: > > BTW, as one can see from the "new style" listing, you get hit a fair > > bit on "/" too, perhaps something to look at... > > If you decide to revert to ext2, take care with "/" and your initrd. > > But you knew that:-). > > > > I'm wondering what is reading/writing on '/'. I was going to say "/tmp", but you have that separate too.... so this might actually be your "clincher".Since it's mostly writing you might be able to find out what gets written through the atime bit... some "intelligent" find or just browsing with an appropriate ls. lsof might also give a clue or two. > Another thing that makes me wonder is the amount of idle CPU. I just > logged in as my server had a high load and I saw that even with many > MailScanner processes running and using CPU, there was often significant > Idle %. (10-30%). Well, although generally IO is CPU-bound, you could see this if you were exhausting your RAID-controllers write-cache.... I'm not too familiar with the one you've got there (more used to SMARTs at the low end and Clariions/FC on the "high" end), but if you have your cache watermark levels wrong (for the IO patterns you see) you might see rather "choppy" behaviour.... if you have such at all. Also, write-cache mirroring can be a real performance killer. I usually try to live with that though, safety first and all that:-). Or it's something else altogether:-). What did the top show? -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Thu Aug 25 21:35:10 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:39 2006 Subject: High CPU system usage Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Glenn Steen wrote: > On 25/08/05, Ugo Bellavance wrote: > >>Glenn Steen wrote: >> >>>BTW, as one can see from the "new style" listing, you get hit a fair >>>bit on "/" too, perhaps something to look at... >>>If you decide to revert to ext2, take care with "/" and your initrd. >>>But you knew that:-). >>> >> >>I'm wondering what is reading/writing on '/'. > > > I was going to say "/tmp", but you have that separate too.... so this > might actually be your "clincher".Since it's mostly writing you might > be able to find out what gets written through the atime bit... some > "intelligent" find or just browsing with an appropriate ls. lsof might > also give a clue or two. > > >>Another thing that makes me wonder is the amount of idle CPU. I just >>logged in as my server had a high load and I saw that even with many >>MailScanner processes running and using CPU, there was often significant >>Idle %. (10-30%). > > > Well, although generally IO is CPU-bound, you could see this if you > were exhausting your RAID-controllers write-cache.... I'm not too > familiar with the one you've got there (more used to SMARTs at the low > end and Clariions/FC on the "high" end), but if you have your cache > watermark levels wrong (for the IO patterns you see) you might see > rather "choppy" behaviour.... if you have such at all. > Also, write-cache mirroring can be a real performance killer. I > usually try to live with that though, safety first and all that:-). > > Or it's something else altogether:-). > What did the top show? > Many MailScanner and MailScanner-related processes (MailScanner, bdc, fprot, etc...) at top (using most CPU time). bind sometimes got in the 12-ish rank, maybe once in 2 minutes. Nothing really weird to me. -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Thu Aug 25 21:56:17 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:39 2006 Subject: High CPU system usage Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 25/08/05, Ugo Bellavance wrote: (snip) > > What did the top show? > > > > Many MailScanner and MailScanner-related processes (MailScanner, bdc, > fprot, etc...) at top (using most CPU time). bind sometimes got in the > 12-ish rank, maybe once in 2 minutes. Nothing really weird to me. > > -- > Ugo Ok, and did you observe the mail backlog at this time? And if so, did you get any iostats with a shorter period (every 2-5 secs, or somesuch)? -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Thu Aug 25 23:14:39 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:39 2006 Subject: High CPU system usage Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Glenn Steen wrote: > On 25/08/05, Ugo Bellavance wrote: > (snip) > >>>What did the top show? >>> >> >>Many MailScanner and MailScanner-related processes (MailScanner, bdc, >>fprot, etc...) at top (using most CPU time). bind sometimes got in the >>12-ish rank, maybe once in 2 minutes. Nothing really weird to me. >> >>-- >>Ugo > > Ok, and did you observe the mail backlog at this time? And if so, did > you get any iostats with a shorter period (every 2-5 secs, or > somesuch)? > The backlog was not terrible at the time. Nah, I forgot about the iostat. Hopefully I'll catch a bigger burst tomorrow. :) -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dfilchak at SYMPATICO.CA Fri Aug 26 00:25:39 2005 From: dfilchak at SYMPATICO.CA (Dave Filchak) Date: Thu Jan 12 21:30:39 2006 Subject: MailScanner not functioning Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello all, I have been noticing an increase in spam levels to our users and so I started going through the logs and determined that it appears as though MailScanner and SpamAssassin have not been functioning. My bad I think but I am now trying to figure out what has gone wrong and most importantly, how to fix it. Here is what I am finding in the log files: Aug 25 13:57:53 rosewood spamc[15755]: connect(AF_INET) to spamd at 127.0.0.1 failed, retrying (#1 of 3): Connection refused Aug 25 13:57:54 rosewood spamc[15755]: connect(AF_INET) to spamd at 127.0.0.1 failed, retrying (#2 of 3): Connection refused Aug 25 13:57:55 rosewood spamc[15755]: connect(AF_INET) to spamd at 127.0.0.1 failed, retrying (#3 of 3): Connection refused Aug 25 13:57:56 rosewood spamc[15755]: connection attempt to spamd aborted after 3 retries Then after I updated to the latest MailScanner, I am seeing this: Aug 25 15:41:59 rosewood sendmail[23231]: NOQUEUE: SYSERR(root): opendaemonsocket: daemon MTA: cannot bind: Address already in use Aug 25 15:41:59 rosewood sendmail[23231]: daemon MTA: problem creating SMTP socket Aug 25 15:42:04 rosewood sendmail[23231]: NOQUEUE: SYSERR(root): opendaemonsocket: daemon MTA: cannot bind: Address already in use Aug 25 15:42:04 rosewood sendmail[23231]: daemon MTA: problem creating SMTP socket I also continue to see the first set of errors so it appears as SpamAssassinh is screwed as well. When I run cat /var/log/maillog | grep MailScanner, I get nothing from the logs. Any help is truly appreciated. Thanks Dave Here is my config: This is MailScanner version 4.44.6 Module versions are: 1.00 AnyDBM_File 1.14 Archive::Zip 1.01 Carp 1.119 Convert::BinHex 1.00 DirHandle 1.04 Fcntl 2.71 File::Basename 2.05 File::Copy 2.01 FileHandle 1.05 File::Path 0.13 File::Temp 1.29 HTML::Entities 3.45 HTML::Parser 2.30 HTML::TokeParser 1.20 IO 1.09 IO::File 1.122 IO::Pipe 1.50 Mail::Header 3.05 MIME::Base64 5.417 MIME::Decoder 5.417 MIME::Decoder::UU 5.417 MIME::Head 5.417 MIME::Parser 3.03 MIME::QuotedPrint 5.417 MIME::Tools 0.10 Net::CIDR 1.05 POSIX 1.75 Socket 0.03 Sys::Syslog 1.02 Time::localtime Optional module versions are: 1.806 DB_File 1.10 Digest 1.01 Digest::HMAC 2.20 Digest::MD5 2.01 Digest::SHA1 0.44 Inline 0.17 Mail::ClamAV 3.000004 Mail::SpamAssassin missing Mail::SPF::Query missing Net::CIDR::Lite 0.48 Net::DNS missing Net::LDAP 1.94 Parse::RecDescent missing SAVI missing Sys::Hostname::Long 2.26 Test::Harness 0.47 Test::Simple 1.89 Text::Balanced 1.21 URI ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Fri Aug 26 00:31:30 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:30:39 2006 Subject: MailScanner not functioning Message-ID: On 26 Aug 2005, at 00:25, Dave Filchak wrote: > Hello all, > > I have been noticing an increase in spam levels to our users and so I > started going through the logs and determined that it appears as > though > MailScanner and SpamAssassin have not been functioning. My bad I think > but I am now trying to figure out what has gone wrong and most > importantly, how to fix it. Here is what I am finding in the log > files: > > Aug 25 13:57:53 rosewood spamc[15755]: connect(AF_INET) to spamd at > 127.0.0.1 failed, retrying (#1 of 3): Connection refused > Aug 25 13:57:54 rosewood spamc[15755]: connect(AF_INET) to spamd at > 127.0.0.1 failed, retrying (#2 of 3): Connection refused > Aug 25 13:57:55 rosewood spamc[15755]: connect(AF_INET) to spamd at > 127.0.0.1 failed, retrying (#3 of 3): Connection refused > Aug 25 13:57:56 rosewood spamc[15755]: connection attempt to spamd > aborted after 3 retries You need to stop spamc & spamc being started at start up. You haven't mentioned which OS you are running so I can't advise how to do this. > > Then after I updated to the latest MailScanner, I am seeing this: > > Aug 25 15:41:59 rosewood sendmail[23231]: NOQUEUE: SYSERR(root): > opendaemonsocket: daemon MTA: cannot bind: Address already in use > Aug 25 15:41:59 rosewood sendmail[23231]: daemon MTA: problem creating > SMTP socket > Aug 25 15:42:04 rosewood sendmail[23231]: NOQUEUE: SYSERR(root): > opendaemonsocket: daemon MTA: cannot bind: Address already in use > Aug 25 15:42:04 rosewood sendmail[23231]: daemon MTA: problem creating > SMTP socket Likewise here you have your MTA (Sendmail?) started when MailScanner tries to start, hence MailScanner can't start it's instance of Sendmail so you get these errors. Turn off the 'stand alone' Sendmail option and only use MAilScanner to start the TA and it's self. Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dfilchak at SYMPATICO.CA Fri Aug 26 00:52:07 2005 From: dfilchak at SYMPATICO.CA (Dave Filchak) Date: Thu Jan 12 21:30:39 2006 Subject: MailScanner not functioning Message-ID: Hi yes sorry, the OS a Red Hat 9 box. I did stop sendmail and then restart MailScanner and it seems to be funbctioning now. However, I am curious how this got this way as this box has been running uninterrupted for quite while now. I just updated the MailScanner and SpamAssassin stuff today so maybe something happened there? The other thing I noticed is that you mention that you should not set Use SpamAssassin = yes in the MailScanner.conf. This is correct? Thanks for your reply by the way. Dave ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From remy at UNIX-ASP.COM Thu Aug 25 19:54:49 2005 From: remy at UNIX-ASP.COM (Remy de Ruysscher) Date: Thu Jan 12 21:30:39 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > I've burnt a CD of the -bootonly.iso file for 5.4, and it won't boot > off it. > And if I try to burn one from my laptop at home, the software refuses > to accept it is an ISO at all. And that is separately downloaded from > www.mirror.ac.uk, which is usually fine. > > What am I doing wrong? > I can't get this d**n BSD stuff to start at all. > Do I need to boot off the -bootonly.iso then use disc 1 then disc 2? > The installation guide is at least 10 years old, it tells you to > catalogue all your hardware with ISA-bus interrupt numbers and stuff > like that, it is so out of date it is useless. > > /me not impressed by FreeBSD so far... > Have you verified the MD5 of your CD? MD5 (5.4-RELEASE-i386-bootonly.iso) = 2afe65af7e7b994c3ce87cefda27352e I've never downloaded the bootonly, but the normal releases (disc1 and disc2) worked always flawlessly. ftp://ftp.uk.freebsd.org/pub/FreeBSD/ISO-IMAGES-i386/5.4/5.4-RELEASE-i386-disc1.iso (you need only disc1 for normal installation). Just boot off disc 1 and you'll find yourself in the sysinstall. See http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/install.html Regards, Remy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 3.9KB. ] [ Unable to print this part. ] From martinh at SOLID-STATE-LOGIC.COM Fri Aug 26 08:41:33 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:39 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > I've burnt a CD of the -bootonly.iso file for 5.4, and it won't boot off > it. > And if I try to burn one from my laptop at home, the software refuses to > accept it is an ISO at all. And that is separately downloaded from > www.mirror.ac.uk, which is usually fine. > > What am I doing wrong? > I can't get this d**n BSD stuff to start at all. > Do I need to boot off the -bootonly.iso then use disc 1 then disc 2? > The installation guide is at least 10 years old, it tells you to > catalogue all your hardware with ISA-bus interrupt numbers and stuff > like that, it is so out of date it is useless. > > /me not impressed by FreeBSD so far... > Hmm You know in many years of FreeBSD use I've never actually read the instructions at the very beginning...gosh they really out of date aren't they.... Anyway disk1 is all you really need (the boot only is a rescue disk type affair). Disk 2 contains lots of the ports etc and most people download them using cvsup once they'ce got the basic install done. If you're still struggling try another mirror.. http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/mirrors-ftp.html#HANDBOOK-MIRRORS-CHAPTER-SGML-MIRRORS-UK-FTP these are virtual and will drop you somewhere... if you are still having problems let me know and I'll drop in the post 1st class so you should have it next day. Oh and yes the rest of the install is non-gui back to 1994 style as well. But once you get your head around it it's fairly easy. -- -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Aug 26 09:27:22 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:39 2006 Subject: Possible bug with spam permissions Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Thanks for the info guys. Turns out the images at www.mirror.ac.uk are corrupt. I'll drop them a line. I downloaded the "bootonly" iso from Germany, attached that as a virtual device, and VMWare then installed it nicely. V. ugly install program. They really don't want novices running this stuff, do they? On 26 Aug 2005, at 08:41, Martin Hepworth wrote: > Julian Field wrote: > >> I've burnt a CD of the -bootonly.iso file for 5.4, and it won't >> boot off it. >> And if I try to burn one from my laptop at home, the software >> refuses to accept it is an ISO at all. And that is separately >> downloaded from www.mirror.ac.uk, which is usually fine. >> What am I doing wrong? >> I can't get this d**n BSD stuff to start at all. >> Do I need to boot off the -bootonly.iso then use disc 1 then disc 2? >> The installation guide is at least 10 years old, it tells you to >> catalogue all your hardware with ISA-bus interrupt numbers and >> stuff like that, it is so out of date it is useless. >> /me not impressed by FreeBSD so far... >> > Hmm > > You know in many years of FreeBSD use I've never actually read the > instructions at the very beginning...gosh they really out of date > aren't they.... > > Anyway disk1 is all you really need (the boot only is a rescue disk > type affair). Disk 2 contains lots of the ports etc and most people > download them using cvsup once they'ce got the basic install done. > > If you're still struggling try another mirror.. > > http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/mirrors- > ftp.html#HANDBOOK-MIRRORS-CHAPTER-SGML-MIRRORS-UK-FTP > > these are virtual and will drop you somewhere... > > if you are still having problems let me know and I'll drop in the > post 1st class so you should have it next day. > > Oh and yes the rest of the install is non-gui back to 1994 style as > well. But once you get your head around it it's fairly easy. > > -- > -- > Martin Hepworth > Senior Systems Administrator > Solid State Logic Ltd > tel: +44 (0)1865 842300 > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQw7Sdfw32o+k+q+hAQFoAwf/SmavzOZC/+h89r9SIuUta2MSKznsQbK+ +M6V0wwIZaq0gWvCnhMI/TOgb9Cm4E8Tky88WlvA8u983hIgniR12jLMrFCSBXjo 80OowJaDomvpjj88eUrX0p8NXxzFE/2NLBig9HkQ5vinc/aaFADxCUShlTlJyAp3 dqJPySpCHh6Ewk23bLF8dXgOz0y9ev5uiDPUFlzyFvfr2KsokRZ/PXjktrfQhB/j 8Y64Ptx3n070dB3vx3Y7/jkEITzqWv8UpA/FBFn52/Ln/PBg/1vfMCR9I9/1HRay ScJMN3Pr0qkBC/jIO5viRtIVSG9OYptcs26/qMobXMefy8cwzsvjZw== =k66H -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From remy at UNIX-ASP.COM Fri Aug 26 10:19:53 2005 From: remy at UNIX-ASP.COM (Remy de Ruysscher) Date: Thu Jan 12 21:30:39 2006 Subject: Possible bug with spam permissions Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Yes, I know the installer is old, but it does the trick. A new installer will be implemented in FreeBSD 6.0 You can check it out at: http://bsdinstaller.org/ Julian Field wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >Thanks for the info guys. Turns out the images at www.mirror.ac.uk >are corrupt. I'll drop them a line. >I downloaded the "bootonly" iso from Germany, attached that as a >virtual device, and VMWare then installed it nicely. >V. ugly install program. They really don't want novices running this >stuff, do they? > >On 26 Aug 2005, at 08:41, Martin Hepworth wrote: > > > >>Julian Field wrote: >> >> >> >>>I've burnt a CD of the -bootonly.iso file for 5.4, and it won't >>>boot off it. >>>And if I try to burn one from my laptop at home, the software >>>refuses to accept it is an ISO at all. And that is separately >>>downloaded from www.mirror.ac.uk, which is usually fine. >>>What am I doing wrong? >>>I can't get this d**n BSD stuff to start at all. >>>Do I need to boot off the -bootonly.iso then use disc 1 then disc 2? >>>The installation guide is at least 10 years old, it tells you to >>>catalogue all your hardware with ISA-bus interrupt numbers and >>>stuff like that, it is so out of date it is useless. >>>/me not impressed by FreeBSD so far... >>> >>> >>> >>Hmm >> >>You know in many years of FreeBSD use I've never actually read the >>instructions at the very beginning...gosh they really out of date >>aren't they.... >> >>Anyway disk1 is all you really need (the boot only is a rescue disk >>type affair). Disk 2 contains lots of the ports etc and most people >>download them using cvsup once they'ce got the basic install done. >> >>If you're still struggling try another mirror.. >> >>http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/mirrors- >>ftp.html#HANDBOOK-MIRRORS-CHAPTER-SGML-MIRRORS-UK-FTP >> >>these are virtual and will drop you somewhere... >> >>if you are still having problems let me know and I'll drop in the >>post 1st class so you should have it next day. >> >>Oh and yes the rest of the install is non-gui back to 1994 style as >>well. But once you get your head around it it's fairly easy. >> >>-- >>-- >>Martin Hepworth >>Senior Systems Administrator >>Solid State Logic Ltd >>tel: +44 (0)1865 842300 >> >>********************************************************************** >> >>This email and any files transmitted with it are confidential and >>intended solely for the use of the individual or entity to whom they >>are addressed. If you have received this email in error please notify >>the system manager. >> >>This footnote confirms that this email message has been swept >>for the presence of computer viruses and is believed to be clean. >> >>********************************************************************** >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >> >> > >- -- >Julian Field >www.MailScanner.info >Buy the MailScanner book at www.MailScanner.info/store >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > >-----BEGIN PGP SIGNATURE----- >Version: PGP Desktop 9.0.2 (Build 2425) > >iQEVAwUBQw7Sdfw32o+k+q+hAQFoAwf/SmavzOZC/+h89r9SIuUta2MSKznsQbK+ >+M6V0wwIZaq0gWvCnhMI/TOgb9Cm4E8Tky88WlvA8u983hIgniR12jLMrFCSBXjo >80OowJaDomvpjj88eUrX0p8NXxzFE/2NLBig9HkQ5vinc/aaFADxCUShlTlJyAp3 >dqJPySpCHh6Ewk23bLF8dXgOz0y9ev5uiDPUFlzyFvfr2KsokRZ/PXjktrfQhB/j >8Y64Ptx3n070dB3vx3Y7/jkEITzqWv8UpA/FBFn52/Ln/PBg/1vfMCR9I9/1HRay >ScJMN3Pr0qkBC/jIO5viRtIVSG9OYptcs26/qMobXMefy8cwzsvjZw== >=k66H >-----END PGP SIGNATURE----- > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 3.9KB. ] [ Unable to print this part. ] From glenn.steen at GMAIL.COM Fri Aug 26 13:03:56 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:39 2006 Subject: MailScanner not functioning Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 26/08/05, Dave Filchak wrote: > Hi yes sorry, the OS a Red Hat 9 box. I did stop sendmail and then restart > MailScanner and it seems to be funbctioning now. However, I am curious how > this got this way as this box has been running uninterrupted for quite while > now. I just updated the MailScanner and SpamAssassin stuff today so maybe > something happened there? ... Did you perhaps reboot, and had forgotten to chkconfig sendmail off perhaps? And the initial "spamc cannot find spamd" looks like you have it in a procmailrc (/etc/procmailrc), since all the log entries are about spamc not finding anything listening (meaning either that spamd is running but being firewalled, or that spamd isn't running at all)... Just remove any mention of spamc and/or spammassassin from your procmailrc and you should be fine. > The other thing I noticed is that you mention that you should not set Use > SpamAssassin = yes in the MailScanner.conf. This is correct? Nope, you _should_ run spamassassin from MailScanner, and pretty much nowhere else. > Thanks for your reply by the way. > > Dave -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From brian at UNIVEXSYSTEMS.COM Fri Aug 26 13:52:09 2005 From: brian at UNIVEXSYSTEMS.COM (Brian Parish) Date: Thu Jan 12 21:30:39 2006 Subject: Stuck in loop Expanding TNEF archive Message-ID: This morning I found postfix stuck in a loop, processing no mail with these messages in the log every few seconds: Aug 26 06:35:09 boyac-server MailScanner[28213]: MailScanner E-Mail Virus Scanner version 4.44.6 starting... Aug 26 06:35:09 : Read 204 hostnames from the phishing whitelist Aug 26 06:35:09 : Using locktype = flock Aug 26 06:35:10 : New Batch: Found 39 messages waiting Aug 26 06:35:10 : New Batch: Scanning 30 messages, 4552291 bytes Aug 26 06:35:11 : Expanding TNEF archive at /var/spool/MailScanner/incoming/28213/5E0C8F60D.3 