From jd at BARITEC.COM Sat Oct 1 00:04:48 2005 From: jd at BARITEC.COM (JD Doelitzsch) Date: Thu Jan 12 21:30:51 2006 Subject: MailScanner not catching eicar Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Just a bit of additional info: I looked in /var/spool/mqueue and found some messages with mailscanner headers, but it seems like mqueue is collecting alot of files. any way I can verify that sendmail is using mqueue for outgoing, is it possible that sendmail is pulling from mqueue.in for outgoing? i don't see any references for this in sendmail .cf or .mc if that is indeed what it is. -JD ============== Hey guys it's been a while since i wrote to the list but once again im stumped. Im running Fedora core 1 the latest from RHN, installed clam AV 8.7 and the lastest MailScanner build. Sendmail is pushing the mail to my "exchange" server but it doesn't seem like Mailscanner is getting to it. I originally thought that it was the clamav-wrapper which pointed to /usr/bin instead of usr/local/bin so once i corrected it worked fine when I ran it. I looked at the webinfo that said Add the domain name to /etc/mail/relay-domains. I didn't have that file so I created it with mydomain.com in it. I look at top and when email comes in I see the sendmail process but no mailscanner or clamscan. I restart Mailscanner to verify its up and its up. MailScanner.conf looks okay to me, so im fresh out of ideas. anyone care to take a shot? -JD ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Sat Oct 1 00:17:18 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:51 2006 Subject: MailScanner not catching eicar Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] JD Doelitzsch spake the following on 9/30/2005 4:04 PM: > Just a bit of additional info: > > I looked in /var/spool/mqueue and found some messages with mailscanner > headers, but it seems like mqueue is collecting alot of files. any way I can > verify that sendmail is using mqueue for outgoing, is it possible that > sendmail is pulling from mqueue.in for outgoing? i don't see any references > for this in sendmail .cf or .mc if that is indeed what it is. > Did you do all the stuff in the docs; service sendmail stop chkconfig sendmail off chkconfig MailScanner on service MailScanner start tail -f /var/log/maillog and look for weird stuff. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jlmiller at MMTNETWORKS.COM.AU Sat Oct 1 02:13:13 2005 From: jlmiller at MMTNETWORKS.COM.AU (Jon Miller) Date: Thu Jan 12 21:30:51 2006 Subject: Still getting spam of the drug nature Message-ID: For some reason I'm still getting spam mail relating to drugs, etc. I want to be clear in that if I receive a spam mail that I want sa to learn, do I issue the command sa-learn -p -v /etc/spam.assassin.prefs.conf --spam /home/jlmiller/spam /home/jlmiller/spam is the location where I store each e-mail that I want sa-learn to read The issue is I do not know if sa-learn is indeed learning as I have not seen anything that suggest this. The following is the header from one such e-mail, notice the score is a negative and not what I would have hoped for. Any advice would be greatly appreciated. Thanks Jon Received: from mail.mmtnetworks.com.au ([192.168.3.3]) by mmtnetworks.com.au; Fri, 30 Sep 2005 20:43:43 +0800 Received: from stonline.sk (unknown [221.141.151.58]) by mail.mmtnetworks.com.au (Postfix) with SMTP id 4D1CC15000C for ; Fri, 30 Sep 2005 20:40:42 +0800 (WST) Received: from 226.144.62.226 by smtp.dnet.it; Fri, 30 Sep 2005 12:25:01 +0000 Message-ID: <13bd01c5c5b9$1aef666c$4f0a7ad9@stonline.sk> From: "Silvia H. Barker" To: jlmiller@mmtnetworks.com.au Subject: Online Drugs - save up to 80% Date: Fri, 30 Sep 2005 10:24:33 -0200 MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1158 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Content-Type: text/plain; charset="iso-8859-1" X-mmtnet-MailScanner: Found to be clean X-mmtnet-MailScanner-SpamCheck: not spam, SpamAssassin (score=-0.099, required 2, BAYES_00, MISSING_SUBJECT) X-MailScanner-From: silvia.h_barker_30@dnet.it Content-Transfer-Encoding: quoted-printable Online pharmacy - Visit our online store and save. Jon L. Miller, ASE, CNS, CLS, MCNE, CCNA Director/Sr Systems Consultant MMT Networks Pty Ltd http://www.mmtnetworks.com.au Resellers for: Sophos Anti-Virus, Novell, Cisco, Swifdsl "I don't know the key to success, but the key to failure is trying to please everybody." -Bill Cosby ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "HTML" Text/HTML 56 lines. ] [ Unable to print this part. ] From mike at CAMAROSS.NET Sat Oct 1 04:05:21 2005 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:30:51 2006 Subject: Still getting spam of the drug nature Message-ID: If you'd drop connections from IP's with no reverse DNS, you'd lose a lot of your daily spam intake. Are you running razor, pyzor and/or dcc? Mike > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Jon Miller > Sent: Friday, September 30, 2005 8:13 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Still getting spam of the drug nature > > For some reason I'm still getting spam mail relating to drugs, etc. > I want to be clear in that if I receive a spam mail that I > want sa to learn, do I issue the command sa-learn -p -v > /etc/spam.assassin.prefs.conf --spam /home/jlmiller/spam > /home/jlmiller/spam is the location where I store each e-mail > that I want sa-learn to read > > The issue is I do not know if sa-learn is indeed learning as > I have not seen anything that suggest this. > > The following is the header from one such e-mail, notice the > score is a negative and not what I would have hoped for. > Any advice would be greatly appreciated. > > Thanks > > Jon > > Received: from mail.mmtnetworks.com.au > ([192.168.3.3]) > by mmtnetworks.com.au; Fri, 30 Sep 2005 20:43:43 +0800 > Received: from stonline.sk (unknown [221.141.151.58]) by > mail.mmtnetworks.com.au (Postfix) with SMTP id 4D1CC15000C > for ; Fri, 30 Sep 2005 20:40:42 > +0800 (WST) > Received: from 226.144.62.226 by smtp.dnet.it; Fri, 30 Sep > 2005 12:25:01 +0000 > Message-ID: <13bd01c5c5b9$1aef666c$4f0a7ad9@stonline.sk> > From: "Silvia H. Barker" > To: jlmiller@mmtnetworks.com.au > Subject: Online Drugs - save up to 80% > Date: Fri, 30 Sep 2005 10:24:33 -0200 > MIME-Version: 1.0 > X-Priority: 3 > X-MSMail-Priority: Normal > X-Mailer: Microsoft Outlook Express 6.00.2800.1158 > X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 > Content-Type: text/plain; > charset="iso-8859-1" > X-mmtnet-MailScanner: Found to be clean > X-mmtnet-MailScanner-SpamCheck: not spam, SpamAssassin > (score=-0.099, required 2, BAYES_00, MISSING_SUBJECT) > X-MailScanner-From: silvia.h_barker_30@dnet.it > Content-Transfer-Encoding: quoted-printable > > Online pharmacy - Visit our online store and save. > > Jon L. Miller, ASE, CNS, CLS, MCNE, CCNA Director/Sr Systems > Consultant MMT Networks Pty Ltd http://www.mmtnetworks.com.au > Resellers for: Sophos Anti-Virus, Novell, Cisco, Swifdsl > > "I don't know the key to success, but the key to failure is > trying to please everybody." -Bill Cosby > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From admin at thenamegame.com Sat Oct 1 04:38:28 2005 From: admin at thenamegame.com (Michael Freeman) Date: Thu Jan 12 21:30:51 2006 Subject: Abornal MailScanner startup Message-ID: I have been running MS for years and have never had an issue with it till last night. All of a sudden MS was eating 99% of my CPU. I though it was because somebody was sending huge mailing list message but that was not the problem. I tried for hours to get it back under control, stopping and starting it and it continued to eat my CPU power. I though maybe something got correct as every time I started it I saw abnormal MS startup entries in the maillog. So I upgraded to the latest version. The problem still exists. When I start MS I see it starting up like this; Sep 30 23:23:38 srv07 MailScanner[12321]: MailScanner E-Mail Virus Scanner version 4.45.4 starting... Sep 30 23:23:38 srv07 MailScanner[12321]: Read 204 hostnames from the phishing whitelist Sep 30 23:23:49 srv07 MailScanner[12328]: MailScanner E-Mail Virus Scanner version 4.45.4 starting... Sep 30 23:23:49 srv07 MailScanner[12328]: Read 204 hostnames from the phishing whitelist Sep 30 23:24:00 srv07 MailScanner[12329]: MailScanner E-Mail Virus Scanner version 4.45.4 starting... Sep 30 23:24:00 srv07 MailScanner[12329]: Read 204 hostnames from the phishing whitelist Sep 30 23:24:11 srv07 MailScanner[12338]: MailScanner E-Mail Virus Scanner version 4.45.4 starting... Sep 30 23:24:11 srv07 MailScanner[12338]: Read 204 hostnames from the phishing whitelist Then top shows 12328 root 19 0 127M 126M 1844 R 21.9 12.6 0:14 MailScanner 12341 root 15 0 65960 62M 1832 R 20.0 6.2 0:03 MailScanner 12321 root 15 0 129M 127M 1844 R 19.1 12.7 0:23 MailScanner 12329 root 15 0 127M 126M 1844 R 19.1 12.6 0:08 MailScanner 12338 root 15 0 127M 126M 1844 R 18.1 12.6 0:05 MailScanner 12343 root 11 0 1088 1088 820 R 1.9 0.1 0:00 top 7 minutes later I see these entries; Sep 30 23:29:43 srv07 MailScanner[12328]: Using locktype = posix Sep 30 23:29:43 srv07 MailScanner[12328]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Why is it taking so much time to start and why it it kicking up the loads so high? Is this a problem with MS + SA 3.1? Thanks ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From naolson at gmail.com Sat Oct 1 06:10:18 2005 From: naolson at gmail.com (Nathan Olson) Date: Thu Jan 12 21:30:51 2006 Subject: Abornal MailScanner startup Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Did anything get upgraded last night, before the trouble began? P.S. Your Reply-To should be the mailing list. Nate ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From admin at thenamegame.com Sat Oct 1 06:49:14 2005 From: admin at thenamegame.com (Michael Freeman) Date: Thu Jan 12 21:30:51 2006 Subject: Abornal MailScanner startup Message-ID: Nope nothing. What's a normal startup supposed to look like? -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Nathan Olson Sent: Saturday, October 01, 2005 1:10 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Abornal MailScanner startup Did anything get upgraded last night, before the trouble began? P.S. Your Reply-To should be the mailing list. Nate ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Oct 1 14:31:28 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:51 2006 Subject: Mailscanner disturbs my domainkey? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Alex Neuman wrote: > Lars Kristiansen wrote: > >>> I've added domainkeys with dk-milter to sendmail. >>> >>> The verifier at http://senderid.espcoalition.org/ shows the >>> signature is >>> there, but it does not verify. >>> >>> Is mailscanner messing up the headers so the signature is wrong? >>> >> >> >> According to the rfc, >> [ >> http://www.ietf.org/internet-drafts/draft-delany-domainkeys-base-02.txt >> ] >> , it is a signature of the mail, including the headers below the >> DomainKey-Signature. >> As far as I can understand new headers need to be put before the >> signature >> not to conflict. >> >> >> -- >> Lars >> >> >> >> >>> 8uye@senderid.espcoalition.org >>> >>> The verifier says: DomainKey-Status: bad: Signature failed verification >>> >>> DomainKey-Signature: a=rsa-sha1; s=arnold; d=neland.dk; c=nofws; q=dns; >>> h=message-id:from:to:subject:date:mime-version:content-type: >>> content-transfer-encoding:x-priority:x-msmail-priority:x-mailer:x-mimeole; >>> >>> b=KqKCCl3LSAL7ztA0QktPMHZSMnAbwwRYUeMJWowfD0SZt5PbuD/mWy92a1gtu+eHa >>> JA8njDRZ4zh0iX239dsmw== >>> >>> ; <<>> DiG 9.3.1 <<>> -t txt arnold._domainkey.neland.dk >>> @ns4.gratisdns.dk >>> ; (1 server found) >>> ;; global options: printcmd >>> ;; Got answer: >>> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41315 >>> ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 5, ADDITIONAL: 5 >>> >>> ;; QUESTION SECTION: >>> ;arnold._domainkey.neland.dk. IN TXT >>> >>> ;; ANSWER SECTION: >>> arnold._domainkey.neland.dk. 43200 IN TXT "g=\; k=rsa\; t=y\; >>> p=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMDitcv/6R1RMjPiGHCiIcTnvVsA+A3XGg5fCf2yKUrrf7NmJw7GB9Cj35GZavzHwOVSUxkQiRUknt/+2jJMS8UCAwEAAQ==" >>> >>> >>> What's wrong? :-( >>> >> >> >> >> >>> -- >>> This message has been scanned for viruses and >>> dangerous content by MailScanner, and is >>> believed to be clean. >>> MailScanner thanks transtec Computers for their support. >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > > In any case, any good info, pointers, tips on getting domainkeys to > work using sendmail+MailScanner would be appreciated. I've already set > up SPF, but having domainkeys as well would be a plus. From what I have seen over the past 20 years or so is that the usual practice is to put "Received" headers at the top, and all X- headers and other header modifications at the bottom. If they produce one exception saying that all new headers must be before the domainkeys header, then how many others are there likely to be in future? They have somewhat changed the rules. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQz6PtBH2WUcUFbZUEQJAlgCfRns3q4vFG+BMZPcDS16Z7KdCLhUAn21a fH+six/rhNm2rS+3/iR2/npo =8Y3x -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Oct 1 14:34:34 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:51 2006 Subject: MailQueue continually growing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Terran Wright wrote: >Gentlemen, > >Running CentOS4 with MS/SA+Razor+DCC/Clam/Bitdefender. > >I notice that the mailqueue continues to increase in size now > 8000 mails. > >Running in debug mode it comes to a halt with the following error: > >format error: can't find EOCD signature > at /usr/sbin/MailScanner line 568 > > > That doesn't stop it, it is perfectly harmless output from the Archive::Zip module. It just means it couldn't find a zip archive. Which happens every time there *isn't* a zip archive. It continues running, it doesn't stop. I would suspect your SpamAssassin setup or your DNS servers. Set "Debug SpamAssassin = yes" and "Debug = yes" and then run a single batch through with check_mailscanner. If it pauses somewhere, thump Ctrl-S and see what it was doing at the time. You may find something simple has happened like your razor or pyzor server lists have become out of date. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQz6QaxH2WUcUFbZUEQKUfwCgyNpXa8dqbNkBcZrhgRCvxINnpsYAn1e0 eos4uwH2Yi/9fWcnp/E154r6 =SQ3s -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Oct 1 14:36:45 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:51 2006 Subject: FW: MailScanner not catching eicar Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 One extra point. Don't change the -wrapper scripts, that's wrong and will be overwritten the next time you upgrade. What you should be doing is editing /etc/MailScanner/virus.scanners.conf as that tells MailScanner where the virus scanners are installed. You don't ever have to change my code, there are configuratioon files to do what you want. JD Doelitzsch wrote: >-----Original Message----- >From: JD Doelitzsch [mailto:jd@baritec.com] >Sent: Friday, September 30, 2005 2:46 PM >To: MailScanner mailing list >Subject: MailScanner not catching eicar > > >Hey guys it's been a while since i wrote to the list but once again im >stumped. > >Im running Fedora core 1 the latest from RHN, installed clam AV 8.7 and the >lastest MailScanner build. Sendmail is pushing the mail to my "exchange" >server but it doesn't seem like Mailscanner is getting to it. I originally >thought that it was the clamav-wrapper which pointed to /usr/bin instead of >usr/local/bin so once i corrected it worked fine when I ran it. I looked at >the webinfo that said Add the domain name to /etc/mail/relay-domains. I >didn't have that file so I created it with mydomain.com in it. I look at top >and when email comes in I see the sendmail process but no mailscanner or >clamscan. I restart Mailscanner to verify its up and its up. >MailScanner.conf looks okay to me, so im fresh out of ideas. anyone care to >take a shot? > >-JD > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQz6Q7hH2WUcUFbZUEQJ5dQCghbcxwL3qll1Map7aUS2+eWz98EMAnRls nDBV/OC566GtsJ8MoNeSmdN9 =6mqt -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Oct 1 14:54:08 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:51 2006 Subject: MailScanner ANNOUNCE: 4.46.2 release Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have just released the latest stable version of MailScanner, 4.46.2. Download as usual from www.mailscanner.info The Change Log is pretty small this month, things have been quiet. The important bit for Postfix users is a fix involving the internal TNEF expander. Also SpamAssassin 3.1.0 is supported and doesn't generate any warnings. The full Change Log is this: * New Features and Improvements * - - Improved phishing net JavaScript detection to make reports more sensible. - - Loads of additions to phishing net safe sites list (thanks Denis!). - - Improved Install-Clam-SA package so that it sets up your /etc/ld.so.conf file for you, by adding /usr/local/lib if necessary. - - Increased the default expansion factor of archives for the clamav scanner. - - Removed -j3 from call to Kaspersky in kaspersky-wrapper, on advice from Kaspersky users. * Fixes * - - Fixed problem with a few TNEF files and the internal TNEF decoder, caused occasional crashes. - - Fixed warnings with numeric tests in a couple of places. - - Tested against SpamAssassin 3.1.0, one minor problem found and fixed. - - Fixed minor bug in "actions" parser in ZMailer support code. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQz6VARH2WUcUFbZUEQJvFwCfeT4qx75mRzyUrqcFIpDzY5TCoisAoL7V qCBvxc6pq2cDUwslmlp1ezeE =jJdh -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From orimbo at ARCC.OR.KE Sat Oct 1 17:22:42 2005 From: orimbo at ARCC.OR.KE (Alfred Orimbo) Date: Thu Jan 12 21:30:52 2006 Subject: MailScanner + Sendmail-8.12.8-4 Message-ID: Hallo all. I have just insttalled MailScanner, and I run sendmail-8.12.8-4. After stoping Sendmail, mails come in ok, but are held up in /var/spool/mqueue.in. How do i modify the script that starts sendmail to enable the scanned mails go to /var/spool/mqueue? Does MailScanner work with sendmail-8.12.8-4? My OS is Linux 9.0 (Shrike) and MailScanner-4.4.0.11-1. The combination is MailScanner+Sendmail+SpamAssassin. I do not have problem with SpamaAssassin. Regards, Alfred. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jrudd at UCSC.EDU Sat Oct 1 23:29:28 2005 From: jrudd at UCSC.EDU (John Rudd) Date: Thu Jan 12 21:30:52 2006 Subject: Mailscanner disturbs my domainkey? Message-ID: On Oct 1, 2005, at 6:31 AM, Julian Field wrote: >> In any case, any good info, pointers, tips on getting domainkeys to >> work using sendmail+MailScanner would be appreciated. I've already set >> up SPF, but having domainkeys as well would be a plus. > > From what I have seen over the past 20 years or so is that the usual > practice is to put "Received" headers at the top, and all X- headers > and > other header modifications at the bottom. If they produce one exception > saying that all new headers must be before the domainkeys header, then > how many others are there likely to be in future? They have somewhat > changed the rules. > There's no "somewhat" about it. If you embrace DomainKeys, then you have to accept that the rules have changed. With DomainKeys, all new headers have to be added above the DomainKeys header (the easiest way is to add them to the beginning of all of the headers; this is what the new spamassassin does). You also may not modify the subject, change the body content, because you may not modify anything after the DomainKeys header. So, when MailScanner wants to modify the body of a message, you would almost want-to/have-to get rid of the DomainKey header. In that case, I would recommend a new MailScanner header that behaves as follows: X-%ORG-MAILSCANNER-DomainKey: a) if passed domain key, and subject/body not modified: above header value is: "Passed" and keep domain key header b) if failed domain key, and subject/body not modified: above header value is: "Failed" and keep the domain key header c) if passed domain key, but header removed due to modifying the subject and/or message body, then: above header value is: "Passed, Removed" and remove the domain key header d) if failed, and body/subject modified: above header value is: "Failed, Removed" and remove the domain key header And, of course, any headers that MS adds, from now on, they should be added to the beginning of the header list (easier to just 'always do that', instead of trying to have special cases like "if header exists, add to top, else add to bottom' or "find header, add new headers just above it", etc. Easier to just do what the new spamassassin does: add to the top, always ... and this also makes it easier for mail admins to forensically see when a header got added, as they will be between received headers ... though it does make reading the received headers more painful). ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From taz at TAZ-MANIA.COM Sun Oct 2 08:16:30 2005 From: taz at TAZ-MANIA.COM (Dennis Willson) Date: Thu Jan 12 21:30:52 2006 Subject: Problem with Custom Functions Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I'm have a problem with some custom functions. I'm extending MailWatch and after adding a new perl module which works perfectly by itself. Seems to cause the SQLBlackWhite.pm functions to fail with the error message: Oct 2 00:10:07 smtp MailScanner[9596]: MailScanner E-Mail Virus Scanner version 4.44.6 starting... Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init function SQLSpamScores Oct 2 00:10:08 smtp MailScanner[9596]: Read 4 Spam entries Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init function SQLNoScan Oct 2 00:10:08 smtp MailScanner[9596]: Read 6 No Spam Scan entries Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init function SQLBlacklist Oct 2 00:10:08 smtp MailScanner[9596]: Starting up SQL Blacklist Oct 2 00:10:08 smtp MailScanner[9596]: Could not use Custom Function code MailScanner::CustomConfig::InitSQLBlacklist, it could not be "eval"ed. Make sure the module is correct with perl -wc Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init function MailWatchLogging Oct 2 00:10:08 smtp MailScanner[9596]: Started SQL Logging child Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init function SQLHighSpamScores Oct 2 00:10:08 smtp MailScanner[9596]: Read 3 high Spam entries Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init function SQLWhitelist Oct 2 00:10:08 smtp MailScanner[9596]: Starting up SQL Whitelist Oct 2 00:10:08 smtp MailScanner[9596]: Could not use Custom Function code MailScanner::CustomConfig::InitSQLWhitelist, it could not be "eval"ed. Make sure the module is correct with perl -wc When I run: perl -wc SQLBlackWhiteList.pm I get: SQLBlackWhiteList.pm syntax OK I was running the SQLBlackWhiteList just fine prior to adding my module (which again runs just fine itself). My module must be interfereing with the SQLBlackWhiteList module somehow. I just don't know how..... Thanks for any help Dennis ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sun Oct 2 12:58:57 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:52 2006 Subject: Problem with Custom Functions Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Do you end the file with a line saying this? 1; If not, it will fail. All my example(s) should end in this. Dennis Willson wrote: > I'm have a problem with some custom functions. I'm extending MailWatch > and after adding a new perl module which works perfectly by itself. > Seems to cause the SQLBlackWhite.pm functions to fail with the error > message: > > Oct 2 00:10:07 smtp MailScanner[9596]: MailScanner E-Mail Virus > Scanner version 4.44.6 starting... > Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init > function SQLSpamScores > Oct 2 00:10:08 smtp MailScanner[9596]: Read 4 Spam entries > Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init > function SQLNoScan > Oct 2 00:10:08 smtp MailScanner[9596]: Read 6 No Spam Scan entries > Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init > function SQLBlacklist > Oct 2 00:10:08 smtp MailScanner[9596]: Starting up SQL Blacklist > Oct 2 00:10:08 smtp MailScanner[9596]: Could not use Custom Function > code MailScanner::CustomConfig::InitSQLBlacklist, it could not be > "eval"ed. Make sure the module is correct with perl -wc > Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init > function MailWatchLogging > Oct 2 00:10:08 smtp MailScanner[9596]: Started SQL Logging child > Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init > function SQLHighSpamScores > Oct 2 00:10:08 smtp MailScanner[9596]: Read 3 high Spam entries > Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init > function SQLWhitelist > Oct 2 00:10:08 smtp MailScanner[9596]: Starting up SQL Whitelist > Oct 2 00:10:08 smtp MailScanner[9596]: Could not use Custom Function > code MailScanner::CustomConfig::InitSQLWhitelist, it could not be > "eval"ed. Make sure the module is correct with perl -wc > > When I run: *perl -wc SQLBlackWhiteList.pm* I get: > *SQLBlackWhiteList.pm syntax OK > > *I was running the SQLBlackWhiteList just fine prior to adding my > module (which again runs just fine itself). My module must be > interfereing with the SQLBlackWhiteList module somehow. I just don't > know how..... > > Thanks for any help > Dennis > * > * > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQz/LihH2WUcUFbZUEQKMuwCgwzOVhaaXY/1DFi4AF76U/lf9pgcAnAsk k8U3/E3tdgxSpZuBEdb5DWP+ =qRpd -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Dave Sun Oct 2 14:31:43 2005 From: Dave (Dave) Date: Thu Jan 12 21:30:52 2006 Subject: Small update Message-ID: I am running the most recent version of the perl Packages and I am seeing some great results. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From taz at TAZ-MANIA.COM Sun Oct 2 14:58:35 2005 From: taz at TAZ-MANIA.COM (Dennis Willson) Date: Thu Jan 12 21:30:52 2006 Subject: Problem with Custom Functions Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Yes, I have 1; at the end. Each of the modules work fine by themselves. I had been running the SQLBlackWhite.pm module for over a month. I had run my new module for a couple of days on the test system (without the SQLBlackWhite.pm installed) and it was running perfectly. It wasn't until I put the two together that I hit this problem. In fact I used the SQLBlackWhite.pm as my template for creating my module. Is there a possiblilty of "interference" with variable naming or subroutine nameing or anything like that? Julian Field wrote: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Do you end the file with a line saying this? 1; If not, it will fail. All my example(s) should end in this. Dennis Willson wrote: I'm have a problem with some custom functions. I'm extending MailWatch and after adding a new perl module which works perfectly by itself. Seems to cause the SQLBlackWhite.pm functions to fail with the error message: Oct 2 00:10:07 smtp MailScanner[9596]: MailScanner E-Mail Virus Scanner version 4.44.6 starting... Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init function SQLSpamScores Oct 2 00:10:08 smtp MailScanner[9596]: Read 4 Spam entries Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init function SQLNoScan Oct 2 00:10:08 smtp MailScanner[9596]: Read 6 No Spam Scan entries Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init function SQLBlacklist Oct 2 00:10:08 smtp MailScanner[9596]: Starting up SQL Blacklist Oct 2 00:10:08 smtp MailScanner[9596]: Could not use Custom Function code MailScanner::CustomConfig::InitSQLBlacklist, it could not be "eval"ed. Make sure the module is correct with perl -wc Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init function MailWatchLogging Oct 2 00:10:08 smtp MailScanner[9596]: Started SQL Logging child Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init function SQLHighSpamScores Oct 2 00:10:08 smtp MailScanner[9596]: Read 3 high Spam entries Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init function SQLWhitelist Oct 2 00:10:08 smtp MailScanner[9596]: Starting up SQL Whitelist Oct 2 00:10:08 smtp MailScanner[9596]: Could not use Custom Function code MailScanner::CustomConfig::InitSQLWhitelist, it could not be "eval"ed. Make sure the module is correct with perl -wc When I run: *perl -wc SQLBlackWhiteList.pm* I get: *SQLBlackWhiteList.pm syntax OK *I was running the SQLBlackWhiteList just fine prior to adding my module (which again runs just fine itself). My module must be interfereing with the SQLBlackWhiteList module somehow. I just don't know how..... Thanks for any help Dennis * * ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). *Support MailScanner development - buy the book off the website!* - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQz/LihH2WUcUFbZUEQKMuwCgwzOVhaaXY/1DFi4AF76U/lf9pgcAnAsk k8U3/E3tdgxSpZuBEdb5DWP+ =qRpd -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From taz at TAZ-MANIA.COM Sun Oct 2 16:53:14 2005 From: taz at TAZ-MANIA.COM (Dennis Willson) Date: Thu Jan 12 21:30:52 2006 Subject: Problem with Custom Functions Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I found it, I had a subroutine with the same name as the SQLBlackWhite module. I changed its name and the problem has gone away. Thanks Julian Field wrote: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Do you end the file with a line saying this? 1; If not, it will fail. All my example(s) should end in this. Dennis Willson wrote: I'm have a problem with some custom functions. I'm extending MailWatch and after adding a new perl module which works perfectly by itself. Seems to cause the SQLBlackWhite.pm functions to fail with the error message: Oct 2 00:10:07 smtp MailScanner[9596]: MailScanner E-Mail Virus Scanner version 4.44.6 starting... Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init function SQLSpamScores Oct 2 00:10:08 smtp MailScanner[9596]: Read 4 Spam entries Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init function SQLNoScan Oct 2 00:10:08 smtp MailScanner[9596]: Read 6 No Spam Scan entries Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init function SQLBlacklist Oct 2 00:10:08 smtp MailScanner[9596]: Starting up SQL Blacklist Oct 2 00:10:08 smtp MailScanner[9596]: Could not use Custom Function code MailScanner::CustomConfig::InitSQLBlacklist, it could not be "eval"ed. Make sure the module is correct with perl -wc Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init function MailWatchLogging Oct 2 00:10:08 smtp MailScanner[9596]: Started SQL Logging child Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init function SQLHighSpamScores Oct 2 00:10:08 smtp MailScanner[9596]: Read 3 high Spam entries Oct 2 00:10:08 smtp MailScanner[9596]: Config: calling custom init function SQLWhitelist Oct 2 00:10:08 smtp MailScanner[9596]: Starting up SQL Whitelist Oct 2 00:10:08 smtp MailScanner[9596]: Could not use Custom Function code MailScanner::CustomConfig::InitSQLWhitelist, it could not be "eval"ed. Make sure the module is correct with perl -wc When I run: *perl -wc SQLBlackWhiteList.pm* I get: *SQLBlackWhiteList.pm syntax OK *I was running the SQLBlackWhiteList just fine prior to adding my module (which again runs just fine itself). My module must be interfereing with the SQLBlackWhiteList module somehow. I just don't know how..... Thanks for any help Dennis * * ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). *Support MailScanner development - buy the book off the website!* - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQz/LihH2WUcUFbZUEQKMuwCgwzOVhaaXY/1DFi4AF76U/lf9pgcAnAsk k8U3/E3tdgxSpZuBEdb5DWP+ =qRpd -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From admin at thenamegame.com Sun Oct 2 17:58:33 2005 From: admin at thenamegame.com (Michael Freeman) Date: Thu Jan 12 21:30:52 2006 Subject: MS + SA 3.1 high loads on startup, SA 3.1 is CRAPITO! Message-ID: I’ve never had these high loads when starting up MS. Ever since our boxes was upgraded by Cpanel to SA 3.1 our MS takes forever to start. The loads skyrocket on the server when you restart /etc/init.d/MailScanner start | restart. At times you cannot restart MS because you get SIGUPS all though the maillog. Instead, you have to shut down MS, killall -9 MailScanner, then start it. Once MS starts it spawns processes that eat up CPU like crazy. This lasts for 10 – 20min finally after you see these entries in your maillog; Oct 2 12:41:12 srv05 MailScanner[16884]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Oct 2 12:41:28 srv05 MailScanner[17234]: Using locktype = posix MS finally eases up on the load and the boxes returns to a respectable load. All I can is that that since our boxes were upgraded to SA 3.1 we have had nothing but load issues with MS. Not sure what SA 3.1 has done but it seems like they are screwing up everything. Anyone else notice this? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHT.IE Sun Oct 2 18:01:27 2005 From: michele at BLACKNIGHT.IE (Michele Neylon :: Blacknight.ie) Date: Thu Jan 12 21:30:52 2006 Subject: MS + SA 3.1 high loads on startup, SA 3.1 is CRAPITO! Message-ID: [ The following text is in the "windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Michael Freeman wrote: > I^Òve never had these high loads when starting up MS. Ever since our > boxes was upgraded by Cpanel to SA 3.1 our MS takes forever to start. > The loads skyrocket on the server when you restart > /etc/init.d/MailScanner start | restart. At times you cannot restart MS > because you get SIGUPS all though the maillog. Instead, you have to > shut down MS, killall -9 MailScanner, then start it. Once MS starts it > spawns processes that eat up CPU like crazy. This lasts for 10 ^Ö 20min > finally after you see these entries in your maillog; > > Did you ever consider that cpanel might be causing the issue? -- Mr Michele Neylon Blacknight Solutions Quality Business Hosting & Colocation http://www.blacknight.ie/ Tel. 1850 927 280 Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 59 9164239 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jlmiller at MMTNETWORKS.COM.AU Mon Oct 3 00:52:25 2005 From: jlmiller at MMTNETWORKS.COM.AU (Jon Miller) Date: Thu Jan 12 21:30:52 2006 Subject: rule failing lint test Message-ID: I've put in a rule that seems to be failing the --lint test. What I'm looking for is in the subject line since there is a # there is this not treated as a remark or is this read as normal information? mail:/etc/spamassassin# spamassassin --lint > lint_test_results.txt Bareword found where operator expected at /etc/spamassassin/local.cf, rule PROLO_GSPAM28, line 10, near "etc" (Might be a runaway multi-line // string starting on line 1) (Missing operator before etc?) Misplaced _ in number at /etc/spamassassin/local.cf, rule PROLO_GSPAM28, line 30. Bareword found where operator expected at /etc/spamassassin/local.cf, rule PROLO_GSPAM28, line 30, near "70_sare_header" (Might be a runaway multi-line "" string starting on line 20) (Missing operator before sare_header?) Misplaced _ in number at /etc/spamassassin/local.cf, rule PROLO_GSPAM28, line 40. Bareword found where operator expected at /etc/spamassassin/local.cf, rule PROLO_GSPAM28, line 40, near "70_sare_random" (Might be a runaway multi-line "" string starting on line 30) (Missing operator before sare_random?) Misplaced _ in number at /etc/spamassassin/local.cf, rule PROLO_GSPAM28, line 50. Bareword found where operator expected at /etc/spamassassin/local.cf, rule PROLO_GSPAM28, line 50, near "70_sare_header" (Might be a runaway multi-line "" string starting on line 40) (Missing operator before sare_header?) Backslash found where operator expected at /etc/spamassassin/local.cf, rule PROLO_GSPAM28, line 91, near "$|\" (Might be a runaway multi-line ?? string starting on line 51) (Missing operator before \?) Backslash found where operator expected at /etc/spamassassin/local.cf, rule PROLO_GSPAM28, line 111, near "\" (Might be a runaway multi-line ?? string starting on line 91) (Missing operator before \?) Bareword found where operator expected at /etc/spamassassin/local.cf, rule PROLO_GSPAM28, line 111, near "@\S" (Missing operator before S?) Backslash found where operator expected at /etc/spamassassin/local.cf, rule PROLO_GSPAM28, line 251, near "d\" (Might be a runaway multi-line ?? string starting on line 111) Bareword found where operator expected at /etc/spamassassin/local.cf, rule PROLO_GSPAM28, line 251, near "@\S" (Missing operator before S?) Failed to run header SpamAssassin tests, skipping some: syntax error at /etc/spamassassin/local.cf, rule PROLO_GSPAM28, line 10, near "etc" syntax error at /etc/spamassassin/local.cf, rule PROLO_GSPAM28, line 251, near "\." syntax error at /etc/spamassassin/local.cf, rule PROLO_GSPAM28, line 251, near "@\S" lint: 1 issues detected. please rerun with debug enabled for more information. mail:/etc/spamassassin# vi lint_test_results.txt mail:/etc/spamassassin# Rule 28 # 28 Subject: $B;(;o$G$*Fk\@w$_!#CO0hJL$K??7u$J=P(B header PROLO_GSPAM28 Subject =~ /\$B;\(;o\$G\$\*Fk\@w\$_!#CO0hJL\$K\?\?7u\$J=P\(B/i score PROLO_GSPAM28 8 describe PROLO_GSPAM28 Spam - Custom rule set Regards, Jon L. Miller, ASE, CNS, CLS, MCNE, CCNA Director/Sr Systems Consultant MMT Networks Pty Ltd http://www.mmtnetworks.com.au Resellers for: Sophos Anti-Virus, Novell, Cisco, Swifdsl "I don't know the key to success, but the key to failure is trying to please everybody." -Bill Cosby ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "HTML" Text/PLAIN 83 lines. ] [ Unable to print this part. ] From Dave Mon Oct 3 01:04:48 2005 From: Dave (Dave) Date: Thu Jan 12 21:30:52 2006 Subject: [Customer concern: {Fraud?} Fwd: {Fraud?} test mailing] Message-ID: ----- Forwarded message from Concerned Customer -----
Dave,

our mailings are still getting tagged as fraud...



does this come with spam/fraud statement???

---------------------------------------------------------------------------
To be unsubscribed from the testlist mailing list, simply click on the link below:
 MailScanner has detected a possible fraud attempt from "safetyresults.ca" claiming to be MailScanner has detected a possible fraud attempt from "safetyresults.ca" claiming to be Unsubscribe bjm@bennaco.com


Content-Description: "AVG certification" No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.344 / Virus Database: 267.11.9/115 - Release Date: 29/09/2005 ----- End forwarded message ----- How do I fix the above scenario? Again this custoemr is using smpro newletter to send out to customer and this is not a Fraud! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jlmiller at MMTNETWORKS.COM.AU Mon Oct 3 01:18:19 2005 From: jlmiller at MMTNETWORKS.COM.AU (Jon Miller) Date: Thu Jan 12 21:30:52 2006 Subject: curious about body rules Message-ID: If I create a rule that checks the body content for certain words, can I just keep adding words to this one rule? It's to my understanding that SA will search the body of the e-mail for the words that are listed. example: body BodyTest_RULE /porn market penis calis/ i score BodyTest_RULE 4.0 describe BodyTest_RULE This body test rule Regards Jon L. Miller, ASE, CNS, CLS, MCNE, CCNA Director/Sr Systems Consultant MMT Networks Pty Ltd http://www.mmtnetworks.com.au Resellers for: Sophos Anti-Virus, Novell, Cisco, Swifdsl "I don't know the key to success, but the key to failure is trying to please everybody." -Bill Cosby ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "HTML" Text/PLAIN 35 lines. ] [ Unable to print this part. ] From jlmiller at MMTNETWORKS.COM.AU Mon Oct 3 01:37:55 2005 From: jlmiller at MMTNETWORKS.COM.AU (Jon Miller) Date: Thu Jan 12 21:30:52 2006 Subject: Mailscanner Book Message-ID: Think it's time to buy the book. Just curious how long would it take to get the book to WA, Australia? Jon L. Miller, ASE, CNS, CLS, MCNE, CCNA Director/Sr Systems Consultant MMT Networks Pty Ltd http://www.mmtnetworks.com.au Resellers for: Sophos Anti-Virus, Novell, Cisco, Swifdsl "I don't know the key to success, but the key to failure is trying to please everybody." -Bill Cosby ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "HTML" Text/PLAIN 26 lines. ] [ Unable to print this part. ] From mike at CAMAROSS.NET Mon Oct 3 01:58:45 2005 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:30:52 2006 Subject: [Customer concern: {Fraud?} Fwd: {Fraud?} test mailing] Message-ID: A couple of options: 1. Add the sending domain or IP to your phishing whitelist 2. Exempt them from phishing/spam checks by ruleset Mike > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Dave Shariff > Yadallee - System Administrator a.k.a. The Root of the Problem > Sent: Sunday, October 02, 2005 7:05 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: [Customer concern: {Fraud?} Fwd: {Fraud?} test mailing] > > ----- Forwarded message from Concerned Customer ----- > > > > >
> Dave,

> our mailings are still getting tagged as fraud...

>

does this come with spam/fraud statement???
> > > Content-Description: "AVG certification" > > > No virus found in this outgoing message. > Checked by AVG Anti-Virus. > Version: 7.0.344 / Virus Database: 267.11.9/115 - Release > Date: 29/09/2005 > > > > ----- End forwarded message ----- > > > How do I fix the above scenario? Again this custoemr is > using smpro newletter to send out to customer and this is not a Fraud! > > -- > This message has been scanned for viruses and dangerous > content by MailScanner, and is believed to be clean. > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Dave Mon Oct 3 02:01:36 2005 From: Dave (Dave) Date: Thu Jan 12 21:30:52 2006 Subject: [Customer concern: {Fraud?} Fwd: {Fraud?} test mailing] Message-ID: On Sun, Oct 02, 2005 at 07:58:45PM -0500, Mike Kercher wrote: > A couple of options: > > 1. Add the sending domain or IP to your phishing whitelist > 2. Exempt them from phishing/spam checks by ruleset > > Mike > Time to get more information from the customer. > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Dave Shariff > > Yadallee - System Administrator a.k.a. The Root of the Problem > > Sent: Sunday, October 02, 2005 7:05 PM > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: [Customer concern: {Fraud?} Fwd: {Fraud?} test mailing] > > > > ----- Forwarded message from Concerned Customer ----- > > > > > > > > > >
> > Dave,

> > our mailings are still getting tagged as fraud...

> >

does this come with spam/fraud statement???
> > > > > > Content-Description: "AVG certification" > > > > > > No virus found in this outgoing message. > > Checked by AVG Anti-Virus. > > Version: 7.0.344 / Virus Database: 267.11.9/115 - Release > > Date: 29/09/2005 > > > > > > > > ----- End forwarded message ----- > > > > > > How do I fix the above scenario? Again this custoemr is > > using smpro newletter to send out to customer and this is not a Fraud! > > > > -- > > This message has been scanned for viruses and dangerous > > content by MailScanner, and is believed to be clean. > > > > ------------------------ MailScanner list > > ------------------------ To unsubscribe, email > > jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) > > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From gdoris at ROGERS.COM Mon Oct 3 02:36:59 2005 From: gdoris at ROGERS.COM (Gerry Doris) Date: Thu Jan 12 21:30:52 2006 Subject: What version of MailScanner book? Message-ID: How can I tell if I'm ordering the most current version of the MailScanner book? The one on Amazon Canada claims it's Sept 1, 2004. I checked Amazon UK and it has the same info. I'd hate to get a copy a year out of date?? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Mon Oct 3 02:42:09 2005 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:30:52 2006 Subject: What version of MailScanner book? Message-ID: http://www.cafepress.com/mailscanner2,mailscanner.13170076 > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Gerry Doris > Sent: Sunday, October 02, 2005 8:37 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: What version of MailScanner book? > > How can I tell if I'm ordering the most current version of > the MailScanner book? The one on Amazon Canada claims it's > Sept 1, 2004. I checked Amazon UK and it has the same info. > > I'd hate to get a copy a year out of date?? > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From nats at SSCRMNL.EDU.PH Mon Oct 3 03:31:08 2005 From: nats at SSCRMNL.EDU.PH (Jose Nathaniel Nengasca) Date: Thu Jan 12 21:30:52 2006 Subject: FW: [Customer concern: {Fraud?} Fwd: {Fraud?} test mailing] Message-ID: -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem Sent: Monday, October 03, 2005 8:05 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: [Customer concern: {Fraud?} Fwd: {Fraud?} test mailing] ----- Forwarded message from Concerned Customer -----
Dave,

our mailings are still getting tagged as fraud...



does this come with spam/fraud statement???

---------------------------------------------------------------------------< br> To be unsubscribed from the testlist mailing list, simply click on the link below:
 MailScanner has detected a possible fraud attempt from "safetyresults.ca" claiming to be MailScanner has detected a possible fraud attempt from "safetyresults.ca" claiming to be Unsubscribe bjm@bennaco.com


Content-Description: "AVG certification" No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.344 / Virus Database: 267.11.9/115 - Release Date: 29/09/2005 ----- End forwarded message ----- How do I fix the above scenario? Again this custoemr is using smpro newletter to send out to customer and this is not a Fraud! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Oct 3 08:50:30 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:52 2006 Subject: curious about body rules Message-ID: Your "body" line is wrong. It needs to say body BodyTest_RULE /porn|market|penis|calis/i to make it search for any of the words listed. On 3 Oct 2005, at 01:18, Jon Miller wrote: > If I create a rule that checks the body content for certain words, > can I just keep adding words to this one rule? > It's to my understanding that SA will search the body of the e-mail > for the words that are listed. > > example: > body BodyTest_RULE /porn market penis calis/ i > score BodyTest_RULE 4.0 > describe BodyTest_RULE This body test rule > > Regards > > > Jon L. Miller, ASE, CNS, CLS, MCNE, CCNA > Director/Sr Systems Consultant > MMT Networks Pty Ltd > http://www.mmtnetworks.com.au > Resellers for: Sophos Anti-Virus, Novell, Cisco, Swifdsl > > "I don't know the key to success, but the key to failure > is trying to please everybody." -Bill Cosby > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Oct 3 08:51:32 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:52 2006 Subject: Mailscanner Book Message-ID: Buy it straight from the icon in the top right corner of www.mailscanner.info and it will take 2 to 3 weeks. Any other method will take a *lot* longer. On 3 Oct 2005, at 01:37, Jon Miller wrote: > Think it's time to buy the book. > > Just curious how long would it take to get the book to WA, Australia? -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Oct 3 08:53:52 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:52 2006 Subject: What version of MailScanner book? Message-ID: That is by far the fastest and cheapest way of getting the book. And there is no possibility of you getting an old version. On 3 Oct 2005, at 02:42, Mike Kercher wrote: > http://www.cafepress.com/mailscanner2,mailscanner.13170076 > > > >> -----Original Message----- >> From: MailScanner mailing list >> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Gerry Doris >> Sent: Sunday, October 02, 2005 8:37 PM >> To: MAILSCANNER@JISCMAIL.AC.UK >> Subject: What version of MailScanner book? >> >> How can I tell if I'm ordering the most current version of >> the MailScanner book? The one on Amazon Canada claims it's >> Sept 1, 2004. I checked Amazon UK and it has the same info. >> >> I'd hate to get a copy a year out of date?? >> >> ------------------------ MailScanner list >> ------------------------ To unsubscribe, email >> jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) >> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Mon Oct 3 09:02:39 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:52 2006 Subject: MailScanner ANNOUNCE: 4.46.2 release Message-ID: Julian Small point, the TNEF expander fix iss not just for PostFix users, Exim can be a problem as well.....in fact its probably a problem for any MTA that doesn't run as root. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field Sent: 01 October 2005 14:54 To: MAILSCANNER@JISCMAIL.AC.UK Subject: [MAILSCANNER] MailScanner ANNOUNCE: 4.46.2 release -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have just released the latest stable version of MailScanner, 4.46.2. Download as usual from www.mailscanner.info The Change Log is pretty small this month, things have been quiet. The important bit for Postfix users is a fix involving the internal TNEF expander. Also SpamAssassin 3.1.0 is supported and doesn't generate any warnings. The full Change Log is this: * New Features and Improvements * - - Improved phishing net JavaScript detection to make reports more sensible. - - Loads of additions to phishing net safe sites list (thanks Denis!). - - Improved Install-Clam-SA package so that it sets up your /etc/ld.so.conf file for you, by adding /usr/local/lib if necessary. - - Increased the default expansion factor of archives for the clamav scanner. - - Removed -j3 from call to Kaspersky in kaspersky-wrapper, on advice from Kaspersky users. * Fixes * - - Fixed problem with a few TNEF files and the internal TNEF decoder, caused occasional crashes. - - Fixed warnings with numeric tests in a couple of places. - - Tested against SpamAssassin 3.1.0, one minor problem found and fixed. - - Fixed minor bug in "actions" parser in ZMailer support code. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQz6VARH2WUcUFbZUEQJvFwCfeT4qx75mRzyUrqcFIpDzY5TCoisAoL7V qCBvxc6pq2cDUwslmlp1ezeE =jJdh -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From raymond at PROLOCATION.NET Mon Oct 3 09:05:39 2005 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:30:52 2006 Subject: FW: [Customer concern: {Fraud?} Fwd: {Fraud?} test mailing] Message-ID: Hi! > Content-Description: "AVG certification" > > > No virus found in this outgoing message. > Checked by AVG Anti-Virus. > Version: 7.0.344 / Virus Database: 267.11.9/115 - Release Date: 29/09/2005 > > > > ----- End forwarded message ----- > > > How do I fix the above scenario? Again this custoemr is using smpro > newletter > to send out to customer and this is not a Fraud! Serveral options... :) 1] disable fraud detection 2] buy support and urge Julian to fix it 3] sit and wait till julian has time 4] fix it yourself Pick one :) Bye, Raymond. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From gdoris at ROGERS.COM Mon Oct 3 11:05:40 2005 From: gdoris at ROGERS.COM (Gerry Doris) Date: Thu Jan 12 21:30:52 2006 Subject: Mailscanner Book Message-ID: On Mon, 2005-10-03 at 08:51 +0100, Julian Field wrote: > Buy it straight from the icon in the top right corner of > www.mailscanner.info and it will take 2 to 3 weeks. > Any other method will take a *lot* longer. > > On 3 Oct 2005, at 01:37, Jon Miller wrote: > > > Think it's time to buy the book. > > > > Just curious how long would it take to get the book to WA, Australia? > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > Actually, Amazon Canada claims to have your book in stock. They say that delivery will be in 1-2 business days. I don't know if these are the older or newer versions? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Oct 3 11:41:38 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:52 2006 Subject: Mailscanner Book Message-ID: On 3 Oct 2005, at 11:05, Gerry Doris wrote: > On Mon, 2005-10-03 at 08:51 +0100, Julian Field wrote: > >> Buy it straight from the icon in the top right corner of >> www.mailscanner.info and it will take 2 to 3 weeks. >> Any other method will take a *lot* longer. >> >> On 3 Oct 2005, at 01:37, Jon Miller wrote: >> >> >>> Think it's time to buy the book. >>> >>> Just curious how long would it take to get the book to WA, >>> Australia? >>> >> >> > Actually, Amazon Canada claims to have your book in stock. They say > that delivery will be in 1-2 business days. Interesting. They might be lying. > I don't know if these are the older or newer versions? As the books are printed on demand, there shouldn't be any way of getting old copies. But if they ordered some directly themselves (which I don't think they can) or ordered more than they needed (which they haven't done through me), then there is a small chance of getting an old copy. My advice would be to order directly from CafePress. That is where the link on the www.mailscanner.info home page takes you. You will get your book considerably faster and cheaper than any other route. Just order it direct. Don't worry about your credit card details, CafePress have a very good reputation to protect, and I have never heard any reports of bad things happening. I am not involved in the purchase in any way if you order directly from them. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Dave Mon Oct 3 14:44:20 2005 From: Dave (Dave) Date: Thu Jan 12 21:30:52 2006 Subject: FW: [Customer concern: {Fraud?} Fwd: {Fraud?} test mailing] Message-ID: On Mon, Oct 03, 2005 at 10:31:08AM +0800, Jose Nathaniel Nengasca wrote: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > Of Dave Shariff Yadallee - System Administrator a.k.a. The Root of the > Problem > Sent: Monday, October 03, 2005 8:05 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: [Customer concern: {Fraud?} Fwd: {Fraud?} test mailing] > > ----- Forwarded message from Concerned Customer ----- > > > > >
> Dave,

> our mailings are still getting tagged as fraud...

