MailScanner ANNOUNCE: 4.42.9 released - bug not fixed
Julian Field
MailScanner at ecs.soton.ac.uk
Wed Jun 1 16:24:49 IST 2005
On 1 Jun 2005, at 15:50, Quentin Campbell wrote:
> Julian
>
> The Spam and MCP actions are shown below. I have interpolated parts of
> the contents of the two spam "Actions" rules file between the "cut
> here"
> lines.
>
> The logged MCP scores are all >= 10.
>
>
> Spam Actions = %rules-dir%/Spam_Actions.rules
> ------------ cut here
> To: *@unn.ac.uk deliver
> To: *@northumbria.ac.uk deliver
> To: *@qeliz.ac.uk deliver
> attachment
> To: *@stmarys-sfc.ac.uk deliver
> attachment
> To: cccc.dddd at newdur.ac.uk deliver
> attachment
> To: *@newdur.ac.uk deliver
> striphtml
> To: /aaaa.bbbb\@(ncl|newcastle)\.ac\.uk$/ deliver
> ## DO NOT EDIT BELOW THIS LINE - CHANGES WILL BE LOST
> To: xxxx.yyyy at ncl.ac.uk delete
> To: xxxx.yyyy at newcastle.ac.uk delete
> [hundreds of addresses of the above form]
You can shortcut this by using
To: /etc/MailScanner/newcastle.addresses delete
and then put the newcastle addresses, 1 per line into the
newcastle.addresses file.
That should make maintenance rather easier.
> To: *@* deliver attachment
> ------------ cut here
> High Scoring Spam Actions = %rules-dir%/
> High_Scoring_Spam_Actions.rules
> ------------ cut here
> [similar records to contents of Spam_Actions.rules]
> ------------ cut here
> Non Spam Actions = deliver
>
> MCP Checks = yes
> First Check = mcp
> MCP Required SpamAssassin Score = 1
> MCP High SpamAssassin Score = 10
> MCP Error Score = 1
> MCP Header = X-%org-name%-MailScanner-MCPCheck:
> Non MCP Actions = deliver
> MCP Actions = deliver
> High Scoring MCP Actions = delete
Your High-scoring MCP threshold is 10, but what are the scores of the
MCP rules you are using? Are they 10 or above, or below? I haven't
yet seen evidence that the High-scoring MCP threshold is actually
reached.
> Bounce MCP As Attachment = no
>
> MCP Modify Subject = yes
> MCP Subject Text = {MCP?}
> High Scoring MCP Modify Subject = yes
> High Scoring MCP Subject Text = {MCP?!}
>
> Is Definitely MCP = no
> Is Definitely Not MCP = no
> Definite MCP Is High Scoring = no
> Always Include MCP Report = yes
> Detailed MCP Report = yes
> Include Scores In MCP Report = yes
> Log MCP = yes
>
>
> Quentin
> ---
> PHONE: +44 191 222 8209 Information Systems and Services (ISS),
> University of Newcastle,
> Newcastle upon Tyne,
> FAX: +44 191 222 8765 United Kingdom, NE1 7RU.
> ----------------------------------------------------------------------
> --
> "Any opinion expressed above is mine. The University can get its own."
>
>
>> -----Original Message-----
>> From: MailScanner mailing list
>> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Julian Field
>> Sent: 01 June 2005 15:09
>> To: MAILSCANNER at JISCMAIL.AC.UK
>> Subject: Re: MailScanner ANNOUNCE: 4.42.9 released - bug not fixed
>>
>> According to the code, it should work for MCP but not for spam.
>> This is weird.
>>
>> What are your MCP actions? And your Spam actions?
>>
>> On 1 Jun 2005, at 14:59, Quentin Campbell wrote:
>>
>>
>>> Julian
>>>
>>> Have installed 4.42.9 but the fix you announced for the "Delete" MCP
>>> action is not working.
>>>
>>> Test messages are being caught by MCP and are not delivered
>>> according to
>>> the logs but there is no explicit MCP "Delete" action record being
>>> logged.
>>>
>>> Quentin
>>> ---
>>> PHONE: +44 191 222 8209 Information Systems and Services (ISS),
>>> University of Newcastle,
>>> Newcastle upon Tyne,
>>> FAX: +44 191 222 8765 United Kingdom, NE1 7RU.
>>>
>>>
>> ---------------------------------------------------------------------
>> -
>>
>>> --
>>> "Any opinion expressed above is mine. The University can get
>>>
>> its own."