A146/winmail.dat Aug 26 06:35:20 : MailScanner E-Mail Virus Scanner version 4.44.6 starting... Aug 26 06:35:21 : Read 204 hostnames from the phishing whitelist Aug 26 06:35:21 : Using locktype = flock Aug 26 06:35:21 : New Batch: Found 39 messages waiting Aug 26 06:35:21 : New Batch: Scanning 30 messages, 4552291 bytes Aug 26 06:35:24 : Expanding TNEF archive at /var/spool/MailScanner/incoming/28225/5E0C8F60D.D 3593/winmail.dat Restarting didn't change anything. In MailScanner.conf I changed: TNEF Expander = internal to TNEF Expander = /usr/bin/tnef --maxsize=10000000 Restarted and voila - all the mail zoomed through and it's been fine since. Now the question is why? cheers Brian ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Fri Aug 26 14:31:19 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:39 2006 Subject: Stuck in loop Expanding TNEF archive Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 26/08/05, Brian Parish wrote: > This morning I found postfix stuck in a loop, processing no mail with these > messages in the log every few seconds: (snip) > Restarting didn't change anything. In MailScanner.conf I changed: > > TNEF Expander = internal > > to > > TNEF Expander = /usr/bin/tnef --maxsize=10000000 > > Restarted and voila - all the mail zoomed through and it's been fine since. > > Now the question is why? > > cheers > Brian If you look in the mailing list archives, you'll find that this is a known issue. Latest word is that Jules is looking for someone to provide him (on a webpage) with one of the TNEF attachments that make the internal expander go "poof". To bad you didn't look there first, or you could've been the one to give it to him;-). Oh well... Next time, 'eh? -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From naolson at GMAIL.COM Fri Aug 26 15:05:29 2005 From: naolson at GMAIL.COM (Nathan Olson) Date: Thu Jan 12 21:30:39 2006 Subject: Stuck in loop Expanding TNEF archive Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] This is a recurring "issue". Julian needs mail the TNEF module gets stuck on. Nate ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From gmatt at NERC.AC.UK Fri Aug 26 16:28:00 2005 From: gmatt at NERC.AC.UK (Greg Matthews) Date: Thu Jan 12 21:30:39 2006 Subject: destination host is loopback Message-ID: I'm getting a number of errors everyday in my logs of the sort: mail.eastrolog.com. config error: mail loops back to me (MX problem?) sure enough, if I do a DNS lookup for the above host, it resolves to 127.0.0.1. Is there anything I can do about this? I get about half a dozen different hosts like this per relay per day. GREG -- Greg Matthews 01491 692445 Head of UNIX/Linux, iTSS Wallingford ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From joost at WAVERSVELD.NL Fri Aug 26 16:33:22 2005 From: joost at WAVERSVELD.NL (Joost Waversveld) Date: Thu Jan 12 21:30:39 2006 Subject: destination host is loopback Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > I'm getting a number of errors everyday in my logs of the sort: > > mail.eastrolog.com. config error: mail loops back to me (MX problem?) > > sure enough, if I do a DNS lookup for the above host, it resolves to > 127.0.0.1. Is there anything I can do about this? I get about half a > dozen different hosts like this per relay per day. > ----- Einde bericht van gmatt@NERC.AC.UK ----- Are you using mailertable?? Then, be sure to put the hostnames/ipaddressess between [ and ] brackets... Otherwise sendmail will perform another MX lookup through DNS and will give you this error... For Example: [root@bb ~]# cat /etc/mail/mailertable domain.tld esmtp:[192.168.12.251] domain2.tld esmtp:[mail.domain2.tld] etc... Good luck Joost Waversveld ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Fri Aug 26 16:34:58 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:39 2006 Subject: Phishing net and international characters Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello Julian, Someone told me that our phishing net believes ALL accented characters are bad, as seen here: MailScanner soupçonne le lien "www._BAD_.com" d'être une tentative de fraude de la part de www.é.com
The source of the message was: www.é.com I know there are many vulnerabilities with IDN, but they will probably get mainstream soon. I found this article about Netscape 7 that dates back July 2003: http://devedge-temp.mozilla.org/viewsource/2003/idn/index_en.html So, is this a bug in MS or a desing decision? Thanks again! Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve.swaney at fsl.com Fri Aug 26 16:36:12 2005 From: steve.swaney at fsl.com (Stephen Swaney) Date: Thu Jan 12 21:30:39 2006 Subject: destination host is loopback Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Greg Matthews > Sent: Friday, August 26, 2005 11:28 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: destination host is loopback > > I'm getting a number of errors everyday in my logs of the sort: > > mail.eastrolog.com. config error: mail loops back to me (MX problem?) > > sure enough, if I do a DNS lookup for the above host, it resolves to > 127.0.0.1. Is there anything I can do about this? I get about half a > dozen different hosts like this per relay per day. > > GREG > -- > Greg Matthews 01491 692445 > Head of UNIX/Linux, iTSS Wallingford This is a very common sendmail problem. Checking Google for: config error: mail loops back to me (MX problem?) Yields: Results 1 - 10 of about 84,800 for config error: mail loops back to me (MX problem?). (0.45 seconds) This found link is one of many that will give you the answer: http://www.brandonhutchinson.com/mail_loops_back_to_me.html Just a hopefully polite hint that it's sometimes quicker and easier to Google for the error message than to post to the list :) Have a good weekend, Steve Stephen Swaney Fort Systems Ltd. stephen.swaney@fsl.com www.fsl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Kevin_Miller at CI.JUNEAU.AK.US Fri Aug 26 16:55:57 2005 From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller) Date: Thu Jan 12 21:30:39 2006 Subject: destination host is loopback Message-ID: Joost Waversveld wrote: >> I'm getting a number of errors everyday in my logs of the sort: >> >> mail.eastrolog.com. config error: mail loops back to me (MX problem?) >> >> sure enough, if I do a DNS lookup for the above host, it resolves to >> 127.0.0.1. Is there anything I can do about this? I get about half a >> dozen different hosts like this per relay per day. >> > > > ----- Einde bericht van gmatt@NERC.AC.UK ----- > > Are you using mailertable?? Then, be sure to put the > hostnames/ipaddressess between [ and ] brackets... Otherwise sendmail > will perform another MX lookup through DNS and will give you this > error... > > For Example: > > [root@bb ~]# cat /etc/mail/mailertable > domain.tld esmtp:[192.168.12.251] > domain2.tld esmtp:[mail.domain2.tld] > etc... Not sure that's his problem. If I'm reading it right, I think that's mail from outside his system - probably NDR replies. I had a similar situation a couple years ago. The spammer had intentionally set their reply-to address to a domain that *they* resolved to 127.0.0.1 so that they never had to bother with bounce messages and complaints. Sleaze bags. My present solution is to reject any connections from that domain in sendmail's access table. At the time I wasn't running sendmail, and the stupid program I was using just kept sending NRDs to itself, which weren't accepted so it sent an NDR for the NDR, etc. Didn't take long to fill up the disk! Thankfully sendmail is a bit smarter about it! HTH... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Fri Aug 26 18:37:10 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:39 2006 Subject: Resending [Phishing net and international characters] Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello Julian, Someone told me that our phishing net believes ALL accented characters are bad, as seen here: MailScanner soupçonne le lien "www._BAD_.com" d'être une tentative de fraude de la part de www.é.com
The source of the message was: www.é.com I know there are many vulnerabilities with IDN, but they will probably get mainstream soon. I found this article about Netscape 7 that dates back July 2003: http://devedge-temp.mozilla.org/viewsource/2003/idn/index_en.html So, is this a bug in MS or a desing decision? Thanks again! Denis PS: I sent this message 2 hours ago and I still haven't seen it back... -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From bob.dewildt at CYSONET.COM Fri Aug 26 21:14:43 2005 From: bob.dewildt at CYSONET.COM (Bob de Wildt) Date: Thu Jan 12 21:30:39 2006 Subject: Feature request for phishing / fraud detection Message-ID: Julian I'm using the mailscanner for a hosting party and would like to see a feature added to the phishing detection. The problem is that many people use genuine mailings with a sublink to keep up with the revenu of a mailing. 90% of these links get marked with possible fraud, which completely destroys the e-mail. It would be a good feature to be able to mark the subject of the message in stead of putting text inside the message. Just like is done with spam, virus and bad content. Would it be possible to take this up in the next upgrade? Bob de Wildt Systems Administrator Cyso Managed Hosting Baangracht 2 1811 DC Alkmaar tel: (+31) (0) 72-7513400 fax: (+31) (0) 72-7513401 e-mail: support@cysonet.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From KLekas at FOXRIVER.COM Fri Aug 26 21:42:25 2005 From: KLekas at FOXRIVER.COM (Kosta Lekas) Date: Thu Jan 12 21:30:39 2006 Subject: problem with bayes Message-ID: I am using postfix 4.42.9 When I test a message using “spamassassin -D -t --prefs-file=/etc/MailScanner/spam.assassin.prefs.conf --mbox /home/spambin/mail/testspam” I get the following output so I know bayes is working. But when the same message comes thru MS as a normal email it does not trigger bayes test. I have includes my spam.assassin.prefs.conf below 15 BAYES_99 BODY: Bayesian spam probability is 99 to 100% [score: 1.0000] 1.0 URIBL_SBL Contains an URL listed in the SBL blocklist [URIs: conuterimp.com] 0.4 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist [URIs: conuterimp.com] 4.0 URIBL_JP_SURBL Has URI in JP at http://www.surbl.org/lists.html [URIs: conuterimp.com] 1.5 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist [URIs: conuterimp.com] 3.2 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist [URIs: conuterimp.com] 4.3 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist [URIs: conuterimp.com] # =============== MailScanner: spam.assassin.prefs.conf =============== # Version 2.13.1 # SpamAssassin preferences for MailScanner users should be placed in # this file to avoid being overwritten by a SpamAssassin upgrade. # For a complete listing of configurable parameters, please see: # http://www.spamassassin.org/doc/Mail_SpamAssassin_Conf.html # =============== SpamAssassin Preferences =============== # # the file installed by SpamAssassin: # /etc/mail/spamassassin/local.cf # Should be disabled # typically use these commands: # mv /etc/mail/spamassassin/local.cf \ # /etc/mail/spamassassin/local.cf.saved # When running SpamAssassin or sa-learn from the command line, # or a script, you should always specify that SpamAssassin use # this file to load SpamAssassin preferences, i.e: # sa-learn --ham -p /etc/MailScanner/spam.assassin.prefs.conf \ # --mbox ham_mbox # spamassassin -D -p etc/MailScanner/spam.assassin.prefs.conf \ # --lint # Additional SpamAssassin rule files should be placed in: # /etc/mail/spamassasssin (default location) # or in the directory specified in MailScanner.conf setting: # SpamAssassin Local Rules Dir = # dns_available { yes | test[: name1 name2...] | no } (default: test) # By default, SpamAssassin will query some default hosts on the internet # to attempt to check if DNS is working on not. The problem is that it can # introduce some delay if your network connection is down, and in some # cases it can wrongly guess that DNS is unavailable because the test # connections failed. SpamAssassin includes a default set of 13 servers, # among which 3 are picked randomly. dns_available yes # =============== White list and Black list addresses =============== # While you can white list here but see below for a better place. # White list addresses should be added in # /etc/MailScanner/rules/spam.whitelist.rules # Black list addresses should be added in # /etc/MailScanner/rules/spam.blacklist.rules # FSL Notes: we need to set the default rule for: # Is Definitely Spam = no # to: # %rules-dir/spam.blacklist.rules # and create a default rules-dir/spam.blacklist.rules file # =============== OK Locales =============== ok_locales en zh ok_languages en zh # FSL Notes: we only support English this is unnecessary # =============== Bayesian Filtering =============== # By default, the Bayesian engine is used. This is a real CPU hog # and uses a lot of system resources to work. # On a small overloaded system, you might need to disable it. use_bayes 1 # If your root filesystem is filling up because SpamAssassin is putting # large databases in /.spamassassin or /root/.spamassassin, you can # move them using the following lines to point to their new locations. # The last part of the path is not a directory name, but actually the # start of the filenames. So with the settings below, the Bayes files # will be created as /var/spool/spamassassin/bayes_msgcount, etc. # FSL Note: we need to coordinate the Bayes File Placement # With MailWatch bayes_path /var/spool/MailScanner/spamassassin/bayes bayes_file_mode 0644 # Bump up SpamAssassin scores on the high and low end score BAYES_00 -15.0 score BAYES_05 -5.0 score BAYES_95 5.0 score BAYES_99 15.0 # To disable bayes autolearn set to 0 to enable set to 1 bayes_auto_learn 0 # For feeding spam and and ham for saved messages, mailboxes # or directories: # This MUST be customized for each site :( # Change X-YOURDOMAIN-COM to match your %org-name% as # set in MailScanner.conf #bayes_ignore_header FRFR-MailScanner #bayes_ignore_header FRFR-MailScanner-SpamCheck ##bayes_ignore_header FRFR-MailScanner-SpamScore #bayes_ignore_header FRFR-MailScanner-Information # When using the scheduled Bayes expiry feature, in MailScanner.conf # you probably want to turn off auto-expiry in SpamAssassin as it will # rarely complete before it is killed for taking too long. # You will just end up with # MailScanner: big bayes_toks.new files # wasting space. # FSL Note: we run Bayes expire from a cron job bayes_auto_expire 0 # If you are using a UNIX machine with all database files on local disks, # and no sharing of those databases across NFS filesystems, you can use a # more efficient, but non-NFS-safe, locking mechanism. Do this by adding # the line "lock_method flock" to the /etc/mail/spamassassin/local.cf # file. This is strongly recommended if you're not using NFS, as it is # much faster than the NFS-safe locker. lock_method flock # The --auto-whitelist and -a options for "spamd" and "spamassassin" to # turn on the auto-whitelist have been removed and replaced by the # "use_auto_whitelist" configuration option which is also now turned on by # default. use_auto_whitelist 0 auto_whitelist_path /var/spool/MailScanner/spamassassin/auto-whitelist auto_whitelist_file_mode 0660 # =============== RBSL related items =============== # By default, SpamAssassin will run RBL checks. If your ISP already # does this, stop RBL checks in SpamAssassin by un-commenting the # following line # skip_rbl_checks 1 # paths to utilities pyzor_path /usr/bin/pyzor dcc_path /usr/bin/dccproc # Uncomment the lines below to stop using the specific service # To stop Razor2 checks, uncomment the following line use_razor2 0 # To stop DCC checks, uncomment the following line # use_dcc 0 # To stop Pyzor checks, uncomment the following line use_pyzor 0 # The timeouts for blacklists and Razor are rather generous in the # default state that SpamAssassin is shipped. Reducing these # stops a lot of timeouts from removing SpamAssassin scores # altogether. rbl_timeout 20 razor_timeout 10 pyzor_timeout 10 # If you specify these scores, SpamAssassin will do RBL checks as well # as MailScanner, which just wastes CPU power and network bandwidth. # Either do them here by un-commenting the rules below # (if you have paid for them) or else uncomment the "skip_rbl_checks" # # line above and let MailScanner do the checks instead. #score RCVD_IN_BL_SPAMCOP_NET 4 # These next 3 will cost you money, see mailscanner.conf. #score RCVD_IN_RBL 10 #score RCVD_IN_RSS 1 #score RCVD_IN_DUL 1 # =============== SpamAssassin Header Processing =============== # SpamAssassin will attempt to discover the address used in the 'MAIL FROM:' # phase of the SMTP transaction that delivered this message, if this data # has been made available by the SMTP server. This is used in the EnvelopeFrom # pseudo-header, and for various rules such as SPF checking. # This should be explicitly set for MailScanner envelope_sender_header X-MailScanner-From # =============== Adding SpamAssassin Rules =============== # Add your own customized scores for some tests below. The default # scores are read from the installed "spamassassin.cf" file, but you # can override or disable the here. # To see the list of tests and their default scores, go to # http://spamassassin.taint.org/tests.html # These next 3 lines will add a local rule to SpamAssassin to help # protect you from the friendlygreetings.com nasty-gram which will # send lots of spam from your PC if you let it. Not really a virus, # but you don't want your users all clicking on it. header FRIEND_GREETINGS Subject =~ /you have an E-Card from/i describe FRIEND_GREETINGS Nasty E-card from FriendGreetings.com score FRIEND_GREETINGS 100.0 header FRIEND_GREETINGS2 Subject =~ /you have a greeting card from/i describe FRIEND_GREETINGS2 Nasty E-card from FriendGreetings.com score FRIEND_GREETINGS2 100.0 # =============== Disable SpamAssassin Rules =============== # To disable a SpamAssassin rule simply add an uncommented # line similar to: # score SUBJ_ILLEGAL_CHARS 0.0 score CHARSET_FARAWAY_HEADER 0.0 # =============== Change SpamAssassin Rules scores =============== # To Change a SpamAssassin rule Score simply add an uncommented # line similar to: # score SUBJ_ILLEGAL_CHARS 2.1 # =============== Special Case Rules =============== # IE explorer spoofing uri IE_VULN /%([01][0-9a-f]|7f).*@/i score IE_VULN 100.0 describe IE_VULN Internet Explorer vulnerability # added Mon Jan 12 16:14:04 EST 2004 to stop the forgers of # Not needed ins SA 3.0 # HABEAUS headers # score HABEAS_SWE -2.0 #### Special Case Rules ##### # =============== Historic Rules =============== # Osirusoft RBSL is dead # score RCVD_IN_OSIRUSOFT_COM 0.0 # score X_OSIRU_OPEN_RELAY 0.0 # score X_OSIRU_DUL 0.0 # score X_OSIRU_SPAM_SRC 0.0 # score X_OSIRU_SPAMWARE_SITE 0.0 # score X_OSIRU_DUL_FH 0.0 # score RCVD_IN_RFCI 0.0 # score DNS_FROM_RFCI_DSN 0.0 # =============== Your Edits Go Here =============== score RCVD_IN_RSL 0 # Steve@fsl.com edit Sun Jan 16 12:17:16 CST 2005 # disable the ALL_TRUSTED ruleset that comes with SA 3.x. # It's generating too many false positives # If you have problems where ALL_TRUSTED is matching external email, # including spam, then SpamAssassin has become confused about which hosts are # a part of your trusted_networks. The most common cause of this is having a # gateway mail exchanger that has a reserved IP and gets NATed by your # firewall. Fortunately the problem is easy to fix by manually declaring a # trusted_networks setting. See man Mail::SpamAssassin::Conf for details. # Once manually set, SA won't try to guess. # # If that does not fix your problem, the other possibility is you have an MTA # that generates malformed Received: headers. If you've modified your # Received: header format, please put it back to the standard format. # SpamAssassin is quite tolerant of deviations from the RFC 2822 format, but # there are some combinations it can't handle. If the malformed headers are # being made by some form of network appliance that you can't fix, report a # bug to your vendor, and as a short-term fix set the score of ALL_TRUSTED to # 0. However, realize that other problems may occur as a result of the # mis-parsed headers and the root cause does need fixing. # score ALL_TRUSTED -100 # JP data was taken out of the WS and SC SURBL zone files # JP will be a separate list in SA 3.1 urirhssub URIBL_JP_SURBL multi.surbl.org. A 64 body URIBL_JP_SURBL eval:check_uridnsbl('URIBL_JP_SURBL') describe URIBL_JP_SURBL Has URI in JP at http://www.surbl.org/lists.html tflags URIBL_JP_SURBL net score URIBL_JP_SURBL 4.0 trusted_networks 10.0/16 127/8 Kosta Lekas ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Fri Aug 26 21:48:10 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:30:39 2006 Subject: problem with bayes Message-ID: [ The following text is in the "WINDOWS-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 26 Aug 2005, at 21:42, Kosta Lekas wrote: I am using postfix 4.42.9   When I test a message using ^Óspamassassin -D -t --prefs-file=/etc/MailScanner/spam.assassin.prefs.conf --mbox  /home/spambin/mail/testspam^Ô I get the following output so I know bayes is working. But when the same message comes thru MS as a normal email it does not trigger bayes test. I have includes my spam.assassin.prefs.conf below   Check your Bayes permissions. Running Postfix, the Postfix user must have suitable permissions (i.e. Ownership) of the bayes_* files  # Change X-YOURDOMAIN-COM to match your %org-name% as # set in MailScanner.conf   #bayes_ignore_header FRFR-MailScanner #bayes_ignore_header FRFR-MailScanner-SpamCheck ##bayes_ignore_header FRFR-MailScanner-SpamScore #bayes_ignore_header FRFR-MailScanner-Information You MUST also uncomment these lines and ensure these headers match the settings in MailScanner.conf as detailed in the comment at the top of this section or else your auto learn will be making tokens from the headers your MailScanner is adding. Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Cleveland at WINNEFOX.ORG Fri Aug 26 21:44:28 2005 From: Cleveland at WINNEFOX.ORG (Jody Cleveland) Date: Thu Jan 12 21:30:39 2006 Subject: Unmatched Entries in logs Message-ID: Hello, I'm running the latest version of MailScanner with Spamassassin, Mailwatch, f-prot, and clam-av on a redhat 4.0 AS server. I noticed a slew of errors in the logs regarding unmatched entries, and I'm wondering how to fix them?: **Unmatched Entries** Started SQL Logging child : 266 Time(s) calling custom init function SQLBlacklist : 29 Time(s) Closing down by-domain spam blacklist : 29 Time(s) calling custom end function SQLBlacklist : 29 Time(s) calling custom init function SQLWhitelist : 29 Time(s) Starting up SQL Whitelist : 29 Time(s) Read 0 whitelist entries : 29 Time(s) calling custom init function MailWatchLogging : 29 Time(s) Enabling SpamAssassin auto-whitelist functionality... : 29 Time(s) Read 204 hostnames from the phishing whitelist : 29 Time(s) Starting up SQL Blacklist : 29 Time(s) Read 0 blacklist entries : 29 Time(s) calling custom end function SQLWhitelist : 29 Time(s) calling custom end function MailWatchLogging : 29 Time(s) Closing down by-domain spam whitelist : 29 Time(s) Virus Processing completed at 1262 bytes per second : 5 Time(s) Disinfection completed at 1262 bytes per second : 5 Time(s) Virus Scanning completed at 1262 bytes per second : 5 Time(s) MCP Checks completed at 1262 bytes per second : 5 Time(s) MCP Checks completed at 1261 bytes per second : 4 Time(s) Virus Processing completed at 1238 bytes per second : 4 Time(s) Spam Checks completed at 629 bytes per second : 4 Time(s) Disinfection completed at 1238 bytes per second : 4 Time(s) Disinfection completed at 1261 bytes per second : 4 Time(s) -- Jody Cleveland Computer Support Specialist cleveland@winnefox.org ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Fri Aug 26 22:02:29 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:39 2006 Subject: Unmatched Entries in logs Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jody Cleveland wrote: > Hello, > > I'm running the latest version of MailScanner with Spamassassin, > Mailwatch, f-prot, and clam-av on a redhat 4.0 AS server. > > I noticed a slew of errors in the logs regarding unmatched entries, and > I'm wondering how to fix them?: > > **Unmatched Entries** > Started SQL Logging child : 266 Time(s) > calling custom init function SQLBlacklist : 29 Time(s) > Closing down by-domain spam blacklist : 29 Time(s) > calling custom end function SQLBlacklist : 29 Time(s) > calling custom init function SQLWhitelist : 29 Time(s) > Starting up SQL Whitelist : 29 Time(s) > Read 0 whitelist entries : 29 Time(s) > calling custom init function MailWatchLogging : 29 Time(s) > Enabling SpamAssassin auto-whitelist functionality... : 29 Time(s) > Read 204 hostnames from the phishing whitelist : 29 Time(s) > Starting up SQL Blacklist : 29 Time(s) > Read 0 blacklist entries : 29 Time(s) > calling custom end function SQLWhitelist : 29 Time(s) > calling custom end function MailWatchLogging : 29 Time(s) > Closing down by-domain spam whitelist : 29 Time(s) > Virus Processing completed at 1262 bytes per second : 5 Time(s) > Disinfection completed at 1262 bytes per second : 5 Time(s) > Virus Scanning completed at 1262 bytes per second : 5 Time(s) > MCP Checks completed at 1262 bytes per second : 5 Time(s) > MCP Checks completed at 1261 bytes per second : 4 Time(s) > Virus Processing completed at 1238 bytes per second : 4 Time(s) > Spam Checks completed at 629 bytes per second : 4 Time(s) > Disinfection completed at 1238 bytes per second : 4 Time(s) > Disinfection completed at 1261 bytes per second : 4 Time(s) These don't seem like errors to me. They're part of regular MailScanner log entries. Ugo > > -- > Jody Cleveland > Computer Support Specialist > cleveland@winnefox.org > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From naolson at GMAIL.COM Fri Aug 26 22:31:19 2005 From: naolson at GMAIL.COM (Nathan Olson) Date: Thu Jan 12 21:30:39 2006 Subject: Unmatched Entries in logs Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I'm guessing you use logwatch. These appear to be normal log messages that logwatch does not have regexps for yet. Nate ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Cleveland at WINNEFOX.ORG Fri Aug 26 22:41:10 2005 From: Cleveland at WINNEFOX.ORG (Jody Cleveland) Date: Thu Jan 12 21:30:39 2006 Subject: Unmatched Entries in logs Message-ID: > I'm guessing you use logwatch. These appear to be normal log messages > that logwatch does not have regexps for yet. Yes, I do. Ah. Let's hope they do soon. ;) - jody ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Fri Aug 26 22:43:15 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:39 2006 Subject: Unmatched Entries in logs Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jody Cleveland wrote: >>I'm guessing you use logwatch. These appear to be normal log messages >>that logwatch does not have regexps for yet. > > > Yes, I do. Ah. Let's hope they do soon. ;) > > - jody > You can always write them up and submit them to the author of logwatch :). ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From matt at CODERS.CO.UK Fri Aug 26 23:32:28 2005 From: matt at CODERS.CO.UK (Matt Hampton) Date: Thu Jan 12 21:30:39 2006 Subject: File Type enforcement feature Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Gentlepeople I have been toying with the idea of coding an extentension for MailScanner which is a combination of the filetypes and filename feature. A third configuration file would be included which would be of the syntax: extension, regular expression, description e.g. avi AVI Avi Movie pdf PDF document Adobe Acrobat PDF Document When MailScanner encouters a file with .avi extension which doesn't produce "AVI" from the "file" output it would do the normal delete/store/warn? I am guessing that I can probably just munge the existing SweepOther.pm to do this - and looking at the code I reckon it won't be too hard to implement. Can anyone see a use for this? cheers Matt ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From vachanta at GMAIL.COM Sat Aug 27 00:13:39 2005 From: vachanta at GMAIL.COM (Venkata Achanta) Date: Thu Jan 12 21:30:39 2006 Subject: Spam Actions Message-ID: Thanks for the responses. That worked. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From vachanta at GMAIL.COM Sat Aug 27 00:56:23 2005 From: vachanta at GMAIL.COM (Venkata Achanta) Date: Thu Jan 12 21:30:39 2006 Subject: spamassassin tmp files in /tmp directory Message-ID: Greetings all, i have a high volume MailScanner server processing over 70k messages per day and i am noticing that /tmp is getting filled up with spamassassin.*.*.tmp files and these are as old as feb 2005. Is something not right ? Arent these supposed expire by themseleves ? Should i be writing script to clean up the /tmp i have other boxes too but i dont see similar behaviour. Any pointers will be highly appreciated. SpamAssassin version 3.0.4 running on Perl version 5.8.2 -rw------- 1 root root 12258 Apr 11 17:33 spamassassin.10016.z4H5Ae.tmp -rw------- 1 root root 6662 Feb 22 2005 spamassassin.10017.52zq9l.tmp -rw------- 1 root root 4814 Mar 2 10:20 spamassassin.10017.7Ur4h8.tmp -rw------- 1 root root 6513 Feb 9 2005 spamassassin.10017.CkYwh1.tmp -rw------- 1 root root 13081 May 12 11:38 spamassassin.10017.GadLdK.tmp -rw------- 1 root root 882 Apr 30 07:08 spamassassin.10017.M6Wgb8.tmp -rw------- 1 root root 4751 May 13 00:04 spamassassin.10017.R4n0Yu.tmp -rw------- 1 root root 4350 Mar 21 09:08 spamassassin.10017.YY7Jj1.tmp -rw------- 1 root root 3195 May 1 03:05 spamassassin.10017.Yl77wG.tmp -rw------- 1 root root 2169 Apr 27 07:08 spamassassin.10017.alQdKB.tmp -rw------- 1 root root 2347 Feb 24 2005 spamassassin.10017.gOE4AD.tmp -rw------- 1 root root 5928 Mar 6 06:08 spamassassin.10017.kqk82c.tmp -rw------- 1 root root 1880 Mar 12 02:04 spamassassin.10017.nfSAOZ.tmp -rw------- 1 root root 1805 Mar 29 08:32 spamassassin.10017.rIofk5.tmp -rw------- 1 root root 572 May 10 08:30 spamassassin.10017.u1ulYZ.tmp -rw------- 1 root root 600 May 8 04:08 spamassassin.10017.y4VKUz.tmp -rw------- 1 root root 3890 Mar 21 09:05 spamassassin.10018.9QALJo.tmp -rw------- 1 root root 23548 Apr 2 18:05 spamassassin.10018.HUsfWX.tmp -rw------- 1 root root 18074 Feb 28 13:22 spamassassin.10018.Idi5fq.tmp ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Cleveland at WINNEFOX.ORG Sat Aug 27 02:04:26 2005 From: Cleveland at WINNEFOX.ORG (Jody Cleveland) Date: Thu Jan 12 21:30:39 2006 Subject: Unmatched Entries in logs Message-ID: > You can always write them up and submit them to the author of > logwatch :). I would love to, but I wouldn't know where to begin. You ever done one? - jody ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Sat Aug 27 02:54:00 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:39 2006 Subject: Unmatched Entries in logs Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jody Cleveland wrote: >>You can always write them up and submit them to the author of >>logwatch :). > > > I would love to, but I wouldn't know where to begin. You ever done one? > > - jody > Open up /etc/log.d/scripts/services/mailscanner and read. Subscribe to the logwatch mailing list http://www2.logwatch.org:81/tabs/lists/ and ask them ;). Ugo ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Sat Aug 27 02:57:33 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:39 2006 Subject: spamassassin tmp files in /tmp directory Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Venkata Achanta wrote: > Greetings all, > > i have a high volume MailScanner server processing over 70k messages per > day and i am noticing that /tmp is getting filled up with > spamassassin.*.*.tmp files and these are as old as feb 2005. Is something > not right ? Arent these supposed expire by themseleves ? Should i be > writing script to clean up the /tmp i have other boxes too but i dont see > similar behaviour. Any pointers will be highly appreciated. > > SpamAssassin version 3.0.4 running on Perl version 5.8.2 > > -rw------- 1 root root 12258 Apr 11 17:33 > spamassassin.10016.z4H5Ae.tmp > -rw------- 1 root root 6662 Feb 22 2005 Is there a recent one? I can't see that on my server. Do you have a spamassassin process running in parallel? Maybe look at you spamassasssin prefs file? > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From raymond at PROLOCATION.NET Sat Aug 27 09:13:11 2005 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:30:39 2006 Subject: spamassassin tmp files in /tmp directory Message-ID: Hi! >> day and i am noticing that /tmp is getting filled up with >> spamassassin.*.*.tmp files and these are as old as feb 2005. Is something >> not right ? Arent these supposed expire by themseleves ? Should i be >> writing script to clean up the /tmp i have other boxes too but i dont see >> similar behaviour. Any pointers will be highly appreciated. >> >> SpamAssassin version 3.0.4 running on Perl version 5.8.2 >> >> -rw------- 1 root root 12258 Apr 11 17:33 >> spamassassin.10016.z4H5Ae.tmp >> -rw------- 1 root root 6662 Feb 22 2005 > > > Is there a recent one? I can't see that on my server. Do you have a > spamassassin process running in parallel? Maybe look at you > spamassasssin prefs file? It looks to me, allthout 70k isnt that much per day, your machine is overloaded during those times. SA times out and you will be stuck with the remaining tmp files. You can safely delete them, and uit you use some tmpwatch alike tool they will be cleaned out automaticly. Bye, Raymond. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Aug 27 11:05:20 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:39 2006 Subject: Resending [Phishing net and international characters] Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] How is MailScanner going to know that %E9 is the same as é ? Denis Beauchemin wrote: > Hello Julian, > > Someone told me that our phishing net believes ALL accented characters > are bad, as seen here: > MailScanner > soupçonne le lien "www._BAD_.com" d'être une tentative de > fraude de la part de www.é.com
> > The source of the message was: > www.é.com > > I know there are many vulnerabilities with IDN, but they will probably > get mainstream soon. I found this article about Netscape 7 that dates > back July 2003: > http://devedge-temp.mozilla.org/viewsource/2003/idn/index_en.html > > So, is this a bug in MS or a desing decision? > > Thanks again! > > Denis > PS: I sent this message 2 hours ago and I still haven't seen it back... > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Aug 27 11:12:09 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:39 2006 Subject: Feature request for phishing / fraud detection Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] This is a definite possibility. Give me an hour or two. Bob de Wildt wrote: >Julian > >I'm using the mailscanner for a hosting party and would like to see a >feature added to the phishing detection. >The problem is that many people use genuine mailings with a sublink to >keep up with the revenu of a mailing. >90% of these links get marked with possible fraud, which completely >destroys the e-mail. > >It would be a good feature to be able to mark the subject of the message >in stead of putting text inside the message. >Just like is done with spam, virus and bad content. > >Would it be possible to take this up in the next upgrade? > >Bob de Wildt > >Systems Administrator >Cyso Managed Hosting >Baangracht 2 >1811 DC Alkmaar >tel: (+31) (0) 72-7513400 >fax: (+31) (0) 72-7513401 >e-mail: support@cysonet.com > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Aug 27 14:47:37 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:39 2006 Subject: Feature request for phishing / fraud detection Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Turns out this is going to be harder than I thought. The code around this is already very complex. How much do people need this? Julian Field wrote: > This is a definite possibility. Give me an hour or two. > > Bob de Wildt wrote: > >> Julian >> >> I'm using the mailscanner for a hosting party and would like to see a >> feature added to the phishing detection. >> The problem is that many people use genuine mailings with a sublink to >> keep up with the revenu of a mailing. >> 90% of these links get marked with possible fraud, which completely >> destroys the e-mail. >> >> It would be a good feature to be able to mark the subject of the message >> in stead of putting text inside the message. >> Just like is done with spam, virus and bad content. >> >> Would it be possible to take this up in the next upgrade? >> >> Bob de Wildt >> >> Systems Administrator >> Cyso Managed Hosting >> Baangracht 2 >> 1811 DC Alkmaar >> tel: (+31) (0) 72-7513400 >> fax: (+31) (0) 72-7513401 >> e-mail: support@cysonet.com >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From joost at WAVERSVELD.NL Sat Aug 27 15:13:38 2005 From: joost at WAVERSVELD.NL (Joost Waversveld) Date: Thu Jan 12 21:30:39 2006 Subject: Feature request for phishing / fraud detection Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > Turns out this is going to be harder than I thought. The code around > this is already very complex. > How much do people need this? I think this is an very useful feature.. I would definitely use it. Joost ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From remy at UNIX-ASP.COM Sat Aug 27 15:18:41 2005 From: remy at UNIX-ASP.COM (Remy de Ruysscher) Date: Thu Jan 12 21:30:39 2006 Subject: Feature request for phishing / fraud detection Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Me too. Joost Waversveld wrote: >> Turns out this is going to be harder than I thought. The code around >> this is already very complex. >> How much do people need this? > > > I think this is an very useful feature.. I would definitely use it. > > Joost > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 3.9KB. ] [ Unable to print this part. ] From bob.dewildt at CYSONET.COM Sat Aug 27 16:46:25 2005 From: bob.dewildt at CYSONET.COM (Bob de Wildt) Date: Thu Jan 12 21:30:39 2006 Subject: Feature request for phishing / fraud detection Message-ID: Julian, We are doing high-end hosting for several international internet parties. The mailscanner features, with a couple of extra milters for sendmail, are definetly the best e-mail protection I have ever put together. Our clients are overwelming satisfied with the e-mail protection, but some of them recently complained about this feature. I have looked at the code and I think you need to slightly change the following files: etc/MailScanner.conf lib/MailScanner/ConfigDefs.pl lib/MailScanner/Message.pm I could get passed the first 2 files, but the last one was giving me trouble. I've included the patch files I was working on. Maybe you can shed some light over it. ------------- patch MailScanner.conf ------------- @@ -1191,20 +1191,6 @@ # This can also be the filename of a ruleset. High Scoring Spam Subject Text = {Spam?} +# If the message is a phishing message, do you want to add to the subject line? +Phishing Modify Subject = yes + +# If you want the subject of phishing e-mails edited +# what would you like to tell in the subject. +Phishing Subject Text = {Phishing?} + +# If the message is a phishing e-mail containing numeric links +# do you want the subject edited? +Numeric Modify Subject = yes + +# What text would you like to add to the subject? +Numeric Subject Text = {Numeric Link!} + # # Changes to the Message Body # --------------------------- ------------- end patch MailScanner.conf ------------- ------------- patch ConfigDefs.pl ------------- +++ ConfigDefs.pl Wed Aug 24 22:24:35 2005 @@ -101,6 +101,10 @@ highspamprependsubject = highscoringspammodifysubject highmcpsubjecttext = highscoringmcpsubjecttext highspamsubjecttext = highscoringspamsubjecttext +phishingprependsubject = phishingmodifysubject +numericprependsubject = numericmodifysubject +phishingsubjecttext = phishingsubjecttext +numericsubjecttext = numericsubjecttext htmltotext = converthtmltotext includespamheader = alwaysincludespamassassinreport includemcpheader = alwaysincludemcpreport ------------- end patch ConfigDefs.pl ------------- ------------- patch Message.pm ------------- +++ Message.pm Wed Aug 24 22:32:38 2005 @@ -4958,15 +4958,37 @@ unless (InPhishingWhitelist($linkurl)) { use bytes; # Don't send UTF16 to syslog, it breaks! if ($linkurl ne "" && numbertrap && $linkurl eq $squashedtext) { - # It's not a real phishing trap, just a use of numberic IP links - print MailScanner::Config::LanguageValue(0, 'numericlinkwarning') . - ' '; + # It's not a real phishing trap, just a use of numberic IP links + # print MailScanner::Config::LanguageValue(0, 'numericlinkwarning') . + # ' '; + $this->{numeric} = 1; + $this->{phishing} = 1; } else { - # It's a phishing attack. - print MailScanner::Config::LanguageValue(0, 'possiblefraudstart') . - ' "' . $linkurl . '" ' . - MailScanner::Config::LanguageValue(0, 'possiblefraudend') . ' '; + # It's a phishing attack. + # print MailScanner::Config::LanguageValue(0, 'possiblefraudstart') . + # ' "' . $linkurl . '" ' . + # MailScanner::Config::LanguageValue(0, 'possiblefraudend') . ' '; + $this->{numeric} = 0; + $this->{phishing} = 1; } + # Modify the subject line for phishing + # if it's phishing AND they want to modify the subject line AND it's not + # already been modified by another of your MailScanners. + my $phishingtag = MailScanner::Config::Value('phishingsubjecttext', $this); + if ($this->{phishing} && !$this->{numeric} && + MailScanner::Config::Value('phishingprependsubject',$this) && + !$global::MS->{mta}->TextStartsHeader($this, 'Subject:', $phishingtag)) { + $global::MS->{mta}->PrependHeader($this, 'Subject:', $phishingtag, ' '); + } + # Modify the subject line for numeric links + # if it's a numeric link AND they want to modify the subject line AND it's not + # already been modified by another of your MailScanners. + my $numerictag = MailScanner::Config::Value('numericsubjecttext', $this); + if ($this->{numeric} && !$this->{phishing} && + MailScanner::Config::Value('numericprependsubject',$this) && + !