>
>
> does this come with spam/fraud statement???
> > > Content-Description: "AVG certification" > > > No virus found in this outgoing message. > Checked by AVG Anti-Virus. > Version: 7.0.344 / Virus Database: 267.11.9/115 - Release Date: 29/09/2005 > > > > ----- End forwarded message ----- > > > How do I fix the above scenario? Again this custoemr is using smpro > newletter > to send out to customer and this is not a Fraud! > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > Jose, were you trying to say something? -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Dave Mon Oct 3 14:56:06 2005 From: Dave (Dave) Date: Thu Jan 12 21:30:52 2006 Subject: FW: [Customer concern: {Fraud?} Fwd: {Fraud?} test mailing] Message-ID: On Mon, Oct 03, 2005 at 10:05:39AM +0200, Raymond Dijkxhoorn wrote: > Hi! > > >Content-Description: "AVG certification" > > > > > >No virus found in this outgoing message. > >Checked by AVG Anti-Virus. > >Version: 7.0.344 / Virus Database: 267.11.9/115 - Release Date: 29/09/2005 > > > > > > > >----- End forwarded message ----- > > > > > >How do I fix the above scenario? Again this custoemr is using smpro > >newletter > >to send out to customer and this is not a Fraud! > > Serveral options... :) > > 1] disable fraud detection > 2] buy support and urge Julian to fix it > 3] sit and wait till julian has time > 4] fix it yourself > Julian did make mention of adding the domain/IP to the phishing file. > Pick one :) > > Bye, > Raymond. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Dave Mon Oct 3 16:42:45 2005 From: Dave (Dave) Date: Thu Jan 12 21:30:52 2006 Subject: FW: [Customer concern: {Fraud?} Fwd: {Fraud?} test mailing] Message-ID: On Mon, Oct 03, 2005 at 07:56:06AM -0600, Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem wrote: > On Mon, Oct 03, 2005 at 10:05:39AM +0200, Raymond Dijkxhoorn wrote: > > Hi! > > > > >Content-Description: "AVG certification" > > > > > > > > >No virus found in this outgoing message. > > >Checked by AVG Anti-Virus. > > >Version: 7.0.344 / Virus Database: 267.11.9/115 - Release Date: 29/09/2005 > > > > > > > > > > > >----- End forwarded message ----- > > > > > > > > >How do I fix the above scenario? Again this custoemr is using smpro > > >newletter > > >to send out to customer and this is not a Fraud! > > > > Serveral options... :) > > > > 1] disable fraud detection > > 2] buy support and urge Julian to fix it > > 3] sit and wait till julian has time > > 4] fix it yourself > > > > Julian did make mention of adding the domain/IP to the phishing file. > This does concern us all as we are trying to fight Fraud and spam. some good news, is that if unsubscribe is not present, the e-newsletter is listed as spam. Question, even though my localhost is send the e-newsletter to others, MAilScanner is taging this as fraud; Should I be listing the host IP or the sender IP? > > Pick one :) > > > > Bye, > > Raymond. > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > -- > > This message has been scanned for viruses and > > dangerous content by MailScanner, and is > > believed to be clean. > > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Mon Oct 3 17:00:22 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:52 2006 Subject: MailScanner + Sendmail-8.12.8-4 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Alfred Orimbo wrote: >Hallo all. >I have just insttalled MailScanner, and I run sendmail-8.12.8-4. >After stoping Sendmail, mails come in ok, but are held up in /var/spool/mqueue.in. How do i modify the script that starts sendmail to enable the scanned mails go to /var/spool/mqueue? Does MailScanner work with sendmail-8.12.8-4? > >My OS is Linux 9.0 (Shrike) and MailScanner-4.4.0.11-1. > >The combination is MailScanner+Sendmail+SpamAssassin. I do not have problem with SpamaAssassin. > > > Alfred, It will be MailScanner that will move emails from mqueue.in to mqueue once it has done its job on them. And yes MS is working perfectly with your version of sendmail and RedHat. Make sure you started MailScanner through its "service mailscanner start" (it may be "service MailScanner stop" depending on your version) and don't forget to "chkconfig mailscanner on" (or "chkconfig MailScanner on"). Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Mon Oct 3 16:54:40 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:52 2006 Subject: MailScanner + Sendmail-8.12.8-4 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Alfred Orimbo spake the following on 10/1/2005 9:22 AM: > Hallo all. > I have just insttalled MailScanner, and I run sendmail-8.12.8-4. > After stoping Sendmail, mails come in ok, but are held up in /var/spool/mqueue.in. How do i modify the script that starts sendmail to enable the scanned mails go to /var/spool/mqueue? Does MailScanner work with sendmail-8.12.8-4? > > My OS is Linux 9.0 (Shrike) and MailScanner-4.4.0.11-1. > > The combination is MailScanner+Sendmail+SpamAssassin. I do not have problem with SpamaAssassin. > > Regards, > Alfred. > You do not run sendmail with MailScanner. You just run MailScanner and it will take care of running the sendmail processes needed. Did you do the following? service sendmail stop chkconfig sendmail off chkconfig MailScanner on service MailScanner start -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Dave Mon Oct 3 17:21:47 2005 From: Dave (Dave) Date: Thu Jan 12 21:30:52 2006 Subject: FW: [Customer concern: {Fraud?} Fwd: {Fraud?} test mailing] Message-ID: On Mon, Oct 03, 2005 at 09:42:45AM -0600, Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem wrote: > On Mon, Oct 03, 2005 at 07:56:06AM -0600, Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem wrote: > > On Mon, Oct 03, 2005 at 10:05:39AM +0200, Raymond Dijkxhoorn wrote: > > > Hi! > > > > > > >Content-Description: "AVG certification" > > > > > > > > > > > >No virus found in this outgoing message. > > > >Checked by AVG Anti-Virus. > > > >Version: 7.0.344 / Virus Database: 267.11.9/115 - Release Date: 29/09/2005 > > > > > > > > > > > > > > > >----- End forwarded message ----- > > > > > > > > > > > >How do I fix the above scenario? Again this custoemr is using smpro > > > >newletter > > > >to send out to customer and this is not a Fraud! > > > > > > Serveral options... :) > > > > > > 1] disable fraud detection > > > 2] buy support and urge Julian to fix it > > > 3] sit and wait till julian has time > > > 4] fix it yourself > > > > > > > Julian did make mention of adding the domain/IP to the phishing file. > > > > This does concern us all as we are trying to fight Fraud and spam. > > some good news, is that if unsubscribe is not present, the e-newsletter > is listed as spam. > > Question, even though my localhost is send the e-newsletter to others, > MAilScanner is taging this as fraud; Should I be listing > the host IP or the sender IP? > The customer did further test and here are the results: Here are the test results with the problem feature ON: Test #5 - No unsubscribe link, disabled the "Powered by SubscribeMePro" notice: Results: tagged as "spam?" on mail to Bennaco - mail to Hotmail account went missing...? not delivered. Test #6 - Unsubscribe link included, disabled the "Powered by SubscribeMePro" notice: Results: tagged as "fraud?"- same for both addresses Test #7 - Unsubscribe link included, includes "Powered by SubscribeMePro" notice: Results: tagged as "fraud?" - same for both addresses Test #8 - No unsubscribe link, includes "Powered by SubscribeMePro" notice: Results: not tagged, - same for both addresses --- Any logical explanation? > > > Pick one :) > > > > > > Bye, > > > Raymond. > > > > > > ------------------------ MailScanner list ------------------------ > > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > > 'leave mailscanner' in the body of the email. > > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > > > > > -- > > > This message has been scanned for viruses and > > > dangerous content by MailScanner, and is > > > believed to be clean. > > > > > > > -- > > This message has been scanned for viruses and > > dangerous content by MailScanner, and is > > believed to be clean. > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jd at BARITEC.COM Mon Oct 3 19:58:35 2005 From: jd at BARITEC.COM (JD Doelitzsch) Date: Thu Jan 12 21:30:52 2006 Subject: FW: MailScanner not catching eicar Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Thanks for the help guys, I appreciate it. Julian, I changed the virus.scanners.conf instead. I don't know what I was thinking, everything else is a .conf. On a side note, I remember hearing someone on this list mention a milter that creates a dummy address for spam bait that will blacklist the sending ip for x amount of days. Anyone remember what it was called? -JD -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On Behalf Of Julian Field Sent: Saturday, October 01, 2005 6:37 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: FW: MailScanner not catching eicar -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 One extra point. Don't change the -wrapper scripts, that's wrong and will be overwritten the next time you upgrade. What you should be doing is editing /etc/MailScanner/virus.scanners.conf as that tells MailScanner where the virus scanners are installed. You don't ever have to change my code, there are configuratioon files to do what you want. JD Doelitzsch wrote: >-----Original Message----- >From: JD Doelitzsch [mailto:jd@baritec.com] >Sent: Friday, September 30, 2005 2:46 PM >To: MailScanner mailing list >Subject: MailScanner not catching eicar > > >Hey guys it's been a while since i wrote to the list but once again im >stumped. > >Im running Fedora core 1 the latest from RHN, installed clam AV 8.7 and the >lastest MailScanner build. Sendmail is pushing the mail to my "exchange" >server but it doesn't seem like Mailscanner is getting to it. I originally >thought that it was the clamav-wrapper which pointed to /usr/bin instead of >usr/local/bin so once i corrected it worked fine when I ran it. I looked at >the webinfo that said Add the domain name to /etc/mail/relay-domains. I >didn't have that file so I created it with mydomain.com in it. I look at top >and when email comes in I see the sendmail process but no mailscanner or >clamscan. I restart Mailscanner to verify its up and its up. >MailScanner.conf looks okay to me, so im fresh out of ideas. anyone care to >take a shot? > >-JD > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQz6Q7hH2WUcUFbZUEQJ5dQCghbcxwL3qll1Map7aUS2+eWz98EMAnRls nDBV/OC566GtsJ8MoNeSmdN9 =6mqt -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jd at BARITEC.COM Mon Oct 3 22:52:37 2005 From: jd at BARITEC.COM (JD Doelitzsch) Date: Thu Jan 12 21:30:52 2006 Subject: securing relay... Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hey guys, Im not sure if this has to do with MailScanner or not, because its just totally beyond me, maybe you can shed some light or point me in the right direction. The setup is MailScanner pushes to exchange via Mailertable/sendmail. Access only has mydomain.com in it. When I telnet to the MS box relay-denied(good) when trying to send other than mydomain.net as far as i can tell, But when monitoring packets I see spam originating or relaying from my MS server to the net. It's getting me blacklisted. What kind of command lets people relay? thats the one thing i can't verify when looking through the packets. I would like the MSbox only to relay to my exchange server and nowhere else. The only thing i can think or is to put a firewall on the MS box to only allow outgoing to my exchange box. What would be the forseeable results of that? is there a better way? -JD ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From peter at UCGBOOK.COM Mon Oct 3 23:30:16 2005 From: peter at UCGBOOK.COM (Peter Bonivart) Date: Thu Jan 12 21:30:52 2006 Subject: securing relay... Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] JD Doelitzsch wrote: > Im not sure if this has to do with MailScanner or not, because its just > totally beyond me, maybe you can shed some light or point me in the right > direction. The setup is MailScanner pushes to exchange via > Mailertable/sendmail. Access only has mydomain.com in it. When I telnet to > the MS box relay-denied(good) when trying to send other than mydomain.net as > far as i can tell, But when monitoring packets I see spam originating or > relaying from my MS server to the net. It's getting me blacklisted. What > kind of command lets people relay? thats the one thing i can't verify when > looking through the packets. I would like the MSbox only to relay to my > exchange server and nowhere else. The only thing i can think or is to put a > firewall on the MS box to only allow outgoing to my exchange box. What would > be the forseeable results of that? is there a better way? You can test for open relays here: http://www.abuse.net/relay.html -- /Peter Bonivart --Unix lovers do it in the Sun ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From james at grayonline.id.au Mon Oct 3 22:34:07 2005 From: james at grayonline.id.au (James Gray) Date: Thu Jan 12 21:30:52 2006 Subject: rule failing lint test Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Monday 03 October 2005 09:52, Jon Miller wrote: > I've put in a rule that seems to be failing the --lint test. What I'm > looking for is in the subject line since there is a # there is this not > treated as a remark or is this read as normal information? > Rule 28 SNIP > # 28 Subject: $B;(;o$G$*Fk\@w$_!#CO0hJL$K??7u$J=P(B > header PROLO_GSPAM28 Subject =~ > /\$B;\(;o\$G\$\*Fk\@w\$_!#CO0hJL\$K\?\?7u\$J=P\(B/i score PROLO_GSPAM28 8 > describe PROLO_GSPAM28 Spam - Custom rule setJames You need to escape "\", "!", "#", AND the "@" (not sure about the semi-colon but when in doubt, escape it anyway). So (assuming no escaping of the ";"): /\$B....Fk\\\@w\$_\!\#CO0h.../i HTH, James -- *** PUBLIC flooding detected from erikyyy THAT's an erik, pholx.... ;) -- Seen on #LinuxGER ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From james at grayonline.id.au Mon Oct 3 22:25:50 2005 From: james at grayonline.id.au (James Gray) Date: Thu Jan 12 21:30:52 2006 Subject: curious about body rules Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Monday 03 October 2005 10:18, Jon Miller wrote: > If I create a rule that checks the body content for certain words, can I > just keep adding words to this one rule? It's to my understanding that SA > will search the body of the e-mail for the words that are listed. > > example: > body BodyTest_RULE /porn market penis calis/ i > score BodyTest_RULE 4.0 > describe BodyTest_RULE This body test rule Close, but no cigar ;) The bit between the /.../ is a Perl regex and is matched, basically, as literal string. To achieve what you are trying, the correct syntax is: body BodyTest_RULE /(?:porn|market|penis|calis)/i You may want to add the word-boundary delimiter "\b" before and after the parenthesis. This will cause a match of each of the words but only if they occur BETWEEN word boundaries. There's a great Perl regex primer at: http://www.anaesthetist.com/mnm/perl/regex.htm FWIW, the words you're trying to catch are usually heavily obfuscated so simple key-word matches are usually ineffective. A number of people (including myself) have written custom rulesets for SpamAssassin that you can just load up and save yourself a heap of time and effort. Google for the "SpamAssassin Rules Emporium" and here's the shameless self-promotion: http://files.grayonline.id.au/ Hope that helps. Cheers, James -- Keep your eyes wide open before marriage, half shut afterwards. -- Benjamin Franklin ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Mon Oct 3 23:30:32 2005 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:30:52 2006 Subject: securing relay... Message-ID: MailScanner mailing list <> scribbled on Monday, October 03, 2005 4:53 PM: > Hey guys, > > Im not sure if this has to do with MailScanner or not, > because its just totally beyond me, maybe you can shed some > light or point me in the right direction. The setup is > MailScanner pushes to exchange via Mailertable/sendmail. > Access only has mydomain.com in it. When I telnet to the MS > box relay-denied(good) when trying to send other than > mydomain.net as far as i can tell, But when monitoring > packets I see spam originating or relaying from my MS server > to the net. It's getting me blacklisted. What kind of command > lets people relay? thats the one thing i can't verify when > looking through the packets. I would like the MSbox only to > relay to my exchange server and nowhere else. The only thing > i can think or is to put a firewall on the MS box to only > allow outgoing to my exchange box. What would be the > forseeable results of that? is there a better way? > > -JD /etc/mail/access should not have mydomain.com in it. mydomain.com should be in /etc/mail/relay-domains I suspect that someone is using your sendmail box to send out spam from user@mydomain.com Since you have mydomain.com in your access file, you are allowing them to relay. What does your maillog show? Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From vachanta at GMAIL.COM Tue Oct 4 00:31:08 2005 From: vachanta at GMAIL.COM (Venkata Achanta) Date: Thu Jan 12 21:30:52 2006 Subject: securing relay... Message-ID: >/etc/mail/access should not have mydomain.com in it. > >mydomain.com should be in /etc/mail/relay-domains > >I suspect that someone is using your sendmail box to send out spam from >user@mydomain.com Since you have mydomain.com in your access file, you are >allowing them to relay. What does your maillog show? > >Mike True.your /etc/mail/access should contain only localhost and all the allowed relay domains should be listed in /etc/mail/relay-domains ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From david at GRECCOCONSULTING.COM Tue Oct 4 00:33:30 2005 From: david at GRECCOCONSULTING.COM (David Grecco) Date: Thu Jan 12 21:30:52 2006 Subject: securing relay... Message-ID: JD, I have the exact same setup. Make sure you specify in the access table of Sendmail (Spam Control if you are using Webmin) to only allow relay from the IP of your Exchange Server (i.e. Connect:10.10.10.10 RELAY in /etc/mail/access). The IP will most likely be the Public IP of your exchange server unless you are running a vpn tunnel or private connection between the two (not a bad idea). Also, make sure that on your exchange server you only allow connections from the MailScanner server. Hope this helps. Feel free to contact me directly if you want me to elaborate. David Grecco -----Original Message----- From: owner-mailscanner@jiscmail.ac.uk [mailto:owner-mailscanner@jiscmail.ac.uk] On Behalf Of JD Doelitzsch Sent: Monday, October 03, 2005 4:53 PM To: MailScanner mailing list Subject: securing relay... Hey guys, Im not sure if this has to do with MailScanner or not, because its just totally beyond me, maybe you can shed some light or point me in the right direction. The setup is MailScanner pushes to exchange via Mailertable/sendmail. Access only has mydomain.com in it. When I telnet to the MS box relay-denied(good) when trying to send other than mydomain.net as far as i can tell, But when monitoring packets I see spam originating or relaying from my MS server to the net. It's getting me blacklisted. What kind of command lets people relay? thats the one thing i can't verify when looking through the packets. I would like the MSbox only to relay to my exchange server and nowhere else. The only thing i can think or is to put a firewall on the MS box to only allow outgoing to my exchange box. What would be the forseeable results of that? is there a better way? -JD ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by the GCS Mail Gateway, and is believed to be clean. -- This message has been scanned for viruses and dangerous content by the GCS Mail Gateway, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Tue Oct 4 09:16:44 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:30:52 2006 Subject: securing relay... Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > Hey guys, > > Im not sure if this has to do with MailScanner or not, because its just > totally beyond me, maybe you can shed some light or point me in the > right > direction. The setup is MailScanner pushes to exchange via > Mailertable/sendmail. Access only has mydomain.com in it. When I telnet > to > the MS box relay-denied(good) when trying to send other than > mydomain.net as > far as i can tell, But when monitoring packets I see spam originating or > relaying from my MS server to the net. It's getting me blacklisted. What > kind of command lets people relay? thats the one thing i can't verify > when > looking through the packets. I would like the MSbox only to relay to my > exchange server and nowhere else. The only thing i can think or is to > put a > firewall on the MS box to only allow outgoing to my exchange box. What > would > be the forseeable results of that? is there a better way? > > -JD Check the results of 'telnet relay-test.mail-abuse.org' from a shell on your mail server.. Fix the problem for whatever is allowed to relay. Also read this once again if you haven't already, theres always something that you could have missed out on :) http://wiki.mailscanner.info/doku.php?id=best_practices - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Tue Oct 4 09:34:10 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:30:52 2006 Subject: securing relay... Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mr. Derek Winkler appears to be out of office for the next 2 weeks, can Mr. Root do the needful? Someone in Toronto could also call the Help desk at 416-217-1500 Ext 3000 and leave some high priority messages. - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Oct 4 09:58:53 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:52 2006 Subject: securing relay... Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Mr Root strikes! And he wins :-) (Don't mind me...) On 4 Oct 2005, at 09:34, Dhawal Doshy wrote: > Mr. Derek Winkler appears to be out of > office for the next 2 weeks, can Mr. Root do the needful? > > Someone in Toronto could also call the Help desk at 416-217-1500 > Ext 3000 and leave some high priority messages. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ0JEUPw32o+k+q+hAQFnRQgAlk3A5bbExz5q7A76hqgAAyNOd4YjLlQX sesvMIk/4Bb5yhvysd89MF7tELWVLkw6WVIntSS6JFLKK7cH1d0JD9brUABeVL6F SBhD0UonzI2XVCRBUE/RjrtAVsHX6o4mrL0jFEM3Cui7Zx9QfJmkxMPLdOxV9BPh yA98PymPBLZomvdZuAmtQlGHYNPLg6JjM8Jv1xjI3si0cVfbFKMfX+mrDnKD8KOy CUftWNa29dynlZLsa+PiyHlxqyaNlCnG/AeC3/S+m5Ccnr7bdzBiwBJSFzGG6LDV Lkea0xJenApfKmsdPz3XBAiBk5XMGHoXO+AZhbgR5kEeBasdGkI0Vw== =tQPV -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Tue Oct 4 10:19:27 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:30:52 2006 Subject: securing relay... Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Tue, October 4, 2005 09:58, Julian Field wrote: > -----BEGIN PGP SIGNED MESSAGE----- > > Mr Root strikes! And he wins :-) > (Don't mind me...) Oooo the power and control of the man. Can I hear swooning from ladies all around Southampton? I'm sure I could hear screaming along the coast here in Brighton. Did Mr Root make a public appearance?? :-) > > On 4 Oct 2005, at 09:34, Dhawal Doshy wrote: > >> Mr. Derek Winkler appears to be out of >> office for the next 2 weeks, can Mr. Root do the needful? >> >> Someone in Toronto could also call the Help desk at 416-217-1500 >> Ext 3000 and leave some high priority messages. :-D -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Oct 4 11:07:28 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:52 2006 Subject: securing relay... Message-ID: -----BEGIN PGP SIGNED MESSAGE----- On 4 Oct 2005, at 10:19, Drew Marshall wrote: > On Tue, October 4, 2005 09:58, Julian Field wrote: > >> -----BEGIN PGP SIGNED MESSAGE----- >> >> Mr Root strikes! And he wins :-) >> (Don't mind me...) >> > > Oooo the power and control of the man. Can I hear swooning from > ladies all > around Southampton? I'm sure I could hear screaming along the coast > here > in Brighton. Did Mr Root make a public appearance?? :-) Nah, he just farted :-) > > >> >> On 4 Oct 2005, at 09:34, Dhawal Doshy wrote: >> >> >>> Mr. Derek Winkler appears to be out of >>> office for the next 2 weeks, can Mr. Root do the needful? >>> >>> Someone in Toronto could also call the Help desk at 416-217-1500 >>> Ext 3000 and leave some high priority messages. >>> > > :-D > > > -- > In line with our policy, this message has > been scanned for viruses and dangerous > content by MailScanner, and is believed to be clean. > www.themarshalls.co.uk/policy > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ0JUY/w32o+k+q+hAQGuSwf/cMdXzoRm5zGfieCfwRJDf9EQOLm+NILu Uhd2+a7sqcBfaJ6wSygrj2S32+BdWUKzCsEJQkOpQySR9tN6CYqNB2uq9tX9JP2k qGbfQRDzNjs/nr9hihhHUHlJcTcmEG00no079QUDeLcTqA+hSeWc6+kIShYRNDZE BXQmjPrWxf8kVvNgWk4tKrMG6BkjgYv5KZS3QOiFHoRIpRDVhrS1nW2zpXlG59Ni 1DzIrcNPYaj9enD+U7TGEjxtOlUFyNQls2uuHpHqH1XfsS9nHk5Mum8FRriNIYsa AtAvTGdKdfVwU7aQYEXnsj8SSdLjCWmUXWu5q2r/agEPZK3czGMnhw== =QX3T -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner-user at NELAND.DK Tue Oct 4 12:54:29 2005 From: mailscanner-user at NELAND.DK (Leif Neland) Date: Thu Jan 12 21:30:52 2006 Subject: securing relay... Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dhawal Doshy wrote: > > Check the results of 'telnet relay-test.mail-abuse.org' from a shell > on your mail server.. > It should be 'telnet relay-test.mail-abuse.org 25' Leif -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Tue Oct 4 13:04:10 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:30:52 2006 Subject: securing relay... Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Leif Neland wrote: > Dhawal Doshy wrote: > >> >> Check the results of 'telnet relay-test.mail-abuse.org' from a shell >> on your mail server.. >> > It should be 'telnet relay-test.mail-abuse.org 25' > > Leif > > No.. it is 'telnet relay-test.mail-abuse.org' without the 25, using 25 will open a SMTP session with the MTA on their server. [root@skynet im]# telnet relay-test.mail-abuse.org 25 Trying 168.61.4.13... Connected to relay-test.mail-abuse.org. Escape character is '^]'. 220 cygnus.mail-abuse.org ESMTP Postfix quit 221 Bye Connection closed by foreign host. - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Nicolas.Schmitz at EC-NANTES.FR Tue Oct 4 13:12:00 2005 From: Nicolas.Schmitz at EC-NANTES.FR (Nicolas Schmitz) Date: Thu Jan 12 21:30:52 2006 Subject: ProcessClamAVOutput unrecognised line (with up-to-date clamav) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, I've got a little trouble here, from time to time I see the following lines in mail.log : MailScanner[17637]: poster.pdf MailScanner[17637]: ProcessClamAVOutput: unrecognised line "poster.pdf". Please contact the authors! MailScanner (4.41.3-2) is running on Debian sarge , with latest clamav package from volatile : 0.87-0volatile1. it's really annoying because I use logcheck, and I can't exclude that kind of lines... Am I the only one who have this problem ? Thanks. -- Nicolas Schmitz Centre de Ressources Informatiques | tel : 02 40 37 68 06 Ecole Centrale de Nantes | fax : 02 40 37 25 78 1 rue de la Noe - BP 92101 44321 NANTES CEDEX 03 http://www.ec-nantes.fr ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mikea at MIKEA.ATH.CX Tue Oct 4 15:53:49 2005 From: mikea at MIKEA.ATH.CX (mikea) Date: Thu Jan 12 21:30:52 2006 Subject: ProcessClamAVOutput unrecognised line (with up-to-date clamav) Message-ID: On Tue, Oct 04, 2005 at 02:12:00PM +0200, Nicolas Schmitz wrote: > Hi, > I've got a little trouble here, from time to time I see the following > lines in mail.log : > > MailScanner[17637]: poster.pdf > MailScanner[17637]: ProcessClamAVOutput: unrecognised line "poster.pdf". > Please contact the authors! > > MailScanner (4.41.3-2) is running on Debian sarge , with latest clamav > package from volatile : 0.87-0volatile1. > > it's really annoying because I use logcheck, and I can't exclude that > kind of lines... > > Am I the only one who have this problem ? No. I find it merely an annoyance, though, not a problem. Oct 4 00:35:50 isdmona MailScanner[14105]: Virus and Content Scanning: Starting Oct 4 00:35:51 isdmona MailScanner[14105]: /var/spool/MailScanner/incoming/14105/./j945ZnFh031367/msg-14105-159.txt: Empty file Oct 4 00:35:51 isdmona MailScanner[14105]: ProcessClamAVOutput: unrecognised line "/var/spool/MailScanner/incoming/14105/./j945ZnFh031367/msg-14105-159.txt: Empty file". Please contact the authors! It appears to happen only when the spammer sends an empty attachment, though I haven't looked into it very deeply. -- Mike Andrews, W5EGO mikea@mikea.ath.cx Tired old sysadmin ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kwang at UCALGARY.CA Tue Oct 4 18:25:47 2005 From: kwang at UCALGARY.CA (Kai Wang) Date: Thu Jan 12 21:30:52 2006 Subject: A big message overwhelmed MailScanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, We are running MailScanner 4.43.8. Our message size limit is 50M. I noticed a valid message was stuck in MailScanner for over an hour. The server's load was very high and email processing was very slow. Eventually I had to move it to the delivery queue manually. Does anybody know what's the best practice for this situation? -rw------- 1 root root 48384095 Oct 4 09:57 dfj94FuH024035 -rw------- 1 root root 867 Oct 4 09:57 qfj94FuH024035 Oct 4 09:57:20 smtp1 pc214-161.psych.ucalgary.ca [136.159.214.161]: DATA[24035]: j94FuH024035: from=, size=48384415, class=0, nrcpts=1, msgid=, proto=ESMTP, daemon=MTA, mech=PLAIN, relay=pc214-161.psych.ucalgary.ca [136.159.214.161] Oct 4 09:57:20 smtp1 pc214-161.psych.ucalgary.ca [136.159.214.161]: DATA[24035]: j94FuH024035: to=, delay=00:01:03, mailer=relay, pri=48414415, stat=queued Oct 4 09:57:21 smtp1 pc214-161.psych.ucalgary.ca [136.159.214.161]: DATA[24035]: NOQUEUE: --> 250 2.0.0 j94FuH024035 Message accepted for delivery Oct 4 09:57:21 smtp1 MailScanner[7673]: Saved archive copies of j94FuH024035 Oct 4 10:07:39 smtp1 MailScanner[8930]: Saved archive copies of j94G7W029517 j94FuH024035 Oct 4 10:18:02 smtp1 MailScanner[1963]: Saved archive copies of j94GHv001891 j94G7W029517 j94FuH024035 j94GHx001902 j94GHv001893 j94GHx001907 j94GHx001912 j94GHt001887 j94GHx001908 Oct 4 10:28:27 smtp1 MailScanner[7135]: Saved archive copies of j94GHv001891 j94G7W029517 j94FuH024035 j94GHx001902 j94GHv001893 j94GHx001907 j94GHx001912 j94GHt001887 j94GHx001908 Oct 4 10:38:44 smtp1 MailScanner[7847]: Saved archive copies of j94GHv001891 j94G7W029517 j94FuH024035 j94GHx001902 j94GHv001893 j94GHx001907 j94GHx001912 j94GHt001887 j94GHx001908 Oct 4 10:49:07 smtp1 MailScanner[16427]: Saved archive copies of j94GHv001891 j94G7W029517 j94FuH024035 j94GHx001902 j94GHv001893 j94GHx001907 j94GHx001912 j94GHt001887 j94GHx001908 Oct 4 10:53:26 smtp1 MailScanner[18665]: Saved archive copies of j94GHv001891 j94GrOJ18662 j94Gr0018612 j94Gqt018568 j94G7W029517 j94FuH024035 j94GHx001902 j94Gqv018575 j94GHv001893 j94GHx001907 j94Gqv018574 j94Gqt018562 j94Gqq018538 j94Gqr018549 j94GHx001912 j94Gqr018543 j94Gqp018536 j94GHt001887 j94GHx001908 Oct 4 11:03:42 smtp1 MailScanner[18996]: Saved archive copies of j94GHv001891 j94GrOJ18662 j94Gr0018612 j94Gqt018568 j94G7W029517 j94FuH024035 j94GHx001902 j94Gqv018575 j94GHv001893 j94GHx001907 j94Gqv018574 j94Gqt018562 j94Gqq018538 j94Gqr018549 j94GHx001912 j94Gqr018543 j94Gqp018536 j94GHt001887 j94GHx001908 Thanks -- Kai Wang System Services Information Technologies, University of Calgary, 2500 University Drive, N.W., Calgary, Alberta, Canada T2N 1N4 Phone (403) 220-2423, Fax (403) 282-9361 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Oct 4 16:54:16 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:52 2006 Subject: ProcessClamAVOutput unrecognised line (with up-to-date clamav) Message-ID: -----BEGIN PGP SIGNED MESSAGE----- On 4 Oct 2005, at 15:53, mikea wrote: > On Tue, Oct 04, 2005 at 02:12:00PM +0200, Nicolas Schmitz wrote: > >> Hi, >> I've got a little trouble here, from time to time I see the following >> lines in mail.log : >> >> MailScanner[17637]: poster.pdf >> MailScanner[17637]: ProcessClamAVOutput: unrecognised line >> "poster.pdf". >> Please contact the authors! >> >> MailScanner (4.41.3-2) is running on Debian sarge , with latest >> clamav >> package from volatile : 0.87-0volatile1. >> >> it's really annoying because I use logcheck, and I can't exclude that >> kind of lines... >> >> Am I the only one who have this problem ? >> > > No. I find it merely an annoyance, though, not a problem. > > Oct 4 00:35:50 isdmona MailScanner[14105]: Virus and Content > Scanning: Starting > Oct 4 00:35:51 isdmona MailScanner[14105]: /var/spool/MailScanner/ > incoming/14105/./j945ZnFh031367/msg-14105-159.txt: Empty file > Oct 4 00:35:51 isdmona MailScanner[14105]: ProcessClamAVOutput: > unrecognised line "/var/spool/MailScanner/incoming/14105/./ > j945ZnFh031367/msg-14105-159.txt: Empty file". Please contact the > authors! > > It appears to happen only when the spammer sends an empty attachment, > though I haven't looked into it very deeply. Don't worry, it is quite harmless. If you want to stop it doing this, apply this patch: - --- SweepViruses.pm.old 2005-07-11 16:44:22.000000000 +0100 +++ SweepViruses.pm 2005-10-04 16:52:35.874101033 +0100 @@ -2466,7 +2466,8 @@ $logline = $line; $logline =~ s/%/%%/g; MailScanner::Log::WarnLog("ProcessClamAVOutput: unrecognised " . - - "line \"$logline\". Please contact the authors!"); + "line \"$logline\". Please contact the authors!") + unless $logline =~ /Empty.*file/; return 0; } That is for /usr/lib/MailScanner/MailScanner/SweepViruses.pm. Remove one line and replace it with 2 new lines. Pretty obvious I hope :-) - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ0Klqfw32o+k+q+hAQEscAf9Gp8BJFuF8iK29iUaWIgsf1Ke7a0Vhdif XaPpM0E9jTWkK+7g+JFo7CgkxqeevR9/IawQkyXMV2vysC1LFWlvTitqPlKerrcV /mEzu4hGtYXAU02Zq1DjdT8IdC6vKZK7HlI1Zk9iTliUP9j5U+mWOvva9Ow2isUb eu1p2xLDQ4EtNitte6zv5XgI53jbbciHPD+GZMQvUuN0hqV/c2bVQGWJ6GOZSjRH RevATtuwRhgy2ER4dK/iscpJwkMusvYgiGB+C0iJyLYH+B257WNIfLL5V1nk04Fz 0ysOoxLikULlJEFCWU/A4jNsHsRA4DIf7EYR02VMOf0cwT+Bg0jNgw== =tJ/b -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Oct 4 18:52:18 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:52 2006 Subject: A big message overwhelmed MailScanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 From the fact that several different MailScanner processes all tried to process the same message, I would say your "Lock Type" is set wrong. What version of sendmail are you using and what operating system and distribution are you using? If you are using Linux and sendmail 8.13.1 or greater, then you need to set Lock Type = posix in your MailScanner.conf. You will then need to "service MailScanner restart". Kai Wang wrote: > Hi, > > We are running MailScanner 4.43.8. Our message size limit is 50M. I > noticed a valid message was stuck in MailScanner for over an hour. The > server's load was very high and email processing was very slow. > Eventually I had to move it to the delivery queue manually. Does > anybody know what's the best practice for this situation? > > -rw------- 1 root root 48384095 Oct 4 09:57 dfj94FuH024035 > -rw------- 1 root root 867 Oct 4 09:57 qfj94FuH024035 > > Oct 4 09:57:20 smtp1 pc214-161.psych.ucalgary.ca [136.159.214.161]: > DATA[24035]: j94FuH024035: from=, size=48384415, > class=0, nrcpts=1, > msgid=, proto=ESMTP, > daemon=MTA, mech=PLAIN, relay=pc214-161.psych.ucalgary.ca > [136.159.214.161] > Oct 4 09:57:20 smtp1 pc214-161.psych.ucalgary.ca [136.159.214.161]: > DATA[24035]: j94FuH024035: to=, delay=00:01:03, > mailer=relay, pri=48414415, stat=queued > Oct 4 09:57:21 smtp1 pc214-161.psych.ucalgary.ca [136.159.214.161]: > DATA[24035]: NOQUEUE: --> 250 2.0.0 j94FuH024035 Message accepted for > delivery > Oct 4 09:57:21 smtp1 MailScanner[7673]: Saved archive copies of > j94FuH024035 > Oct 4 10:07:39 smtp1 MailScanner[8930]: Saved archive copies of > j94G7W029517 j94FuH024035 > Oct 4 10:18:02 smtp1 MailScanner[1963]: Saved archive copies of > j94GHv001891 j94G7W029517 j94FuH024035 j94GHx001902 j94GHv001893 > j94GHx001907 j94GHx001912 j94GHt001887 j94GHx001908 > Oct 4 10:28:27 smtp1 MailScanner[7135]: Saved archive copies of > j94GHv001891 j94G7W029517 j94FuH024035 j94GHx001902 j94GHv001893 > j94GHx001907 j94GHx001912 j94GHt001887 j94GHx001908 > Oct 4 10:38:44 smtp1 MailScanner[7847]: Saved archive copies of > j94GHv001891 j94G7W029517 j94FuH024035 j94GHx001902 j94GHv001893 > j94GHx001907 j94GHx001912 j94GHt001887 j94GHx001908 > Oct 4 10:49:07 smtp1 MailScanner[16427]: Saved archive copies of > j94GHv001891 j94G7W029517 j94FuH024035 j94GHx001902 j94GHv001893 > j94GHx001907 j94GHx001912 j94GHt001887 j94GHx001908 > Oct 4 10:53:26 smtp1 MailScanner[18665]: Saved archive copies of > j94GHv001891 j94GrOJ18662 j94Gr0018612 j94Gqt018568 j94G7W029517 > j94FuH024035 j94GHx001902 j94Gqv018575 j94GHv001893 j94GHx001907 > j94Gqv018574 j94Gqt018562 j94Gqq018538 j94Gqr018549 j94GHx001912 > j94Gqr018543 j94Gqp018536 j94GHt001887 j94GHx001908 > Oct 4 11:03:42 smtp1 MailScanner[18996]: Saved archive copies of > j94GHv001891 j94GrOJ18662 j94Gr0018612 j94Gqt018568 j94G7W029517 > j94FuH024035 j94GHx001902 j94Gqv018575 j94GHv001893 j94GHx001907 > j94Gqv018574 j94Gqt018562 j94Gqq018538 j94Gqr018549 j94GHx001912 > j94Gqr018543 j94Gqp018536 j94GHt001887 j94GHx001908 > > Thanks > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQ0LBUxH2WUcUFbZUEQKMeACgvJKpF8mRgaDLU6GJfNHuCrCm1VIAn27A PxhZvsli7IVOF7KJEhsm/tx6 =v9LZ -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From PHachey at CITY.CORNWALL.ON.CA Tue Oct 4 21:26:49 2005 From: PHachey at CITY.CORNWALL.ON.CA (Philip Hachey) Date: Thu Jan 12 21:30:52 2006 Subject: Workaround for MailScanner RPM installation when using 'Perl from source' Message-ID: I have been using MailScanner for some time now. I have it installed on a WhiteBox 3 (clone of RHEL 3) server. Prior to the recent MailScanner upgrade (via RPMs), I had installed the most recent version of Perl (5.8.7) from the source available at CPAN. In addition to the operating system RPM version of Perl (5.8.0) located under /usr/lib/perl5, I now have this new version of Perl located under /usr/local/lib/perl5. I also swapped /usr/bin/perl with a symbolic link to /usr/local/bin/perl. When MailScanner installs, it recognizes both Perls, but during the installation of MailScanner's included Perl RPM modules, the paths it decides to use for the installation are /usr/lib/perl5/5.8.7 and /usr/lib/perl5/site_perl/5.8.7 . POSSIBLE FIX: The correct paths would have been used if, in the spec file of each of the Perl RPMs, the call to 'perl Makefile.PL' did NOT include the PREFIX argument. TEMPORARY WORKAROUND: Before installing MailScanner, do the following: # ln --symbolic /usr/local/lib/perl5/5.8.7 /usr/lib/perl5/5.8.7 # ln --symbolic /usr/local/lib/perl5/site_perl/5.8.7 /usr/lib/perl5/site_perl/5.8.7 There is an additional problem I've noticed that, after having used CPAN to grab the latest version of various Perl modules, MailScanner will still install a lower version: those modules marked "IsABundle" in install.sh. Is this intentional? Should I not be upgrading these modules via CPAN? ---------------------------------- Philip J. Hachey, BCS(High Hons) Programmer-Analyst City of Cornwall ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From vachanta at GMAIL.COM Tue Oct 4 22:01:23 2005 From: vachanta at GMAIL.COM (Venkata Achanta) Date: Thu Jan 12 21:30:52 2006 Subject: OT - Anti DOS tips for sendmail configuration Message-ID: Hello all, I came across this,just wanted to share this with the list.Most of these tips n tricks have been posted on this list already. http://www.technoids.org/dossed.html Thanks much, Venkata Achanta ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kwang at UCALGARY.CA Tue Oct 4 23:59:47 2005 From: kwang at UCALGARY.CA (Kai Wang) Date: Thu Jan 12 21:30:52 2006 Subject: A big message overwhelmed MailScanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] We are running sendmail 8.11.7. It does not seem to be a lock problem. I re-put the message to the incoming queue. You can see the load went up quickly. According to lsof command, only one MailScanner process opened the qf file. After about 10 minutes, I found the MailScanner process ID changed from lsof command output. The original MailScanner process disappeared. There was another log entry. I guess the previous uvscan probably timed out and the original MailScanner process went away and released the lock. # How to lock spool files. # Don't set this unless you *know* you need to. # For sendmail, it defaults to "flock". # For sendmail 8.13 onwards, you will probably need to change it to posix. # For Exim, it defaults to "posix". # No other type is implemented. Lock Type = [root@smtp1 mqueue.in]# uname -a Linux smtp1.ucalgary.ca 2.4.21-15.EL #1 Thu Apr 22 00:27:41 EDT 2004 i686 i686 i386 GNU/Linux [root@smtp1 mqueue.in]# cat /etc/redhat-release Red Hat Enterprise Linux AS release 3 (Taroon Update 2) [root@smtp1 mqueue.in]# /usr/sbin/sendmail -d0.1 -bt < /dev/null Version 8.11.7 Compiled with: LDAPMAP MAP_REGEX LOG MATCHGECOS MIME7TO8 MIME8TO7 NAMED_BIND NETINET NETINET6 NETUNIX NEWDB NIS QUEUE SASL SCANF SFIO SMTP STARTTLS TCPWRAPPERS USERDB ============ SYSTEM IDENTITY (after readcf) ============ (short domain name) $w = smtp1 (canonical domain name) $j = smtp1.ucalgary.ca (subdomain name) $m = ucalgary.ca (node name) $k = smtp1.ucalgary.ca ======================================================== ADDRESS TEST MODE (ruleset 3 NOT automatically invoked) Enter
[root@smtp1 test]# ls -l /var/spool/mqueue.in/qfj94FuH024035 -rw------- 1 root root 868 Oct 4 16:39 /var/spool/mqueue.in/qfj94FuH024035 [root@smtp1 test]# top 16:41:07 up 25 days, 16:25, 2 users, load average: 5.73, 3.25, 2.52 63 processes: 59 sleeping, 4 running, 0 zombie, 0 stopped CPU states: cpu user nice system irq softirq iowait idle total 84.4% 0.0% 15.2% 0.0% 0.4% 0.0% 0.0% Mem: 2064640k av, 2043832k used, 20808k free, 0k shrd, 174268k buff 1358992k actv, 406880k in_d, 39624k in_c Swap: 2048248k av, 1756k used, 2046492k free 1587096k cached PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND 18369 root 25 0 24328 23M 1872 R 43.2 1.1 0:18 0 uvscan 1234 root 20 0 18952 18M 2264 S 23.4 0.9 3:20 0 MailScanner 1702 root 21 0 18960 18M 2224 S 3.4 0.9 3:01 0 MailScanner 18660 root 21 0 3996 3996 2824 R 1.6 0.1 0:00 0 sendmail 1513 root 21 0 19236 18M 2224 S 0.2 0.9 3:10 0 MailScanner [root@smtp1 test]# lsof /var/spool/mqueue.in/qfj94FuH024035 COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME MailScann 6523 root 6uW REG 8,7 868 95817 /var/spool/mqueue.in/qfj94FuH024035 [root@smtp1 test]# lsof /var/spool/mqueue.in/qfj94FuH024035 COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME MailScann 1395 root 6uW REG 8,7 868 95817 /var/spool/mqueue.in/qfj94FuH024035 [root@smtp1 test]# ps -ef | grep MailScan root 18664 1 0 10:53 ? 00:00:00 /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf root 1024 18664 2 14:54 ? 00:03:01 /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf root 1133 18664 3 14:54 ? 00:03:52 /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf root 1234 18664 3 14:54 ? 00:03:38 /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf root 1277 18664 2 14:54 ? 00:03:17 /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf root 1395 18664 3 14:54 ? 00:04:03 /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf root 1513 18664 3 14:55 ? 00:03:36 /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf root 1702 18664 2 14:55 ? 00:03:25 /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf root 2220 18664 3 14:56 ? 00:03:39 /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf root 9999 18664 3 15:12 ? 00:03:26 /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf root 21822 18664 2 16:50 ? 00:00:05 /usr/bin/perl -I/usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf root 22995 28404 0 16:53 pts/0 00:00:00 grep MailScan Oct 4 16:40:05 smtp1 MailScanner[6523]: Saved archive copies of j94Me2J18130 j94Me2J18147 j94Me1J18118 j94Me1J18120 j94Me1J18042 j94Me2J18139 j94Me3J18155 j94Me2J18137 j94Me3J18153 j94Me2J18133 j94Me2J18149 j94Me2J18131 j94FuH024035 j94Me2J18128 j94Me2J18126 j94Me1J18116 j94Me1J18114 j94Me3J18157 j94Me2J18141 j94Me2J18151 j94Me1J18122 j94Me2J18135 j94Me2J18145 j94Me2J18124 Oct 4 16:50:35 smtp1 MailScanner[1395]: Saved archive copies of j94Me2J18130 j94Me2J18147 j94Me1J18118 j94Me1J18120 j94Me1J18042 j94Me2J18139 j94Me3J18155 j94Me2J18137 j94Me3J18153 j94Me2J18133 j94Me2J18149 j94Me2J18131 j94FuH024035 j94Me2J18128 j94Me2J18126 j94Me1J18116 j94Me1J18114 j94Me3J18157 j94Me2J18141 j94Me2J18151 j94Me1J18122 j94Me2J18135 j94Me2J18145 j94Me2J18124 Julian Field wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > > From the fact that several different MailScanner processes all tried to >process the same message, I would say your "Lock Type" is set wrong. >What version of sendmail are you using and what operating system and >distribution are you using? > >If you are using Linux and sendmail 8.13.1 or greater, then you need to set > Lock Type = posix >in your MailScanner.conf. You will then need to "service MailScanner >restart". > >Kai Wang wrote: > > > >>Hi, >> >>We are running MailScanner 4.43.8. Our message size limit is 50M. I >>noticed a valid message was stuck in MailScanner for over an hour. The >>server's load was very high and email processing was very slow. >>Eventually I had to move it to the delivery queue manually. Does >>anybody know what's the best practice for this situation? >> >>-rw------- 1 root root 48384095 Oct 4 09:57 dfj94FuH024035 >>-rw------- 1 root root 867 Oct 4 09:57 qfj94FuH024035 >> >>Oct 4 09:57:20 smtp1 pc214-161.psych.ucalgary.ca [136.159.214.161]: >>DATA[24035]: j94FuH024035: from=, size=48384415, >>class=0, nrcpts=1, >>msgid=, proto=ESMTP, >>daemon=MTA, mech=PLAIN, relay=pc214-161.psych.ucalgary.ca >>[136.159.214.161] >>Oct 4 09:57:20 smtp1 pc214-161.psych.ucalgary.ca [136.159.214.161]: >>DATA[24035]: j94FuH024035: to=, delay=00:01:03, >>mailer=relay, pri=48414415, stat=queued >>Oct 4 09:57:21 smtp1 pc214-161.psych.ucalgary.ca [136.159.214.161]: >>DATA[24035]: NOQUEUE: --> 250 2.0.0 j94FuH024035 Message accepted for >>delivery >>Oct 4 09:57:21 smtp1 MailScanner[7673]: Saved archive copies of >>j94FuH024035 >>Oct 4 10:07:39 smtp1 MailScanner[8930]: Saved archive copies of >>j94G7W029517 j94FuH024035 >>Oct 4 10:18:02 smtp1 MailScanner[1963]: Saved archive copies of >>j94GHv001891 j94G7W029517 j94FuH024035 j94GHx001902 j94GHv001893 >>j94GHx001907 j94GHx001912 j94GHt001887 j94GHx001908 >>Oct 4 10:28:27 smtp1 MailScanner[7135]: Saved archive copies of >>j94GHv001891 j94G7W029517 j94FuH024035 j94GHx001902 j94GHv001893 >>j94GHx001907 j94GHx001912 j94GHt001887 j94GHx001908 >>Oct 4 10:38:44 smtp1 MailScanner[7847]: Saved archive copies of >>j94GHv001891 j94G7W029517 j94FuH024035 j94GHx001902 j94GHv001893 >>j94GHx001907 j94GHx001912 j94GHt001887 j94GHx001908 >>Oct 4 10:49:07 smtp1 MailScanner[16427]: Saved archive copies of >>j94GHv001891 j94G7W029517 j94FuH024035 j94GHx001902 j94GHv001893 >>j94GHx001907 j94GHx001912 j94GHt001887 j94GHx001908 >>Oct 4 10:53:26 smtp1 MailScanner[18665]: Saved archive copies of >>j94GHv001891 j94GrOJ18662 j94Gr0018612 j94Gqt018568 j94G7W029517 >>j94FuH024035 j94GHx001902 j94Gqv018575 j94GHv001893 j94GHx001907 >>j94Gqv018574 j94Gqt018562 j94Gqq018538 j94Gqr018549 j94GHx001912 >>j94Gqr018543 j94Gqp018536 j94GHt001887 j94GHx001908 >>Oct 4 11:03:42 smtp1 MailScanner[18996]: Saved archive copies of >>j94GHv001891 j94GrOJ18662 j94Gr0018612 j94Gqt018568 j94G7W029517 >>j94FuH024035 j94GHx001902 j94Gqv018575 j94GHv001893 j94GHx001907 >>j94Gqv018574 j94Gqt018562 j94Gqq018538 j94Gqr018549 j94GHx001912 >>j94Gqr018543 j94Gqp018536 j94GHt001887 j94GHx001908 >> >>Thanks >> >> >> > >- -- >Julian Field >www.MailScanner.info >Buy the MailScanner book at www.MailScanner.info/store >Professional Support Services at www.MailScanner.biz >MailScanner thanks transtec Computers for their support > >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > >-----BEGIN PGP SIGNATURE----- >Version: PGP Desktop 9.0.2 (Build 2424) > >iQA/AwUBQ0LBUxH2WUcUFbZUEQKMeACgvJKpF8mRgaDLU6GJfNHuCrCm1VIAn27A >PxhZvsli7IVOF7KJEhsm/tx6 >=v9LZ >-----END PGP SIGNATURE----- > > > -- Kai Wang System Services Information Technologies, University of Calgary, 2500 University Drive, N.W., Calgary, Alberta, Canada T2N 1N4 Phone (403) 220-2423, Fax (403) 282-9361 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Wed Oct 5 00:02:42 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:52 2006 Subject: OT - Which greylist milter Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Just getting a feel at which greylist solutions are used by the esteemed recipients of this list. Especially interested in sendmail milters. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Wed Oct 5 02:45:28 2005 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:52 2006 Subject: A big message overwhelmed MailScanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Take the user out back and beat them with a clue stick. I had a client that specifically asked me *not* to put any size restrictions on his e-mail whatsoever. One day, a user decided to send her entire Outlook file (almost 2gb) to another user; she said she needed that other user to have a copy of all her e-mail and contacts, etc. The server started to choke; even so, she managed to send *another copy* of her PST file since it had been "more than 5 minutes since she sent the first one and it hadn't arrived". She was used to the near-instantaneous response time provided by a finely tuned server. Needless to say, caps were put at the MTA level (50MB) and at the individual user level using rulesets. My experience is that you should, at least for the sake of your server's health - not to mention bandwidth - limit your message sizes to something less than half the RAM available. Any message with attachments over 100MB in size means your users are in desperate need of a more reliable file transfer solution, such as (s)ftp. Even corporate intranets using php to upload files are prone to this, that's why PHP usually defaults to 8M max uploads. Kai Wang wrote: > Hi, > > We are running MailScanner 4.43.8. Our message size limit is 50M. I > noticed a valid message was stuck in MailScanner for over an hour. The > server's load was very high and email processing was very slow. > Eventually I had to move it to the delivery queue manually. Does > anybody know what's the best practice for this situation? > > -rw------- 1 root root 48384095 Oct 4 09:57 dfj94FuH024035 > -rw------- 1 root root 867 Oct 4 09:57 qfj94FuH024035 > > Oct 4 09:57:20 smtp1 pc214-161.psych.ucalgary.ca [136.159.214.161]: > DATA[24035]: j94FuH024035: from=, size=48384415, > class=0, nrcpts=1, > msgid=, proto=ESMTP, > daemon=MTA, mech=PLAIN, relay=pc214-161.psych.ucalgary.ca > [136.159.214.161] > Oct 4 09:57:20 smtp1 pc214-161.psych.ucalgary.ca [136.159.214.161]: > DATA[24035]: j94FuH024035: to=, delay=00:01:03, > mailer=relay, pri=48414415, stat=queued > Oct 4 09:57:21 smtp1 pc214-161.psych.ucalgary.ca [136.159.214.161]: > DATA[24035]: NOQUEUE: --> 250 2.0.0 j94FuH024035 Message accepted for > delivery > Oct 4 09:57:21 smtp1 MailScanner[7673]: Saved archive copies of > j94FuH024035 > Oct 4 10:07:39 smtp1 MailScanner[8930]: Saved archive copies of > j94G7W029517 j94FuH024035 > Oct 4 10:18:02 smtp1 MailScanner[1963]: Saved archive copies of > j94GHv001891 j94G7W029517 j94FuH024035 j94GHx001902 j94GHv001893 > j94GHx001907 j94GHx001912 j94GHt001887 j94GHx001908 > Oct 4 10:28:27 smtp1 MailScanner[7135]: Saved archive copies of > j94GHv001891 j94G7W029517 j94FuH024035 j94GHx001902 j94GHv001893 > j94GHx001907 j94GHx001912 j94GHt001887 j94GHx001908 > Oct 4 10:38:44 smtp1 MailScanner[7847]: Saved archive copies of > j94GHv001891 j94G7W029517 j94FuH024035 j94GHx001902 j94GHv001893 > j94GHx001907 j94GHx001912 j94GHt001887 j94GHx001908 > Oct 4 10:49:07 smtp1 MailScanner[16427]: Saved archive copies of > j94GHv001891 j94G7W029517 j94FuH024035 j94GHx001902 j94GHv001893 > j94GHx001907 j94GHx001912 j94GHt001887 j94GHx001908 > Oct 4 10:53:26 smtp1 MailScanner[18665]: Saved archive copies of > j94GHv001891 j94GrOJ18662 j94Gr0018612 j94Gqt018568 j94G7W029517 > j94FuH024035 j94GHx001902 j94Gqv018575 j94GHv001893 j94GHx001907 > j94Gqv018574 j94Gqt018562 j94Gqq018538 j94Gqr018549 j94GHx001912 > j94Gqr018543 j94Gqp018536 j94GHt001887 j94GHx001908 > Oct 4 11:03:42 smtp1 MailScanner[18996]: Saved archive copies of > j94GHv001891 j94GrOJ18662 j94Gr0018612 j94Gqt018568 j94G7W029517 > j94FuH024035 j94GHx001902 j94Gqv018575 j94GHv001893 j94GHx001907 > j94Gqv018574 j94Gqt018562 j94Gqq018538 j94Gqr018549 j94GHx001912 > j94Gqr018543 j94Gqp018536 j94GHt001887 j94GHx001908 > > Thanks > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Wed Oct 5 03:04:50 2005 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:30:52 2006 Subject: OT - Which greylist milter Message-ID: MailScanner mailing list <> scribbled on Tuesday, October 04, 2005 6:03 PM: > Just getting a feel at which greylist solutions are used by > the esteemed recipients of this list. > Especially interested in sendmail milters. > I use milter-sender Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Wed Oct 5 03:08:42 2005 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:52 2006 Subject: OT - Which greylist milter Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] It seems snertsoft is charging for it now. I know I've downloaded it and I probably have a copy of it lying around somewhere... I've been thinking of installing it on a couple of places where spam is most troublesome, except modifying the callback routine so it comes from instead of <> because of non-RFC-compliant ISP MTAs. Mike Kercher wrote: > MailScanner mailing list <> scribbled on Tuesday, October 04, 2005 6:03 PM: > > >> Just getting a feel at which greylist solutions are used by >> the esteemed recipients of this list. >> Especially interested in sendmail milters. >> >> > > I use milter-sender > > Mike > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Wed Oct 5 03:09:38 2005 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:52 2006 Subject: Anyone has milter-sender? Can you send one? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Like I mentioned on another thread, I *may* have a copy lying around somewhere. I'll have a look and let you know. Jose Nathaniel Nengasca wrote: > Hi, > > > > Do anyone has a milter-sender? The version before the official stable > release. > > > > Thanks > > > > > > > > JOSE NATHANIEL G. NENGASCA > > Network Administrator > > San Sebastian College-Recoletos > > Manila > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From james at GRAYONLINE.ID.AU Wed Oct 5 04:24:57 2005 From: james at GRAYONLINE.ID.AU (James Gray) Date: Thu Jan 12 21:30:52 2006 Subject: OT - Which greylist milter Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Wednesday 05 October 2005 09:02, Scott Silva wrote: > Just getting a feel at which greylist solutions are used by the esteemed > recipients of this list. > Especially interested in sendmail milters. We use milter-greylist on both our sendmail gateways (one FreeBSD, the other is CentOS). Compiled the latest version from source so we can use extended regex in our configuration files. The results have been good: Spam reduction: ~30-50% Virus reduction: ~15-20% (compared to total spam/viruses before the greylist, ie, not a %-age of total mail volume). As always, the biggest bonus is that all this happens at the MTA level saving MailScanner the hassle. The biggest problems we've had stem from the assumption amongst users that e-mail is actually some sort of instant-messaging. If a message didn't arrive within X-seconds, they would log a help desk call! Despite much education and assurance that once the mail (sender+recipient+originating SMTP host tuple) had been "learned" there would be no further delays as long as the sender sent you mail at least once a month (our autolearned-whitelist forgets unused entries older than 30 days). Our solution was simply to not greylist mail from key clients' domains[1] and to manually whitelist a few internal mail accounts (mostly sales people). Beyond that, we simply ignored most cries for help from the user population until after a week-or-so to give the greylist a chance to "learn" the mail patterns. Surprisingly, this worked - after a week, the flood of "my e-mail hasn't arrived" messages dried up. :) Once these little niggles were sorted, we've been very impressed with the results. The two mail gateways synchronise their autowhite-lists etc too. So if a sender gets auto-learned on the primary MX, then tries the secondary, they get through without delay there too. Same rules apply for all auto-entries. So if they try on the primary and get a 451-temporarily unavailable, then come back after the set time interval but on the secondary, they will still get through on the secondary (even though they originally hit the primary). Grey listing can have some weird (but predictable) side-effects too. Consider the following: Jill is a user from snafu.foo who sends a message to Barry at fubar.bar. After a delay, the grey list lets Jill's mail through to Barry. Jill and Barry exchange e-mail from now on without delay. Jill sends another message to Fred at fubar.bar and CC'ed Barry. The CC'ed message to Barry goes straight through but the message to Fred is delayed. Barry talks to Fred about the message from Jill, but Fred says "WTF?!". Jill gets a phone call from Fred and all three start annoying the IT people until (mysteriously) the message to Fred is delivered! Education is the key I think, but we all know how reluctant lusers are to have $CLUE imparted. Cheers, James ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From augustin.siaens at AQUADEV.ORG Wed Oct 5 10:07:35 2005 From: augustin.siaens at AQUADEV.ORG (augustin siaens) Date: Thu Jan 12 21:30:52 2006 Subject: spam scanning blocked regularly Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi there, It appears that my MailScanner has some problems. Every 2 days, it seems that MailScanner doesn't scan mail anymore for spams (antivirus seems OK). I have to stop the server, then I also have to stop sendmail (I know I shouldn't but it seems to be ON). Once I restart MailScanner scanning is OK. I don't understand what is wrong and more importantly how to spot the problem. In the log everything seems fine and then suddenly no more scanning! here are the running processes [root@server1 root]# ps aux | grep mail smmsp 28794 0.0 0.1 7296 1996 ? S Oct04 0:00 sendmail: Queue runner@01:00:00 for /var/spool/clientmqueue root 6377 0.0 0.2 7700 2592 ? S 08:40 0:00 sendmail: accepting connections smmsp 6382 0.0 0.2 7628 2264 ? S 08:40 0:00 sendmail: Queue runner@00:15:00 for /var/spool/clientmqueue root 6388 0.0 0.2 6992 2352 ? S 08:40 0:00 sendmail: Queue runner@00:15:00 for /var/spool/mqueue root 6389 0.0 0.2 7736 3008 ? S 08:40 0:00 sendmail: ./j935jSwC007162 mail.spamrejection.com.: client DATA status root 6503 0.0 0.0 4608 688 pts/0 S 08:53 0:00 grep mail Ususally I was killing these processes and scanning was back on track but restarting server (yes, sendmail too) seems to do the trick. sendmail 8.12.10 MailScanner 4.45 SA 3.1 -- Augustin Siaens AQUADEV Rue des Carmélites 151 Karmelietenstraat 1180 Bruxelles - Brussel Tel: +32 2 347 70 00 Fax: +32 2 347 00 36 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Oct 5 08:59:25 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:52 2006 Subject: Workaround for MailScanner RPM installation when using 'Perl from source' Message-ID: -----BEGIN PGP SIGNED MESSAGE----- What's wrong with ./install.sh --perl=/usr/local/bin/perl ? On 4 Oct 2005, at 21:26, Philip Hachey wrote: > I have been using MailScanner for some time now. I have it > installed on a > WhiteBox 3 (clone of RHEL 3) server. Prior to the recent MailScanner > upgrade (via RPMs), I had installed the most recent version of Perl > (5.8.7) from the source available at CPAN. In addition to the > operating > system RPM version of Perl (5.8.0) located under /usr/lib/perl5, I now > have this new version of Perl located under /usr/local/lib/perl5. > I also > swapped /usr/bin/perl with a symbolic link to /usr/local/bin/perl. > > When MailScanner installs, it recognizes both Perls, but during the > installation of MailScanner's included Perl RPM modules, the paths it > decides to use for the installation are /usr/lib/perl5/5.8.7 and / > usr/lib/perl5/site_perl/5.8.7 . > > POSSIBLE FIX: The correct paths would have been used if, in the > spec file > of each of the Perl RPMs, the call to 'perl Makefile.PL' did NOT > include > the PREFIX argument. > > TEMPORARY WORKAROUND: Before installing MailScanner, do the > following: > # ln --symbolic /usr/local/lib/perl5/5.8.7 /usr/lib/perl5/5.8.7 > # ln --symbolic /usr/local/lib/perl5/site_perl/5.8.7 > /usr/lib/perl5/site_perl/5.8.7 > > > There is an additional problem I've noticed that, after having used > CPAN > to grab the latest version of various Perl modules, MailScanner > will still > install a lower version: those modules marked "IsABundle" in > install.sh. > Is this intentional? Should I not be upgrading these modules via > CPAN? > > ---------------------------------- > Philip J. Hachey, BCS(High Hons) > Programmer-Analyst > City of Cornwall > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ0OH3vw32o+k+q+hAQHJJAf9Hn+I5t2A/uGSgeGD/58Wg1Ic1AcVCs1U QSIIZ5c25/DleXQa2KzxHpYs9kHki/BisrdXOo4e2QHHfq5nxkAo1/iAwohV04/d Ehtv+4G6MQIb2PqEgivFFRWdjpzn0DAS3fOnDBT98fPv6y38vOSygONtkqsA3Ez5 F04xzkZQwHkPVK09JN2Q8m7hjc3KHsVzU8gZMjFw0SM7n0EWrk2LrVkUzGM6BCnB qZUQAR3BK0auKLktNbONyLqHIsCvoEhCZJBf1lBNuvvVNBTF8Q1sLc0YP9CfUbXa N897FWVrbK78oqKCwcXBFEmJIKAvq4z8EMNR0UMpKO0JiPJBCLRzcQ== =k9nD -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Oct 5 09:03:00 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:52 2006 Subject: A big message overwhelmed MailScanner Message-ID: -----BEGIN PGP SIGNED MESSAGE----- What happens if you set Debug = yes and then do a check_mailscanner (after killing all MailScanner processes). I would be interested to hear what error it finally bombs out on. Almost certainly out of memory for something. On 4 Oct 2005, at 23:59, Kai Wang wrote: > We are running sendmail 8.11.7. It does not seem to be a lock > problem. I re-put the message to the incoming queue. You can see > the load went up quickly. According to lsof command, only one > MailScanner process opened the qf file. After about 10 minutes, I > found the MailScanner process ID changed from lsof command output. > The original MailScanner process disappeared. There was another log > entry. I guess the previous uvscan probably timed out and the > original MailScanner process went away and released the lock. > > # How to lock spool files. > # Don't set this unless you *know* you need to. > # For sendmail, it defaults to "flock". > # For sendmail 8.13 onwards, you will probably need to change it to > posix. > # For Exim, it defaults to "posix". > # No other type is implemented. > Lock Type = > > [root@smtp1 mqueue.in]# uname -a > Linux smtp1.ucalgary.ca 2.4.21-15.EL #1 Thu Apr 22 00:27:41 EDT > 2004 i686 i686 i386 GNU/Linux > [root@smtp1 mqueue.in]# cat /etc/redhat-release > Red Hat Enterprise Linux AS release 3 (Taroon Update 2) > [root@smtp1 mqueue.in]# /usr/sbin/sendmail -d0.1 -bt < /dev/null > Version 8.11.7 > Compiled with: LDAPMAP MAP_REGEX LOG MATCHGECOS MIME7TO8 MIME8TO7 > NAMED_BIND NETINET NETINET6 NETUNIX NEWDB NIS QUEUE > SASL SCANF > SFIO SMTP STARTTLS TCPWRAPPERS USERDB > > ============ SYSTEM IDENTITY (after readcf) ============ > (short domain name) $w = smtp1 > (canonical domain name) $j = smtp1.ucalgary.ca > (subdomain name) $m = ucalgary.ca > (node name) $k = smtp1.ucalgary.ca > ======================================================== > > ADDRESS TEST MODE (ruleset 3 NOT automatically invoked) > Enter
> > [root@smtp1 test]# ls -l /var/spool/mqueue.in/qfj94FuH024035 > -rw------- 1 root root 868 Oct 4 16:39 /var/spool/ > mqueue.in/qfj94FuH024035 > > [root@smtp1 test]# top > > 16:41:07 up 25 days, 16:25, 2 users, load average: 5.73, 3.25, 2.52 > 63 processes: 59 sleeping, 4 running, 0 zombie, 0 stopped > CPU states: cpu user nice system irq softirq iowait > idle > total 84.4% 0.0% 15.2% 0.0% 0.4% 0.0% > 0.0% > Mem: 2064640k av, 2043832k used, 20808k free, 0k shrd, > 174268k buff > 1358992k actv, 406880k in_d, 39624k in_c > Swap: 2048248k av, 1756k used, 2046492k free > 1587096k cached > > PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU > COMMAND > 18369 root 25 0 24328 23M 1872 R 43.2 1.1 0:18 0 > uvscan > 1234 root 20 0 18952 18M 2264 S 23.4 0.9 3:20 0 > MailScanner > 1702 root 21 0 18960 18M 2224 S 3.4 0.9 3:01 0 > MailScanner > 18660 root 21 0 3996 3996 2824 R 1.6 0.1 0:00 0 > sendmail > 1513 root 21 0 19236 18M 2224 S 0.2 0.9 3:10 0 > MailScanner > > [root@smtp1 test]# lsof /var/spool/mqueue.in/qfj94FuH024035 > COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME > MailScann 6523 root 6uW REG 8,7 868 95817 /var/spool/ > mqueue.in/qfj94FuH024035 > > [root@smtp1 test]# lsof /var/spool/mqueue.in/qfj94FuH024035 > COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME > MailScann 1395 root 6uW REG 8,7 868 95817 /var/spool/ > mqueue.in/qfj94FuH024035 > [root@smtp1 test]# ps -ef | grep MailScan > root 18664 1 0 10:53 ? 00:00:00 /usr/bin/perl -I/ > usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/ > MailScanner.conf > root 1024 18664 2 14:54 ? 00:03:01 /usr/bin/perl -I/ > usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/ > MailScanner.conf > root 1133 18664 3 14:54 ? 00:03:52 /usr/bin/perl -I/ > usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/ > MailScanner.conf > root 1234 18664 3 14:54 ? 00:03:38 /usr/bin/perl -I/ > usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/ > MailScanner.conf > root 1277 18664 2 14:54 ? 00:03:17 /usr/bin/perl -I/ > usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/ > MailScanner.conf > root 1395 18664 3 14:54 ? 00:04:03 /usr/bin/perl -I/ > usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/ > MailScanner.conf > root 1513 18664 3 14:55 ? 00:03:36 /usr/bin/perl -I/ > usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/ > MailScanner.conf > root 1702 18664 2 14:55 ? 00:03:25 /usr/bin/perl -I/ > usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/ > MailScanner.conf > root 2220 18664 3 14:56 ? 00:03:39 /usr/bin/perl -I/ > usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/ > MailScanner.conf > root 9999 18664 3 15:12 ? 00:03:26 /usr/bin/perl -I/ > usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/ > MailScanner.conf > root 21822 18664 2 16:50 ? 00:00:05 /usr/bin/perl -I/ > usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailScanner/ > MailScanner.conf > root 22995 28404 0 16:53 pts/0 00:00:00 grep MailScan > > Oct 4 16:40:05 smtp1 MailScanner[6523]: Saved archive copies of > j94Me2J18130 j94Me2J18147 j94Me1J18118 j94Me1J18120 j94Me1J18042 > j94Me2J18139 j94Me3J18155 j94Me2J18137 j94Me3J18153 j94Me2J18133 > j94Me2J18149 j94Me2J18131 j94FuH024035 j94Me2J18128 j94Me2J18126 > j94Me1J18116 j94Me1J18114 j94Me3J18157 j94Me2J18141 j94Me2J18151 > j94Me1J18122 j94Me2J18135 j94Me2J18145 j94Me2J18124 > Oct 4 16:50:35 smtp1 MailScanner[1395]: Saved archive copies of > j94Me2J18130 j94Me2J18147 j94Me1J18118 j94Me1J18120 j94Me1J18042 > j94Me2J18139 j94Me3J18155 j94Me2J18137 j94Me3J18153 j94Me2J18133 > j94Me2J18149 j94Me2J18131 j94FuH024035 j94Me2J18128 j94Me2J18126 > j94Me1J18116 j94Me1J18114 j94Me3J18157 j94Me2J18141 j94Me2J18151 > j94Me1J18122 j94Me2J18135 j94Me2J18145 j94Me2J18124 > > > > > Julian Field wrote: > > >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> From the fact that several different MailScanner processes all >> tried to process the same message, I would say your "Lock Type" is >> set wrong. What version of sendmail are you using and what >> operating system and distribution are you using? >> >> If you are using Linux and sendmail 8.13.1 or greater, then you >> need to set >> Lock Type = posix >> in your MailScanner.conf. You will then need to "service >> MailScanner restart". >> >> Kai Wang wrote: >> >> >> >>> Hi, >>> >>> We are running MailScanner 4.43.8. Our message size limit is 50M. >>> I noticed a valid message was stuck in MailScanner for over an >>> hour. The server's load was very high and email processing was >>> very slow. Eventually I had to move it to the delivery queue >>> manually. Does anybody know what's the best practice for this >>> situation? >>> >>> -rw------- 1 root root 48384095 Oct 4 09:57 >>> dfj94FuH024035 >>> -rw------- 1 root root 867 Oct 4 09:57 >>> qfj94FuH024035 >>> >>> Oct 4 09:57:20 smtp1 pc214-161.psych.ucalgary.ca >>> [136.159.214.161]: DATA[24035]: j94FuH024035: >>> from=, size=48384415, class=0, nrcpts=1, >>> msgid=, >>> proto=ESMTP, daemon=MTA, mech=PLAIN, >>> relay=pc214-161.psych.ucalgary.ca [136.159.214.161] >>> Oct 4 09:57:20 smtp1 pc214-161.psych.ucalgary.ca >>> [136.159.214.161]: DATA[24035]: j94FuH024035: >>> to=, delay=00:01:03, mailer=relay, >>> pri=48414415, stat=queued >>> Oct 4 09:57:21 smtp1 pc214-161.psych.ucalgary.ca >>> [136.159.214.161]: DATA[24035]: NOQUEUE: --> 250 2.0.0 >>> j94FuH024035 Message accepted for delivery >>> Oct 4 09:57:21 smtp1 MailScanner[7673]: Saved archive copies of >>> j94FuH024035 >>> Oct 4 10:07:39 smtp1 MailScanner[8930]: Saved archive copies of >>> j94G7W029517 j94FuH024035 >>> Oct 4 10:18:02 smtp1 MailScanner[1963]: Saved archive copies of >>> j94GHv001891 j94G7W029517 j94FuH024035 j94GHx001902 j94GHv001893 >>> j94GHx001907 j94GHx001912 j94GHt001887 j94GHx001908 >>> Oct 4 10:28:27 smtp1 MailScanner[7135]: Saved archive copies of >>> j94GHv001891 j94G7W029517 j94FuH024035 j94GHx001902 j94GHv001893 >>> j94GHx001907 j94GHx001912 j94GHt001887 j94GHx001908 >>> Oct 4 10:38:44 smtp1 MailScanner[7847]: Saved archive copies of >>> j94GHv001891 j94G7W029517 j94FuH024035 j94GHx001902 j94GHv001893 >>> j94GHx001907 j94GHx001912 j94GHt001887 j94GHx001908 >>> Oct 4 10:49:07 smtp1 MailScanner[16427]: Saved archive copies of >>> j94GHv001891 j94G7W029517 j94FuH024035 j94GHx001902 j94GHv001893 >>> j94GHx001907 j94GHx001912 j94GHt001887 j94GHx001908 >>> Oct 4 10:53:26 smtp1 MailScanner[18665]: Saved archive copies of >>> j94GHv001891 j94GrOJ18662 j94Gr0018612 j94Gqt018568 j94G7W029517 >>> j94FuH024035 j94GHx001902 j94Gqv018575 j94GHv001893 j94GHx001907 >>> j94Gqv018574 j94Gqt018562 j94Gqq018538 j94Gqr018549 j94GHx001912 >>> j94Gqr018543 j94Gqp018536 j94GHt001887 j94GHx001908 >>> Oct 4 11:03:42 smtp1 MailScanner[18996]: Saved archive copies of >>> j94GHv001891 j94GrOJ18662 j94Gr0018612 j94Gqt018568 j94G7W029517 >>> j94FuH024035 j94GHx001902 j94Gqv018575 j94GHv001893 j94GHx001907 >>> j94Gqv018574 j94Gqt018562 j94Gqq018538 j94Gqr018549 j94GHx001912 >>> j94Gqr018543 j94Gqp018536 j94GHt001887 j94GHx001908 >>> >>> Thanks >>> >>> >>> >> >> - -- Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> Professional Support Services at www.MailScanner.biz >> MailScanner thanks transtec Computers for their support >> >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> >> -----BEGIN PGP SIGNATURE----- >> Version: PGP Desktop 9.0.2 (Build 2424) >> >> iQA/AwUBQ0LBUxH2WUcUFbZUEQKMeACgvJKpF8mRgaDLU6GJfNHuCrCm1VIAn27A >> PxhZvsli7IVOF7KJEhsm/tx6 >> =v9LZ >> -----END PGP SIGNATURE----- >> >> >> > > -- > Kai Wang > System Services > Information Technologies, University of Calgary, > 2500 University Drive, N.W., > Calgary, Alberta, Canada T2N 1N4 > Phone (403) 220-2423, Fax (403) 282-9361 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ0OItvw32o+k+q+hAQGIPQf/SBb0VnjGKYNihxsczauX4pf+zdnQDcwQ Zc0ei0Uj/mROw6IFOvB60FusG3je7D+VKptyrPfsaW7dotND0xVb0bIM+oZE9laA uHkqxdTUIilBGa5wMdDyZedYOfh8lw0fdlRE/PUg6p3Q7K74A2NV5xxwIbHJx1GR HFGYWLHoaXMXmDpSbP/Xo+vrub3/aa8eBHDdx7O0TTdDbgfNPc2ZQCHcmzwr17sG R0Zw3dHcErQRzFsioOps8+rOPe229CPclC10mQz/zVa9Z/+CFccdp7/pjfkNy7qu 0XSt1qMh3gQ3tf2GZsSZbJyaUaa71j1wTpqIFNzxwZgjeHom9MwdTg== =3MP3 -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Nicolas.Schmitz at EC-NANTES.FR Wed Oct 5 09:03:50 2005 From: Nicolas.Schmitz at EC-NANTES.FR (Nicolas Schmitz) Date: Thu Jan 12 21:30:52 2006 Subject: ProcessClamAVOutput unrecognised line (with up-to-date clamav) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >Don't worry, it is quite harmless. If you want to stop it doing this, >apply this patch: > >- --- SweepViruses.pm.old 2005-07-11 16:44:22.000000000 +0100 >+++ SweepViruses.pm 2005-10-04 16:52:35.874101033 +0100 >@@ -2466,7 +2466,8 @@ > $logline = $line; > $logline =~ s/%/%%/g; > MailScanner::Log::WarnLog("ProcessClamAVOutput: unrecognised " . >- - "line \"$logline\". Please contact the >authors!"); >+ "line \"$logline\". Please contact the >authors!") >+ unless $logline =~ /Empty.*file/; > return 0; >} > >That is for /usr/lib/MailScanner/MailScanner/SweepViruses.pm. Remove >one line and replace it with 2 new lines. Pretty obvious I hope :-) > Helllo, thanks for the answer. But I don't think /Empty.*file/ will match MailScanner[17637]: poster.pdf MailScanner[17637]: ProcessClamAVOutput: unrecognised line "poster.pdf". There is two different problems : one with "Empty file" and one with only the name of a file. I know it's harmless, but I use logcheck (http://logcheck.org/), and I can't find a valid regexp to exclude that kind of line, without excluding all the MailScanner log ! Thanks. -- Nicolas Schmitz ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Q.G.Campbell at NEWCASTLE.AC.UK Wed Oct 5 09:34:01 2005 From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell) Date: Thu Jan 12 21:30:52 2006 Subject: MS 4.46.4-2 & SA 3.1.0 - still get warning from SA Message-ID: Have installed the latest MS alongside SA 3.1.0. What can be done to get rid of the warnings (see below) from SA when you run "SpamAssassin -D"? ... [32293] warn: Use of uninitialized value in pattern match (m//) at /usr/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/PerMsgStatus.pm line 870. [32293] warn: Use of uninitialized value in concatenation (.) or string at /usr/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/PerMsgStatus.pm line 944. ... An earlier posting from Julian implied these messages would go away with the latest MS. Can't see why though as this appears to be a problem with SA, not MS. For completeness, details of the set up on the machine in question: [root@cheviot69 MailScanner]# MailScanner -V Running on Linux cheviot69.ncl.ac.uk 2.6.9-5.ELsmp #1 SMP Wed Jan 5 19:30:39 EST 2005 i686 i686 i386 GNU/Linux This is Red Hat Enterprise Linux AS release 4 (Nahant) This is Perl version 5.008005 (5.8.5) This is MailScanner version 4.46.2 Module versions are: 1.00 AnyDBM_File 1.14 Archive::Zip 1.03 Carp 1.119 Convert::BinHex 1.00 DirHandle 1.05 Fcntl 2.73 File::Basename 2.08 File::Copy 2.01 FileHandle 1.06 File::Path 0.14 File::Temp 1.29 HTML::Entities 3.45 HTML::Parser 2.30 HTML::TokeParser 1.21 IO 1.10 IO::File 1.123 IO::Pipe 1.50 Mail::Header 3.05 MIME::Base64 5.417 MIME::Decoder 5.417 MIME::Decoder::UU 5.417 MIME::Head 5.417 MIME::Parser 3.03 MIME::QuotedPrint 5.417 MIME::Tools 0.10 Net::CIDR 1.08 POSIX 1.77 Socket 0.05 Sys::Syslog 1.02 Time::localtime Optional module versions are: 0.17 Convert::TNEF 1.810 DB_File 1.08 Digest 1.01 Digest::HMAC 2.33 Digest::MD5 2.10 Digest::SHA1 0.44 Inline 0.17 Mail::ClamAV 3.001000 Mail::SpamAssassin 1.997 Mail::SPF::Query 0.15 Net::CIDR::Lite 0.48 Net::DNS 0.31 Net::LDAP 1.94 Parse::RecDescent missing SAVI 1.2 Sys::Hostname::Long 2.42 Test::Harness 0.47 Test::Simple 1.95 Text::Balanced 1.35 URI Quentin --- PHONE: +44 191 222 8209 Information Systems and Services (ISS), University of Newcastle, Newcastle upon Tyne, FAX: +44 191 222 8765 United Kingdom, NE1 7RU. ------------------------------------------------------------------------ Any opinion expressed above is mine. The University can get its own. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Oct 5 09:38:45 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:52 2006 Subject: MS 4.46.4-2 & SA 3.1.0 - still get warning from SA Message-ID: -----BEGIN PGP SIGNED MESSAGE----- There was a line in SA which caused MailScanner to complain. That's what I stopped. These two remaining ones are harmless little things in SA. They will probably fix them in the next release, I would guess. On 5 Oct 2005, at 09:34, Quentin Campbell wrote: > Have installed the latest MS alongside SA 3.1.0. > > What can be done to get rid of the warnings (see below) from SA > when you > run "SpamAssassin -D"? > > ... > [32293] warn: Use of uninitialized value in pattern match (m//) at > /usr/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/PerMsgStatus.pm line > 870. > [32293] warn: Use of uninitialized value in concatenation (.) or > string > at /usr/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/PerMsgStatus.pm > line > 944. > ... > > An earlier posting from Julian implied these messages would go away > with > the latest MS. Can't see why though as this appears to be a problem > with > SA, not MS. > > For completeness, details of the set up on the machine in question: > > [root@cheviot69 MailScanner]# MailScanner -V > Running on > Linux cheviot69.ncl.ac.uk 2.6.9-5.ELsmp #1 SMP Wed Jan 5 19:30:39 EST > 2005 i686 i686 i386 GNU/Linux > This is Red Hat Enterprise Linux AS release 4 (Nahant) > This is Perl version 5.008005 (5.8.5) > > This is MailScanner version 4.46.2 > Module versions are: > 1.00 AnyDBM_File > 1.14 Archive::Zip > 1.03 Carp > 1.119 Convert::BinHex > 1.00 DirHandle > 1.05 Fcntl > 2.73 File::Basename > 2.08 File::Copy > 2.01 FileHandle > 1.06 File::Path > 0.14 File::Temp > 1.29 HTML::Entities > 3.45 HTML::Parser > 2.30 HTML::TokeParser > 1.21 IO > 1.10 IO::File > 1.123 IO::Pipe > 1.50 Mail::Header > 3.05 MIME::Base64 > 5.417 MIME::Decoder > 5.417 MIME::Decoder::UU > 5.417 MIME::Head > 5.417 MIME::Parser > 3.03 MIME::QuotedPrint > 5.417 MIME::Tools > 0.10 Net::CIDR > 1.08 POSIX > 1.77 Socket > 0.05 Sys::Syslog > 1.02 Time::localtime > > Optional module versions are: > 0.17 Convert::TNEF > 1.810 DB_File > 1.08 Digest > 1.01 Digest::HMAC > 2.33 Digest::MD5 > 2.10 Digest::SHA1 > 0.44 Inline > 0.17 Mail::ClamAV > 3.001000 Mail::SpamAssassin > 1.997 Mail::SPF::Query > 0.15 Net::CIDR::Lite > 0.48 Net::DNS > 0.31 Net::LDAP > 1.94 Parse::RecDescent > missing SAVI > 1.2 Sys::Hostname::Long > 2.42 Test::Harness > 0.47 Test::Simple > 1.95 Text::Balanced > 1.35 URI > > > Quentin > --- > PHONE: +44 191 222 8209 Information Systems and Services (ISS), > University of Newcastle, > Newcastle upon Tyne, > FAX: +44 191 222 8765 United Kingdom, NE1 7RU. > ---------------------------------------------------------------------- > -- > Any opinion expressed above is mine. The University can get its own. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ0ORF/w32o+k+q+hAQGGqwf/cZzowoAj3OATZq30WzcSgNBtV76sszJE g/0SVljgZHAEXY2/izQw5TDVBXWVV5NBilwh0/tq4EX2mfW5rlILK+2j+I2PVWlA YZidZ+bMDNi7aPPQnq4wNc6F33uTrLqpo+p1kn2ebGHqe5AY5Gi6OQFmG6yOjXf9 aGHXcc9taX3hyWccdfA6qfiJH3WPjCFLn8QFTG0+O+poCRRKATgzFn8/FN6SnTN2 qbvSogz/ZyqKSvfSES6wlrA6vCJMjHZ4p0kUDggDmibvzyOQlbYiWodTkPBYm37R H+LzXSSLcGqRYIy6Q7y4GRxUtMoXBSqSIK4s4V/Tkk0zq1WSnJcznQ== =th+e -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From stef at L5NET.NET Wed Oct 5 11:56:38 2005 From: stef at L5NET.NET (Stef Morrell) Date: Thu Jan 12 21:30:52 2006 Subject: OT - Which greylist milter Message-ID: James Gray [james@GRAYONLINE.ID.AU] wrote: > On Wednesday 05 October 2005 09:02, Scott Silva wrote: >> Just getting a feel at which greylist solutions are used by the >> esteemed recipients of this list. >> Especially interested in sendmail milters. Postfix shop here, so we're using postgrey. > Grey listing can have some weird (but predictable) > side-effects too. Consider the following: > > Jill is a user from snafu.foo who sends a message to Barry at > fubar.bar. After a delay, the grey list lets Jill's mail through to > Barry. Jill and Barry exchange e-mail from now on without > delay. Jill sends another message to Fred at fubar.bar and > CC'ed Barry. The CC'ed message to Barry goes straight > through but the message to Fred is delayed. Barry talks to > Fred about the message from Jill, but Fred says "WTF?!". > Jill gets a phone call from Fred and all three start annoying > the IT people until (mysteriously) the message to Fred is delivered! Interesting comedy behaviour :) Postgrey works somewhat differently. Rather than auto-whitelisting by recipient, it auto-whitelists by server, which IMHO is more sensible. In the scenario above, after the first email from Jenny, fubar.bar's incoming mail server would trust mail from snafu.foo's outgoing server and thus accept mail for both Barry and Fred. > Education is the key I think, but we all know how reluctant > lusers are to have $CLUE imparted. I find that the general response... "Your email has been delayed, it will come through soon, it's to help reduce your spam." ...works pretty well. Anything which gives users less crap tends to be well received, even if there is a slight inconvenience. Stef Stefan Morrell | Director Tel: 0870 365 2813 | Level 5 Internet Ltd Fax: 0192 450 7307 | Part of the Alpha Omega Group stef@l5net.net | stef@aoc-uk.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From stef at L5NET.NET Wed Oct 5 12:14:00 2005 From: stef at L5NET.NET (Stef Morrell) Date: Thu Jan 12 21:30:52 2006 Subject: OT - Which greylist milter Message-ID: > sensible. In the scenario above, after the first email from Jenny, oops... s/Jenny/Jill/ Stefan Morrell | Director Tel: 0870 365 2813 | Level 5 Internet Ltd Fax: 0192 450 7307 | Part of the Alpha Omega Group stef@l5net.net | stef@aoc-uk.