>>
>>>
>>>
>>>
>>>
>>> ________________________________
>>>
>>> From: MailScanner mailing list
>>> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Julian Field
>>> Sent: 01 June 2005 10:08
>>> To: MAILSCANNER at JISCMAIL.AC.UK
>>> Subject: MailScanner ANNOUNCE: 4.42.9 released
>>>
>>>
>>> I have just released the latest stable release of MailScanner.
>>>
>>> The major new features this month are
>>>
>>> - Panda support completely rewritten (thanks to Rick Cooper!).
>>> - New options to tag Subject: line of HTML mail that has been
>>> disarmed.
>>> - Can now set the number of "Spam Lists" that are hit before the
>>> message is treated as spam.
>>> - Now passes the testvirus.org "null MIME-boundary" test.
>>>
>>> You can download as usual from www.mailscanner.info.
>>>
>>> The full Change Log is this:
>>>
>>> * New Features and Improvements *
>>> - Now automatically detects and warns if the "Incoming Work
>>> Directory"
>>> setting contains any links. It also corrects the path (but not
>>> in the
>>> MailScanner.conf file) and continues to work properly.
>>> - Added support for Sophos 3.93.2. You must use the
>>> sophos-autoupdate from
>>> this version if you want Sophos to work (both the sophos and
>>> sophossavi
>>> scanner settings).
>>> - Tar and RPM distribution installation scripts now look for
>>> gtar if GNU
>>> tar was not found, and is happy if /usr/local/bin/perl and
>>> /usr/bin/perl
>>> point to the same place.
>>> - SophosSAVI errors are detected as if they were viruses, and
>>> are not
>>> ignored.
>>> - Panda support completely reimplemented a lot better by Rick
>>> Cooper.
>>> - Upgraded File::Temp, Compress::Zlib and ExtUtils-MakeMaker to
>>> latest
>>> releases.
>>> - New options "Disarmed Modify Subject" and "Disarmed Subject
>>> Text" now
>>> provide the ability to alter the Subject: line if any HTML
>>> tags in the
>>> body of the message were disarmed (by having their "Allow ....
>>> Tags" set
>>> to "disarm". This is switched on by default.
>>> - New option "Spam Lists To Be Spam" now provides the ability to
>>> set how
>>> many Spam Lists a message must appear in before it is
>>> considered to be
>>> spam. The default is 1 as that mimics the previous behaviour.
>>> - Improved output of SuSE MailScanner init.d script.
>>> - Reversed spam and disarm tags to leave spam tag at start of
>>> Subject:.
>>>
>>> * Fixes*
>>> - Fixed problem that could cause harmless header files to be
>>> left in the
>>> temporary working directories when using Postfix.
>>> - Fixed problem where attachment size checks were made on the
>>> contents of
>>> zip files and not just the zip files themselves.
>>> - Hopefully fixed problem with ClamAV missing Worm.Sober.P
>>> occasionally.
>>> - No longer import missing whine method from MIME-tools.
>>> - Fixed problems with incomplete reporting of viruses in zip
>>> files.
>>> - Fixed problem with "Delete" MCP action not being logged in
>>> syslog.
>>> - Fixed problem with the "null MIME boundary" vulnerability
>>> test.
>>> - Added check to upgrade_MailScanner_conf and
>>> upgrade_langages_conf so they
>>> check to ensure all input files have content before starting.
>>> - Fixed bug where clean header was being applied to unscanned
>>> mail when using
>>> virus scanning rulesets.
>>> - Fixed wrong build number for 1 Perl module in install.sh
>>> scripts.
>>> - Fixed typo in upgrade_MailScanner_conf.
>>> - Made significant changes to child worker process management
>>> and re-spawning,
>>> to try to avoid problems reported by a few users with
>>> MailScanner "slowly
>>> stopping working" over the space of several hours.
>>>
>>> --
>>> Julian Field
>>> www.MailScanner.info
>>> Buy the MailScanner book at www.MailScanner.info/store
>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>>
>>> ------------------------ MailScanner list
>>> ------------------------
>>> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>> 'leave mailscanner' in the body of the email.
>>> Before posting, read the Wiki (http://wiki.mailscanner.info/)
>>> and the archives
>>> (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>> Support MailScanner development - buy the book off the website!
>>>
>>> ------------------------ MailScanner list ------------------------
>>> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>> 'leave mailscanner' in the body of the email.
>>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>> Support MailScanner development - buy the book off the website!
>>>
>>>
>>>
>>
>> --
>> Julian Field
>> www.MailScanner.info
>> Buy the MailScanner book at www.MailScanner.info/store
>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>> Support MailScanner development - buy the book off the website!
>>
>>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
>
--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!
More information about the MailScanner
mailing list