$global::MS->{mta}->TextStartsHeader($this, 'Subject:', $numerictag)) { + $global::MS->{mta}->PrependHeader($this, 'Subject:', $numerictag, ' '); + } $DisarmPhishingFound = 1; $linkurl = substr $linkurl, 0, 80; $squashedtext = substr $squashedtext, 0, 80; ------------- end patch Message.pm ------------- Kind regards, Bob de Wildt Systems Administrator Cyso Managed Hosting Baangracht 2 1811 DC Alkmaar tel: (+31) (0) 72-7513400 fax: (+31) (0) 72-7513401 e-mail: support@cysonet.com -----Oorspronkelijk bericht----- Van: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] Namens Julian Field Verzonden: zaterdag 27 augustus 2005 15:48 Aan: MAILSCANNER@JISCMAIL.AC.UK Onderwerp: Re: Feature request for phishing / fraud detection Turns out this is going to be harder than I thought. The code around this is already very complex. How much do people need this? Julian Field wrote: > This is a definite possibility. Give me an hour or two. > > Bob de Wildt wrote: > >> Julian >> >> I'm using the mailscanner for a hosting party and would like to see a >> feature added to the phishing detection. >> The problem is that many people use genuine mailings with a sublink >> to keep up with the revenu of a mailing. >> 90% of these links get marked with possible fraud, which completely >> destroys the e-mail. >> >> It would be a good feature to be able to mark the subject of the >> message in stead of putting text inside the message. >> Just like is done with spam, virus and bad content. >> >> Would it be possible to take this up in the next upgrade? >> >> Bob de Wildt >> >> Systems Administrator >> Cyso Managed Hosting >> Baangracht 2 >> 1811 DC Alkmaar >> tel: (+31) (0) 72-7513400 >> fax: (+31) (0) 72-7513401 >> e-mail: support@cysonet.com >> >> ------------------------ MailScanner list ------------------------ To >> unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and the >> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Aug 27 17:08:57 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:39 2006 Subject: Feature request for phishing / fraud detection Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Am I allowed to know who for? (off list, of course) I am happy to hear they like MailScanner. I don't suppose any of them would be prepared to make a donation or hire me for some consultancy work would they? There are always bills to pay... I can easily produce invoices that say whatever they need them to say. You obviously make a nice living out of these international parties, a bit of benefit to me is always much appreciated. However, back to the subject in hand. I have written the new code, and will put out a new beta in the next few minutes containing these new settings and features. Install exactly the same way as usual. Thanks (in advance :-) Jules. Bob de Wildt wrote: >Julian, > >We are doing high-end hosting for several international internet >parties. >The mailscanner features, with a couple of extra milters for sendmail, >are definetly the best e-mail protection I have ever put together. >Our clients are overwelming satisfied with the e-mail protection, but >some of them recently complained about this feature. > >I have looked at the code and I think you need to slightly change the >following files: > >etc/MailScanner.conf >lib/MailScanner/ConfigDefs.pl >lib/MailScanner/Message.pm > >I could get passed the first 2 files, but the last one was giving me >trouble. > >I've included the patch files I was working on. >Maybe you can shed some light over it. > >------------- patch MailScanner.conf ------------- > >@@ -1191,20 +1191,6 @@ > # This can also be the filename of a ruleset. > High Scoring Spam Subject Text = {Spam?} > >+# If the message is a phishing message, do you want to add to the >subject line? >+Phishing Modify Subject = yes >+ >+# If you want the subject of phishing e-mails edited >+# what would you like to tell in the subject. >+Phishing Subject Text = {Phishing?} >+ >+# If the message is a phishing e-mail containing numeric links >+# do you want the subject edited? >+Numeric Modify Subject = yes >+ >+# What text would you like to add to the subject? >+Numeric Subject Text = {Numeric Link!} >+ > # > # Changes to the Message Body > # --------------------------- > >------------- end patch MailScanner.conf ------------- > > > > >------------- patch ConfigDefs.pl ------------- > >+++ ConfigDefs.pl Wed Aug 24 22:24:35 2005 >@@ -101,6 +101,10 @@ > highspamprependsubject = highscoringspammodifysubject > highmcpsubjecttext = highscoringmcpsubjecttext > highspamsubjecttext = highscoringspamsubjecttext >+phishingprependsubject = phishingmodifysubject >+numericprependsubject = numericmodifysubject >+phishingsubjecttext = phishingsubjecttext >+numericsubjecttext = numericsubjecttext > htmltotext = converthtmltotext > includespamheader = alwaysincludespamassassinreport > includemcpheader = alwaysincludemcpreport > >------------- end patch ConfigDefs.pl ------------- > > > > >------------- patch Message.pm ------------- > >+++ Message.pm Wed Aug 24 22:32:38 2005 >@@ -4958,15 +4958,37 @@ > unless (InPhishingWhitelist($linkurl)) { > use bytes; # Don't send UTF16 to syslog, it breaks! > if ($linkurl ne "" && numbertrap && $linkurl eq >$squashedtext) { >- # It's not a real phishing trap, just a use of numberic IP >links >- print MailScanner::Config::LanguageValue(0, >'numericlinkwarning') . >- ' '; >+ # It's not a real phishing trap, just a use of numberic IP >links >+ # print MailScanner::Config::LanguageValue(0, >'numericlinkwarning') . >+ # ' '; >+ $this->{numeric} = 1; >+ $this->{phishing} = 1; > } else { >- # It's a phishing attack. >- print MailScanner::Config::LanguageValue(0, >'possiblefraudstart') . >- ' "' . $linkurl . '" ' . >- MailScanner::Config::LanguageValue(0, >'possiblefraudend') . ' '; >+ # It's a phishing attack. >+ # print MailScanner::Config::LanguageValue(0, >'possiblefraudstart') . >+ # ' "' . $linkurl . '" ' . >+ # MailScanner::Config::LanguageValue(0, >'possiblefraudend') . ' '; >+ $this->{numeric} = 0; >+ $this->{phishing} = 1; > } >+ # Modify the subject line for phishing >+ # if it's phishing AND they want to modify the subject line >AND it's not >+ # already been modified by another of your MailScanners. >+ my $phishingtag = >MailScanner::Config::Value('phishingsubjecttext', $this); >+ if ($this->{phishing} && !$this->{numeric} && >+ >MailScanner::Config::Value('phishingprependsubject',$this) && >+ !$global::MS->{mta}->TextStartsHeader($this, 'Subject:', >$phishingtag)) { >+ $global::MS->{mta}->PrependHeader($this, 'Subject:', >$phishingtag, ' '); >+ } >+ # Modify the subject line for numeric links >+ # if it's a numeric link AND they want to modify the subject >line AND it's not >+ # already been modified by another of your MailScanners. >+ my $numerictag = >MailScanner::Config::Value('numericsubjecttext', $this); >+ if ($this->{numeric} && !$this->{phishing} && >+ >MailScanner::Config::Value('numericprependsubject',$this) && >+ !$global::MS->{mta}->TextStartsHeader($this, 'Subject:', >$numerictag)) { >+ $global::MS->{mta}->PrependHeader($this, 'Subject:', >$numerictag, ' '); >+ } > $DisarmPhishingFound = 1; > $linkurl = substr $linkurl, 0, 80; > $squashedtext = substr $squashedtext, 0, 80; > > >------------- end patch Message.pm ------------- > > > >Kind regards, > >Bob de Wildt > >Systems Administrator >Cyso Managed Hosting >Baangracht 2 >1811 DC Alkmaar >tel: (+31) (0) 72-7513400 >fax: (+31) (0) 72-7513401 >e-mail: support@cysonet.com > > >-----Oorspronkelijk bericht----- >Van: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] Namens >Julian Field >Verzonden: zaterdag 27 augustus 2005 15:48 >Aan: MAILSCANNER@JISCMAIL.AC.UK >Onderwerp: Re: Feature request for phishing / fraud detection > >Turns out this is going to be harder than I thought. The code around >this is already very complex. >How much do people need this? > >Julian Field wrote: > > > >>This is a definite possibility. Give me an hour or two. >> >>Bob de Wildt wrote: >> >> >> >>>Julian >>> >>>I'm using the mailscanner for a hosting party and would like to see a >>> >>> > > > >>>feature added to the phishing detection. >>>The problem is that many people use genuine mailings with a sublink >>>to keep up with the revenu of a mailing. >>>90% of these links get marked with possible fraud, which completely >>>destroys the e-mail. >>> >>>It would be a good feature to be able to mark the subject of the >>>message in stead of putting text inside the message. >>>Just like is done with spam, virus and bad content. >>> >>>Would it be possible to take this up in the next upgrade? >>> >>>Bob de Wildt >>> -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Aug 27 17:33:28 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:39 2006 Subject: Beta release 4.45.2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have just release beta release version 4.45.2. The major new feature for this beta release is the ability to control whether you want to highlight any phishing attack links and/or modify the subject line when a phishing attack is found. The other useful thing is that when a message passes through more than one MailScanner servers and a "web bug" is found, you no longer get the "Web Bug from MailScannerWebBug" text in the message, so the message looks a lot tidier in this situation. Download as usual from www.mailscanner.info. For your interest, MailScanner is now running at a steady rate of 30,000 downloads per month. The total measured so far is about 580,000 downloads. So I have beaten the 1/2 million downloads figure, yay! That implies me that my best guess of the number of sites is probably at least 60,000 sites. That's quie a few, and way more than any of the commercial systems. Barracuda jump up and down about their 12,000 boxes: small fry :-) The full Change Log from 4.44 is this: * New Features and Improvements * - Added MCP patches for SpamAssassin 3.0.4. - Added extra output about nodeps switch with install.sh for RPM. - Added "no bytes" lines to cancel out "use bytes" as it causes problems with multi-lingual subject lines. - Improved phishing net so that when you have multiple MailScanner servers all handling your incoming mail, links caught by the first one won't also be caught by the following ones. This caused the final message to contain multiple warnings about the same link. There is now just 1 warning. - New "Quarantine Modified Body" setting, default is "no". This will cause all modified messages to be quarantined, including messages which have had their HTML disarmed. - Added syslog-ing to BitDefender updater. - Improved web bug handler when disarmed by multiple MailScanners. - Added new configuration options to control whether you want to highlight phishing fraud links or modify the subject line or both. New options are :- Highlight Phishing Fraud (= yes by default) Phishing Modify Subject (= "{Fraud?}" by default) Phishing Subject Text (= no by default) * Fixes * - Corrected bayes_file_mode in spam.assassin.prefs.conf on advice from Matt Kettler. - 'MailScanner -v' now prints out the version number of Convert::TNEF. - Group memberships problem on BSD fixed. Spam quarantine membership should now always be correct on BSD systems. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Aug 27 18:56:15 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:39 2006 Subject: Feature request for phishing / fraud detection Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Bob de Wildt wrote: >I have looked at the code and I think you need to slightly change the >following files: > >etc/MailScanner.conf >lib/MailScanner/ConfigDefs.pl >lib/MailScanner/Message.pm > > The first two are the trivial bit. The hard part is the actual code in the third one:) Pardon me if I didn't use your code but implemented it from scratch in my own style, I never like just taking other people's code. I'm fussy like that :-) -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bob.dewildt at CYSONET.COM Sat Aug 27 19:41:30 2005 From: bob.dewildt at CYSONET.COM (Bob de Wildt) Date: Thu Jan 12 21:30:39 2006 Subject: Feature request for phishing / fraud detection Message-ID: Julian, This is not a problem at all. I think it's even better if you use your own style in the coding. Since you've created the all the files :) I'm sorry that I can't give you any information about our clients, privacy is playing here. Though I can give you a clue in waht way to think: - International banking - International financing - housing You have probably heard of the BlackBerry technology (Exchange / BlackBerry connection). We are facilitating the only hosted environment in the Netherlands. Kind regards and keep up the good work, Bob de Wildt Systems Administrator Cyso Managed Hosting Baangracht 2 1811 DC Alkmaar tel: (+31) (0) 72-7513400 fax: (+31) (0) 72-7513401 e-mail: support@cysonet.com -----Oorspronkelijk bericht----- Van: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] Namens Julian Field Verzonden: zaterdag 27 augustus 2005 19:56 Aan: MAILSCANNER@JISCMAIL.AC.UK Onderwerp: Re: Feature request for phishing / fraud detection Bob de Wildt wrote: >I have looked at the code and I think you need to slightly change the >following files: > >etc/MailScanner.conf >lib/MailScanner/ConfigDefs.pl >lib/MailScanner/Message.pm > > The first two are the trivial bit. The hard part is the actual code in the third one:) Pardon me if I didn't use your code but implemented it from scratch in my own style, I never like just taking other people's code. I'm fussy like that :-) -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sun Aug 28 11:34:11 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:39 2006 Subject: Feature request for phishing / fraud detection Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I always like to see international banking in lists like this. Good to know that some of the most important organisations in the world are open to inovative solutions, not just blinkered into the standard "If it doesn't cost us lots of money, it can't be any good" mindset. I had a possibility of a large contracting job a year or so ago, and the company involved went for the competition, in large part because it cost more than 10 times my solution. That was how the book was born, so it wasn't all a waste of time :-> Bob de Wildt wrote: >Julian, > >This is not a problem at all. >I think it's even better if you use your own style in the coding. >Since you've created the all the files :) > >I'm sorry that I can't give you any information about our clients, >privacy is playing here. >Though I can give you a clue in waht way to think: >- International banking >- International financing >- housing > >You have probably heard of the BlackBerry technology (Exchange / >BlackBerry connection). >We are facilitating the only hosted environment in the Netherlands. > >Kind regards and keep up the good work, > >Bob de Wildt > >Systems Administrator >Cyso Managed Hosting >Baangracht 2 >1811 DC Alkmaar >tel: (+31) (0) 72-7513400 >fax: (+31) (0) 72-7513401 >e-mail: support@cysonet.com >-----Oorspronkelijk bericht----- >Van: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] Namens >Julian Field >Verzonden: zaterdag 27 augustus 2005 19:56 >Aan: MAILSCANNER@JISCMAIL.AC.UK >Onderwerp: Re: Feature request for phishing / fraud detection > >Bob de Wildt wrote: > > > >>I have looked at the code and I think you need to slightly change the >>following files: >> >>etc/MailScanner.conf >>lib/MailScanner/ConfigDefs.pl >>lib/MailScanner/Message.pm >> >> >> >> >The first two are the trivial bit. The hard part is the actual code in >the third one:) Pardon me if I didn't use your code but implemented it >from scratch in my own style, I never like just taking other people's >code. I'm fussy like that :-) > >-- >Julian Field >www.MailScanner.info >Buy the MailScanner book at www.MailScanner.info/store Professional >Support Services at www.MailScanner.biz MailScanner thanks transtec >Computers for their support > >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >------------------------ MailScanner list ------------------------ To >unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and the >archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From brian at UNIVEXSYSTEMS.COM Mon Aug 29 11:16:38 2005 From: brian at UNIVEXSYSTEMS.COM (Brian Parish) Date: Thu Jan 12 21:30:39 2006 Subject: Ruleset for archiving mail Message-ID: I would like to archive mail for one address. Not spying, just allowing messages to be deleted from a mailbox used for incoming requests as they are processed, while keeping an untouched record elsewhere. When I specify: archive = /etc/MailScanner/rules/archive-ruleset it is interpreted as a mbox file to which messages should be appended. How do I tell MailScanner that this is a ruleset? Given that I get this right, I presume that the contents should be something like: To: info@domain info-archive@domain TIA Brian ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Mon Aug 29 02:18:35 2005 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:30:39 2006 Subject: Ruleset for archiving mail Message-ID: MailScanner mailing list <> scribbled on Monday, August 29, 2005 5:17 AM: > I would like to archive mail for one address. Not spying, > just allowing messages to be deleted from a mailbox used for > incoming requests as they are processed, while keeping an > untouched record elsewhere. > > When I specify: > > archive = /etc/MailScanner/rules/archive-ruleset > > it is interpreted as a mbox file to which messages should be > appended. How do I tell MailScanner that this is a ruleset? > > Given that I get this right, I presume that the contents > should be something > like: > > To: info@domain info-archive@domain > archive = /etc/MailScanner/rules/archive-ruleset.rules should do the trick. Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From xplora at MEDIADESIGN.SCHOOL.NZ Mon Aug 29 07:03:59 2005 From: xplora at MEDIADESIGN.SCHOOL.NZ (Richard Smith) Date: Thu Jan 12 21:30:39 2006 Subject: Ruleset for archiving mail Message-ID: On 29/08/2005, at 1:18 PM, Mike Kercher wrote: > MailScanner mailing list <> scribbled on Monday, August 29, 2005 > 5:17 AM: > > >> I would like to archive mail for one address. Not spying, >> just allowing messages to be deleted from a mailbox used for >> incoming requests as they are processed, while keeping an >> untouched record elsewhere. >> >> When I specify: >> >> archive = /etc/MailScanner/rules/archive-ruleset >> >> it is interpreted as a mbox file to which messages should be >> appended. How do I tell MailScanner that this is a ruleset? >> >> Given that I get this right, I presume that the contents >> should be something >> like: >> >> To: info@domain info-archive@domain >> >> > > archive = /etc/MailScanner/rules/archive-ruleset.rules should do > the trick. > > Mike What Mike means is, all of your MailScanner rule files should have .rules on the end of the name, this helps MailScanner know the difference between a ruleset and what you are seeing happening to your file, with it being treated as the output of the archive setting. - Richard -- http://www.mediadesign.school.nz/ CAUTION: This communication is confidential and may be legally privileged. If you have received it in error you must not use, disclose, copy or retain it. Please immediately notify us by return email and then delete the email. This message has been scanned for viruses and dangerous content by MailScanner with McAfee UVScan, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From brian at UNIVEXSYSTEMS.COM Mon Aug 29 17:13:27 2005 From: brian at UNIVEXSYSTEMS.COM (Brian Parish) Date: Thu Jan 12 21:30:39 2006 Subject: Ruleset for archiving mail Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Monday 29 August 2005 06:03, Richard Smith wrote: > On 29/08/2005, at 1:18 PM, Mike Kercher wrote: > > MailScanner mailing list <> scribbled on Monday, August 29, 2005 > > > > 5:17 AM: > >> I would like to archive mail for one address. Not spying, > >> just allowing messages to be deleted from a mailbox used for > >> incoming requests as they are processed, while keeping an > >> untouched record elsewhere. > >> > >> When I specify: > >> > >> archive = /etc/MailScanner/rules/archive-ruleset > >> > >> it is interpreted as a mbox file to which messages should be > >> appended. How do I tell MailScanner that this is a ruleset? > >> > >> Given that I get this right, I presume that the contents > >> should be something > >> like: > >> > >> To: info@domain info-archive@domain > > > > archive = /etc/MailScanner/rules/archive-ruleset.rules should do > > the trick. > > > > Mike > > What Mike means is, all of your MailScanner rule files should > have .rules on the end of the name, this helps MailScanner know the > difference between a ruleset and what you are seeing happening to > your file, with it being treated as the output of the archive setting. > > - Richard Yep - got that thanks. I guess it points out that it's the little things that get you. All the examples of rulesets and all the comments in the MailScanner.conf file and the relevant pages from the MailScanner book that I've checked never mention a file type. Should have worked this out for myself I guess. Must be a bad braincell day! thanks again Brian -- best regards Brian ------------ Brian Parish Managing Director Univex Systems Pty Ltd Phone: 1300 73 64 54 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Aug 29 09:34:20 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:39 2006 Subject: Ruleset for archiving mail Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Most of the time, MailScanner can work out what you meant. It's only when there really is no way of telling, that it needs the .rules filename extension. Brian Parish wrote: >On Monday 29 August 2005 06:03, Richard Smith wrote: > > >>On 29/08/2005, at 1:18 PM, Mike Kercher wrote: >> >> >>>MailScanner mailing list <> scribbled on Monday, August 29, 2005 >>> >>>5:17 AM: >>> >>> >>>>archive = /etc/MailScanner/rules/archive-ruleset >>>> >>>>To: info@domain info-archive@domain >>>> >>>> >>>archive = /etc/MailScanner/rules/archive-ruleset.rules should do >>>the trick. >>> >>> - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQxLI4hH2WUcUFbZUEQLSlACeOyFVNY3zTrL2Jq7v1+7VRs9n32YAoIfM 1mt+qlCZBP1B2bWIMqQ206yw =zMrz -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From grantd at AISMEDIA.COM Mon Aug 29 12:39:35 2005 From: grantd at AISMEDIA.COM (Grant) Date: Thu Jan 12 21:30:39 2006 Subject: Problems with inbound mail queue Message-ID: I am not sure if this is a mailwatch or mailscanner problem, so I am posting it to both forums. I am having a considerable amount of emails building up in the inbound mailq. As of this morning there are 238 messages in there. There does not seems to be anything wrong with the messages, some are spam and others are not. They do not appear to have been processed at all, just hanging around in the queue. Mailscanner sees the messages, but does not process them. Here is a snippet of Logs; Aug 29 07:34:48 europa MailScanner[22046]: New Batch: Found 239 messages waiting Aug 29 07:34:48 europa MailScanner[22046]: New Batch: Scanning 1 messages, 3335 bytes Aug 29 07:34:49 europa MailScanner[22046]: MCP Checks: Starting Aug 29 07:34:49 europa MailScanner[22046]: MCP Checks completed at 3335 bytes per second Aug 29 07:34:49 europa MailScanner[22046]: Spam Checks: Starting I read some other posts about this and some people are just deleting them and purging the from the DB, but this does not seem to be a "solution" but a way to manage the problem. Does anyone know what the "fix" is? This problem did not start until I upgraded to Mailwatch 1.0.2 and MailScanner 4.4.6-1. It was installed from