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From phachey at CITY.CORNWALL.ON.CA Wed Oct 5 18:52:00 2005 From: phachey at CITY.CORNWALL.ON.CA (Philip Hachey) Date: Thu Jan 12 21:30:53 2006 Subject: Workaround for MailScanner RPM installation when using 'Perl from source' Message-ID: That is not a recognized option for install.sh. The only available options are "nodeps", "ingore-perl", and "fast". That might be a nice option to have -- although it's likely easier just to remove the PREFIX variable in the RPM spec files and let the perl binary decide upon paths. On Wed, 5 Oct 2005 08:59:25 +0100, Julian Field wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >What's wrong with >./install.sh --perl=/usr/local/bin/perl >? > >On 4 Oct 2005, at 21:26, Philip Hachey wrote: > >> I have been using MailScanner for some time now. I have it >> installed on a >> WhiteBox 3 (clone of RHEL 3) server. Prior to the recent MailScanner >> upgrade (via RPMs), I had installed the most recent version of Perl >> (5.8.7) from the source available at CPAN. In addition to the >> operating >> system RPM version of Perl (5.8.0) located under /usr/lib/perl5, I now >> have this new version of Perl located under /usr/local/lib/perl5. >> I also >> swapped /usr/bin/perl with a symbolic link to /usr/local/bin/perl. >> >> When MailScanner installs, it recognizes both Perls, but during the >> installation of MailScanner's included Perl RPM modules, the paths it >> decides to use for the installation are /usr/lib/perl5/5.8.7 and / >> usr/lib/perl5/site_perl/5.8.7 . >> >> POSSIBLE FIX: The correct paths would have been used if, in the >> spec file >> of each of the Perl RPMs, the call to 'perl Makefile.PL' did NOT >> include >> the PREFIX argument. >> >> TEMPORARY WORKAROUND: Before installing MailScanner, do the >> following: >> # ln --symbolic /usr/local/lib/perl5/5.8.7 /usr/lib/perl5/5.8.7 >> # ln --symbolic /usr/local/lib/perl5/site_perl/5.8.7 >> /usr/lib/perl5/site_perl/5.8.7 >> >> >> There is an additional problem I've noticed that, after having used >> CPAN >> to grab the latest version of various Perl modules, MailScanner >> will still >> install a lower version: those modules marked "IsABundle" in >> install.sh. >> Is this intentional? Should I not be upgrading these modules via >> CPAN? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From PHachey at CITY.CORNWALL.ON.CA Wed Oct 5 20:03:35 2005 From: PHachey at CITY.CORNWALL.ON.CA (Philip Hachey) Date: Thu Jan 12 21:30:53 2006 Subject: Suggestion: configuration option for ClamAV paths Message-ID: I'd like to suggest the addition of two configuration options in MailScanner.conf: ClamAV Log File ====================== Custom path for ClamAV log file (or perhaps any virus scanner). For example, I have changed $LogFile = "/tmp/ClamAV.update.log"; to $LogFile = "/var/log/clamav/freshclam.log"; in /usr/lib/MailScanner/clamav-autoupdate ClamAV Work Dir =============== It's nice to have ClamAV work in a tmpfs filesystem. For example, I have changed TempDir="/tmp/clamav.$$" to TempDir="/dev/shm/clamav.$$" in /usr/lib/MailScanner/clamav-wrapper Regards, ---------------------------------- Philip J. Hachey, BCS(High Hons) Programmer-Analyst City of Cornwall ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Wed Oct 5 20:18:58 2005 From: alex at nkpanama.com (Alex Neuman) Date: Thu Jan 12 21:30:53 2006 Subject: Suggestion: configuration option for ClamAV paths Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Philip Hachey wrote: > ClamAV Work Dir > =============== > It's nice to have ClamAV work in a tmpfs filesystem. For example, I have > changed > TempDir="/tmp/clamav.$$" > to > TempDir="/dev/shm/clamav.$$" > in /usr/lib/MailScanner/clamav-wrapper > Would this be needed if one is using ClamAVmodule? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cstone at AXINT.NET Wed Oct 5 20:27:36 2005 From: cstone at AXINT.NET (Chris Stone) Date: Thu Jan 12 21:30:53 2006 Subject: Anyone has milter-sender? Can you send one? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tuesday 04 October 2005 08:09 pm, Alex Neuman van der Hans wrote: > Like I mentioned on another thread, I *may* have a copy lying around > somewhere. I'll have a look and let you know. > You can get it from http://www.axint.net/downloads/milter-sender-0.62.tgz Chris -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFDRCkuG4PxJjbMvv0RAmnOAJ0bwwvbPRnsGaML60pMJOLQvBYjkACbBgVh gaw621NIHgpfT/wKbtfYeI4= =DVnC -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jd at BARITEC.COM Wed Oct 5 21:22:07 2005 From: jd at BARITEC.COM (JD Doelitzsch) Date: Thu Jan 12 21:30:53 2006 Subject: securing relay... Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Thanks again guys, I checked the relay using those site and it seems to be secure. I think what might be happening is my MS box takes any email then forwards it to my winbox which will accept or deny depending on if there is such a user. If no user my MS box tries to return to sender and so it looks like spam is going out. Is this a possible scenario? would this generate enough returned email that is spam to blacklist me? I am considering using milter-ahead as a possible fix. What do you think? -JD -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On Behalf Of Dhawal Doshy Sent: Tuesday, October 04, 2005 1:17 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: securing relay... > Hey guys, > > Im not sure if this has to do with MailScanner or not, because its just > totally beyond me, maybe you can shed some light or point me in the > right > direction. The setup is MailScanner pushes to exchange via > Mailertable/sendmail. Access only has mydomain.com in it. When I telnet > to > the MS box relay-denied(good) when trying to send other than > mydomain.net as > far as i can tell, But when monitoring packets I see spam originating or > relaying from my MS server to the net. It's getting me blacklisted. What > kind of command lets people relay? thats the one thing i can't verify > when > looking through the packets. I would like the MSbox only to relay to my > exchange server and nowhere else. The only thing i can think or is to > put a > firewall on the MS box to only allow outgoing to my exchange box. What > would > be the forseeable results of that? is there a better way? > > -JD Check the results of 'telnet relay-test.mail-abuse.org' from a shell on your mail server.. Fix the problem for whatever is allowed to relay. Also read this once again if you haven't already, theres always something that you could have missed out on :) http://wiki.mailscanner.info/doku.php?id=best_practices - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Wed Oct 5 22:44:15 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:53 2006 Subject: Spamassassin woes Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have two mostly identical systems, but one has recently stopped hitting the SURBL hits in spamassassin. I re-installed spamassasin, and diffed the configs between the two systems, but can't find the problem. I can lint a test message on the non-working spamassassin and the SURBL's hit. My next try is to re-install Net::DNS. Any other ideas? MailScanner is latest stable Spamassassin 3.1.0 ClamAV 0.87 All installed from Julian's tarball. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Wed Oct 5 23:01:00 2005 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:30:53 2006 Subject: Spamassassin woes Message-ID: MailScanner mailing list <> scribbled on Wednesday, October 05, 2005 4:44 PM: > I have two mostly identical systems, but one has recently > stopped hitting the SURBL hits in spamassassin. > I re-installed spamassasin, and diffed the configs between > the two systems, but can't find the problem. > I can lint a test message on the non-working spamassassin and > the SURBL's hit. > > My next try is to re-install Net::DNS. > Any other ideas? > > MailScanner is latest stable > Spamassassin 3.1.0 > ClamAV 0.87 > All installed from Julian's tarball. > Is it possible you are being hit by the fact that Cogent and Level3 de-peered today? This is killing me as some of my customers are unable to even check their email! http://status.cogento.com Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Wed Oct 5 23:15:20 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:53 2006 Subject: Spamassassin woes Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mike Kercher spake the following on 10/5/2005 3:01 PM: > MailScanner mailing list <> scribbled on Wednesday, October 05, 2005 4:44 > PM: > > >>I have two mostly identical systems, but one has recently >>stopped hitting the SURBL hits in spamassassin. >>I re-installed spamassasin, and diffed the configs between >>the two systems, but can't find the problem. >>I can lint a test message on the non-working spamassassin and >>the SURBL's hit. >> >>My next try is to re-install Net::DNS. >>Any other ideas? >> >>MailScanner is latest stable >>Spamassassin 3.1.0 >>ClamAV 0.87 >>All installed from Julian's tarball. >> > > > > Is it possible you are being hit by the fact that Cogent and Level3 > de-peered today? This is killing me as some of my customers are unable to > even check their email! > > http://status.cogento.com > > Mike > Both my hosts are on MCI / whoever they are this week. One works, one quit about a week ago. Just noticed as the same spam seemed to score too differently on each. After reinstalling Net::DNS, I got lint errors with spamassassin, so now I'm re-installing it again to see what's up. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From peter at UCGBOOK.COM Wed Oct 5 23:35:49 2005 From: peter at UCGBOOK.COM (Peter Bonivart) Date: Thu Jan 12 21:30:53 2006 Subject: Suggestion: configuration option for ClamAV paths Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Philip Hachey wrote: > It's nice to have ClamAV work in a tmpfs filesystem. For example, I have > changed > TempDir="/tmp/clamav.$$" If you used Solaris that would be a tmpfs file system. ;-) -- /Peter Bonivart --Unix lovers do it in the Sun ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kevins at BMRB.CO.UK Wed Oct 5 23:41:09 2005 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:30:53 2006 Subject: CentOS 4.1 final w/posix lock still having issues Message-ID: On Wed, 2005-10-05 at 10:17 -0400, Richard D Alloway wrote: > But, I still get deliveries with the dreaded "Message body disappears" errors. ... > What should I look for at this point? Wild shot in the dark, from the one time I saw this myself (very long time ago). Make sure that sendmail is being started from the MailScanner startup scripts and that you have the noetrn option on in that startup script (its there by default so it should be...). Also worth grepping the logs for etrn, just in case the command line option isn't being honoured for some reason. You don't want to let folks use etrn! Probably not your problem, but doesn't hurt to check. ================================================================= BMRB http://www.bmrb.co.uk _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Wed Oct 5 23:31:01 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:53 2006 Subject: Spamassassin woes Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Scott Silva spake the following on 10/5/2005 2:44 PM: > I have two mostly identical systems, but one has recently stopped > hitting the SURBL hits in spamassassin. > I re-installed spamassasin, and diffed the configs between the two > systems, but can't find the problem. > I can lint a test message on the non-working spamassassin and the > SURBL's hit. > > My next try is to re-install Net::DNS. > Any other ideas? > > MailScanner is latest stable > Spamassassin 3.1.0 > ClamAV 0.87 > All installed from Julian's tarball. > Now I have; Can't locate object method "check_uridnsbl" via package "Mail::SpamAssassin::PerMsgStatus" Not sure what module is hosed. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From maillists at CONACTIVE.COM Thu Oct 6 00:17:59 2005 From: maillists at CONACTIVE.COM (Kai Schaetzl) Date: Thu Jan 12 21:30:53 2006 Subject: Workaround for MailScanner RPM installation when using 'Perl from source' Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Philip Hachey wrote on Tue, 4 Oct 2005 16:26:49 -0400: > There is an additional problem I've noticed that, after having used CPAN > to grab the latest version of various Perl modules, MailScanner will still > install a lower version: those modules marked "IsABundle" in install.sh. > Is this intentional? Should I not be upgrading these modules via CPAN? If you do know you have "everything onboard" simply install "rpm -uvh --nodeps" the MailScanner rpm and nothing else! Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com IE-Center: http://ie5.de & http://msie.winware.org ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Thu Oct 6 00:18:32 2005 From: alex at nkpanama.com (Alex Neuman) Date: Thu Jan 12 21:30:53 2006 Subject: Spamassassin woes Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Scott Silva wrote: > Scott Silva spake the following on 10/5/2005 2:44 PM: > >> I have two mostly identical systems, but one has recently stopped >> hitting the SURBL hits in spamassassin. >> I re-installed spamassasin, and diffed the configs between the two >> systems, but can't find the problem. >> I can lint a test message on the non-working spamassassin and the >> SURBL's hit. >> >> My next try is to re-install Net::DNS. >> Any other ideas? >> >> MailScanner is latest stable >> Spamassassin 3.1.0 >> ClamAV 0.87 >> All installed from Julian's tarball. >> >> > Now I have; > Can't locate object method "check_uridnsbl" via package > "Mail::SpamAssassin::PerMsgStatus" > Not sure what module is hosed. > Whenever I've had problems like that I look up all the modules that are required by every part (spamassassin, mailscanner, etc.) and perl -MCPAN -e 'install Whatever::Module' one by one. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Thu Oct 6 00:20:22 2005 From: alex at nkpanama.com (Alex Neuman) Date: Thu Jan 12 21:30:53 2006 Subject: Workaround for MailScanner RPM installation when using 'Perl from source' Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Kai Schaetzl wrote: > Philip Hachey wrote on Tue, 4 Oct 2005 16:26:49 -0400: > > >> There is an additional problem I've noticed that, after having used CPAN >> to grab the latest version of various Perl modules, MailScanner will still >> install a lower version: those modules marked "IsABundle" in install.sh. >> Is this intentional? Should I not be upgrading these modules via CPAN? >> > > If you do know you have "everything onboard" simply install "rpm -uvh > --nodeps" the MailScanner rpm and nothing else! > > Kai > > And if you're still in doubt, perl -MCPAN -e 'install whatever::isneeded' when if MailScanner complains or if you want to really make sure. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Thu Oct 6 00:41:50 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:53 2006 Subject: Spamassassin woes Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Alex Neuman spake the following on 10/5/2005 4:18 PM: > Scott Silva wrote: > >> Scott Silva spake the following on 10/5/2005 2:44 PM: >> >> >>> I have two mostly identical systems, but one has recently stopped >>> hitting the SURBL hits in spamassassin. >>> I re-installed spamassasin, and diffed the configs between the two >>> systems, but can't find the problem. >>> I can lint a test message on the non-working spamassassin and the >>> SURBL's hit. >>> >>> My next try is to re-install Net::DNS. >>> Any other ideas? >>> >>> MailScanner is latest stable >>> Spamassassin 3.1.0 >>> ClamAV 0.87 >>> All installed from Julian's tarball. >>> >>> >> >> Now I have; >> Can't locate object method "check_uridnsbl" via package >> "Mail::SpamAssassin::PerMsgStatus" >> Not sure what module is hosed. >> > > Whenever I've had problems like that I look up all the modules that are > required by every part (spamassassin, mailscanner, etc.) and perl -MCPAN > -e 'install Whatever::Module' one by one. > Whatever hosed this system seemed to happen at the upgrade to spamassassin 3.1.0. I'll have to hack at it again tomorrow. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jaearick at COLBY.EDU Thu Oct 6 02:32:19 2005 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:30:53 2006 Subject: [NATIONAL-ALERTS] (AUSCERT AL-2005.0030) Trojan "Hesive" Targets Microsoft Access Vulnerability (fwd) Message-ID: Gang, FYI below. In the course of attempting to figure out what an mdb file is, I stumbled across this website, telling what types of attachments Outlook 2003 blocks. Wow, what a list... http://office.microsoft.com/en-us/assistance/HA011402971033.aspx Jeff Earickson Colby College ---------- Forwarded message ---------- Date: Thu, 06 Oct 2005 10:04:05 +1000 From: AusCERT To: national-alerts@auscert.org.au Subject: [NATIONAL-ALERTS] (AUSCERT AL-2005.0030) Trojan "Hesive" Targets Microsoft Access Vulnerability -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 =========================================================================== A U S C E R T A L E R T AL-2005.0030 -- AUSCERT ALERT Trojan "Hesive" Targets Microsoft Access Vulnerability 4 October 2005 =========================================================================== AusCERT Alert Summary --------------------- Product: Microsoft Access Operating System: Windows Impact: Administrator Compromise Access: Remote/Unauthenticated Member-only until: Thursday, October 06 2005 OVERVIEW: A new trojan, Hesive, targets a flaw in Microsoft Access that allows a remote attacker to execute arbitrary code or commands in the context of the currently logged in user. The vulnerability exploited by this trojan is five months old, and no patch is currently available. The trojan requires a local user to open a specially crafted Access .mdb file. This file can be received via email. Once activated, it opens a backdoor onto the system to allow further access to the remote attacker. IMPACT: While the trojan itself performs minimal actions on the infected system, it allows a remote attacker to access the system. Since many home users log on to Windows as an Administrator level user, this is effectively an Administrator Compromise. The trojan itself is simple to remove using an antivirus product, however actions taken by a remote attacker through the back door the trojan sets up are unpredictable and may not be reversible. MITIGATION: Treat Microsoft Office files as you would an executable program - do not open Office files that you have received from an unknown, untrusted or unexpected source, especially Access '.mdb' files. Ensure Windows Update is enabled on your systems so that any updates to fix this problem are installed. REFERENCES: Symantec Virus Definition: http://securityresponse.symantec.com/avcenter/venc/data/backdoor.hesive.html SecurityFocus: http://www.securityfocus.com/news/11335 Secunia: http://secunia.com/advisories/14896/ AusCERT has made every effort to ensure that the information contained in this document is accurate. However, the decision to use the information described is the responsibility of each user or organisation. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. If you believe that your computer system has been compromised or attacked in any way, we encourage you to let us know by completing the secure National IT Incident Reporting Form at: http://www.auscert.org.au/render.html?it=3192 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBQ0Rp9Ch9+71yA2DNAQMxyQP/czgdZNIbzc3mK5xk6kSV9agUWPqe6lxq cguUcWHRLPQI437an3urcpepZXTozrhrBDW2h1+C+sxaMxe4os9Cy1B12TeJrR8j TUNYZGBbKKL5b/MK0nTdWZlHTIQGKBPYrZcR8QLBoMYVKnR41/GXXR1TANc3WqfC UFZ1gGTUntk= =sEsT -----END PGP SIGNATURE----- AusCERT is the national computer emergency response team for Australia. We monitor various sources around the globe and provide reliable and independent information about serious computer network threats and vulnerabilities. AusCERT, which is a not-for-profit organisation, operates a cost-recovery service for its members and a smaller free security bulletin service to subscribers of the National Alerts Service. In the interests of protecting your information systems and keeping up to date with relevant information to protect your information systems, you should be aware that not all security bulletins published or distributed by AusCERT are included in the National Alert Service. AusCERT may publish and distribute bulletins to its members which contain information about serious computer network threats and vulnerabilities that could affect your information systems. Many of these security bulletins are publicly accessible from our web site. AusCERT maintains the mailing list for access to National Alerts Service security bulletins. If you are subscribed to the National Alerts Service and wish to cancel your subscription to this service, please follow the instructions at: http://www.auscert.org.au/msubmit.html?it=3058 Previous security bulletins published or distributed as part of the National Alerts Service can be retrieved from: http://national.auscert.org.au/render.html?cid=2998 Previous security bulletins published or distributed by AusCERT can be retrieved from: http://www.auscert.org.au/render.html?cid=1 If you believe that your computer system has been compromised or attacked in any way, we encourage you to let us know by completing the secure National IT Incident Reporting Form at: http://national.auscert.org.au/render.html?it=3192 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Thu Oct 6 08:55:13 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:53 2006 Subject: Spamassassin woes Message-ID: Try a "MailScanner -v" and a "spamassassin -p /etc/MailScanner/spam.assassin.prefs.com -D --lint" To clues as to whats broke. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Scott Silva Sent: 05 October 2005 23:31 To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: [MAILSCANNER] Spamassassin woes Scott Silva spake the following on 10/5/2005 2:44 PM: > I have two mostly identical systems, but one has recently stopped > hitting the SURBL hits in spamassassin. > I re-installed spamassasin, and diffed the configs between the two > systems, but can't find the problem. > I can lint a test message on the non-working spamassassin and the > SURBL's hit. > > My next try is to re-install Net::DNS. > Any other ideas? > > MailScanner is latest stable > Spamassassin 3.1.0 > ClamAV 0.87 > All installed from Julian's tarball. > Now I have; Can't locate object method "check_uridnsbl" via package "Mail::SpamAssassin::PerMsgStatus" Not sure what module is hosed. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner-user at NELAND.DK Wed Oct 5 13:00:02 2005 From: mailscanner-user at NELAND.DK (Leif Neland) Date: Thu Jan 12 21:30:53 2006 Subject: Mailscanner disturbs my domainkey? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] John Rudd wrote: > On Oct 1, 2005, at 6:31 AM, Julian Field wrote: >>> In any case, any good info, pointers, tips on getting domainkeys to >>> work using sendmail+MailScanner would be appreciated. I've already >>> set up SPF, but having domainkeys as well would be a plus. >> >> From what I have seen over the past 20 years or so is that the usual >> practice is to put "Received" headers at the top, and all X- headers >> and >> other header modifications at the bottom. If they produce one >> exception saying that all new headers must be before the domainkeys >> header, then how many others are there likely to be in future? They >> have somewhat changed the rules. >> > > There's no "somewhat" about it. If you embrace DomainKeys, then you > have to accept that the rules have changed. > > With DomainKeys, all new headers have to be added above the DomainKeys > header (the easiest way is to add them to the beginning of all of the > headers; this is what the new spamassassin does). You also may not > modify the subject, change the body content, because you may not > modify anything after the DomainKeys header. > > > So, when MailScanner wants to modify the body of a message, you would > almost want-to/have-to get rid of the DomainKey header. ... The DomainKey header is: DomainKey-Signature: a=rsa-sha1; s=arnold; d=neland.dk; c=nofws; q=dns; h=message-id:from:to:cc:references:subject:date: mime-version:content-type:content-transfer-encoding:x-priority: x-msmail-priority:x-mailer:xmimeole; b=kntlhXWmVzOKnkd73K3EKoPUvQz7zUokFzY97EYK5EoWvIBuaQ+sQrfS6VFLdp6LE lsy+qDYuED3/4uLnbygcQ== AFAICR that means that domainkey verification only looks at the headers mentioned above, and the rest, and the body may be freely modified. But isn't there a risk for the content-transfer-encoding to change, eg from qp to 8-bit? Leif -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ralloway at WINBEAM.COM Wed Oct 5 15:17:08 2005 From: ralloway at WINBEAM.COM (Richard D Alloway) Date: Thu Jan 12 21:30:53 2006 Subject: CentOS 4.1 final w/posix lock still having issues Message-ID: Hi. I have 6 SMTP gateway servers, each running either RH9, FC1, FC2 or (as of a few days ago) CentOS4.1final. They all use the same MailScanner.conf file which explicitly states: Lock Type = posix This appears to be honored correctly: Oct 5 04:05:55 smtp-gateway-5 MailScanner[23752]: Using locktype = posix Oct 5 04:05:55 smtp-gateway-5 MailScanner[23752]: Creating hardcoded struct_flock subroutine for linux (Linux-type) But, I still get deliveries with the dreaded "Message body disappears" errors. Here are the logs showing this: Oct 5 04:05:53 smtp-gateway-5 sendmail[23744]: j957uWFm017187: SYSERR(root): readqf: cannot open ./dfj957uWFm017187: No such file or directory Oct 5 04:05:53 smtp-gateway-5 sendmail[23744]: j957uWFm017187: to=, delay=00:09:19, xdelay=00:00:00, mailer=smtp, pri=125159, relay=mail.xxxxxx.net. [64.84.xx.xx], dsn=2.0.0, stat=Sent (ok 1128499555 qp 15073) Oct 5 04:05:53 smtp-gateway-5 sendmail[23744]: j957ulAU017283: SYSERR(root): readqf: cannot open ./dfj957ulAU017283: No such file or directory Oct 5 04:05:53 smtp-gateway-5 sendmail[23744]: j957ulAU017283: to=, delay=00:09:06, xdelay=00:00:00, mailer=esmtp, pri=156080, relay=mailin-01.mx.xxxxx.net. [205.188.156.185], dsn=2.0.0, stat=Sent (OK) I'm using: CentOS release 4.1 (Final) - Kernel 2.6.9 MailScanner-4.42.9-1 spamassassin-3.0.4-1.i386.rpm perl-Mail-SpamAssassin-3.0.4-1.i386.rpm spamassassin-tools-3.0.4-1.i386.rpm sendmail 8.13.2 Compiled with: DNSMAP LOG MATCHGECOS MILTER MIME7TO8 MIME8TO7 NAMED_BIND NETINET NETUNIX NEWDB PIPELINING SCANF USERDB XDEBUG What should I look for at this point? Thanks! -Rich ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Wed Oct 5 15:52:33 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:53 2006 Subject: MailScanner ANNOUNCE: 4.46.2 release Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >I have just released the latest stable version of MailScanner, 4.46.2. > >Download as usual from www.mailscanner.info > >The Change Log is pretty small this month, things have been quiet. The >important bit for Postfix users is a fix involving the internal TNEF >expander. Also SpamAssassin 3.1.0 is supported and doesn't generate any >warnings. > >The full Change Log is this: >* New Features and Improvements * >- - Improved phishing net JavaScript detection to make reports more sensible. >- - Loads of additions to phishing net safe sites list (thanks Denis!). >- - Improved Install-Clam-SA package so that it sets up your /etc/ld.so.conf > file for you, by adding /usr/local/lib if necessary. >- - Increased the default expansion factor of archives for the clamav scanner. >- - Removed -j3 from call to Kaspersky in kaspersky-wrapper, on advice from > Kaspersky users. > >* Fixes * >- - Fixed problem with a few TNEF files and the internal TNEF decoder, > caused occasional crashes. >- - Fixed warnings with numeric tests in a couple of places. >- - Tested against SpamAssassin 3.1.0, one minor problem found and fixed. >- - Fixed minor bug in "actions" parser in ZMailer support code. > > > > Julian, Do I need to run install.sh if I upgrade from mailscanner-4.44.6-2 or will a rpm -Uvh mailscanner-4.46.2-2.noarch.rpm do? Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From gmatt at NERC.AC.UK Thu Oct 6 11:52:49 2005 From: gmatt at NERC.AC.UK (Greg Matthews) Date: Thu Jan 12 21:30:53 2006 Subject: sophos and glibc resolved? Message-ID: Is the problem with the glibc version of Sophos resolved yet? There was a problem with the glibc version of sophos and it appeared to be broken on many modern linux distros. The solution was to use the (allegedly slower) libc6 version. Any update? GREG -- Greg Matthews 01491 692445 Head of UNIX/Linux, iTSS Wallingford ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jaearick at COLBY.EDU Thu Oct 6 13:41:08 2005 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:30:53 2006 Subject: 4.46.2: updates to perl modules Message-ID: Julian, In my monthly review of current perl modules used by MailScanner, I found on CPAN: your latest module version version --------------------------------- Compress-zlib 1.34 1.40 Archive-Zip 1.14 1.16 File-Spec 0.82 0.90 HTML-Tagset 3.03 3.04 IO-stringy 2.108 2.110 MailTools 1.50 1.67 Mime-tools 5.417 5.418 Net-CIDR 0.10 0.11 TimeDate 1.1301 1.16 I am running the latest versions with MS 4.46.2 on Solaris 9 with no problems. Jeff Earickson Colby College ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From brose at MED.WAYNE.EDU Thu Oct 6 13:55:35 2005 From: brose at MED.WAYNE.EDU (Rose, Bobby) Date: Thu Jan 12 21:30:53 2006 Subject: MailScanner and Logwatch Message-ID: Recently, we've migrated our gateway from Solaris to Linux and before I go munging the script/confs is there a simple switch to disable the reporting of unmatched entries for MailScanner? Thanks -=B ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Oct 6 14:58:29 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:53 2006 Subject: MailScanner ANNOUNCE: 4.46.2 release Message-ID: -----BEGIN PGP SIGNED MESSAGE----- On 5 Oct 2005, at 15:52, Denis Beauchemin wrote: > Julian Field wrote: > > >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> I have just released the latest stable version of MailScanner, >> 4.46.2. >> >> Download as usual from www.mailscanner.info >> >> The Change Log is pretty small this month, things have been quiet. >> The important bit for Postfix users is a fix involving the >> internal TNEF expander. Also SpamAssassin 3.1.0 is supported and >> doesn't generate any warnings. >> >> > Julian, > > Do I need to run install.sh if I upgrade from mailscanner-4.44.6-2 > or will a rpm -Uvh mailscanner-4.46.2-2.noarch.rpm do? You should be able to just rpm -Uvh it from 4.44 to 4.46. But generally I advise people to run ./install.sh anyway. You can speed it up a lot by doing "./install.sh fast". - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ0UtiPw32o+k+q+hAQF51ggAplvVuEvqZJAUNhH3/8rVDr3jO0H5383/ x+N1OGGHo2oJmGkp28XR3QuCWEV4cOq50LJFuU7PVeqmVqRGVnoHEJ5/LJffkGpC cdlMXMG8d0rAXOhcwvB51L5QKvCtHZsjLF2TQLfm+5P7HtQ2dxWFlFV6Cka7Or5x u96fNAlPgRbup9QaK1aGxcH57HB353/vw+0Xhg5ip9UpmPTN2GQhNo+7bDzIzt6S 6ny7Xor1nA0U90zqFH7O960m7qMNaLv35jWNbfaFEj9Esz39U5ZmylxaTfGHzMwf zJzdYxcrDIB1QAnc/E2lGrJB6ltbceKrvhSKS64NvZQbnULLZDq3gw== =jlKI -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Oct 6 15:01:34 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:53 2006 Subject: Workaround for MailScanner RPM installation when using 'Perl from source' Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Yes, sorry, you are quite right. The ClamAV+SA package has a --perl option, but the main MailScanner one doesn't. On 5 Oct 2005, at 18:52, Philip Hachey wrote: > That is not a recognized option for install.sh. The only available > options > are "nodeps", "ingore-perl", and "fast". That might be a nice > option to > have -- although it's likely easier just to remove the PREFIX > variable in > the RPM spec files and let the perl binary decide upon paths. > > On Wed, 5 Oct 2005 08:59:25 +0100, Julian Field > wrote: > > >> -----BEGIN PGP SIGNED MESSAGE----- >> >> What's wrong with >> ./install.sh --perl=/usr/local/bin/perl >> ? >> >> On 4 Oct 2005, at 21:26, Philip Hachey wrote: >> >> >>> I have been using MailScanner for some time now. I have it >>> installed on a >>> WhiteBox 3 (clone of RHEL 3) server. Prior to the recent >>> MailScanner >>> upgrade (via RPMs), I had installed the most recent version of Perl >>> (5.8.7) from the source available at CPAN. In addition to the >>> operating >>> system RPM version of Perl (5.8.0) located under /usr/lib/perl5, >>> I now >>> have this new version of Perl located under /usr/local/lib/perl5. >>> I also >>> swapped /usr/bin/perl with a symbolic link to /usr/local/bin/perl. >>> >>> When MailScanner installs, it recognizes both Perls, but during the >>> installation of MailScanner's included Perl RPM modules, the >>> paths it >>> decides to use for the installation are /usr/lib/perl5/5.8.7 and / >>> usr/lib/perl5/site_perl/5.8.7 . >>> >>> POSSIBLE FIX: The correct paths would have been used if, in the >>> spec file >>> of each of the Perl RPMs, the call to 'perl Makefile.PL' did NOT >>> include >>> the PREFIX argument. >>> >>> TEMPORARY WORKAROUND: Before installing MailScanner, do the >>> following: >>> # ln --symbolic /usr/local/lib/perl5/5.8.7 /usr/lib/perl5/5.8.7 >>> # ln --symbolic /usr/local/lib/perl5/site_perl/5.8.7 >>> /usr/lib/perl5/site_perl/5.8.7 >>> >>> >>> There is an additional problem I've noticed that, after having used >>> CPAN >>> to grab the latest version of various Perl modules, MailScanner >>> will still >>> install a lower version: those modules marked "IsABundle" in >>> install.sh. >>> Is this intentional? Should I not be upgrading these modules via >>> CPAN? >>> > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ0UuQPw32o+k+q+hAQH/nwgAqYfoH+Y54VgnuYob6atsiyIazNhFKwGn sA1yV3ETaMzr8jZqsBGZMvepNCbQJvRr96TEQ29ray39vmWjJFkmdo+HmGwd94ev tLGRCNpfQ+1pwDRcZVH0PqsW/WYkhxhB/7AXVbMaGwXXyuX5oHbrfIjrr/U3sCxY TWy92LF5URTuApgeAqCg93C0z/XSooiWQgq7o6Y5sPPinOeJeMxi55i1lGJyNvVN kLTxPosi6T2smMYYkAYWAE4q7x126kCtRrUfGtUqraT/5sXEe84q7vWzxaOO2P0L qHEs2Y3jvu2CPnlAstWHcLKSNMav3v9HBN9lDym0QA4Aq6wDcuLNug== =jcQi -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Oct 6 15:04:07 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:53 2006 Subject: Suggestion: configuration option for ClamAV paths Message-ID: -----BEGIN PGP SIGNED MESSAGE----- On 5 Oct 2005, at 20:03, Philip Hachey wrote: > I'd like to suggest the addition of two configuration options in > MailScanner.conf: > > ClamAV Work Dir > =============== > It's nice to have ClamAV work in a tmpfs filesystem. For example, > I have > changed > TempDir="/tmp/clamav.$$" > to > TempDir="/dev/shm/clamav.$$" > in /usr/lib/MailScanner/clamav-wrapper That only works if you have /dev/shm mounted as tmpfs, or if you have it at all. Most Unix distributions don't, only Linux has it. And I'm certainly not getting into OS-dependent -wrapper scripts. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ0Uu2Pw32o+k+q+hAQHtUwgAmE975smml3/Bob/fWo3vcshWBVJ48psK 4KG362t4sagie/JMzs//L/yBjML/hgFaQ/GIp/ou2JVwb0pyD41q/z3Tk8uuzhef NXaCpBnHS/sS6Y7lCcgFtyDY1ptllX+FYbryqkU1E2oWu+s+U30DTwN5qM79HaIU cL8JLHhx0RLLiRaTT56hpPcuLf22bys8/Waf+OUiwNVeIGsCJTsf7pRyZ/EcULsB Ju66GMniO7YTktLjaDiSylX0cXrQeTS/wXTFjzwBxZZoqPJSPVyTP1XDhLRlxJSx olepyPcTwS673uqT+5Rn5MgILQ2Tq4XgwupLgd7nWBZPJTYjj+Vo+g== =p6ym -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Oct 6 15:06:47 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:53 2006 Subject: Suggestion: configuration option for ClamAV paths Message-ID: -----BEGIN PGP SIGNED MESSAGE----- On 5 Oct 2005, at 23:35, Peter Bonivart wrote: > Philip Hachey wrote: > >> It's nice to have ClamAV work in a tmpfs filesystem. For example, >> I have changed >> TempDir="/tmp/clamav.$$" >> > > If you used Solaris that would be a tmpfs file system. ;-) Quite. On most of my systems I mount /tmp with tmpfs. Much faster and it is only for tmp stuff anyway, so who cares that it gets lost over a reboot. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ0Uvefw32o+k+q+hAQHGEQgAu0aWUcD6Gv1GtbejW7nR7ikOSGLPutvu 92GdqIi3T/8kDfddrMmqFHfJPU7b4y9rz1AuAbuJJBAwm80ZygnFp+JHsYswV/1t ivBrFHiiUvpOAB0ZjyWU30LXFIs5ZHTSRF+wgsK/Z/BJAhZFmiSLoxkndjxnp61O zBloQf4JURL8ZQ8NqY1+lt/+N+aHA5rX+Px9z2Kyg9tkFa2zjWvquHEzkoK8SAgA VHh0CW26f4gAxpSXf6VlbgQnLq2KCyEnF+CXV6T7Fz4s1k0k/aFgCcILkxWyBQE9 DGcR3LS2lrX88qesffjDBciSt9EdIdZiN9qHR10Y5LAmjO7zEFFShA== =imjN -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Oct 6 15:09:17 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:53 2006 Subject: Spamassassin woes Message-ID: -----BEGIN PGP SIGNED MESSAGE----- On 6 Oct 2005, at 00:41, Scott Silva wrote: > Alex Neuman spake the following on 10/5/2005 4:18 PM: > >> Scott Silva wrote: >> >> >>> Scott Silva spake the following on 10/5/2005 2:44 PM: >>> >>> >>> >>>> I have two mostly identical systems, but one has recently stopped >>>> hitting the SURBL hits in spamassassin. >>>> I re-installed spamassasin, and diffed the configs between the two >>>> systems, but can't find the problem. >>>> I can lint a test message on the non-working spamassassin and the >>>> SURBL's hit. >>>> >>>> My next try is to re-install Net::DNS. >>>> Any other ideas? >>>> >>>> MailScanner is latest stable >>>> Spamassassin 3.1.0 >>>> ClamAV 0.87 >>>> All installed from Julian's tarball. >>>> >>>> >>>> >>> >>> Now I have; >>> Can't locate object method "check_uridnsbl" via package >>> "Mail::SpamAssassin::PerMsgStatus" >>> Not sure what module is hosed. >>> >>> >> >> Whenever I've had problems like that I look up all the modules >> that are >> required by every part (spamassassin, mailscanner, etc.) and perl - >> MCPAN >> -e 'install Whatever::Module' one by one. >> >> > Whatever hosed this system seemed to happen at the upgrade to > spamassassin 3.1.0. > I'll have to hack at it again tomorrow. You haven't got 2 perls installed have you? Just a thought. You might be installing some of it into the wrong one. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ0UwDvw32o+k+q+hAQHfLAf/Yla7AwVo9/jsytHkb0YCSq8QIg5a7cak bNZIabYorFsJYo7OPkC/f41DJ1V6IDiVqLn6vwG4tmlPuutaR8CyJ6JRXrM8m88/ jf6fkmiAkFFFfALJOVRU4TADxoAAu6Z6u7gtOc0NEz+vM6kdoQYkJ42UYt1TWY8+ 6QxuMh/FCUwgQz+Su+EkAhy2D4N6pt68IfjvFSVsajPykxPAug+WFzFS07rcafcl zWs5QT5Gs26Srbhtx/0mz9M1FXk2TZ//Vs7ZDBl6QKrpP7Q7M63Oe2ip7Vcg2mu/ ul5j+n3QpFYeVT9U4XL5ZSeOxkOvbJB/Pqxvz38jr0mTAx7NJPFhBg== =NbuJ -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Oct 6 15:13:42 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:53 2006 Subject: [NATIONAL-ALERTS] (AUSCERT AL-2005.0030) Trojan "Hesive" Targets Microsoft Access Vulnerability (fwd) Message-ID: -----BEGIN PGP SIGNED MESSAGE----- They miss out 2 things: 1) an apology for having to publicly admit that you can't trust their files 2) going to Windows Update to get a patch for Office (which is presumably where they will patch it) won't work, as Office patches are only available from office.microsoft.com and not from windowsupdate.microsoft.com. On 6 Oct 2005, at 02:32, Jeff A. Earickson wrote: > Gang, > > FYI below. In the course of attempting to figure out what an mdb file > is, I stumbled across this website, telling what types of attachments > Outlook 2003 blocks. Wow, what a list... > > http://office.microsoft.com/en-us/assistance/HA011402971033.aspx > > Jeff Earickson > Colby College > > ---------- Forwarded message ---------- > Date: Thu, 06 Oct 2005 10:04:05 +1000 > From: AusCERT > To: national-alerts@auscert.org.au > Subject: [NATIONAL-ALERTS] (AUSCERT AL-2005.0030) Trojan "Hesive" > Targets > Microsoft Access Vulnerability > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: RIPEMD160 > > ====================================================================== > ===== > A U S C E R T A L > E R T > > AL-2005.0030 -- AUSCERT ALERT > Trojan "Hesive" Targets Microsoft Access Vulnerability > 4 October 2005 > > ====================================================================== > ===== > > AusCERT Alert Summary > --------------------- > > Product: Microsoft Access > Operating System: Windows > Impact: Administrator Compromise > Access: Remote/Unauthenticated > Member-only until: Thursday, October 06 2005 > > OVERVIEW: > > A new trojan, Hesive, targets a flaw in Microsoft Access that > allows a > remote attacker to execute arbitrary code or commands in the > context of > the currently logged in user. The vulnerability exploited by > this trojan > is five months old, and no patch is currently available. > > The trojan requires a local user to open a specially crafted > Access .mdb > file. This file can be received via email. Once activated, it > opens a > backdoor onto the system to allow further access to the remote > attacker. > > > IMPACT: > > While the trojan itself performs minimal actions on the > infected system, > it allows a remote attacker to access the system. Since many > home users > log on to Windows as an Administrator level user, this is > effectively an > Administrator Compromise. > > The trojan itself is simple to remove using an antivirus > product, however > actions taken by a remote attacker through the back door the > trojan sets > up are unpredictable and may not be reversible. > > > MITIGATION: > > Treat Microsoft Office files as you would an executable program > - do not > open Office files that you have received from an unknown, > untrusted or > unexpected source, especially Access '.mdb' files. > > Ensure Windows Update is enabled on your systems so that any > updates to > fix this problem are installed. > > > REFERENCES: > > Symantec Virus Definition: > http://securityresponse.symantec.com/avcenter/venc/data/ > backdoor.hesive.html > > SecurityFocus: > http://www.securityfocus.com/news/11335 > > Secunia: > http://secunia.com/advisories/14896/ > > AusCERT has made every effort to ensure that the information contained > in this document is accurate. However, the decision to use the > information > described is the responsibility of each user or organisation. The > decision to > follow or act on information or advice contained in this security > bulletin is > the responsibility of each user or organisation, and should be > considered in > accordance with your organisation's site policies and procedures. > AusCERT > takes no responsibility for consequences which may arise from > following or > acting on information or advice contained in this security bulletin. > > If you believe that your computer system has been compromised or > attacked in > any way, we encourage you to let us know by completing the secure > National IT > Incident Reporting Form at: > > http://www.auscert.org.au/render.html?it=3192 > > ====================================================================== > ===== > Australian Computer Emergency Response Team > The University of Queensland > Brisbane > Qld 4072 > > Internet Email: auscert@auscert.org.au > Facsimile: (07) 3365 7031 > Telephone: (07) 3365 4417 (International: +61 7 3365 4417) > AusCERT personnel answer during Queensland business > hours > which are GMT+10:00 (AEST). > On call after hours for member emergencies only. > ====================================================================== > ===== > > > -----BEGIN PGP SIGNATURE----- > Comment: http://www.auscert.org.au/render.html?it=1967 > Comment: http://www.auscert.org.au/render.html?it=1967 > > iQCVAwUBQ0Rp9Ch9+71yA2DNAQMxyQP/czgdZNIbzc3mK5xk6kSV9agUWPqe6lxq > cguUcWHRLPQI437an3urcpepZXTozrhrBDW2h1+C+sxaMxe4os9Cy1B12TeJrR8j > TUNYZGBbKKL5b/MK0nTdWZlHTIQGKBPYrZcR8QLBoMYVKnR41/GXXR1TANc3WqfC > UFZ1gGTUntk= > =sEsT > -----END PGP SIGNATURE----- > > AusCERT is the national computer emergency response team for > Australia. We > monitor various sources around the globe and provide reliable and > independent > information about serious computer network threats and > vulnerabilities. > AusCERT, which is a not-for-profit organisation, operates a cost- > recovery > service for its members and a smaller free security bulletin > service to > subscribers of the National Alerts Service. > > In the interests of protecting your information systems and keeping > up to date > with relevant information to protect your information systems, you > should be > aware that not all security bulletins published or distributed by > AusCERT are > included in the National Alert Service. AusCERT may publish and > distribute > bulletins to its members which contain information about serious > computer > network threats and vulnerabilities that could affect your information > systems. Many of these security bulletins are publicly accessible > from our web > site. > > AusCERT maintains the mailing list for access to National Alerts > Service > security bulletins. If you are subscribed to the National Alerts > Service and > wish to cancel your subscription to this service, please follow the > instructions at: > > http://www.auscert.org.au/msubmit.html?it=3058 > > Previous security bulletins published or distributed as part of the > National > Alerts Service can be retrieved from: > > http://national.auscert.org.au/render.html?cid=2998 > > Previous security bulletins published or distributed by AusCERT can be > retrieved from: > > http://www.auscert.org.au/render.html?cid=1 > > If you believe that your computer system has been compromised or > attacked in > any way, we encourage you to let us know by completing the secure > National IT > Incident Reporting Form at: > > http://national.auscert.org.au/render.html?it=3192 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ0UxGPw32o+k+q+hAQELQgf/VT1kj4Ovfkn9cU5JeC2dsdkdE/romu4p 16R5Xo0V7m+BPDEc01CkEowD3AnKUodw96Oezkf8HVMtlPlWc5pVHXC7noXCnjyS i/9m6NVdiAuyvkdICrmSWfcAevF9cXQJH1+9tK4a22qihUmGmVifQeqVUCnhxoTA fzFsFL98PXKJmLzboYgA/43Iq3AQWW8r4Dzs9p+hMvDAPHTUSAWyAvPYMBqteTGE Uv+uozfK5M9CHzzKRU2k5NjVqn166QZ3SyiKMH/1GQSJfOYchRywfUrANPAaVymh OWyJO9liS1hM2jLmu/e9vLWocqzGGf7CfBL/BULBMheYWItf9xh/yg== =P04s -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Oct 6 15:14:56 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:53 2006 Subject: MailScanner and Logwatch Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Not currently, no. On 6 Oct 2005, at 13:55, Rose, Bobby wrote: > Recently, we've migrated our gateway from Solaris to Linux and > before I > go munging the script/confs is there a simple switch to disable the > reporting of unmatched entries for MailScanner? - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ0UxYvw32o+k+q+hAQHPrwf/erimi40H4vEmcTsO1W72bFlMq3B8b3DO IRTx786ShfGpasbw4QrAIJzWoJMKs/2Jd+rbqn7lj2WtBQ/UGvnWAmD0ahDzAorw s/PMaImCTOhIw89hVOfCsZy0fLwOuTmLKIByes+pv1aBslTxSc1Qfia1kMaQws/q 7isL/N81mqiVvmD0jC1rCICge0gosZRRYCCrd+VHu4iW61sqPUuqBHxoGcEW7DXw KjjlQecK5yj8bnBL3M3FvUT8F6GKUlIGHgWQxEKFqAKtvoBtvppWYzT10vwyhEak 3bX34UXbnlfsXyvp+TU56LrNkYQKAEkv/hr71+PpeQXc4fuSaH6Ujg== =5xLt -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Thu Oct 6 15:18:58 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:53 2006 Subject: [NATIONAL-ALERTS] (AUSCERT AL-2005.0030) Trojan "Hesive" Targets Microsoft Access Vulnerability (fwd) Message-ID: One more reason why you need to manage the M$ desktop with LanDesk/SMS/whatever and not let the users handle all this themselves... -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field Sent: 06 October 2005 15:14 To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: [MAILSCANNER] [NATIONAL-ALERTS] (AUSCERT AL-2005.0030) Trojan "Hesive" Targets Microsoft Access Vulnerability (fwd) -----BEGIN PGP SIGNED MESSAGE----- They miss out 2 things: 1) an apology for having to publicly admit that you can't trust their files 2) going to Windows Update to get a patch for Office (which is presumably where they will patch it) won't work, as Office patches are only available from office.microsoft.com and not from windowsupdate.microsoft.com. On 6 Oct 2005, at 02:32, Jeff A. Earickson wrote: > Gang, > > FYI below. In the course of attempting to figure out what an mdb file > is, I stumbled across this website, telling what types of attachments > Outlook 2003 blocks. Wow, what a list... > > http://office.microsoft.com/en-us/assistance/HA011402971033.aspx > > Jeff Earickson > Colby College > > ---------- Forwarded message ---------- > Date: Thu, 06 Oct 2005 10:04:05 +1000 > From: AusCERT > To: national-alerts@auscert.org.au > Subject: [NATIONAL-ALERTS] (AUSCERT AL-2005.0030) Trojan "Hesive" > Targets > Microsoft Access Vulnerability > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: RIPEMD160 > > ====================================================================== > ===== > A U S C E R T A L > E R T > > AL-2005.0030 -- AUSCERT ALERT > Trojan "Hesive" Targets Microsoft Access Vulnerability > 4 October 2005 > > ====================================================================== > ===== > > AusCERT Alert Summary > --------------------- > > Product: Microsoft Access > Operating System: Windows > Impact: Administrator Compromise > Access: Remote/Unauthenticated > Member-only until: Thursday, October 06 2005 > > OVERVIEW: > > A new trojan, Hesive, targets a flaw in Microsoft Access that > allows a > remote attacker to execute arbitrary code or commands in the > context of > the currently logged in user. The vulnerability exploited by > this trojan > is five months old, and no patch is currently available. > > The trojan requires a local user to open a specially crafted > Access .mdb > file. This file can be received via email. Once activated, it > opens a > backdoor onto the system to allow further access to the remote > attacker. > > > IMPACT: > > While the trojan itself performs minimal actions on the > infected system, > it allows a remote attacker to access the system. Since many > home users > log on to Windows as an Administrator level user, this is > effectively an > Administrator Compromise. > > The trojan itself is simple to remove using an antivirus > product, however > actions taken by a remote attacker through the back door the > trojan sets > up are unpredictable and may not be reversible. > > > MITIGATION: > > Treat Microsoft Office files as you would an executable program > - do not > open Office files that you have received from an unknown, > untrusted or > unexpected source, especially Access '.mdb' files. > > Ensure Windows Update is enabled on your systems so that any > updates to > fix this problem are installed. > > > REFERENCES: > > Symantec Virus Definition: > http://securityresponse.symantec.com/avcenter/venc/data/ > backdoor.hesive.html > > SecurityFocus: > http://www.securityfocus.com/news/11335 > > Secunia: > http://secunia.com/advisories/14896/ > > AusCERT has made every effort to ensure that the information contained > in this document is accurate. However, the decision to use the > information > described is the responsibility of each user or organisation. The > decision to > follow or act on information or advice contained in this security > bulletin is > the responsibility of each user or organisation, and should be > considered in > accordance with your organisation's site policies and procedures. > AusCERT > takes no responsibility for consequences which may arise from > following or > acting on information or advice contained in this security bulletin. > > If you believe that your computer system has been compromised or > attacked in > any way, we encourage you to let us know by completing the secure > National IT > Incident Reporting Form at: > > http://www.auscert.org.au/render.html?it=3192 > > ====================================================================== > ===== > Australian Computer Emergency Response Team > The University of Queensland > Brisbane > Qld 4072 > > Internet Email: auscert@auscert.org.au > Facsimile: (07) 3365 7031 > Telephone: (07) 3365 4417 (International: +61 7 3365 4417) > AusCERT personnel answer during Queensland business > hours > which are GMT+10:00 (AEST). > On call after hours for member emergencies only. > ====================================================================== > ===== > > > -----BEGIN PGP SIGNATURE----- > Comment: http://www.auscert.org.au/render.html?it=1967 > Comment: http://www.auscert.org.au/render.html?it=1967 > > iQCVAwUBQ0Rp9Ch9+71yA2DNAQMxyQP/czgdZNIbzc3mK5xk6kSV9agUWPqe6lxq > cguUcWHRLPQI437an3urcpepZXTozrhrBDW2h1+C+sxaMxe4os9Cy1B12TeJrR8j > TUNYZGBbKKL5b/MK0nTdWZlHTIQGKBPYrZcR8QLBoMYVKnR41/GXXR1TANc3WqfC > UFZ1gGTUntk= > =sEsT > -----END PGP SIGNATURE----- > > AusCERT is the national computer emergency response team for > Australia. We > monitor various sources around the globe and provide reliable and > independent > information about serious computer network threats and > vulnerabilities. > AusCERT, which is a not-for-profit organisation, operates a cost- > recovery > service for its members and a smaller free security bulletin > service to > subscribers of the National Alerts Service. > > In the interests of protecting your information systems and keeping > up to date > with relevant information to protect your information systems, you > should be > aware that not all security bulletins published or distributed by > AusCERT are > included in the National Alert Service. AusCERT may publish and > distribute > bulletins to its members which contain information about serious > computer > network threats and vulnerabilities that could affect your information > systems. Many of these security bulletins are publicly accessible > from our web > site. > > AusCERT maintains the mailing list for access to National Alerts > Service > security bulletins. If you are subscribed to the National Alerts > Service and > wish to cancel your subscription to this service, please follow the > instructions at: > > http://www.auscert.org.au/msubmit.html?it=3058 > > Previous security bulletins published or distributed as part of the > National > Alerts Service can be retrieved from: > > http://national.auscert.org.au/render.html?cid=2998 > > Previous security bulletins published or distributed by AusCERT can be > retrieved from: > > http://www.auscert.org.au/render.html?cid=1 > > If you believe that your computer system has been compromised or > attacked in > any way, we encourage you to let us know by completing the secure > National IT > Incident Reporting Form at: > > http://national.auscert.org.au/render.html?it=3192 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ0UxGPw32o+k+q+hAQELQgf/VT1kj4Ovfkn9cU5JeC2dsdkdE/romu4p 16R5Xo0V7m+BPDEc01CkEowD3AnKUodw96Oezkf8HVMtlPlWc5pVHXC7noXCnjyS i/9m6NVdiAuyvkdICrmSWfcAevF9cXQJH1+9tK4a22qihUmGmVifQeqVUCnhxoTA fzFsFL98PXKJmLzboYgA/43Iq3AQWW8r4Dzs9p+hMvDAPHTUSAWyAvPYMBqteTGE Uv+uozfK5M9CHzzKRU2k5NjVqn166QZ3SyiKMH/1GQSJfOYchRywfUrANPAaVymh OWyJO9liS1hM2jLmu/e9vLWocqzGGf7CfBL/BULBMheYWItf9xh/yg== =P04s -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Chris.Russell at KNOWLEDGEIT.CO.UK Thu Oct 6 15:20:50 2005 From: Chris.Russell at KNOWLEDGEIT.CO.UK (Chris Russell) Date: Thu Jan 12 21:30:53 2006 Subject: [NATIONAL-ALERTS] (AUSCERT AL-2005.0030) Trojan "Hesive" Targets Microsoft Access Vulnerability (fwd) Message-ID: >2) going to Windows Update to get a patch for Office (which is presumably where they will patch it) won't work, > as Office patches are only available from office.microsoft.com .. AND update.microsoft.com :) Ta Chris The contents of this e-mail may be privileged and are confidential. It may not be disclosed to or used by anyone other than the addressee(s), nor copied in any way. Any views or opinions presented are solely those of the author and do not necessarily represent those of Knowledge Limited. If received in error, please advise the sender, then delete it from your system. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at gmail.com Thu Oct 6 15:12:42 2005 From: glenn.steen at gmail.com (Glenn Steen) Date: Thu Jan 12 21:30:53 2006 Subject: securing relay... Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 05/10/05, JD Doelitzsch wrote: > Thanks again guys, I checked the relay using those site and it seems to be > secure. I think what might be happening is my MS box takes any email then > forwards it to my winbox which will accept or deny depending on if there is > such a user. If no user my MS box tries to return to sender and so it looks > like spam is going out. Is this a possible scenario? would this generate > enough returned email that is spam to blacklist me? I am considering using > milter-ahead as a possible fix. What do you think? > > -JD Yes, well ... if you check the archives to this list you'll find a lot about this ("NDR-spam", "backwash", whatever). You could be "originating" a hefty amount of spam, yes. But, to my knowledge, no BLs blacklist this type of behaviour as such ... yet (but then, you might be the first ... :-).. At least for postfix, this is documented in the wiki (http://wiki.mailscanner.info/doku.php?id=documentation:configuration:mta:postfix:how_to:reject_non_existent_users)) ... using milter-ahead seems to be a reasonable way of fixing this for sendmail. -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ryan at MARINOCRANE.COM Thu Oct 6 15:40:39 2005 From: ryan at MARINOCRANE.COM (Ryan Pitt) Date: Thu Jan 12 21:30:53 2006 Subject: MailScanner and Logwatch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I use Logwatch also - and have found that you can have Logwatch *ignore* certain strings. Its quite simple to do. Add the desired string to /etc/log.d/ignore.conf (Fedora Core 1) and Logwatch will output a single line ie. "3415 Ignored Lines" in place of the usual long output. Hope this helps. Ryan Julian Field wrote: > -----BEGIN PGP SIGNED MESSAGE----- > > Not currently, no. > > On 6 Oct 2005, at 13:55, Rose, Bobby wrote: > > >>Recently, we've migrated our gateway from Solaris to Linux and >>before I >>go munging the script/confs is there a simple switch to disable the >>reporting of unmatched entries for MailScanner? > > > - -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > -----BEGIN PGP SIGNATURE----- > Version: PGP Desktop 9.0.2 (Build 2425) > > iQEVAwUBQ0UxYvw32o+k+q+hAQHPrwf/erimi40H4vEmcTsO1W72bFlMq3B8b3DO > IRTx786ShfGpasbw4QrAIJzWoJMKs/2Jd+rbqn7lj2WtBQ/UGvnWAmD0ahDzAorw > s/PMaImCTOhIw89hVOfCsZy0fLwOuTmLKIByes+pv1aBslTxSc1Qfia1kMaQws/q > 7isL/N81mqiVvmD0jC1rCICge0gosZRRYCCrd+VHu4iW61sqPUuqBHxoGcEW7DXw > KjjlQecK5yj8bnBL3M3FvUT8F6GKUlIGHgWQxEKFqAKtvoBtvppWYzT10vwyhEak > 3bX34UXbnlfsXyvp+TU56LrNkYQKAEkv/hr71+PpeQXc4fuSaH6Ujg== > =5xLt > -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Thu Oct 6 15:41:17 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:53 2006 Subject: MailScanner ANNOUNCE: 4.46.2 release Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field spake the following on 10/6/2005 6:58 AM: > > On 5 Oct 2005, at 15:52, Denis Beauchemin wrote: > > >>>Julian Field wrote: >>> >>> >>> >>>>-----BEGIN PGP SIGNED MESSAGE----- >>>>Hash: SHA1 >>>> >>>>I have just released the latest stable version of MailScanner, >>>>4.46.2. >>>> >>>>Download as usual from www.mailscanner.info >>>> >>>>The Change Log is pretty small this month, things have been quiet. >>>>The important bit for Postfix users is a fix involving the >>>>internal TNEF expander. Also SpamAssassin 3.1.0 is supported and >>>>doesn't generate any warnings. >>>> >>>> >>> >>>Julian, >>> >>>Do I need to run install.sh if I upgrade from mailscanner-4.44.6-2 >>>or will a rpm -Uvh mailscanner-4.46.2-2.noarch.rpm do? > > > You should be able to just rpm -Uvh it from 4.44 to 4.46. But > generally I advise people to run ./install.sh anyway. You can speed > it up a lot by doing "./install.sh fast". > Is there a --force option in install.sh? Sometimes it would be nice to MAKE everything install again when things get hosed. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Thu Oct 6 15:52:48 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:53 2006 Subject: Spamassassin woes Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field spake the following on 10/6/2005 7:09 AM: > On 6 Oct 2005, at 00:41, Scott Silva wrote: > > >>>Alex Neuman spake the following on 10/5/2005 4:18 PM: >>> >>> >>>>Scott Silva wrote: >>>> >>>> >>>> >>>>>Scott Silva spake the following on 10/5/2005 2:44 PM: >>>>> >>>>> >>>>> >>>>> >>>>>>I have two mostly identical systems, but one has recently stopped >>>>>>hitting the SURBL hits in spamassassin. >>>>>>I re-installed spamassasin, and diffed the configs between the two >>>>>>systems, but can't find the problem. >>>>>>I can lint a test message on the non-working spamassassin and the >>>>>>SURBL's hit. >>>>>> >>>>>>My next try is to re-install Net::DNS. >>>>>>Any other ideas? >>>>>> >>>>>>MailScanner is latest stable >>>>>>Spamassassin 3.1.0 >>>>>>ClamAV 0.87 >>>>>>All installed from Julian's tarball. >>>>>> >>>>>> >>>>>> >>>>> >>>>>Now I have; >>>>>Can't locate object method "check_uridnsbl" via package >>>>>"Mail::SpamAssassin::PerMsgStatus" >>>>>Not sure what module is hosed. >>>>> >>>>> >>>> >>>>Whenever I've had problems like that I look up all the modules >>>>that are >>>>required by every part (spamassassin, mailscanner, etc.) and perl - >>>>MCPAN >>>>-e 'install Whatever::Module' one by one. >>>> >>>> >>> >>>Whatever hosed this system seemed to happen at the upgrade to >>>spamassassin 3.1.0. >>>I'll have to hack at it again tomorrow. > > > You haven't got 2 perls installed have you? Just a thought. You might > be installing some of it into the wrong one. Just one. It was the first think I checked. 5.8.0 I think I will run through CPAN and force install each module again. I also see this; [28256] warn: config: failed to parse line, skipping: dcc_path usr/local/bin/dccproc [28256] warn: config: failed to parse line, skipping: dcc_home /var/dcc [28256] warn: config: failed to parse line, skipping: razor_timeout 10 [28256] warn: config: failed to parse line, skipping: urirhssub URIBL_BLACK multi.uribl.com. A 2 [28256] warn: config: failed to parse line, skipping: urirhssub URIBL_GREY multi.uribl.com. A 4 [28256] warn: config: warning: score set for non-existent rule RAZOR2_CF_RANGE_51_100 -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dl6mpg at GMAIL.COM Thu Oct 6 15:50:17 2005 From: dl6mpg at GMAIL.COM (Uwe) Date: Thu Jan 12 21:30:53 2006 Subject: sophos and glibc resolved? Message-ID: Hi, > Is the problem with the glibc version of Sophos resolved yet? ... I think so. Using 3.98 and works fine for me with sophosavi. Running linux glib2.2 version. Uwe ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ralloway at WINBEAM.COM Thu Oct 6 15:17:54 2005 From: ralloway at WINBEAM.COM (Richard D Alloway) Date: Thu Jan 12 21:30:53 2006 Subject: CentOS 4.1 final w/posix lock still having issues Message-ID: On Wed, 5 Oct 2005, Kevin Spicer wrote: > On Wed, 2005-10-05 at 10:17 -0400, Richard D Alloway wrote: >> But, I still get deliveries with the dreaded "Message body disappears" errors. > ... >> What should I look for at this point? > > Wild shot in the dark, from the one time I saw this myself (very long > time ago). Make sure that sendmail is being started from the > MailScanner startup scripts and that you have the noetrn option on in > that startup script (its there by default so it should be...). Also > worth grepping the logs for etrn, just in case the command line option > isn't being honoured for some reason. You don't want to let folks use > etrn! > > Probably not your problem, but doesn't hurt to check. Thanks for the suggestions, but it doesn't look like etrn is the issue. We don't have anyone using etrn at all on any of our mail servers at this point and the noetrn option is in the MailScanner startup script. Also, the only reference to etrn in the logs are lines like: Oct 6 09:59:55 smtp-gateway-5 sendmail[22406]: j96DxtOg022406: [218.68.xxx.xxx] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA So, there's still something going on that I'm not aware of... Any other thoughts? :) -Rich ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rpoe at PLATTESHERIFF.ORG Thu Oct 6 16:27:47 2005 From: rpoe at PLATTESHERIFF.ORG (Rob Poe) Date: Thu Jan 12 21:30:53 2006 Subject: SpamAssassin Efficiency Message-ID: Running Spamassassin with MailScanner. As I use more rulesets, during busy / peak mail server periods, SpamAssassin is timing out and the spam message makes it through. I'd rather default the box to WAIT for SpamAssassin, even if that means backing up email a little bit. Hopefully I'll be able to replace the box soon (it's a 2.0ghz celeron / 1g ram) with a dual 2.8 xeon / 3 gigs ram / hardware RAID5 (instead of software raid1)..But for now I have to use what I have.. Any suggestions? Thanks in advance. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Oct 6 16:41:14 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:53 2006 Subject: Spamassassin woes Message-ID: -----BEGIN PGP SIGNED MESSAGE----- On 6 Oct 2005, at 15:52, Scott Silva wrote: > Julian Field spake the following on 10/6/2005 7:09 AM: > >> On 6 Oct 2005, at 00:41, Scott Silva wrote: >> >> >> >>>> Alex Neuman spake the following on 10/5/2005 4:18 PM: >>>> >>>> >>>> >>>>> Scott Silva wrote: >>>>> >>>>> >>>>> >>>>> >>>>>> Scott Silva spake the following on 10/5/2005 2:44 PM: >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>> I have two mostly identical systems, but one has recently >>>>>>> stopped >>>>>>> hitting the SURBL hits in spamassassin. >>>>>>> I re-installed spamassasin, and diffed the configs between >>>>>>> the two >>>>>>> systems, but can't find the problem. >>>>>>> I can lint a test message on the non-working spamassassin and >>>>>>> the >>>>>>> SURBL's hit. >>>>>>> >>>>>>> My next try is to re-install Net::DNS. >>>>>>> Any other ideas? >>>>>>> >>>>>>> MailScanner is latest stable >>>>>>> Spamassassin 3.1.0 >>>>>>> ClamAV 0.87 >>>>>>> All installed from Julian's tarball. >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>> >>>>>> Now I have; >>>>>> Can't locate object method "check_uridnsbl" via package >>>>>> "Mail::SpamAssassin::PerMsgStatus" >>>>>> Not sure what module is hosed. >>>>>> >>>>>> >>>>>> >>>>> >>>>> Whenever I've had problems like that I look up all the modules >>>>> that are >>>>> required by every part (spamassassin, mailscanner, etc.) and >>>>> perl - >>>>> MCPAN >>>>> -e 'install Whatever::Module' one by one. >>>>> >>>>> >>>>> >>>> >>>> Whatever hosed this system seemed to happen at the upgrade to >>>> spamassassin 3.1.0. >>>> I'll have to hack at it again tomorrow. >>>> >> >> >> You haven't got 2 perls installed have you? Just a thought. You might >> be installing some of it into the wrong one. >> > Just one. It was the first think I checked. > 5.8.0 > I think I will run through CPAN and force install each module again. > I also see this; > > [28256] warn: config: failed to parse line, skipping: dcc_path > usr/local/bin/dccproc > [28256] warn: config: failed to parse line, skipping: dcc_home /var/ > dcc > [28256] warn: config: failed to parse line, skipping: razor_timeout 10 Have you uncommented the relevant lines in your /etc/mail/ spamassassin/v310.pre (or whatever it's called)? If you use my ClamAV+SA bundle then it tells you exactly what you need to do to this file at the end of the installation process. > [28256] warn: config: failed to parse line, skipping: urirhssub > URIBL_BLACK multi.uribl.com. A 2 > [28256] warn: config: failed to parse line, skipping: urirhssub > URIBL_GREY multi.uribl.com. A 4 That's probably the same reason as above. There are some lines you have to add to the file as well. > [28256] warn: config: warning: score set for non-existent rule > RAZOR2_CF_RANGE_51_100 As above. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ0VFnPw32o+k+q+hAQGvRQf/d0VNkOIc5hrxsUgfq1cTj/ecKU9X1v3c KVVcpNverv/xyt4rPVmzAp0gwVenG2kZn75IU/6DZQ1YJA0WpwSbjegkseccSHMT kLTB1+d4XJMG+6/oZZ7TCEKP27ZJ2K4y65Ab0E3LqsooF7px+2CTspJk54RC6xcx NdmdDRd/qvEMhVZ75MHkfZdXliRdPi08l9WJIR+UISUzkZtApMnY/0V3ro5CMLax PxkHbYTDBcXgseWsGUNiCqYylRChIPSA7d43sYl/AVnY0m38w036y9CUaT4VXwKi OoOQDhzT8Qq/XRutVUkH/TZDDemAEQSdgK7nb6Q8JEFlELPRCUzt/w== =WQuP -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Thu Oct 6 15:58:10 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:53 2006 Subject: Spamassassin woes Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Martin Hepworth spake the following on 10/6/2005 12:55 AM: > Try a "MailScanner -v" and a > > "spamassassin -p /etc/MailScanner/spam.assassin.prefs.com -D --lint" > > To clues as to whats broke. > The lint test is where I am getting these; [28404] warn: config: failed to parse line, skipping: dcc_path /usr/local/bin/dccproc [28404] warn: config: failed to parse line, skipping: dcc_home /var/dcc [28404] warn: config: failed to parse line, skipping: razor_timeout 10 [28404] warn: config: failed to parse line, skipping: urirhssub URIBL_BLACK multi.uribl.com. A 2 [28404] warn: config: failed to parse line, skipping: urirhssub URIBL_GREY multi.uribl.com. A 4 [28404] warn: config: warning: score set for non-existent rule RAZOR2_CF_RANGE_51_100 [28404] dbg: plugin: Mail::SpamAssassin::Plugin::ReplaceTags=HASH(0x92bed4c) implements 'finish_parsing_end' and plugin did not register All seems OK with MailScanner -v Running on Linux mail.fontanawater.com 2.4.20-43.9.legacysmp #1 SMP Sat Apr 30 19:07:33 EDT 2005 i686 i686 i386 GNU/Linux This is Red Hat Linux release 9 (Shrike) This is Perl version 5.008000 (5.8.0) This is MailScanner version 4.46.2 Module versions are: 1.00 AnyDBM_File 1.16 Archive::Zip 1.01 Carp 1.119 Convert::BinHex 1.00 DirHandle 1.04 Fcntl 2.71 File::Basename 2.05 File::Copy 2.01 FileHandle 1.05 File::Path 0.16 File::Temp 1.29 HTML::Entities 3.45 HTML::Parser 2.30 HTML::TokeParser 1.20 IO 1.09 IO::File 1.122 IO::Pipe 1.50 Mail::Header 3.05 MIME::Base64 5.417 MIME::Decoder 5.417 MIME::Decoder::UU 5.417 MIME::Head 5.417 MIME::Parser 3.03 MIME::QuotedPrint 5.417 MIME::Tools 0.10 Net::CIDR 1.05 POSIX 1.75 Socket 0.03 Sys::Syslog 1.02 Time::localtime Optional module versions are: 0.17 Convert::TNEF 1.810 DB_File 1.08 Digest 1.01 Digest::HMAC 2.33 Digest::MD5 2.10 Digest::SHA1 0.44 Inline 0.17 Mail::ClamAV 3.001000 Mail::SpamAssassin 1.997 Mail::SPF::Query 0.15 Net::CIDR::Lite 0.53 Net::DNS 0.32 Net::LDAP 1.94 Parse::RecDescent missing SAVI 1.2 Sys::Hostname::Long 2.42 Test::Harness 0.47 Test::Simple 1.89 Text::Balanced 1.35 URI -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Thu Oct 6 16:34:01 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:30:53 2006 Subject: McAfee not being updated to 4561 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Glenn Steen wrote: > >>>Seems speedownload.nai.com is OK, so a simple and probably very >>>temporary fix could be to alter the mcafee-autoupdate script to use >>>that. Sigh. >>> >>>Suggestions for the notes section of the wiki (that don't contain too >>>many profanities) much appreciated:). >>> Julian, If most MailScanner users using mcafee agree, could you change the FTPDIR in mcafee-autoupdate to this URL in future MS releases: http://speedownload.nai.com/products/datfiles/4.x/nai Though i believe most of us already have changed it manually when there was a problem some time back. If someone is aware of a better URL, do update us (and the wiki) - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From phachey at CITY.CORNWALL.ON.CA Thu Oct 6 16:45:19 2005 From: phachey at CITY.CORNWALL.ON.CA (Philip Hachey) Date: Thu Jan 12 21:30:53 2006 Subject: Suggestion: configuration option for ClamAV paths Message-ID: On Thu, 6 Oct 2005 15:04:07 +0100, Julian Field wrote: >-----BEGIN PGP SIGNED MESSAGE----- > > >On 5 Oct 2005, at 20:03, Philip Hachey wrote: > >> I'd like to suggest the addition of two configuration options in >> MailScanner.conf: >> >> ClamAV Work Dir >> =============== >> It's nice to have ClamAV work in a tmpfs filesystem. For example, >> I have >> changed >> TempDir="/tmp/clamav.$$" >> to >> TempDir="/dev/shm/clamav.$$" >> in /usr/lib/MailScanner/clamav-wrapper > >That only works if you have /dev/shm mounted as tmpfs, or if you have >it at all. Most Unix distributions don't, only Linux has it. And I'm >certainly not getting into OS-dependent -wrapper scripts. I wasn't suggesting something OS-dependent, just the ability to configure where the temporary "clamav.$$" gets written to. As has been suggested, mounting /tmp as tmpfs is also a good idea. Thanks, Philip ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Oct 6 16:42:32 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:53 2006 Subject: SpamAssassin Efficiency Message-ID: -----BEGIN PGP SIGNED MESSAGE----- On 6 Oct 2005, at 16:27, Rob Poe wrote: > Running Spamassassin with MailScanner. As I use more rulesets, > during busy / peak mail server periods, SpamAssassin is timing out > and the spam message makes it through. > > I'd rather default the box to WAIT for SpamAssassin, even if that > means backing up email a little bit. Hopefully I'll be able to > replace the box soon (it's a 2.0ghz celeron / 1g ram) with a dual > 2.8 xeon / 3 gigs ram / hardware RAID5 (instead of software > raid1)..But for now I have to use what I have.. > > Any suggestions? Why not just increase the SpamAssassin timeout value in MailScanner.conf? - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ0VF7Pw32o+k+q+hAQE04ggAkTzkq16x2Yh0kvRO84b7N99NxPKjwQUs xkYTSNBmiD7JkWGy4yx6FacjLXk07gXXkIlwNoaBX7l46vDcdQ61mdpcD9ZuZ6wF bnOtNpL5PSzt3Sxvo0RWMksRdwyjqDLepBYP2sxSBbDSjouv/pNe5dEwf7VpmjT6 ZRQBi6eW6Ifl381tvDoyF7A6bwh2yX4uJ0QoX298h0gCeGyL9B/CRbqYVlqOvE7R 7Zg3xyzKMLRhb4WXAXV9Cl2oCP1D1OJDkrBUemxzkakt0HGWvXVfNFWv6DWtDsJC XSiUggbSk4Qz1EExLnMMaOD3XU5ia2yIt3T8atUhBvch5k8KPj9xIA== =J7BG -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Thu Oct 6 17:13:34 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:53 2006 Subject: MailScanner ANNOUNCE: 4.46.2 release Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Scott Silva spake the following on 10/6/2005 7:41 AM: > Julian Field spake the following on 10/6/2005 6:58 AM: > >>On 5 Oct 2005, at 15:52, Denis Beauchemin wrote: >> >> >> >>>>Julian Field wrote: >>>> >>>> >>>> >>>> >>>>>-----BEGIN PGP SIGNED MESSAGE----- >>>>>Hash: SHA1 >>>>> >>>>>I have just released the latest stable version of MailScanner, >>>>>4.46.2. >>>>> >>>>>Download as usual from www.mailscanner.info >>>>> >>>>>The Change Log is pretty small this month, things have been quiet. >>>>>The important bit for Postfix users is a fix involving the >>>>>internal TNEF expander. Also SpamAssassin 3.1.0 is supported and >>>>>doesn't generate any warnings. >>>>> >>>>> >>>> >>>>Julian, >>>> >>>>Do I need to run install.sh if I upgrade from mailscanner-4.44.6-2 >>>>or will a rpm -Uvh mailscanner-4.46.2-2.noarch.rpm do? >> >> >>You should be able to just rpm -Uvh it from 4.44 to 4.46. But >>generally I advise people to run ./install.sh anyway. You can speed >>it up a lot by doing "./install.sh fast". >> > > Is there a --force option in install.sh? > Sometimes it would be nice to MAKE everything install again when things > get hosed. In looking at install.sh, I see there isn't. But it looks like it would be easy to add. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Thu Oct 6 17:39:22 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:53 2006 Subject: McAfee not being updated to 4561 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 06/10/05, Dhawal Doshy wrote: > Glenn Steen wrote: > > > >>>Seems speedownload.nai.com is OK, so a simple and probably very > >>>temporary fix could be to alter the mcafee-autoupdate script to use > >>>that. Sigh. > >>> > >>>Suggestions for the notes section of the wiki (that don't contain too > >>>many profanities) much appreciated:). > >>> > > Julian, > > If most MailScanner users using mcafee agree, could you change the > FTPDIR in mcafee-autoupdate to this URL in future MS releases: > http://speedownload.nai.com/products/datfiles/4.x/nai > > Though i believe most of us already have changed it manually when there > was a problem some time back. If someone is aware of a better URL, do > update us (and the wiki) > > - dhawal > I dunno Dahwal... As you can see I've updated the wiki to give the tip to evryone who think they need it... But I've moved back to the official one since then (no glitches so far:). -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Thu Oct 6 17:39:55 2005 From: alex at nkpanama.com (Alex Neuman) Date: Thu Jan 12 21:30:53 2006 Subject: 4.46.2: updates to perl modules Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jeff A. Earickson wrote: > Julian, > > In my monthly review of current perl modules used by MailScanner, > I found on CPAN: > Same here... ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Thu Oct 6 17:42:19 2005 From: alex at nkpanama.com (Alex Neuman) Date: Thu Jan 12 21:30:53 2006 Subject: Suggestion: configuration option for ClamAV paths Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Philip Hachey wrote: > As has been suggested, mounting /tmp as tmpfs is also a good idea. > Unless you're running on a box with not much more RAM than it really needs - or if any of the tmp processes would mean data loss in case of power loss, unexpected reboots, etc. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Thu Oct 6 17:42:12 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:53 2006 Subject: McAfee not being updated to 4561 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 06/10/05, Glenn Steen wrote: > On 06/10/05, Dhawal Doshy wrote: > > Glenn Steen wrote: > > > > > >>>Seems speedownload.nai.com is OK, so a simple and probably very > > >>>temporary fix could be to alter the mcafee-autoupdate script to use > > >>>that. Sigh. > > >>> > > >>>Suggestions for the notes section of the wiki (that don't contain too > > >>>many profanities) much appreciated:). > > >>> > > > > Julian, > > > > If most MailScanner users using mcafee agree, could you change the > > FTPDIR in mcafee-autoupdate to this URL in future MS releases: > > http://speedownload.nai.com/products/datfiles/4.x/nai > > > > Though i believe most of us already have changed it manually when there > > was a problem some time back. If someone is aware of a better URL, do > > update us (and the wiki) > > > > - dhawal > > > I dunno Dahwal... As you can see I've updated the wiki to give the tip > to evryone who think they need it... But I've moved back to the > official one since then (no glitches so far:). > Spoke too soon. See your point. Sigh. -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Thu Oct 6 17:44:20 2005 From: alex at nkpanama.com (Alex Neuman) Date: Thu Jan 12 21:30:53 2006 Subject: securing relay... Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Glenn Steen wrote: > about this ("NDR-spam", "backwash", whatever). You could be > "originating" a hefty amount of spam, yes. But, to my knowledge, no > BLs blacklist this type of behaviour as such ... yet (but then, you > I think I once looked something up on dnsstuff.com's list and the RBL said something about IP's being blocked for (virus bounces|bogus NDRs|open proxies) - so I wouldn't rule it out. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Thu Oct 6 17:46:20 2005 From: alex at nkpanama.com (Alex Neuman) Date: Thu Jan 12 21:30:53 2006 Subject: [NATIONAL-ALERTS] (AUSCERT AL-2005.0030) Trojan "Hesive" Targets Microsoft Access Vulnerability (fwd) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Chris Russell wrote: > >2) going to Windows Update to get a patch for Office (which is > presumably where they will patch it) won't work, > > as Office patches are only available from office.microsoft.com > > .. AND update.microsoft.com :) > > True, since a few weeks back there's an update site that''ll do both. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Thu Oct 6 17:11:01 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:53 2006 Subject: Spamassassin woes Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field spake the following on 10/6/2005 8:41 AM: > > On 6 Oct 2005, at 15:52, Scott Silva wrote: > > >>>Julian Field spake the following on 10/6/2005 7:09 AM: >>> >>> >>>>On 6 Oct 2005, at 00:41, Scott Silva wrote: >>>> >>>> >>>> >>>> >>>>>>Alex Neuman spake the following on 10/5/2005 4:18 PM: >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>Scott Silva wrote: >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>>>Scott Silva spake the following on 10/5/2005 2:44 PM: >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>>I have two mostly identical systems, but one has recently >>>>>>>>>stopped >>>>>>>>>hitting the SURBL hits in spamassassin. >>>>>>>>>I re-installed spamassasin, and diffed the configs between >>>>>>>>>the two >>>>>>>>>systems, but can't find the problem. >>>>>>>>>I can lint a test message on the non-working spamassassin and >>>>>>>>>the >>>>>>>>>SURBL's hit. >>>>>>>>> >>>>>>>>>My next try is to re-install Net::DNS. >>>>>>>>>Any other ideas? >>>>>>>>> >>>>>>>>>MailScanner is latest stable >>>>>>>>>Spamassassin 3.1.0 >>>>>>>>>ClamAV 0.87 >>>>>>>>>All installed from Julian's tarball. >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>>Now I have; >>>>>>>>Can't locate object method "check_uridnsbl" via package >>>>>>>>"Mail::SpamAssassin::PerMsgStatus" >>>>>>>>Not sure what module is hosed. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>> >>>>>>>Whenever I've had problems like that I look up all the modules >>>>>>>that are >>>>>>>required by every part (spamassassin, mailscanner, etc.) and >>>>>>>perl - >>>>>>>MCPAN >>>>>>>-e 'install Whatever::Module' one by one. >>>>>>> >>>>>>> >>>>>>> >>>>>> >>>>>>Whatever hosed this system seemed to happen at the upgrade to >>>>>>spamassassin 3.1.0. >>>>>>I'll have to hack at it again tomorrow. >>>>>> >>>> >>>> >>>>You haven't got 2 perls installed have you? Just a thought. You might >>>>be installing some of it into the wrong one. >>>> >>> >>>Just one. It was the first think I checked. >>>5.8.0 >>>I think I will run through CPAN and force install each module again. >>>I also see this; >>> >>>[28256] warn: config: failed to parse line, skipping: dcc_path >>>usr/local/bin/dccproc >>>[28256] warn: config: failed to parse line, skipping: dcc_home /var/ >>>dcc >>>[28256] warn: config: failed to parse line, skipping: razor_timeout 10 > > > Have you uncommented the relevant lines in your /etc/mail/ > spamassassin/v310.pre (or whatever it's called)? > > If you use my ClamAV+SA bundle then it tells you exactly what you > need to do to this file at the end of the installation process. > > >>>[28256] warn: config: failed to parse line, skipping: urirhssub >>>URIBL_BLACK multi.uribl.com. A 2 >>>[28256] warn: config: failed to parse line, skipping: urirhssub >>>URIBL_GREY multi.uribl.com. A 4 > > > That's probably the same reason as above. There are some lines you > have to add to the file as well. > > >>>[28256] warn: config: warning: score set for non-existent rule >>>RAZOR2_CF_RANGE_51_100 > > > As above. Finally! After an extended session in CPAN, things seem OK. I still don't know which module was tanked, but it's fixed! Thank you to all! And greeting from California, USA. Where any actor can aspire to Governor! -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Thu Oct 6 17:48:21 2005 From: alex at nkpanama.com (Alex Neuman) Date: Thu Jan 12 21:30:53 2006 Subject: SpamAssassin Efficiency Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Why not just increase the SpamAssassin timeout value in > MailScanner.conf? > That and the usual "use local rbldns or a caching nameserver"... plus the "help, my sendmail is being DDOSed!" page that's been mentioned a couple of times on this list. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From andy at TIRESWING.NET Thu Oct 6 17:54:19 2005 From: andy at TIRESWING.NET (Andy Norris) Date: Thu Jan 12 21:30:53 2006 Subject: Opting a user/domain out of attachment checking Message-ID: I recently upgraded MailScanner and SpamAssassin, and it seems that some of my fine-tuning has been wiped out. The rule to not scan mail for viruses FromOrTo a domain isn't working, apparently, and I've got people screaming at me about their zip files not coming through. The book says to look in filename.rules.conf and filetype.rules.conf. For now, I have commented out the line in filename.rules.conf for EXE files. I have left alone filetype.rules.conf. Not sure why this file is necessary in conjunction with the other... but am leaving it alone for now. This allows the exes in the zip files, but this is not really what I want to do server-wide. I had set in the file virus-scan.rules the following line: FromOrTo: *@calian.us no I've tried both spaces and tabs here, and no difference... it doesn't work. So am I messing with the wrong files, or not enough files? :-) I'm running: MailScanner version 4.45.4 SpamAssassin version 3.1.0 Please let me know if there's more information I need to include here for anyone to give me a hand here. Thanks in advance for any and all suggestions. Especially the ones that help! Andy Norris andy@tireswing.net ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Thu Oct 6 17:41:45 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:53 2006 Subject: Spamassassin woes Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > > Finally! > After an extended session in CPAN, things seem OK. I still don't know > which module was tanked, but it's fixed! > Thank you to all! > > And greeting from California, USA. > Where any actor can aspire to Governor! > > Spoke too soon! Although lint tests all work, MailScanner isn't adding the URIBL scores into messages. If I take the same message and run it through lint, it shows up. I guess I'm going to reinstall MailScanner now. I think I will diff the config files for the two machines again first, just to make sure. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Chris.Russell at KNOWLEDGEIT.CO.UK Thu Oct 6 17:57:27 2005 From: Chris.Russell at KNOWLEDGEIT.CO.UK (Chris Russell) Date: Thu Jan 12 21:30:53 2006 Subject: Opting a user/domain out of attachment checking Message-ID: The contents of this e-mail may be privileged and are confidential. It may not be disclosed to or used by anyone other than the addressee(s), nor copied in any way. Any views or opinions presented are solely those of the author and do not necessarily represent those of Knowledge Limited. If received in error, please advise the sender, then delete it from your system. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Thu Oct 6 18:19:05 2005 From: alex at nkpanama.com (Alex Neuman) Date: Thu Jan 12 21:30:53 2006 Subject: MailScanner and Logwatch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Any examples? :) Ryan Pitt wrote: > I use Logwatch also - and have found that you can have Logwatch > *ignore* certain strings. Its quite simple to do. > Add the desired string to /etc/log.d/ignore.conf (Fedora Core 1) and > Logwatch will output a single line ie. "3415 Ignored Lines" in place > of the usual long output. > Hope this helps. > Ryan > > Julian Field wrote: >> -----BEGIN PGP SIGNED MESSAGE----- >> >> Not currently, no. >> >> On 6 Oct 2005, at 13:55, Rose, Bobby wrote: >> >> >>> Recently, we've migrated our gateway from Solaris to Linux and >>> before I >>> go munging the script/confs is there a simple switch to disable the >>> reporting of unmatched entries for MailScanner? >> >> >> - -- Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> >> -----BEGIN PGP SIGNATURE----- >> Version: PGP Desktop 9.0.2 (Build 2425) >> >> iQEVAwUBQ0UxYvw32o+k+q+hAQHPrwf/erimi40H4vEmcTsO1W72bFlMq3B8b3DO >> IRTx786ShfGpasbw4QrAIJzWoJMKs/2Jd+rbqn7lj2WtBQ/UGvnWAmD0ahDzAorw >> s/PMaImCTOhIw89hVOfCsZy0fLwOuTmLKIByes+pv1aBslTxSc1Qfia1kMaQws/q >> 7isL/N81mqiVvmD0jC1rCICge0gosZRRYCCrd+VHu4iW61sqPUuqBHxoGcEW7DXw >> KjjlQecK5yj8bnBL3M3FvUT8F6GKUlIGHgWQxEKFqAKtvoBtvppWYzT10vwyhEak >> 3bX34UXbnlfsXyvp+TU56LrNkYQKAEkv/hr71+PpeQXc4fuSaH6Ujg== >> =5xLt >> -----END PGP SIGNATURE----- > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Thu Oct 6 18:03:22 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:53 2006 Subject: Spamassassin woes Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Scott Silva spake the following on 10/6/2005 9:41 AM: >>Finally! >>After an extended session in CPAN, things seem OK. I still don't know >>which module was tanked, but it's fixed! >>Thank you to all! >> >>And greeting from California, USA. >>Where any actor can aspire to Governor! >> >> > > > Spoke too soon! > Although lint tests all work, MailScanner isn't adding the URIBL scores > into messages. > If I take the same message and run it through lint, it shows up. > I guess I'm going to reinstall MailScanner now. > I think I will diff the config files for the two machines again first, > just to make sure. > Running MailScanner in debug mode gets entries like this; rules: failed to run URIBL_BLACK test, skipping: (Can't locate object method "check_uridnsbl" via package "Mail::SpamAssassin::PerMsgStatus" at /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/PerMsgStatus.pm line 2581. But if I pipe the same message into a lint, it works fine. BUMP, BUMP, SLAM! (Head banging against wall) -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Thu Oct 6 18:09:09 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:53 2006 Subject: securing relay... Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Glenn Steen spake the following on 10/6/2005 7:12 AM: > On 05/10/05, JD Doelitzsch wrote: > >>Thanks again guys, I checked the relay using those site and it seems to be >>secure. I think what might be happening is my MS box takes any email then >>forwards it to my winbox which will accept or deny depending on if there is >>such a user. If no user my MS box tries to return to sender and so it looks >>like spam is going out. Is this a possible scenario? would this generate >>enough returned email that is spam to blacklist me? I am considering using >>milter-ahead as a possible fix. What do you think? >> >>-JD > > Yes, well ... if you check the archives to this list you'll find a lot > about this ("NDR-spam", "backwash", whatever). You could be > "originating" a hefty amount of spam, yes. But, to my knowledge, no > BLs blacklist this type of behaviour as such ... yet (but then, you > might be the first ... :-).. > At least for postfix, this is documented in the wiki > (http://wiki.mailscanner.info/doku.php?id=documentation:configuration:mta:postfix:how_to:reject_non_existent_users)) > ... using milter-ahead seems to be a reasonable way of fixing this > for sendmail. > > -- > -- Glenn > email: glenn < dot > steen < at > gmail < dot > com > work: glenn < dot > steen < at > ap1 < dot > se > And not bouncing mail with the attachments still there. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Oct 6 18:32:31 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:53 2006 Subject: Opting a user/domain out of attachment checking Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] What did you mean to say? Chris Russell wrote: >The contents of this e-mail may be privileged and are confidential. >It may not be disclosed to or used by anyone other than the addressee(s), nor copied in any way. Any views or opinions presented are solely those of the author and do not necessarily represent those of Knowledge Limited. > >If received in error, please advise the sender, then delete it from your system. > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Oct 6 18:37:54 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:53 2006 Subject: Spamassassin woes Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Scott Silva wrote: >Scott Silva spake the following on 10/6/2005 9:41 AM: > > >>>Finally! >>>After an extended session in CPAN, things seem OK. I still don't know >>>which module was tanked, but it's fixed! >>>Thank you to all! >>> >>>And greeting from California, USA. >>>Where any actor can aspire to Governor! >>> >>> >>> >>> >>Spoke too soon! >>Although lint tests all work, MailScanner isn't adding the URIBL scores >>into messages. >>If I take the same message and run it through lint, it shows up. >>I guess I'm going to reinstall MailScanner now. >>I think I will diff the config files for the two machines again first, >>just to make sure. >> >> >> > >Running MailScanner in debug mode gets entries like this; > >rules: failed to run URIBL_BLACK test, skipping: > (Can't locate object method "check_uridnsbl" via package >"Mail::SpamAssassin::PerMsgStatus" at >/usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/PerMsgStatus.pm line 2581. > >But if I pipe the same message into a lint, it works fine. > > You don't have 2 Perl installations do you? You will need to have added loadplugin Mail::SpamAssassin::Plugin::URIDNSBL to your init.pre file in /etc/mail/spamassassin, or else the SURBL stuff won't work at all. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Oct 6 18:34:38 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:53 2006 Subject: Opting a user/domain out of attachment checking Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Check Maximum Archive Depth setting. Also if you have "File Command" set to point to your "file" command, then filetype.rules.conf will be blocking executables by default, regardless of what they are called. Andy Norris wrote: > I recently upgraded MailScanner and SpamAssassin, and it seems that > some of my fine-tuning has been wiped out. The rule to not scan mail > for viruses FromOrTo a domain isn't working, apparently, and I've got > people screaming at me about their zip files not coming through. > > The book says to look in filename.rules.conf and filetype.rules.conf. > > For now, I have commented out the line in filename.rules.conf for EXE > files. > > I have left alone filetype.rules.conf. Not sure why this file is > necessary in conjunction with the other... but am leaving it alone for > now. > > This allows the exes in the zip files, but this is not really what I > want to do server-wide. > > I had set in the file virus-scan.rules the following line: > > FromOrTo: *@calian.us no > > I've tried both spaces and tabs here, and no difference... it doesn't > work. > > So am I messing with the wrong files, or not enough files? :-) > > I'm running: > MailScanner version 4.45.4 > SpamAssassin version 3.1.0 > > Please let me know if there's more information I need to include here > for anyone to give me a hand here. > > Thanks in advance for any and all suggestions. Especially the ones > that help! > > Andy Norris > andy@tireswing.net > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rgreen at TRAYERPRODUCTS.COM Thu Oct 6 18:44:19 2005 From: rgreen at TRAYERPRODUCTS.COM (Rodney Green) Date: Thu Jan 12 21:30:53 2006 Subject: Still getting spam of the drug nature Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] How would you do this in Postfix? >If you'd drop connections from IP's with no reverse DNS, you'd lose a lot of >your daily spam intake. > > -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Thu Oct 6 18:56:04 2005 From: alex at nkpanama.com (Alex Neuman) Date: Thu Jan 12 21:30:53 2006 Subject: Still getting spam of the drug nature Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Is there a way to do this using sendmail? I'll google around a bit, but in case anybody's already done it... I know AOL and a whole bunch of other ISPs are doing just that. Rodney Green wrote: > How would you do this in Postfix? > >> If you'd drop connections from IP's with no reverse DNS, you'd lose a >> lot of >> your daily spam intake. >> >> > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Thu Oct 6 18:56:28 2005 From: alex at nkpanama.com (Alex Neuman) Date: Thu Jan 12 21:30:53 2006 Subject: Mailscanner and big Attach = much swap Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Needs more RAM? :) Suporte SETi - Dennis wrote: > Hi. I'm using MailScanner with Qmail, and i dont know wht when I send > a mail .. like 40Mb, in my test mail-server the mail scanner go use > all RAM and > use all SWAP that i set.. and CPU goes 100% .. for much time, like 1 hour. > > what's the real problem?? > > > thanks > > > > -------------------------------------------------------------------- > Esta mensagem foi verificada pelo sistema de anti-vírus e anti-spam. > Seti Segurança e Tecnologia na Internet - suporte@setinet.com.br > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From suporte at SETINET.COM.BR Thu Oct 6 22:55:21 2005 From: suporte at SETINET.COM.BR (Suporte SETi - Dennis) Date: Thu Jan 12 21:30:53 2006 Subject: Mailscanner and big Attach = much swap Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi. I'm using MailScanner with Qmail, and i dont know wht when I send a mail .. like 40Mb, in my test mail-server the mail scanner go use all RAM and use all SWAP that i set.. and CPU goes 100% .. for much time, like 1 hour. what's the real problem?? thanks -------------------------------------------------------------------- Esta mensagem foi verificada pelo sistema de anti-vírus e anti-spam. Seti Segurança e Tecnologia na Internet - suporte@setinet.com.br ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ryan at MARINOCRANE.COM Thu Oct 6 19:09:18 2005 From: ryan at MARINOCRANE.COM (Ryan Pitt) Date: Thu Jan 12 21:30:53 2006 Subject: MailScanner and Logwatch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Sure...I added the line "Logging message" (without the quotes ;-)) to /etc/log.d/ignore.conf Which resulted in "3415 Ignored Lines" for me in Logwatch yesterday. Quoted from ignore.conf documentation.... "Simply cut and paste as much of the line as needed below be warned that it is possible to really limit your reports by placing a bad value below. BAD EXAMPLE: putting a single "." alone on a line will filter all output" Also, I noticed that YUM did not update the package for me and found that a much later version of Logwatch was available in rpm format from their web site. http://www2.logwatch.org:8080/tabs/download/ Have fun! Ryan Alex Neuman wrote: > Any examples? :) > > Ryan Pitt wrote: > >> I use Logwatch also - and have found that you can have Logwatch >> *ignore* certain strings. Its quite simple to do. >> Add the desired string to /etc/log.d/ignore.conf (Fedora Core 1) and >> Logwatch will output a single line ie. "3415 Ignored Lines" in place >> of the usual long output. >> Hope this helps. >> Ryan >> >> Julian Field wrote: >> >>> -----BEGIN PGP SIGNED MESSAGE----- >>> >>> Not currently, no. >>> >>> On 6 Oct 2005, at 13:55, Rose, Bobby wrote: >>> >>> >>>> Recently, we've migrated our gateway from Solaris to Linux and >>>> before I >>>> go munging the script/confs is there a simple switch to disable the >>>> reporting of unmatched entries for MailScanner? >>> >>> ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From andy at TIRESWING.NET Thu Oct 6 19:24:56 2005 From: andy at TIRESWING.NET (Andy Norris) Date: Thu Jan 12 21:30:53 2006 Subject: Opting a user/domain out of attachment checking Message-ID: Thanks Julian for your quick response. Maximum Archive Depth = 2 Filetype Rules = %etc-dir%/filetype.rules.conf %etc-dir% = /etc/MailScanner (that directory and file exist there). I've just commented out, for the time-being, the lines denying .exe and .chm files. But I don't want to do that server-wide. Just for the domain calian.us. Thanks again, Andy At 12:34 pm 2005-10-06, you wrote: >Check >Maximum Archive Depth >setting. >Also if you have "File Command" set to point to your "file" command, >then filetype.rules.conf will be blocking executables by default, >regardless of what they are called. > > >Andy Norris wrote: > >>I recently upgraded MailScanner and SpamAssassin, and it seems that >>some of my fine-tuning has been wiped out. The rule to not scan >>mail for viruses FromOrTo a domain isn't working, apparently, and >>I've got people screaming at me about their zip files not coming through. >> >>The book says to look in filename.rules.conf and filetype.rules.conf. >> >>For now, I have commented out the line in filename.rules.conf for EXE files. >> >>I have left alone filetype.rules.conf. Not sure why this file is >>necessary in conjunction with the other... but am leaving it alone for now. >> >>This allows the exes in the zip files, but this is not really what >>I want to do server-wide. >> >>I had set in the file virus-scan.rules the following line: >> >>FromOrTo: *@calian.us no >> >>I've tried both spaces and tabs here, and no difference... it doesn't work. >> >>So am I messing with the wrong files, or not enough files? :-) >> >>I'm running: >>MailScanner version 4.45.4 >>SpamAssassin version 3.1.0 >> >>Please let me know if there's more information I need to include >>here for anyone to give me a hand here. >> >>Thanks in advance for any and all suggestions. Especially the ones that help! >> >>Andy Norris >>andy@tireswing.net >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! > > >-- >Julian Field >www.MailScanner.info >Buy the MailScanner book at www.MailScanner.info/store >Professional Support Services at www.MailScanner.biz >MailScanner thanks transtec Computers for their support > >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > >-- >This message has been scanned for viruses and >dangerous content by MailScanner, and is >believed to be clean. > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Thu Oct 6 19:18:16 2005 From: alex at nkpanama.com (Alex Neuman) Date: Thu Jan 12 21:30:54 2006 Subject: MailScanner and Logwatch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Thanks... I'll look into it right away... Ryan Pitt wrote: > Sure...I added the line > "Logging message" (without the quotes ;-)) to /etc/log.d/ignore.conf > Which resulted in "3415 Ignored Lines" for me in Logwatch yesterday. > > Quoted from ignore.conf documentation.... > "Simply cut and paste as much of the line as needed below be warned > that it is possible to really limit your reports by placing a bad > value below. > BAD EXAMPLE: putting a single "." alone on a line will filter all output" > > Also, I noticed that YUM did not update the package for me and found > that a much later version of Logwatch was available in rpm format from > their web site. > http://www2.logwatch.org:8080/tabs/download/ > > Have fun! > > Ryan > > Alex Neuman wrote: >> Any examples? :) >> >> Ryan Pitt wrote: >> >>> I use Logwatch also - and have found that you can have Logwatch >>> *ignore* certain strings. Its quite simple to do. >>> Add the desired string to /etc/log.d/ignore.conf (Fedora Core 1) and >>> Logwatch will output a single line ie. "3415 Ignored Lines" in >>> place of the usual long output. >>> Hope this helps. >>> Ryan >>> >>> Julian Field wrote: >>> >>>> -----BEGIN PGP SIGNED MESSAGE----- >>>> >>>> Not currently, no. >>>> >>>> On 6 Oct 2005, at 13:55, Rose, Bobby wrote: >>>> >>>> >>>>> Recently, we've migrated our gateway from Solaris to Linux and >>>>> before I >>>>> go munging the script/confs is there a simple switch to disable the >>>>> reporting of unmatched entries for MailScanner? >>>> >>>> > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Thu Oct 6 19:11:25 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:54 2006 Subject: Spamassassin woes Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field spake the following on 10/6/2005 10:37 AM: > Scott Silva wrote: > >> Scott Silva spake the following on 10/6/2005 9:41 AM: >> >> >>>> Finally! >>>> After an extended session in CPAN, things seem OK. I still don't know >>>> which module was tanked, but it's fixed! >>>> Thank you to all! >>>> >>>> And greeting from California, USA. >>>> Where any actor can aspire to Governor! >>>> >>>> >>>> >>> >>> Spoke too soon! >>> Although lint tests all work, MailScanner isn't adding the URIBL scores >>> into messages. >>> If I take the same message and run it through lint, it shows up. >>> I guess I'm going to reinstall MailScanner now. >>> I think I will diff the config files for the two machines again first, >>> just to make sure. >>> >>> >> >> >> Running MailScanner in debug mode gets entries like this; >> >> rules: failed to run URIBL_BLACK test, skipping: >> (Can't locate object method "check_uridnsbl" via package >> "Mail::SpamAssassin::PerMsgStatus" at >> /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/PerMsgStatus.pm line >> 2581. >> >> But if I pipe the same message into a lint, it works fine. >> >> > You don't have 2 Perl installations do you? > You will need to have added > loadplugin Mail::SpamAssassin::Plugin::URIDNSBL > > to your init.pre file in /etc/mail/spamassassin, or else the SURBL stuff > won't work at all. > One perl, and I have the line to load the plugin. Can't figure out why I can lint a message as root, and get different results than MailScanner running as root. That should eliminate any path or permission problems. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Dave Thu Oct 6 19:45:13 2005 From: Dave (Dave) Date: Thu Jan 12 21:30:54 2006 Subject: Fraud Message-ID: Is there a possible to work on the fraud issue . It is a good idea, but it does need refining. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Thu Oct 6 19:45:03 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:30:54 2006 Subject: Still getting spam of the drug nature Message-ID: On 6 Oct 2005, at 18:44, Rodney Green wrote: > How would you do this in Postfix? smtpd_helo_restrictions = reject_non_fqdn_hostname And you can also add reject_unknown_hostname to reject MTAs that HELO with unknown names. These can be quite draconian so you might want to first test them by adding warn_if_reject in front of those so Postfix does the test and logs the failure instead of actually rejecting based on the failure. That way over a few days you can make sure you best customer's dodgy Exchange server isn't being rejected in error. Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Oct 6 19:49:28 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:54 2006 Subject: Fraud Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] In what way? You need to give me rather more information than that. Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem wrote: >Is there a possible to work on the fraud issue . > >It is a good idea, but it does need refining. > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From henker at S-H-COM.DE Thu Oct 6 19:56:13 2005 From: henker at S-H-COM.DE (Steffan Henke) Date: Thu Jan 12 21:30:54 2006 Subject: Still getting spam of the drug nature Message-ID: On Thu, 6 Oct 2005, Alex Neuman wrote: > Is there a way to do this using sendmail? I'll google around a bit, but in > case anybody's already done it... I know AOL and a whole bunch of other ISPs > are doing just that. IIRC, this should be somewhere in the list archives. You may want to google for require_rdns.m4 , just add it to sendmail. Regards, Steffan ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Thu Oct 6 19:47:00 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:30:54 2006 Subject: Mailscanner and big Attach = much swap Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 6 Oct 2005, at 22:55, Suporte SETi - Dennis wrote: Hi. I'm using MailScanner with Qmail, and i dont know wht when I send a mail .. like 40Mb, in my test mail-server the mail scanner go use all RAM and use all SWAP that i set.. and CPU goes 100% .. for much time, like 1 hour.   what's the real problem??   Try putting MailScanner into debug (See bottom of MailScanner.conf) and restarting MS. It will run one batch 'on screen' and should give you an idea what is causing the problem Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From raymond at PROLOCATION.NET Thu Oct 6 20:11:37 2005 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:30:54 2006 Subject: Fraud Message-ID: Hi! > Is there a possible to work on the fraud issue . > > It is a good idea, but it does need refining. Sure, go ahead.... :) Bye, Raymond. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHT.IE Thu Oct 6 20:13:13 2005 From: michele at BLACKNIGHT.IE (Michele Neylon:: Blacknight.ie) Date: Thu Jan 12 21:30:54 2006 Subject: Fraud Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem wrote: > Is there a possible to work on the fraud issue . > > It is a good idea, but it does need refining. > Could you be more vague? :) -- Mr Michele Neylon Blacknight Solutions Quality Business Hosting & Colocation http://www.blacknight.ie/ Tel. 1850 927 280 Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 59 9164239 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From KGoods at AIAINSURANCE.COM Thu Oct 6 20:41:31 2005 From: KGoods at AIAINSURANCE.COM (Ken Goods) Date: Thu Jan 12 21:30:54 2006 Subject: Fraud Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Michele Neylon:: Blacknight.ie wrote: > Dave Shariff Yadallee - System Administrator a.k.a. The Root of the > Problem wrote: >> Is there a possible to work on the fraud issue . >> >> It is a good idea, but it does need refining. >> > Could you be more vague? :) Maybe..... Sorry, couldn't resist. :) Ken ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ralloway at WINBEAM.COM Thu Oct 6 20:49:55 2005 From: ralloway at WINBEAM.COM (Richard D Alloway) Date: Thu Jan 12 21:30:54 2006 Subject: CentOS 4.1 final w/posix lock still having issues Message-ID: On Thu, 6 Oct 2005, Richard D Alloway wrote: > On Wed, 5 Oct 2005, Kevin Spicer wrote: > >> On Wed, 2005-10-05 at 10:17 -0400, Richard D Alloway wrote: >>> But, I still get deliveries with the dreaded "Message body disappears" >>> errors. >> ... >>> What should I look for at this point? >> >> Wild shot in the dark, from the one time I saw this myself (very long >> time ago). Make sure that sendmail is being started from the >> MailScanner startup scripts and that you have the noetrn option on in >> that startup script (its there by default so it should be...). Also >> worth grepping the logs for etrn, just in case the command line option >> isn't being honoured for some reason. You don't want to let folks use >> etrn! >> >> Probably not your problem, but doesn't hurt to check. > > Thanks for the suggestions, but it doesn't look like etrn is the issue. We > don't have anyone using etrn at all on any of our mail servers at this point > and the noetrn option is in the MailScanner startup script. Also, the only > reference to etrn in the logs are lines like: > > Oct 6 09:59:55 smtp-gateway-5 sendmail[22406]: j96DxtOg022406: > [218.68.xxx.xxx] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA > > So, there's still something going on that I'm not aware of... > > Any other thoughts? :) > > -Rich In addition to any further thoughts anyone has regarding why identical installations fail (No Message Collected error) when the only difference is the one failing is the only CentOS box deployed, can someone tell suggest a way to watch the locking processes for sendmail and MailScanner? I can do a strace on sendmail and watch sendmail opening the files in mqueue.in with O_EXCL but watching MailScanner with the same options to strace only shows a bunch of temp files in /tmp and some for clamav. This is regardless of whether it is one of my 5 boxes that is working or the 1 box that isn't. Thanks! -Rich ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Thu Oct 6 20:35:32 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:54 2006 Subject: Spamassassin woes Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Scott Silva spake the following on 10/6/2005 11:11 AM: > Julian Field spake the following on 10/6/2005 10:37 AM: > >>Scott Silva wrote: >> >> >>>Scott Silva spake the following on 10/6/2005 9:41 AM: >>> >>> >>> >>>>>Finally! >>>>>After an extended session in CPAN, things seem OK. I still don't know >>>>>which module was tanked, but it's fixed! >>>>>Thank you to all! >>>>> >>>>>And greeting from California, USA. >>>>>Where any actor can aspire to Governor! >>>>> >>>>> >>>>> >>>> >>>>Spoke too soon! >>>>Although lint tests all work, MailScanner isn't adding the URIBL scores >>>>into messages. >>>>If I take the same message and run it through lint, it shows up. >>>>I guess I'm going to reinstall MailScanner now. >>>>I think I will diff the config files for the two machines again first, >>>>just to make sure. >>>> >>>> >>> >>> >>>Running MailScanner in debug mode gets entries like this; >>> >>>rules: failed to run URIBL_BLACK test, skipping: >>> (Can't locate object method "check_uridnsbl" via package >>>"Mail::SpamAssassin::PerMsgStatus" at >>>/usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/PerMsgStatus.pm line >>>2581. >>> >>>But if I pipe the same message into a lint, it works fine. >>> >>> >> >>You don't have 2 Perl installations do you? >>You will need to have added >>loadplugin Mail::SpamAssassin::Plugin::URIDNSBL >> >>to your init.pre file in /etc/mail/spamassassin, or else the SURBL stuff >>won't work at all. >> > > One perl, and I have the line to load the plugin. > Can't figure out why I can lint a message as root, and get different > results than MailScanner running as root. > That should eliminate any path or permission problems. > > I have found the problem. For some reason, the local rules directory is getting ignored and either MailScanner or spamassassin is looking in /usr/etc/mail/spamassassin instead of /etc/mail/spamassassin The working system had that directory, and the non working system didn't. Making a symlink seems to have cured the non-working system, but now I need to find out why this happened. All my config files have the proper paths in them, so I do not know where this /usr/etc/mail/spamassassin came from. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From campbell at CNPAPERS.COM Thu Oct 6 21:08:04 2005 From: campbell at CNPAPERS.COM (Steve Campbell) Date: Thu Jan 12 21:30:54 2006 Subject: Fraud Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Maybe you should take the alias (aka) more literally. The answer lies there. Steve Campbell campbell@cnpapers.com Charleston Newspapers ----- Original Message ----- From: "Ken Goods" To: Sent: Thursday, October 06, 2005 3:41 PM Subject: Re: Fraud > Michele Neylon:: Blacknight.ie wrote: >> Dave Shariff Yadallee - System Administrator a.k.a. The Root of the >> Problem wrote: >>> Is there a possible to work on the fraud issue . >>> >>> It is a good idea, but it does need refining. >>> >> Could you be more vague? :) > > Maybe..... > > Sorry, couldn't resist. :) > > Ken > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Thu Oct 6 21:02:11 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:54 2006 Subject: Spamassassin woes - OT Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Scott Silva spake the following on 10/6/2005 12:35 PM: > Scott Silva spake the following on 10/6/2005 11:11 AM: > >>Julian Field spake the following on 10/6/2005 10:37 AM: >> >> >>>Scott Silva wrote: >>> >>> >>> >>>>Scott Silva spake the following on 10/6/2005 9:41 AM: >>>> >>>> >>>> >>>> >>>>>>Finally! >>>>>>After an extended session in CPAN, things seem OK. I still don't know >>>>>>which module was tanked, but it's fixed! >>>>>>Thank you to all! >>>>>> >>>>>>And greeting from California, USA. >>>>>>Where any actor can aspire to Governor! >>>>>> >>>>>> >>>>>> >>>>> >>>>>Spoke too soon! >>>>>Although lint tests all work, MailScanner isn't adding the URIBL scores >>>>>into messages. >>>>>If I take the same message and run it through lint, it shows up. >>>>>I guess I'm going to reinstall MailScanner now. >>>>>I think I will diff the config files for the two machines again first, >>>>>just to make sure. >>>>> >>>>> >>>> >>>> >>>>Running MailScanner in debug mode gets entries like this; >>>> >>>>rules: failed to run URIBL_BLACK test, skipping: >>>> (Can't locate object method "check_uridnsbl" via package >>>>"Mail::SpamAssassin::PerMsgStatus" at >>>>/usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/PerMsgStatus.pm line >>>>2581. >>>> >>>>But if I pipe the same message into a lint, it works fine. >>>> >>>> >>> >>>You don't have 2 Perl installations do you? >>>You will need to have added >>>loadplugin Mail::SpamAssassin::Plugin::URIDNSBL >>> >>>to your init.pre file in /etc/mail/spamassassin, or else the SURBL stuff >>>won't work at all. >>> >> >>One perl, and I have the line to load the plugin. >>Can't figure out why I can lint a message as root, and get different >>results than MailScanner running as root. >>That should eliminate any path or permission problems. >> >> > > I have found the problem. > For some reason, the local rules directory is getting ignored and either > MailScanner or spamassassin is looking in /usr/etc/mail/spamassassin > instead of /etc/mail/spamassassin > The working system had that directory, and the non working system didn't. > Making a symlink seems to have cured the non-working system, but now I > need to find out why this happened. > All my config files have the proper paths in them, so I do not know > where this /usr/etc/mail/spamassassin came from. > > Right after I fixed this, I got my highest scoring message - 80.37 points. BAM! You're gone! -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Dave Thu Oct 6 23:10:14 2005 From: Dave (Dave) Date: Thu Jan 12 21:30:54 2006 Subject: Fraud Message-ID: On Thu, Oct 06, 2005 at 07:49:28PM +0100, Julian Field wrote: > In what way? You need to give me rather more information than that. > Again newsletters are marked {Fraud?} even from localhost. Yes there are frauds, but legitimate newsletters? That is for starters. > Dave Shariff Yadallee - System Administrator a.k.a. The Root of the > Problem wrote: > > >Is there a possible to work on the fraud issue . > > > >It is a good idea, but it does need refining. > > > > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Dave Thu Oct 6 23:11:11 2005 From: Dave (Dave) Date: Thu Jan 12 21:30:54 2006 Subject: Fraud Message-ID: On Thu, Oct 06, 2005 at 08:13:13PM +0100, Michele Neylon:: Blacknight.ie wrote: > Dave Shariff Yadallee - System Administrator a.k.a. The Root of the > Problem wrote: > > Is there a possible to work on the fraud issue . > > > > It is a good idea, but it does need refining. > > > Could you be more vague? :) > Now that the attention has been captured ... > -- > Mr Michele Neylon > Blacknight Solutions > Quality Business Hosting & Colocation > http://www.blacknight.ie/ > Tel. 1850 927 280 > Intl. +353 (0) 59 9183072 > Direct Dial: +353 (0)59 9183090 > Fax. +353 (0) 59 9164239 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHT.IE Thu Oct 6 23:14:58 2005 From: michele at BLACKNIGHT.IE (Michele Neylon:: Blacknight.ie) Date: Thu Jan 12 21:30:54 2006 Subject: Fraud Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem wrote: > On Thu, Oct 06, 2005 at 07:49:28PM +0100, Julian Field wrote: > >>In what way? You need to give me rather more information than that. >> > > > Again newsletters are marked {Fraud?} even from localhost. > > Yes there are frauds, but legitimate newsletters? > > That is for starters. > Why don't you do us all a favour and do the following: 1 - Read the documentation. There is plenty of it both in the configuration files, on the MailScanner site and elsewhere 2 - Read the mailing list archives or use the search option 3 - Learn to provide _clear_ information when you are asking for assistance. There are plenty of people on this list who will help you if you follow steps 1 to 3 -- Mr Michele Neylon Blacknight Solutions Quality Business Hosting & Colocation http://www.blacknight.ie/ Tel. 1850 927 280 Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 59 9164239 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ka at PACIFIC.NET Thu Oct 6 23:29:58 2005 From: ka at PACIFIC.NET (Ken A) Date: Thu Jan 12 21:30:54 2006 Subject: O.T. mod_perl smtp server Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Anyone played with this? http://search.cpan.org/~mock/Apache-SMTP-0.01/lib/Apache/SMTP.pm It's Apache2, mod_perl, and Net::SMTP to make a simple scalable smtp server or smtp proxy. Might it be a good fit for mailscanner? Looks like it was developed by http://www.mailchannels.com/opensource/ I think I'd like being able to use mod_throttle to throttle smtp connections! It's made my list of 'must tinker with' toys of 2005. Ken A Pacific.Net ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From vasiliy at linuxspecial.com Thu Oct 6 23:35:48 2005 From: vasiliy at linuxspecial.com (Vasiliy Boulytchev) Date: Thu Jan 12 21:30:54 2006 Subject: We would love to help! (RE: FRAUD) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dave Shariff, Please join the Irc server (irc.freenode.net) and join #mailscanner. I hope you know how to use irc... On irc people disregard the needless 1s 2s and 3s and get right to the point :))))))) -- Vasiliy Boulytchev Colorado Information Technologies www.coinfotech.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mgt at STELLARCORE.NET Fri Oct 7 00:19:22 2005 From: mgt at STELLARCORE.NET (Mike Tremaine) Date: Thu Jan 12 21:30:54 2006 Subject: MailScanner and Logwatch Message-ID: On Thu, 6 Oct 2005 13:18:16 -0500, Alex Neuman wrote: >Thanks... I'll look into it right away... > You can also post the types of entries you are not getting matched to logawtch -at- logwatch -dot- org and I'll be happy to do something with them. We should have a new beta coming out shortly so now would be a good time to hit me with new stuff. -Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From vasiliy at linuxspecial.com Fri Oct 7 00:23:27 2005 From: vasiliy at linuxspecial.com (Vasiliy Boulytchev) Date: Thu Jan 12 21:30:54 2006 Subject: We would love to help! (RE: FRAUD) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Vasiliy Boulytchev wrote: > Dave Shariff, > > Please join the Irc server (irc.freenode.net) and join #mailscanner. > > I hope you know how to use irc... > > On irc people disregard the needless 1s 2s and 3s and get right to the > point :))))))) > http://www.google.com/search?q=dave+shariff&start=0&start=0&ie=utf-8&oe=utf-8&client=firefox-a&rls=org.mozilla:en-US:official Gentlemen, here is a google search on David Shariff's cries out for help :). Seems that he follows the same pattern :))) Sorry, its just too funny. Anyone posting this to slashdot? j/k -- Vasiliy Boulytchev Colorado Information Technologies www.coinfotech.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jlmiller at MMTNETWORKS.COM.AU Fri Oct 7 02:01:55 2005 From: jlmiller at MMTNETWORKS.COM.AU (Jon Miller) Date: Thu Jan 12 21:30:54 2006 Subject: spam mail Message-ID: Maybe I'm not getting the jest of how this is supposed to work, but I keep getting sporadic spam mail with basically the same content and certain key words that in my opinion should be picked up by either SA or MS. The subject is different but the content isn't. So my question is does either of the two apps actually scan the content (body) of the e-mail or are they just looking at the header and subject line? Thanks Jon L. Miller, ASE, CNS, CLS, MCNE, CCNA Director/Sr Systems Consultant MMT Networks Pty Ltd http://www.mmtnetworks.com.au Resellers for: Sophos Anti-Virus, Novell, Cisco, Swifdsl "I don't know the key to success, but the key to failure is trying to please everybody." -Bill Cosby ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "HTML" Text/PLAIN 32 lines. ] [ Unable to print this part. ] From ugob at CAMO-ROUTE.COM Fri Oct 7 02:45:14 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:54 2006 Subject: spam mail Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jon Miller wrote: > Maybe I'm not getting the jest of how this is supposed to work, but I keep getting sporadic spam mail with basically the same content and certain key words that in my opinion should be picked up by either SA or MS. The subject is different but the content isn't. So my question is does either of the two apps actually scan the content (body) of the e-mail or are they just looking at the header and subject line? Spamassassin scans the headers + body. MailScanner doesn't scan anything for spam. It only checks for RBL if you ask it to. You can't decide to treat a message as spam just because of one word... To improve your setup, please read: http://wiki.mailscanner.info/doku.php?id=maq:index#optimization_tips Regards, -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Fri Oct 7 03:30:02 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:54 2006 Subject: O.T. mod_perl smtp server Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ken A wrote: > Anyone played with this? > http://search.cpan.org/~mock/Apache-SMTP-0.01/lib/Apache/SMTP.pm > > It's Apache2, mod_perl, and Net::SMTP to make a simple scalable smtp > server or smtp proxy. > > Might it be a good fit for mailscanner? > I don't see exactly why one would use in prod environment a product that seems to be young. You have a lot of mature alternatives for MTA: Sendmail, Postfix, Exim, Qmail, Zmailer that offer many different ways to be configured. Apparently, you can throttle connexions with a milter or a config. > Looks like it was developed by http://www.mailchannels.com/opensource/ > > I think I'd like being able to use mod_throttle to throttle smtp > connections! It's made my list of 'must tinker with' toys of 2005. > > Ken A > Pacific.Net > -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Oct 7 08:59:16 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:54 2006 Subject: Spamassassin woes Message-ID: Scott Oh and SpamAssassin Site Rules Dir = /etc/mail/spamassassin As well :-) -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Scott Silva Sent: 06 October 2005 20:36 To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: [MAILSCANNER] Spamassassin woes Scott Silva spake the following on 10/6/2005 11:11 AM: > Julian Field spake the following on 10/6/2005 10:37 AM: > >>Scott Silva wrote: >> >> >>>Scott Silva spake the following on 10/6/2005 9:41 AM: >>> >>> >>> >>>>>Finally! >>>>>After an extended session in CPAN, things seem OK. I still don't know >>>>>which module was tanked, but it's fixed! >>>>>Thank you to all! >>>>> >>>>>And greeting from California, USA. >>>>>Where any actor can aspire to Governor! >>>>> >>>>> >>>>> >>>> >>>>Spoke too soon! >>>>Although lint tests all work, MailScanner isn't adding the URIBL scores >>>>into messages. >>>>If I take the same message and run it through lint, it shows up. >>>>I guess I'm going to reinstall MailScanner now. >>>>I think I will diff the config files for the two machines again first, >>>>just to make sure. >>>> >>>> >>> >>> >>>Running MailScanner in debug mode gets entries like this; >>> >>>rules: failed to run URIBL_BLACK test, skipping: >>> (Can't locate object method "check_uridnsbl" via package >>>"Mail::SpamAssassin::PerMsgStatus" at >>>/usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/PerMsgStatus.pm line >>>2581. >>> >>>But if I pipe the same message into a lint, it works fine. >>> >>> >> >>You don't have 2 Perl installations do you? >>You will need to have added >>loadplugin Mail::SpamAssassin::Plugin::URIDNSBL >> >>to your init.pre file in /etc/mail/spamassassin, or else the SURBL stuff >>won't work at all. >> > > One perl, and I have the line to load the plugin. > Can't figure out why I can lint a message as root, and get different > results than MailScanner running as root. > That should eliminate any path or permission problems. > > I have found the problem. For some reason, the local rules directory is getting ignored and either MailScanner or spamassassin is looking in /usr/etc/mail/spamassassin instead of /etc/mail/spamassassin The working system had that directory, and the non working system didn't. Making a symlink seems to have cured the non-working system, but now I need to find out why this happened. All my config files have the proper paths in them, so I do not know where this /usr/etc/mail/spamassassin came from. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Oct 7 09:01:42 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:54 2006 Subject: spam mail Message-ID: Also check http://wiki.mailscanner.info/doku.php?id=documentation:anti_spam:spamassassi n:rules:recommended There's a whole load of rules that are really useful. Also check you've got the URI-RBL's working.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Jon Miller Sent: 07 October 2005 02:02 To: MAILSCANNER@JISCMAIL.AC.UK Subject: [MAILSCANNER] spam mail Maybe I'm not getting the jest of how this is supposed to work, but I keep getting sporadic spam mail with basically the same content and certain key words that in my opinion should be picked up by either SA or MS. The subject is different but the content isn't. So my question is does either of the two apps actually scan the content (body) of the e-mail or are they just looking at the header and subject line? Thanks Jon L. Miller, ASE, CNS, CLS, MCNE, CCNA Director/Sr Systems Consultant MMT Networks Pty Ltd http://www.mmtnetworks.com.au Resellers for: Sophos Anti-Virus, Novell, Cisco, Swifdsl "I don't know the key to success, but the key to failure is trying to please everybody." -Bill Cosby ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Oct 7 08:58:27 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:54 2006 Subject: Spamassassin woes Message-ID: Scott Check MailScanner.conf and make sure "SpamAssassin Local Rules Dir" and "SpamAssassin Default Rules Dir" equal nothing... ie #SpamAssassin Local Rules Dir = /opt/MailScanner/etc/mail/spamassassin SpamAssassin Local Rules Dir = # The default rules are searched for here, and in prefix/share/spamassassin, # /usr/local/share/spamassassin, /usr/share/spamassassin, and maybe others. # If this is set then it adds to the list of places that are searched; # otherwise it has no effect. #SpamAssassin Default Rules Dir = /opt/MailScanner/share/spamassassin SpamAssassin Default Rules Dir = -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Scott Silva Sent: 06 October 2005 20:36 To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: [MAILSCANNER] Spamassassin woes Scott Silva spake the following on 10/6/2005 11:11 AM: > Julian Field spake the following on 10/6/2005 10:37 AM: > >>Scott Silva wrote: >> >> >>>Scott Silva spake the following on 10/6/2005 9:41 AM: >>> >>> >>> >>>>>Finally! >>>>>After an extended session in CPAN, things seem OK. I still don't know >>>>>which module was tanked, but it's fixed! >>>>>Thank you to all! >>>>> >>>>>And greeting from California, USA. >>>>>Where any actor can aspire to Governor! >>>>> >>>>> >>>>> >>>> >>>>Spoke too soon! >>>>Although lint tests all work, MailScanner isn't adding the URIBL scores >>>>into messages. >>>>If I take the same message and run it through lint, it shows up. >>>>I guess I'm going to reinstall MailScanner now. >>>>I think I will diff the config files for the two machines again first, >>>>just to make sure. >>>> >>>> >>> >>> >>>Running MailScanner in debug mode gets entries like this; >>> >>>rules: failed to run URIBL_BLACK test, skipping: >>> (Can't locate object method "check_uridnsbl" via package >>>"Mail::SpamAssassin::PerMsgStatus" at >>>/usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/PerMsgStatus.pm line >>>2581. >>> >>>But if I pipe the same message into a lint, it works fine. >>> >>> >> >>You don't have 2 Perl installations do you? >>You will need to have added >>loadplugin Mail::SpamAssassin::Plugin::URIDNSBL >> >>to your init.pre file in /etc/mail/spamassassin, or else the SURBL stuff >>won't work at all. >> > > One perl, and I have the line to load the plugin. > Can't figure out why I can lint a message as root, and get different > results than MailScanner running as root. > That should eliminate any path or permission problems. > > I have found the problem. For some reason, the local rules directory is getting ignored and either MailScanner or spamassassin is looking in /usr/etc/mail/spamassassin instead of /etc/mail/spamassassin The working system had that directory, and the non working system didn't. Making a symlink seems to have cured the non-working system, but now I need to find out why this happened. All my config files have the proper paths in them, so I do not know where this /usr/etc/mail/spamassassin came from. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Oct 7 09:22:16 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:54 2006 Subject: Fwd: IPv6 sendmail problem Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Repost as it seems to have lost the message. From: Julian Field Date: 7 October 2005 08:45:18 BDT To: MailScanner mailing list Subject: IPv6 sendmail problem One for you gurus out there... I'm using IPv6 with sendmail 8.13.1 on RHEL 4 box. Got problems relaying. My access db contains these IPv6 lines: IPv6:2001:0630:00d0 RELAY IPv6:2001:630:d0 RELAY [IPv6:2001:0630:00d0] RELAY As you can see I have tried a few variants :-) But I still get these errors:    ----- Transcript of session follows ----- ... while talking to relay.ecs.soton.ac.uk.: DATA <<< 550 5.7.1 ... Relaying denied. IP name lookup failed [IPv6:2001:630:d0:f110:204:23ff:feb3:e42c] 550 5.1.1 user@domain.ac.uk... User unknown <<< 503 5.0.0 Need RCPT (recipient) (Names changed to protect the innocent) It appears to be ignoring my IPv6 RELAY lines altogether. Any ideas? --  Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 --  Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Application/PGP-SIGNATURE 498bytes. ] [ Unable to print this part. ] From dee at asyouneed.com Fri Oct 7 09:52:10 2005 From: dee at asyouneed.com (Dee Lowndes) Date: Thu Jan 12 21:30:54 2006 Subject: Stopping Messages broken up by HTML Message-ID: Hi All, Does anyone have a ruleset that can stop messages that are broken up by html as seen below. Regards, Dee Lowndes Hi Do you want t pend less On yo ations? o s ur Meddic Yes? Peace of cake :) - Additional information Lev Xan Cia Via Am Vali it a li g b u ra x s $1 ra $ ien m $ .21 3.33 3.75 plus 200 other , Good bye ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Oct 7 10:07:51 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:54 2006 Subject: Stopping Messages broken up by HTML Message-ID: Dee Put up the full email on a web page somewhere (headers and all). I'll run it over my system, which has lots of extra rules, and I'll what hits. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Dee Lowndes Sent: 07 October 2005 09:52 To: MAILSCANNER@JISCMAIL.AC.UK Subject: [MAILSCANNER] Stopping Messages broken up by HTML Hi All, Does anyone have a ruleset that can stop messages that are broken up by html as seen below. Regards, Dee Lowndes Hi Do you want t pend less On yo ations? o s ur Meddic Yes? Peace of cake :) - Additional information Lev Xan Cia Via Am Vali it a li g b u ra x s $1 ra $ ien m $ .21 3.33 3.75 plus 200 other , Good bye ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Oct 7 08:45:18 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:54 2006 Subject: IPv6 sendmail problem Message-ID: -----BEGIN PGP SIGNED MESSAGE----- One for you gurus out there... I'm using IPv6 with sendmail 8.13.1 on RHEL 4 box. Got problems relaying. My access db contains these IPv6 lines: IPv6:2001:0630:00d0 RELAY IPv6:2001:630:d0 RELAY [IPv6:2001:0630:00d0] RELAY As you can see I have tried a few variants :-) But I still get these errors: ----- Transcript of session follows ----- ... while talking to relay.ecs.soton.ac.uk.: >>> DATA >>> <<< 550 5.7.1 ... Relaying denied. IP name lookup failed [IPv6:2001:630:d0:f110:204:23ff:feb3:e42c] 550 5.1.1 user@domain.ac.uk... User unknown <<< 503 5.0.0 Need RCPT (recipient) (Names changed to protect the innocent) It appears to be ignoring my IPv6 RELAY lines altogether. Any ideas? - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ0YnkPw32o+k+q+hAQFasAf/WaQ/qCu5PbQbhCSHmpmWl75AjDGvYrT+ 8IkT/Lm7Cov8DNceoeAvVpkgpdPHFxQjpNfHA5yiTOjky39m/dKn2X9HXSq0J8Aa bY+Z2EeyMqx3LXAG9Kw7LA993gACewkd+yIKHPWCIZVclYTzp3zpjE1Tg3rF3Eq7 xHyh4B/zh4NPIec7bUE1YsNf1qq2DtJ3ANygr+jCHir6LAhGu9tZOJWS5mlf9zs2 HgERppUP9fhqggFBZAyNcddSNr3v2gu9Bqdp4oRCrcV+8SPRIznZh3nreiQ3Xept ZLcIi9CkeNbDpANTigEAULoytY9LAqzczl6BkYIxZBIjgewZYYEVHQ== =SRIs -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lbcadmin at gmail.com Fri Oct 7 14:39:51 2005 From: lbcadmin at gmail.com (Information Services) Date: Thu Jan 12 21:30:54 2006 Subject: Clustering MS Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I did a search on MailScanner wiki for rsync and did not find Glenn's 5ki15 script. Was wondering if the script was done, and posted somewhere that I am not aware of? On 8/30/05, Glenn Steen wrote: On 30/08/05, James Gray wrote: > On Tuesday 30 August 2005 19:58, Raymond Dijkxhoorn wrote: (snip) > > > Simplistically you could keep the plaintext config files in sync with > > > any tool ... like rsync... > > > > Sure, but there is a product doing that, the things you mentioned. If you > > have the cashflow to make 2 datacenters you most likely can send some > > towards Julian by supporting the product. You can also do some rsync trics > > but most likely you have to figure that out ytourself. > > It's weird - we have two data centres (Boston MA, USA and Sydney AUST), two > MailScanner gateways and I was only pondering today that I really should pull > my finger out and write a combined script that "rsync's" all the configs then > restarts stuff that's changed so I only have to modify the files on one > machine..... > > Anyone interested to see my scripting 5ki15 when it's all done? Should fit well in the wiki, no? > > We run independent bayes databases on each server - they get enough of the > same sort of mail to be "close enough". If we ever wanted shared a database > I'd put in some sort of funky mysql replication...or something along those > lines anyway (never looked into it in much detail). > > Cheers > > James > -- > Until Eve arrived, this was a man's world. > -- Richard Armour Are you sure Eve sisn't take the position "You had it on loan for a few minutes, 's all! You no-good oaf!" on this one?-) -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki ( http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lbcadmin at gmail.com Fri Oct 7 14:44:14 2005 From: lbcadmin at gmail.com (Information Services) Date: Thu Jan 12 21:30:54 2006 Subject: MailScanner on boot Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have a CentOS 4.1 system with MailScanner loaded for the possibility of using in one or our remote locations. I have gone into the GUI services and took the check out of MailScanner and Sendmail to startup at boot, but that did not seem to keep MailScanner from starting on a boot. I did a chkconfig and turned off all mailscanner levels, and I must not understand the purpose of chkconfig, but once again Mailscanner has decided to when the system is booted. What can I do to keep MailScanner from running when the system is rebooted? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From naolson at gmail.com Fri Oct 7 14:53:17 2005 From: naolson at gmail.com (Nathan Olson) Date: Thu Jan 12 21:30:54 2006 Subject: Clustering MS Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] cfengine may be useful for synchronization. Ideally, a Makefile should exist if rsync is used. You'd change the config and then just type 'make'. Nate ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michael at NOMENNESCIO.NET Fri Oct 7 15:07:07 2005 From: michael at NOMENNESCIO.NET (Mike) Date: Thu Jan 12 21:30:54 2006 Subject: IPv6 sendmail problem Message-ID: > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Julian Field > > One for you gurus out there... > > I'm using IPv6 with sendmail 8.13.1 on RHEL 4 box. > > Got problems relaying. My access db contains these IPv6 lines: > > IPv6:2001:0630:00d0 RELAY > IPv6:2001:630:d0 RELAY > [IPv6:2001:0630:00d0] RELAY > > As you can see I have tried a few variants :-) > > But I still get these errors: > > ----- Transcript of session follows ----- > ... while talking to relay.ecs.soton.ac.uk.: > > >>> DATA > >>> > <<< 550 5.7.1 ... Relaying denied. IP name lookup > failed [IPv6:2001:630:d0:f110:204:23ff:feb3:e42c] I think the problem is that the IPv6 address 2001:630:d0:f110:204:23ff:feb3:e42c cannot be resolved into an IP name: # host 2001:630:d0:f110:204:23ff:feb3:e42c Host c.2.4.e.3.b.e.f.f.f.3.2.4.0.2.0.0.1.1.f.0.d.0.0.0.3.6.0.1.0.0.2.ip6.arpa not found: 3(NXDOMAIN) As opposed to: # host 2001:630:d0:f102:230:48ff:fe11:b6bc c.b.6.b.1.1.e.f.f.f.8.4.0.3.2.0.2.0.1.f.0.d.0.0.0.3.6.0.1.0.0.2.ip6.arpa domain name pointer peewit.ecs.soton.ac.uk. (relay.ecs.soton.ac.uk being an alias for peewit). I presume that the relay entries in your access.db are therefore not executed. On the notation, I have the following entry in my access.db: Connect:IPv6:2002:507f:a412::1 OK So, IMHO the [] are not necessary. IPv6:2001:630:d0 RELAY should be ok. > It appears to be ignoring my IPv6 RELAY lines altogether. > > Any ideas? > - -- > Julian Field Mike. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cconn at ABACOM.COM Fri Oct 7 15:44:20 2005 From: cconn at ABACOM.COM (Chris Conn) Date: Thu Jan 12 21:30:54 2006 Subject: Upgrade uncertainty Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello, I recently upgraded a MS box from RHEL3 to CentOS4. I used to run MS 4.37 and SA 3.0.4 and I would frequently using ClamAV detect the following viruses: HTML.Phishing.Auction-XX HTML.Phishing.Bank-XX With my brand new box running SA 3.1 and MS 4.46-2, I no longer see ClamAV detecting these. I am wondering if they are now flagged as high scoring spam and never scanned by ClamAV? I read down the ChangeLog and did not find anything mentioning this.... Also, on the main site, I see: 1/10/2005 Released stable version 4.64.2. SpamAssassin 3.1.0 supported better, and a few minor features and bug fixes. I only find 4.46.2-2 for download, so I expect this is a typo? Thanks, Chris ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lbcadmin at gmail.com Fri Oct 7 15:45:18 2005 From: lbcadmin at gmail.com (Information Services) Date: Thu Jan 12 21:30:54 2006 Subject: MailScanner on boot Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Okay, I did the 'chkconfig --list MailScanner' and saw the different run levels turned on. So yes, I can see that 'mailscanner' is not the way to go. I ran 'chkconfig --levels 0123456 MailScanner off' and rebooted. Still the same problem. Denis, I didn't even thought about the cron.hourly job for check_MailScanner. I removed this from the cron.hourly, and rebooted....currently wait for system to reboot.......okay rebooted now. Looks like removing the check_MailScanner from the cron.hourly fixed it. now when I do a 'service MailScanner status' I get an error for sendmail.in.pid and sendmail.out.pid. This would be expected. now when I decide to use MailScanner on this system, I just need to remember to add check_MailScanner back into cron.hourly. Nate, thanks for clearing up difference between "MailScanner" and "mailscanner," this could have continued to haunt me in other situations. Casey On 10/7/05, Denis Beauchemin wrote: Information Services wrote: > I have a CentOS 4.1 system with MailScanner loaded for the possibility > of using in one or our remote locations. I have gone into the GUI > services and took the check out of MailScanner and Sendmail to startup > at boot, but that did not seem to keep MailScanner from starting on a > boot. I did a chkconfig and turned off all mailscanner levels, and I > must not understand the purpose of chkconfig, but once again > Mailscanner has decided to when the system is booted. What can I do > to keep MailScanner from running when the system is rebooted?** Maybe /etc/cron.hourly/check_MailScanner is restarting it? OTOH, are you sure MS is completely disabled? Do "chkconfig --list MailScanner" and make sure it is off in all run levels. Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Oct 7 16:21:44 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:54 2006 Subject: Upgrade uncertainty Message-ID: Typo, now fixed. On 7 Oct 2005, at 15:44, Chris Conn wrote: > Also, on the main site, I see: > > 1/10/2005 Released stable version 4.64.2. SpamAssassin 3.1.0 > supported better, and a few minor features and bug fixes. > > I only find 4.46.2-2 for download, so I expect this is a typo? -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Oct 7 16:25:29 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:54 2006 Subject: MailScanner on boot Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] It's a bit more intelligent than that. If you do a "service MailScanner stop" it creates a lockfile in /var/lock/subsys/MailScanner.off. When the hourly cron job runs, it detects the presence of this file and doesn't then start up MailScanner. So all you need to do is a "service MailScanner stop" and it will stay stopped. No need to mess around with the cron jobs at all. On 7 Oct 2005, at 15:45, Information Services wrote: Okay,  I did the 'chkconfig --list MailScanner' and saw the different run levels turned on.  So yes, I can see that 'mailscanner' is not the way to go.  I ran 'chkconfig --levels 0123456 MailScanner off' and rebooted.  Still the same problem.  Denis, I didn't even thought about the cron.hourly job for check_MailScanner.  I removed this from the cron.hourly, and rebooted....currently wait for system to reboot.......okay rebooted now. Looks like removing the check_MailScanner from the cron.hourly fixed it.  now when I do a 'service MailScanner status' I get an error for sendmail.in.pid and sendmail.out.pid.  This would be expected.  now when I decide to use MailScanner on this system, I just need to remember to add  check_MailScanner back into cron.hourly. Nate, thanks for clearing up difference between "MailScanner" and "mailscanner," this could have continued to haunt me in other situations. Casey On 10/7/05, Denis Beauchemin wrote: Information Services wrote: > I have a CentOS 4.1 system with MailScanner loaded for the possibility > of using in one or our remote locations.  I have gone into the GUI > services and took the check out of MailScanner and Sendmail to startup > at boot, but that did not seem to keep MailScanner from starting on a > boot.  I did a chkconfig and turned off all mailscanner levels, and I > must not understand the purpose of chkconfig, but once again > Mailscanner has decided to when the system is booted.  What can I do > to keep MailScanner from running when the system is rebooted?** Maybe /etc/cron.hourly/check_MailScanner is restarting it? OTOH, are you sure MS is completely disabled?  Do "chkconfig --list MailScanner" and make sure it is off in all run levels. --  Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Fri Oct 7 16:37:16 2005 From: alex at nkpanama.com (Alex Neuman) Date: Thu Jan 12 21:30:54 2006 Subject: Still getting spam of the drug nature Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Steffan Henke wrote: > IIRC, this should be somewhere in the list archives. You may want to > google for require_rdns.m4 , just add it to sendmail. > I found that and a few others... thanks! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Fri Oct 7 16:36:01 2005 From: alex at nkpanama.com (Alex Neuman) Date: Thu Jan 12 21:30:54 2006 Subject: CentOS 4.1 final w/posix lock still having issues Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Richard D Alloway wrote: > On Thu, 6 Oct 2005, Richard D Alloway wrote: > >> On Wed, 5 Oct 2005, Kevin Spicer wrote: >> >>> On Wed, 2005-10-05 at 10:17 -0400, Richard D Alloway wrote: >>>> But, I still get deliveries with the dreaded "Message body >>>> disappears" errors. >>> ... >>>> What should I look for at this point? >>> >>> Wild shot in the dark, from the one time I saw this myself (very long >>> time ago). Make sure that sendmail is being started from the >>> MailScanner startup scripts and that you have the noetrn option on in >>> that startup script (its there by default so it should be...). Also >>> worth grepping the logs for etrn, just in case the command line option >>> isn't being honoured for some reason. You don't want to let folks use >>> etrn! >>> >>> Probably not your problem, but doesn't hurt to check. >> >> Thanks for the suggestions, but it doesn't look like etrn is the >> issue. We don't have anyone using etrn at all on any of our mail >> servers at this point and the noetrn option is in the MailScanner >> startup script. Also, the only reference to etrn in the logs are >> lines like: >> >> Oct 6 09:59:55 smtp-gateway-5 sendmail[22406]: j96DxtOg022406: >> [218.68.xxx.xxx] did not issue MAIL/EXPN/VRFY/ETRN during connection >> to MTA >> >> So, there's still something going on that I'm not aware of... >> >> Any other thoughts? :) >> >> -Rich > > In addition to any further thoughts anyone has regarding why identical > installations fail (No Message Collected error) when the only > difference is the one failing is the only CentOS box deployed, can > someone tell suggest a way to watch the locking processes for sendmail > and MailScanner? > > I can do a strace on sendmail and watch sendmail opening the files in > mqueue.in with O_EXCL but watching MailScanner with the same options > to strace only shows a bunch of temp files in /tmp and some for clamav. > > This is regardless of whether it is one of my 5 boxes that is working > or the 1 box that isn't. > > Thanks! > > -Rich > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! I once had a problem on a CentOS box that seemed to be lock-related. From time to time messages would be delivered with extra LF's and dovecot would refuse to read them. The problem went away when I set Max Child Processes = 1; I don't remember if/how I solved it after that. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ka at PACIFIC.NET Fri Oct 7 16:48:41 2005 From: ka at PACIFIC.NET (Ken A) Date: Thu Jan 12 21:30:54 2006 Subject: O.T. mod_perl smtp server Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ugo Bellavance wrote: > Ken A wrote: >> Anyone played with this? >> http://search.cpan.org/~mock/Apache-SMTP-0.01/lib/Apache/SMTP.pm >> >> It's Apache2, mod_perl, and Net::SMTP to make a simple scalable smtp >> server or smtp proxy. >> >> Might it be a good fit for mailscanner? >> > > I don't see exactly why one would use in prod environment a product that > seems to be young. You have a lot of mature alternatives for MTA: > Sendmail, Postfix, Exim, Qmail, Zmailer that offer many different ways > to be configured. Apparently, you can throttle connexions with a milter > or a config. You are right about it being immature and not ready for prod envirionment. It's not even written yet. There are some developers here too though. It's probably not ever going to be wise to dump your mail hub MTAs for this. But, because a MailScanner machines are often setup as a relays out in front of other machines, and MailScanner and SA are perl, this could reduce the i/o that MailScanner does quite a bit by keeping mail in the pipeline. Tt would put MailScanner 'in' a lightweight MTA, but you'd lose the benefits of the IN/OUT queuing buckets. I just thought I'd mention it here, since I feel there may be some potential efficiency gains, and when it comes to mail processing, that's a big deal. Thanks, Ken A Pacific.Net > >> Looks like it was developed by http://www.mailchannels.com/opensource/ >> >> I think I'd like being able to use mod_throttle to throttle smtp >> connections! It's made my list of 'must tinker with' toys of 2005. >> >> Ken A >> Pacific.Net >> > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From luca.palazzo at NCE-ICT.IT Fri Oct 7 16:52:36 2005 From: luca.palazzo at NCE-ICT.IT (Luca Palazzo) Date: Thu Jan 12 21:30:54 2006 Subject: Postfix queue file Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, When I try to requeue messages i got: fatal: uid=0: unexpected record type: 67 I'm using mailscanner 4.41 with spam messages stored (Quarantine Whole Messages As Queue Files = yes) How can I requeue them? Thanks - -- Luca Palazzo System Engineer N.C.E. Network Consulting Engineering s.r.l. Via Etnea, 52 - 95028 Valverde (CT) - ITALY Tel/Fax: +39 095 524190 Mobile: +39 340 4608689 web: www.nce-ict.it mail: luca.palazzo@nce-ict.it -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFDRpnEFU0TB0V8iHsRAniEAJ9gJiqC43VjeF9uiOUwLGyrwV8O5QCfRDTs fH5iG0adP3JQVnb7Kwu1IXI= =FZYz -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Fri Oct 7 16:45:23 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:54 2006 Subject: Spamassassin woes Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Martin Hepworth spake the following on 10/7/2005 12:59 AM: > Scott > > Oh and > > SpamAssassin Site Rules Dir = /etc/mail/spamassassin > > As well :-) > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > Of Scott Silva > Sent: 06 October 2005 20:36 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: [MAILSCANNER] Spamassassin woes > > Scott Silva spake the following on 10/6/2005 11:11 AM: > >>Julian Field spake the following on 10/6/2005 10:37 AM: >> >> >>>Scott Silva wrote: >>> >>> >>> >>>>Scott Silva spake the following on 10/6/2005 9:41 AM: >>>> >>>> >>>> >>>> >>>>>>Finally! >>>>>>After an extended session in CPAN, things seem OK. I still don't know >>>>>>which module was tanked, but it's fixed! >>>>>>Thank you to all! >>>>>> >>>>>>And greeting from California, USA. >>>>>>Where any actor can aspire to Governor! >>>>>> >>>>>> >>>>>> >>>>> >>>>>Spoke too soon! >>>>>Although lint tests all work, MailScanner isn't adding the URIBL scores >>>>>into messages. >>>>>If I take the same message and run it through lint, it shows up. >>>>>I guess I'm going to reinstall MailScanner now. >>>>>I think I will diff the config files for the two machines again first, >>>>>just to make sure. >>>>> >>>>> >>>> >>>> >>>>Running MailScanner in debug mode gets entries like this; >>>> >>>>rules: failed to run URIBL_BLACK test, skipping: >>>> (Can't locate object method "check_uridnsbl" via package >>>>"Mail::SpamAssassin::PerMsgStatus" at >>>>/usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/PerMsgStatus.pm line >>>>2581. >>>> >>>>But if I pipe the same message into a lint, it works fine. >>>> >>>> >>> >>>You don't have 2 Perl installations do you? >>>You will need to have added >>>loadplugin Mail::SpamAssassin::Plugin::URIDNSBL >>> >>>to your init.pre file in /etc/mail/spamassassin, or else the SURBL stuff >>>won't work at all. >>> >> >>One perl, and I have the line to load the plugin. >>Can't figure out why I can lint a message as root, and get different >>results than MailScanner running as root. >>That should eliminate any path or permission problems. >> >> > > I have found the problem. > For some reason, the local rules directory is getting ignored and either > MailScanner or spamassassin is looking in /usr/etc/mail/spamassassin > instead of /etc/mail/spamassassin > The working system had that directory, and the non working system didn't. > Making a symlink seems to have cured the non-working system, but now I > need to find out why this happened. > All my config files have the proper paths in them, so I do not know > where this /usr/etc/mail/spamassassin came from. > > This was blank as the default seemed to be the proper directory, but I guess time changes all. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Fri Oct 7 17:01:40 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:30:54 2006 Subject: Postfix queue file Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Luca Palazzo wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi all, > When I try to requeue messages i got: > fatal: uid=0: unexpected record type: 67 > > I'm using mailscanner 4.41 with spam messages stored (Quarantine Whole > Messages As Queue Files = yes) > > How can I requeue them? > > Thanks > - -- > > Luca Palazzo See if this helps.. [all on one line] http://wiki.mailscanner.info/doku.php?id=documentation:configuration:mta:postfix:how_to:release_quarantined_mail - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lbcadmin at gmail.com Fri Oct 7 17:32:30 2005 From: lbcadmin at gmail.com (Information Services) Date: Thu Jan 12 21:30:54 2006 Subject: MailScanner on boot Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian, I see what you are saying, and I gave it a try, and for some reason MailScanner starts on it's own. Thinking about what I have running on my system: MailWatch RDJ Spamassassin sendmail I realized that I had made a config change in /etc/rulesdujour/config and added SA_RESTART="/etc/init.d/MailScanner restart"; I changed this line to "/root/do_nothing.sh"; and then turned off MailScanner with 'service MailScanner stop'....rebooted, I have looked into all my cron jobs, and there is nothing that I can see in cron that would specify MailScanner. I am not sure what else to check. About one minute after a reboot MailScanner starts automatically. What am I missing here? On 10/7/05, Julian Field wrote: It's a bit more intelligent than that. If you do a "service MailScanner stop" it creates a lockfile in /var/lock/subsys/MailScanner.off. When the hourly cron job runs, it detects the presence of this file and doesn't then start up MailScanner. So all you need to do is a "service MailScanner stop" and it will stay stopped. No need to mess around with the cron jobs at all. On 7 Oct 2005, at 15:45, Information Services wrote: Okay, I did the 'chkconfig --list MailScanner' and saw the different run levels turned on. So yes, I can see that 'mailscanner' is not the way to go. I ran 'chkconfig --levels 0123456 MailScanner off' and rebooted. Still the same problem. Denis, I didn't even thought about the cron.hourly job for check_MailScanner. I removed this from the cron.hourly, and rebooted....currently wait for system to reboot.......okay rebooted now. Looks like removing the check_MailScanner from the cron.hourly fixed it. now when I do a 'service MailScanner status' I get an error for sendmail.in.pid and sendmail.out.pid. This would be expected. now when I decide to use MailScanner on this system, I just need to remember to add check_MailScanner back into cron.hourly. Nate, thanks for clearing up difference between "MailScanner" and "mailscanner," this could have continued to haunt me in other situations. Casey On 10/7/05, Denis Beauchemin < Denis.Beauchemin@usherbrooke.ca> wrote: Information Services wrote: > I have a CentOS 4.1 system with MailScanner loaded for the possibility > of using in one or our remote locations. I have gone into the GUI > services and took the check out of MailScanner and Sendmail to startup > at boot, but that did not seem to keep MailScanner from starting on a > boot. I did a chkconfig and turned off all mailscanner levels, and I > must not understand the purpose of chkconfig, but once again > Mailscanner has decided to when the system is booted. What can I do > to keep MailScanner from running when the system is rebooted?** Maybe /etc/cron.hourly/check_MailScanner is restarting it? OTOH, are you sure MS is completely disabled? Do "chkconfig --list MailScanner" and make sure it is off in all run levels. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From phachey at CITY.CORNWALL.ON.CA Fri Oct 7 17:48:31 2005 From: phachey at CITY.CORNWALL.ON.CA (Philip Hachey) Date: Thu Jan 12 21:30:54 2006 Subject: 4.46.2: updates to perl modules Message-ID: I'm running Perl 5.8.7 on WhiteBox 3 Linux, and module versions similar to yours with these differences: Files::Spec 3.11 (PathTools) IO::Stringy 2.108 (hmm.. I should upgrade this one) Outside of a bit of workaround during installation (two Perls), everything's working great. In fact, I'd say my system load is noiticeably reduced (although that may also be related to the recent SpamAssassin upgrade). Philip Hachey On Thu, 6 Oct 2005 08:41:08 -0400, Jeff A. Earickson wrote: >Julian, > >In my monthly review of current perl modules used by MailScanner, >I found on CPAN: > > your latest >module version version >--------------------------------- >Compress-zlib 1.34 1.40 >Archive-Zip 1.14 1.16 >File-Spec 0.82 0.90 >HTML-Tagset 3.03 3.04 >IO-stringy 2.108 2.110 >MailTools 1.50 1.67 >Mime-tools 5.417 5.418 >Net-CIDR 0.10 0.11 >TimeDate 1.1301 1.16 > >I am running the latest versions with MS 4.46.2 on Solaris >9 with no problems. > >Jeff Earickson >Colby College ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From taz at TAZ-MANIA.COM Fri Oct 7 18:01:48 2005 From: taz at TAZ-MANIA.COM (Dennis Willson) Date: Thu Jan 12 21:30:54 2006 Subject: MailScanner on boot Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] You don't happen to run Webmin do you? There's a feature to restart services if they die. Information Services wrote: > Julian, > > I see what you are saying, and I gave it a try, and for some reason > MailScanner starts on it's own. Thinking about what I have running on > my system: > > MailWatch > RDJ > Spamassassin > sendmail > > I realized that I had made a config change in /etc/rulesdujour/config > and added > SA_RESTART="/etc/init.d/MailScanner restart"; > > I changed this line to "/root/do_nothing.sh"; and then turned off > MailScanner with 'service MailScanner stop'....rebooted, I have looked > into all my cron jobs, and there is nothing that I can see in cron that > would specify MailScanner. I am not sure what else to check. About > one minute after a reboot MailScanner starts automatically. What am I > missing here? > > On 10/7/05, *Julian Field* > wrote: > > It's a bit more intelligent than that. > > If you do a "service MailScanner stop" it creates a lockfile in > /var/lock/subsys/MailScanner.off. When the hourly cron job runs, it > detects the presence of this file and doesn't then start up > MailScanner. > > So all you need to do is a "service MailScanner stop" and it will > stay stopped. No need to mess around with the cron jobs at all. > > On 7 Oct 2005, at 15:45, Information Services wrote: > >> Okay, I did the 'chkconfig --list MailScanner' and saw the >> different run levels turned on. So yes, I can see that >> 'mailscanner' is not the way to go. I ran 'chkconfig --levels >> 0123456 MailScanner off' and rebooted. Still the same problem. >> Denis, I didn't even thought about the cron.hourly job for >> check_MailScanner. I removed this from the cron.hourly, and >> rebooted....currently wait for system to reboot.......okay >> rebooted now. >> >> Looks like removing the check_MailScanner from the cron.hourly >> fixed it. now when I do a 'service MailScanner status' I get an >> error for sendmail.in.pid and sendmail.out.pid. This would be >> expected. now when I decide to use MailScanner on this system, I >> just need to remember to add check_MailScanner back into cron.hourly. >> >> Nate, thanks for clearing up difference between "MailScanner" and >> "mailscanner," this could have continued to haunt me in other >> situations. >> >> Casey >> >> On 10/7/05, *Denis Beauchemin* < Denis.Beauchemin@usherbrooke.ca >> > wrote: >> >> Information Services wrote: >> >>> I have a CentOS 4.1 system with MailScanner loaded for the >> possibility >>> of using in one or our remote locations. I have gone into >> the GUI >>> services and took the check out of MailScanner and Sendmail >> to startup >>> at boot, but that did not seem to keep MailScanner from >> starting on a >>> boot. I did a chkconfig and turned off all mailscanner >> levels, and I >>> must not understand the purpose of chkconfig, but once again >>> Mailscanner has decided to when the system is booted. What >> can I do >>> to keep MailScanner from running when the system is rebooted?