RPM on Redhat 9 running Sendmail 8.13.3-1. Mailwatch is running with Apache 2.0.52 and php 5.0.3-1. Any ideas, anyone? - Thank you, Grant Della Vecchia System Administrator ---------------------------------------------------------------------- AIS Media, Inc. 7000 Central Parkway, Suite 1700 Atlanta, GA 30328 Tel: 770.350.7998 ext. 506 | Fax: 770.350.9409 URL: www.aismedia.com | Email: grantd@aismedia.com ---------------------------------------------------------------------- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Aug 29 12:48:22 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:40 2006 Subject: Problems with inbound mail queue Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] As you are running Sendmail 8.13.1 or newer, make sure your "Lock Type = posix" in /etc/MailScanner/MailScanner.conf. Do you have a load of sendmail processes running storing the incoming messages? The "Found x messages waiting" shows the number of complete and incomplete messages in the queue, so if a load are still being delivered to you then that number can be quite large. The number it then actually scans is shows by "Scanning y messages", which shows you how many complete messages are there, in its view. If you stop the incoming sendmail listener process, does the number stay at 239? or does it gradually drop? If it stays the same then something is wrong. If it slowly drops then you just had a lot of messages being delivered to you at the same time, which is fine. Grant wrote: >I am not sure if this is a mailwatch or mailscanner problem, so I am >posting it to both forums. >I am having a considerable amount of emails building up in the inbound >mailq. >As of this morning there are 238 messages in there. There does not seems >to be anything wrong with the messages, some are spam and others are not. >They do not appear to have been processed at all, just hanging around in >the queue. >Mailscanner sees the messages, but does not process them. Here is a >snippet of Logs; >Aug 29 07:34:48 europa MailScanner[22046]: New Batch: Found 239 messages waiting >Aug 29 07:34:48 europa MailScanner[22046]: New Batch: Scanning 1 messages, 3335 bytes >Aug 29 07:34:49 europa MailScanner[22046]: MCP Checks: Starting >Aug 29 07:34:49 europa MailScanner[22046]: MCP Checks completed at 3335 bytes per second >Aug 29 07:34:49 europa MailScanner[22046]: Spam Checks: Starting > > >I read some other posts about this and some people are just deleting >them and purging the from the DB, but this does not seem to be a >"solution" but a way to manage the problem. >Does anyone know what the "fix" is? This problem did not start until I >upgraded to Mailwatch 1.0.2 and MailScanner 4.4.6-1. It was installed >from RPM on Redhat 9 running Sendmail 8.13.3-1. Mailwatch is running >with Apache 2.0.52 and php 5.0.3-1. > >Any ideas, anyone? > >- >Thank you, >Grant Della Vecchia >System Administrator >---------------------------------------------------------------------- >AIS Media, Inc. >7000 Central Parkway, Suite 1700 >Atlanta, GA 30328 >Tel: 770.350.7998 ext. 506 | Fax: 770.350.9409 >URL: www.aismedia.com | Email: grantd@aismedia.com >---------------------------------------------------------------------- > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Mon Aug 29 12:49:59 2005 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:30:40 2006 Subject: Problems with inbound mail queue Message-ID: MailScanner mailing list <> scribbled on Monday, August 29, 2005 6:40 AM: > I am not sure if this is a mailwatch or mailscanner problem, > so I am posting it to both forums. > I am having a considerable amount of emails building up in > the inbound mailq. > As of this morning there are 238 messages in there. There > does not seems to be anything wrong with the messages, some > are spam and others are not. > They do not appear to have been processed at all, just > hanging around in the queue. > Mailscanner sees the messages, but does not process them. > Here is a snippet of Logs; Aug 29 07:34:48 europa > MailScanner[22046]: New Batch: Found 239 messages waiting Aug > 29 07:34:48 europa MailScanner[22046]: New Batch: Scanning 1 > messages, 3335 bytes Aug 29 07:34:49 europa > MailScanner[22046]: MCP Checks: Starting Aug 29 07:34:49 > europa MailScanner[22046]: MCP Checks completed at 3335 bytes > per second Aug 29 07:34:49 europa MailScanner[22046]: Spam > Checks: Starting > > > I read some other posts about this and some people are just > deleting them and purging the from the DB, but this does not > seem to be a "solution" but a way to manage the problem. > Does anyone know what the "fix" is? This problem did not > start until I upgraded to Mailwatch 1.0.2 and MailScanner > 4.4.6-1. It was installed from RPM on Redhat 9 running > Sendmail 8.13.3-1. Mailwatch is running with Apache 2.0.52 > and php 5.0.3-1. > > Any ideas, anyone? > > - > Thank you, > Grant Della Vecchia > System Administrator I would start by looking at a filename in you mqueue.in and then grep your maillog to see if that message has or has not been processed. Do you have your lock type set to posix in MailScanner.conf? Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From joost at WAVERSVELD.NL Mon Aug 29 12:52:27 2005 From: joost at WAVERSVELD.NL (Joost Waversveld) Date: Thu Jan 12 21:30:40 2006 Subject: Problems with inbound mail queue Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > I am not sure if this is a mailwatch or mailscanner problem, so I am > posting it to both forums. > I am having a considerable amount of emails building up in the inbound > mailq. > As of this morning there are 238 messages in there. There does not seems > to be anything wrong with the messages, some are spam and others are not. > They do not appear to have been processed at all, just hanging around in > the queue. > Mailscanner sees the messages, but does not process them. Here is a > snippet of Logs; > Aug 29 07:34:48 europa MailScanner[22046]: New Batch: Found 239 > messages waiting > Aug 29 07:34:48 europa MailScanner[22046]: New Batch: Scanning 1 > messages, 3335 bytes > Aug 29 07:34:49 europa MailScanner[22046]: MCP Checks: Starting > Aug 29 07:34:49 europa MailScanner[22046]: MCP Checks completed at > 3335 bytes per second > Aug 29 07:34:49 europa MailScanner[22046]: Spam Checks: Starting > > > I read some other posts about this and some people are just deleting > them and purging the from the DB, but this does not seem to be a > "solution" but a way to manage the problem. > Does anyone know what the "fix" is? This problem did not start until I > upgraded to Mailwatch 1.0.2 and MailScanner 4.4.6-1. It was installed > from RPM on Redhat 9 running Sendmail 8.13.3-1. Mailwatch is running > with Apache 2.0.52 and php 5.0.3-1. > > Any ideas, anyone? I'm also seeing this, but only on one server. Other mailscanners are working correctly, and they are using the same versions. I really do not know what the problem is. I compared all the config files, etc but they are all the same. The only difference is that the 'problematic' machine is Fedora Core 3, and the other 'working' machines are RHEL 3 and Fecora Core 4. Though, by us the email seems to be delivered, but they're still standing in the mqueue.in/ folder. If there are a lot of mails in there, the load of the mailserver keeps getting higher and higher, so I copy the folder to an backupfolder and empty the /var/spool/mqueue.in/ folder, so the load returns to normal and I have still an copy of the email (just in case). ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Mon Aug 29 12:56:59 2005 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:30:40 2006 Subject: Problems with inbound mail queue Message-ID: MailScanner mailing list <> scribbled on Monday, August 29, 2005 6:52 AM: >> I am not sure if this is a mailwatch or mailscanner > problem, so I am >> posting it to both forums. >> I am having a considerable amount of emails building up in > the inbound >> mailq. >> As of this morning there are 238 messages in there. There does not >> seems to be anything wrong with the messages, some are spam > and others are not. >> They do not appear to have been processed at all, just > hanging around >> in the queue. >> Mailscanner sees the messages, but does not process them. Here is a >> snippet of Logs; Aug 29 07:34:48 europa MailScanner[22046]: > New Batch: >> Found 239 messages waiting Aug 29 07:34:48 europa > MailScanner[22046]: >> New Batch: Scanning 1 messages, 3335 bytes Aug 29 07:34:49 europa >> MailScanner[22046]: MCP Checks: Starting Aug 29 07:34:49 europa >> MailScanner[22046]: MCP Checks completed at >> 3335 bytes per second >> Aug 29 07:34:49 europa MailScanner[22046]: Spam Checks: Starting >> >> >> I read some other posts about this and some people are just > deleting >> them and purging the from the DB, but this does not seem to be a >> "solution" but a way to manage the problem. >> Does anyone know what the "fix" is? This problem did not > start until I >> upgraded to Mailwatch 1.0.2 and MailScanner 4.4.6-1. It was > installed >> from RPM on Redhat 9 running Sendmail 8.13.3-1. Mailwatch > is running >> with Apache 2.0.52 and php 5.0.3-1. >> >> Any ideas, anyone? > > I'm also seeing this, but only on one server. Other > mailscanners are working correctly, and they are using the > same versions. I really do not know what the problem is. I > compared all the config files, etc but they are all the same. > The only difference is that the 'problematic' machine is > Fedora Core 3, and the other 'working' machines are RHEL 3 > and Fecora Core 4. > > Though, by us the email seems to be delivered, but they're > still standing in the mqueue.in/ folder. > > If there are a lot of mails in there, the load of the > mailserver keeps getting higher and higher, so I copy the > folder to an backupfolder and empty the /var/spool/mqueue.in/ > folder, so the load returns to normal and I have still an > copy of the email (just in case). > I had a similar problem on an RHEL3 box. I had my High Scoring Spam Action set to delete and at certain times, the same messages would get processed over and over again...driving the system load higher and higher. I ended up changing my High Scoring Spam Actions = forward dev_null@doma.ain and I have an alias in /etc/aliases that sends dev_null@ to /dev/null. I've never seen that problem since. Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From joost at WAVERSVELD.NL Mon Aug 29 13:01:04 2005 From: joost at WAVERSVELD.NL (Joost Waversveld) Date: Thu Jan 12 21:30:40 2006 Subject: Problems with inbound mail queue Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > If you stop the incoming sendmail listener process, does the number > stay at 239? or does it gradually drop? If it stays the same then > something is wrong. If it slowly drops then you just had a lot of > messages being delivered to you at the same time, which is fine. On our situation, the emails are being processed, but they are still standing in the mqueue.in/ directory... I just checked the setting "Lock Type", and it was not set to posix, so I just changed that. I have to check if that works.... One strange thing, at the office we are also running Mailscanner. This machine is Fedora Core 4, which has a newer sendmail deamon (In the 8.13-range). Here also the "Lock Type" was set to the default (flock), but here we were not having these problems..... ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From grantd at AISMEDIA.COM Mon Aug 29 13:03:39 2005 From: grantd at AISMEDIA.COM (Grant) Date: Thu Jan 12 21:30:40 2006 Subject: Problems with inbound mail queue Message-ID: Thanks for the quick reply. I do NOT have a load of inbound sendmails, at the time of your response, there was just one sendmail process running. I did NOT have the posix lock type defined in Mailscanner.conf, so I change that and restarted Mailscanner. I checked the logs on some of the message ID's and I can not find them in the log files, I am not sure what this means, however the older ones the messafe file has been purged from the system so I can not view the message in Mailwatch. What do I do with these messages though? - Thank you, Grant Della Vecchia System Administrator ---------------------------------------------------------------------- AIS Media, Inc. 7000 Central Parkway, Suite 1700 Atlanta, GA 30328 Tel: 770.350.7998 ext. 506 | Fax: 770.350.9409 URL: www.aismedia.com | Email: grantd@aismedia.com ---------------------------------------------------------------------- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Mon Aug 29 13:19:29 2005 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:30:40 2006 Subject: Problems with inbound mail queue Message-ID: MailScanner mailing list <> scribbled on Monday, August 29, 2005 7:04 AM: > Thanks for the quick reply. > I do NOT have a load of inbound sendmails, at the time of > your response, there was just one sendmail process running. I > did NOT have the posix lock type defined in Mailscanner.conf, > so I change that and restarted Mailscanner. > > I checked the logs on some of the message ID's and I can not > find them in the log files, I am not sure what this means, > however the older ones the messafe file has been purged from > the system so I can not view the message in Mailwatch. > > What do I do with these messages though? > - It may be that since you were not using posix, these are incomplete messages (not fully received by sendmail). How old are the files in your /var/spool/mqueue.in ? Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From grantd at AISMEDIA.COM Mon Aug 29 13:27:26 2005 From: grantd at AISMEDIA.COM (Grant) Date: Thu Jan 12 21:30:40 2006 Subject: Problems with inbound mail queue Message-ID: The oldest one is 8/12/05 and the newest one is 8/29/05 at 5:45 am (EST)... - Thank you, Grant Della Vecchia System Administrator ---------------------------------------------------------------------- AIS Media, Inc. 7000 Central Parkway, Suite 1700 Atlanta, GA 30328 Tel: 770.350.7998 ext. 506 | Fax: 770.350.9409 URL: www.aismedia.com | Email: grantd@aismedia.com ---------------------------------------------------------------------- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From KLekas at FOXRIVER.COM Mon Aug 29 14:54:46 2005 From: KLekas at FOXRIVER.COM (Kosta Lekas) Date: Thu Jan 12 21:30:40 2006 Subject: problem with bayes Message-ID: On 26 Aug 2005, at 21:42, Kosta Lekas wrote: I am using postfix 4.42.9 When I test a message using “spamassassin -D -t --prefs-file=/etc/MailScanner/spam.assassin.prefs.conf --mbox /home/spambin/mail/testspam” I get the following output so I know bayes is working. But when the same message comes thru MS as a normal email it does not trigger bayes test. I have includes my spam.assassin.prefs.conf below Check your Bayes permissions. Running Postfix, the Postfix user must have suitable permissions (i.e. Ownership) of the bayes_* files # Change X-YOURDOMAIN-COM to match your %org-name% as # set in MailScanner.conf #bayes_ignore_header FRFR-MailScanner #bayes_ignore_header FRFR-MailScanner-SpamCheck ##bayes_ignore_header FRFR-MailScanner-SpamScore #bayes_ignore_header FRFR-MailScanner-Information You MUST also uncomment these lines and ensure these headers match the settings in MailScanner.conf as detailed in the comment at the top of this section or else your auto learn will be making tokens from the headers your MailScanner is adding. Drew I figured out what the problem was. Everything was working correctly it’s just Max SpamAssassin size = 30000 was chopping my incoming messages and therefore all my spam that I have been teaching bayes with was getting chopped when being delivered so bayes wasn’t triggered on any of them. Once I set this to a higher value I saw bayes scores in my spam reports. kosta -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From venkatesh_s at FASTMAIL.FM Mon Aug 29 15:10:59 2005 From: venkatesh_s at FASTMAIL.FM (Venkatesh.S) Date: Thu Jan 12 21:30:40 2006 Subject: Fragmented messages Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] hello all, can i know why these happen, which i got the report below, coz there r mails which r important to me, can anyone explain me this , its very important to know.  " Report: MailScanner: Fragmented messages cannot be scanned and are removed." regards venkatesh   -- Venkatesh.S venkatesh_s@fastmail.fm -- http://www.fastmail.fm - The professional email service ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Mon Aug 29 15:20:25 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:40 2006 Subject: Fragmented messages Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 29/08/05, Venkatesh.S wrote: > hello all, > > can i know why these happen, which i got the report below, coz there r mails > which r important to me, can anyone explain me this , its very important to > know. > " Report: MailScanner: Fragmented messages cannot be scanned and are > removed." > > regards > venkatesh > > > -- > Venkatesh.S > venkatesh_s@fastmail.fm > > -- > http://www.fastmail.fm - The professional email service I do believe it is this.... from MailScanner.conf: # Do you want to allow partial messages, which only contain a fraction of # the attachments, not the whole thing? There is absolutely no way to # scan these "partial messages" properly for viruses, as MailScanner never # sees all of the attachment at the same time. Enabling this option can # allow viruses through. You have been warned. # This can also be the filename of a ruleset so you can, for example, allow # them in outgoing mail but not in incoming mail. Allow Partial Messages = no .... So if you need them to go through, make a ruleset allowing partial messages for the recipients and/or senders that "need" this. Or just plain say "yes", but as stated.... you expose yourself to risk then. -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From denis.beauchemin at USHERBROOKE.CA Mon Aug 29 15:21:14 2005 From: denis.beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:40 2006 Subject: Resending [Phishing net and international characters] Message-ID: On Sat, 27 Aug 2005 11:05:20 +0100, Julian Field wrote: >How is MailScanner going to know that %E9 is the same as é ? I don't know but since these are no longer illegal there has to be a way to not treat them as such. Denis > >Denis Beauchemin wrote: > >> Hello Julian, >> >> Someone told me that our phishing net believes ALL accented characters >> are bad, as seen here: >> MailScanner >> soupçonne le lien "www._BAD_.com" d'être une tentative de >> fraude de la part de www.é.com
>> >> The source of the message was: >> www.é.com >> >> I know there are many vulnerabilities with IDN, but they will probably >> get mainstream soon. I found this article about Netscape 7 that dates >> back July 2003: >> http://devedge-temp.mozilla.org/viewsource/2003/idn/index_en.html >> >> So, is this a bug in MS or a desing decision? >> >> Thanks again! >> >> Denis >> PS: I sent this message 2 hours ago and I still haven't seen it back... >> > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rabellino at DI.UNITO.IT Mon Aug 29 15:42:39 2005 From: rabellino at DI.UNITO.IT (Rabellino Sergio) Date: Thu Jan 12 21:30:40 2006 Subject: Resending [Phishing net and international characters] Message-ID: Denis Beauchemin wrote: >On Sat, 27 Aug 2005 11:05:20 +0100, Julian Field > wrote: > > > >>How is MailScanner going to know that %E9 is the same as é ? >> >> > >I don't know but since these are no longer illegal there has to be a way to >not treat them as such. > >Denis > > > I found this table (grabbed from w3c) that can be used to map the binary code to HTML code. http://htmlcodetutorial.com/characterentities_famsupp_69.html The bad thing is that this table must be hardcoded into MS, I think. Bye. PS. I've checked the table and E9 (=233) map to acute; -- Dott. Mag. Sergio Rabellino Technical Staff Department of Computer Science University of Torino (Italy) http://www.di.unito.it/~rabser Tel. +39-0116706701 Fax. +39-011751603 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dpowell at LSSI.NET Mon Aug 29 16:12:15 2005 From: dpowell at LSSI.NET (Darrin Powell) Date: Thu Jan 12 21:30:40 2006 Subject: Sophos Antivirus Library Remote Heap Overflow ? Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Has anyone seen this? Is there an update from Sophos? I couldn't find anything on their site. Date August 26, 2005 Vulnerability The Sophos Antivirus Library provides file format support for virus analysis. During analysis of Visio files Sophos is vulnerable to a heap overflow allowing attackers complete control of the system(s) being protected. This vulnerability can be exploited remotely without user interaction or authentication through common protocols such as SMTP, SMB, HTTP, FTP, etc. Impact Successful exploitation of Sophos protected systems allows attackers unauthorized control of data and related privileges. It also provides leverage for further network compromise. Sophos Antivirus Library implementations are likely vulnerable in their default configuration. Affected Products Sophos Antivirus for Windows 2000/XP/2003 Sophos Antivirus for Windows NT Sophos Antivirus for Mac OS X Sophos Antivirus for MAC 8/9 Sophos Antivirus for UNIX/Linux Sophos Antivirus for Netware Sophos Antivirus for OS/2 Sophos Antivirus for OpenVMS Sophos Antivirus for DOS/Windows 3.1x Sophos Antivirus Small Business Edition for Windows Sophos Antivirus Small Business Edition for Mac PureMessage Small Business Edition PureMessage for Windows/Exchange PureMessage for UNIX MailMonitor for SMTP â^Ŕ^Ó Windows MailMonitor for Notes/Domino MailMonitor for Exchange The Sophos Antivirus Library is also OEM by over 25 other vendors with products that are affected by this vulnerability; see the following link for a list. There are also several vendors not listed that OEM the Sophos Antivirus Library. Refer to Sophos or your vendor for specifics. http://www.sophos.com/partners/oem/ Credit This vulnerability was discovered and researched by Alex Wheeler. Contact security@rem0te.com Details http://www.rem0te.com/public/images/sophos.pdf Thanks -- Darrin Powell LSSi Corp. Security Administrator Office (919) 466-6803 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Mon Aug 29 16:44:29 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:40 2006 Subject: Resending [Phishing net and international characters] Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Rabellino Sergio wrote: > Denis Beauchemin wrote: > >> On Sat, 27 Aug 2005 11:05:20 +0100, Julian Field >> wrote: >> >> >> >>> How is MailScanner going to know that %E9 is the same as é ? >>> >> >> >> I don't know but since these are no longer illegal there has to be a >> way to >> not treat them as such. >> >> Denis >> >> >> > I found this table (grabbed from w3c) that can be used to map the > binary code to HTML code. > > http://htmlcodetutorial.com/characterentities_famsupp_69.html > > The bad thing is that this table must be hardcoded into MS, I think. > > Bye. > > PS. I've checked the table and E9 (=233) map to acute; Julian, I have found this Perl module: URI::Escape which has functions to encode/decode %nn characters. At the end of the readme it also says: The module can also export the |%escapes| hash, which contains the mapping from all 256 bytes to the corresponding escape codes. Lookup in this hash is faster than evaluating |sprintf("%%%02X", ord($byte))| each time. Now, I'll try to find some other module that can convert the international character into é... Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From MailScanner at ecs.soton.ac.uk Mon Aug 29 17:08:44 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:40 2006 Subject: Resending [Phishing net and international characters] Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Denis Beauchemin wrote: > Rabellino Sergio wrote: > >> Denis Beauchemin wrote: >> >>> On Sat, 27 Aug 2005 11:05:20 +0100, Julian Field >>> wrote: >>> >>> >>> >>>> How is MailScanner going to know that %E9 is the same as é ? >>>> >>> >>> >>> >>> I don't know but since these are no longer illegal there has to be a >>> way to >>> not treat them as such. >>> >>> Denis >>> >>> >>> >> I found this table (grabbed from w3c) that can be used to map the >> binary code to HTML code. >> >> http://htmlcodetutorial.com/characterentities_famsupp_69.html >> >> The bad thing is that this table must be hardcoded into MS, I think. >> >> Bye. >> >> PS. I've checked the table and E9 (=233) map to acute; > > > Julian, > > I have found this Perl module: URI::Escape which has functions to > encode/decode %nn characters. At the end of the readme it also says: > The module can also export the |%escapes| hash, which contains the > mapping from all 256 bytes to the corresponding escape codes. Lookup > in this hash is faster than evaluating |sprintf("%%%02X", ord($byte))| > each time. > > Now, I'll try to find some other module that can convert the > international character into é... I have just hardcoded in the table that was in the htmlcodetutorial link above. Works nicely. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard.siddall at ELIRION.NET Mon Aug 29 17:30:37 2005 From: richard.siddall at ELIRION.NET (Richard Siddall) Date: Thu Jan 12 21:30:40 2006 Subject: Sophos Antivirus Library Remote Heap Overflow ? Message-ID: Darrin Powell wrote: > Has anyone seen this? Is there an update from Sophos? I couldn't find > anything on their site. > According to BugTraq last week: Dowling, Gabrielle wrote: > Sophos has had a fix for since August 5th... > http://www.sophos.com/support/knowledgebase/article/3409.html. The > vulnerability was also publicly discussed prior to that time. Regards, Richard. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Mon Aug 29 17:34:59 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:40 2006 Subject: MailScanner not functioning Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dave Filchak spake the following on 8/25/2005 4:52 PM: > Hi yes sorry, the OS a Red Hat 9 box. I did stop sendmail and then restart > MailScanner and it seems to be funbctioning now. However, I am curious how > this got this way as this box has been running uninterrupted for quite while > now. I just updated the MailScanner and SpamAssassin stuff today so maybe > something happened there? > > The other thing I noticed is that you mention that you should not set Use > SpamAssassin = yes in the MailScanner.conf. This is correct? > > Thanks for your reply by the way. > > Dave > Did you install from RPM? It could be that you got a pre-configured RPM from someone that has post-install scripts making these changes. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Aug 29 17:59:45 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:40 2006 Subject: Beat 4.45.3 -- Re: Resending [Phishing net and international characters] Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have just released a new beta release with this code added into it. Please test it and check that it works okay. Many thanks, Jules. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Mon Aug 29 17:48:57 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:40 2006 Subject: Resending [Phishing net and international characters] Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field spake the following on 8/27/2005 3:05 AM: > How is MailScanner going to know that %E9 is the same as é ? I don't think it is the literal é, but a capital "E" with an acute symbol above it. %E9 should map to code 201, but with all the character sets floating around the planet, I think this would be a tough nut to crack. > Denis Beauchemin wrote: > >> Hello Julian, >> >> Someone told me that our phishing net believes ALL accented characters >> are bad, as seen here: >> MailScanner >> soupçonne le lien "www._BAD_.com" d'être une tentative de >> fraude de la part de www.é.com
>> >> The source of the message was: >> www.é.com >> >> I know there are many vulnerabilities with IDN, but they will probably >> get mainstream soon. I found this article about Netscape 7 that dates >> back July 2003: >> http://devedge-temp.mozilla.org/viewsource/2003/idn/index_en.html >> >> So, is this a bug in MS or a desing decision? >> >> Thanks again! >> >> Denis >> PS: I sent this message 2 hours ago and I still haven't seen it back... >> > -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mgt at STELLARCORE.NET Mon Aug 29 18:12:20 2005 From: mgt at STELLARCORE.NET (Mike Tremaine) Date: Thu Jan 12 21:30:40 2006 Subject: Attachment forwarding Message-ID: Is there a way to use the "forward" directive like we do with spam for the Quarantine Dir = ?? I know this sounds moderately dangerous but I was just wondering what options the Quarantine Dir= has.... Thanks, Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkipness at PAVESTONE.COM Mon Aug 29 18:00:40 2005 From: mkipness at PAVESTONE.COM (Max Kipness) Date: Thu Jan 12 21:30:40 2006 Subject: Recommendation on Bayes Score Message-ID: I have my Bayes score set at the default 3.5. A good amount of spam is caught by my system using Bayes, SA rules, Razor, DCC, and Pyzor. However there is an increasing amount of spam getting is getting through. When I look at the headers of these particular emails, sometimes it might have a Razor score and/or DCC adding a bit to the score, and the Bayes is ALWAYS at 3.50. My score required for it to be considered spam is 6. Should I raise the Bayes score and just make sure the Bayes databases are well tuned? Are they any other checks that I could perform? Thanks, Max ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Mon Aug 29 18:20:33 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:30:40 2006 Subject: Recommendation on Bayes Score Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Max Kipness wrote: > I have my Bayes score set at the default 3.5. A good amount of spam is > caught by my system using Bayes, SA rules, Razor, DCC, and Pyzor. However > there is an increasing amount of spam getting is getting through. When I > look at the headers of these particular emails, sometimes it might have a > Razor score and/or DCC adding a bit to the score, and the Bayes is ALWAYS at > 3.50. My score required for it to be considered spam is 6. > > Should I raise the Bayes score and just make sure the Bayes databases are > well tuned? Before you do so, consider the following. BAYES_99 represents a spam probability, as estimated by bayes, between 99 and 100% for the message. This means that in a statistically perfect world, with perfect training, 0.5% of the messages matching BAYES_99 will be nonspam messages. Of course, the world isn't statistically perfect, nor will your training be perfect. You might have more or less nonspam matching BAYES_99, but the "statistical ideal" should give you a basis to make judgments from until you take some actual measurements. That said, if FNs are such a problem for you, why is your threshold set at 6 instead of the default 5? Raising the threshold suggests to me you're willing to accept more FNs to avoid FPs. In fact, according to STATISTICS-set3.txt from SA 3.0.4, your FN rate should be 42% higher than the default 5.0. Of course, your FP rate will also be 44% lower... # SUMMARY for threshold 5.0: # Correctly non-spam: 29443 99.97% # Correctly spam: 27220 97.53% # False positives: 9 0.03% # False negatives: 688 2.47% # SUMMARY for threshold 6.0: # Correctly non-spam: 29447 99.98% # Correctly spam: 26931 96.50% # False positives: 5 0.02% # False negatives: 977 3.50% If FPs are highly intolerable to you, I would be very cautious about bringing BAYES_99's score all the way into the spam-tag range. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jstork at PBCO.CA Mon Aug 29 20:03:36 2005 From: jstork at PBCO.CA (Johnny Stork) Date: Thu Jan 12 21:30:40 2006 Subject: Flagging SPAM Message-ID: We currently receive some mail from a remote host through fetchmail and this host also runs spamassassin. Hence some emails are already flagged as SPAM with a changed subject line. However, once the message has passed through mailscanner, it is NOT flagged as SPAM so I would like to ensure it is also flagged there as well. Is there a way to change the settings either in spamassassin or mailscanner so it will also flag a message as SPAM if it sees certain words in the subject line? ----------------------------------------------------------- Johnny Stork Information & Technology Manager Provincial Blood Coordinating Office #301 - 1190 Hornby St. Vancouver, BC (V6Z-2K5) 604-806-8840 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Mon Aug 29 21:06:31 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:40 2006 Subject: Beat 4.45.3 -- Re: Resending [Phishing net and international characters] Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > I have just released a new beta release with this code added into it. > > Please test it and check that it works okay. > > Many thanks, > Jules. > Julian, It seems to work just fine, but I couldn't test it as thoroughly as I would have liked so far. I seem to have noticed no new language.conf.rpmnew file. Problem is I didn't have a backup of that directory so I am not sure I had modified it on my previous install (I usually do). Is this beta stable enough to be rolled into production? Thanks again!!! Denis PS: I've noticed that the 'Web Bug from ' text is hardcoded into Message.pm; How about giving us the chance to translate it into our own language? In French, I would translate it to: 'Pixel invisible de '. -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From ssilva at SGVWATER.COM Mon Aug 29 23:52:53 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:40 2006 Subject: Beta release 4.45.2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field spake the following on 8/27/2005 9:33 AM: > I have just release beta release version 4.45.2. > > The major new feature for this beta release is the ability to control > whether you want to highlight any phishing attack links and/or modify > the subject line when a phishing attack is found. > The other useful thing is that when a message passes through more than > one MailScanner servers and a "web bug" is found, you no longer get the > "Web Bug from MailScannerWebBug" text in the message, so the message > looks a lot tidier in this situation. > > Download as usual from www.mailscanner.info. > > For your interest, MailScanner is now running at a steady rate of 30,000 > downloads per month. > > The total measured so far is about 580,000 downloads. So I have beaten > the 1/2 million downloads figure, yay! That implies me that my best > guess of the number of sites is probably at least 60,000 sites. That's > quie a few, and way more than any of the commercial systems. Barracuda > jump up and down about their 12,000 boxes: small fry :-) > Congrats on your half-million milestone! It wouldn't have happened if MailScanner wasn't such a great piece of software. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Tue Aug 30 00:00:48 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:40 2006 Subject: Problems with inbound mail queue Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Joost Waversveld spake the following on 8/29/2005 5:01 AM: >>If you stop the incoming sendmail listener process, does the number >>stay at 239? or does it gradually drop? If it stays the same then >>something is wrong. If it slowly drops then you just had a lot of >>messages being delivered to you at the same time, which is fine. > > > On our situation, the emails are being processed, but they are still > standing in the mqueue.in/ directory... I just checked the setting "Lock Type", > and it was not set to posix, so I just changed that. I have to check if that > works.... > > One strange thing, at the office we are also running Mailscanner. This machine > is Fedora Core 4, which has a newer sendmail deamon (In the 8.13-range). Here > also the "Lock Type" was set to the default (flock), but here we were not > having these problems..... > I think the problem only occurs when sendmail and MailScanner have a tussle over the same file. If the sendmail process is finished before the MailScanner process tries to access the file, there is no contention, and no locking problem. But sooner or later, there will be a contention problem, and the newer sendmail will choke itself. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Tue Aug 30 00:08:27 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:40 2006 Subject: Flagging SPAM Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Johnny Stork spake the following on 8/29/2005 12:03 PM: > We currently receive some mail from a remote host through fetchmail and > this host also runs spamassassin. Hence some emails are already flagged > as SPAM with a changed subject line. However, once the message has > passed through mailscanner, it is NOT flagged as SPAM so I would like to > ensure it is also flagged there as well. > > Is there a way to change the settings either in spamassassin or > mailscanner so it will also flag a message as SPAM if it sees certain > words in the subject line? You could write a simple rule for spamassassin to score messages like that high enough to flag them, or write a MCP rule to do the same. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Tue Aug 30 00:06:07 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:40 2006 Subject: Recommendation on Bayes Score Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Max Kipness spake the following on 8/29/2005 10:00 AM: > I have my Bayes score set at the default 3.5. A good amount of spam is > caught by my system using Bayes, SA rules, Razor, DCC, and Pyzor. However > there is an increasing amount of spam getting is getting through. When I > look at the headers of these particular emails, sometimes it might have a > Razor score and/or DCC adding a bit to the score, and the Bayes is ALWAYS at > 3.50. My score required for it to be considered spam is 6. > > Should I raise the Bayes score and just make sure the Bayes databases are > well tuned? > > Are they any other checks that I could perform? > > Thanks, > Max > Why not increase the scores for razor, DCC, and pyzor instead. I think you would have much less likelyhood of false positives. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 30 08:38:01 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:40 2006 Subject: Attachment forwarding Message-ID: -----BEGIN PGP SIGNED MESSAGE----- It will only take a directory. If you want to forward everything to another address, then use "Non Spam Actions". On 29 Aug 2005, at 18:12, Mike Tremaine wrote: > Is there a way to use the "forward" directive like we do with spam for > the Quarantine Dir = ?? > > I know this sounds moderately dangerous but I was just wondering what > options the Quarantine Dir= has.... - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQxQM6vw32o+k+q+hAQHEAAf/bkIJhbOylXMnBtTzM8j5lrQNFNJiMnbL G6b7zt+dLRUu+FdfdXX3WOd4R9cdPoHDZ6FaOEZ6bI7JIqGHF+QGHMFuaQE6U4aD WLyMq0ma487NiWNKai9k1aFoe69aN/wX4NgZtR6DT4EatxuUWvzsKaGi4XC5sx3G xK4YCnWjSta6gM+3atTuoFiHCedTAH7Tg28BT/qbw62t0jxXKNpmXnDXVDTf7Ftt P/NmeMh7F3dZ7fpQyxtypCJlfF05zp9KgHPzwrQF75if9deVqrEIhInRNnjn9ykE w5f+APDC/s+RMYJdHdLo+hdranMzXXo1RkA8XOZw3xz7Y0Ss5kIfnw== =k8Pg -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 30 08:40:59 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:40 2006 Subject: Beat 4.45.3 -- Re: Resending [Phishing net and international characters] Message-ID: -----BEGIN PGP SIGNED MESSAGE----- On 29 Aug 2005, at 21:06, Denis Beauchemin wrote: > Julian Field wrote: > > >> I have just released a new beta release with this code added into it. >> >> Please test it and check that it works okay. >> >> Many thanks, >> Jules. >> >> > Julian, > > It seems to work just fine, but I couldn't test it as thoroughly as > I would have liked so far. > > I seem to have noticed no new language.conf.rpmnew file. Problem > is I didn't have a backup of that directory so I am not sure I had > modified it on my previous install (I usually do). I haven't changed that file in a while, so I don't think it will create a new one if there is no change to it anyway. > Is this beta stable enough to be rolled into production? I'm going to base the stable release on it, I would wait a few days for the stable release if I were you. > PS: I've noticed that the 'Web Bug from ' text is hardcoded into > Message.pm; How about giving us the chance to translate it into our > own language? In French, I would translate it to: 'Pixel invisible > de '. The end-user is never supposed to see it anyway, so I didn't think there was any point translating it. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQxQNjvw32o+k+q+hAQElyQf/asRx2b5vCt+weOJzK8MexgPCYbYifUo9 oWujbGbx/Q0QtOk1zBHBwWVdn8KwYUAa/sE4qPJGNuF2casTjJ+2lyW9GBDA0mOd krFRuIwtvyaMrYKiDaqNDCTm4K/m+WXe3LKa6peUQTB5xE4pTMskj9vKIonfytp0 xw/Xlb7R6eL9t9ojP0unqpuGqNx5/3RRc/jgQiHXeNAWZ4w333c8KkNjh4jU0hEK 6hDmarP8kmeUrQJeWRozf9nyr/14lBdxXNdRd7MjXomQMlDNzRYOJpf/HimyoAZu clCwtY4qmEoR3lDPMUgHgGF3f8d0gPWRfOTE4uKbqlgy2ZcDW6u/lA== =A2qJ -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From joost at WAVERSVELD.NL Tue Aug 30 08:55:43 2005 From: joost at WAVERSVELD.NL (Joost Waversveld) Date: Thu Jan 12 21:30:40 2006 Subject: Problems with inbound mail queue Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > I think the problem only occurs when sendmail and MailScanner have a > tussle over the same file. If the sendmail process is finished before > the MailScanner process tries to access the file, there is no > contention, and no locking problem. > But sooner or later, there will be a contention problem, and the newer > sendmail will choke itself. Yesterday I changed the setting for the file locking to POSIX and it worked! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rabellino at DI.UNITO.IT Tue Aug 30 09:13:31 2005 From: rabellino at DI.UNITO.IT (Rabellino Sergio) Date: Thu Jan 12 21:30:40 2006 Subject: Resending [Phishing net and international characters] Message-ID: Scott Silva wrote: >Julian Field spake the following on 8/27/2005 3:05 AM: > > >>How is MailScanner going to know that %E9 is the same as é ? >> >> > >I don't think it is the literal é, but a capital "E" with an acute >symbol above it. %E9 should map to code 201, but with all the character >sets floating around the planet, I think this would be a tough nut to crack. > > I'm sorry, but if I don't miss anything, %E9=(E)14*16+(9)9 = 233 = é, 201 is 12*16+9, where 12=C => %C9 = É Bye. -- Dott. Mag. Sergio Rabellino Technical Staff Department of Computer Science University of Torino (Italy) http://www.di.unito.it/~rabser Tel. +39-0116706701 Fax. +39-011751603 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From norbert.schmidt at IS-TELEDATA.COM Tue Aug 30 09:44:58 2005 From: norbert.schmidt at IS-TELEDATA.COM (Norbert Schmidt) Date: Thu Jan 12 21:30:40 2006 Subject: Clustering MS Message-ID: Hi everybody, we are running two datacenters with each using it's own internetconnection. We would like to have one MailScanner Gateway in each location, so in case of a failure the other Gateway will still work. We will register both MailScanner Gateways with the same priority into the DNS, so they will equally receive mail. Now how can I cluster Mailwatch, the spamassassin bayesian db (stored within mysql) and how do I syncronise the configuration??? Is there any documentation on this? Thanks in advance Norbert Schmidt -------------------------------------- IS-Teledata AG Cologne Germany [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 5.6KB. ] [ Unable to print this part. ] From raymond at PROLOCATION.NET Tue Aug 30 10:13:30 2005 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:30:40 2006 Subject: Clustering MS Message-ID: Hi! > we are running two datacenters with each using it's own > internetconnection. We would like to have one MailScanner Gateway in each > location, so in case of a failure the other Gateway will still work. We > will register both MailScanner Gateways with the same priority into the > DNS, so they will equally receive mail. > Now how can I cluster Mailwatch, the spamassassin bayesian db (stored > within mysql) and how do I syncronise the configuration??? > Is there any documentation on this? Buy the professional version. Bye, Raymond. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From gmatt at NERC.AC.UK Tue Aug 30 10:15:07 2005 From: gmatt at NERC.AC.UK (Greg Matthews) Date: Thu Jan 12 21:30:40 2006 Subject: destination host is loopback Message-ID: On Fri, 2005-08-26 at 11:36 -0400, Stephen Swaney wrote: > > I'm getting a number of errors everyday in my logs of the sort: > > > > mail.eastrolog.com. config error: mail loops back to me (MX problem?) > > > > sure enough, if I do a DNS lookup for the above host, it resolves to > > 127.0.0.1. Is there anything I can do about this? I get about half a > > dozen different hosts like this per relay per day. > > > This is a very common sendmail problem. Checking Google for: > > config error: mail loops back to me (MX problem?) > > Yields: > > Results 1 - 10 of about 84,800 for config error: mail loops back to me (MX > problem?). (0.45 seconds) > > This found link is one of many that will give you the answer: > http://www.brandonhutchinson.com/mail_loops_back_to_me.html except that I dont want to accept mail addressed to eastrolog.com mailboxes (its a spam domain). The problem is that mail.eastrolog.com resolves to 127.0.0.1 in the DNS. I dont want to have to put every host that resolves to the loopback address in my mailertable - there are others. > > Just a hopefully polite hint that it's sometimes quicker and easier to > Google for the error message than to post to the list :) thanks for the hint steve! GREG > > Have a good weekend, > > Steve > > Stephen Swaney > Fort Systems Ltd. > stephen.swaney@fsl.com > www.fsl.com > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- Greg Matthews 01491 692445 Head of UNIX/Linux, iTSS Wallingford ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Tue Aug 30 10:31:53 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:40 2006 Subject: Clustering MS Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 30/08/05, Raymond Dijkxhoorn wrote: > Hi! > > > we are running two datacenters with each using it's own > > internetconnection. We would like to have one MailScanner Gateway in each > > location, so in case of a failure the other Gateway will still work. We > > will register both MailScanner Gateways with the same priority into the > > DNS, so they will equally receive mail. > > Now how can I cluster Mailwatch, the spamassassin bayesian db (stored > > within mysql) and how do I syncronise the configuration??? > > Is there any documentation on this? > > Buy the professional version. > > Bye, > Raymond. > "Cluster" is a relative term:-). There's some info in the wiki.... Like http://wiki.mailscanner.info/doku.php?id=documentation:anti_spam:spamassassin:bayes:sql .... And something in the MailWatch package about that (mainly having a nonlocal DB, correct settings for xml-rpc to work etc etc:-). Simplistically you could keep the plaintext config files in sync with any tool ... like rsync... -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From venkatesh_s at FASTMAIL.FM Tue Aug 30 10:40:48 2005 From: venkatesh_s at FASTMAIL.FM (Venkatesh.S) Date: Thu Jan 12 21:30:40 2006 Subject: Fragmented messages Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] hi glenn steen thank u very much for your advice.. regards venkatesh -- Venkatesh.S venkatesh_s@fastmail.fm -- http://www.fastmail.fm - mmm... Fastmail... ----- Original message ----- From: "Glenn Steen" To: MAILSCANNER@JISCMAIL.AC.UK Date: Mon, 29 Aug 2005 16:20:25 +0200 Subject: Re: Fragmented messages On 29/08/05, Venkatesh.S wrote: > hello all, > > can i know why these happen, which i got the report below, coz there r mails > which r important to me, can anyone explain me this , its very important to > know. > " Report: MailScanner: Fragmented messages cannot be scanned and are > removed." > > regards > venkatesh > > > -- > Venkatesh.S > venkatesh_s@fastmail.fm > > -- > http://www.fastmail.fm - The professional email service I do believe it is this.... from MailScanner.conf: # Do you want to allow partial messages, which only contain a fraction of # the attachments, not the whole thing? There is absolutely no way to # scan these "partial messages" properly for viruses, as MailScanner never # sees all of the attachment at the same time. Enabling this option can # allow viruses through. You have been warned. # This can also be the filename of a ruleset so you can, for example, allow # them in outgoing mail but not in incoming mail. Allow Partial Messages = no .... So if you need them to go through, make a ruleset allowing partial messages for the recipients and/or senders that "need" this. Or just plain say "yes", but as stated.... you expose yourself to risk then. -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From t.d.lee at DURHAM.AC.UK Tue Aug 30 10:47:12 2005 From: t.d.lee at DURHAM.AC.UK (David Lee) Date: Thu Jan 12 21:30:40 2006 Subject: Beat 4.45.3 -- Re: Resending [Phishing net and international characters] Message-ID: On Mon, 29 Aug 2005, Denis Beauchemin wrote: > [...] > PS: I've noticed that the 'Web Bug from ' text is hardcoded into Message.pm; > How about giving us the chance to translate it into our own language? In > French, I would translate it to: 'Pixel invisible de '. The principle (allowing translation) of this text seems decent enough. But is Denis's actual translation of this text the most appropriate? Julian's phrase is about "bugs in the web", whereas Denis's is about the "invisibility of pixels". Those operate at different conceptual levels (whether these instances map onto each other is a secondary issue). Shouldn't we keep the translations at the same level? (Principle.) Assuming that the translations should convey information at the same level, in as close a manner is as reasonable achievable, then what do we do about this particular case? Let's look at them (staying in English for the moment): 1. "Web Bug from": Personally, I have always found that text somewhat strange; not immediately obvious to the recipient of the email. It raises the question: "_What_ is a 'web bug'?" 2. But Denis's (English-equivalent) "Invisible Pixel from" also feels inadequate. It raises the question for the recipient: "_Why_ is an 'invisible pixel' a problem?" And in the future, "web bugs" other than "invisible pixels" may emerge and need reporting. Staying in English, i.e. within one langauge, so that we can get the semantics sorted out. Should this text be something like: "Web Bug (invisible pixel) from". Then, after that question is resolved, we can begin to think about actual translation into other languages (subject to what I believe linguists describe as "to translate is to betray", itself an English (from Latin) translation (and betrayal!) of much finer-sounding transliteration "to translate is to traduce"). -- : David Lee I.T. Service : : Senior Systems Programmer Computer Centre : : Durham University : : http://www.dur.ac.uk/t.d.lee/ South Road : : Durham DH1 3LE : : Phone: +44 191 334 2752 U.K. : ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From raymond at PROLOCATION.NET Tue Aug 30 10:58:07 2005 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:30:40 2006 Subject: Clustering MS Message-ID: Hi! >> Buy the professional version. > "Cluster" is a relative term:-). There's some info in the wiki.... Like > http://wiki.mailscanner.info/doku.php?id=documentation:anti_spam:spamassassin:bayes:sql > > .... And something in the MailWatch package about that (mainly having > a nonlocal DB, correct settings for xml-rpc to work etc etc:-). > > Simplistically you could keep the plaintext config files in sync with > any tool ... like rsync... Sure, but there is a product doing that, the things you mentioned. If you have the cashflow to make 2 datacenters you most likely can send some towards Julian by supporting the product. You can also do some rsync trics but most likely you have to figure that out ytourself. Bye, Raymond. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Tue Aug 30 11:54:41 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:40 2006 Subject: Clustering MS Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 30/08/05, Raymond Dijkxhoorn wrote: > Hi! > > >> Buy the professional version. > > > "Cluster" is a relative term:-). There's some info in the wiki.... Like > > http://wiki.mailscanner.info/doku.php?id=documentation:anti_spam:spamassassin:bayes:sql > > > > .... And something in the MailWatch package about that (mainly having > > a nonlocal DB, correct settings for xml-rpc to work etc etc:-). > > > > Simplistically you could keep the plaintext config files in sync with > > any tool ... like rsync... > > Sure, but there is a product doing that, the things you mentioned. If you > have the cashflow to make 2 datacenters you most likely can send some > towards Julian by supporting the product. You can also do some rsync trics > but most likely you have to figure that out ytourself. > > Bye, > Raymond. Oh yes, no argument there. Just wanted to "point in the general direction of what's there" (and knowing that "a big budget for what the PHB perceives as critical doesn't mean s/he'll be less tightfisted when it cones to the crucial, but free, piece of software s/he's _really_ relying on", this could actually be necessary:-). But sure, if Norbert can shake some coin loose (and in Jules direction, to boot), that'd be best:). -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From james at grayonline.id.au Tue Aug 30 13:11:23 2005 From: james at grayonline.id.au (James Gray) Date: Thu Jan 12 21:30:40 2006 Subject: Clustering MS Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Tuesday 30 August 2005 19:58, Raymond Dijkxhoorn wrote: > Hi! > > >> Buy the professional version. > > > > "Cluster" is a relative term:-). There's some info in the wiki.... Like > > http://wiki.mailscanner.info/doku.php?id=documentation:anti_spam:spamassa > >ssin:bayes:sql > > > > .... And something in the MailWatch package about that (mainly having > > a nonlocal DB, correct settings for xml-rpc to work etc etc:-). > > > > Simplistically you could keep the plaintext config files in sync with > > any tool ... like rsync... > > Sure, but there is a product doing that, the things you mentioned. If you > have the cashflow to make 2 datacenters you most likely can send some > towards Julian by supporting the product. You can also do some rsync trics > but most likely you have to figure that out ytourself. It's weird - we have two data centres (Boston MA, USA and Sydney AUST), two MailScanner gateways and I was only pondering today that I really should pull my finger out and write a combined script that "rsync's" all the configs then restarts stuff that's changed so I only have to modify the files on one machine..... Anyone interested to see my scripting 5ki15 when it's all done? We run independent bayes databases on each server - they get enough of the same sort of mail to be "close enough". If we ever wanted shared a database I'd put in some sort of funky mysql replication...or something along those lines anyway (never looked into it in much detail). Cheers James -- Until Eve arrived, this was a man's world. -- Richard Armour ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Tue Aug 30 13:11:34 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:40 2006 Subject: Beat 4.45.3 -- Re: Resending [Phishing net and international characters] Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 30/08/05, David Lee wrote: > On Mon, 29 Aug 2005, Denis Beauchemin wrote: > > > [...] > > PS: I've noticed that the 'Web Bug from ' text is hardcoded into Message.pm; > > How about giving us the chance to translate it into our own language? In > > French, I would translate it to: 'Pixel invisible de '. > > The principle (allowing translation) of this text seems decent enough. > > But is Denis's actual translation of this text the most appropriate? > Julian's phrase is about "bugs in the web", whereas Denis's is about the > "invisibility of pixels". Those operate at different conceptual levels > (whether these instances map onto each other is a secondary issue). (snip) > Let's look at them (staying in English for the moment): What makes you think that exact terminology/semantics survive the translation boundary? I'm sure it doesn't. For all I know (which I don't, BTW), Denis might be using the "consensus term" for "web bug" (note: no mention of the evil "translation" word;). Example: English: "Computer" is "someone/something performing calculations". French: "Ordinateur" (pardon my french, it's rarely used, so I probably misspelled it) is "someone/something ordering/organizing (something)" Swedish: "Dator" is "someone/something keeping (a record of) data" But they all denote the beloved machines we dabble with daily. So ... should we suddenly decide that one of these terms are wrong? Of course not.... Names just don't translate well that way;-). > > 1. "Web Bug from": Personally, I have always found that text somewhat > strange; not immediately obvious to the recipient of the email. It raises > the question: "_What_ is a 'web bug'?" > > 2. But Denis's (English-equivalent) "Invisible Pixel from" also feels > inadequate. It raises the question for the recipient: "_Why_ is an > 'invisible pixel' a problem?" Both are acronymical descriptions of a phenomenon. The only way to settle this "correctly" would be to reference a FAQ (http://www.eff.org/Privacy/Marketing/web_bug.html), which would be both ugly and not necessarily more easily understood by the users. Note the "Clear GIF" euphemism mentioned in the FAQ. Sweet isn't it:-). Looking at the FAQ, one could make a rather strong case for "Invisible pixel" too. Oh well, read on for another angle... > And in the future, "web bugs" other than "invisible pixels" may emerge > and need reporting. If we really care, we shouldn't be bandying too much tech-lingo about, but rather warn about the risk that has been handled ("Evil tracker (Web Bug/Clear GIF/Invisible pixel) found and destroyed":). Still a bit techy, but more to the point;-). > Staying in English, i.e. within one langauge, so that we can get the > semantics sorted out. Should this text be something like: > "Web Bug (invisible pixel) from". No. See above. > Then, after that question is resolved, we can begin to think about actual > translation into other languages (subject to what I believe linguists > describe as "to translate is to betray", itself an English (from Latin) > translation (and betrayal!) of much finer-sounding transliteration "to > translate is to traduce"). Mapping one language to another is never a 1-to-1/onto relationship, and the "thoughtscape" each language allows differ. So translation is indeed "to betray the true meaning", since the "true meaning" might not even be possible to express in the target language;). > > -- > > : David Lee I.T. Service : > : Senior Systems Programmer Computer Centre : > : Durham University : > : http://www.dur.ac.uk/t.d.lee/ South Road : > : Durham DH1 3LE : > : Phone: +44 191 334 2752 U.K. : Cheers -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Tue Aug 30 13:38:58 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:40 2006 Subject: Clustering MS Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 30/08/05, James Gray wrote: > On Tuesday 30 August 2005 19:58, Raymond Dijkxhoorn wrote: (snip) > > > Simplistically you could keep the plaintext config files in sync with > > > any tool ... like rsync... > > > > Sure, but there is a product doing that, the things you mentioned. If you > > have the cashflow to make 2 datacenters you most likely can send some > > towards Julian by supporting the product. You can also do some rsync trics > > but most likely you have to figure that out ytourself. > > It's weird - we have two data centres (Boston MA, USA and Sydney AUST), two > MailScanner gateways and I was only pondering today that I really should pull > my finger out and write a combined script that "rsync's" all the configs then > restarts stuff that's changed so I only have to modify the files on one > machine..... > > Anyone interested to see my scripting 5ki15 when it's all done? Should fit well in the wiki, no? > > We run independent bayes databases on each server - they get enough of the > same sort of mail to be "close enough". If we ever wanted shared a database > I'd put in some sort of funky mysql replication...or something along those > lines anyway (never looked into it in much detail). > > Cheers > > James > -- > Until Eve arrived, this was a man's world. > -- Richard Armour Are you sure Eve sisn't take the position "You had it on loan for a few minutes, 's all! You no-good oaf!" on this one?-) -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From liste at ALIXEN.FR Tue Aug 30 13:40:39 2005 From: liste at ALIXEN.FR (Benoit Guguin) Date: Thu Jan 12 21:30:40 2006 Subject: filtering attachments by extensions and by users Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I'm using postfix 2.1 on a sarge and I have installed mailscanner I'd like to filter mail by extension and by user but i don't find how to do this ... Clearly a user "tata" can send an attachments .xls, .doc, .exe, .ppt and a user "toto" can only send .doc for example. So to filter mail by extension with mailscanner it's not a big probleme, but I don't find any way to associate a list of extension with a list of users ... The extensions filters rules don't seem to support this ? Perhaps I have miss a parametters (I hope) Any idea please ? Regards, -- Guguin Benoit Société Alixen 2 rue Jean Rostand 91 893 Orsay Cedex France Tel : 01 69 85 24 13, Fax : 01 69 85 24 10 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Tue Aug 30 13:54:31 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:40 2006 Subject: filtering attachments by extensions and by users Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Benoit Guguin wrote: > I'm using postfix 2.1 on a sarge and I have installed mailscanner > > I'd like to filter mail by extension and by user but i don't find how > to do this ... > Clearly a user "tata" can send an attachments .xls, .doc, .exe, .ppt > and a user "toto" can only send .doc for example. > > So to filter mail by extension with mailscanner it's not a big probleme, > but I don't find any way to associate a list of extension with a list of > users ... The extensions filters rules don't seem to support this ? > > Perhaps I have miss a parametters (I hope) > > Any idea please ? > > Regards, > Benoit try looking at this... http://wiki.mailscanner.info/doku.php?id=documentation:configuration:rulesets:overloading -- -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From liste at ALIXEN.FR Tue Aug 30 14:20:36 2005 From: liste at ALIXEN.FR (Benoit Guguin) Date: Thu Jan 12 21:30:40 2006 Subject: filtering attachments by extensions and by users Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] oki thank you :) Regards, -- Guguin Benoit Société Alixen 2 rue Jean Rostand 91 893 Orsay Cedex France Tel : 01 69 85 24 13, Fax : 01 69 85 24 10 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Tue Aug 30 14:29:17 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:40 2006 Subject: Beat 4.45.3 -- Re: Resending [Phishing net and international characters] Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: >>PS: I've noticed that the 'Web Bug from ' text is hardcoded into >>Message.pm; How about giving us the chance to translate it into our >>own language? In French, I would translate it to: 'Pixel invisible >>de '. >> >> > >The end-user is never supposed to see it anyway, so I didn't think >there was any point translating it. > Julian, I'm pretty sure I have seen this text in email messages I received but I don't have any example to offer you right now. Now for David, As for my French translation, it comes from an official government agency here in Québec: http://www.granddictionnaire.com/ This site helps translate technical terms from English to French (or vice versa). Quite helpful. Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dpowell at LSSI.NET Tue Aug 30 14:39:41 2005 From: dpowell at LSSI.NET (Darrin Powell) Date: Thu Jan 12 21:30:40 2006 Subject: Sophos Antivirus Library Remote Heap Overflow ? Message-ID: Thanks, Richard I need to pay closer attention to the list :) Darrin On Mon, 2005-08-29 at 12:30 -0400, Richard Siddall wrote: > Darrin Powell wrote: > > > Has anyone seen this? Is there an update from Sophos? I couldn't find > > anything on their site. > > > > According to BugTraq last week: > > Dowling, Gabrielle wrote: > > Sophos has had a fix for since August 5th... > > http://www.sophos.com/support/knowledgebase/article/3409.html. The > > vulnerability was also publicly discussed prior to that time. > > Regards, > > Richard. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- Darrin Powell LSSi Corp. Security Administrator Office (919) 466-6803 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Tue Aug 30 14:25:24 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:40 2006 Subject: OT: Noms d'utilisateurs (Was "filtering attachments by extensions and by users") Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Martin Hepworth wrote: > Benoit Guguin wrote: > >> I'm using postfix 2.1 on a sarge and I have installed mailscanner >> >> I'd like to filter mail by extension and by user but i don't find how >> to do this ... >> Clearly a user "tata" can send an attachments .xls, .doc, .exe, .ppt >> and a user "toto" can only send .doc for example. Salut Benoit, J'aime bien tes usernames :). Tu sembles nouveau dans la famille MailScanner. As-tu jete un oeil au wiki? http://wiki.mailscanner.info/doku.php?id=&idx=documentation et http://wiki.mailscanner.info/doku.php?id=maq:index Ugo ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard.siddall at ELIRION.NET Tue Aug 30 14:53:36 2005 From: richard.siddall at ELIRION.NET (Richard Siddall) Date: Thu Jan 12 21:30:40 2006 Subject: Sophos Antivirus Library Remote Heap Overflow ? Message-ID: Darrin Powell wrote: > Thanks, Richard > > I need to pay closer attention to the list :) > > > Darrin > Darrin, There was an update on the BugTraq list (mailto:bugtraq-subscribe@securityfocus.com) yesterday in response to the message I quoted: > You are partially correct. Prior to this advisory, Sophos & rem0te > agreed to w/hold details until all fixes were available (August > 26th). The Sophos link you provided below does not disclose any > details of the vulnerability - only the patch - which leaves a lot of > people guessing about the actual vulnerability details. > > It's also important to note there are many large 3rd party vendors > that sublicense this library who should apply patches to their > customer installations. It will be interesting to see how many of > these 3rd parties issue advisories to their users. So it sounds like you need a more recent update than the August 5th one. Regards, Richard Siddall ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Tue Aug 30 14:22:02 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:40 2006 Subject: Clustering MS Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Norbert Schmidt wrote: > > Hi everybody, > > we are running two datacenters with each using it's own > internetconnection. We would like to have one MailScanner Gateway in > each location, so in case of a failure the other Gateway will still > work. We will register both MailScanner Gateways with the same priority > into the DNS, so they will equally receive mail. > Now how can I cluster Mailwatch, the spamassassin bayesian db (stored > within mysql) and how do I syncronise the configuration??? > Is there any documentation on this? You should ask Steve Swaney at FSL on that. They'll do that for you and it is not too expensive (read: very reasonable). steve@fsl.com www.fsl.com > > Thanks in advance > > Norbert Schmidt > > -------------------------------------- > IS-Teledata AG > Cologne > Germany ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From max at KIPNESS.COM Tue Aug 30 15:06:44 2005 From: max at KIPNESS.COM (Max Kipness) Date: Thu Jan 12 21:30:40 2006 Subject: Bayes Score Recommendation Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have my Bayes score set at the default 3.5. A good amount of spam is caught by my system using Bayes, SA rules, Razor, DCC, and Pyzor. However there is an increasing amount of spam getting is getting through. When I look at the headers of these particular emails, sometimes it might have a Razor score and/or DCC adding a bit to the score, and the Bayes is ALWAYS at 3.50. My score required for it to be considered spam is 6. Should I raise the Bayes score and just make sure the Bayes databases are well tuned? Are they any other checks that I could perform? Thanks, Max ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kte at NEXIS.BE Tue Aug 30 14:40:50 2005 From: kte at NEXIS.BE (Koen Teugels) Date: Thu Jan 12 21:30:40 2006 Subject: forward 1 maildomain to 2 mailserver Message-ID: Is their an easy way to forwards 1 maildomain to 2 mailservers. So every mail exists 2 times. Thanks Koen ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Tue Aug 30 16:17:30 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:30:40 2006 Subject: Bayes Score Recommendation Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] This is a verbatim a repost of yesterday's thread: "Recommendation on Bayes Score" If the answers to that thread were not acceptable, I'd suggest following up in that thread, rather than reposting. Max Kipness wrote: > I have my Bayes score set at the default 3.5. A good amount of spam is > caught by my system using Bayes, SA rules, Razor, DCC, and Pyzor. However > there is an increasing amount of spam getting is getting through. When I > look at the headers of these particular emails, sometimes it might have a > Razor score and/or DCC adding a bit to the score, and the Bayes is ALWAYS > at 3.50. My score required for it to be considered spam is 6. > > Should I raise the Bayes score and just make sure the Bayes databases are > well tuned? > > Are they any other checks that I could perform? > > Thanks, > Max > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From max at kipness.com Tue Aug 30 16:49:08 2005 From: max at kipness.com (Max Kipness) Date: Thu Jan 12 21:30:40 2006 Subject: Bayes Score Recommendation Message-ID: My apologies, I did not see my own post come back to me and thought I had accidentally used the wrong SMTP account to send the post. Max > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Matt Kettler > Sent: Tuesday, August 30, 2005 10:18 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Bayes Score Recommendation > > This is a verbatim a repost of yesterday's thread: > > "Recommendation on Bayes Score" > > If the answers to that thread were not acceptable, I'd suggest following > up in > that thread, rather than reposting. > > Max Kipness wrote: > > I have my Bayes score set at the default 3.5. A good amount of spam is > > caught by my system using Bayes, SA rules, Razor, DCC, and Pyzor. > However > > there is an increasing amount of spam getting is getting through. When I > > look at the headers of these particular emails, sometimes it might have > a > > Razor score and/or DCC adding a bit to the score, and the Bayes is > ALWAYS > > at 3.50. My score required for it to be considered spam is 6. > > > > Should I raise the Bayes score and just make sure the Bayes databases > are > > well tuned? > > > > Are they any other checks that I could perform? > > > > Thanks, > > Max > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Tue Aug 30 16:36:14 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:40 2006 Subject: Bayes Score Recommendation Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Max Kipness spake the following on 8/30/2005 7:06 AM: > I have my Bayes score set at the default 3.5. A good amount of spam is > caught by my system using Bayes, SA rules, Razor, DCC, and Pyzor. However > there is an increasing amount of spam getting is getting through. When I > look at the headers of these particular emails, sometimes it might have a > Razor score and/or DCC adding a bit to the score, and the Bayes is ALWAYS > at 3.50. My score required for it to be considered spam is 6. > > Should I raise the Bayes score and just make sure the Bayes databases are > well tuned? > > Are they any other checks that I could perform? > > Thanks, > Max > There were some answers when you asked this yesterday. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Tue Aug 30 18:42:26 2005 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:30:40 2006 Subject: Rearding Web-Bug Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Sorry, just saw the Thread :( Julian: I do receive a lot Mails where i can see the Web Bug :) See here: --- snip here --- Web Bug from http://www.deltaradio.de/delta/images/spacer.gif [spacer.gif] Web Bug from http://www.deltaradio.de/delta/images/spacer.gif [spacer.gif] Web Bug from http://www.deltaradio.de/delta/images/spacer.gif Web Bug from http://www.deltaradio.de/delta/images/spacer.gif Web Bug from http://www.deltaradio.de/delta/images/spacer.gif Web Bug from http://www.deltaradio.de/delta/images/spacer.gif [spacer.gif] Web Bug from http://www.deltaradio.de/delta/images/spacer.gif Web Bug from http://www.deltaradio.de/delta/images/spacer.gif Web Bug from http://www.deltaradio.de/delta/images/spacer.gif Web Bug from http://www.deltaradio.de/delta/images/spacer.gif [spacer.gif] delta radio Newsletter Web Bug from http://www.deltaradio.de/delta/images/spacer.gif [popup_logo_3.gif] Web Bug from http://www.deltaradio.de/delta/images/spacer.gif [spacer.gif] [spacer.gif] Hi ! Web Bug from http://www.deltaradio.de/delta/images/spacer.gif [spacer.gif] Web Bug from http://www.deltaradio.de/delta/images/spacer.gif Web Bug from http://www.deltaradio.de/delta/images/spacer.gif Web Bug from http://www.deltaradio.de/delta/images/spacer.gif [10_353x130.gif] [spacer.gif] Gewinn Tickets im Gesamtwert von über 3000 Euro: WIR SCHICKEN DICH ZUM ROSKILDE FESTIVAL! [spacer.gif] Das Roskilde Festival in Dänemark ist absoluter Kult! Immer geile Bands, immer super Stimmung. Und das Beste: Du kannst mit delta radio vom 30. Juni bis zum 3. Juli dabei sein. Wie du an die begehrtesten Tickets des Sommers kommst? Hier gibt's alle Infos >> Web Bug from http://www.deltaradio.de/delta/images/spacer.gif Web Bug from http://www.deltaradio.de/delta/images/spacer.gif Web Bug from http://www.deltaradio.de/delta/images/spacer.gif Web Bug from http://www.deltaradio.de/delta/images/spacer.gif Web Bug from http://www.deltaradio.de/delta/images/spacer.gif [667_353x130.gif] [spacer.gif] Remember Rock am Ring 2005: SIMPLE PLAN-SOUVENIR IN DER SECRET ZONE --- snip here --- if someone should not see this..hmm.. ;) Greetings Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at DFK-SYSTEMS.COM Tue Aug 30 19:21:26 2005 From: mailscanner at DFK-SYSTEMS.COM (Mark Waterhouse - Mailing Lists) Date: Thu Jan 12 21:30:40 2006 Subject: Mailing List Request Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi Would it be possible for the mailing list to be altered slightly to include the words [Mailscanner] in the subject line. I receive a large number of messages in one mailbox and it gets increasingly difficult to read the mailscanner emails in amongst all others. Thanks Mark Waterhouse DFK Systems Limited http://www.dfk-systems.com/ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Aug 30 19:28:20 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:40 2006 Subject: Mailing List Request Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] See www.jiscmail.ac.uk/lists/mailscanner.html and you will see that you can set this up for yourself. Mark Waterhouse - Mailing Lists wrote: > Hi > > Would it be possible for the mailing list to be altered slightly to > include the words [Mailscanner] in the subject line. > I receive a large number of messages in one mailbox and it gets > increasingly difficult to read the mailscanner emails in amongst all > others. > > > Thanks > Mark Waterhouse > DFK Systems Limited > http://www.dfk-systems.com/ > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smhickel at CHARTERMI.NET Tue Aug 30 23:39:14 2005 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:30:40 2006 Subject: New messages after upgrade ?? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] All, I did an update to the latest mailscanner and started seeing the below in my maillog. Thoughts? Aug 30 19:17:52 fetch MailScanner[22825]: Looked up unknown string mcpspamassassin in language translation file /etc/MailScanner/reports/en/languages.conf Aug 30 19:17:53 fetch MailScanner[22825]: Message j7UMfSFl022834 from 127.0.0.1 (root@localhost.localdomain) to localhost.localdomain is mcp, mcpspamassassin (mcpsatimedout) r, Steve ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Wed Aug 31 00:09:04 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:40 2006 Subject: New messages after upgrade ?? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Steve Hickel spake the following on 8/30/2005 3:39 PM: > All, > > I did an update to the latest mailscanner and started seeing the below in my maillog. Thoughts? > > Aug 30 19:17:52 fetch MailScanner[22825]: Looked up unknown string mcpspamassassin in language translation file /etc/MailScanner/reports/en/languages.conf > Aug 30 19:17:53 fetch MailScanner[22825]: Message j7UMfSFl022834 from 127.0.0.1 (root@localhost.localdomain) to localhost.localdomain is mcp, mcpspamassassin (mcpsatimedout) > > > r, > > Steve > Look for a /etc/MailScanner/reports/en/languages.conf.rpmnew file? -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From taz at TAZ-MANIA.COM Wed Aug 31 01:28:31 2005 From: taz at TAZ-MANIA.COM (Dennis Willson) Date: Thu Jan 12 21:30:40 2006 Subject: Error on MailWatch website Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I was trying to read about MailWatch and keep getting the following message... Writing /home/groups/m/ma/mailwatch/htdocs/data/cache/6/6551a83adb8942674a26dad38ffad79c.xhtml failed Also the documentation pages don't seem to be there. Is there anyone on this list that has anything to do with MailWatch? There's no contact email address to send the report to, I have subscribed to their mail list but I haven't received the confirmation yet. Thanks Dennis ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From norbert.schmidt at IS-TELEDATA.COM Wed Aug 31 13:15:19 2005 From: norbert.schmidt at IS-TELEDATA.COM (Norbert Schmidt) Date: Thu Jan 12 21:30:40 2006 Subject: Do I need to put the update_virus_scanners to cron?? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, the mailscanner book says, the update of the virus scanner signatures is done hourly by the update_virus_scanners script. But not at my debian installation. I can start the update_virus_scanners script manually and the update works and gets logged to syslog. But when I do: tail -f /var/log/mail.log |grep update.virus No more logging happens thus no more updateing seems to happen. Do I have to start the script from cron.hourly?? Thanks Norbert -------------------------------------- IS-Teledata AG Stollwerckstr. 7 D-51149 Köln mailto:Norbert.Schmidt@is-teledata.com http://www.is-teledata.com/ Tel.: +49 2203 9009-190 Fax : +49 2203 9009-105 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 5.6KB. ] [ Unable to print this part. ] From MailScanner at ecs.soton.ac.uk Wed Aug 31 13:54:08 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:40 2006 Subject: Do I need to put the update_virus_scanners to cron?? Message-ID: -----BEGIN PGP SIGNED MESSAGE----- On 31 Aug 2005, at 13:15, Norbert Schmidt wrote: > Hi, > > the mailscanner book says, the update of the virus scanner > signatures is > done hourly by the update_virus_scanners script. > But not at my debian installation. I can start the > update_virus_scanners > script manually and the update works and gets logged to syslog. > But when I do: > tail -f /var/log/mail.log |grep update.virus > > No more logging happens thus no more updateing seems to happen. > > Do I have to start the script from cron.hourly?? You need an hourly cron job to call update_virus_scanners. How you implement that is up to you, I'm surprised that the deb package doesn't include one, disappointing. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQxWocvw32o+k+q+hAQHzzwgApqjn6MQiNA1koQTx7/HBmH6WMyaqTPco Qpc090AIhmLrcw5FJtWPntqk+tDOXqREvB2jd8he+/WBKbhUnPspodH14WEdmWWy c+QJpRZBk4d96MeqhFLfd+nqnbafYtLwEiI4efdfJQHJpK8OEJdFyPvG49Gq7yFu yYeVVNzfrQEg/MP62xNzBH9/MokeeJ1/SerzOw5scYXEmApVE1MnQRf2YasJosSz 7JTlmcydmuOmJvgu2E+EqwBO8YwZOH4pxd5/E+JAMBeuf7Nz63AH1C94yZsurTb+ uD1Izl4K3ElwKZXlhet46KaqsHjl0wtzkdn8wTuytlSRaSiGMGrxDg== =DUWO -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From norbert.schmidt at IS-TELEDATA.COM Wed Aug 31 14:09:38 2005 From: norbert.schmidt at IS-TELEDATA.COM (Norbert Schmidt) Date: Thu Jan 12 21:30:40 2006 Subject: Do I need to put the update_virus_scanners to cron?? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] MailScanner mailing list wrote on 31.08.2005 14:54:08: > -----BEGIN PGP SIGNED MESSAGE----- > > On 31 Aug 2005, at 13:15, Norbert Schmidt wrote: > > Hi, > > > > the mailscanner book says, the update of the virus scanner > > signatures is > > done hourly by the update_virus_scanners script. > > But not at my debian installation. I can start the > > update_virus_scanners > > script manually and the update works and gets logged to syslog. > > But when I do: > > tail -f /var/log/mail.log |grep update.virus > > > > No more logging happens thus no more updateing seems to happen. > > > > Do I have to start the script from cron.hourly?? > > You need an hourly cron job to call update_virus_scanners. How you > implement that is up to you, I'm surprised that the deb package > doesn't include one, disappointing. > > - -- > Julian Field I've crosschecked with a rpm based system and found that there are no cron.hourly scripts there. So "cron.hourly/check_mailscanner" also seems to be missing within the debian package. Norbert -------------------------------------- IS-Teledata AG Stollwerckstr. 7 D-51149 Köln [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 5.6KB. ] [ Unable to print this part. ] From KLekas at FOXRIVER.COM Wed Aug 31 16:13:07 2005 From: KLekas at FOXRIVER.COM (Kosta Lekas) Date: Thu Jan 12 21:30:40 2006 Subject: ripping atachments on MS gateway?? Message-ID: I am using Postfix and MS 4.42.9 and my MS system is a gateway, I have a transport configured in postfix to forward all my mail to my Exchange Box, I also have configured a relay_recipient_maps in postfix and pull a recipient list from exchange using getadsmtp.pl with Net::LDAP module so there are no local users on my MS box. This is what I am looking to do: I want to use ripmime program to strip attachment from email that one of my users gets daily. I want to intercept this email on MS gateway, rip the attachment (word doc) and then scp it to an internal host where it will be parsed. We are doing this now thru an outlook rule and an attachment removing application that is on the local users PC, the problem is that the user can never turn his PC off for this to work because the windows ripping app is local. I was thinking of using a global procmail rule on MS gateway to catch the email coming in and writing a script to rip and scp the attachment to the internal host. The problem is that I don’t know how to get procmail to work with my setup and I am not sure if this is the best way to handle this. Any suggestions would be appreciated. Kosta ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From carinus.carelse at MRC.AC.ZA Wed Aug 31 16:43:56 2005 From: carinus.carelse at MRC.AC.ZA (Carinus Carelse) Date: Thu Jan 12 21:30:40 2006 Subject: Load Query Message-ID: I have noticed that every so often I get a load problem on my mailscanner. The amount of messages being scanned keeps going up and doesn't come down. Any help of where I can look and what I can try will be appreciated MailScanner-4.44.6 Spamassassin 3.0.4 Solaris 9 exim 4.52 mcafee virus scanner Carinus ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Wed Aug 31 16:54:42 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:40 2006 Subject: Load Query Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Carinus Carelse wrote: > > I have noticed that every so often I get a load problem on my > mailscanner. The amount of messages being scanned keeps going up and > doesn't come down. Any help of where I can look and what I can try will > be appreciated > > MailScanner-4.44.6 > Spamassassin 3.0.4 > Solaris 9 > exim 4.52 > mcafee virus scanner See http://wiki.mailscanner.info/doku.php?id=documentation:test_troubleshoot:performance -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From clark.coffman at sendit.nodak.edu Wed Aug 31 17:15:40 2005 From: clark.coffman at sendit.nodak.edu (Clark Coffman) Date: Thu Jan 12 21:30:40 2006 Subject: Mailing List Request Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] What I've done is setup a rule in my .procmailrc (obviously I'm using Unix) such as: :0 * ^To.*JISCMAIL.AC.UK MailScanner This directs all mail from the MailScanner list into a MailScanner folder for me. If you're using Unix/Linux to receive your email you might try that. Clark Mark Waterhouse - Mailing Lists wrote: > Hi > > Would it be possible for the mailing list to be altered slightly to > include the words [Mailscanner] in the subject line. > I receive a large number of messages in one mailbox and it gets > increasingly difficult to read the mailscanner emails in amongst all > others. > > > Thanks > Mark Waterhouse > DFK Systems Limited > http://www.dfk-systems.com/ > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- ____________________________________ Clark W. Coffman - System Admin - EduTech (education technology services) North Dakota State University - 1320 Albrecht Blvd, IACC 212 Clark.Coffman@Sendit.Nodak.Edu Work: 701-231-8825 - Fax: 701-231-8541 Hamster: Whack!! Rabbit: Did you just whack me with a carrot? ... Hamster: Whoa! Oh boy!! ------------------------------------ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pete at ENITECH.COM.AU Wed Aug 31 23:06:00 2005 From: pete at ENITECH.COM.AU (Peter Russell) Date: Thu Jan 12 21:30:40 2006 Subject: Best practise? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] 2 questions I currently scan mail for a handful of domains and less than 2000 users. I have primary and secondary MailScanner servers both with own MX records of different weights. They are on 2 different physical networks/sites, but one of those networks and the site is being decommissioned. The second machine will moved to the same rack as the primary. We have a another MailScanner machine that handles outbound mail only. Should i just turn the secondary into a backup MX and simplify the whole thing by having just one mailscanner and the backup mx machines? Or is it better to continue to maintain two mailscanners? My preference is for the ms+backupMX option but not sure of there are drawbacks with this that i havent considered? My next question is that we provide a service that is an email address for ex students for life. Its a subdomain of ours and there is no mail storage, it is simply a forwarding/redirecting service. There is a web gui that allows users to change their forwarding address. The development guys dont like the system that does it now and would prefer to output a text file from their app and let me redirect this using Postfix on MailScanner. Is Virtual Alias maps the best way? Thanks in advance for any advice/suggestions Pete ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website!