** >> >> Maybe /etc/cron.hourly/check_MailScanner is restarting it? >> >> OTOH, are you sure MS is completely disabled? Do "chkconfig >> --list >> MailScanner" and make sure it is off in all run levels. > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > -- > This message has been scanned for viruses and > dangerous content by *MailScanner* , > and is > believed to be clean. > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Fri Oct 7 18:24:47 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:54 2006 Subject: MailScanner on boot Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Information Services spake the following on 10/7/2005 9:32 AM: > Julian, > > I see what you are saying, and I gave it a try, and for some reason > MailScanner starts on it's own. Thinking about what I have running on > my system: > > MailWatch > RDJ > Spamassassin > sendmail > > I realized that I had made a config change in /etc/rulesdujour/config > and added > SA_RESTART="/etc/init.d/MailScanner restart"; > > I changed this line to "/root/do_nothing.sh"; and then turned off > MailScanner with 'service MailScanner stop'....rebooted, I have looked > into all my cron jobs, and there is nothing that I can see in cron that > would specify MailScanner. I am not sure what else to check. About > one minute after a reboot MailScanner starts automatically. What am I > missing here? > > On 10/7/05, *Julian Field* > wrote: > > It's a bit more intelligent than that. > > If you do a "service MailScanner stop" it creates a lockfile in > /var/lock/subsys/MailScanner.off. When the hourly cron job runs, it > detects the presence of this file and doesn't then start up > MailScanner. > > So all you need to do is a "service MailScanner stop" and it will > stay stopped. No need to mess around with the cron jobs at all. > > On 7 Oct 2005, at 15:45, Information Services wrote: > >> Okay, I did the 'chkconfig --list MailScanner' and saw the >> different run levels turned on. So yes, I can see that >> 'mailscanner' is not the way to go. I ran 'chkconfig --levels >> 0123456 MailScanner off' and rebooted. Still the same problem. >> Denis, I didn't even thought about the cron.hourly job for >> check_MailScanner. I removed this from the cron.hourly, and >> rebooted....currently wait for system to reboot.......okay >> rebooted now. >> >> Looks like removing the check_MailScanner from the cron.hourly >> fixed it. now when I do a 'service MailScanner status' I get an >> error for sendmail.in.pid and sendmail.out.pid. This would be >> expected. now when I decide to use MailScanner on this system, I >> just need to remember to add check_MailScanner back into cron.hourly. >> >> Nate, thanks for clearing up difference between "MailScanner" and >> "mailscanner," this could have continued to haunt me in other >> situations. >> >> Casey >> >> On 10/7/05, *Denis Beauchemin* < Denis.Beauchemin@usherbrooke.ca >> > wrote: >> >> Information Services wrote: >> >>> I have a CentOS 4.1 system with MailScanner loaded for the >> possibility >>> of using in one or our remote locations. I have gone into >> the GUI >>> services and took the check out of MailScanner and Sendmail >> to startup >>> at boot, but that did not seem to keep MailScanner from >> starting on a >>> boot. I did a chkconfig and turned off all mailscanner >> levels, and I >>> must not understand the purpose of chkconfig, but once again >>> Mailscanner has decided to when the system is booted. What >> can I do >>> to keep MailScanner from running when the system is rebooted?** >> >> Maybe /etc/cron.hourly/check_MailScanner is restarting it? >> >> OTOH, are you sure MS is completely disabled? Do "chkconfig >> --list >> MailScanner" and make sure it is off in all run levels. Are you running Mailscanner-mrtg? The older version had a problem with re-starting mailscanner. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ewallig at AEROCONTRACTORS.COM Fri Oct 7 19:14:29 2005 From: ewallig at AEROCONTRACTORS.COM (Ed Wallig) Date: Thu Jan 12 21:30:55 2006 Subject: Determine version and other ?? Message-ID: Hi, running a version of MS from earlier this year on CentOS4 and have a few questions: * How do I determine what version is running? * What is the "best practice" for upgrading a live system? * If we choose not to upgrade MS at this time, can newer versions of ClamAV be used (currently using 85.1 - want to upgrade to 87.1)? Thanks, Ed Wallig ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Application/X-PKCS7-SIGNATURE 6.1KB. ] [ Unable to print this part. ] From jfagan at FIRSTLIGHTNETWORKS.COM Fri Oct 7 19:15:14 2005 From: jfagan at FIRSTLIGHTNETWORKS.COM (James Fagan) Date: Thu Jan 12 21:30:55 2006 Subject: MailScanner on boot Message-ID: > Information Services spake the following on 10/7/2005 9:32 AM: > > Julian, > > > > I see what you are saying, and I gave it a try, and for some reason > > MailScanner starts on it's own. Thinking about what I have > running on > > my system: > > > > MailWatch > > RDJ > > Spamassassin > > sendmail > > > > I realized that I had made a config change in > /etc/rulesdujour/config > > and added SA_RESTART="/etc/init.d/MailScanner restart"; > > > > I changed this line to "/root/do_nothing.sh"; and then turned off > > MailScanner with 'service MailScanner stop'....rebooted, I > have looked > > into all my cron jobs, and there is nothing that I can see > in cron that > > would specify MailScanner. I am not sure what else to > check. About > > one minute after a reboot MailScanner starts automatically. > What am I > > missing here? > > > > On 10/7/05, *Julian Field* > > wrote: > > > > It's a bit more intelligent than that. > > > > If you do a "service MailScanner stop" it creates a lockfile in > > /var/lock/subsys/MailScanner.off. When the hourly cron > job runs, it > > detects the presence of this file and doesn't then start up > > MailScanner. > > > > So all you need to do is a "service MailScanner stop" > and it will > > stay stopped. No need to mess around with the cron jobs at all. > > > > On 7 Oct 2005, at 15:45, Information Services wrote: > > > >> Okay, I did the 'chkconfig --list MailScanner' and saw the > >> different run levels turned on. So yes, I can see that > >> 'mailscanner' is not the way to go. I ran 'chkconfig --levels > >> 0123456 MailScanner off' and rebooted. Still the same > problem. > >> Denis, I didn't even thought about the cron.hourly job for > >> check_MailScanner. I removed this from the cron.hourly, and > >> rebooted....currently wait for system to reboot.......okay > >> rebooted now. > >> > >> Looks like removing the check_MailScanner from the cron.hourly > >> fixed it. now when I do a 'service MailScanner > status' I get an > >> error for sendmail.in.pid and sendmail.out.pid. This would be > >> expected. now when I decide to use MailScanner on > this system, I > >> just need to remember to add check_MailScanner back > into cron.hourly. > >> > >> Nate, thanks for clearing up difference between > "MailScanner" and > >> "mailscanner," this could have continued to haunt me in other > >> situations. > >> > >> Casey > >> > >> On 10/7/05, *Denis Beauchemin* < > Denis.Beauchemin@usherbrooke.ca > >> > wrote: > >> > >> Information Services wrote: > >> > >>> I have a CentOS 4.1 system with MailScanner loaded for the > >> possibility > >>> of using in one or our remote locations. I have gone into > >> the GUI > >>> services and took the check out of MailScanner and Sendmail > >> to startup > >>> at boot, but that did not seem to keep MailScanner from > >> starting on a > >>> boot. I did a chkconfig and turned off all mailscanner > >> levels, and I > >>> must not understand the purpose of chkconfig, but once again > >>> Mailscanner has decided to when the system is booted. What > >> can I do > >>> to keep MailScanner from running when the system is rebooted?** > >> > >> Maybe /etc/cron.hourly/check_MailScanner is restarting it? > >> > >> OTOH, are you sure MS is completely disabled? Do > "chkconfig > >> --list > >> MailScanner" and make sure it is off in all run levels. > Are you running Mailscanner-mrtg? > The older version had a problem with re-starting mailscanner. > > -- > Maybe try and move temporarily the MailScanner to another dir, then reboot and then check your system error logs and see what complains if anything. Hopefully something will. James ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHT.IE Fri Oct 7 19:34:41 2005 From: michele at BLACKNIGHT.IE (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:30:55 2006 Subject: Determine version and other ?? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ed Wallig said on 07 October 2005 7:14: > Hi, running a version of MS from earlier this year on CentOS4 and > have a few questions: > > ^Õ How do I determine what version is running? Mailscanner -v Mr Michele Neylon Blacknight Solutions Quality Business Hosting & Colocation http://www.blacknight.ie/ Tel. 1850 927 280 Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 59 9164239 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Fri Oct 7 19:34:08 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:55 2006 Subject: Determine version and other ?? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ed Wallig spake the following on 10/7/2005 11:14 AM: > Hi, running a version of MS from earlier this year on CentOS4 and have > a few questions: > > * How do I determine what version is running? > * What is the "best practice" for upgrading a live system? > * If we choose not to upgrade MS at this time, can newer versions of > ClamAV be used (currently using 85.1 - want to upgrade to 87.1)? > > > Thanks, > > Ed Wallig > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* http://wiki.mailscanner.info/doku.php?id=maq:index -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From PHachey at CITY.CORNWALL.ON.CA Fri Oct 7 20:12:31 2005 From: PHachey at CITY.CORNWALL.ON.CA (Philip Hachey) Date: Thu Jan 12 21:30:55 2006 Subject: OT: Using DCC for greylisting Message-ID: I'm about to go ahead and reconfigure DCC so that 1) it runs at the MTA level and 2) acts as greylist milter for Sendmail. Running DCC at the MTA level (as a daemon) should be more efficient than having SpamAssassin call dccifd -- and I still plan on SpamAssassin using DCC in it's scoring which is fine, since SA looks for the presence of a DCC added header (basing it's scores on that) and only queries dccifd if there isn't one (or for reporting). My main motivation for running DCC at MTA is to use it's greylisting. If there's anyone here who has some experience with DCC greylist features, would you be so kind as to share your experience? Were there any issues with SpamAssassin or MailScanner? How does it compare with other greylist implementations? Thanks, ---------------------------------- Philip J. Hachey, BCS(High Hons) Programmer-Analyst City of Cornwall ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lbcadmin at gmail.com Fri Oct 7 20:16:04 2005 From: lbcadmin at gmail.com (Information Services) Date: Thu Jan 12 21:30:55 2006 Subject: MailScanner on boot Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Yes I do run webmin....I guess I didn't add that to the list of programs loaded. You will need to educate me on what I should be looking for here. On 10/7/05, Dennis Willson wrote: You don't happen to run Webmin do you? There's a feature to restart services if they die. Information Services wrote: > Julian, > > I see what you are saying, and I gave it a try, and for some reason > MailScanner starts on it's own. Thinking about what I have running on > my system: > > MailWatch > RDJ > Spamassassin > sendmail > > I realized that I had made a config change in /etc/rulesdujour/config > and added > SA_RESTART="/etc/init.d/MailScanner restart"; > > I changed this line to "/root/do_nothing.sh"; and then turned off > MailScanner with 'service MailScanner stop'....rebooted, I have looked > into all my cron jobs, and there is nothing that I can see in cron that > would specify MailScanner. I am not sure what else to check. About > one minute after a reboot MailScanner starts automatically. What am I > missing here? > > On 10/7/05, *Julian Field* > wrote: > > It's a bit more intelligent than that. > > If you do a "service MailScanner stop" it creates a lockfile in > /var/lock/subsys/MailScanner.off. When the hourly cron job runs, it > detects the presence of this file and doesn't then start up > MailScanner. > > So all you need to do is a "service MailScanner stop" and it will > stay stopped. No need to mess around with the cron jobs at all. > > On 7 Oct 2005, at 15:45, Information Services wrote: > >> Okay, I did the 'chkconfig --list MailScanner' and saw the >> different run levels turned on. So yes, I can see that >> 'mailscanner' is not the way to go. I ran 'chkconfig --levels >> 0123456 MailScanner off' and rebooted. Still the same problem. >> Denis, I didn't even thought about the cron.hourly job for >> check_MailScanner. I removed this from the cron.hourly, and >> rebooted....currently wait for system to reboot.......okay >> rebooted now. >> >> Looks like removing the check_MailScanner from the cron.hourly >> fixed it. now when I do a 'service MailScanner status' I get an >> error for sendmail.in.pid and sendmail.out.pid. This would be >> expected. now when I decide to use MailScanner on this system, I >> just need to remember to add check_MailScanner back into cron.hourly. >> >> Nate, thanks for clearing up difference between "MailScanner" and >> "mailscanner," this could have continued to haunt me in other >> situations. >> >> Casey >> >> On 10/7/05, *Denis Beauchemin* < Denis.Beauchemin@usherbrooke.ca >> > wrote: >> >> Information Services wrote: >> >>> I have a CentOS 4.1 system with MailScanner loaded for the >> possibility >>> of using in one or our remote locations. I have gone into >> the GUI >>> services and took the check out of MailScanner and Sendmail >> to startup >>> at boot, but that did not seem to keep MailScanner from >> starting on a >>> boot. I did a chkconfig and turned off all mailscanner >> levels, and I >>> must not understand the purpose of chkconfig, but once again >>> Mailscanner has decided to when the system is booted. What >> can I do >>> to keep MailScanner from running when the system is rebooted?** >> >> Maybe /etc/cron.hourly/check_MailScanner is restarting it? >> >> OTOH, are you sure MS is completely disabled? Do "chkconfig >> --list >> MailScanner" and make sure it is off in all run levels. > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > -- > This message has been scanned for viruses and > dangerous content by *MailScanner* , > and is > believed to be clean. > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives ( http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/ ) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lbcadmin at gmail.com Fri Oct 7 20:25:27 2005 From: lbcadmin at gmail.com (Information Services) Date: Thu Jan 12 21:30:55 2006 Subject: MailScanner on boot Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I am running MailScanner-mrtg v. 0.10.00-1 I have gone into /etc/cron.d where MailScanner-mrtg located and commented out lines in mrtg, and mailscanner-mrtg.crond but that didn't help. I will see if moving MailScanner to a different directory and see what happens On 10/7/05, Scott Silva wrote: Information Services spake the following on 10/7/2005 9:32 AM: > Julian, > > I see what you are saying, and I gave it a try, and for some reason > MailScanner starts on it's own. Thinking about what I have running on > my system: > > MailWatch > RDJ > Spamassassin > sendmail > > I realized that I had made a config change in /etc/rulesdujour/config > and added > SA_RESTART="/etc/init.d/MailScanner restart"; > > I changed this line to "/root/do_nothing.sh"; and then turned off > MailScanner with 'service MailScanner stop'....rebooted, I have looked > into all my cron jobs, and there is nothing that I can see in cron that > would specify MailScanner. I am not sure what else to check. About > one minute after a reboot MailScanner starts automatically. What am I > missing here? > > On 10/7/05, *Julian Field* > wrote: > > It's a bit more intelligent than that. > > If you do a "service MailScanner stop" it creates a lockfile in > /var/lock/subsys/MailScanner.off. When the hourly cron job runs, it > detects the presence of this file and doesn't then start up > MailScanner. > > So all you need to do is a "service MailScanner stop" and it will > stay stopped. No need to mess around with the cron jobs at all. > > On 7 Oct 2005, at 15:45, Information Services wrote: > >> Okay, I did the 'chkconfig --list MailScanner' and saw the >> different run levels turned on. So yes, I can see that >> 'mailscanner' is not the way to go. I ran 'chkconfig --levels >> 0123456 MailScanner off' and rebooted. Still the same problem. >> Denis, I didn't even thought about the cron.hourly job for >> check_MailScanner. I removed this from the cron.hourly, and >> rebooted....currently wait for system to reboot.......okay >> rebooted now. >> >> Looks like removing the check_MailScanner from the cron.hourly >> fixed it. now when I do a 'service MailScanner status' I get an >> error for sendmail.in.pid and sendmail.out.pid. This would be >> expected. now when I decide to use MailScanner on this system, I >> just need to remember to add check_MailScanner back into cron.hourly. >> >> Nate, thanks for clearing up difference between "MailScanner" and >> "mailscanner," this could have continued to haunt me in other >> situations. >> >> Casey >> >> On 10/7/05, *Denis Beauchemin* < Denis.Beauchemin@usherbrooke.ca >> > wrote: >> >> Information Services wrote: >> >>> I have a CentOS 4.1 system with MailScanner loaded for the >> possibility >>> of using in one or our remote locations. I have gone into >> the GUI >>> services and took the check out of MailScanner and Sendmail >> to startup >>> at boot, but that did not seem to keep MailScanner from >> starting on a >>> boot. I did a chkconfig and turned off all mailscanner >> levels, and I >>> must not understand the purpose of chkconfig, but once again >>> Mailscanner has decided to when the system is booted. What >> can I do >>> to keep MailScanner from running when the system is rebooted?** >> >> Maybe /etc/cron.hourly/check_MailScanner is restarting it? >> >> OTOH, are you sure MS is completely disabled? Do "chkconfig >> --list >> MailScanner" and make sure it is off in all run levels. Are you running Mailscanner-mrtg? The older version had a problem with re-starting mailscanner. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives ( http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lbcadmin at gmail.com Fri Oct 7 20:52:21 2005 From: lbcadmin at gmail.com (Information Services) Date: Thu Jan 12 21:30:55 2006 Subject: MailScanner on boot Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] You were right...MailScanner-mrtg looks like it is causing the problem...here is what I just got from my log Oct 7 14:45:03 wks-lin8 MailScanner-MRTG[2873]: Number of MailScanner processes below threshold, restarting MailScanner I guess I don't understand how MailScanner-MRTG is restarting when I commented out all the lines in cron.d files. On 10/7/05, Information Services wrote: > I am running MailScanner-mrtg v. 0.10.00-1 > I have gone into /etc/cron.d where MailScanner-mrtg located and commented out lines in mrtg, and mailscanner-mrtg.crond but that didn't help. > > I will see if moving MailScanner to a different directory and see what happens > > > > On 10/7/05, Scott Silva wrote: > > Information Services spake the following on 10/7/2005 9:32 AM: > > > Julian, > > > > > > I see what you are saying, and I gave it a try, and for some reason > > > MailScanner starts on it's own. Thinking about what I have running on > > > my system: > > > > > > MailWatch > > > RDJ > > > Spamassassin > > > sendmail > > > > > > I realized that I had made a config change in /etc/rulesdujour/config > > > and added > > > SA_RESTART="/etc/init.d/MailScanner restart"; > > > > > > I changed this line to "/root/do_nothing.sh"; and then turned off > > > MailScanner with 'service MailScanner stop'....rebooted, I have looked > > > into all my cron jobs, and there is nothing that I can see in cron that > > > would specify MailScanner. I am not sure what else to check. About > > > one minute after a reboot MailScanner starts automatically. What am I > > > missing here? > > > > > > On 10/7/05, *Julian Field* > > > wrote: > > > > > > It's a bit more intelligent than that. > > > > > > If you do a "service MailScanner stop" it creates a lockfile in > > > /var/lock/subsys/MailScanner.off. When the hourly cron job runs, it > > > detects the presence of this file and doesn't then start up > > > MailScanner. > > > > > > So all you need to do is a "service MailScanner stop" and it will > > > stay stopped. No need to mess around with the cron jobs at all. > > > > > > On 7 Oct 2005, at 15:45, Information Services wrote: > > > > > >> Okay, I did the 'chkconfig --list MailScanner' and saw the > > >> different run levels turned on. So yes, I can see that > > >> 'mailscanner' is not the way to go. I ran 'chkconfig --levels > > >> 0123456 MailScanner off' and rebooted. Still the same problem. > > >> Denis, I didn't even thought about the cron.hourly job for > > >> check_MailScanner. I removed this from the cron.hourly, and > > >> rebooted....currently wait for system to reboot.......okay > > >> rebooted now. > > >> > > >> Looks like removing the check_MailScanner from the cron.hourly > > >> fixed it. now when I do a 'service MailScanner status' I get an > > >> error for sendmail.in.pid and sendmail.out.pid. This would be > > >> expected. now when I decide to use MailScanner on this system, I > > >> just need to remember to add check_MailScanner back into cron.hourly. > > >> > > >> Nate, thanks for clearing up difference between "MailScanner" and > > >> "mailscanner," this could have continued to haunt me in other > > >> situations. > > >> > > >> Casey > > >> > > >> On 10/7/05, *Denis Beauchemin* < Denis.Beauchemin@usherbrooke.ca > > >> > wrote: > > >> > > >> Information Services wrote: > > >> > > >>> I have a CentOS 4.1 system with MailScanner loaded for the > > >> possibility > > >>> of using in one or our remote locations. I have gone into > > >> the GUI > > >>> services and took the check out of MailScanner and Sendmail > > >> to startup > > >>> at boot, but that did not seem to keep MailScanner from > > >> starting on a > > >>> boot. I did a chkconfig and turned off all mailscanner > > >> levels, and I > > >>> must not understand the purpose of chkconfig, but once again > > >>> Mailscanner has decided to when the system is booted. What > > >> can I do > > >>> to keep MailScanner from running when the system is rebooted?** > > >> > > >> Maybe /etc/cron.hourly/check_MailScanner is restarting it? > > >> > > >> OTOH, are you sure MS is completely disabled? Do "chkconfig > > >> --list > > >> MailScanner" and make sure it is off in all run levels. > > Are you running Mailscanner-mrtg? > > The older version had a problem with re-starting mailscanner. > > > > -- > > > > /-----------------------\ |~~\_____/~~\__ | > > | MailScanner; The best |___________ \N1____====== )-+ > > | protection on the net!| ~~~|/~~ | > > \-----------------------/ () > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives ( http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Fri Oct 7 21:47:26 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:55 2006 Subject: MailScanner on boot Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Information Services spake the following on 10/7/2005 12:52 PM: > You were right...MailScanner-mrtg looks like it is causing the > problem...here is what I just got from my log > > Oct 7 14:45:03 wks-lin8 MailScanner-MRTG[2873]: Number of MailScanner > processes below threshold, restarting MailScanner > > I guess I don't understand how MailScanner-MRTG is restarting when I > commented out all the lines in cron.d files. > > That was supposed to be fixed in 0.10.00-1. I think it looks for the same file that MailScanner generates when you run service MailScanner stop. /var/lock/subsys/MailScanner.off To quote the changelog "Now will not restart MailScanner if MailScanner was shut down using its init script." So if you stop MailScanner from it's init script, and then reboot, does it still restart? You might need to restore some of the changes you have made. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From garry at GLENDOWN.DE Fri Oct 7 22:06:27 2005 From: garry at GLENDOWN.DE (Garry Glendown) Date: Thu Jan 12 21:30:55 2006 Subject: OT: Sophisticated size limiting ... Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Possibly/Most likely not really a MS question, but maybe somebody has an idea ... A customer of ours is running a Linux system, having switched from a Novell/Tobit server ... Before, they had the possibility of "quarantining" specific mails, like, too large, unwanted attachment or too many recipients. Just a couple days ago, something happened that would have been avoided with the old system - some "intelligent" user sent a mail to 400+ local users with an 13MB word attachment (MIME encoded 18mb mail) ... Question: Does anybody know of a way to do some more granularly defineable mail handling, as mentioned above? I know I can set the maximum message size, which would be a starter, but then the message should be forwarded to the admin account, not rejected ... Tnx, -garry ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Fri Oct 7 22:52:22 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:30:55 2006 Subject: why is my mail not being deliverd to the smart host? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi Guys, I am sure I am missing something small here. I have a ms box that is currently supporting domains. I added a new domain to my MS box and have setup a mail server inside the network to receive mail for this domain. the mail server side works as I have successfully sent an email to the users connecting directly to the smtp agent on the mail server. I am running ms on suse 9.2 with sendmail. i have added the the domain and destination to the mailertable file. domain.com esmtp:[10.1.1.1] I have added it to the relayed domains file. And restarted the server. but when I send an email with telnet to the ms box it gets sent to the internet to the customers current mail system and not to the new server. i want to test this situation before I change the customers mx records to make sure it works ok. What have I done wrong? please let me know what other info is needed to help diagnose this issue. Thanks Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From taz at TAZ-MANIA.COM Fri Oct 7 23:11:14 2005 From: taz at TAZ-MANIA.COM (Dennis Willson) Date: Thu Jan 12 21:30:55 2006 Subject: why is my mail not being deliverd to the smart host? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] This may sound overly simple... Do you have FEATURE(`mailertable') in your sendmail.mc file? Lance Haig wrote: > Hi Guys, > > I am sure I am missing something small here. > > I have a ms box that is currently supporting domains. > > I added a new domain to my MS box and have setup a mail server inside > the network to receive mail for this domain. > > the mail server side works as I have successfully sent an email to the > users connecting directly to the smtp agent on the mail server. > > I am running ms on suse 9.2 with sendmail. > > i have added the the domain and destination to the mailertable file. > domain.com esmtp:[10.1.1.1] > > I have added it to the relayed domains file. > > And restarted the server. but when I send an email with telnet to the ms > box it gets sent to the internet to the customers current mail system > and not to the new server. > i want to test this situation before I change the customers mx records > to make sure it works ok. > > What have I done wrong? > > please let me know what other info is needed to help diagnose this issue. > > Thanks > > Lance > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From taz at TAZ-MANIA.COM Fri Oct 7 23:13:37 2005 From: taz at TAZ-MANIA.COM (Dennis Willson) Date: Thu Jan 12 21:30:55 2006 Subject: why is my mail not being deliverd to the smart host? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Oh, yeah on thing I forgot... I also assume you ran makemap on the mailertable file. Lance Haig wrote: > Hi Guys, > > I am sure I am missing something small here. > > I have a ms box that is currently supporting domains. > > I added a new domain to my MS box and have setup a mail server inside > the network to receive mail for this domain. > > the mail server side works as I have successfully sent an email to the > users connecting directly to the smtp agent on the mail server. > > I am running ms on suse 9.2 with sendmail. > > i have added the the domain and destination to the mailertable file. > domain.com esmtp:[10.1.1.1] > > I have added it to the relayed domains file. > > And restarted the server. but when I send an email with telnet to the ms > box it gets sent to the internet to the customers current mail system > and not to the new server. > i want to test this situation before I change the customers mx records > to make sure it works ok. > > What have I done wrong? > > please let me know what other info is needed to help diagnose this issue. > > Thanks > > Lance > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Sat Oct 8 00:18:43 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:55 2006 Subject: why is my mail not being deliverd to the smart host? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dennis Willson wrote: > Oh, yeah on thing I forgot... I also assume you ran makemap on the > mailertable file. > > Lance Haig wrote: > >> Hi Guys, >> >> I am sure I am missing something small here. >> >> I have a ms box that is currently supporting domains. >> >> I added a new domain to my MS box and have setup a mail server inside >> the network to receive mail for this domain. >> >> the mail server side works as I have successfully sent an email to >> the users connecting directly to the smtp agent on the mail server. >> >> I am running ms on suse 9.2 with sendmail. >> >> i have added the the domain and destination to the mailertable file. >> domain.com esmtp:[10.1.1.1] >> >> I have added it to the relayed domains file. >> >> And restarted the server. but when I send an email with telnet to the >> ms box it gets sent to the internet to the customers current mail >> system and not to the new server. >> i want to test this situation before I change the customers mx >> records to make sure it works ok. >> >> What have I done wrong? >> >> please let me know what other info is needed to help diagnose this >> issue. >> >> Thanks >> >> Lance >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! I usually run "make -C /etc/mail" whenever I do any change to files in that folder. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Sat Oct 8 00:17:22 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:55 2006 Subject: OT: Sophisticated size limiting ... Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Garry Glendown wrote: >Possibly/Most likely not really a MS question, but maybe somebody has an >idea ... > >A customer of ours is running a Linux system, having switched from a >Novell/Tobit server ... Before, they had the possibility of >"quarantining" specific mails, like, too large, unwanted attachment or >too many recipients. Just a couple days ago, something happened that >would have been avoided with the old system - some "intelligent" user >sent a mail to 400+ local users with an 13MB word attachment (MIME >encoded 18mb mail) ... > >Question: Does anybody know of a way to do some more granularly >defineable mail handling, as mentioned above? I know I can set the >maximum message size, which would be a starter, but then the message >should be forwarded to the admin account, not rejected ... > >Tnx, -garry > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > Perhaps this is something that could be implemented using MCP, although I don't know if SA supports creating a rule based on message size. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Sat Oct 8 00:18:18 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:55 2006 Subject: why is my mail not being deliverd to the smart host? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Lance Haig wrote: > Hi Guys, > > I am sure I am missing something small here. > > I have a ms box that is currently supporting domains. > > I added a new domain to my MS box and have setup a mail server inside > the network to receive mail for this domain. > > the mail server side works as I have successfully sent an email to the > users connecting directly to the smtp agent on the mail server. > > I am running ms on suse 9.2 with sendmail. > > i have added the the domain and destination to the mailertable file. > domain.com esmtp:[10.1.1.1] > > I have added it to the relayed domains file. > > And restarted the server. but when I send an email with telnet to the > ms box it gets sent to the internet to the customers current mail > system and not to the new server. > i want to test this situation before I change the customers mx records > to make sure it works ok. > > What have I done wrong? > > please let me know what other info is needed to help diagnose this issue. > > Thanks > > Lance > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! Perhaps you need to add .domain.com as well as domain.com so that e-mail to domain.com *and anything in that domain* gets sent there. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Sat Oct 8 08:33:35 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:30:55 2006 Subject: why is my mail not being deliverd to the smart host? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Tis is why I love this malling list Dennis and Alex Thank you for the help I did not run the make on the mailertable and will do it right away and then test again. Thanks again Lance Lance Haig wrote: > Hi Guys, > > I am sure I am missing something small here. > > I have a ms box that is currently supporting domains. > > I added a new domain to my MS box and have setup a mail server inside > the network to receive mail for this domain. > > the mail server side works as I have successfully sent an email to the > users connecting directly to the smtp agent on the mail server. > > I am running ms on suse 9.2 with sendmail. > > i have added the the domain and destination to the mailertable file. > domain.com esmtp:[10.1.1.1] > > I have added it to the relayed domains file. > > And restarted the server. but when I send an email with telnet to the > ms box it gets sent to the internet to the customers current mail > system and not to the new server. > i want to test this situation before I change the customers mx records > to make sure it works ok. > > What have I done wrong? > > please let me know what other info is needed to help diagnose this issue. > > Thanks > > Lance > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Oct 8 17:42:22 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:55 2006 Subject: OT: Sophisticated size limiting ... Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Alex Neuman van der Hans wrote: > Garry Glendown wrote: > >> Possibly/Most likely not really a MS question, but maybe somebody has an >> idea ... >> >> A customer of ours is running a Linux system, having switched from a >> Novell/Tobit server ... Before, they had the possibility of >> "quarantining" specific mails, like, too large, unwanted attachment or >> too many recipients. Just a couple days ago, something happened that >> would have been avoided with the old system - some "intelligent" user >> sent a mail to 400+ local users with an 13MB word attachment (MIME >> encoded 18mb mail) ... >> >> Question: Does anybody know of a way to do some more granularly >> defineable mail handling, as mentioned above? I know I can set the >> maximum message size, which would be a starter, but then the message >> should be forwarded to the admin account, not rejected ... > > Perhaps this is something that could be implemented using MCP, > although I don't know if SA supports creating a rule based on message > size. Do it using a Custom Function "plugin". I am reluctant to add this to the core functionality, as it makes it yet more complicated, when the behaviour is easy to add as a Custom Function. I could add the Custom Function to CustomConfig.pm so everyone can use it if they want to. As long as you are happy with me doing that of course. You could implement a Custom Function attached to "Maximum Message Size". Test the $message->{size} property against the size you want the limit set to. If it's too big then $global::MS->{mta}->DeleteRecipients($message); push @{$message->{archiveplaces}}, "admin.account@yourdomain.com"; and return the limit size 1 to force it to produce the correct warning messages. Or produce 0 to not generate any warning messages at all. If you know enough Perl, that will get you going. If you don't, then contact me and I'll write it for you (for some suitable donation/payment if possible). -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Sun Oct 9 03:36:20 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:55 2006 Subject: Clustering MS Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] INorbert Schmidt wrote: > > Hi everybody, > > we are running two datacenters with each using it's own > internetconnection. We would like to have one MailScanner Gateway in > each location, so in case of a failure the other Gateway will still > work. We will register both MailScanner Gateways with the same priority > into the DNS, so they will equally receive mail. > Now how can I cluster Mailwatch, the spamassassin bayesian db (stored > within mysql) and how do I syncronise the configuration??? > Is there any documentation on this? I recommend asking FSL. They did that + centralized customized MailWatch for one of my clients and their price was really cheap. Maybe they'll give the instructions for a small fee, I don't know. Better ask them: www.fsl.com steve@fsl.com They can do the task remotely. Regards, Ugo > > Thanks in advance > > Norbert Schmidt > > -------------------------------------- > IS-Teledata AG > Cologne > Germany -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Sun Oct 9 03:41:14 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:55 2006 Subject: Clustering MS Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Information Services wrote: > I did a search on MailScanner wiki for rsync and did not find Glenn's > 5ki15 script. Was wondering if the script was done, and posted > somewhere that I am not aware of? I don't think glenn wrote the script. It is james gray, but I don't think it is ready. "5ki15" is just a geeky way (sorry james ;)) to say "skills" and not the name of the script itself. I think you'd probably better of thinking about your setup, readying the man page for rsync and create a cronjob that will rsync every x minutes. Or find a way to tell the script that it has to sync something... -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sun Oct 9 15:54:02 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:55 2006 Subject: Beta release 4.47.1 - auto-update phishing sites list Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have just released the first beta release of 4.47. The main new feature here is to automatically update the phishing.safe.sites.conf file every day. All your local changes will be kept, so there is no need to change how you use the file at all. But if you post me details of new additions to the file, I will add them to the master list, and they will appear in everyone's list within a day. If sites are added to the master list which turn out to be false, then I can just add a "REMOVE site.com" line to the master file and that will be removed from everyone's whitelist. So if you don't approve of one of my additions, you can add your own "REMOVE site.com" line so you don't use my listing for that site.com. So it's all pretty safe, and it should be impossible to subvert it. I personally vet every application to add a host to the list. But if I list one I shouldn't, then it is very easy for me (or you) to undo this with the "REMOVE" syntax. I hope you all find this useful and will upgrade to the new release at the start of November. In the mean time, I would be eternally grateful if you could test this new feature for me. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQ0kvCxH2WUcUFbZUEQLvGgCg1IspN/sNwIq0mFDy1UhNNU7YjucAoLag vdiHXNMXB4W3BMpNPQ3TKrfS =HM+x -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHT.IE Sun Oct 9 15:58:56 2005 From: michele at BLACKNIGHT.IE (Michele Neylon :: Blacknight.ie) Date: Thu Jan 12 21:30:55 2006 Subject: Beta release 4.47.1 - auto-update phishing sites list Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > I have just released the first beta release of 4.47. > > The main new feature here is to automatically update the > phishing.safe.sites.conf file every day. > All your local changes will be kept, so there is no need to change how > you use the file at all. This sounds like an excellent idea -- Mr Michele Neylon Blacknight Solutions Quality Business Hosting & Colocation http://www.blacknight.ie/ Tel. 1850 927 280 Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 59 9164239 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Sun Oct 9 18:59:32 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:55 2006 Subject: Beta release 4.47.1 - auto-update phishing sites list Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Michele Neylon :: Blacknight.ie wrote: >Julian Field wrote: > > >>I have just released the first beta release of 4.47. >> >>The main new feature here is to automatically update the >>phishing.safe.sites.conf file every day. >>All your local changes will be kept, so there is no need to change how >>you use the file at all. >> >> > >This sounds like an excellent idea > > > > > Will try it out ASAP. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From james at GRAYONLINE.ID.AU Sun Oct 9 22:47:01 2005 From: james at GRAYONLINE.ID.AU (James Gray) Date: Thu Jan 12 21:30:55 2006 Subject: OT - Which greylist milter Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Wednesday 05 October 2005 20:56, Stef Morrell wrote: > James Gray [james@GRAYONLINE.ID.AU] wrote: > Postgrey works somewhat differently. Rather than auto-whitelisting by > recipient, it auto-whitelists by server, which IMHO is more sensible. In > the scenario above, after the first email from Jenny, fubar.bar's > incoming mail server would trust mail from snafu.foo's outgoing server > and thus accept mail for both Barry and Fred. > > > Education is the key I think, but we all know how reluctant > > lusers are to have $CLUE imparted. > > I find that the general response... "Your email has been delayed, it > will come through soon, it's to help reduce your spam." ...works pretty > well. Anything which gives users less crap tends to be well received, > even if there is a slight inconvenience. Wow - can I have your users please? ;) Our users seem to behave more like my 2 year old daughter; they don't know what's best for them, even after you tell them why $FOO is a good thing. Still, I /think/ milter-greylist can be configured as you describe postgrey. Either way we have implemented the same sort of function by whitelisting our main customers' SMTP machines. The sendmail milter doesn't arbitrarily whitelist due to the domain in the envelope or From header, it uses a DNS lookup to figure out if the originating IP (remote SMTP host) is part of the whitelisted domains and if so there's no delay. The drawback is that some big customers have broken DNS too - in which case they deserve all the delays they get IMHO. Even though the same functionality has been achieved, it's not automatic so in some ways I think the Postfix greylist is probably a better "fit" for us. Pity we sendmail in this case :( Thanks for the insights. Cheers, James -- Can anyone remember when the times were not hard, and money not scarce? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From SJCJonker at SJC.NL Mon Oct 10 04:38:30 2005 From: SJCJonker at SJC.NL (Stijn Jonker) Date: Thu Jan 12 21:30:55 2006 Subject: Question about custom functions / generic spam plugin: Can they add headers? Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello all, There is currently a requirement popping up to add to headers for all email towards an domain: X-SMTP-From: X-SMTP-To: Before diving in writing my own libmilter function/program I was thinking of the custom function and/or the generic spam plugin. Whilst reading the book it didn't become really clear whether either of them can do it. I checked the source and although some experience at perl I'm unsure if i can call the functions AddHeader/ChangeHeader from the various mailer pm's suchs as Sendmail.pm. Therefore my question, is this possible? Thanks in advance, Stijn -- Met Vriendelijke groet/Yours Sincerely Stijn Jonker ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Oct 10 09:04:54 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:55 2006 Subject: Question about custom functions / generic spam plugin: Can they add headers? Message-ID: Beat you to it by miles on that one. What you want is this: # Do you want to add the Envelope-From: header? # This is very useful for tracking where spam came from as it # contains the envelope sender address. # This can also be the filename of a ruleset. Add Envelope From Header = yes # Do you want to add the Envelope-To: header? # This can be useful for tracking spam destinations, but should be # used with care due to possible privacy concerns with the use of # Bcc: headers by users. # This can also be the filename of a ruleset. Add Envelope To Header = no # This is the name of the Envelope From header # controlled by the option above. # This can also be the filename of a ruleset. Envelope From Header = X-MailScanner-From: # This is the name of the Envelope To header # controlled by the option above. # This can also be the filename of a ruleset. Envelope To Header = X-MailScanner-To: On 10 Oct 2005, at 04:38, Stijn Jonker wrote: > Hello all, > > There is currently a requirement popping up to add to headers for all > email towards an domain: > X-SMTP-From: > X-SMTP-To: > > Before diving in writing my own libmilter function/program I was > thinking of the custom function and/or the generic spam plugin. > > Whilst reading the book it didn't become really clear whether > either of > them can do it. I checked the source and although some experience at > perl I'm unsure if i can call the functions AddHeader/ChangeHeader > from > the various mailer pm's suchs as Sendmail.pm. > > Therefore my question, is this possible? > > Thanks in advance, > Stijn > -- > Met Vriendelijke groet/Yours Sincerely > Stijn Jonker > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > > > > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Mon Oct 10 10:26:43 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:55 2006 Subject: Clustering MS Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 07/10/05, Information Services wrote: > I did a search on MailScanner wiki for rsync and did not find Glenn's 5ki15 > script. James' (Grays), not mine. > Was wondering if the script was done, and posted somewhere that I > am not aware of? Haven't seen it (yet, I'm still catching up this thread:-). Perhaps James will (remember to) share it, once he sees this. (snip) -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From SJCJonker at SJC.NL Mon Oct 10 14:38:16 2005 From: SJCJonker at SJC.NL (Stijn Jonker) Date: Thu Jan 12 21:30:55 2006 Subject: Question about custom functions / generic spam plugin: Can they add headers? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian, Once again a wonderfull product, and I should learn to look at the easy wins first before thinking about starting a program job ;-) Stijn Julian Field said the following on 10/10/2005 10:04: > Beat you to it by miles on that one. What you want is this: > > # Do you want to add the Envelope-From: header? > # This is very useful for tracking where spam came from as it > On 10 Oct 2005, at 04:38, Stijn Jonker wrote: > > >> Hello all, >> >> There is currently a requirement popping up to add to headers for all >> email towards an domain: >> X-SMTP-From: >> X-SMTP-To: >> -- Met Vriendelijke groet/Yours Sincerely Stijn Jonker ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lbcadmin at gmail.com Mon Oct 10 14:41:21 2005 From: lbcadmin at gmail.com (Information Services) Date: Thu Jan 12 21:30:55 2006 Subject: MailScanner on boot Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I ran service MailScanner stop, and made sure the MailScanner.off was in /var/lock/subsys/, and then rebooted. Upon rebooting, and checking the /var/lock/subsys/ directory, the MailScanner.off was no longer there. And then checking the /var/log/maillog I see this: Oct 10 08:35:03 wks-lin8 MailScanner-MRTG[3015]: Number of MailScanner processes below threshold, restarting MailScanner My question now is....is the MailScanner.off supposed to be there upon a reboot? On 10/7/05, Scott Silva wrote: > Information Services spake the following on 10/7/2005 12:52 PM: > > You were right...MailScanner-mrtg looks like it is causing the > > problem...here is what I just got from my log > > > > Oct 7 14:45:03 wks-lin8 MailScanner-MRTG[2873]: Number of MailScanner > > processes below threshold, restarting MailScanner > > > > I guess I don't understand how MailScanner-MRTG is restarting when I > > commented out all the lines in cron.d files. > > > > > > That was supposed to be fixed in 0.10.00-1. > I think it looks for the same file that MailScanner generates when you > run service MailScanner stop. > /var/lock/subsys/MailScanner.off > To quote the changelog "Now will not restart MailScanner if MailScanner > was shut down using its init script." > So if you stop MailScanner from it's init script, and then reboot, does > it still restart? > You might need to restore some of the changes you have made. > -- > > /-----------------------\ |~~\_____/~~\__ | > | MailScanner; The best |___________ \N1____====== )-+ > | protection on the net!| ~~~|/~~ | > \-----------------------/ () > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From William.Burns at AEROFLEX.COM Mon Oct 10 15:02:53 2005 From: William.Burns at AEROFLEX.COM (William Burns) Date: Thu Jan 12 21:30:55 2006 Subject: OT - Which greylist milter Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] James Gray wrote: >Once these little niggles were sorted, we've been very impressed with the >results. The two mail gateways synchronise their autowhite-lists etc too. >So if a sender gets auto-learned on the primary MX, then tries the secondary, >they get through without delay there too. Same rules apply for all >auto-entries. So if they try on the primary and get a 451-temporarily >unavailable, then come back after the set time interval but on the secondary, >they will still get through on the secondary (even though they originally hit >the primary). > > James: How did you do the synchronization? -Bill ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Mon Oct 10 15:49:59 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:55 2006 Subject: Question about custom functions / generic spam plugin: Can they add headers? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Beat you to it by miles on that one. What you want is this: > > # Do you want to add the Envelope-From: header? > # This is very useful for tracking where spam came from as it > # contains the envelope sender address. > # This can also be the filename of a ruleset. > Add Envelope From Header = yes > > # Do you want to add the Envelope-To: header? > # This can be useful for tracking spam destinations, but should be > # used with care due to possible privacy concerns with the use of > # Bcc: headers by users. > # This can also be the filename of a ruleset. > Add Envelope To Header = no > > # This is the name of the Envelope From header > # controlled by the option above. > # This can also be the filename of a ruleset. > Envelope From Header = X-MailScanner-From: > > # This is the name of the Envelope To header > # controlled by the option above. > # This can also be the filename of a ruleset. > Envelope To Header = X-MailScanner-To: > > On 10 Oct 2005, at 04:38, Stijn Jonker wrote: > > > > > > > >> Hello all, >> >> There is currently a requirement popping up to add to headers for all >> email towards an domain: >> X-SMTP-From: >> X-SMTP-To: >> >> Before diving in writing my own libmilter function/program I was >> thinking of the custom function and/or the generic spam plugin. >> >> Whilst reading the book it didn't become really clear whether either of >> them can do it. I checked the source and although some experience at >> perl I'm unsure if i can call the functions AddHeader/ChangeHeader from >> the various mailer pm's suchs as Sendmail.pm. >> >> Therefore my question, is this possible? >> >> Thanks in advance, >> Stijn >> -- >> Met Vriendelijke groet/Yours Sincerely >> Stijn Jonker >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> >> >> >> >> >> > You might want to consider letting your users know that even if they send e-mail out with BCC: the header will be included, so anyone who looks at the message source will see who the recipients were. This way, either they must send each message individually (some MUA's will let you do this) or risk others knowing who they BCC:'d the message to. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rabellino at DI.UNITO.IT Mon Oct 10 17:17:11 2005 From: rabellino at DI.UNITO.IT (Rabellino Sergio) Date: Thu Jan 12 21:30:55 2006 Subject: Too much uptime ! Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dear list, i'm getting an high uptime on my mailscanner box, and this is a new behaviour for me. The load average persist over 3.00 and my mail traffic is not so high. My actual config is MailScanner Rel4.45.4 - McAfee VirusScan - ClamAV cmd line - SA 3.0.4 Max Children = 5 Queue Scan Interval = 40 I've changed The Scan Interval from 5 seconds to 40 and the max children from 10 to 5, but without any significant change in the load. My Solaris 9 box is an V440 with 4GB of ram and 4 ultrasparc CPU. Where I need to investigate ? From a simple check, seems that 2 MailScanner processes are statically in O-state and three are in either R/S state: it's normal ? -- Dott. Mag. Sergio Rabellino Technical Staff Department of Computer Science University of Torino (Italy) http://www.di.unito.it/~rabser Tel. +39-0116706701 Fax. +39-011751603 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Mon Oct 10 17:26:54 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:55 2006 Subject: Too much uptime ! Message-ID: Hi What rules are you running on the SA config. If you are using RBL's or URI-RBL's have you defined a caching nameserver on the machine? Have you read the tuning info on the wiki? -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rabellino Sergio Sent: 10 October 2005 17:17 To: MAILSCANNER@JISCMAIL.AC.UK Subject: [MAILSCANNER] Too much uptime ! Dear list, i'm getting an high uptime on my mailscanner box, and this is a new behaviour for me. The load average persist over 3.00 and my mail traffic is not so high. My actual config is MailScanner Rel4.45.4 - McAfee VirusScan - ClamAV cmd line - SA 3.0.4 Max Children = 5 Queue Scan Interval = 40 I've changed The Scan Interval from 5 seconds to 40 and the max children from 10 to 5, but without any significant change in the load. My Solaris 9 box is an V440 with 4GB of ram and 4 ultrasparc CPU. Where I need to investigate ? From a simple check, seems that 2 MailScanner processes are statically in O-state and three are in either R/S state: it's normal ? -- Dott. Mag. Sergio Rabellino Technical Staff Department of Computer Science University of Torino (Italy) http://www.di.unito.it/~rabser Tel. +39-0116706701 Fax. +39-011751603 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Cleveland at WINNEFOX.ORG Mon Oct 10 17:31:42 2005 From: Cleveland at WINNEFOX.ORG (Jody Cleveland) Date: Thu Jan 12 21:30:55 2006 Subject: Errors when running --lint Message-ID: Hello, I recently upgraded spamassassin to 3.1 and MailScanner to 4.46.2 and it's all running on a redhat 3AS server. When I run: # /usr/bin/spamassassin -p /etc/MailScanner/spam.assassin.prefs.conf --lint I get this: [10005] warn: config: failed to parse line, skipping: dcc_path /usr/local/bin/dccproc [10005] warn: config: failed to parse line, skipping: razor_timeout 10 [10005] warn: config: warning: score set for non-existent rule RCVD_IN_RSL [10005] warn: lint: 3 issues detected, please rerun with debug enabled for more information Before those upgrades, lint ran fine without errors. Did something change with how dcc and razor run that needs to be reconvigured? -- Jody Cleveland Computer Support Specialist cleveland@winnefox.org ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cparker at SWATGEAR.COM Mon Oct 10 17:34:53 2005 From: cparker at SWATGEAR.COM (Chris W. Parker) Date: Thu Jan 12 21:30:55 2006 Subject: LDAP script for Active Directory (also, Wiki) Message-ID: Hello, I was just reading through http://wiki.mailscanner.info/doku.php?id=maq:index#using_with_exchange_d omino_etc and to my dismay found out that there is no link to the appropriate article where Exchange is concerned. However, on http://wiki.mailscanner.info/doku.php?id=documentation:configuration:mta :postfix:how_to:reject_non_existent_users#ms_exchange there is a link to some documentation for Postfix and Exchange that can be applied to sendmail too. For anyone out there that is using MailScanner as a gateway with sendmail in front of Exchange I would be very appreciative of a working script to query valid user email addresses. Thanks, Chris. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Mon Oct 10 17:34:40 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:30:55 2006 Subject: Errors when running --lint Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jody Cleveland wrote: > Hello, > > I recently upgraded spamassassin to 3.1 and MailScanner to 4.46.2 and > it's all running on a redhat 3AS server. > > When I run: > # /usr/bin/spamassassin -p /etc/MailScanner/spam.assassin.prefs.conf > --lint > > I get this: > [10005] warn: config: failed to parse line, skipping: dcc_path > /usr/local/bin/dccproc > [10005] warn: config: failed to parse line, skipping: razor_timeout 10 > [10005] warn: config: warning: score set for non-existent rule > RCVD_IN_RSL > [10005] warn: lint: 3 issues detected, please rerun with debug enabled > for more information > > Before those upgrades, lint ran fine without errors. Did something > change with how dcc and razor run that needs to be reconvigured? > > -- > Jody Cleveland DCC and Razor are no more free, razor hasn't been so for the past 2 years and dcc for about 4 months.. Heres what you need to do: Enable the DCC / RAZOR plugins in /etc/mail/spamassassin/v310.pre if you qualify for their free usage policy OR comment out the erroneous lines in spam.assassin.prefs.conf if you don't qualify. - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at TC3NET.COM Mon Oct 10 17:56:52 2005 From: mike at TC3NET.COM (Michael Baird) Date: Thu Jan 12 21:30:55 2006 Subject: Too much uptime ! Message-ID: You mean high load average I think. High uptime is a good thing. Regards Michael Biard > Dear list, > i'm getting an high uptime on my mailscanner box, and this is a new > behaviour for me. > > The load average persist over 3.00 and my mail traffic is not so high. > My actual config is > > MailScanner Rel4.45.4 - McAfee VirusScan - ClamAV cmd line - SA 3.0.4 > Max Children = 5 > Queue Scan Interval = 40 > > I've changed The Scan Interval from 5 seconds to 40 and the max children > from 10 to 5, but without any significant change in the load. > My Solaris 9 box is an V440 with 4GB of ram and 4 ultrasparc CPU. > > Where I need to investigate ? From a simple check, seems that 2 > MailScanner processes are statically in O-state and three are in either > R/S state: it's normal ? > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smf at F2S.COM Mon Oct 10 18:00:49 2005 From: smf at F2S.COM (Steve Freegard) Date: Thu Jan 12 21:30:55 2006 Subject: LDAP script for Active Directory (also, Wiki) Message-ID: Hi Chris, On Mon, 2005-10-10 at 09:34 -0700, Chris W. Parker wrote: > Hello, > > I was just reading through > http://wiki.mailscanner.info/doku.php?id=maq:index#using_with_exchange_d > omino_etc and to my dismay found out that there is no link to the > appropriate article where Exchange is concerned. > > However, on > http://wiki.mailscanner.info/doku.php?id=documentation:configuration:mta > :postfix:how_to:reject_non_existent_users#ms_exchange there is a link to > some documentation for Postfix and Exchange that can be applied to > sendmail too. > > For anyone out there that is using MailScanner as a gateway with > sendmail in front of Exchange I would be very appreciative of a working > script to query valid user email addresses. > If you are using Exchange 2003 - then I can thoroughly recommend milter-ahead instead of directly querying Active Directory. This is a call-ahead type milter that you can implement on the gateway which then keeps a cache of the lookups for a configurable number of days. I prefer this as it's really easy to set-up and has no chance of bogging down your domain controllers or slowing mail delivery if AD is busy etc. See http://www.fsl.com/support/Milter-Ahead-Exchange-Settings.pdf for details on setting this up. Hope this helps. Cheers, Steve. -- Steve Freegard Fort Systems ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From taz at TAZ-MANIA.COM Mon Oct 10 17:14:02 2005 From: taz at TAZ-MANIA.COM (Dennis Willson) Date: Thu Jan 12 21:30:55 2006 Subject: OT - Which greylist milter Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] If you use Milter-Greylist, it's part of the configuration. I use it and it works really cool. William Burns wrote: > James Gray wrote: > >> Once these little niggles were sorted, we've been very impressed with >> the results. The two mail gateways synchronise their autowhite-lists >> etc too. So if a sender gets auto-learned on the primary MX, then >> tries the secondary, they get through without delay there too. Same >> rules apply for all auto-entries. So if they try on the primary and >> get a 451-temporarily unavailable, then come back after the set time >> interval but on the secondary, they will still get through on the >> secondary (even though they originally hit the primary). >> >> > > James: > > How did you do the synchronization? > > -Bill > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cparker at SWATGEAR.COM Mon Oct 10 18:02:00 2005 From: cparker at SWATGEAR.COM (Chris W. Parker) Date: Thu Jan 12 21:30:55 2006 Subject: LDAP script for Active Directory (also, Wiki) Message-ID: Steve Freegard on Monday, October 10, 2005 10:01 AM said: > If you are using Exchange 2003 - then I can thoroughly recommend > milter-ahead instead of directly querying Active Directory. Unfortunately no, I'm still at 2000. Sounds convenient though! :) Chris. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From vachanta at GMAIL.COM Mon Oct 10 18:14:15 2005 From: vachanta at GMAIL.COM (Venkata Achanta) Date: Thu Jan 12 21:30:55 2006 Subject: LDAP script for Active Directory (also, Wiki) Message-ID: Are you looking for this ? http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/270.html ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From peter at UCGBOOK.COM Mon Oct 10 18:32:20 2005 From: peter at UCGBOOK.COM (Peter Bonivart) Date: Thu Jan 12 21:30:55 2006 Subject: Too much uptime ! Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Rabellino Sergio wrote: > The load average persist over 3.00 and my mail traffic is not so high. The only times I've had high load averages continously without high traffic is when some process got stuck. Could be SA, DCC or Clam. Easiest way to find it is to shut down MS and see what's left, kill it and restart MS. -- /Peter Bonivart --Unix lovers do it in the Sun ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Oct 10 18:56:20 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:55 2006 Subject: Question about custom functions / generic spam plugin: Can they add headers? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Alex Neuman van der Hans wrote: > Julian Field wrote: > >> Beat you to it by miles on that one. What you want is this: >> >> # Do you want to add the Envelope-From: header? >> # This is very useful for tracking where spam came from as it >> # contains the envelope sender address. >> # This can also be the filename of a ruleset. >> Add Envelope From Header = yes >> >> # Do you want to add the Envelope-To: header? >> # This can be useful for tracking spam destinations, but should be >> # used with care due to possible privacy concerns with the use of >> # Bcc: headers by users. >> # This can also be the filename of a ruleset. >> Add Envelope To Header = no >> >> # This is the name of the Envelope From header >> # controlled by the option above. >> # This can also be the filename of a ruleset. >> Envelope From Header = X-MailScanner-From: >> >> # This is the name of the Envelope To header >> # controlled by the option above. >> # This can also be the filename of a ruleset. >> Envelope To Header = X-MailScanner-To: >> >> On 10 Oct 2005, at 04:38, Stijn Jonker wrote: >> >> >> >> >> >> >> >>> Hello all, >>> >>> There is currently a requirement popping up to add to headers for all >>> email towards an domain: >>> X-SMTP-From: >>> X-SMTP-To: >>> >>> Before diving in writing my own libmilter function/program I was >>> thinking of the custom function and/or the generic spam plugin. >>> >>> Whilst reading the book it didn't become really clear whether >>> either of >>> them can do it. I checked the source and although some experience at >>> perl I'm unsure if i can call the functions AddHeader/ChangeHeader >>> from >>> the various mailer pm's suchs as Sendmail.pm. >>> >>> Therefore my question, is this possible? >>> >>> Thanks in advance, >>> Stijn >>> >> > You might want to consider letting your users know that even if they > send e-mail out with BCC: the header will be included, so anyone who > looks at the message source will see who the recipients were. This > way, either they must send each message individually (some MUA's will > let you do this) or risk others knowing who they BCC:'d the message to. This is precisely why I leave the Envelope-To header switched off by default. I thoroughly disapprove of switching this on, but people can find it useful when diagnosing mail routing problems. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQ0qrRRH2WUcUFbZUEQIavwCgnOiDJIPlW76bA9JUVeMqvLlgZFgAoMSd 6BgqQsXphmqHpF8BWuUiVDbL =3Zmc -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Oct 10 18:54:12 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:55 2006 Subject: MailScanner on boot Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Have you got MailScanner-MRTG installed? I think that is what generates this log message. It isn't created by MailScanner itself. I think new versions of MailScanner-MRTG are better behaved in this respect. Information Services wrote: >I ran service MailScanner stop, and made sure the MailScanner.off was >in /var/lock/subsys/, and then rebooted. Upon rebooting, and checking >the /var/lock/subsys/ directory, the MailScanner.off was no longer >there. And then checking the /var/log/maillog I see this: > >Oct 10 08:35:03 wks-lin8 MailScanner-MRTG[3015]: Number of MailScanner >processes below threshold, restarting MailScanner > >My question now is....is the MailScanner.off supposed to be there upon a reboot? > >On 10/7/05, Scott Silva wrote: > > >>Information Services spake the following on 10/7/2005 12:52 PM: >> >> >>>You were right...MailScanner-mrtg looks like it is causing the >>>problem...here is what I just got from my log >>> >>>Oct 7 14:45:03 wks-lin8 MailScanner-MRTG[2873]: Number of MailScanner >>>processes below threshold, restarting MailScanner >>> >>>I guess I don't understand how MailScanner-MRTG is restarting when I >>>commented out all the lines in cron.d files. >>> >>> >>> >>> >>That was supposed to be fixed in 0.10.00-1. >>I think it looks for the same file that MailScanner generates when you >>run service MailScanner stop. >>/var/lock/subsys/MailScanner.off >>To quote the changelog "Now will not restart MailScanner if MailScanner >>was shut down using its init script." >>So if you stop MailScanner from it's init script, and then reboot, does >>it still restart? >>You might need to restore some of the changes you have made. >>-- >> >>/-----------------------\ |~~\_____/~~\__ | >>| MailScanner; The best |___________ \N1____====== )-+ >>| protection on the net!| ~~~|/~~ | >>\-----------------------/ () >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >> >> > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQ0qqxRH2WUcUFbZUEQKKMwCg/b06jRR0EMpAADyrwCbytzUV3pcAoJXm 6Kbijo/E4uWadjBZqxPzYEIw =cGU+ -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Oct 10 19:05:18 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:55 2006 Subject: Too much uptime ! Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 High load average figures from "uptime" are not an indication at all that your system is overloaded. It gives the average number of processes in the run queue. If a process is waiting for disk, it adds 1. If a process is waiting for network response, it adds 1. It doesn't mean anything is overloaded at all. A load average of 3 means there are an average of 3 processes waiting for cpu, disk or network. Since you have 4 CPUs then 1 of them is idle. A load of 12 to 15 on a hard-working single cpu system is perfectly common, it just means that all your system resources are being thoroughly used. I usually recommend 5 children per CPU. So you should start by setting it to 20. The Queue Scan Interval won't make any difference, I might remove it some time. It only affects the behaviour of the system when there are very few incoming messages. In all other situations it will process as many messages as it can without waiting for anything. It doesn't mean that MailScanner always waits 40 seconds to collect messages. If there are any messages waiting at all, then they are immediately processed. Leave it at 6. With a load average of 3 on a box with 4 cpu's, you've wasted your money as at least 1 cpu isn't even doing anything. A load average of 30 or 40 would mean your machine is working for its dinner. Rabellino Sergio wrote: > Dear list, > i'm getting an high uptime on my mailscanner box, and this is a new > behaviour for me. > > The load average persist over 3.00 and my mail traffic is not so high. > My actual config is > > MailScanner Rel4.45.4 - McAfee VirusScan - ClamAV cmd line - SA 3.0.4 > Max Children = 5 > Queue Scan Interval = 40 > > I've changed The Scan Interval from 5 seconds to 40 and the max > children from 10 to 5, but without any significant change in the load. > My Solaris 9 box is an V440 with 4GB of ram and 4 ultrasparc CPU. > > Where I need to investigate ? From a simple check, seems that 2 > MailScanner processes are statically in O-state and three are in > either R/S state: it's normal ? > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQ0qtYBH2WUcUFbZUEQLMEACgiIawJOB95M8H1O+Ik7RrzcJRf88AoOvF RuE7jUyv6vT4UU7ax1Tb08rI =AYAX -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Oct 10 19:08:41 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:55 2006 Subject: Errors when running --lint Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dhawal Doshy wrote: > Jody Cleveland wrote: > >> Hello, >> >> I recently upgraded spamassassin to 3.1 and MailScanner to 4.46.2 and >> it's all running on a redhat 3AS server. >> >> When I run: >> # /usr/bin/spamassassin -p /etc/MailScanner/spam.assassin.prefs.conf >> --lint >> >> I get this: >> [10005] warn: config: failed to parse line, skipping: dcc_path >> /usr/local/bin/dccproc >> [10005] warn: config: failed to parse line, skipping: razor_timeout 10 >> [10005] warn: config: warning: score set for non-existent rule >> RCVD_IN_RSL >> [10005] warn: lint: 3 issues detected, please rerun with debug enabled >> for more information >> >> Before those upgrades, lint ran fine without errors. Did something >> change with how dcc and razor run that needs to be reconvigured? >> >> -- >> Jody Cleveland > > > DCC and Razor are no more free, razor hasn't been so for the past 2 > years and dcc for about 4 months.. > > Heres what you need to do: > Enable the DCC / RAZOR plugins in /etc/mail/spamassassin/v310.pre if > you qualify for their free usage policy OR comment out the erroneous > lines in spam.assassin.prefs.conf if you don't qualify. If you install SpamAssassin from my ClamAV+SA package, it will tell you about things like that, and will tell you the lines you need to add to that file to enable SPF and SURBL checking too. For your info, they are loadplugin Mail::SpamAssassin::Plugin::RelayCountry loadplugin Mail::SpamAssassin::Plugin::SPF loadplugin Mail::SpamAssassin::Plugin::URIDNSBL - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQ0quKhH2WUcUFbZUEQK1TACcC033qSFvPkn46vXVzLVVaxkjpDMAoNp5 5MiBUVrXDktgQ0z/40oUfbrg =zX06 -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Cleveland at WINNEFOX.ORG Mon Oct 10 19:59:45 2005 From: Cleveland at WINNEFOX.ORG (Jody Cleveland) Date: Thu Jan 12 21:30:55 2006 Subject: Errors when running --lint Message-ID: Hi Julian, > If you install SpamAssassin from my ClamAV+SA package, it > will tell you about things like that, I'll definitely install it that way from now on. > and will tell you the lines you need > to add to > that file to enable SPF and SURBL checking too. For your > info, they are > loadplugin Mail::SpamAssassin::Plugin::RelayCountry > loadplugin Mail::SpamAssassin::Plugin::SPF > loadplugin Mail::SpamAssassin::Plugin::URIDNSBL I added those in, and now I get this error when I run --lint: [16459] warn: config: warning: score set for non-existent rule RCVD_IN_RSL Is there a plugin I need to install? - jody ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Oct 10 20:35:45 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:55 2006 Subject: Errors when running --lint Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Jody Cleveland wrote: >Hi Julian, > > > >>If you install SpamAssassin from my ClamAV+SA package, it >>will tell you about things like that, >> >> > >I'll definitely install it that way from now on. > > > >>and will tell you the lines you need >>to add to >>that file to enable SPF and SURBL checking too. For your >>info, they are >>loadplugin Mail::SpamAssassin::Plugin::RelayCountry >>loadplugin Mail::SpamAssassin::Plugin::SPF >>loadplugin Mail::SpamAssassin::Plugin::URIDNSBL >> >> > >I added those in, and now I get this error when I run --lint: >[16459] warn: config: warning: score set for non-existent rule >RCVD_IN_RSL > >Is there a plugin I need to install? > > No, that line isn't wanted any more. It's in spam.assassin.prefs.conf. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQ0rCkhH2WUcUFbZUEQIGKQCg9BD0bwgFZ30zFWiAvPcexsAv+goAoLtU 3tK2i2Py78NfhU0ht/T7rp0j =fB0O -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Mon Oct 10 20:51:11 2005 From: alex at NKPANAMA.COM (Alex Neuman) Date: Thu Jan 12 21:30:55 2006 Subject: Errors when running --lint Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > DCC and Razor are no more free, razor hasn't been so for the past 2 > years and dcc for about 4 months.. > > Heres what you need to do: > Enable the DCC / RAZOR plugins in /etc/mail/spamassassin/v310.pre if you > qualify for their free usage policy OR comment out the erroneous lines > in spam.assassin.prefs.conf if you don't qualify. Anybody care to explain why/how DCC/Razor are not free? Are they "not free as in beer", "not free as in speech", or some other form of "not free"? Thanks... ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lbcadmin at gmail.com Mon Oct 10 21:09:53 2005 From: lbcadmin at gmail.com (Information Services) Date: Thu Jan 12 21:30:55 2006 Subject: MailScanner on boot Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Yes, I am running MailScanner-mrtg (the most current stable version 0.10.00-1). I have gone to /etc/cron.d on my CentOS 4.1 system, and commented out all lines in: mailscanner-mrtg.crond mrtg --time lapse while doing some research--- Looking in /etc/MailScanner/mailscanner-mrtg...I found this: # MAILSCANNER SETTINGS # -------------------- # We can restart MailScanner if the number of MailScanner processes # goes below this number. Change to 0 if you don't want us to restart. Restart Threshhold = 1 # The script to run to restart MailScanner Restart MailScanner = /etc/rc.d/init.d/MailScanner restart # MailScanner lock file # This file is created by the MailScanner init script when MailScanner is # stopped. MSMRTG will look for this file and if it exists will not # attempt to restart MailScanner MailScanner Off File = /var/lock/subsys/MailScanner.off --------------------------- The part that I recognized right away was the Restart Threshold, because that is what the /var/log/messages keeps saying. Now, I can see how, if I change this to 0, then my problem will more than likely go away (something I will try after this email is sent). Of course, there are the two following commands that should already be working, and from what I can gather, they are working just fine until I reboot. It is the rebooting that gets me in trouble. The /var/lock/subsys/MailScanner.off is no longer there when the system reboots, and this allows mailscanner-mrtg to use the 'Restart Threshold.' So since this is the case, I guess what I need to do is move everything back that I have changed, and give it a try. Now, earlier, there was a post to this topic, that said mailscanner-mrtg 0.10.00-1 was supposed to resolve this problem. Is the problem resolved or is it my system that is not working properly? On 10/10/05, Alex Neuman van der Hans wrote: > Information Services wrote: > > >I ran service MailScanner stop, and made sure the MailScanner.off was > >in /var/lock/subsys/, and then rebooted. Upon rebooting, and checking > >the /var/lock/subsys/ directory, the MailScanner.off was no longer > >there. And then checking the /var/log/maillog I see this: > > > >Oct 10 08:35:03 wks-lin8 MailScanner-MRTG[3015]: Number of MailScanner > >processes below threshold, restarting MailScanner > > > >My question now is....is the MailScanner.off supposed to be there upon a reboot? > > > >On 10/7/05, Scott Silva wrote: > > > > > >>Information Services spake the following on 10/7/2005 12:52 PM: > >> > >> > >>>You were right...MailScanner-mrtg looks like it is causing the > >>>problem...here is what I just got from my log > >>> > >>>Oct 7 14:45:03 wks-lin8 MailScanner-MRTG[2873]: Number of MailScanner > >>>processes below threshold, restarting MailScanner > >>> > >>>I guess I don't understand how MailScanner-MRTG is restarting when I > >>>commented out all the lines in cron.d files. > >>> > >>> > >>> > >>> > >>That was supposed to be fixed in 0.10.00-1. > >>I think it looks for the same file that MailScanner generates when you > >>run service MailScanner stop. > >>/var/lock/subsys/MailScanner.off > >>To quote the changelog "Now will not restart MailScanner if MailScanner > >>was shut down using its init script." > >>So if you stop MailScanner from it's init script, and then reboot, does > >>it still restart? > >>You might need to restore some of the changes you have made. > >>-- > >> > >>/-----------------------\ |~~\_____/~~\__ | > >>| MailScanner; The best |___________ \N1____====== )-+ > >>| protection on the net!| ~~~|/~~ | > >>\-----------------------/ () > >> > >>------------------------ MailScanner list ------------------------ > >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>'leave mailscanner' in the body of the email. > >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >>Support MailScanner development - buy the book off the website! > >> > >> > >> > > > >------------------------ MailScanner list ------------------------ > >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >'leave mailscanner' in the body of the email. > >Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >Support MailScanner development - buy the book off the website! > > > > > You're running something else, in this case, "mailscanner-mrtg", which > is doing the deleting/restarting, probably. > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lbcadmin at gmail.com Mon Oct 10 21:22:49 2005 From: lbcadmin at gmail.com (Information Services) Date: Thu Jan 12 21:30:55 2006 Subject: MailScanner on boot Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Well it looks like the problem is resolved. Thanks for all your help. Next time I need to look in the config file right away, but I can say this...I better understand how Mailscanner-mrtg works. Again, thanks for taking the time to help me through this issue. Casey On 10/10/05, Information Services wrote: > Yes, > I am running MailScanner-mrtg (the most current stable version > 0.10.00-1). I have gone to /etc/cron.d on my CentOS 4.1 system, and > commented out all lines in: > > mailscanner-mrtg.crond > mrtg > > --time lapse while doing some research--- > > Looking in /etc/MailScanner/mailscanner-mrtg...I found this: > > # MAILSCANNER SETTINGS > # -------------------- > > # We can restart MailScanner if the number of MailScanner processes > # goes below this number. Change to 0 if you don't want us to restart. > Restart Threshhold = 1 > > # The script to run to restart MailScanner > Restart MailScanner = /etc/rc.d/init.d/MailScanner restart > > # MailScanner lock file > # This file is created by the MailScanner init script when MailScanner is > # stopped. MSMRTG will look for this file and if it exists will not > # attempt to restart MailScanner > MailScanner Off File = /var/lock/subsys/MailScanner.off > > --------------------------- > > The part that I recognized right away was the Restart Threshold, > because that is what the /var/log/messages keeps saying. Now, I can > see how, if I change this to 0, then my problem will more than likely > go away (something I will try after this email is sent). Of course, > there are the two following commands that should already be working, > and from what I can gather, they are working just fine until I reboot. > It is the rebooting that gets me in trouble. The > /var/lock/subsys/MailScanner.off is no longer there when the system > reboots, and this allows mailscanner-mrtg to use the 'Restart > Threshold.' So since this is the case, I guess what I need to do is > move everything back that I have changed, and give it a try. Now, > earlier, there was a post to this topic, that said mailscanner-mrtg > 0.10.00-1 was supposed to resolve this problem. Is the problem > resolved or is it my system that is not working properly? > > On 10/10/05, Alex Neuman van der Hans wrote: > > Information Services wrote: > > > > >I ran service MailScanner stop, and made sure the MailScanner.off was > > >in /var/lock/subsys/, and then rebooted. Upon rebooting, and checking > > >the /var/lock/subsys/ directory, the MailScanner.off was no longer > > >there. And then checking the /var/log/maillog I see this: > > > > > >Oct 10 08:35:03 wks-lin8 MailScanner-MRTG[3015]: Number of MailScanner > > >processes below threshold, restarting MailScanner > > > > > >My question now is....is the MailScanner.off supposed to be there upon a reboot? > > > > > >On 10/7/05, Scott Silva wrote: > > > > > > > > >>Information Services spake the following on 10/7/2005 12:52 PM: > > >> > > >> > > >>>You were right...MailScanner-mrtg looks like it is causing the > > >>>problem...here is what I just got from my log > > >>> > > >>>Oct 7 14:45:03 wks-lin8 MailScanner-MRTG[2873]: Number of MailScanner > > >>>processes below threshold, restarting MailScanner > > >>> > > >>>I guess I don't understand how MailScanner-MRTG is restarting when I > > >>>commented out all the lines in cron.d files. > > >>> > > >>> > > >>> > > >>> > > >>That was supposed to be fixed in 0.10.00-1. > > >>I think it looks for the same file that MailScanner generates when you > > >>run service MailScanner stop. > > >>/var/lock/subsys/MailScanner.off > > >>To quote the changelog "Now will not restart MailScanner if MailScanner > > >>was shut down using its init script." > > >>So if you stop MailScanner from it's init script, and then reboot, does > > >>it still restart? > > >>You might need to restore some of the changes you have made. > > >>-- > > >> > > >>/-----------------------\ |~~\_____/~~\__ | > > >>| MailScanner; The best |___________ \N1____====== )-+ > > >>| protection on the net!| ~~~|/~~ | > > >>\-----------------------/ () > > >> > > >>------------------------ MailScanner list ------------------------ > > >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > >>'leave mailscanner' in the body of the email. > > >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > >> > > >>Support MailScanner development - buy the book off the website! > > >> > > >> > > >> > > > > > >------------------------ MailScanner list ------------------------ > > >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > >'leave mailscanner' in the body of the email. > > >Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > >Support MailScanner development - buy the book off the website! > > > > > > > > You're running something else, in this case, "mailscanner-mrtg", which > > is doing the deleting/restarting, probably. > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Mon Oct 10 22:12:45 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:55 2006 Subject: Errors when running --lint Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 10/10/05, Alex Neuman wrote: > > DCC and Razor are no more free, razor hasn't been so for the past 2 > > years and dcc for about 4 months.. > > > > Heres what you need to do: > > Enable the DCC / RAZOR plugins in /etc/mail/spamassassin/v310.pre if you > > qualify for their free usage policy OR comment out the erroneous lines > > in spam.assassin.prefs.conf if you don't qualify. > > Anybody care to explain why/how DCC/Razor are not free? Are they "not free > as in beer", "not free as in speech", or some other form of "not free"? > Thanks... > Excerpts from their sites DCC: (in reverse order of appearance, for clarity) ... The Distributed Checksum Clearinghouse source carries a license that is free to organizations that do not sell filtering devices or services except to their own users and that participate in the global DCC network. (I.e. ISPs that use the DCC to filter mail for their own users are intended to be covered in the free license.) You also can't call it your own or blame anyone for using it. ... Note that it has never been proper to sell the bandwidth and, most important, human system administration work of the public DCC servers to third parties. Sellers of products or services including the DCC must provide DCC servers of their own or contracted from others. For example, Commtouch operates DCC servers for its licensees. ... Razor2: (More or less the total sum of http://razor.sourceforge.net/docs/doc.php?type=text&name=SERVICE_POLICY) ... Cloudmark SpamNet Service Policy V1.0 Aug 1, 2003 SpamNet Service and Razor-Agents While Razor-Agents are distributed under the Artistic License and will stay that way, the Cloudmark SpamNet service, a particular implementation of a Razor-compliant back-end, is a commercial operation with maintenance and support costs, and is no longer available for unlimited free use, effective immediately. Use of the SpamNet service by Razor-agent-enabled software will remain free for personal use, subject to capacity constraints that Cloudmark may enforce against intensive users of the service as it sees fit. Distribution or use of the system in commercial embedded software solutions is not free. All such access must be licensed by Cloudmark. Organizations interested in working with Razor or with Cloudmark's next-generation SpamNet client technologies should contact Cloudmark at partners@cloudmark.com ... Just for completeness, lets add this blurb from the Pyzor website too: ... Pyzor is a collaborative, networked system to detect and block spam using identifying digests of messages. Pyzor initially started out to be merely a Python implementation of Razor, but due to the protocol and the fact that Razor's server is not Open Source or software libre, I decided to impelement Pyzor with a new protocol and release the entire system as Open Source and software libre. Since the entire system is released under the GPL, people are free to host their own independent servers. Server peering is planned for a future release. ... So of them, we have one GPL (but suffering from .... other problems... Well, really just the scarcity of servers:-), one "free for YOUR users, provided you SHARE", and one "free for personal use, but not much else". This is enough "freedom" that I, for one, can use them. And it is strongly suggested that all you who provide commercial anti-spam services should be using the commercial offering for Razor and participate with at least a server and/or a commercial license for DCC, AFAICS. -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cparker at SWATGEAR.COM Mon Oct 10 23:17:33 2005 From: cparker at SWATGEAR.COM (Chris W. Parker) Date: Thu Jan 12 21:30:56 2006 Subject: Error getting Julian's key Message-ID: According to http://wiki.mailscanner.info/doku.php?id=maq:index I am supposed to run 'gpg --recv-keys --keyserver pgp.mit.edu 1415B654' before installation. However I get the following output: gpg: failed to create temporary file `/root/.gnupg/.#lk0x8bc9a8.localhost.localdomain.25932': No such file or directory gpg: keyblock resource `/root/.gnupg/secring.gpg': general error gpg: failed to create temporary file `/root/.gnupg/.#lk0x8bccb8.localhost.localdomain.25932': No such file or directory gpg: keyblock resource `/root/.gnupg/pubring.gpg': general error gpg: no writable keyring found: eof gpg: error reading `[stream]': general error gpg: Total number processed: 0 'rpm -qa|grep -i gpg' returns: libgpg-error-1.0-1 gpg-pubkey-443e1821-421f218f What am I missing or doing wrong? Chris. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Tue Oct 11 00:13:14 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:56 2006 Subject: Error getting Julian's key Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 11/10/05, Chris W. Parker wrote: > According to http://wiki.mailscanner.info/doku.php?id=maq:index I am > supposed to run 'gpg --recv-keys --keyserver pgp.mit.edu 1415B654' > before installation. However I get the following output: > > gpg: failed to create temporary file > `/root/.gnupg/.#lk0x8bc9a8.localhost.localdomain.25932': No such file or > directory > gpg: keyblock resource `/root/.gnupg/secring.gpg': general error > gpg: failed to create temporary file > `/root/.gnupg/.#lk0x8bccb8.localhost.localdomain.25932': No such file or > directory > gpg: keyblock resource `/root/.gnupg/pubring.gpg': general error > gpg: no writable keyring found: eof > gpg: error reading `[stream]': general error > gpg: Total number processed: 0 > > 'rpm -qa|grep -i gpg' returns: > > libgpg-error-1.0-1 > gpg-pubkey-443e1821-421f218f > > > What am I missing or doing wrong? > > > > Chris. > Well.... Do you have a keyring to add his public key to? If not, just run through "gpg --gen-key" to generate both a secring and a pubring (and a key pair for yourself:), then try receiving his pubkey again. -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Tue Oct 11 05:08:38 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:30:56 2006 Subject: Error getting Julian's key Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Chris W. Parker writes: > According to http://wiki.mailscanner.info/doku.php?id=maq:index I am > supposed to run 'gpg --recv-keys --keyserver pgp.mit.edu 1415B654' > before installation. However I get the following output: > > gpg: failed to create temporary file > `/root/.gnupg/.#lk0x8bc9a8.localhost.localdomain.25932': No such file or > directory > gpg: keyblock resource `/root/.gnupg/secring.gpg': general error > gpg: failed to create temporary file > `/root/.gnupg/.#lk0x8bccb8.localhost.localdomain.25932': No such file or > directory > gpg: keyblock resource `/root/.gnupg/pubring.gpg': general error > gpg: no writable keyring found: eof > gpg: error reading `[stream]': general error > gpg: Total number processed: 0 > > 'rpm -qa|grep -i gpg' returns: > > libgpg-error-1.0-1 > gpg-pubkey-443e1821-421f218f > > > What am I missing or doing wrong? > > > > Chris. Do you have a directory called .gnupg in /root? try creating one and rinse repeat to see if it works. - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rabellino at DI.UNITO.IT Tue Oct 11 08:18:18 2005 From: rabellino at DI.UNITO.IT (Rabellino Sergio) Date: Thu Jan 12 21:30:56 2006 Subject: Too much uptime ! Message-ID: Peter Bonivart wrote: > Rabellino Sergio wrote: > >> The load average persist over 3.00 and my mail traffic is not so high. > > > The only times I've had high load averages continously without high > traffic is when some process got stuck. Could be SA, DCC or Clam. > Easiest way to find it is to shut down MS and see what's left, kill it > and restart MS. > There are no visible processes stucked by the VirusScanners nor the Spamassassin. thanks. -- Dott. Mag. Sergio Rabellino Technical Staff Department of Computer Science University of Torino (Italy) http://www.di.unito.it/~rabser Tel. +39-0116706701 Fax. +39-011751603 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rabellino at DI.UNITO.IT Tue Oct 11 08:19:03 2005 From: rabellino at DI.UNITO.IT (Rabellino Sergio) Date: Thu Jan 12 21:30:56 2006 Subject: Too much uptime ! Message-ID: Michael Baird wrote: >You mean high load average I think. High uptime is a good thing. > >Regards >Michael Biard > > > Yes, i'm sorry, but yesterday was too late in the afternoon when I wrote the message :-) >>Dear list, >> i'm getting an high uptime on my mailscanner box, and this is a new >>behaviour for me. >> >>The load average persist over 3.00 and my mail traffic is not so high. >>My actual config is >> >>MailScanner Rel4.45.4 - McAfee VirusScan - ClamAV cmd line - SA 3.0.4 >>Max Children = 5 >>Queue Scan Interval = 40 >> >>I've changed The Scan Interval from 5 seconds to 40 and the max children >>from 10 to 5, but without any significant change in the load. >>My Solaris 9 box is an V440 with 4GB of ram and 4 ultrasparc CPU. >> >>Where I need to investigate ? From a simple check, seems that 2 >>MailScanner processes are statically in O-state and three are in either >>R/S state: it's normal ? >> >> >> > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > -- Dott. Mag. Sergio Rabellino Technical Staff Department of Computer Science University of Torino (Italy) http://www.di.unito.it/~rabser Tel. +39-0116706701 Fax. +39-011751603 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rabellino at DI.UNITO.IT Tue Oct 11 08:23:14 2005 From: rabellino at DI.UNITO.IT (Rabellino Sergio) Date: Thu Jan 12 21:30:56 2006 Subject: Too much uptime ! Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >High load average figures from "uptime" are not an indication at all >that your system is overloaded. It gives the average number of processes >in the run queue. If a process is waiting for disk, it adds 1. If a >process is waiting for network response, it adds 1. It doesn't mean >anything is overloaded at all. > > > Yes, I know, but why there are 2 MS processes always in run-queue ? They don't go to sleep for a while between the queue scanning ? >A load average of 3 means there are an average of 3 processes waiting >for cpu, disk or network. Since you have 4 CPUs then 1 of them is idle. >A load of 12 to 15 on a hard-working single cpu system is perfectly >common, it just means that all your system resources are being >thoroughly used. > >I usually recommend 5 children per CPU. So you should start by setting >it to 20. > > > I was used to see a load-average between 0->1 so now I noticed a change in this parameter and I need to understand why it happen. >The Queue Scan Interval won't make any difference, I might remove it >some time. It only affects the behaviour of the system when there are >very few incoming messages. In all other situations it will process as >many messages as it can without waiting for anything. It doesn't mean >that MailScanner always waits 40 seconds to collect messages. If there >are any messages waiting at all, then they are immediately processed. >Leave it at 6. > > > ok. >With a load average of 3 on a box with 4 cpu's, you've wasted your money >as at least 1 cpu isn't even doing anything. A load average of 30 or 40 >would mean your machine is working for its dinner. > > > > got it, captain! >>Dear list, >>i'm getting an high uptime on my mailscanner box, and this is a new >>behaviour for me. >> >>The load average persist over 3.00 and my mail traffic is not so high. >>My actual config is >> >>MailScanner Rel4.45.4 - McAfee VirusScan - ClamAV cmd line - SA 3.0.4 >>Max Children = 5 >>Queue Scan Interval = 40 >> >>I've changed The Scan Interval from 5 seconds to 40 and the max >>children from 10 to 5, but without any significant change in the load. >>My Solaris 9 box is an V440 with 4GB of ram and 4 ultrasparc CPU. >> >>Where I need to investigate ? From a simple check, seems that 2 >>MailScanner processes are statically in O-state and three are in >>either R/S state: it's normal ? >> >> >> > >- -- >Julian Field >www.MailScanner.info >Buy the MailScanner book at www.MailScanner.info/store >Professional Support Services at www.MailScanner.biz >MailScanner thanks transtec Computers for their support > >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > >-----BEGIN PGP SIGNATURE----- >Version: PGP Desktop 9.0.2 (Build 2424) > >iQA/AwUBQ0qtYBH2WUcUFbZUEQLMEACgiIawJOB95M8H1O+Ik7RrzcJRf88AoOvF >RuE7jUyv6vT4UU7ax1Tb08rI >=AYAX >-----END PGP SIGNATURE----- > > > -- Dott. Mag. Sergio Rabellino Technical Staff Department of Computer Science University of Torino (Italy) http://www.di.unito.it/~rabser Tel. +39-0116706701 Fax. +39-011751603 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Tue Oct 11 08:54:33 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:56 2006 Subject: Beta release 4.47.1 - auto-update phishing sites list Message-ID: Jules Fun and games doing the auto-update phishing sites update this AM... --03:30:00-- http://www.mailscanner.info/phishing.safe.sites.conf.master => `phishing.safe.sites.conf.master' Resolving www.mailscanner.info... done. Connecting to www.mailscanner.info[2001:630:d0:f102:204:23ff:feb9:897f]:80... failed: No route to host. Connecting to www.mailscanner.info[152.78.68.160]:80... connected. HTTP request sent, awaiting response... 302 Found Location: http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/phishing.safe.sites.conf. master [following] --03:30:20-- http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/phishing.safe.sites.conf. master => `phishing.safe.sites.conf.master' Resolving www.sng.ecs.soton.ac.uk... done. Connecting to www.sng.ecs.soton.ac.uk[2001:630:d0:f102:204:23ff:feb9:897f]:80... failed: No route to host. Connecting to www.sng.ecs.soton.ac.uk[152.78.68.160]:80... connected. HTTP request sent, awaiting response... 200 OK Length: 13,645 [text/plain] 0K .......... ... 100% 160.54 KB/s 03:30:20 (160.54 KB/s) - `phishing.safe.sites.conf.master' saved [13645/13645] Phishing safe sites list updated. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field Sent: 09 October 2005 15:54 To: MAILSCANNER@JISCMAIL.AC.UK Subject: [MAILSCANNER] Beta release 4.47.1 - auto-update phishing sites list -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have just released the first beta release of 4.47. The main new feature here is to automatically update the phishing.safe.sites.conf file every day. All your local changes will be kept, so there is no need to change how you use the file at all. But if you post me details of new additions to the file, I will add them to the master list, and they will appear in everyone's list within a day. If sites are added to the master list which turn out to be false, then I can just add a "REMOVE site.com" line to the master file and that will be removed from everyone's whitelist. So if you don't approve of one of my additions, you can add your own "REMOVE site.com" line so you don't use my listing for that site.com. So it's all pretty safe, and it should be impossible to subvert it. I personally vet every application to add a host to the list. But if I list one I shouldn't, then it is very easy for me (or you) to undo this with the "REMOVE" syntax. I hope you all find this useful and will upgrade to the new release at the start of November. In the mean time, I would be eternally grateful if you could test this new feature for me. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQ0kvCxH2WUcUFbZUEQLvGgCg1IspN/sNwIq0mFDy1UhNNU7YjucAoLag vdiHXNMXB4W3BMpNPQ3TKrfS =HM+x -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Oct 11 09:25:53 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:56 2006 Subject: Beta release 4.47.1 - auto-update phishing sites list Message-ID: It just means our main net connection doesn't yet run native IPv6. We have a separate IPv6 feed, but we use that for research work. On 11 Oct 2005, at 08:54, Martin Hepworth wrote: > Jules > > Fun and games doing the auto-update phishing sites update this AM... > > > --03:30:00-- http://www.mailscanner.info/ > phishing.safe.sites.conf.master > => `phishing.safe.sites.conf.master' > Resolving www.mailscanner.info... done. > Connecting to > www.mailscanner.info[2001:630:d0:f102:204:23ff:feb9:897f]:80... > failed: No > route to host. > Connecting to www.mailscanner.info[152.78.68.160]:80... connected. > HTTP request sent, awaiting response... 302 Found > Location: > http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/ > phishing.safe.sites.conf. > master [following] > --03:30:20-- > http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/ > phishing.safe.sites.conf. > master > => `phishing.safe.sites.conf.master' > Resolving www.sng.ecs.soton.ac.uk... done. > Connecting to > www.sng.ecs.soton.ac.uk[2001:630:d0:f102:204:23ff:feb9:897f]:80... > failed: > No route to host. > Connecting to www.sng.ecs.soton.ac.uk[152.78.68.160]:80... connected. > HTTP request sent, awaiting response... 200 OK > Length: 13,645 [text/plain] > > 0K .......... ... 100% > 160.54 > KB/s > > 03:30:20 (160.54 KB/s) - `phishing.safe.sites.conf.master' saved > [13645/13645] > > Phishing safe sites list updated. > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] > On Behalf > Of Julian Field > Sent: 09 October 2005 15:54 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: [MAILSCANNER] Beta release 4.47.1 - auto-update phishing > sites list > > * PGP Signed by an unmatched address: 10/09/05 at 15:54:03 > > I have just released the first beta release of 4.47. > > The main new feature here is to automatically update the > phishing.safe.sites.conf file every day. > All your local changes will be kept, so there is no need to change how > you use the file at all. > > But if you post me details of new additions to the file, I will add > them > to the master list, and they will appear in everyone's list within > a day. > > If sites are added to the master list which turn out to be false, > then I > can just add a "REMOVE site.com" line to the master file and that will > be removed from everyone's whitelist. So if you don't approve of > one of > my additions, you can add your own "REMOVE site.com" line so you don't > use my listing for that site.com. > > So it's all pretty safe, and it should be impossible to subvert it. I > personally vet every application to add a host to the list. But if I > list one I shouldn't, then it is very easy for me (or you) to undo > this > with the "REMOVE" syntax. > > I hope you all find this useful and will upgrade to the new release at > the start of November. > > In the mean time, I would be eternally grateful if you could test this > new feature for me. > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > * Julian Field > * 0x1415B654 (L) > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Tue Oct 11 10:36:04 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:56 2006 Subject: Error getting Julian's key Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 11/10/05, Dhawal Doshy wrote: > Chris W. Parker writes: > > > According to http://wiki.mailscanner.info/doku.php?id=maq:index I am > > supposed to run 'gpg --recv-keys --keyserver pgp.mit.edu 1415B654' > > before installation. However I get the following output: > > > > gpg: failed to create temporary file > > `/root/.gnupg/.#lk0x8bc9a8.localhost.localdomain.25932': No such file or > > directory > > gpg: keyblock resource `/root/.gnupg/secring.gpg': general error > > gpg: failed to create temporary file > > `/root/.gnupg/.#lk0x8bccb8.localhost.localdomain.25932': No such file or > > directory > > gpg: keyblock resource `/root/.gnupg/pubring.gpg': general error > > gpg: no writable keyring found: eof > > gpg: error reading `[stream]': general error > > gpg: Total number processed: 0 > > > > 'rpm -qa|grep -i gpg' returns: > > > > libgpg-error-1.0-1 > > gpg-pubkey-443e1821-421f218f > > > > > > What am I missing or doing wrong? > > > > > > > > Chris. > > Do you have a directory called .gnupg in /root? try creating one and rinse > repeat to see if it works. > > - dhawal > Did some testing... Might this be run as a user which lack write permissions on $HOME, like "postfix" usually does? -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Tue Oct 11 10:39:51 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:56 2006 Subject: Error getting Julian's key Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 11/10/05, Glenn Steen wrote: (snip) > Did some testing... Might this be run as a user which lack write > permissions on $HOME, like "postfix" usually does? What I'm getting at is ... well, you might have done a plain "su someuser"... Oh well, more coffee... -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From anders.andersson at LTKALMAR.SE Tue Oct 11 11:51:15 2005 From: anders.andersson at LTKALMAR.SE (Anders Andersson, IT) Date: Thu Jan 12 21:30:56 2006 Subject: LDAP script for Active Directory (also, Wiki) Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Steve Freegard > Sent: Monday, October 10, 2005 7:01 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: LDAP script for Active Directory (also, Wiki) > > Hi Chris, > > On Mon, 2005-10-10 at 09:34 -0700, Chris W. Parker wrote: > > Hello, > > > > I was just reading through > > > http://wiki.mailscanner.info/doku.php?id=maq:index#using_with_exchange > > _d omino_etc and to my dismay found out that there is no > link to the > > appropriate article where Exchange is concerned. > > > > However, on > > > http://wiki.mailscanner.info/doku.php?id=documentation:configuration:m > > ta :postfix:how_to:reject_non_existent_users#ms_exchange there is a > > link to some documentation for Postfix and Exchange that can be > > applied to sendmail too. > > > > For anyone out there that is using MailScanner as a gateway with > > sendmail in front of Exchange I would be very appreciative of a > > working script to query valid user email addresses. > > > > If you are using Exchange 2003 - then I can thoroughly > recommend milter-ahead instead of directly querying Active Directory. > > This is a call-ahead type milter that you can implement on > the gateway which then keeps a cache of the lookups for a > configurable number of days. I prefer this as it's really > easy to set-up and has no chance of bogging down your domain > controllers or slowing mail delivery if AD is busy etc. > > See > http://www.fsl.com/support/Milter-Ahead-Exchange-Settings.pdf > for details on setting this up. One thing I wondered that I didnt understand about Milter-Ahead, what will happen if the call-ahead fails? I guess that goes for things like keeping configuration on a mysql as well? /Anders > > Hope this helps. > > Cheers, > Steve. > > -- > Steve Freegard > Fort Systems ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From suporte at SETINET.COM.BR Tue Oct 11 16:40:29 2005 From: suporte at SETINET.COM.BR (Suporte SETi - Dennis) Date: Thu Jan 12 21:30:56 2006 Subject: dont want virus files in quanrantine folders Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] What to do if i dont want Virus files in my quarantine Folders? only eliminate the virus files. thanks -------------------------------------------------------------------- Esta mensagem foi verificada pelo sistema de anti-vírus e anti-spam. Seti Segurança e Tecnologia na Internet - suporte@setinet.com.br ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Tue Oct 11 12:43:26 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:30:56 2006 Subject: dont want virus files in quanrantine folders Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Suporte SETi - Dennis wrote: > What to do if i dont want Virus files in my quarantine Folders? > only eliminate the virus files. > > > thanks See this in MailScanner.conf # Do you want to stop any virus-infected spam getting into the spam or MCP # archives? If you have a system where users can release messages from the # spam or MCP archives, then you probably want to stop them being able to # release any infected messages, so set this to yes. # It is set to no by default as it causes a small hit in performance, and # many people don't allow users to access the spam quarantine, so don't # need it. # This can also be the filename of a ruleset. Keep Spam And MCP Archive Clean = no - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From suporte at SETINET.COM.BR Tue Oct 11 17:01:34 2005 From: suporte at SETINET.COM.BR (Suporte SETi - Dennis) Date: Thu Jan 12 21:30:56 2006 Subject: dont want virus files in quanrantine folders Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] And, if i use this version : 4.36.4-1 ? ----- Original Message ----- From: "Dhawal Doshy" To: Sent: Tuesday, October 11, 2005 4:43 AM Subject: Re: dont want virus files in quanrantine folders > Suporte SETi - Dennis wrote: > > What to do if i dont want Virus files in my quarantine Folders? > > only eliminate the virus files. > > > > > > thanks > > See this in MailScanner.conf > > # Do you want to stop any virus-infected spam getting into the spam or MCP > # archives? If you have a system where users can release messages from the > # spam or MCP archives, then you probably want to stop them being able to > # release any infected messages, so set this to yes. > # It is set to no by default as it causes a small hit in performance, and > # many people don't allow users to access the spam quarantine, so don't > # need it. > # This can also be the filename of a ruleset. > Keep Spam And MCP Archive Clean = no > > - dhawal > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > > -------------------------------------------------------------------- > Esta mensagem foi verificada pelo sistema de anti-vírus e anti-spam. > Seti Segurança e Tecnologia na Internet - suporte@setinet.com.br > > -------------------------------------------------------------------- Esta mensagem foi verificada pelo sistema de anti-vírus e anti-spam. Seti Segurança e Tecnologia na Internet - suporte@setinet.com.br ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Oct 11 13:05:08 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:56 2006 Subject: dont want virus files in quanrantine folders Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- You need to upgrade. It was added in 4.37 (Jan 1st 2005). On 11 Oct 2005, at 17:01, Suporte SETi - Dennis wrote: > And, if i use this version : 4.36.4-1 ? > > > ----- Original Message ----- > From: "Dhawal Doshy" > To: > Sent: Tuesday, October 11, 2005 4:43 AM > Subject: Re: dont want virus files in quanrantine folders > > > >> Suporte SETi - Dennis wrote: >> >>> What to do if i dont want Virus files in my quarantine Folders? >>> only eliminate the virus files. >>> >>> >>> thanks >>> >> >> See this in MailScanner.conf >> >> # Do you want to stop any virus-infected spam getting into the >> spam or MCP >> # archives? If you have a system where users can release messages >> from the >> # spam or MCP archives, then you probably want to stop them being >> able to >> # release any infected messages, so set this to yes. >> # It is set to no by default as it causes a small hit in >> performance, and >> # many people don't allow users to access the spam quarantine, so >> don't >> # need it. >> # This can also be the filename of a ruleset. >> Keep Spam And MCP Archive Clean = no >> >> - dhawal >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> >> -------------------------------------------------------------------- >> Esta mensagem foi verificada pelo sistema de anti-vírus e anti-spam. >> Seti Segurança e Tecnologia na Internet - suporte@setinet.com.br >> >> >> > > > > -------------------------------------------------------------------- > Esta mensagem foi verificada pelo sistema de anti-vírus e anti-spam. > Seti Segurança e Tecnologia na Internet - suporte@setinet.com.br > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ0uqffw32o+k+q+hAQEzcgf/RGaPyHY6Ze3whf1qM24ydjaAjwn78U3c jCAV7h3NVezkh7ElY2zoA8pNvwCQrLc0IFUzmgrCuaVU7PflxRDrzcFEg+KNji57 W5h2K0OfZb8grwyKBEeq0hY5cmzzK5nRUNUgQuSnpcCBwBx8tWQgldP48yV7belh 65onlbkwyTdsso6k5MUpE3pHABavzfNlzjwVSxQxMynDHfHf81UWE+Tuq2JzB4Au i08yzVZ+39Sk8Od3VODdgn7pWqfF3g1ubFVmcGpFTLUreLAFj1c44kN7n2fUWzrI 9Lv6ImJtaiP/eAiBzK6wzSS9f1aoTEPvzOAjimzzKZi0botMjIWXLw== =beFY -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Tue Oct 11 13:11:34 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:30:56 2006 Subject: dont want virus files in quanrantine folders Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > -----BEGIN PGP SIGNED MESSAGE----- > > You need to upgrade. It was added in 4.37 (Jan 1st 2005). > And you also need to sync the time on your laptop.. your posts are more than 4 hours in the future. - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From gmatt at NERC.AC.UK Tue Oct 11 13:28:01 2005 From: gmatt at NERC.AC.UK (Greg Matthews) Date: Thu Jan 12 21:30:56 2006 Subject: LDAP script for Active Directory (also, Wiki) Message-ID: On Tue, 2005-10-11 at 12:51 +0200, Anders Andersson, IT wrote: > One thing I wondered that I didnt understand about Milter-Ahead, what > will happen if the call-ahead fails? I guess that goes for things like > keeping configuration on a mysql as well? this is in the docs, the delivery is attempted. G > > /Anders -- Greg Matthews 01491 692445 Head of UNIX/Linux, iTSS Wallingford ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Tue Oct 11 13:24:19 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:30:56 2006 Subject: dont want virus files in quanrantine folders Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Tue, October 11, 2005 13:11, Dhawal Doshy wrote: > Julian Field wrote: >> -----BEGIN PGP SIGNED MESSAGE----- >> >> You need to upgrade. It was added in 4.37 (Jan 1st 2005). >> > > And you also need to sync the time on your laptop.. your posts are more > than 4 hours in the future. > Or the time zone is wrong
Date: Tue, 11 Oct 2005 09:01:34 -0700
Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From suporte at SETINET.COM.BR Tue Oct 11 13:46:07 2005 From: suporte at SETINET.COM.BR (Suporte SETi - Dennis) Date: Thu Jan 12 21:30:56 2006 Subject: dont want virus files in quanrantine folders Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ok, sorry about the time. Now that's ok, i think Thanks ----- Original Message ----- From: "Drew Marshall" To: Sent: Tuesday, October 11, 2005 9:24 AM Subject: Re: dont want virus files in quanrantine folders > On Tue, October 11, 2005 13:11, Dhawal Doshy wrote: > > Julian Field wrote: > >> -----BEGIN PGP SIGNED MESSAGE----- > >> > >> You need to upgrade. It was added in 4.37 (Jan 1st 2005). > >> > > > > And you also need to sync the time on your laptop.. your posts are more > > than 4 hours in the future. > > > > Or the time zone is wrong
Date: Tue, 11 Oct 2005 09:01:34 > -0700
> > Drew > > > -- > In line with our policy, this message has > been scanned for viruses and dangerous > content by MailScanner, and is believed to be clean. > www.themarshalls.co.uk/policy > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > > -------------------------------------------------------------------- > Esta mensagem foi verificada pelo sistema de anti-vírus e anti-spam. > Seti Segurança e Tecnologia na Internet - suporte@setinet.com.br > > -------------------------------------------------------------------- Esta mensagem foi verificada pelo sistema de anti-vírus e anti-spam. Seti Segurança e Tecnologia na Internet - suporte@setinet.com.br ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From aslan at AEON.COM.BR Tue Oct 11 13:48:50 2005 From: aslan at AEON.COM.BR (Aslan Carlos de Medeiros Ramos) Date: Thu Jan 12 21:30:56 2006 Subject: Traffic Backup for security propose. Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi Guys, I'm talk to brazil, I've make a module for Mailscanner to save all traffic in and out for a security propose, but If one here help I'll finish early. I've used the object $message to get the traffic, but I can't get the body, how I can do this? Sorry my english may be so bad. Thanks!! When I've finish, I put it here.. -- Aslan Carlos de Medeiros Ramos Aeon Technologies ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "This is a digitally signed message part" ] [ Application/PGP-SIGNATURE 492bytes. ] [ Unable to print this part. ] From aslan at AEON.COM.BR Tue Oct 11 13:57:36 2005 From: aslan at AEON.COM.BR (Aslan Carlos de Medeiros Ramos) Date: Thu Jan 12 21:30:56 2006 Subject: Always Looked Up Last Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi! How can I put two function in the option "Always Looked Up Last" in the MailScanner.conf, I want run the MailWatch and um function (my copymail) both togther. Thanks.. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "This is a digitally signed message part" ] [ Application/PGP-SIGNATURE 492bytes. ] [ Unable to print this part. ] From MailScanner at ecs.soton.ac.uk Tue Oct 11 14:01:13 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:56 2006 Subject: Traffic Backup for security propose. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Just use the "Archive Mail" feature. And please always set your reply-to to be the mailing list (or don't set it at all). There is little point having a discussion in replies are not sent to the list. And people like me get very annoyed having to add the list address to the recipient list of all the replies to people like you. On 11 Oct 2005, at 13:48, Aslan Carlos de Medeiros Ramos wrote: * PGP Signed by an unknown key: 10/11/05 at 13:48:49 Hi Guys, I'm talk to brazil, I've make a module for Mailscanner to save all traffic in and out for a security propose, but If one here help I'll finish early. I've used the object $message to get the traffic, but I can't get the body, how I can do this? Sorry my english may be so bad. Thanks!! When I've finish, I put it here.. -- Aslan Carlos de Medeiros Ramos Aeon Technologies * Unknown Key * 0x9939056D ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! --  Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Application/PGP-SIGNATURE 498bytes. ] [ Unable to print this part. ] From ugob at CAMO-ROUTE.COM Tue Oct 11 13:53:48 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:56 2006 Subject: dont want virus files in quanrantine folders Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Suporte SETi - Dennis wrote: > And, if i use this version : 4.36.4-1 ? The workaround is to forward what you don't deliver to /dev/null. But you should think about upgrading or you may end up having so much changes in your next upgrade that it would become very hard. Regards, -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From aslan at AEON.COM.BR Tue Oct 11 14:18:47 2005 From: aslan at AEON.COM.BR (Aslan Carlos de Medeiros Ramos) Date: Thu Jan 12 21:30:56 2006 Subject: Traffic Backup for security propose. Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Thanks, And Sorry it my first email. On Tue, 2005-10-11 at 14:01 +0100, Julian Field wrote: Just use the "Archive Mail" feature. And please always set your reply-to to be the mailing list (or don't set it at all). There is little point having a discussion in replies are not sent to the list. And people like me get very annoyed having to add the list address to the recipient list of all the replies to people like you. On 11 Oct 2005, at 13:48, Aslan Carlos de Medeiros Ramos wrote: * PGP Signed by an unknown key: 10/11/05 at 13:48:49 Hi Guys, I'm talk to brazil, I've make a module for Mailscanner to save all traffic in and out for a security propose, but If one here help I'll finish early. I've used the object $message to get the traffic, but I can't get the body, how I can do this? Sorry my english may be so bad. Thanks!! When I've finish, I put it here.. -- Aslan Carlos de Medeiros Ramos Aeon Technologies * Unknown Key * 0x9939056D ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! -- Aslan Carlos de Medeiros Ramos Aeon Technologies ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "This is a digitally signed message part" ] [ Application/PGP-SIGNATURE 492bytes. ] [ Unable to print this part. ] From cparker at SWATGEAR.COM Tue Oct 11 16:42:01 2005 From: cparker at SWATGEAR.COM (Chris W. Parker) Date: Thu Jan 12 21:30:56 2006 Subject: Error getting Julian's key Message-ID: Dhawal Doshy on Monday, October 10, 2005 9:09 PM said: > Do you have a directory called .gnupg in /root? try creating one and > rinse repeat to see if it works. No I didn't. I thought it was more complicated than that so I asked the list to make sure (because Google was no help). But I guess this was all I needed to do. Thanks, Chris. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From aslan at AEON.COM.BR Tue Oct 11 17:12:50 2005 From: aslan at AEON.COM.BR (Aslan Carlos de Medeiros Ramos) Date: Thu Jan 12 21:30:56 2006 Subject: Traffic Backup for security propose. Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi Julian, Thanks for help me, this option "Archive Mail" it's my solution, but I can't understand the rules, there say # Space-separated list of any combination of # 1. email addresses to which mail should be forwarded, # 2. directory names where you want mail to be stored, # 3. file names (they must already exist!) to which mail will be appended # in "mbox" format suitable for most Unix mail systems. # # If you give this option a ruleset, you can control exactly whose mail # is archived or forwarded. If you do this, beware of the legal implications # as this could be deemed to be illegal interception unless the police have # asked you to do this. (Where a put the 1,2 or 3 sayed above)? I'd make a file rule follow a exemple /etc/MailScanner/rules/achive.rules FromOrTo: user@domain.com /var/spool/MailScanner/achive/user above is append all the traffic from or to to the file user in the one dir, but my problem is , I need to order by date exemple : /var/spool/MailScanner/user/$date/in or out . Any Idea? Thanks for all, Aslan Carlos On Tue, 2005-10-11 at 10:18 -0300, Aslan Carlos de Medeiros Ramos wrote: Thanks, And Sorry it my first email. On Tue, 2005-10-11 at 14:01 +0100, Julian Field wrote: Just use the "Archive Mail" feature. And please always set your reply-to to be the mailing list (or don't set it at all). There is little point having a discussion in replies are not sent to the list. And people like me get very annoyed having to add the list address to the recipient list of all the replies to people like you. On 11 Oct 2005, at 13:48, Aslan Carlos de Medeiros Ramos wrote: * PGP Signed by an unknown key: 10/11/05 at 13:48:49 Hi Guys, I'm talk to brazil, I've make a module for Mailscanner to save all traffic in and out for a security propose, but If one here help I'll finish early. I've used the object $message to get the traffic, but I can't get the body, how I can do this? Sorry my english may be so bad. Thanks!! When I've finish, I put it here.. -- Aslan Carlos de Medeiros Ramos Aeon Technologies * Unknown Key * 0x9939056D ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! -- Aslan Carlos de Medeiros Ramos Aeon Technologies ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! -- Aslan Carlos de Medeiros Ramos Aeon Technologies ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "This is a digitally signed message part" ] [ Application/PGP-SIGNATURE 492bytes. ] [ Unable to print this part. ] From MailScanner at ecs.soton.ac.uk Tue Oct 11 17:59:43 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:56 2006 Subject: Traffic Backup for security propose. Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Aslan Carlos de Medeiros Ramos wrote: > Hi Julian, > Thanks for help me, this option "Archive Mail" it's my solution, but I > can't understand the rules, > there say > # Space-separated list of any combination of > # 1. email addresses to which mail should be forwarded, > # 2. directory names where you want mail to be stored, > # 3. file names (they must already exist!) to which mail will be appended > # in "mbox" format suitable for most Unix mail systems. > # > # If you give this option a ruleset, you can control exactly whose mail > # is archived or forwarded. If you do this, beware of the legal > implications > # as this could be deemed to be illegal interception unless the police > have > # asked you to do this. > (Where a put the 1,2 or 3 sayed above)? It means you can have a list containing any of the 3 options given. > > I'd make a file rule follow a exemple > /etc/MailScanner/rules/achive.rules > FromOrTo: user@domain.com /var/spool/MailScanner/achive/user > above is append all the traffic from or to to the file user in the one > dir, but my problem is , I need to order by date > exemple : /var/spool/MailScanner/user/$date/in or out . > Any Idea? If you had a recent version, you would see this comment as well: # Any of the items above can contain the magic string _DATE_ in them # which will be replaced with the current date in yyyymmdd format. # This will make archive-rolling and maintenance much easier, as you can # guarantee that yesterday's mail archive will not be in active use today. So if you wanted to save the mail for user@domain.com then you could put Archive Mail = /var/spool/MailScanner/user/_DATE_/mail You need to upgrade your MailScanner. > > > Thanks for all, > Aslan Carlos > > > On Tue, 2005-10-11 at 10:18 -0300, Aslan Carlos de Medeiros Ramos wrote: > >> Thanks, >> And Sorry it my first email. >> >> >> On Tue, 2005-10-11 at 14:01 +0100, Julian Field wrote: >> >>> Just use the "Archive Mail" feature. >>> >>> >>> And please always set your reply-to to be the mailing list (or don't >>> set it at all). There is little point having a discussion in replies >>> are not sent to the list. And people like me get very annoyed having >>> to add the list address to the recipient list of all the replies to >>> people like you. >>> >>> On 11 Oct 2005, at 13:48, Aslan Carlos de Medeiros Ramos wrote: >>> >>>> * PGP Signed by an unknown key: 10/11/05 at 13:48:49 >>>> >>>> Hi Guys, >>>> I'm talk to brazil, >>>> I've make a module for Mailscanner to save all traffic in and out >>>> for a security propose, but If one here help I'll finish early. >>>> I've used the object $message to get the traffic, but I can't get >>>> the body, how I can do this? >>>> Sorry my english may be so bad. >>>> Thanks!! >>>> When I've finish, I put it here.. >>>> >>>> >>>> -- >>>> Aslan Carlos de Medeiros Ramos >>> > >>>> Aeon Technologies >>>> >>>> * Unknown Key >>>> * 0x9939056D >>>> >>>> >>>> >>>> ------------------------ MailScanner list ------------------------ >>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>> 'leave mailscanner' in the body of the email. >>>> Before posting, read the Wiki (http://wiki.mailscanner.info/) >>>> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>> *Support MailScanner development - buy the book off the website!* >>> >>> >>> -- >>> Julian Field >>> www.MailScanner.info >>> Buy the MailScanner book at www.MailScanner.info/store >>> >>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>> >>> >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) >>> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> *Support MailScanner development - buy the book off the website!* >> >> -- >> Aslan Carlos de Medeiros Ramos > > >> Aeon Technologies >> >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) >> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> *Support MailScanner development - buy the book off the website!* > > -- > Aslan Carlos de Medeiros Ramos > > Aeon Technologies > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike.patchen at GMAIL.COM Tue Oct 11 18:37:31 2005 From: mike.patchen at GMAIL.COM (Mike Patchen) Date: Thu Jan 12 21:30:56 2006 Subject: Messages not getting scanned Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello, I am having a slight problem with Mailscanner in that occasionally messages do not get scanned at all. Running Mailscanner version 4.44.6, sendmail 8.12.8 (I know, I need to update that). Problem only occurs a couple of time a day out of about 4,000 emails/day. Of course, all the ones that I catch are spam/virus that should have been caught in Mailscanner, but were completely missed. On all of these messages, there is no header information to suggest that it was even scanned, and the logs show no scanning to have occurred. Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: from=<{sender@domain.org}>, size=2102, class=0, nrcpts=3, msgid=<46951E64.855A1E7@{domain.org}>, proto=ESMTP, daemon=MTA, relay={relay} [{x.x.x.x}] Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: to=<{user1@mydomain.com}>, delay=00:00:00, mailer=smtp, pri=92102, stat=queued Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: to=<{user2@mydomain.com}>, delay=00:00:00, mailer=smtp, pri=92102, stat=queued Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: to=<{user3@mydomain.com}>, delay=00:00:00, mailer=smtp, pri=92102, stat=queued Oct 11 11:37:04 mail sendmail[20449]: j9BGb2KV020448: to=<{user3@mydomain.com}>,<{user2@mydomain.com}>,<{user1@mydomain.com}>, delay=00:00:02, xdelay=00:00:00, mailer=smtp, pri=182102, relay=[{internal mail server}] [x.x.x.x], dsn=2.0.0, stat=Sent (Requested mail action okay, completed) Sometimes there will be multiple recipients, sometimes just one. I have verified that there are no specific rules for any of the individual users, or the relay servers. I'm not even sure if this is a Mailscanner issue or a sendmail issue at this point. With the exception of these few messages, everything is working just as expected. Thanks in advance for any help! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Oct 11 19:12:04 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:56 2006 Subject: Messages not getting scanned Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Are you running Linux? Please check you have *not* got the sendmail service running, and not starting on reboot. Do this lot: service MailScanner stop service sendmail stop Check you have no sendmail processes running at all Check you have no MailScanner processes running at all chkconfig sendmail off chkconfig --level 2345 MailScanner on service MailScanner start and see if that helps at all. Also, make sure you haven't got any webmin/cpanel/whatever software running that may be trying to restart sendmail. Mike Patchen wrote: >Hello, > >I am having a slight problem with Mailscanner in that occasionally >messages do not get scanned at all. Running Mailscanner version >4.44.6, sendmail 8.12.8 (I know, I need to update that). Problem only >occurs a couple of time a day out of about 4,000 emails/day. Of >course, all the ones that I catch are spam/virus that should have been >caught in Mailscanner, but were completely missed. On all of these >messages, there is no header information to suggest that it was even >scanned, and the logs show no scanning to have occurred. > >Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: >from=<{sender@domain.org}>, size=2102, class=0, nrcpts=3, >msgid=<46951E64.855A1E7@{domain.org}>, proto=ESMTP, daemon=MTA, >relay={relay} [{x.x.x.x}] >Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: >to=<{user1@mydomain.com}>, delay=00:00:00, mailer=smtp, pri=92102, >stat=queued >Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: >to=<{user2@mydomain.com}>, delay=00:00:00, mailer=smtp, pri=92102, >stat=queued >Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: >to=<{user3@mydomain.com}>, delay=00:00:00, mailer=smtp, pri=92102, >stat=queued >Oct 11 11:37:04 mail sendmail[20449]: j9BGb2KV020448: >to=<{user3@mydomain.com}>,<{user2@mydomain.com}>,<{user1@mydomain.com}>, >delay=00:00:02, xdelay=00:00:00, mailer=smtp, pri=182102, >relay=[{internal mail server}] [x.x.x.x], dsn=2.0.0, stat=Sent >(Requested mail action okay, completed) > >Sometimes there will be multiple recipients, sometimes just one. I >have verified that there are no specific rules for any of the >individual users, or the relay servers. I'm not even sure if this is >a Mailscanner issue or a sendmail issue at this point. With the >exception of these few messages, everything is working just as >expected. > >Thanks in advance for any help! > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQ0wAdhH2WUcUFbZUEQIcuwCg1MjyVXsv3aeiriQz2g+Ro8nhJP4AoIDx trfDNRMvozg84nvii6nacIh7 =fbXu -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike.patchen at GMAIL.COM Tue Oct 11 19:29:52 2005 From: mike.patchen at GMAIL.COM (Mike Patchen) Date: Thu Jan 12 21:30:56 2006 Subject: Messages not getting scanned Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Yes, I am running Linux - RedHat 8. Guess I am a bit confused on not having sendmail running, do I not need this to accept incoming mail and place it in MailScanner's queue? I have my sendmail setup as per the instructions on the web site, it saves incoming messages to mailq.in, MailScanner processes them and places them back into mailq. A separate sendmail process then handles final delivery of the message. This appears to be working perfectly fine. Mike On 10/11/05, Julian Field wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Are you running Linux? > Please check you have *not* got the sendmail service running, and not > starting on reboot. Do this lot: > service MailScanner stop > service sendmail stop > Check you have no sendmail processes running at all > Check you have no MailScanner processes running at all > chkconfig sendmail off > chkconfig --level 2345 MailScanner on > service MailScanner start > > and see if that helps at all. > > Also, make sure you haven't got any webmin/cpanel/whatever software > running that may be trying to restart sendmail. > > Mike Patchen wrote: > > >Hello, > > > >I am having a slight problem with Mailscanner in that occasionally > >messages do not get scanned at all. Running Mailscanner version > >4.44.6, sendmail 8.12.8 (I know, I need to update that). Problem only > >occurs a couple of time a day out of about 4,000 emails/day. Of > >course, all the ones that I catch are spam/virus that should have been > >caught in Mailscanner, but were completely missed. On all of these > >messages, there is no header information to suggest that it was even > >scanned, and the logs show no scanning to have occurred. > > > >Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: > >from=<{sender@domain.org}>, size=2102, class=0, nrcpts=3, > >msgid=<46951E64.855A1E7@{domain.org}>, proto=ESMTP, daemon=MTA, > >relay={relay} [{x.x.x.x}] > >Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: > >to=<{user1@mydomain.com}>, delay=00:00:00, mailer=smtp, pri=92102, > >stat=queued > >Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: > >to=<{user2@mydomain.com}>, delay=00:00:00, mailer=smtp, pri=92102, > >stat=queued > >Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: > >to=<{user3@mydomain.com}>, delay=00:00:00, mailer=smtp, pri=92102, > >stat=queued > >Oct 11 11:37:04 mail sendmail[20449]: j9BGb2KV020448: > >to=<{user3@mydomain.com}>,<{user2@mydomain.com}>,<{user1@mydomain.com}>, > >delay=00:00:02, xdelay=00:00:00, mailer=smtp, pri=182102, > >relay=[{internal mail server}] [x.x.x.x], dsn=2.0.0, stat=Sent > >(Requested mail action okay, completed) > > > >Sometimes there will be multiple recipients, sometimes just one. I > >have verified that there are no specific rules for any of the > >individual users, or the relay servers. I'm not even sure if this is > >a Mailscanner issue or a sendmail issue at this point. With the > >exception of these few messages, everything is working just as > >expected. > > > >Thanks in advance for any help! > > > >------------------------ MailScanner list ------------------------ > >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >'leave mailscanner' in the body of the email. > >Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >Support MailScanner development - buy the book off the website! > > > > > > - -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > -----BEGIN PGP SIGNATURE----- > Version: PGP Desktop 9.0.2 (Build 2424) > > iQA/AwUBQ0wAdhH2WUcUFbZUEQIcuwCg1MjyVXsv3aeiriQz2g+Ro8nhJP4AoIDx > trfDNRMvozg84nvii6nacIh7 > =fbXu > -----END PGP SIGNATURE----- > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Oct 11 20:15:17 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:56 2006 Subject: Messages not getting scanned Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mike Patchen wrote: >Yes, I am running Linux - RedHat 8. Guess I am a bit confused on not >having sendmail running, do I not need this to accept incoming mail >and place it in MailScanner's queue? > The MailScanner startup script will also start the sendmail processes it needs in the correct way. You don't want to start up sendmail independently as well, that will bypass MailScanner. > I have my sendmail setup as per >the instructions on the web site, it saves incoming messages to >mailq.in, MailScanner processes them and places them back into mailq. >A separate sendmail process then handles final delivery of the >message. This appears to be working perfectly fine. > > I hope you mean mqueue and not mailq.... >Mike > >On 10/11/05, Julian Field wrote: > > >>-----BEGIN PGP SIGNED MESSAGE----- >>Hash: SHA1 >> >>Are you running Linux? >>Please check you have *not* got the sendmail service running, and not >>starting on reboot. Do this lot: >>service MailScanner stop >>service sendmail stop >>Check you have no sendmail processes running at all >>Check you have no MailScanner processes running at all >>chkconfig sendmail off >>chkconfig --level 2345 MailScanner on >>service MailScanner start >> >>and see if that helps at all. >> >>Also, make sure you haven't got any webmin/cpanel/whatever software >>running that may be trying to restart sendmail. >> >>Mike Patchen wrote: >> >> >> >>>Hello, >>> >>>I am having a slight problem with Mailscanner in that occasionally >>>messages do not get scanned at all. Running Mailscanner version >>>4.44.6, sendmail 8.12.8 (I know, I need to update that). Problem only >>>occurs a couple of time a day out of about 4,000 emails/day. Of >>>course, all the ones that I catch are spam/virus that should have been >>>caught in Mailscanner, but were completely missed. On all of these >>>messages, there is no header information to suggest that it was even >>>scanned, and the logs show no scanning to have occurred. >>> >>>Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: >>>from=<{sender@domain.org}>, size=2102, class=0, nrcpts=3, >>>msgid=<46951E64.855A1E7@{domain.org}>, proto=ESMTP, daemon=MTA, >>>relay={relay} [{x.x.x.x}] >>>Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: >>>to=<{user1@mydomain.com}>, delay=00:00:00, mailer=smtp, pri=92102, >>>stat=queued >>>Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: >>>to=<{user2@mydomain.com}>, delay=00:00:00, mailer=smtp, pri=92102, >>>stat=queued >>>Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: >>>to=<{user3@mydomain.com}>, delay=00:00:00, mailer=smtp, pri=92102, >>>stat=queued >>>Oct 11 11:37:04 mail sendmail[20449]: j9BGb2KV020448: >>>to=<{user3@mydomain.com}>,<{user2@mydomain.com}>,<{user1@mydomain.com}>, >>>delay=00:00:02, xdelay=00:00:00, mailer=smtp, pri=182102, >>>relay=[{internal mail server}] [x.x.x.x], dsn=2.0.0, stat=Sent >>>(Requested mail action okay, completed) >>> >>>Sometimes there will be multiple recipients, sometimes just one. I >>>have verified that there are no specific rules for any of the >>>individual users, or the relay servers. I'm not even sure if this is >>>a Mailscanner issue or a sendmail issue at this point. With the >>>exception of these few messages, everything is working just as >>>expected. >>> >>>Thanks in advance for any help! >>> >>>------------------------ MailScanner list ------------------------ >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >>> >>> >>> >>> >>- -- >>Julian Field >>www.MailScanner.info >>Buy the MailScanner book at www.MailScanner.info/store >>Professional Support Services at www.MailScanner.biz >>MailScanner thanks transtec Computers for their support >> >>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> >>-----BEGIN PGP SIGNATURE----- >>Version: PGP Desktop 9.0.2 (Build 2424) >> >>iQA/AwUBQ0wAdhH2WUcUFbZUEQIcuwCg1MjyVXsv3aeiriQz2g+Ro8nhJP4AoIDx >>trfDNRMvozg84nvii6nacIh7 >>=fbXu >>-----END PGP SIGNATURE----- >> >>-- >>This message has been scanned for viruses and >>dangerous content by MailScanner, and is >>believed to be clean. >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >> >> > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQ0wPRhH2WUcUFbZUEQIVDgCdFhjiShGvtExH2iUlka7+hdjBEhYAoP0a wGBRvnJhx4qXG2/k3Rn4qUsF =FIDD -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Tue Oct 11 20:15:46 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:56 2006 Subject: Traffic Backup for security propose. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > > And please always set your reply-to to be the mailing list (or don't > set it at all). There is little point having a discussion in replies > are not sent to the list. And people like me get very annoyed having > to add the list address to the recipient list of all the replies to > people like you. > Another thing I hate about other mailing lists. I'd rather put up with the occasional out-of-office reply than have to "reply all", "copy and paste" etc. - mailing list discussions are just that - discussions - and replies should go to the list. And don't get me started on thread hijacking! ;) ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHT.IE Tue Oct 11 20:21:43 2005 From: michele at BLACKNIGHT.IE (Michele Neylon:: Blacknight.ie) Date: Thu Jan 12 21:30:56 2006 Subject: Rants - was Re: Traffic Backup for security propose. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Alex Neuman van der Hans wrote: > And don't get me started on thread hijacking! ;) Have we had a rant about email etiquette, top posting etc., recently? :) /me runs -- Mr Michele Neylon Blacknight Solutions Quality Business Hosting & Colocation http://www.blacknight.ie/ Tel. 1850 927 280 Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 59 9164239 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Tue Oct 11 20:23:53 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:30:56 2006 Subject: Rants - was Re: Traffic Backup for security propose. Message-ID: On 11 Oct 2005, at 20:21, Michele Neylon:: Blacknight.ie wrote: > Alex Neuman van der Hans wrote: > > >> And don't get me started on thread hijacking! ;) >> > > Have we had a rant about email etiquette, top posting etc., > recently? :) > > /me runs Not for a couple of weeks or at least of any quality. :-) /me runs after Michele -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHT.IE Tue Oct 11 20:29:29 2005 From: michele at BLACKNIGHT.IE (Michele Neylon:: Blacknight.ie) Date: Thu Jan 12 21:30:56 2006 Subject: Rants - was Re: Traffic Backup for security propose. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Drew Marshall wrote: > Not for a couple of weeks or at least of any quality. :-) > > /me runs after Michele > Is that a gauntlet I see before me? /me wonders if anybody else saw it -- Mr Michele Neylon Blacknight Solutions Quality Business Hosting & Colocation http://www.blacknight.ie/ Tel. 1850 927 280 Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 59 9164239 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Tue Oct 11 20:36:39 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:30:56 2006 Subject: Rants - was Re: Traffic Backup for security propose. Message-ID: On 11 Oct 2005, at 20:29, Michele Neylon:: Blacknight.ie wrote: > Drew Marshall wrote: > >> Not for a couple of weeks or at least of any quality. :-) >> >> /me runs after Michele >> >> > Is that a gauntlet I see before me? > > /me wonders if anybody else saw it A gauntlet? I like to only take challenges I have a better than half a chance of winning :-) As 'Jim' (Gym) is some one I work with as opposed to go to... On you marks... get set... GO /me runs the other way some what faster than when he was following Michele (Now red in face and sounding like a steam train) -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rob at THEHOSTMASTERS.COM Tue Oct 11 20:40:44 2005 From: rob at THEHOSTMASTERS.COM (Rob) Date: Thu Jan 12 21:30:56 2006 Subject: Exclude domain from Virus scan... Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello all.. just tried this, and it did not work.... am i missing something? In a file located in /etc/Mailscanner/rules/virus.scanning.rules FromTo: *@domain1.com no FromTo: *@domain2.com no FromTo: default yes In /etc/Mailscanner/Mailscanner.conf Changed the line Virus scanning = yes to Virus scanning = /etc/Mailscanner/rules/virus.scanning.rules All domain still get scanned for viruses... Thanks... Rob... ----- Original Message ----- From: "Chris Conn" To: Sent: Friday, September 30, 2005 4:06 PM Subject: Re: Exclude domain from Virus scan... > Rob wrote: >> Sorry for being a pain, but i did a quick search and did not find >> anything... i have a client that just called up 4pm here on a Friday, i >> close at 4:30 pm. This client wants me to exclude his domain from virus >> scanning only, but leave spam scanning , as they are developers and want >> to email each other this weekend files and stuff... >> >> Can anyone tell me what files i need to add this domain to, to have it >> excluded from virus scanning? >> >> Once again sorry for posting in haste.. i apologize... >> >> Thanks... >> >> Rob... >> > > Find this in your MailScanner.conf: > > Virus Scanning = yes > > > change it to: > > Virus Scanning = %rules-dir%/virus.scanning.rules > > and in your rules dir, make a file calle virus.scanning.rules that > contains: > > To: *@hisdomain.com no > To: *@hisdomain2.com no > To: *@hisdomain3.com no > FromOrTo: default yes > > so for every domain you don't want to virus scan, list it before the > FromOrTo line. If your customer only has one domain, your file will only > have 2 lines. > > Good luck. > > Oh, and since it is friday I would send myself a few test viruses and make > sure that you didn't fowl up anything... =) > > Chris > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cconn at ABACOM.COM Tue Oct 11 20:42:04 2005 From: cconn at ABACOM.COM (Chris Conn) Date: Thu Jan 12 21:30:56 2006 Subject: Exclude domain from Virus scan... Message-ID: [ The following text is in the "windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Did you reload your mailscanner processes after? Chris Rob wrote: > Hello all.. just tried this, and it did not work.... am i missing > something? > > In a file located in /etc/Mailscanner/rules/virus.scanning.rules > > FromTo: *@domain1.com no > FromTo: *@domain2.com no > FromTo: default yes > > > In /etc/Mailscanner/Mailscanner.conf > > Changed the line > > Virus scanning = yes > > to > > Virus scanning = /etc/Mailscanner/rules/virus.scanning.rules > > All domain still get scanned for viruses... > > Thanks... > > > > Rob... > > ----- Original Message ----- From: "Chris Conn" > To: > Sent: Friday, September 30, 2005 4:06 PM > Subject: Re: Exclude domain from Virus scan... > > >> Rob wrote: >> >>> Sorry for being a pain, but i did a quick search and did not find >>> anything... i have a client that just called up 4pm here on a Friday, >>> i close at 4:30 pm. This client wants me to exclude his domain from >>> virus scanning only, but leave spam scanning , as they are developers >>> and want to email each other this weekend files and stuff... >>> >>> Can anyone tell me what files i need to add this domain to, to have >>> it excluded from virus scanning? >>> >>> Once again sorry for posting in haste.. i apologize... >>> >>> Thanks... >>> >>> Rob... >>> >> >> Find this in your MailScanner.conf: >> >> Virus Scanning = yes >> >> >> change it to: >> >> Virus Scanning = %rules-dir%/virus.scanning.rules >> >> and in your rules dir, make a file calle virus.scanning.rules that >> contains: >> >> To: *@hisdomain.com no >> To: *@hisdomain2.com no >> To: *@hisdomain3.com no >> FromOrTo: default yes >> >> so for every domain you don't want to virus scan, list it before the >> FromOrTo line. If your customer only has one domain, your file will >> only have 2 lines. >> >> Good luck. >> >> Oh, and since it is friday I would send myself a few test viruses and >> make sure that you didn't fowl up anything... =) >> >> Chris >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Tue Oct 11 20:41:58 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:56 2006 Subject: Errors when running --lint Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Glenn Steen wrote: >On 10/10/05, Alex Neuman wrote: > > >>>DCC and Razor are no more free, razor hasn't been so for the past 2 >>>years and dcc for about 4 months.. >>> >>>Heres what you need to do: >>>Enable the DCC / RAZOR plugins in /etc/mail/spamassassin/v310.pre if you >>>qualify for their free usage policy OR comment out the erroneous lines >>>in spam.assassin.prefs.conf if you don't qualify. >>> >>> >>Anybody care to explain why/how DCC/Razor are not free? Are they "not free >>as in beer", "not free as in speech", or some other form of "not free"? >>Thanks... >> >> >> >Excerpts from their sites >DCC: (in reverse order of appearance, for clarity) >... >The Distributed Checksum Clearinghouse source carries a license that >is free to organizations that do not sell filtering devices or >services except to their own users and that participate in the global >DCC network. (I.e. ISPs that use the DCC to filter mail for their own >users are intended to be covered in the free license.) You also can't >call it your own or blame anyone for using it. >... >Note that it has never been proper to sell the bandwidth and, most >important, human system administration work of the public DCC servers >to third parties. Sellers of products or services including the DCC >must provide DCC servers of their own or contracted from others. For >example, Commtouch operates DCC servers for its licensees. >... >Razor2: (More or less the total sum of >http://razor.sourceforge.net/docs/doc.php?type=text&name=SERVICE_POLICY) >... >Cloudmark SpamNet Service Policy > >V1.0 >Aug 1, 2003 > >SpamNet Service and Razor-Agents > >While Razor-Agents are distributed under the Artistic License and will >stay that way, the Cloudmark SpamNet service, a particular implementation >of a Razor-compliant back-end, is a commercial operation with maintenance >and support costs, and is no longer available for unlimited free use, >effective immediately. > >Use of the SpamNet service by Razor-agent-enabled software will remain >free for personal use, subject to capacity constraints that Cloudmark may >enforce against intensive users of the service as it sees fit. > >Distribution or use of the system in commercial embedded software >solutions is not free. All such access must be licensed by Cloudmark. >Organizations interested in working with Razor or with Cloudmark's >next-generation SpamNet client technologies should contact Cloudmark at >partners@cloudmark.com >... > >Just for completeness, lets add this blurb from the Pyzor website too: >... > Pyzor is a collaborative, networked system to detect and block spam >using identifying digests of messages. > >Pyzor initially started out to be merely a Python implementation of >Razor, but due to the protocol and the fact that Razor's server is not >Open Source or software libre, I decided to impelement Pyzor with a >new protocol and release the entire system as Open Source and software >libre. > >Since the entire system is released under the GPL, people are free to >host their own independent servers. Server peering is planned for a >future release. >... > >So of them, we have one GPL (but suffering from .... other problems... >Well, really just the scarcity of servers:-), one "free for YOUR >users, provided you SHARE", and one "free for personal use, but not >much else". > >This is enough "freedom" that I, for one, can use them. And it is >strongly suggested that all you who provide commercial anti-spam >services should be using the commercial offering for Razor and >participate with at least a server and/or a commercial license for >DCC, AFAICS. > >-- >-- Glenn >email: glenn < dot > steen < at > gmail < dot > com >work: glenn < dot > steen < at > ap1 < dot > se > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > Ok... So unless it's for my own personal use, pyzor is the only really "free" one. I'll look into setting up a service on my servers in order to help with the load. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Tue Oct 11 20:43:25 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:56 2006 Subject: Exclude domain from Virus scan... Message-ID: [ The following text is in the "windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Rob wrote: > Hello all.. just tried this, and it did not work.... am i missing > something? > > In a file located in /etc/Mailscanner/rules/virus.scanning.rules > > FromTo: *@domain1.com no > FromTo: *@domain2.com no > FromTo: default yes It's From:, To:, or FromOrTo: - not FromTo: ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Tue Oct 11 20:44:26 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:30:56 2006 Subject: Exclude domain from Virus scan... Message-ID: On 11 Oct 2005, at 20:40, Rob wrote: > Hello all.. just tried this, and it did not work.... am i missing > something? Yup :-) > > In a file located in /etc/Mailscanner/rules/virus.scanning.rules > > FromTo: *@domain1.com no > FromTo: *@domain2.com no > FromTo: default yes I think this should be FromOrTo: *@domain.tld no etc > > > In /etc/Mailscanner/Mailscanner.conf > > Changed the line > > Virus scanning = yes > > to > > Virus scanning = /etc/Mailscanner/rules/virus.scanning.rules > > All domain still get scanned for viruses... Don't forget to restart MailScanner Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike.patchen at GMAIL.COM Tue Oct 11 20:51:34 2005 From: mike.patchen at GMAIL.COM (Mike Patchen) Date: Thu Jan 12 21:30:56 2006 Subject: Messages not getting scanned Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Yes, mqueue and mqueue.in. Major brain fart there, sorry. Sometimes the fingers work independently from the brain when writing email. On 10/11/05, Julian Field wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > > Mike Patchen wrote: > > >Yes, I am running Linux - RedHat 8. Guess I am a bit confused on not > >having sendmail running, do I not need this to accept incoming mail > >and place it in MailScanner's queue? > > > The MailScanner startup script will also start the sendmail processes it > needs in the correct way. You don't want to start up sendmail > independently as well, that will bypass MailScanner. > > > I have my sendmail setup as per > >the instructions on the web site, it saves incoming messages to > >mailq.in, MailScanner processes them and places them back into mailq. > >A separate sendmail process then handles final delivery of the > >message. This appears to be working perfectly fine. > > > > > I hope you mean mqueue and not mailq.... > > >Mike > > > >On 10/11/05, Julian Field wrote: > > > > > >>-----BEGIN PGP SIGNED MESSAGE----- > >>Hash: SHA1 > >> > >>Are you running Linux? > >>Please check you have *not* got the sendmail service running, and not > >>starting on reboot. Do this lot: > >>service MailScanner stop > >>service sendmail stop > >>Check you have no sendmail processes running at all > >>Check you have no MailScanner processes running at all > >>chkconfig sendmail off > >>chkconfig --level 2345 MailScanner on > >>service MailScanner start > >> > >>and see if that helps at all. > >> > >>Also, make sure you haven't got any webmin/cpanel/whatever software > >>running that may be trying to restart sendmail. > >> > >>Mike Patchen wrote: > >> > >> > >> > >>>Hello, > >>> > >>>I am having a slight problem with Mailscanner in that occasionally > >>>messages do not get scanned at all. Running Mailscanner version > >>>4.44.6, sendmail 8.12.8 (I know, I need to update that). Problem only > >>>occurs a couple of time a day out of about 4,000 emails/day. Of > >>>course, all the ones that I catch are spam/virus that should have been > >>>caught in Mailscanner, but were completely missed. On all of these > >>>messages, there is no header information to suggest that it was even > >>>scanned, and the logs show no scanning to have occurred. > >>> > >>>Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: > >>>from=<{sender@domain.org}>, size=2102, class=0, nrcpts=3, > >>>msgid=<46951E64.855A1E7@{domain.org}>, proto=ESMTP, daemon=MTA, > >>>relay={relay} [{x.x.x.x}] > >>>Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: > >>>to=<{user1@mydomain.com}>, delay=00:00:00, mailer=smtp, pri=92102, > >>>stat=queued > >>>Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: > >>>to=<{user2@mydomain.com}>, delay=00:00:00, mailer=smtp, pri=92102, > >>>stat=queued > >>>Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: > >>>to=<{user3@mydomain.com}>, delay=00:00:00, mailer=smtp, pri=92102, > >>>stat=queued > >>>Oct 11 11:37:04 mail sendmail[20449]: j9BGb2KV020448: > >>>to=<{user3@mydomain.com}>,<{user2@mydomain.com}>,<{user1@mydomain.com}>, > >>>delay=00:00:02, xdelay=00:00:00, mailer=smtp, pri=182102, > >>>relay=[{internal mail server}] [x.x.x.x], dsn=2.0.0, stat=Sent > >>>(Requested mail action okay, completed) > >>> > >>>Sometimes there will be multiple recipients, sometimes just one. I > >>>have verified that there are no specific rules for any of the > >>>individual users, or the relay servers. I'm not even sure if this is > >>>a Mailscanner issue or a sendmail issue at this point. With the > >>>exception of these few messages, everything is working just as > >>>expected. > >>> > >>>Thanks in advance for any help! > >>> > >>>------------------------ MailScanner list ------------------------ > >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>'leave mailscanner' in the body of the email. > >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>> > >>>Support MailScanner development - buy the book off the website! > >>> > >>> > >>> > >>> > >>- -- > >>Julian Field > >>www.MailScanner.info > >>Buy the MailScanner book at www.MailScanner.info/store > >>Professional Support Services at www.MailScanner.biz > >>MailScanner thanks transtec Computers for their support > >> > >>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >> > >> > >>-----BEGIN PGP SIGNATURE----- > >>Version: PGP Desktop 9.0.2 (Build 2424) > >> > >>iQA/AwUBQ0wAdhH2WUcUFbZUEQIcuwCg1MjyVXsv3aeiriQz2g+Ro8nhJP4AoIDx > >>trfDNRMvozg84nvii6nacIh7 > >>=fbXu > >>-----END PGP SIGNATURE----- > >> > >>-- > >>This message has been scanned for viruses and > >>dangerous content by MailScanner, and is > >>believed to be clean. > >> > >>------------------------ MailScanner list ------------------------ > >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>'leave mailscanner' in the body of the email. > >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >>Support MailScanner development - buy the book off the website! > >> > >> > >> > > > >------------------------ MailScanner list ------------------------ > >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >'leave mailscanner' in the body of the email. > >Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >Support MailScanner development - buy the book off the website! > > > > > > - -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > -----BEGIN PGP SIGNATURE----- > Version: PGP Desktop 9.0.2 (Build 2424) > > iQA/AwUBQ0wPRhH2WUcUFbZUEQIVDgCdFhjiShGvtExH2iUlka7+hdjBEhYAoP0a > wGBRvnJhx4qXG2/k3Rn4qUsF > =FIDD > -----END PGP SIGNATURE----- > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dnsadmin at 1BIGTHINK.COM Tue Oct 11 21:00:07 2005 From: dnsadmin at 1BIGTHINK.COM (dnsadmin 1bigthink.com) Date: Thu Jan 12 21:30:56 2006 Subject: Messages not getting scanned Message-ID: At 03:51 PM 10/11/2005, you wrote: >Yes, mqueue and mqueue.in. Major brain fart there, sorry. Sometimes >the fingers work independently from the brain when writing email. > >On 10/11/05, Julian Field wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA1 > > > > > > > > Mike Patchen wrote: > > > > >Yes, I am running Linux - RedHat 8. Guess I am a bit confused on not > > >having sendmail running, do I not need this to accept incoming mail > > >and place it in MailScanner's queue? > > > > > The MailScanner startup script will also start the sendmail processes it > > needs in the correct way. You don't want to start up sendmail > > independently as well, that will bypass MailScanner. > > > > > I have my sendmail setup as per > > >the instructions on the web site, it saves incoming messages to > > >mailq.in, MailScanner processes them and places them back into mailq. > > >A separate sendmail process then handles final delivery of the > > >message. This appears to be working perfectly fine. > > > > > > > > I hope you mean mqueue and not mailq.... > > > > >Mike > > > > > >On 10/11/05, Julian Field wrote: > > > > > > > > >>-----BEGIN PGP SIGNED MESSAGE----- > > >>Hash: SHA1 > > >> > > >>Are you running Linux? > > >>Please check you have *not* got the sendmail service running, and not > > >>starting on reboot. Do this lot: > > >>service MailScanner stop > > >>service sendmail stop > > >>Check you have no sendmail processes running at all > > >>Check you have no MailScanner processes running at all > > >>chkconfig sendmail off > > >>chkconfig --level 2345 MailScanner on > > >>service MailScanner start > > >> > > >>and see if that helps at all. > > >> > > >>Also, make sure you haven't got any webmin/cpanel/whatever software > > >>running that may be trying to restart sendmail. > > >> > > >>Mike Patchen wrote: > > >> > > >> > > >> > > >>>Hello, > > >>> > > >>>I am having a slight problem with Mailscanner in that occasionally > > >>>messages do not get scanned at all. Running Mailscanner version > > >>>4.44.6, sendmail 8.12.8 (I know, I need to update that). Problem only > > >>>occurs a couple of time a day out of about 4,000 emails/day. Of > > >>>course, all the ones that I catch are spam/virus that should have been > > >>>caught in Mailscanner, but were completely missed. On all of these > > >>>messages, there is no header information to suggest that it was even > > >>>scanned, and the logs show no scanning to have occurred. > > >>> > > >>>Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: > > >>>from=<{sender@domain.org}>, size=2102, class=0, nrcpts=3, > > >>>msgid=<46951E64.855A1E7@{domain.org}>, proto=ESMTP, daemon=MTA, > > >>>relay={relay} [{x.x.x.x}] > > >>>Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: > > >>>to=<{user1@mydomain.com}>, delay=00:00:00, mailer=smtp, pri=92102, > > >>>stat=queued > > >>>Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: > > >>>to=<{user2@mydomain.com}>, delay=00:00:00, mailer=smtp, pri=92102, > > >>>stat=queued > > >>>Oct 11 11:37:02 mail sendmail[20448]: j9BGb2KV020448: > > >>>to=<{user3@mydomain.com}>, delay=00:00:00, mailer=smtp, pri=92102, > > >>>stat=queued > > >>>Oct 11 11:37:04 mail sendmail[20449]: j9BGb2KV020448: > > >>>to=<{user3@mydomain.com}>,<{user2@mydomain.com}>,<{user1@mydomain.com}>, > > >>>delay=00:00:02, xdelay=00:00:00, mailer=smtp, pri=182102, > > >>>relay=[{internal mail server}] [x.x.x.x], dsn=2.0.0, stat=Sent > > >>>(Requested mail action okay, completed) > > >>> > > >>>Sometimes there will be multiple recipients, sometimes just one. I > > >>>have verified that there are no specific rules for any of the > > >>>individual users, or the relay servers. I'm not even sure if this is > > >>>a Mailscanner issue or a sendmail issue at this point. With the > > >>>exception of these few messages, everything is working just as > > >>>expected. > > >>> > > >>>Thanks in advance for any help! > > >>> Try 'chkconfig --list Mailscanner' and 'chkconfig --list sendmail' from the command line to see if you are starting up the two processes indepently. Cheers! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dyioulos at FIRSTBHPH.COM Tue Oct 11 21:02:26 2005 From: dyioulos at FIRSTBHPH.COM (Dimitri Yioulos) Date: Thu Jan 12 21:30:56 2006 Subject: Errors when running --lint Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Tuesday October 11 2005 3:41 pm, Alex Neuman van der Hans wrote: > Glenn Steen wrote: > >On 10/10/05, Alex Neuman wrote: > >>>DCC and Razor are no more free, razor hasn't been so for the past 2 > >>>years and dcc for about 4 months.. > >>> > >>>Heres what you need to do: > >>>Enable the DCC / RAZOR plugins in /etc/mail/spamassassin/v310.pre if you > >>>qualify for their free usage policy OR comment out the erroneous lines > >>>in spam.assassin.prefs.conf if you don't qualify. > >> > >>Anybody care to explain why/how DCC/Razor are not free? Are they "not > >> free as in beer", "not free as in speech", or some other form of "not > >> free"? Thanks... > > > >Excerpts from their sites > >DCC: (in reverse order of appearance, for clarity) > >... > >The Distributed Checksum Clearinghouse source carries a license that > >is free to organizations that do not sell filtering devices or > >services except to their own users and that participate in the global > >DCC network. (I.e. ISPs that use the DCC to filter mail for their own > >users are intended to be covered in the free license.) You also can't > >call it your own or blame anyone for using it. > >... > >Note that it has never been proper to sell the bandwidth and, most > >important, human system administration work of the public DCC servers > >to third parties. Sellers of products or services including the DCC > >must provide DCC servers of their own or contracted from others. For > >example, Commtouch operates DCC servers for its licensees. > >... > >Razor2: (More or less the total sum of > >http://razor.sourceforge.net/docs/doc.php?type=text&name=SERVICE_POLICY) > >... > >Cloudmark SpamNet Service Policy > > > >V1.0 > >Aug 1, 2003 > > > >SpamNet Service and Razor-Agents > > > >While Razor-Agents are distributed under the Artistic License and will > >stay that way, the Cloudmark SpamNet service, a particular implementation > >of a Razor-compliant back-end, is a commercial operation with maintenance > >and support costs, and is no longer available for unlimited free use, > >effective immediately. > > > >Use of the SpamNet service by Razor-agent-enabled software will remain > >free for personal use, subject to capacity constraints that Cloudmark may > >enforce against intensive users of the service as it sees fit. > > > >Distribution or use of the system in commercial embedded software > >solutions is not free. All such access must be licensed by Cloudmark. > >Organizations interested in working with Razor or with Cloudmark's > >next-generation SpamNet client technologies should contact Cloudmark at > >partners@cloudmark.com > >... > > > >Just for completeness, lets add this blurb from the Pyzor website too: > >... > > Pyzor is a collaborative, networked system to detect and block spam > >using identifying digests of messages. > > > >Pyzor initially started out to be merely a Python implementation of > >Razor, but due to the protocol and the fact that Razor's server is not > >Open Source or software libre, I decided to impelement Pyzor with a > >new protocol and release the entire system as Open Source and software > >libre. > > > >Since the entire system is released under the GPL, people are free to > >host their own independent servers. Server peering is planned for a > >future release. > >... > > > >So of them, we have one GPL (but suffering from .... other problems... > >Well, really just the scarcity of servers:-), one "free for YOUR > >users, provided you SHARE", and one "free for personal use, but not > >much else". > > > >This is enough "freedom" that I, for one, can use them. And it is > >strongly suggested that all you who provide commercial anti-spam > >services should be using the commercial offering for Razor and > >participate with at least a server and/or a commercial license for > >DCC, AFAICS. > > > >-- > >-- Glenn > >email: glenn < dot > steen < at > gmail < dot > com > >work: glenn < dot > steen < at > ap1 < dot > se > > > >------------------------ MailScanner list ------------------------ > >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >'leave mailscanner' in the body of the email. > >Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >Support MailScanner development - buy the book off the website! > > Ok... So unless it's for my own personal use, pyzor is the only really > "free" one. I'll look into setting up a service on my servers in order > to help with the load. > Not so. Razor is available as long as it's not part of a solution that a fee is chared for. So, even in a business environment, as long as no fee is being charged for Razor, it can legally be used. This is as per vipul; it was posted here earlier. Not sure about DCC, though. Dimitri -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHT.IE Tue Oct 11 21:08:04 2005 From: michele at BLACKNIGHT.IE (Michele Neylon:: Blacknight.ie) Date: Thu Jan 12 21:30:56 2006 Subject: OT: Email Etiquette Rant Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I haven't done one of these in a while, so if I forget anything obvious please let me know: - please don't post HTML emails. They may seem appropriate for marketing but they are not appropriate for a technical mailing list. Just because your MUA can display them properly doesn't mean that mine can - please don't put in 40 line disclaimers. We aren't going to read them and as you are posting to a public mailing list they are a kind of pointless - when replying to previous emails try "snipping". There's no point in reposting several hundred lines of logs etc., to simply say two words - Subject lines serve a purpose. Please use them and DO NOT hijack threads. - Please read the MAQ/FAQ and other documentation. The most common issues have been covered many times in the past. - Wording your questions properly will help avoid getting "larted" / "flamed" Please read http://www.catb.org/~esr/faqs/smart-questions.html if you are unsure what this means. - The output of MailScanner -v is useful. - Help us help you. We cannot "guess" what you are doing or using. (see above) - Out of Office replies may serve a purpose but sending them to a mailing list is _not_ it. - If you insist on "protecting" yourself with CR whitelist the list. - please don't "top post". There may be valid reasons for doing it in some contexts, but if you're only sending a two liner do we really need an entire copy of the last message to the list? - Be patient. You may be having a rough day, but most regulars on the list work for a living too -- Mr Michele Neylon Blacknight Solutions Quality Business Hosting & Colocation http://www.blacknight.ie/ Tel. 1850 927 280 Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 59 9164239 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard.siddall at ELIRION.NET Tue Oct 11 21:17:42 2005 From: richard.siddall at ELIRION.NET (Richard Siddall) Date: Thu Jan 12 21:30:56 2006 Subject: Razor/DCC license, was: Errors when running --lint Message-ID: Dimitri Yioulos wrote: [snip] > > Not so. Razor is available as long as it's not part of a solution that a fee > is chared for. So, even in a business environment, as long as no fee is > being charged for Razor, it can legally be used. This is as per vipul; it > was posted here earlier. Not sure about DCC, though. > > Dimitri > DCC's about the same. You read the license and conclude you can't use it. You read the explanations of the license on the DCC mailing list by the person who wrote the license and conclude that you can. So, it's not clear whether you can or you can't. Probably best to run the license and the explanations past a lawyer. Regards, Richard Siddall ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jstork at pbco.ca Tue Oct 11 21:19:27 2005 From: jstork at pbco.ca (Johnny Stork) Date: Thu Jan 12 21:30:56 2006 Subject: How to accept all mail and forward to another SMTP server? Message-ID: Currently we run a mail server called Scalix (server2) and run MailScanner for outgoing mail/SMTP traffic for scanning on another server (server3). I would like to setup this SMTP gateway server running MailScanner (server3) to accep all incoming mail for our domain, and after scanning route it back to the main, internal mail server, Scalix (server2). I know I can change sendmail to be setup to accept mail for the domain (pbco.ca), after I make the MX record changes for that domain, but how can I get MailScanner/Sendmail to accept all mail for a given domain without having to create users on that server for each email account? I just want MailScanner to accept all the mail, scan, process and then route to the Scalix server, where all the accounts actually do exist? Thanks for any help in advance :) _______________________________ Johnny Stork Information & Technology Manager Provincial Blood Coordinating Office 604-806-8840 bsite! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From taz at TAZ-MANIA.COM Tue Oct 11 21:26:52 2005 From: taz at TAZ-MANIA.COM (Dennis Willson) Date: Thu Jan 12 21:30:56 2006 Subject: How to accept all mail and forward to another SMTP server? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have this exact setup. All the configuration to make mail forward to the end server is done in sendmail. You have to make an entry in the mailertable to send all email from that domain to the name of the other server. Be sure that your sendmail.cf has the mailertable feature enabled and be sure to run makemap on the mailertable file to get the appropriate db file. Johnny Stork wrote: > Currently we run a mail server called Scalix (server2) and run MailScanner for outgoing mail/SMTP traffic for scanning on another server (server3). I would like to setup this SMTP gateway server running MailScanner (server3) to accep all incoming mail for our domain, and after scanning route it back to the main, internal mail server, Scalix (server2). > > I know I can change sendmail to be setup to accept mail for the domain (pbco.ca), after I make the MX record changes for that domain, but how can I get MailScanner/Sendmail to accept all mail for a given domain without having to create users on that server for each email account? I just want MailScanner to accept all the mail, scan, process and then route to the Scalix server, where all the accounts actually do exist? > > Thanks for any help in advance :) > _______________________________ > Johnny Stork > Information & Technology Manager > Provincial Blood Coordinating Office > 604-806-8840 > > > bsite! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHT.IE Tue Oct 11 21:30:28 2005 From: michele at BLACKNIGHT.IE (Michele Neylon:: Blacknight.ie) Date: Thu Jan 12 21:30:56 2006 Subject: How to accept all mail and forward to another SMTP server? Message-ID: If the gateway server is running sendmail simply add the following into the mailertable (usually in /etc/mail/mailertable ): domain.tld esmtp:[destination] The square brackets are required Destination can be an IP address or hostname Sendmail will check the mailertable and see that it is set to accept mail for the domain, mailscanner will filter it and send on the "clean" mail to the destination HTH Michele Mr Michele Neylon Blacknight Solutions Quality Business Hosting & Colocation http://www.blacknight.ie/ Tel. 1850 927 280 Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 59 9164239 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike.patchen at GMAIL.COM Tue Oct 11 21:36:10 2005 From: mike.patchen at GMAIL.COM (Mike Patchen) Date: Thu Jan 12 21:30:56 2006 Subject: Messages not getting scanned Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 10/11/05, dnsadmin 1bigthink.com wrote: > > Try 'chkconfig --list Mailscanner' and 'chkconfig --list sendmail' > from the command line to see if you are starting up the two processes > indepently. > Confirmed: sendmail 0:off 1:off 2:on 3:on 4:on 5:on 6:off Mailscanner 0:off 1:off 2:on 3:on 4:on 5:on 6:off ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rob at THEHOSTMASTERS.COM Tue Oct 11 21:44:16 2005 From: rob at THEHOSTMASTERS.COM (Rob) Date: Thu Jan 12 21:30:56 2006 Subject: Exclude domain from Virus scan... Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] It is now FromOrTo: and i have restarted mail scanner and it still removes .exe files that got through... unless this is another issue?? they need to transfer .exe files back and forth, would this be another modification rather than just turning off virus scanning for the domain in question? Sorry if i did not mention this before... Rob... ----- Original Message ----- From: "Alex Neuman van der Hans" To: Sent: Tuesday, October 11, 2005 3:43 PM Subject: Re: Exclude domain from Virus scan... > Rob wrote: > >> Hello all.. just tried this, and it did not work.... am i missing >> something? >> >> In a file located in /etc/Mailscanner/rules/virus.scanning.rules >> >> FromTo: *@domain1.com no >> FromTo: *@domain2.com no >> FromTo: default yes > > It's From:, To:, or FromOrTo: - not FromTo: > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Tue Oct 11 21:37:29 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:56 2006 Subject: OT - Which greylist milter Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] James Gray wrote: > On Wednesday 05 October 2005 09:02, Scott Silva wrote: >> Just getting a feel at which greylist solutions are used by the esteemed >> recipients of this list. >> Especially interested in sendmail milters. > > We use milter-greylist on both our sendmail gateways (one FreeBSD, the other > is CentOS). Compiled the latest version from source so we can use extended > regex in our configuration files. The results have been good: > Spam reduction: ~30-50% > Virus reduction: ~15-20% > (compared to total spam/viruses before the greylist, ie, not a %-age of total > mail volume). As always, the biggest bonus is that all this happens at the > MTA level saving MailScanner the hassle. > > The biggest problems we've had stem from the assumption amongst users that > e-mail is actually some sort of instant-messaging. If a message didn't > arrive within X-seconds, they would log a help desk call! Despite much > education and assurance that once the mail (sender+recipient+originating SMTP > host tuple) had been "learned" there would be no further delays as long as > the sender sent you mail at least once a month (our autolearned-whitelist > forgets unused entries older than 30 days). > > Our solution was simply to not greylist mail from key clients' domains[1] and > to manually whitelist a few internal mail accounts (mostly sales people). > Beyond that, we simply ignored most cries for help from the user population > until after a week-or-so to give the greylist a chance to "learn" the mail > patterns. Surprisingly, this worked - after a week, the flood of "my e-mail > hasn't arrived" messages dried up. :) I've read somewhere that you could put greylisting in 'learn' mode. Woudln't that have helped? -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From taz at TAZ-MANIA.COM Tue Oct 11 21:57:32 2005 From: taz at TAZ-MANIA.COM (Dennis Willson) Date: Thu Jan 12 21:30:56 2006 Subject: Exclude domain from Virus scan... Message-ID: [ The following text is in the "windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Try this section in the MailScanner.conf. Notice it says it will accept or reject regardless if it's infected. I have my users put their .exe files within zips. # # Attachment Filename Checking # ---------------------------- # # Set where to find the attachment filename ruleset. # The structure of this file is explained elsewhere, but it is used to # accept or reject file attachments based on their name, regardless of # whether they are infected or not. # # This can also point to a ruleset, but the ruleset filename must end in # ".rules" so that MailScanner can determine if the filename given is # a ruleset or not! Filename Rules = %etc-dir%/filename.rules.conf # Set where to find the attachment filetype ruleset. # The structure of this file is explained elsewhere, but it is used to # accept or reject file attachments based on their content as determined # by the "file" command, regardless of whether they are infected or not. # # This can also point to a ruleset, but the ruleset filename must end in # ".rules" so that MailScanner can determine if the filename given is # a ruleset or not! # # To disable this feature, set this to just "Filetype Rules =" or set # the location of the file command to a blank string. Filetype Rules = %etc-dir%/filetype.rules.conf Rob wrote: > It is now FromOrTo: and i have restarted mail scanner and it still > removes .exe files that got through... unless this is another issue?? > they need to transfer .exe files back and forth, would this be another > modification rather than just turning off virus scanning for the domain > in question? > > Sorry if i did not mention this before... > > > > Rob... > > ----- Original Message ----- From: "Alex Neuman van der Hans" > > To: > Sent: Tuesday, October 11, 2005 3:43 PM > Subject: Re: Exclude domain from Virus scan... > > >> Rob wrote: >> >>> Hello all.. just tried this, and it did not work.... am i missing >>> something? >>> >>> In a file located in /etc/Mailscanner/rules/virus.scanning.rules >>> >>> FromTo: *@domain1.com no >>> FromTo: *@domain2.com no >>> FromTo: default yes >> >> >> It's From:, To:, or FromOrTo: - not FromTo: >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Tue Oct 11 21:59:19 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:30:56 2006 Subject: Exclude domain from Virus scan... Message-ID: On 11 Oct 2005, at 21:44, Rob wrote: > It is now FromOrTo: and i have restarted mail scanner and it still > removes .exe files that got through... unless this is another > issue?? they need to transfer .exe files back and forth, would this > be another modification rather than just turning off virus scanning > for the domain in question? > > Sorry if i did not mention this before... Yes this is another issue. Allowing (Or stopping) virus scanning will make no difference. You need to look at the file name/ type conf files (Search your MailScanner.conf for filename.rules.conf and filetypes.rules.conf for some details) also search the mailling list as this can be set up on a 'cascading' basis which Julian explained far better than I can :-) You might also have a look in the wiki. Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From SJCJonker at SJC.NL Tue Oct 11 22:08:57 2005 From: SJCJonker at SJC.NL (Stijn Jonker) Date: Thu Jan 12 21:30:56 2006 Subject: Messages not getting scanned Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mike, Mike Patchen said the following on 11/10/2005 22:36: > On 10/11/05, dnsadmin 1bigthink.com wrote: > >>Try 'chkconfig --list Mailscanner' and 'chkconfig --list sendmail' >>from the command line to see if you are starting up the two processes >>indepently. >> > Confirmed: > sendmail 0:off 1:off 2:on 3:on 4:on 5:on 6:off > Mailscanner 0:off 1:off 2:on 3:on 4:on 5:on 6:off As julian said, the sendmail process is started by mailscanner, the follwing commands should fix your problem chkconfig sendmail off /etc/init.d/sendmail stop /etc/init.d/Mailscanner stop sleep 10 /etc/init.d/Mailscanner start (And i like this one:) chmod 0000 /etc/init.d/sendmail Just to be sure. Stijn -- Met Vriendelijke groet/Yours Sincerely Stijn Jonker ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dyioulos at FIRSTBHPH.COM Tue Oct 11 22:37:25 2005 From: dyioulos at FIRSTBHPH.COM (Dimitri Yioulos) Date: Thu Jan 12 21:30:56 2006 Subject: Passworded zip files denied Message-ID: Hello to all. Recently, I had occasion to receive an email with a password-protected zip file attached. MailScanner wouldn't let that piece of mail through. I looked in filename.rules.conf and filetype.rules.conf, but couldn't see any (obvious) rule which was casing this to happen. Can anyone tell me how to allow mail with password-protected zip files to pass unimpeded? Thanks. Dimitri -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cstone at AXINT.NET Tue Oct 11 22:43:21 2005 From: cstone at AXINT.NET (Chris Stone) Date: Thu Jan 12 21:30:56 2006 Subject: Passworded zip files denied Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tuesday 11 October 2005 03:37 pm, Dimitri Yioulos wrote: > Recently, I had occasion to receive an email with a password-protected zip > file attached. MailScanner wouldn't let that piece of mail through. I > looked in filename.rules.conf and filetype.rules.conf, but couldn't see any > (obvious) rule which was casing this to happen. Can anyone tell me how to > allow mail with password-protected zip files to pass unimpeded? In MailScanner.conf: # Should archives which contain any password-protected files be allowed? # Leaving this set to "no" is a good way of protecting against all the # protected zip files used by viruses at the moment. # This can also be the filename of a ruleset. Allow Password-Protected Archives = yes -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFDTDH5G4PxJjbMvv0RAleIAJ9x4DhXMFeHLZ/wCCx7frFc+UKf7gCfUR9G 7aN7XlaYlP2vZlnGnEYGq4Q= =nzSp -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dyioulos at FIRSTBHPH.COM Tue Oct 11 22:55:24 2005 From: dyioulos at FIRSTBHPH.COM (Dimitri Yioulos) Date: Thu Jan 12 21:30:56 2006 Subject: Passworded zip files denied Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Arrrgh. Thanks, Chris, for your patience with a fool who didn't look closely enough. Dimitri On Tuesday October 11 2005 5:43 pm, Chris Stone wrote: > On Tuesday 11 October 2005 03:37 pm, Dimitri Yioulos wrote: > > Recently, I had occasion to receive an email with a password-protected > > zip file attached. MailScanner wouldn't let that piece of mail through. > > I looked in filename.rules.conf and filetype.rules.conf, but couldn't see > > any (obvious) rule which was casing this to happen. Can anyone tell me > > how to allow mail with password-protected zip files to pass unimpeded? > > In MailScanner.conf: > > # Should archives which contain any password-protected files be allowed? > # Leaving this set to "no" is a good way of protecting against all the > # protected zip files used by viruses at the moment. > # This can also be the filename of a ruleset. > Allow Password-Protected Archives = yes > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From brad at BECKENHAUER.COM Tue Oct 11 23:17:26 2005 From: brad at BECKENHAUER.COM (brad@beckenhauer.com) Date: Thu Jan 12 21:30:56 2006 Subject: Exclude domain from Virus scan... Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Rob, Julian posted a great message about this back at the end of June. Martin Hepworth created a wiki page based on that email. Read it a couple of times. http://wiki.mailscanner.info/doku.php?id=documentation:configuration:rulesets:overloading Essentially, it sounds as if you're going to want to ALLOW ".exe" files only between the two specified domains. So, using the wiki as a reference: MailScanner.conf: Filename Rules = %rules-dir%/filename.rules %rules-dir%/filename.rules: To: *@domain1.tld and From: *@domain2.tld /etc/MailScanner/filename.domain1.tld.conf /etc/MailScanner/filename.rules.conf To: *@domain2.tld and From: *@domain1.tld /etc/MailScanner/filename.domain2.tld.conf /etc/MailScanner/filename.rules.conf FromOrTo: default /etc/MailScanner/filename.rules.conf /etc/MailScanner/filename.domain1.tld.conf: allow \.exe$ Windows/DOS Exe's Exe's DOS/Windows programs are dangerous in email /etc/MailScanner/filename.domain2.tld.conf: allow \.exe$ Windows/DOS Exe's Exe's DOS/Windows programs are dangerous in email Enjoy. Brad >>> Rob 10/11/2005 3:44:16 PM >>> It is now FromOrTo: and i have restarted mail scanner and it still removes .exe files that got through... unless this is another issue?? they need to transfer .exe files back and forth, would this be another modification rather than just turning off virus scanning for the domain in question? Sorry if i did not mention this before... Rob... ----- Original Message ----- From: "Alex Neuman van der Hans" To: Sent: Tuesday, October 11, 2005 3:43 PM Subject: Re: Exclude domain from Virus scan... > Rob wrote: > >> Hello all.. just tried this, and it did not work.... am i missing >> something? >> >> In a file located in /etc/Mailscanner/rules/virus.scanning.rules >> >> FromTo: *@domain1.com no >> FromTo: *@domain2.com no >> FromTo: default yes > > It's From:, To:, or FromOrTo: - not FromTo: > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jstork at pbco.ca Wed Oct 12 06:10:27 2005 From: jstork at pbco.ca (Johnny Stork) Date: Thu Jan 12 21:30:56 2006 Subject: How to accept all mail and forward to another SMTP server? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I seem to be getting close, mail is getting picked up and scanned by the MailScanner server, and it is getting routed to the Scalix server (192.168.1.3) but I am getting an error and the mail is returned (myserver.mydomain.ca edited to hide the real hostname) myserver.mydomain.ca [192.168.1.3] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA I tried adding the Mailscanner server into the accepted relay list but still the same message? ----- Original Message ----- From: Michele Neylon:: Blacknight.ie Sent: Tue Oct 11 2005 13:38:50 GMT-0700 (Pacific Daylight Time) To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: How to accept all mail and forward to another SMTP server? If the gateway server is running sendmail simply add the following into the mailertable (usually in /etc/mail/mailertable ): domain.tld  esmtp:[destination] The square brackets are required Destination can be an IP address or hostname Sendmail will check the mailertable and see that it is set to accept mail for the domain, mailscanner will filter it and send on the "clean" mail to the destination HTH Michele Mr Michele Neylon Blacknight Solutions Quality Business Hosting & Colocation http://www.blacknight.ie/ Tel. 1850 927 280 Intl. +353 (0) 59  9183072 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 59  9164239 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Wed Oct 12 08:12:15 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:56 2006 Subject: Errors when running --lint Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 11/10/05, Dimitri Yioulos wrote: > On Tuesday October 11 2005 3:41 pm, Alex Neuman van der Hans wrote: > > Glenn Steen wrote: (snip) > > >DCC: (in reverse order of appearance, for clarity) > > >... (snip) > > >DCC network. (I.e. ISPs that use the DCC to filter mail for their own > > >users are intended to be covered in the free license.) You also can't (snip) > > Ok... So unless it's for my own personal use, pyzor is the only really > > "free" one. I'll look into setting up a service on my servers in order > > to help with the load. If "freedom to use" isn't enough, then yes. As usual, when someone is giving away the fruit of their labour with a specific recipient crowd in mind (or rather, wanting to exclude some specific types of sharks), the wording can be less than clear. I'm not sure Pyzor is able to function with a "load-balancing" set of servers ... yet. But any effort to make it a better service is commendable. > > > Not so. Razor is available as long as it's not part of a solution that a fee > is chared for. So, even in a business environment, as long as no fee is > being charged for Razor, it can legally be used. This is as per vipul; it > was posted here earlier. Not sure about DCC, though. > > Dimitri > It's all in the wording there ... "fee being charged for service"... In a "business" (like mine) that simply use it for our own end, no revenue from it, sure. I'm less clear on ISPs or others though. Might be that the intention is pretty much the same as for DCC, that benevolent ISPs (and similar) should be allowed to use it free of charge. Anyway, giving something back to these people wouldn't be a bad idea (sort of like the consensus here regarding supporting Jules), if one has the budget and thinks they've been helpful in protecting ones environment. -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Q.G.Campbell at NEWCASTLE.AC.UK Wed Oct 12 09:24:34 2005 From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell) Date: Thu Jan 12 21:30:56 2006 Subject: Beta release 4.47.1 - auto-update phishing sites list Message-ID: Julian Have been running MailScanner-4.47.1-1 on one of our production Mail Hubs without obvious problems. The "phishing.safe.sites.conf" file was updated overnight. MS installed on this RH AS4 system as usual without any problems. Quentin --- PHONE: +44 191 222 8209 Information Systems and Services (ISS), University of Newcastle, Newcastle upon Tyne, FAX: +44 191 222 8765 United Kingdom, NE1 7RU. ------------------------------------------------------------------------ Any opinion expressed above is mine. The University can get its own. >-----Original Message----- >From: MailScanner mailing list >[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field >Sent: 09 October 2005 15:54 >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Beta release 4.47.1 - auto-update phishing sites list > >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >I have just released the first beta release of 4.47. > >The main new feature here is to automatically update the >phishing.safe.sites.conf file every day. >All your local changes will be kept, so there is no need to change how >you use the file at all. > >But if you post me details of new additions to the file, I >will add them >to the master list, and they will appear in everyone's list >within a day. > >If sites are added to the master list which turn out to be >false, then I >can just add a "REMOVE site.com" line to the master file and that will >be removed from everyone's whitelist. So if you don't approve >of one of >my additions, you can add your own "REMOVE site.com" line so you don't >use my listing for that site.com. > >So it's all pretty safe, and it should be impossible to subvert it. I >personally vet every application to add a host to the list. But if I >list one I shouldn't, then it is very easy for me (or you) to >undo this >with the "REMOVE" syntax. > >I hope you all find this useful and will upgrade to the new release at >the start of November. > >In the mean time, I would be eternally grateful if you could test this >new feature for me. > >- -- >Julian Field >www.MailScanner.info >Buy the MailScanner book at www.MailScanner.info/store >Professional Support Services at www.MailScanner.biz >MailScanner thanks transtec Computers for their support > >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > >-----BEGIN PGP SIGNATURE----- >Version: PGP Desktop 9.0.2 (Build 2424) > >iQA/AwUBQ0kvCxH2WUcUFbZUEQLvGgCg1IspN/sNwIq0mFDy1UhNNU7YjucAoLag >vdiHXNMXB4W3BMpNPQ3TKrfS >=HM+x >-----END PGP SIGNATURE----- > >-- >This message has been scanned for viruses and >dangerous content by MailScanner, and is >believed to be clean. > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rob at THEHOSTMASTERS.COM Wed Oct 12 14:41:40 2005 From: rob at THEHOSTMASTERS.COM (Rob) Date: Thu Jan 12 21:30:56 2006 Subject: Exclude domain from Virus scan... Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] That did it!! thanks guys..... I really appreciate all the help... :) Rob... ----- Original Message ----- From: "brad@beckenhauer.com" To: Sent: Tuesday, October 11, 2005 6:17 PM Subject: Re: Exclude domain from Virus scan... Rob, Julian posted a great message about this back at the end of June. Martin Hepworth created a wiki page based on that email. Read it a couple of times. http://wiki.mailscanner.info/doku.php?id=documentation:configuration:rulesets:overloading Essentially, it sounds as if you're going to want to ALLOW ".exe" files only between the two specified domains. So, using the wiki as a reference: MailScanner.conf: Filename Rules = %rules-dir%/filename.rules %rules-dir%/filename.rules: To: *@domain1.tld and From: *@domain2.tld /etc/MailScanner/filename.domain1.tld.conf /etc/MailScanner/filename.rules.conf To: *@domain2.tld and From: *@domain1.tld /etc/MailScanner/filename.domain2.tld.conf /etc/MailScanner/filename.rules.conf FromOrTo: default /etc/MailScanner/filename.rules.conf /etc/MailScanner/filename.domain1.tld.conf: allow \.exe$ Windows/DOS Exe's Exe's DOS/Windows programs are dangerous in email /etc/MailScanner/filename.domain2.tld.conf: allow \.exe$ Windows/DOS Exe's Exe's DOS/Windows programs are dangerous in email Enjoy. Brad >>> Rob 10/11/2005 3:44:16 PM >>> It is now FromOrTo: and i have restarted mail scanner and it still removes .exe files that got through... unless this is another issue?? they need to transfer .exe files back and forth, would this be another modification rather than just turning off virus scanning for the domain in question? Sorry if i did not mention this before... Rob... ----- Original Message ----- From: "Alex Neuman van der Hans" To: Sent: Tuesday, October 11, 2005 3:43 PM Subject: Re: Exclude domain from Virus scan... > Rob wrote: > >> Hello all.. just tried this, and it did not work.... am i missing >> something? >> >> In a file located in /etc/Mailscanner/rules/virus.scanning.rules >> >> FromTo: *@domain1.com no >> FromTo: *@domain2.com no >> FromTo: default yes > > It's From:, To:, or FromOrTo: - not FromTo: > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at NKPANAMA.COM Wed Oct 12 15:49:06 2005 From: alex at NKPANAMA.COM (Alex Neuman van der Hans) Date: Thu Jan 12 21:30:56 2006 Subject: Traffic Backup for security propose. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Craig White wrote: >most modern mail programs have 'reply to list' so that shouldn't be such >a big problem but I agree, I sometimes forget and reply to previous >sender and not list. > >Craig > > > > Thunderbird's pretty modern and, to my knowledge, doesn't have it. I have to "reply all" then delete the poster's address. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From DCurtis at SBSCHOOLS.NET Wed Oct 12 17:13:25 2005 From: DCurtis at SBSCHOOLS.NET (David Curtis) Date: Thu Jan 12 21:30:56 2006 Subject: SQL logging and reporting. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] This is the first time I have attempted to setup mysql logging with mailscanner. I have the logging working. My question is do I have to change any thing for reporting to continue to work? Thanks in advance. ______________________________________________________________ ______________________________________________________________ This email may contain information protected under the Family Educational Rights and Privacy Act (FERPA) or the Health Insurance Portability and Accountability Act (HIPAA). If this email contains confidential and/or privileged health or student information and you are not entitled to access such information under FERPA or HIPAA, federal regulations require that you destroy this email without reviewing it and you may not forward it to anyone. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From SJCJonker at SJC.NL Wed Oct 12 22:07:25 2005 From: SJCJonker at SJC.NL (Stijn Jonker) Date: Thu Jan 12 21:30:57 2006 Subject: Messages not getting scanned Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello Mike & The list, On 12-Oct-2005 20:04, Mike Patchen wrote: > On 10/11/05, Stijn Jonker wrote: >> Mike, >> >> Mike Patchen said the following on 11/10/2005 22:36: >>> On 10/11/05, dnsadmin 1bigthink.com wrote: >>> >>>> Try 'chkconfig --list Mailscanner' and 'chkconfig --list sendmail' >>> >from the command line to see if you are starting up the two processes >>>> indepently. >>>> >>> Confirmed: >>> sendmail 0:off 1:off 2:on 3:on 4:on 5:on 6:off >>> Mailscanner 0:off 1:off 2:on 3:on 4:on 5:on 6:off >> As julian said, the sendmail process is started by mailscanner, the >> follwing commands should fix your problem >> >> chkconfig sendmail off >> /etc/init.d/sendmail stop >> /etc/init.d/Mailscanner stop >> sleep 10 >> /etc/init.d/Mailscanner start >> >> (And i like this one:) >> chmod 0000 /etc/init.d/sendmail > OK, I now know one of my problems. I had been using the tarball for > my install, and did not have the actual init.d scripts. I have > installed the init.d scripts from the rpm and modified them to match > my paths (not other modifications). I now have sendmail starting from > withing the Mailscanner script, and have confirmed that it is not > starting anywhere else (command mentioned above have been executed). > I am still seeing the problem, though :-( I'm not a 100% sure, if mail is still bypassing MailScanner it looks like something else is handling the email. To rule out other mailers, could you run: "lsof -i4tcp:25 -n -P" And provide the output? Next to this could you also provide the output of: "ps -eaf | grep -i -e sendmail \ -e mailscanner \ -e qmail \ -e exim \ -e master \ -e qmgr" Stijn -- Met Vriendelijke groet/Yours Sincerely Stijn Jonker ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From SJCJonker at SJC.NL Wed Oct 12 22:45:02 2005 From: SJCJonker at SJC.NL (Stijn Jonker) Date: Thu Jan 12 21:30:57 2006 Subject: Messages not getting scanned Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mike, First off all please leave the list in, I'm not all knowing... On 12-Oct-2005 23:20, Mike Patchen wrote: > On 10/12/05, Stijn Jonker wrote: >> Hello Mike & The list, > >> I'm not a 100% sure, if mail is still bypassing MailScanner it looks >> like something else is handling the email. To rule out other mailers, >> could you run: >> "lsof -i4tcp:25 -n -P" >> >> And provide the output? Next to this could you also provide the output of: >> "ps -eaf | grep -i -e sendmail \ >> -e mailscanner \ >> -e qmail \ >> -e exim \ >> -e master \ >> -e qmgr" >> >> Stijn >> -- >> Met Vriendelijke groet/Yours Sincerely >> Stijn Jonker >> > > Output of lsof: > [root@mail 20051012]# lsof -i4tcp:25 -n -P > COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME > sendmail 7934 root 4u IPv4 719480370 TCP *:25 (LISTEN) <> > > And the ps command: > [root@mail 20051012]# ps -eaf | grep -i -e sendmail -e mailscanner -e > qmail -e exim -e master -e qmgr <> How do you determine it's bypassing mailscanner, are you 100% sure it's not bypassing it through a secondary mailserver, firewall hole or something else? Stijn -- Met Vriendelijke groet/Yours Sincerely Stijn Jonker ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Thu Oct 13 06:59:50 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:30:57 2006 Subject: I error with SA Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, Not knowing much about SA my rulesdujure sent me this error Lint output: [5426] warn: config: warning: score set for non-existent rule RCVD_IN_RSL [5426] warn: lint: 1 issues detected, please rerun with debug enabled for more information what can I do to repair this? Thanks Guys Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Oct 13 08:58:50 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:57 2006 Subject: I error with SA Message-ID: -----BEGIN PGP SIGNED MESSAGE----- This is a rule in an old spam.assassin.prefs.conf file. Just remove the RCVD_IN_RSL line(s) from that file. On 13 Oct 2005, at 06:59, Lance Haig wrote: > Hi, > > Not knowing much about SA my rulesdujure sent me this error > > Lint output: [5426] warn: config: warning: score set for non- > existent rule RCVD_IN_RSL > [5426] warn: lint: 1 issues detected, please rerun with debug > enabled for more information > > what can I do to repair this? > > Thanks Guys > > Lance > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ04Tvfw32o+k+q+hAQFV4wgAp/JDHdoGjPUB6f3Oa/HNsYt6Tl+7Saba qRGVDY5TpaBdh1k8u/x2YnrWnUg7pGNhEXrJw5fUMIaoSRlKwQnBJIZoTbYjfpWW aQVxn59zTbMxps7gnCOpNGau+Srz6Yx31yJTAUVz46bkytg7ef0dzpp/W19nYsJ1 UgWXGAPCxwlQCa5gd5U2FwJ0X9uig0kWzwbmF4GA/YjF67JB03unb/Pu/Ib+xEpb 14mdodNaolpbSoPQipAotxZ0DQrblTb10BEj3b6LHOx88CfKCjgR40hvD09MzLws 9VV8ecPq0104u3O9rS8S6sSY0nd29F0Ma2ckrOP082lqcteBzd7vug== =WwZC -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rabellino at DI.UNITO.IT Thu Oct 13 09:15:11 2005 From: rabellino at DI.UNITO.IT (Rabellino Sergio) Date: Thu Jan 12 21:30:57 2006 Subject: Best practice Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dear list, i'm involved in a revision of the filename rules applied to my domain. Specifically the rumors were around the last rule, the "double dot deny" (MS default choice), believed too strict and unuseful if catching also exes and scripts . What is the community opinion about that rule ? Thanks. -- Dott. Mag. Sergio Rabellino Technical Staff Department of Computer Science University of Torino (Italy) http://www.di.unito.it/~rabser Tel. +39-0116706701 Fax. +39-011751603 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Thu Oct 13 09:42:09 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:57 2006 Subject: Best practice Message-ID: Hi Double file extensions still catch anough viruses etc for me before the AV people update to it useful.. This then becomes an education issue... advise people not to put dots in filesnames as many anti-virus gateways will not them through as they are a potential virus. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Rabellino Sergio > Sent: 13 October 2005 09:15 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: [MAILSCANNER] Best practice > > Dear list, > i'm involved in a revision of the filename rules applied to my domain. > Specifically the rumors were around the last rule, the "double dot deny" > (MS default choice), believed too strict and unuseful if catching also > exes and scripts . > > What is the community opinion about that rule ? > > Thanks. > > -- > Dott. Mag. Sergio Rabellino > > Technical Staff > Department of Computer Science > University of Torino (Italy) > > http://www.di.unito.it/~rabser > Tel. +39-0116706701 > Fax. +39-011751603 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rabellino at DI.UNITO.IT Thu Oct 13 10:36:12 2005 From: rabellino at DI.UNITO.IT (Rabellino Sergio) Date: Thu Jan 12 21:30:57 2006 Subject: Best practice Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Martin Hepworth wrote: >Hi > >Double file extensions still catch anough viruses etc for me before the AV >people update to it useful.. > >This then becomes an education issue... advise people not to put dots in >filesnames as many anti-virus gateways will not them through as they are a >potential virus. > >-- >Martin Hepworth >Snr Systems Administrator >Solid State Logic >Tel: +44 (0)1865 842300 > > > Ho do you feel about mycode.c.old or mydocs.tar.gz, or mydata.20051009.txt ??? It's hard tell anyone that he can't send a project in development to someone else because there are double dotted filenames, without concerning the real content. This was the start point for our discussion, then my doubt on that rule. Could be a 'better performance' rule, but there are real attacks catched ONLY by that rule ? For now i've not found any attacks singularly catched by the double-dot rule, but... -- Dott. Mag. Sergio Rabellino Technical Staff Department of Computer Science University of Torino (Italy) http://www.di.unito.it/~rabser Tel. +39-0116706701 Fax. +39-011751603 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard.gray at DNS.CO.UK Thu Oct 13 10:59:43 2005 From: richard.gray at DNS.CO.UK (Gray, Richard) Date: Thu Jan 12 21:30:57 2006 Subject: Best practice Message-ID: > This was the start point for our discussion, then my doubt on > that rule. > Could be a 'better performance' rule, but there are real > attacks catched ONLY by that rule ? > Its Defence In Depth. You're right that their nearly always caught by something else (a lot of ours are stopped by spam filters and RBLs) but there is always a possibility that one will slip through, however remote the chance may be. Its like all these defences, you have to weigh up whats more important, and make a decision based on that. If you are getting major grief for double dot viruses, then IMHO you're probably safe to take them out. You could mitigate the risk by using a heuristic virus scanner. This might increase the number of FPs that you get, but lowers the risk of a double dotted 0-day virus coming in. Your choice really. R ________________________________ richard gray dns ltd 83 princes street, edinburgh, eh2 2er t: +44 (0) 870 085 8555 f: +44 (0) 870 085 8556 m: +44 (0) 777 569 2145 w: http://www.dns.co.uk/ ----------------------- This email from dns has been validated by dnsMSS(TM) Managed Email Security and is free from all known viruses. For further information contact email-integrity@dns.co.uk ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From a.peacock at CHIME.UCL.AC.UK Thu Oct 13 11:53:42 2005 From: a.peacock at CHIME.UCL.AC.UK (Anthony Peacock) Date: Thu Jan 12 21:30:57 2006 Subject: Best practice Message-ID: Hi, > Hi > > Double file extensions still catch anough viruses etc for me before > the AV people update to it useful.. > > This then becomes an education issue... advise people not to put dots > in filesnames as many anti-virus gateways will not them through as > they are a potential virus. I agree that it is an education issue. I have managed to convince most of my users that email is not a file transfer medium. Yes, it is convenient to send small files as attachments to emails, but if people are regularly sending project related files to each other they should be picking a more suitable mechanism. -- Anthony Peacock CHIME, Royal Free & University College Medical School WWW: http://www.chime.ucl.ac.uk/~rmhiajp/ "In the beginning of a change, the patriot is a brave and scarce man, hated and scorned. When the cause succeeds, however, the timid join him...for then it costs nothing to be a patriot." -Mark Twain ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Thu Oct 13 13:10:58 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:30:57 2006 Subject: I error with SA Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Thanks Julian. I have just upgraded with your install package Lance Julian Field wrote: -----BEGIN PGP SIGNED MESSAGE----- This is a rule in an old spam.assassin.prefs.conf file. Just remove the RCVD_IN_RSL line(s) from that file. On 13 Oct 2005, at 06:59, Lance Haig wrote: Hi, Not knowing much about SA my rulesdujure sent me this error Lint output: [5426] warn: config: warning: score set for non- existent rule RCVD_IN_RSL [5426] warn: lint: 1 issues detected, please rerun with debug enabled for more information what can I do to repair this? Thanks Guys Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ04Tvfw32o+k+q+hAQFV4wgAp/JDHdoGjPUB6f3Oa/HNsYt6Tl+7Saba qRGVDY5TpaBdh1k8u/x2YnrWnUg7pGNhEXrJw5fUMIaoSRlKwQnBJIZoTbYjfpWW aQVxn59zTbMxps7gnCOpNGau+Srz6Yx31yJTAUVz46bkytg7ef0dzpp/W19nYsJ1 UgWXGAPCxwlQCa5gd5U2FwJ0X9uig0kWzwbmF4GA/YjF67JB03unb/Pu/Ib+xEpb 14mdodNaolpbSoPQipAotxZ0DQrblTb10BEj3b6LHOx88CfKCjgR40hvD09MzLws 9VV8ecPq0104u3O9rS8S6sSY0nd29F0Ma2ckrOP082lqcteBzd7vug== =WwZC -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Thu Oct 13 13:23:51 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:30:57 2006 Subject: I error with SA Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] What I meant was I had installed the new package and MS and then this error started so it might be in the spamassassin.conf that is in your package Lance Lance Haig wrote: Thanks Julian. I have just upgraded with your install package Lance Julian Field wrote: -----BEGIN PGP SIGNED MESSAGE----- This is a rule in an old spam.assassin.prefs.conf file. Just remove the RCVD_IN_RSL line(s) from that file. On 13 Oct 2005, at 06:59, Lance Haig wrote: Hi, Not knowing much about SA my rulesdujure sent me this error Lint output: [5426] warn: config: warning: score set for non- existent rule RCVD_IN_RSL [5426] warn: lint: 1 issues detected, please rerun with debug enabled for more information what can I do to repair this? Thanks Guys Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ04Tvfw32o+k+q+hAQFV4wgAp/JDHdoGjPUB6f3Oa/HNsYt6Tl+7Saba qRGVDY5TpaBdh1k8u/x2YnrWnUg7pGNhEXrJw5fUMIaoSRlKwQnBJIZoTbYjfpWW aQVxn59zTbMxps7gnCOpNGau+Srz6Yx31yJTAUVz46bkytg7ef0dzpp/W19nYsJ1 UgWXGAPCxwlQCa5gd5U2FwJ0X9uig0kWzwbmF4GA/YjF67JB03unb/Pu/Ib+xEpb 14mdodNaolpbSoPQipAotxZ0DQrblTb10BEj3b6LHOx88CfKCjgR40hvD09MzLws 9VV8ecPq0104u3O9rS8S6sSY0nd29F0Ma2ckrOP082lqcteBzd7vug== =WwZC -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by Red Armour MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ebruce at HPMICH.COM Thu Oct 13 13:47:11 2005 From: ebruce at HPMICH.COM (Ed Bruce) Date: Thu Jan 12 21:30:57 2006 Subject: Best practice Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Anthony Peacock wrote: > > > > I agree that it is an education issue. I have managed to convince > most of my users that email is not a file transfer medium. Yes, it > is convenient to send small files as attachments to emails, but if > people are regularly sending project related files to each other they > should be picking a more suitable mechanism. > > I'll 2nd this and add thats what ftp and scp are for. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike.patchen at GMAIL.COM Thu Oct 13 13:49:10 2005 From: mike.patchen at GMAIL.COM (Mike Patchen) Date: Thu Jan 12 21:30:57 2006 Subject: Messages not getting scanned Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 10/12/05, Stijn Jonker wrote: > Mike, > > First off all please leave the list in, I'm not all knowing... > > On 12-Oct-2005 23:20, Mike Patchen wrote: > > On 10/12/05, Stijn Jonker wrote: > >> Hello Mike & The list, > > > >> I'm not a 100% sure, if mail is still bypassing MailScanner it looks > >> like something else is handling the email. To rule out other mailers, > >> could you run: > >> "lsof -i4tcp:25 -n -P" > >> > >> And provide the output? Next to this could you also provide the output of: > >> "ps -eaf | grep -i -e sendmail \ > >> -e mailscanner \ > >> -e qmail \ > >> -e exim \ > >> -e master \ > >> -e qmgr" > >> > >> Stijn > >> -- > >> Met Vriendelijke groet/Yours Sincerely > >> Stijn Jonker > >> > > > > Output of lsof: > > [root@mail 20051012]# lsof -i4tcp:25 -n -P > > COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME > > sendmail 7934 root 4u IPv4 719480370 TCP *:25 (LISTEN) > <> > > > > And the ps command: > > [root@mail 20051012]# ps -eaf | grep -i -e sendmail -e mailscanner -e > > qmail -e exim -e master -e qmgr > <> > > How do you determine it's bypassing mailscanner, are you 100% sure it's > not bypassing it through a secondary mailserver, firewall hole or > something else? > > Stijn > > > > -- > Met Vriendelijke groet/Yours Sincerely > Stijn Jonker > Stijn, and all, Firstly, I apologize for not watching my reply address closer. You would think gmail would be smart enough to figure out how to respond to a mailing list. On to the question at hand. I have determined the bypass by watching the logs (looking for a needle in a haystack). I will see the message picked up by the sendmail deamon, dropped into the queue directory, then delivered to the destination all within a second or two. When I watch scanned messages on the same server, there is a delay of at least 5 seconds between the receipt of the message and delivery (usually a little longer, but 5 seconds was the least I have noticed). As far as some secondary mailserver, the only mta installed on this machine is sendmail. Not sure how a firewall hole would allow some messages to be scanned, but not others. And for anything else, that is why I am asking. What else can I look for? What else might be there that would be causing this? Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pete at ENITECH.COM.AU Thu Oct 13 13:55:27 2005 From: pete at ENITECH.COM.AU (Pete Russell) Date: Thu Jan 12 21:30:57 2006 Subject: LDAP script for Active Directory (also, Wiki) - my fault Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Buggar, i was hosting that. Sorry i moved web hosts and didnt move those files, i will sort it out over the weekend. Pete Steve Freegard wrote: > Hi Chris, > > On Mon, 2005-10-10 at 09:34 -0700, Chris W. Parker wrote: > >>Hello, >> >>I was just reading through >>http://wiki.mailscanner.info/doku.php?id=maq:index#using_with_exchange_d >>omino_etc and to my dismay found out that there is no link to the >>appropriate article where Exchange is concerned. >> >>However, on >>http://wiki.mailscanner.info/doku.php?id=documentation:configuration:mta >>:postfix:how_to:reject_non_existent_users#ms_exchange there is a link to >>some documentation for Postfix and Exchange that can be applied to >>sendmail too. >> >>For anyone out there that is using MailScanner as a gateway with >>sendmail in front of Exchange I would be very appreciative of a working >>script to query valid user email addresses. >> > > > If you are using Exchange 2003 - then I can thoroughly recommend > milter-ahead instead of directly querying Active Directory. > > This is a call-ahead type milter that you can implement on the gateway > which then keeps a cache of the lookups for a configurable number of > days. I prefer this as it's really easy to set-up and has no chance of > bogging down your domain controllers or slowing mail delivery if AD is > busy etc. > > See http://www.fsl.com/support/Milter-Ahead-Exchange-Settings.pdf for > details on setting this up. > > Hope this helps. > > Cheers, > Steve. > > -- > Steve Freegard > Fort Systems > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From aslan at AEON.COM.BR Thu Oct 13 14:03:22 2005 From: aslan at AEON.COM.BR (Aslan Carlos de Medeiros Ramos) Date: Thu Jan 12 21:30:57 2006 Subject: Traffic Backup for security propose. Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Sorry, That one was my first email for the list. I use Evolution it`s my favourite, but this mail aslan@aeon.com.br is my work mail and it`s necessery reply to one general email for anyone in my sector recives it. Sorry again, I disabled this options one time I`ll send email for the list. Thanks so much for all help . Aslan Carlos M. Ramos LPC 1 . LPIC 2 Linux Administrator Aeon Technologies www.aeon.com.br On Tue, 2005-10-11 at 23:31 -0700, Craig White wrote: On Tue, 2005-10-11 at 14:15 -0500, Alex Neuman van der Hans wrote: > Julian Field wrote: > > > > > And please always set your reply-to to be the mailing list (or don't > > set it at all). There is little point having a discussion in replies > > are not sent to the list. And people like me get very annoyed having > > to add the list address to the recipient list of all the replies to > > people like you. > > > Another thing I hate about other mailing lists. I'd rather put up with > the occasional out-of-office reply than have to "reply all", "copy and > paste" etc. - mailing list discussions are just that - discussions - and > replies should go to the list. ---- most modern mail programs have 'reply to list' so that shouldn't be such a big problem but I agree, I sometimes forget and reply to previous sender and not list. Craig - ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "This is a digitally signed message part" ] [ Application/PGP-SIGNATURE 492bytes. ] [ Unable to print this part. ] From rcooper at DWFORD.COM Thu Oct 13 14:03:19 2005 From: rcooper at DWFORD.COM (Rick Cooper) Date: Thu Jan 12 21:30:57 2006 Subject: Best practice Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On > Behalf Of Rabellino Sergio > Sent: Thursday, October 13, 2005 4:36 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Best practice > > > Martin Hepworth wrote: > > >Hi > > > >Double file extensions still catch anough viruses etc for me > before the AV > >people update to it useful.. > > > >This then becomes an education issue... advise people not to put dots in > >filesnames as many anti-virus gateways will not them through as > they are a > >potential virus. > > > >-- > >Martin Hepworth > >Snr Systems Administrator > >Solid State Logic > >Tel: +44 (0)1865 842300 > > > > > > > Ho do you feel about mycode.c.old or mydocs.tar.gz, or > mydata.20051009.txt ??? > > It's hard tell anyone that he can't send a project in development to > someone else because there are double dotted filenames, without concerning > the real content. > > This was the start point for our discussion, then my doubt on that rule. > Could be a 'better performance' rule, but there are real attacks > catched ONLY by that rule ? > > For now i've not found any attacks singularly catched by the double-dot > rule, but... > > -- A Lot of this is a policy issue. For instance, if you use .tar.gz files in your organization then add an allow rule above the double ext deny like allow \.tar\.gz$, same with other commonly used formats. For instance one site I handle routinely receives files from Ford Motor Company that end 5 digits and then xls so I allow \.\d{5}\.xls$. Well then I start seeing all kinds of other vendors sending reports and quotes and such with double extensions so I added the following to my filename rules # Allow XLS/DOC/PDF files that do not have an executable second extension deny (?:\.exe|\.scr|\.bat|\.com|\.vb[es]|\.cmd|\.pif|\.ws[chf])\.doc$ Attempt to Hide Bad Things With DOC Extension Attempt to Hide Bad Things With DOC Extension - NO CIGAR! deny (?:\.exe|\.scr|\.bat|\.com|\.vb[es]|\.cmd|\.pif|\.ws[chf])\.xls$ Attempt to Hide Bad Things With XLS Extension Attempt to Hide Bad Things With XLS Extension - NO CIGAR! deny (?:\.exe|\.scr|\.bat|\.com|\.vb[es]|\.cmd|\.pif|\.ws[chf])\.pdf$ Attempt to Hide Bad Things With PDF Extension Attempt to Hide Bad Things With PDF Extension - NO CIGAR! # Allow multiple extensions on .xls, .doc, .pdf files allow \.(doc|xls|pdf)$ Allow xls, doc, pdf outright Allow xls, doc, pdf outright This could, of course, be easily extended to include any final extension or all final extensions such as deny (?:\.exe|\.scr|\.bat|\.com|\.vb[es]|\.cmd|\.pif|\.ws[chf])\.[^\.]{1,}$ which would deny anything ending in a double containing the parenthetic expressions and any other extension. Could easily add more denied types to the \.exe|\.scr stuff I really don't think the original double extension problem is an issue anymore (executing by type and not name from an email) but there are still issues with extensions like somefile.xls.exe because once saved the user in a default windows configuration will see somefile.xls. Of course one way to mitigate the double extension issue somewhat is to disable hiding known file types in the windows folder views, so somefile.xls.exe doesn't appear as somefile.xls Rick -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner-user at NELAND.DK Thu Oct 13 14:40:42 2005 From: mailscanner-user at NELAND.DK (Leif Neland) Date: Thu Jan 12 21:30:57 2006 Subject: Best practice Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] From: "Rick Cooper" To: Sent: Thursday, October 13, 2005 3:03 PM Subject: Re: Best practice > > # Allow XLS/DOC/PDF files that do not have an executable second extension > deny (?:\.exe|\.scr|\.bat|\.com|\.vb[es]|\.cmd|\.pif|\.ws[chf])\.doc$ > Attempt to Hide Bad Things With DOC Extension Attempt to Hide Bad Things > With DOC Extension - NO CIGAR! > deny (?:\.exe|\.scr|\.bat|\.com|\.vb[es]|\.cmd|\.pif|\.ws[chf])\.xls$ > Attempt to Hide Bad Things With XLS Extension Attempt to Hide Bad Things > With XLS Extension - NO CIGAR! > deny (?:\.exe|\.scr|\.bat|\.com|\.vb[es]|\.cmd|\.pif|\.ws[chf])\.pdf$ > Attempt to Hide Bad Things With PDF Extension Attempt to Hide Bad Things > With PDF Extension - NO CIGAR! > Haven't you got this the other way around? There is nothing harmful with a filename.bat.doc On the other hand, filename.doc.bat might be dangerous. Leif ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Thu Oct 13 16:39:28 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:57 2006 Subject: Best practice Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Gray, Richard spake the following on 10/13/2005 2:59 AM: >>This was the start point for our discussion, then my doubt on >>that rule. >>Could be a 'better performance' rule, but there are real >>attacks catched ONLY by that rule ? >> > > > Its Defence In Depth. You're right that their nearly always caught by > something else (a lot of ours are stopped by spam filters and RBLs) but > there is always a possibility that one will slip through, however remote > the chance may be. > > Its like all these defences, you have to weigh up whats more important, > and make a decision based on that. If you are getting major grief for > double dot viruses, then IMHO you're probably safe to take them out. You > could mitigate the risk by using a heuristic virus scanner. This might > increase the number of FPs that you get, but lowers the risk of a double > dotted 0-day virus coming in. > > Your choice really. > But wouldn't blocking executables by filetype catch anything that could be executable? Even if the filename is obscured? The file command is pretty good with dos and windows executables, no matter the extension. I usually catch the newer viruses here as their signatures are written and distributed through the virus scanner channels. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From taz at TAZ-MANIA.COM Thu Oct 13 17:21:14 2005 From: taz at TAZ-MANIA.COM (Dennis Willson) Date: Thu Jan 12 21:30:57 2006 Subject: Messages not getting scanned Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Do you have any "Spam checks" rules? Mike Patchen wrote: >On 10/12/05, Stijn Jonker wrote: > > >>Mike, >> >>First off all please leave the list in, I'm not all knowing... >> >>On 12-Oct-2005 23:20, Mike Patchen wrote: >> >> >>>On 10/12/05, Stijn Jonker wrote: >>> >>> >>>>Hello Mike & The list, >>>> >>>> >>>>I'm not a 100% sure, if mail is still bypassing MailScanner it looks >>>>like something else is handling the email. To rule out other mailers, >>>>could you run: >>>>"lsof -i4tcp:25 -n -P" >>>> >>>>And provide the output? Next to this could you also provide the output of: >>>>"ps -eaf | grep -i -e sendmail \ >>>> -e mailscanner \ >>>> -e qmail \ >>>> -e exim \ >>>> -e master \ >>>> -e qmgr" >>>> >>>>Stijn >>>>-- >>>>Met Vriendelijke groet/Yours Sincerely >>>>Stijn Jonker >>>> >>>> >>>> >>>Output of lsof: >>>[root@mail 20051012]# lsof -i4tcp:25 -n -P >>>COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME >>>sendmail 7934 root 4u IPv4 719480370 TCP *:25 (LISTEN) >>> >>> >><> >> >> >>>And the ps command: >>>[root@mail 20051012]# ps -eaf | grep -i -e sendmail -e mailscanner -e >>>qmail -e exim -e master -e qmgr >>> >>> >><> >> >>How do you determine it's bypassing mailscanner, are you 100% sure it's >>not bypassing it through a secondary mailserver, firewall hole or >>something else? >> >>Stijn >> >> >> >>-- >>Met Vriendelijke groet/Yours Sincerely >>Stijn Jonker >> >> >> > >Stijn, and all, > >Firstly, I apologize for not watching my reply address closer. You >would think gmail would be smart enough to figure out how to respond >to a mailing list. > >On to the question at hand. I have determined the bypass by watching >the logs (looking for a needle in a haystack). I will see the message >picked up by the sendmail deamon, dropped into the queue directory, >then delivered to the destination all within a second or two. When I >watch scanned messages on the same server, there is a delay of at >least 5 seconds between the receipt of the message and delivery >(usually a little longer, but 5 seconds was the least I have noticed). > >As far as some secondary mailserver, the only mta installed on this >machine is sendmail. Not sure how a firewall hole would allow some >messages to be scanned, but not others. And for anything else, that >is why I am asking. What else can I look for? What else might be >there that would be causing this? > > >Mike > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ELIQUID.COM Thu Oct 13 17:36:23 2005 From: mailscanner at ELIQUID.COM (Wess Bechard) Date: Thu Jan 12 21:30:57 2006 Subject: Hangup on 4.46.2 when missing filename/filetype rules Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I came across this bug today and thought I would share it with all of you. While installing a new email system with MailScanner 4.46.2 and Postfix 2.1.5, I came across a bug when handling missing filetype and filename configuration files for MailScanner. To make a long bug report short, commenting out the filename and filetype rules from the Mailscanner.conf, or simply configuring and using the filename and filetype checks fixes the problem. The only bug here is that MailScanner reports that it is ignoring the missing files, and then crashes and starts a mail check loop that runs forever. If you would like to read the details, please continue below. It seems that MailScanner writes warning to the log file that it is skipping the filename and filetype checks, as it cannot find the files. This warning is the proper way to handle the missing files. The problem is that after issuing a warning, MailScanner dies, and restarts. Example: Message 5FA399E80F4.8A148 from 64.12.136.13 (scomp@aol.net) to eliquid.ca is not spam, SpamAssassin (score=1.658, required 5, autolearn=disabled, FAKED_UNDISC_RECIPS 0.56, HTML_MESSAGE 0.00, MIME_HTML_MOSTLY 0.28, NO_REAL_NAME 0.18, URIBL_SBL 0.63) Oct 13 11:49:22 email MailScanner[23356]: Spam Checks completed at 8525 bytes per second Right here is where the child process has restarted... Oct 13 11:49:23 email MailScanner[23356]: Virus and Content Scanning: Starting Oct 13 11:49:30 email MailScanner[23371]: MailScanner E-Mail Virus Scanner version 4.46.2 starting... Oct 13 11:49:30 email MailScanner[23371]: Cannot open filename-rules file etc-dir%/filename.rules.conf, skipping Oct 13 11:49:30 email MailScanner[23371]: Cannot open filename-rules file etc-dir%/filetype.rules.conf, skipping Oct 13 11:49:30 email MailScanner[23371]: Read 676 hostnames from the phishing whitelist This example also shows that MailScanner has indicated that it will skip the filename/filetype rules. You would naturally assume that MailScanner should ignore anything else about these rules. Since mail was looping through spam checks and dying, I turned on Debug mode and found the problem by running check_mailscanner. Right when MailScanner starts to process the checks, right after the virus scanning, we find an error: Can't use an undefined value as an ARRAY reference at /opt/MailScanner/lib/MailScanner/Config.pm line 897. Config.pm @ Line 875: sub FilenameRulesValue { my($message) = @_; my($list,@filenamelist,$file,$listref,@totallist); # Get the list of filenames and split it $list = Value('filenamerules', $message); @filenamelist = split(" ", $list); # Now construct a list containing the concatenation of all the allow-deny # rules #print STDERR "Filename rulesets are " . join(', ', @filenamelist) . "\n"; foreach $file (@filenamelist) { if (!exists($FilenameRules{$file})) { #print STDERR "Could not find filenamerules $file, forcing a re-read.\n"; # This filename has not been seen before, so compile it now. # Skip the file if it didn't exist, error already generated. next unless $FilenameRules{$file} = ReadOneFilenameRulesFile($file); } $listref = $FilenameRules{$file}; #print STDERR "listref = $listref\n"; #print STDERR "listref = " . @{$listref} . "\n"; push @totallist, @{$listref}; <--- Error occurs here } #print STDERR "Filename rules for message are\n" . join("\n",@totallist) . # "Filename rules for message ends.\n"; return \@totallist; } Thanks folks. Make sure to visit us on irc.freenode.net #mailscanner for the live technical support community! ___________________________________________ Wess Bechard Information Technology Manager eliquidMEDIA International Inc. Visit: www.eliquid.com Office: 519.973.1930 - 1.800.561.7525 Fax: 519.253.0337 Cell: 519.791.9492 ___________________________________________ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rcooper at DWFORD.COM Thu Oct 13 18:18:10 2005 From: rcooper at DWFORD.COM (Rick Cooper) Date: Thu Jan 12 21:30:57 2006 Subject: Best practice Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On > Behalf Of Leif Neland > Sent: Thursday, October 13, 2005 8:41 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Best practice > > > From: "Rick Cooper" > To: > Sent: Thursday, October 13, 2005 3:03 PM > Subject: Re: Best practice > > > > # Allow XLS/DOC/PDF files that do not have an executable second > extension > > deny (?:\.exe|\.scr|\.bat|\.com|\.vb[es]|\.cmd|\.pif|\.ws[chf])\.doc$ > > Attempt to Hide Bad Things With DOC Extension Attempt to Hide > Bad Things > > With DOC Extension - NO CIGAR! > > deny (?:\.exe|\.scr|\.bat|\.com|\.vb[es]|\.cmd|\.pif|\.ws[chf])\.xls$ > > Attempt to Hide Bad Things With XLS Extension Attempt to Hide > Bad Things > > With XLS Extension - NO CIGAR! > > deny (?:\.exe|\.scr|\.bat|\.com|\.vb[es]|\.cmd|\.pif|\.ws[chf])\.pdf$ > > Attempt to Hide Bad Things With PDF Extension Attempt to Hide > Bad Things > > With PDF Extension - NO CIGAR! > > > Haven't you got this the other way around? > > There is nothing harmful with a filename.bat.doc > On the other hand, filename.doc.bat might be dangerous. > That has to do with an old vulnerability wherein you could place an incorrect ending suffix such as txt to an executable and it would fire off rather than use notepad because it was aware of the actual file type. I don't think it really exists anymore. The normal double filter would catch something ending some.exe later down the expressions. The only reason I even keep the above rule around is you never know what some 3d part application might do. Rick -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike.patchen at GMAIL.COM Thu Oct 13 18:37:01 2005 From: mike.patchen at GMAIL.COM (Mike Patchen) Date: Thu Jan 12 21:30:57 2006 Subject: Messages not getting scanned Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 10/13/05, Dennis Willson wrote: > Do you have any "Spam checks" rules? In Mailscanner.conf: Spam Checks = %rules-dir%/spam.check.rules spam.checks.rules: From: 127.0.0.1 no From: no FromOrTo: default yes I have the firewall address in there to keep outbound emails from being scanned, and the loopback address for obvious reasons. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Thu Oct 13 21:45:11 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:57 2006 Subject: Phishing RBL? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello all, My users would prefer not to receive emails with phishing attempts, specially the banking ones. I was wondering about URIBL_PH_SURBL and discovered I only got 3 hits this month (didn't look at previous logs). Is there some RBL more effective than this one targeted at phishing attempts? I would like to score them big enough to get the mails high scoring and deleted. Thanks! Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Thu Oct 13 21:52:37 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:57 2006 Subject: Phishing RBL? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Denis Beauchemin wrote: > Hello all, > > My users would prefer not to receive emails with phishing attempts, > specially the banking ones. > > I was wondering about URIBL_PH_SURBL and discovered I only got 3 hits > this month (didn't look at previous logs). > > Is there some RBL more effective than this one targeted at phishing > attempts? I would like to score them big enough to get the mails high > scoring and deleted. > Julian, Could the phishing net be expanded to delete/deliver/whatever phishing attempts on selected web sites? We could maintain a liste of web sites that wouldn't tolerate phishing attempts against them (our local banking sites, for example). If a phishing attempt was detected for one of those sites, the mail would be deleted/delivered/whatever. Could this be of interest to other people? Thanks again! Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Thu Oct 13 22:08:55 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:30:57 2006 Subject: Phishing RBL? Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Denis Beauchemin writes: > I was wondering about URIBL_PH_SURBL and discovered I only got 3 hits this > month (didn't look at previous logs). > > Is there some RBL more effective than this one targeted at phishing > attempts? I would like to score them big enough to get the mails high > scoring and deleted. > What do your clamav (assuming you are using it) stats for phishing mails look like? fyi, bitdefender also detects phished mails. Anyways have a look at these and see if you can use them: http://www.ahbl.org/docs/rhsbl.php http://rhs.mailpolice.com/ (this one has already merged with ph.surbl) - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Thu Oct 13 22:15:49 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:30:57 2006 Subject: Phishing RBL? Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dhawal Doshy writes: > Denis Beauchemin writes: > >> I was wondering about URIBL_PH_SURBL and discovered I only got 3 hits >> this month (didn't look at previous logs). >> >> Is there some RBL more effective than this one targeted at phishing >> attempts? I would like to score them big enough to get the mails high >> scoring and deleted. >> > > Anyways have a look at these and see if you can use them: > http://www.ahbl.org/docs/rhsbl.php > http://rhs.mailpolice.com/ (this one has already merged with ph.surbl) > One more, if you are ready to go the commercial way. (all on one line) http://news.netcraft.com/archives/2005/04/27/netcraft_phishing_site_feed_ava ilable.html i found it a bit too expensive, when last inquired. i could dig up the info if you are interested. - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard.thomas at PSYSOLUTIONS.COM Thu Oct 13 22:10:18 2005 From: richard.thomas at PSYSOLUTIONS.COM (Richard Thomas) Date: Thu Jan 12 21:30:57 2006 Subject: Best practice Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Rabellino Sergio wrote: > Ho do you feel about mycode.c.old or mydocs.tar.gz, or > mydata.20051009.txt ??? > > It's hard tell anyone that he can't send a project in development to > someone else because there are double dotted filenames, without > concerning > the real content. > > This was the start point for our discussion, then my doubt on that > rule. Could be a 'better performance' rule, but there are real > attacks catched ONLY by that rule ? > > For now i've not found any attacks singularly catched by the > double-dot rule, but... > I've been wondering about this myself. I mean sure, block report.doc.exe and hotpic.jpg.pif but is anything really gained by blocking the examples listed by the previous poster? And I mean don't just do some handwaving about "extra security", I'd like to see a real explanation of the gain and preferably a couple of examples. Rich -- MIS Department | Psychiatric Solutions Inc |Phone: +1 615 312 5787 840 Crescent Ctr Dr | |Fax: +1 615 312 5711 Suite 460 +---------------------------+---------------------- Franklin, TN 37067 |Support: helpdesk@psysolutions.com +1 615 312 5888 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard.thomas at PSYSOLUTIONS.COM Thu Oct 13 22:16:59 2005 From: richard.thomas at PSYSOLUTIONS.COM (Richard Thomas) Date: Thu Jan 12 21:30:57 2006 Subject: Best practice Message-ID: Rick Cooper wrote: >>-----Original Message----- >>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On >>Behalf Of Leif Neland >>Sent: Thursday, October 13, 2005 8:41 AM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: Best practice >> >> >>From: "Rick Cooper" >>To: >>Sent: Thursday, October 13, 2005 3:03 PM >>Subject: Re: Best practice >> >> >>># Allow XLS/DOC/PDF files that do not have an executable second >>> >>> >>extension >> >> >>>deny (?:\.exe|\.scr|\.bat|\.com|\.vb[es]|\.cmd|\.pif|\.ws[chf])\.doc$ >>>Attempt to Hide Bad Things With DOC Extension Attempt to Hide >>> >>> >>Bad Things >> >> >>>With DOC Extension - NO CIGAR! >>>deny (?:\.exe|\.scr|\.bat|\.com|\.vb[es]|\.cmd|\.pif|\.ws[chf])\.xls$ >>>Attempt to Hide Bad Things With XLS Extension Attempt to Hide >>> >>> >>Bad Things >> >> >>>With XLS Extension - NO CIGAR! >>>deny (?:\.exe|\.scr|\.bat|\.com|\.vb[es]|\.cmd|\.pif|\.ws[chf])\.pdf$ >>>Attempt to Hide Bad Things With PDF Extension Attempt to Hide >>> >>> >>Bad Things >> >> >>>With PDF Extension - NO CIGAR! >>> >>> >>> >>Haven't you got this the other way around? >> >>There is nothing harmful with a filename.bat.doc >>On the other hand, filename.doc.bat might be dangerous. >> >> >> > >That has to do with an old vulnerability wherein you could place an >incorrect ending suffix such as txt to an executable and it would fire off >rather than use notepad because it was aware of the actual file type. I >don't think it really exists anymore. The normal double filter would catch >something ending some.exe later down the expressions. > > In that case, isn't the script still incorrect since it is looking for exe, scr, bat etc in the filename when presumably that wouldn't be required and you could have a document.txt with an executable mimetype? Rich >The only reason I even keep the above rule around is you never know what >some 3d part application might do. > >Rick > > >-- >This message has been scanned for viruses and >dangerous content by MailScanner, and is >believed to be clean. > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > -- MIS Department | Psychiatric Solutions Inc |Phone: +1 615 312 5787 840 Crescent Ctr Dr | |Fax: +1 615 312 5711 Suite 460 +---------------------------+---------------------- Franklin, TN 37067 |Support: helpdesk@psysolutions.com +1 615 312 5888 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From jlmiller at MMTNETWORKS.COM.AU Fri Oct 14 01:16:55 2005 From: jlmiller at MMTNETWORKS.COM.AU (Jon Miller) Date: Thu Jan 12 21:30:57 2006 Subject: question re: spam mail Message-ID: Maybe I'm not understanding the function of this program clearly. I'm still receiving various spam mail with all types of content ranging from free vacation to viagra to see my wife crap and the like. I submit these e-mail as samples to a folder on the linux server and run a script that sa-learn reads and then delete the contents of the folder. mail:/home/jlmiller/spam# cat /root/spamlearn.sh #!/bin/bash # spamlearn.sh - enter mail name to run sa-learn -p -v /etc/spam.assassin.prefs.conf --spam /home/jlmiller/spam ls -l /home/jlmiller/spam/* >> /home/jlmiller/spammail/spamlist.txt rm /home/jlmiller/spam/*.mlm Now from what I understood from someone on the list is that this has to happen several times before SA will learn that this is considered spam, is that correct? If so why not run the same junk through several times? If I do it manually I see that sa-learn picks up on the information and learns that the submitted mail is spam. If I run it a 2nd time it states it "Learned from 0 message(s) (14 message(s) examined)". 1st run mail:/home/jlmiller/spam# sa-learn -p -v /etc/spam.assassin.prefs.conf --spam /home/jlmiller/spam Learned from 13 message(s) (14 message(s) examined). 2nd run mail:/home/jlmiller/spam# sa-learn -p -v /etc/spam.assassin.prefs.conf --spam /home/jlmiller/spam Learned from 0 message(s) (14 message(s) examined). So, if it's learned something from the 1st run why is it the same email can come through time and time again? Also in the header of some of these e-mails I can see that SA disabled itself (2nd e-mail header) or has timed out others are reporting the score in a either a negative (1st email header) or too low. Like to get some help in understanding why messages such as these are able to get through. Thanks *************** 1st email header ************************************ Received: from mail.mmtnetworks.com.au ([192.168.3.3]) by mmtnetworks.com.au; Thu, 13 Oct 2005 20:46:53 +0800 Received: from arcor.de (unknown [81.13.29.16]) by mail.mmtnetworks.com.au (Postfix) with SMTP id 6BF47150080 for ; Thu, 13 Oct 2005 20:41:15 +0800 (WST) Received: from theirs (192.168.226.107) by arcor.de (Crusher oi 4.97) with SMTP id GYCIjl-OHQvnr-qT for ; Thu, 13 Oct 2005 07:29:12 -0500 Message-ID: <000e01c5cff1$b58e5880$6be2a8c0@theirs> From: "Rajendra Birkland" To: "Olya Bachelder" Subject: Dumitru Pugliese Meids Date: Thu, 13 Oct 2005 07:29:09 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000B_01C5CFC7.CCB85080" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-mmtnet-MailScanner: Found to be clean X-mmtnet-MailScanner-SpamCheck: not spam, SpamAssassin (score=-2.018, required 2, BAYES_00, HTML_90_100, HTML_FONT_BIG, HTML_MESSAGE, MIME_QP_LONG_LINE, SARE_HTML_TD_BR) X-MailScanner-From: rajenktlbirkland@arcor.de ******** 2nd email header ********************** Received: from mail.mmtnetworks.com.au ([192.168.3.3]) by mmtnetworks.com.au; Thu, 06 Oct 2005 21:18:58 +0800 Received: from cm-85-152-224-116.telecable.es (cm-85-152-224-116.telecable.es [85.152.224.116]) by mail.mmtnetworks.com.au (Postfix) with SMTP id 0B548150073 for ; Thu, 6 Oct 2005 21:14:58 +0800 (WST) FCC: mailbox://wkcoawzpu@hotmail.com/Sent X-Identity-Key: id1 Date: Thu, 06 Oct 2005 13:00:45 -0100 From: Liliana Winters X-Accept-Language: en-us, en MIME-Version: 1.0 To: jlmiller@mmtnetworks.com.au Subject: re [9]: Content-Type: multipart/related; boundary="------------070203010308010305060004" Message-Id: <20051006131458.0B548150073@mail.mmtnetworks.com.au> X-mmtnet-MailScanner: Found to be clean X-mmtnet-MailScanner-SpamCheck: not spam, SpamAssassin (Disabled due to 20 consecutive timeouts) X-MailScanner-From: wkcoawzpu@hotmail.com This is a multi-part message in MIME format. --------------070203010308010305060004 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit

it's beautiful Oscar Powerball Cliff Notes

Atkins Diet Oprah Winfrey

--------------070203010308010305060004 Content-Type: image/gif; name="asinine.GIF" Content-Transfer-Encoding: base64 Content-ID: Content-Disposition: inline; filename="asinine.GIF" Click to view Base64 Encoded File Jon L. Miller, ASE, CNS, CLS, MCNE, CCNA Director/Sr Systems Consultant MMT Networks Pty Ltd http://www.mmtnetworks.com.au Resellers for: Sophos Anti-Virus, Novell, Cisco, Swifdsl "I don't know the key to success, but the key to failure is trying to please everybody." -Bill Cosby ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "HTML" Text/HTML 131 lines. ] [ Unable to print this part. ] From matt at CODERS.CO.UK Fri Oct 14 01:33:29 2005 From: matt at CODERS.CO.UK (Matt Hampton) Date: Thu Jan 12 21:30:57 2006 Subject: Best practice Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Scott Silva wrote: >But wouldn't blocking executables by filetype catch anything that could >be executable? Even if the filename is obscured? >The file command is pretty good with dos and windows executables, no >matter the extension. I usually catch the newer viruses here as their >signatures are written and distributed through the virus scanner channels. > > Still testing the code but I am implementing a safe filename/filetype function. If the file extension ends .pdf (with anything before it) and "file" returns that it is a PDF allow it. At the same time if something other than PDF is returned by "file" the attachment is is handled like a virus....... Once I am happy with the code I'll post it..... (otherwise engaged at the moment - my daughter was born two days ago :-) ) matt ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner-user at NELAND.DK Fri Oct 14 07:22:18 2005 From: mailscanner-user at NELAND.DK (Leif Neland) Date: Thu Jan 12 21:30:57 2006 Subject: question re: spam mail Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] ---- Original Message ---- From: "Jon Miller" To: Sent: Friday, October 14, 2005 2:16 AM Subject: question re: spam mail > Maybe I'm not understanding the function of this program clearly. > I'm still receiving various spam mail with all types of content > ranging from free vacation to viagra to see my wife crap and the > like. I submit these e-mail as samples to a folder on the linux > server and run a script that sa-learn reads and then delete the > contents of the folder. > > Now from what I understood from someone on the list is that this has > to happen several times before SA will learn that this is considered > spam, is that correct? > If so why not run the same junk through several times? If I do it > manually I see that sa-learn picks up on the information and learns > that the submitted mail is spam. If I run it a 2nd time it states it > "Learned from 0 message(s) (14 message(s) examined)". Because there is nothing new, it doesn't help running the samme messages through. You might think the messages are the same, but the spammers add spelling mistakes to make the messages different, and they often add random sentences at the bottom of the mail to confuse the bayes-filter. Viagra, vlagra vi agr a etc are different words for the filter, but you recognize the word. > So, if it's learned something from the 1st run why is it the same > email can come through time and time again? Because it is not quite the same email. > > Also in the header of some of these e-mails I can see that SA > disabled itself (2nd e-mail header) or has timed out others are > reporting the score in a either a negative (1st email header) or too > low. > X-mmtnet-MailScanner: Found to be clean > X-mmtnet-MailScanner-SpamCheck: not spam, > SpamAssassin (Disabled due to 20 consecutive timeouts) Is it an old slow machine? Try increasing the timeout, and run mailscanner in debug-mode to see where it is slow. Leif ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From anders.andersson at LTKALMAR.SE Fri Oct 14 08:28:29 2005 From: anders.andersson at LTKALMAR.SE (Anders Andersson, IT) Date: Thu Jan 12 21:30:57 2006 Subject: OT OT was Re: Best practice Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Matt Hampton > Sent: Friday, October 14, 2005 2:33 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Best practice > Once I am happy with the code I'll post it..... (otherwise > engaged at the moment - my daughter was born two days ago :-) ) > > matt > Congratulation from me and the rest of the list :) ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From matt at CODERS.CO.UK Fri Oct 14 09:04:57 2005 From: matt at CODERS.CO.UK (Matt Hampton) Date: Thu Jan 12 21:30:57 2006 Subject: question re: spam mail Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >1st run >mail:/home/jlmiller/spam# sa-learn -p -v /etc/spam.assassin.prefs.conf --spam /home/jlmiller/spam >Learned from 13 message(s) (14 message(s) examined). > > > Mailscanner doesn't use the default Spam Assassin config file - see http://wiki.mailscanner.info/doku.php?id=documentation:anti_spam:spamassassin:debug Try this command instead (assuming you have a standardish installation!) sa-learn -p -v /etc/MailScanner/spam.assassin.prefs.conf --spam /home/jlmiller/spam ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Oct 14 09:11:42 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:57 2006 Subject: question re: spam mail Message-ID: Jon Make sure you have the URI-RBL's enabled (needs Net::DNS) in the SA setup (in /etc/mail/spamassassin/*.pre) Also run a spamassassin -D --lint to see if it pops any errors....also check the SARE rules and others on www.rulesemporium.com for lots of nice extras ontop of the default SA ones. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Jon Miller > Sent: 14 October 2005 01:17 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: [MAILSCANNER] question re: spam mail > > Maybe I'm not understanding the function of this program clearly. I'm > still receiving various spam mail with all types of content ranging from > free vacation to viagra to see my wife crap and the like. I submit these > e-mail as samples to a folder on the linux server and run a script that > sa-learn reads and then delete the contents of the folder. > > mail:/home/jlmiller/spam# cat /root/spamlearn.sh > #!/bin/bash > # spamlearn.sh - enter mail name to run > sa-learn -p -v /etc/spam.assassin.prefs.conf --spam /home/jlmiller/spam > ls -l /home/jlmiller/spam/* >> /home/jlmiller/spammail/spamlist.txt > rm /home/jlmiller/spam/*.mlm > > > Now from what I understood from someone on the list is that this has to > happen several times before SA will learn that this is considered spam, is > that correct? > If so why not run the same junk through several times? If I do it > manually I see that sa-learn picks up on the information and learns that > the submitted mail is spam. If I run it a 2nd time it states it "Learned > from 0 message(s) (14 message(s) examined)". > > 1st run > mail:/home/jlmiller/spam# sa-learn -p -v /etc/spam.assassin.prefs.conf -- > spam /home/jlmiller/spam > Learned from 13 message(s) (14 message(s) examined). > > > 2nd run > mail:/home/jlmiller/spam# sa-learn -p -v /etc/spam.assassin.prefs.conf -- > spam /home/jlmiller/spam > Learned from 0 message(s) (14 message(s) examined). > > > So, if it's learned something from the 1st run why is it the same email > can come through time and time again? > > Also in the header of some of these e-mails I can see that SA disabled > itself (2nd e-mail header) or has timed out others are reporting the score > in a either a negative (1st email header) or too low. > > Like to get some help in understanding why messages such as these are able > to get through. > > Thanks > > > *************** 1st email header ************************************ > Received: from mail.mmtnetworks.com.au > ([192.168.3.3]) > by mmtnetworks.com.au; Thu, 13 Oct 2005 20:46:53 +0800 > Received: from arcor.de (unknown [81.13.29.16]) > by mail.mmtnetworks.com.au (Postfix) with SMTP id 6BF47150080 > for ; Thu, 13 Oct 2005 20:41:15 +0800 (WST) > Received: from theirs (192.168.226.107) > by arcor.de (Crusher oi 4.97) with SMTP id GYCIjl-OHQvnr-qT > for ; Thu, 13 Oct 2005 07:29:12 -0500 > Message-ID: <000e01c5cff1$b58e5880$6be2a8c0@theirs> > From: "Rajendra Birkland" > To: "Olya Bachelder" > Subject: Dumitru Pugliese Meids > Date: Thu, 13 Oct 2005 07:29:09 -0500 > MIME-Version: 1.0 > Content-Type: multipart/alternative; > boundary="----=_NextPart_000_000B_01C5CFC7.CCB85080" > X-Priority: 3 > X-MSMail-Priority: Normal > X-Mailer: Microsoft Outlook Express 6.00.2800.1106 > X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 > X-mmtnet-MailScanner: Found to be clean > X-mmtnet-MailScanner-SpamCheck: not spam, SpamAssassin (score=-2.018, > required 2, BAYES_00, HTML_90_100, HTML_FONT_BIG, HTML_MESSAGE, > MIME_QP_LONG_LINE, SARE_HTML_TD_BR) > X-MailScanner-From: rajenktlbirkland@arcor.de > > > ******** 2nd email header ********************** > > Received: from mail.mmtnetworks.com.au > ([192.168.3.3]) > by mmtnetworks.com.au; Thu, 06 Oct 2005 21:18:58 +0800 > Received: from cm-85-152-224-116.telecable.es (cm-85-152-224- > 116.telecable.es [85.152.224.116]) > by mail.mmtnetworks.com.au (Postfix) with SMTP id 0B548150073 > for ; Thu, 6 Oct 2005 21:14:58 +0800 (WST) > FCC: mailbox://wkcoawzpu@hotmail.com/Sent > X-Identity-Key: id1 > Date: Thu, 06 Oct 2005 13:00:45 -0100 > From: Liliana Winters > X-Accept-Language: en-us, en > MIME-Version: 1.0 > To: jlmiller@mmtnetworks.com.au > Subject: re [9]: > Content-Type: multipart/related; > boundary="------------070203010308010305060004" > Message-Id: <20051006131458.0B548150073@mail.mmtnetworks.com.au> > X-mmtnet-MailScanner: Found to be clean > X-mmtnet-MailScanner-SpamCheck: not spam, > SpamAssassin (Disabled due to 20 consecutive timeouts) > X-MailScanner-From: wkcoawzpu@hotmail.com > > This is a multi-part message in MIME format. > --------------070203010308010305060004 > Content-Type: text/html; charset=us-ascii > Content-Transfer-Encoding: 7bit > >

SRC="cid:part1.07050508.00050507@gwnfcmat@hotmail.com" border="0" > ALT="">

it's beautiful Oscar Powerball Cliff > Notes

Atkins Diet Oprah > Winfrey

> > --------------070203010308010305060004 > Content-Type: image/gif; > name="asinine.GIF" > Content-Transfer-Encoding: base64 > Content-ID: > Content-Disposition: inline; > filename="asinine.GIF" > Click to view Base64 Encoded File > > > Jon L. Miller, ASE, CNS, CLS, MCNE, CCNA > Director/Sr Systems Consultant > MMT Networks Pty Ltd > http://www.mmtnetworks.com.au > Resellers for: Sophos Anti-Virus, Novell, Cisco, Swifdsl > > "I don't know the key to success, but the key to failure > is trying to please everybody." -Bill Cosby > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Oct 14 09:12:32 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:30:57 2006 Subject: question re: spam mail Message-ID: Oh another thing The bayes stuff isn't as effective as the URI-RBL's I find.... -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Matt Hampton > Sent: 14 October 2005 09:05 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: [MAILSCANNER] question re: spam mail > > >1st run > >mail:/home/jlmiller/spam# sa-learn -p -v /etc/spam.assassin.prefs.conf -- > spam /home/jlmiller/spam > >Learned from 13 message(s) (14 message(s) examined). > > > > > > > Mailscanner doesn't use the default Spam Assassin config file - see > > http://wiki.mailscanner.info/doku.php?id=documentation:anti_spam:spamassas > sin:debug > > Try this command instead (assuming you have a standardish installation!) > > sa-learn -p -v /etc/MailScanner/spam.assassin.prefs.conf --spam > /home/jlmiller/spam > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Oct 14 09:19:44 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:57 2006 Subject: Hangup on 4.46.2 when missing filename/filetype rules Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Many thanks for the bug report. Fixed hopefully now. It will be in the next beta. On 13 Oct 2005, at 17:36, Wess Bechard wrote: I came across this bug today and thought I would share it with all of you. While installing a new email system with MailScanner 4.46.2 and Postfix 2.1.5, I came across a bug when handling missing filetype and filename configuration files for MailScanner. To make a long bug report short, commenting out the filename and filetype rules from the Mailscanner.conf, or simply configuring and using the filename and filetype checks fixes the problem.  The only bug here is that MailScanner reports that it is ignoring the missing files, and then crashes and starts a mail check loop that runs forever. If you would like to read the details, please continue below. It seems that MailScanner writes warning to the log file that it is skipping the filename and filetype checks, as it cannot find the files.  This warning is the proper way to handle the missing files. The problem is that after issuing a warning, MailScanner dies, and restarts. Example: Message 5FA399E80F4.8A148 from 64.12.136.13 (scomp@aol.net) to eliquid.ca is not spam, SpamAssassin (score=1.658, required 5, autolearn=disabled, FAKED_UNDISC_RECIPS 0.56, HTML_MESSAGE 0.00, MIME_HTML_MOSTLY 0.28, NO_REAL_NAME 0.18, URIBL_SBL 0.63) Oct 13 11:49:22 email MailScanner[23356]: Spam Checks completed at 8525 bytes per second Right here is where the child process has restarted... Oct 13 11:49:23 email MailScanner[23356]: Virus and Content Scanning: Starting Oct 13 11:49:30 email MailScanner[23371]: MailScanner E-Mail Virus Scanner version 4.46.2 starting... Oct 13 11:49:30 email MailScanner[23371]: Cannot open filename-rules file etc-dir%/filename.rules.conf, skipping Oct 13 11:49:30 email MailScanner[23371]: Cannot open filename-rules file etc-dir%/filetype.rules.conf, skipping Oct 13 11:49:30 email MailScanner[23371]: Read 676 hostnames from the phishing whitelist This example also shows that MailScanner has indicated that it will skip the filename/filetype rules.  You would naturally assume that MailScanner should ignore anything else about these rules. Since mail was looping through spam checks and dying, I turned on Debug mode and found the problem by running check_mailscanner. Right when MailScanner starts to process the checks, right after the virus scanning, we find an error: Can't use an undefined value as an ARRAY reference at /opt/MailScanner/lib/MailScanner/Config.pm line 897. Config.pm @ Line 875: sub FilenameRulesValue {   my($message) = @_;   my($list,@filenamelist,$file,$listref,@totallist);   # Get the list of filenames and split it   $list = Value('filenamerules', $message);   @filenamelist = split(" ", $list);   # Now construct a list containing the concatenation of all the allow-deny   # rules   #print STDERR "Filename rulesets are " . join(', ', @filenamelist) . "\n";   foreach $file (@filenamelist) {     if (!exists($FilenameRules{$file})) {       #print STDERR "Could not find filenamerules $file, forcing a re-read.\n";       # This filename has not been seen before, so compile it now.       # Skip the file if it didn't exist, error already generated.       next unless $FilenameRules{$file} = ReadOneFilenameRulesFile($file);     }     $listref = $FilenameRules{$file};     #print STDERR "listref = $listref\n";     #print STDERR "listref = " . @{$listref} . "\n";     push @totallist, @{$listref};         <--- Error occurs here   }   #print STDERR "Filename rules for message are\n" . join("\n",@totallist) .   #             "Filename rules for message ends.\n";   return \@totallist; } Thanks folks. Make sure to visit us on irc.freenode.net #mailscanner for the live technical support community! ___________________________________________ Wess Bechard Information Technology Manager eliquidMEDIA International Inc. Visit: www.eliquid.com Office: 519.973.1930  -  1.800.561.7525 Fax: 519.253.0337 Cell: 519.791.9492 ___________________________________________ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! --  Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Application/PGP-SIGNATURE 498bytes. ] [ Unable to print this part. ] From MailScanner at ecs.soton.ac.uk Fri Oct 14 09:24:21 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:57 2006 Subject: Best practice Message-ID: -----BEGIN PGP SIGNED MESSAGE----- On 13 Oct 2005, at 18:18, Rick Cooper wrote: >> -----Original Message----- >> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On >> Behalf Of Leif Neland >> Sent: Thursday, October 13, 2005 8:41 AM >> To: MAILSCANNER@JISCMAIL.AC.UK >> Subject: Re: Best practice >> >> >> From: "Rick Cooper" >> To: >> Sent: Thursday, October 13, 2005 3:03 PM >> Subject: Re: Best practice >> >>> >>> # Allow XLS/DOC/PDF files that do not have an executable second >>> >> extension >> >>> deny (?:\.exe|\.scr|\.bat|\.com|\.vb[es]|\.cmd|\.pif|\.ws[chf]) >>> \.doc$ >>> Attempt to Hide Bad Things With DOC Extension Attempt to Hide >>> >> Bad Things >> >>> With DOC Extension - NO CIGAR! >>> deny (?:\.exe|\.scr|\.bat|\.com|\.vb[es]|\.cmd|\.pif|\.ws[chf]) >>> \.xls$ >>> Attempt to Hide Bad Things With XLS Extension Attempt to Hide >>> >> Bad Things >> >>> With XLS Extension - NO CIGAR! >>> deny (?:\.exe|\.scr|\.bat|\.com|\.vb[es]|\.cmd|\.pif|\.ws[chf]) >>> \.pdf$ >>> Attempt to Hide Bad Things With PDF Extension Attempt to Hide >>> >> Bad Things >> >>> With PDF Extension - NO CIGAR! >>> >>> >> Haven't you got this the other way around? >> >> There is nothing harmful with a filename.bat.doc >> On the other hand, filename.doc.bat might be dangerous. >> >> > > That has to do with an old vulnerability wherein you could place an > incorrect ending suffix such as txt to an executable and it would > fire off > rather than use notepad because it was aware of the actual file > type. I > don't think it really exists anymore. The normal double filter > would catch > something ending some.exe later down the expressions. There certainly was a vulnerability whereby if you had 3 extensions, and the 3rd one started at the 256th character in the filename then it would use the 2nd one. Something like that, but that is why I put in the "long filename" and "lots of spaces" rules. I never saw any patch which definitely said they had fixed it, so the rules have stayed. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ09rOPw32o+k+q+hAQGcxAgAniqdn+Iq0VuNb7rPR2S7xBLILpj5/zDt BCG4AS76bOovI7+UE/CFAl8BtEnMDDRUqWO8Kl3Ek7v4nAQNRhUQicDnM+415UFx ge5Ip5+djpwAOUMdsHQ9RlBx+ezny+HMdd5HY9F8yu+BCoFAjrzCU3WYJ0BDWb1L dmGG8m6z0xJEvo1jiDuGnAYsv6gHHSn87MnSwYbHOs1OnQ1NzQVmSrsDR2qY8YvY qnBEufpklfMAZjTAlKRl9ceinZxsI3/rI9GtQk/qRTvHkGEprynB2cidwRxJRAQv lXcEjc9Y8teql+iW6+VpQpi05VO2ztVGxmHBD+oBaKLcz2GHmKaqVQ== =IvjT -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Oct 14 09:31:09 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:57 2006 Subject: Best practice Message-ID: -----BEGIN PGP SIGNED MESSAGE----- On 13 Oct 2005, at 22:10, Richard Thomas wrote: > Rabellino Sergio wrote: > > >> Ho do you feel about mycode.c.old or mydocs.tar.gz, or mydata. >> 20051009.txt ??? >> >> It's hard tell anyone that he can't send a project in development >> to someone else because there are double dotted filenames, without >> concerning >> the real content. >> >> This was the start point for our discussion, then my doubt on that >> rule. Could be a 'better performance' rule, but there are real >> attacks catched ONLY by that rule ? >> >> For now i've not found any attacks singularly catched by the >> double-dot rule, but... >> >> > I've been wondering about this myself. I mean sure, block > report.doc.exe and hotpic.jpg.pif but is anything really gained by > blocking the examples listed by the previous poster? And I mean > don't just do some handwaving about "extra security", I'd like to > see a real explanation of the gain and preferably a couple of > examples. Please remember that no-one is forcing any of this on you. Don't like them? Don't use them. The default rules are the ones I felt were worth having, some based on my own experience and some based on Microsoft's own lists of such things. I wrote the double-extension trap rule as an example of what you could do with my rules system, rather than the simple extension- blockers provided with any of the commercial alternatives. It has turned out be rather useful, and I wouldn't want to be without it. But if you don't see the reason for having some/all of the rules, just delete them. This whole conversation has become a bit pointless and circular, in my opinion. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ09s0fw32o+k+q+hAQEHcQgAoCImoo4yfPb2Gd3cz/yvI6c/4w8wEqQn rcswIgo1d4qG2NLoTxy3riwlpKjAhYawUDghHBzXIaf2dWmEWpTmCfJ3Iod32tiB ki4scnYecL7e2FjUQCD/5Sl0MtckS5RgyNcvUj/sQ2TMvxuTmbcCWzEc3zph2njR g9VAYRrNGQV1uDH01VKrfGsv8VN/ACdCkpSXMo9f+wQxjW0ietY4fu7eeR6O3weJ Ls7ktA7xE+2atXr9j7qne+tEkmfLvgAE6ZJmyYcZp+l9XribhGpaGcui2hV4JuBt 7ifFcY5udsoz+RNRrkpZvC2Ig997KNziPsO5nEU4S+Rqn5r5FIThjg== =VSrE -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rabellino at DI.UNITO.IT Fri Oct 14 11:23:19 2005 From: rabellino at DI.UNITO.IT (Rabellino Sergio) Date: Thu Jan 12 21:30:57 2006 Subject: Best practice Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >On 13 Oct 2005, at 22:10, Richard Thomas wrote: > > > >>Rabellino Sergio wrote: >> >> >> >> >>>Ho do you feel about mycode.c.old or mydocs.tar.gz, or mydata. >>>20051009.txt ??? >>> >>>It's hard tell anyone that he can't send a project in development >>>to someone else because there are double dotted filenames, without >>>concerning >>>the real content. >>> >>>This was the start point for our discussion, then my doubt on that >>>rule. Could be a 'better performance' rule, but there are real >>>attacks catched ONLY by that rule ? >>> >>>For now i've not found any attacks singularly catched by the >>>double-dot rule, but... >>> >>> >>> >>> >>I've been wondering about this myself. I mean sure, block >>report.doc.exe and hotpic.jpg.pif but is anything really gained by >>blocking the examples listed by the previous poster? And I mean >>don't just do some handwaving about "extra security", I'd like to >>see a real explanation of the gain and preferably a couple of >>examples. >> >> > >Please remember that no-one is forcing any of this on you. Don't like >them? Don't use them. The default rules are the ones I felt were >worth having, some based on my own experience and some based on >Microsoft's own lists of such things. > >I wrote the double-extension trap rule as an example of what you >could do with my rules system, rather than the simple extension- >blockers provided with any of the commercial alternatives. It has >turned out be rather useful, and I wouldn't want to be without it. > >But if you don't see the reason for having some/all of the rules, >just delete them. This whole conversation has become a bit pointless >and circular, in my opinion. > > I was 'out of the window' to see all the opinions, to better understand all the various ideas around. Remember Julian that for many users your example or suggestion wired in the standard configuration,would be the best thing to do, so a careful selection must be done. Probably the double dot rule must be listed as usually, but a bit of criticism on the past choices would lead to a better comprehension of MS. Thanks to all. -- Dott. Mag. Sergio Rabellino Technical Staff Department of Computer Science University of Torino (Italy) http://www.di.unito.it/~rabser Tel. +39-0116706701 Fax. +39-011751603 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rcooper at DWFORD.COM Fri Oct 14 12:02:50 2005 From: rcooper at DWFORD.COM (Rick Cooper) Date: Thu Jan 12 21:30:57 2006 Subject: Best practice Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On > Behalf Of Julian Field > Sent: Friday, October 14, 2005 3:24 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Best practice > > > -----BEGIN PGP SIGNED MESSAGE----- > > > On 13 Oct 2005, at 18:18, Rick Cooper wrote: > > >> -----Original Message----- > >> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On > >> Behalf Of Leif Neland > >> Sent: Thursday, October 13, 2005 8:41 AM > >> To: MAILSCANNER@JISCMAIL.AC.UK > >> Subject: Re: Best practice > >> > >> > >> From: "Rick Cooper" > >> To: > >> Sent: Thursday, October 13, 2005 3:03 PM > >> Subject: Re: Best practice > >> > > That has to do with an old vulnerability wherein you could place an > > incorrect ending suffix such as txt to an executable and it would > > fire off > > rather than use notepad because it was aware of the actual file > > type. I > > don't think it really exists anymore. The normal double filter > > would catch > > something ending some.exe later down the expressions. > > There certainly was a vulnerability whereby if you had 3 extensions, > and the 3rd one started at the 256th character in the filename then > it would use the 2nd one. Something like that, but that is why I put > in the "long filename" and "lots of spaces" rules. > I never saw any patch which definitely said they had fixed it, so the > rules have stayed. > I agree with keeping them as is. As the developer you have no idea what kinds of hardware and software people are using and if someone is comfortable removing something that doesn't apply to their situation, fine. Heck I still had windows 95 based boxes in three locations until last year! They were vender supplied for a cataloging program and we had no choice about it. I think the fact that you add new checks and leave old is the *perfect* way to do it. Rick -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Fri Oct 14 13:09:12 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:57 2006 Subject: Phishing RBL? Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dhawal Doshy wrote: > Denis Beauchemin writes: > >> I was wondering about URIBL_PH_SURBL and discovered I only got 3 hits >> this month (didn't look at previous logs). >> Is there some RBL more effective than this one targeted at phishing >> attempts? I would like to score them big enough to get the mails >> high scoring and deleted. > > > What do your clamav (assuming you are using it) stats for phishing > mails look like? fyi, bitdefender also detects phished mails. > Anyways have a look at these and see if you can use them: > http://www.ahbl.org/docs/rhsbl.php > http://rhs.mailpolice.com/ (this one has already merged with ph.surbl) I don't run Clamav mainly because at one point it detected malware where I didn't see any (but it was a long time ago and I don't remember what it was about). But even if I did it wouldn't give me a pure phishing detection that could be used to make some phishing attempts get deleted. I'm investigating the Netcraft solution. Can anyone give their opinion on their RBL? Thanks! Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Fri Oct 14 14:01:41 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:57 2006 Subject: Phishing RBL? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 14/10/05, Denis Beauchemin wrote: (snip) > > I don't run Clamav mainly because at one point it detected malware where > I didn't see any (but it was a long time ago and I don't remember what > it was about). But even if I did it wouldn't give me a pure phishing > detection that could be used to make some phishing attempts get deleted. Define "pure" in this context. Sure it missed the recent "nordea" phish (swedish bank... c:a 4 million e-banking customers), but so would most any solution (well, perhaps not Jules phishing net)... But then, we're all still trying to get up off the floor from all the rolling and laughing ... The silly buggers used a translation program... Need one say more? ISTR we had a fun "autotranslation thread" a while back, detailing most of all the woes one would have with that approach. Not that I'm complaining about their infinite stupidity:-). Anyway, to my mind clamav is pretty darned close to getting most of all known phishing _and_ is a very good virus detector... So why not use it? Every AV has its flaws, so that it missed some few can't be a reason to forego it. > I'm investigating the Netcraft solution. Can anyone give their opinion > on their RBL? Haven't used, but would be very interrested to hear this too... Always interrested in possible improvements (provided one has the time to implement them:-). -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lbcadmin at GMAIL.COM Fri Oct 14 14:55:08 2005 From: lbcadmin at GMAIL.COM (Information Services) Date: Thu Jan 12 21:30:57 2006 Subject: MailWatch password (web user) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I am trying to change the password for the MailWatch web user, but am having problems in doing so. I am running CentOS 4.1 mysql-4.1.10a-2.RHEL4.1 mailwatch-1.0.1 mailscanner-4.44.1-1 phpMyAdmin-2.6.3-pl1 I have changed the password in: MailWatch.pm SQLBlackWhiteList.pm conf.php from the command line: mysql mailscanner -u (user) -p [changed the password] GRANT ALL ON mailscanner.* TO xxx@localhost IDENTIFIED BY 'password'; flush privileges; \q; Then when I try to create a MailWatch Web User, I run into this problem mysql mailscanner -u (user) -p INSERT INTO users VALUES ('xxxx',md5('password'0,'xxxx','A','0'); ERROR 1062 (23000): Duplicate entry 'xxx' for key 1 So what do I need to do in order to change the password for this user? Casey ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Fri Oct 14 15:16:34 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:57 2006 Subject: Phishing RBL? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Glenn Steen wrote: >On 14/10/05, Denis Beauchemin wrote: >(snip) > > >>I don't run Clamav mainly because at one point it detected malware where >>I didn't see any (but it was a long time ago and I don't remember what >>it was about). But even if I did it wouldn't give me a pure phishing >>detection that could be used to make some phishing attempts get deleted. >> >> > >Define "pure" in this context. Sure it missed the recent "nordea" >phish (swedish bank... c:a 4 million e-banking customers), but so >would most any solution (well, perhaps not Jules phishing net)... But >then, we're all still trying to get up off the floor from all the >rolling and laughing ... The silly buggers used a translation >program... Need one say more? ISTR we had a fun "autotranslation >thread" a while back, detailing most of all the woes one would have >with that approach. >Not that I'm complaining about their infinite stupidity:-). > >Anyway, to my mind clamav is pretty darned close to getting most of >all known phishing _and_ is a very good virus detector... So why not >use it? Every AV has its flaws, so that it missed some few can't be a >reason to forego it. > > > >>I'm investigating the Netcraft solution. Can anyone give their opinion >>on their RBL? >> >> > >Haven't used, but would be very interrested to hear this too... Always >interrested in possible improvements (provided one has the time to >implement them:-). > > > Glenn, Clam didn't miss anything. It detected something where there should be nothing. Bummer, I really can't remember what... I guess I'll give it a try. As for Netcraft, it'e being used by GoDaddy.com. This article states that they move about 1 million emails per hour: http://www.godaddy.com/gdshop/pressReleases/08_16_05_Joint_With_Netcraft_F.pdf Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Chris.Russell at KNOWLEDGEIT.CO.UK Fri Oct 14 15:26:58 2005 From: Chris.Russell at KNOWLEDGEIT.CO.UK (Chris Russell) Date: Thu Jan 12 21:30:57 2006 Subject: MailWatch password (web user) Message-ID: this is a sql query rather than another a mailscanner question, However, update users set password=md5('newpassword') where username='xxxx'; .. Assuming the username field is "username" (Check this with "describe users" from mysql) Cheers, Chris -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Information Services Sent: 14 October 2005 14:55 To: MAILSCANNER@JISCMAIL.AC.UK Subject: MailWatch password (web user) I am trying to change the password for the MailWatch web user, but am having problems in doing so. I am running CentOS 4.1 mysql-4.1.10a-2.RHEL4.1 mailwatch-1.0.1 mailscanner-4.44.1-1 phpMyAdmin-2.6.3-pl1 I have changed the password in: MailWatch.pm SQLBlackWhiteList.pm conf.php from the command line: mysql mailscanner -u (user) -p [changed the password] GRANT ALL ON mailscanner.* TO xxx@localhost IDENTIFIED BY 'password'; flush privileges; \q; Then when I try to create a MailWatch Web User, I run into this problem mysql mailscanner -u (user) -p INSERT INTO users VALUES ('xxxx',md5('password'0,'xxxx','A','0'); ERROR 1062 (23000): Duplicate entry 'xxx' for key 1 So what do I need to do in order to change the password for this user? Casey ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by the Nexent Internet Anti Virus and Spam Tagging Service and is believed to be clean. The contents of this e-mail may be privileged and are confidential. It may not be disclosed to or used by anyone other than the addressee(s), nor copied in any way. Any views or opinions presented are solely those of the author and do not necessarily represent those of Knowledge Limited. If received in error, please advise the sender, then delete it from your system. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Fri Oct 14 15:54:16 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:30:57 2006 Subject: Phishing RBL? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Denis Beauchemin wrote: >> >>> I'm investigating the Netcraft solution. Can anyone give their opinion >>> on their RBL? >> >> Haven't used, but would be very interrested to hear this too... Always >> interrested in possible improvements (provided one has the time to >> implement them:-). > > Glenn, > > Clam didn't miss anything. It detected something where there should be > nothing. Bummer, I really can't remember what... I guess I'll give it a > try. > > As for Netcraft, it'e being used by GoDaddy.com. This article states > that they move about 1 million emails per hour: > Shoot off a mail to sales at netcraft dot com, i did and got back a very detailed technical reply. From the reply "We can block arbitrary patterns, thereby coping with phishing attacks hosted on bank's sites, wildcard DNS, shared hosting systems & personalised urls". They also claim not to suffer from a geocities like problem (for instance: surbl and uribl haven't listed geocities for policy reasons, no fps) + they also take care of crosssite scripting frauds. Ask them for the commercials and see if it suits your budget. - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ELIQUID.COM Fri Oct 14 15:57:20 2005 From: mailscanner at ELIQUID.COM (Wess Bechard) Date: Thu Jan 12 21:30:57 2006 Subject: Unused File Checks Bug Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I came across this bug today and thought I would share it with all of you. While installing a new email system with MailScanner 4.46.2 and Postfix 2.1.5, I came across a bug when handling missing filetype and filename configuration files for MailScanner. To make a long bug report short, commenting out the filename and filetype rules from the Mailscanner.conf, or simply configuring and using the filename and filetype checks fixes the problem. The only bug here is that MailScanner reports that it is ignoring the missing files, and then crashes and starts a mail check loop that runs forever. If you would like to read the details, please continue below. It seems that MailScanner writes warning to the log file that it is skipping the filename and filetype checks, as it cannot find the files. This warning is the proper way to handle the missing files. The problem is that after issuing a warning, MailScanner dies, and restarts. Example: Message 5FA399E80F4.8A148 from 64.12.136.13 (scomp@aol.net) to eliquid.ca is not spam, SpamAssassin (score=1.658, required 5, autolearn=disabled, FAKED_UNDISC_RECIPS 0.56, HTML_MESSAGE 0.00, MIME_HTML_MOSTLY 0.28, NO_REAL_NAME 0.18, URIBL_SBL 0.63) Oct 13 11:49:22 email MailScanner[23356]: Spam Checks completed at 8525 bytes per second Right here is where the child process has restarted... Oct 13 11:49:23 email MailScanner[23356]: Virus and Content Scanning: Starting Oct 13 11:49:30 email MailScanner[23371]: MailScanner E-Mail Virus Scanner version 4.46.2 starting... Oct 13 11:49:30 email MailScanner[23371]: Cannot open filename-rules file etc-dir%/filename.rules.conf, skipping Oct 13 11:49:30 email MailScanner[23371]: Cannot open filename-rules file etc-dir%/filetype.rules.conf, skipping Oct 13 11:49:30 email MailScanner[23371]: Read 676 hostnames from the phishing whitelist This example also shows that MailScanner has indicated that it will skip the filename/filetype rules. You would naturally assume that MailScanner should ignore anything else about these rules. Since mail was looping through spam checks and dying, I turned on Debug mode and found the problem by running check_mailscanner. Right when MailScanner starts to process the checks, right after the virus scanning, we find an error: Can't use an undefined value as an ARRAY reference at /opt/MailScanner/lib/MailScanner/Config.pm line 897. Config.pm @ Line 875: sub FilenameRulesValue { my($message) = @_; my($list,@filenamelist,$file,$listref,@totallist); # Get the list of filenames and split it $list = Value('filenamerules', $message); @filenamelist = split(" ", $list); # Now construct a list containing the concatenation of all the allow-deny # rules #print STDERR "Filename rulesets are " . join(', ', @filenamelist) . "\n"; foreach $file (@filenamelist) { if (!exists($FilenameRules{$file})) { #print STDERR "Could not find filenamerules $file, forcing a re-read.\n"; # This filename has not been seen before, so compile it now. # Skip the file if it didn't exist, error already generated. next unless $FilenameRules{$file} = ReadOneFilenameRulesFile($file); } $listref = $FilenameRules{$file}; #print STDERR "listref = $listref\n"; #print STDERR "listref = " . @{$listref} . "\n"; push @totallist, @{$listref}; <--- Error occurs here } #print STDERR "Filename rules for message are\n" . join("\n",@totallist) . # "Filename rules for message ends.\n"; return \@totallist; } Thanks folks. Make sure to visit us on irc.freenode.net #mailscanner for the live technical support community! ___________________________________________ Wess Bechard Information Technology Manager eliquidMEDIA International Inc. Visit: www.eliquid.com Office: 519.973.1930 - 1.800.561.7525 Fax: 519.253.0337 Cell: 519.791.9492 ___________________________________________ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Oct 14 16:04:29 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:57 2006 Subject: Unused File Checks Bug Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Please see the thread entitledRe: Hangup on 4.46.2 when missing filename/filetype rules from earlier today. I will post a new beta fixing this very soon. In the mean time, you can just create a 1 line filename.rules.conf and filetype.rules.conf containing allow    .    -    - and it will allow everything. On 14 Oct 2005, at 15:57, Wess Bechard wrote: I came across this bug today and thought I would share it with all of you. While installing a new email system with MailScanner 4.46.2 and Postfix 2.1.5, I came across a bug when handling missing filetype and filename configuration files for MailScanner. To make a long bug report short, commenting out the filename and filetype rules from the Mailscanner.conf, or simply configuring and using the filename and filetype checks fixes the problem.  The only bug here is that MailScanner reports that it is ignoring the missing files, and then crashes and starts a mail check loop that runs forever. If you would like to read the details, please continue below. It seems that MailScanner writes warning to the log file that it is skipping the filename and filetype checks, as it cannot find the files.  This warning is the proper way to handle the missing files. The problem is that after issuing a warning, MailScanner dies, and restarts. Example: Message 5FA399E80F4.8A148 from 64.12.136.13 (scomp@aol.net) to eliquid.ca is not spam, SpamAssassin (score=1.658, required 5, autolearn=disabled, FAKED_UNDISC_RECIPS 0.56, HTML_MESSAGE 0.00, MIME_HTML_MOSTLY 0.28, NO_REAL_NAME 0.18, URIBL_SBL 0.63) Oct 13 11:49:22 email MailScanner[23356]: Spam Checks completed at 8525 bytes per second Right here is where the child process has restarted... Oct 13 11:49:23 email MailScanner[23356]: Virus and Content Scanning: Starting Oct 13 11:49:30 email MailScanner[23371]: MailScanner E-Mail Virus Scanner version 4.46.2 starting... Oct 13 11:49:30 email MailScanner[23371]: Cannot open filename-rules file etc-dir%/filename.rules.conf, skipping Oct 13 11:49:30 email MailScanner[23371]: Cannot open filename-rules file etc-dir%/filetype.rules.conf, skipping Oct 13 11:49:30 email MailScanner[23371]: Read 676 hostnames from the phishing whitelist This example also shows that MailScanner has indicated that it will skip the filename/filetype rules.  You would naturally assume that MailScanner should ignore anything else about these rules. Since mail was looping through spam checks and dying, I turned on Debug mode and found the problem by running check_mailscanner. Right when MailScanner starts to process the checks, right after the virus scanning, we find an error: Can't use an undefined value as an ARRAY reference at /opt/MailScanner/lib/MailScanner/Config.pm line 897. Config.pm @ Line 875: sub FilenameRulesValue {   my($message) = @_;   my($list,@filenamelist,$file,$listref,@totallist);   # Get the list of filenames and split it   $list = Value('filenamerules', $message);   @filenamelist = split(" ", $list);   # Now construct a list containing the concatenation of all the allow-deny   # rules   #print STDERR "Filename rulesets are " . join(', ', @filenamelist) . "\n";   foreach $file (@filenamelist) {     if (!exists($FilenameRules{$file})) {       #print STDERR "Could not find filenamerules $file, forcing a re-read.\n";       # This filename has not been seen before, so compile it now.       # Skip the file if it didn't exist, error already generated.       next unless $FilenameRules{$file} = ReadOneFilenameRulesFile($file);     }     $listref = $FilenameRules{$file};     #print STDERR "listref = $listref\n";     #print STDERR "listref = " . @{$listref} . "\n";     push @totallist, @{$listref};         <--- Error occurs here   }   #print STDERR "Filename rules for message are\n" . join("\n",@totallist) .   #             "Filename rules for message ends.\n";   return \@totallist; } Thanks folks. Make sure to visit us on irc.freenode.net #mailscanner for the live technical support community! ___________________________________________ Wess Bechard Information Technology Manager eliquidMEDIA International Inc. Visit: www.eliquid.com Office: 519.973.1930  -  1.800.561.7525 Fax: 519.253.0337 Cell: 519.791.9492 ___________________________________________ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! --  Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Application/PGP-SIGNATURE 498bytes. ] [ Unable to print this part. ] From MailScanner at ecs.soton.ac.uk Fri Oct 14 16:17:15 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:57 2006 Subject: Beta release 4.47.2 Message-ID: -----BEGIN PGP SIGNED MESSAGE----- I have just released another beta to tidy up a couple of issues. - - Empty or non-existent filename.rules.conf or filetype.rules.conf were stopping MailScanner working. If you don't want to upgrade to this beta release, just create a 1 line file for each one containing "allow . - -" where each field is separated by a tab character. - - The Maximum Attachments Per Message setting was not working properly. Download as usual from www.mailscanner.info. Feedback to the mailing list please. Let me know how you get on. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ0/L/fw32o+k+q+hAQFgZwgAqAIXN8qjQ6WKkymeCHT9eycTmbtDAEAp et4CXlK68m4okNayhswBa2EJFPDRcGdJCDsKS12OWa+cOW1GJ8gcZBBE4uedupl1 DYfsbaRgKSrX06vN/kDLZGYgpnTh6kt8ERb6o8XvQRprwvSBvRZDdF3LpXrks9In teEbk1zRNV7pamYhHxoE0QGMpagpb6laJtyxKflOcL+MqD4tg8nseBr1f5rTlagG Jm16sCn3dzGWbxbaf5Jf/GSmZ+hvVXYWb/ih/av6mpABtZTgXCpYLKUiduggfNiX g5tdqmIy/3S6IGMi4oDdS1WiVgQZ6Uch4M7uveICH3Ly+AZ17QAaxQ== =6JcD -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ELIQUID.COM Fri Oct 14 16:36:36 2005 From: mailscanner at ELIQUID.COM (Wess Bechard) Date: Thu Jan 12 21:30:57 2006 Subject: Beta release 4.47.2 Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian, Does this mean you got my message about the filename/type rules? I haven't seen it on the list yet, although its been mentioned on IRC. On Fri, 2005-10-14 at 16:17 +0100, Julian Field wrote: -----BEGIN PGP SIGNED MESSAGE----- I have just released another beta to tidy up a couple of issues. - - Empty or non-existent filename.rules.conf or filetype.rules.conf were stopping MailScanner working. If you don't want to upgrade to this beta release, just create a 1 line file for each one containing "allow . - -" where each field is separated by a tab character. - - The Maximum Attachments Per Message setting was not working properly. Download as usual from www.mailscanner.info. Feedback to the mailing list please. Let me know how you get on. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ0/L/fw32o+k+q+hAQFgZwgAqAIXN8qjQ6WKkymeCHT9eycTmbtDAEAp et4CXlK68m4okNayhswBa2EJFPDRcGdJCDsKS12OWa+cOW1GJ8gcZBBE4uedupl1 DYfsbaRgKSrX06vN/kDLZGYgpnTh6kt8ERb6o8XvQRprwvSBvRZDdF3LpXrks9In teEbk1zRNV7pamYhHxoE0QGMpagpb6laJtyxKflOcL+MqD4tg8nseBr1f5rTlagG Jm16sCn3dzGWbxbaf5Jf/GSmZ+hvVXYWb/ih/av6mpABtZTgXCpYLKUiduggfNiX g5tdqmIy/3S6IGMi4oDdS1WiVgQZ6Uch4M7uveICH3Ly+AZ17QAaxQ== =6JcD -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Oct 14 17:14:53 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:57 2006 Subject: Beta release 4.47.2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Yes.Fix time about 20 minutes. Not too bad for a busy Friday afternoon, even if I say so myself :-) Haven't been on IRC for a while, day job is rather busy at the moment, term started this week. n thousand new students on campus... On 14 Oct 2005, at 16:36, Wess Bechard wrote: Julian, Does this mean you got my message about the filename/type rules?  I haven't seen it on the list yet, although its been mentioned on IRC. On Fri, 2005-10-14 at 16:17 +0100, Julian Field wrote: -----BEGIN PGP SIGNED MESSAGE----- I have just released another beta to tidy up a couple of issues. - - Empty or non-existent filename.rules.conf or filetype.rules.conf were stopping MailScanner working. If you don't want to upgrade to this beta release, just create a 1 line file for each one containing "allow . - -" where each field is separated by a tab character. - - The Maximum Attachments Per Message setting was not working properly. Download as usual from www.mailscanner.info. Feedback to the mailing list please. Let me know how you get on. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ0/L/fw32o+k+q+hAQFgZwgAqAIXN8qjQ6WKkymeCHT9eycTmbtDAEAp et4CXlK68m4okNayhswBa2EJFPDRcGdJCDsKS12OWa+cOW1GJ8gcZBBE4uedupl1 DYfsbaRgKSrX06vN/kDLZGYgpnTh6kt8ERb6o8XvQRprwvSBvRZDdF3LpXrks9In teEbk1zRNV7pamYhHxoE0QGMpagpb6laJtyxKflOcL+MqD4tg8nseBr1f5rTlagG Jm16sCn3dzGWbxbaf5Jf/GSmZ+hvVXYWb/ih/av6mpABtZTgXCpYLKUiduggfNiX g5tdqmIy/3S6IGMi4oDdS1WiVgQZ6Uch4M7uveICH3Ly+AZ17QAaxQ== =6JcD -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! --  Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Application/PGP-SIGNATURE 498bytes. ] [ Unable to print this part. ] From lbcadmin at GMAIL.COM Fri Oct 14 17:33:50 2005 From: lbcadmin at GMAIL.COM (Information Services) Date: Thu Jan 12 21:30:57 2006 Subject: MailWatch password (web user) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Good point. Thanks for replying though. I did get it changed by going through phpmyadmin. Thanks Casey On 10/14/05, Chris Russell wrote: > this is a sql query rather than another a mailscanner question, > > However, > > update users set password=md5('newpassword') where username='xxxx'; > > .. Assuming the username field is "username" (Check this with "describe > users" from mysql) > > Cheers, > > Chris > > > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Information Services > Sent: 14 October 2005 14:55 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: MailWatch password (web user) > > I am trying to change the password for the MailWatch web user, but am > having problems in doing so. > > I am running > > CentOS 4.1 > mysql-4.1.10a-2.RHEL4.1 > mailwatch-1.0.1 > mailscanner-4.44.1-1 > phpMyAdmin-2.6.3-pl1 > > > I have changed the password in: > > MailWatch.pm > SQLBlackWhiteList.pm > conf.php > > from the command line: > > mysql mailscanner -u (user) -p > [changed the password] > GRANT ALL ON mailscanner.* TO xxx@localhost IDENTIFIED BY 'password'; > > flush privileges; > \q; > > Then when I try to create a MailWatch Web User, I run into this problem > > mysql mailscanner -u (user) -p > INSERT INTO users VALUES ('xxxx',md5('password'0,'xxxx','A','0'); > ERROR 1062 (23000): Duplicate entry 'xxx' for key 1 > > > So what do I need to do in order to change the password for this user? > > Casey > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > This message has been scanned for viruses and dangerous content by the > Nexent Internet Anti Virus and Spam Tagging Service and is believed to > be clean. > > > > > > > The contents of this e-mail may be privileged and are confidential. > It may not be disclosed to or used by anyone other than the addressee(s), nor copied in any way. Any views or opinions presented are solely those of the author and do not necessarily represent those of Knowledge Limited. > > If received in error, please advise the sender, then delete it from your system. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From vachanta at GMAIL.COM Fri Oct 14 18:26:26 2005 From: vachanta at GMAIL.COM (Venkata Achanta) Date: Thu Jan 12 21:30:57 2006 Subject: OT: DNS problems Message-ID: hello list, Looks like i am having problem with resolving certain domains ONLY.Any pointers/things to check for would be helpful. This is weired problem,i can resolv this on other boxes but not on this one. Oct 14 10:09:50 asav sendmail[3378]: j9EH9UGR003378: ruleset=check_mail, arg1=, relay=smtp.barwol.com [38.118.132.70] (may be forged), reject=451 4.1.8 Domain of sender address geisenreich@barwol.com does not resolve Oct 14 10:09:50 asav sendmail[3378]: j9EH9UGR003378: from=, size=14532, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=smtp.barwol.com [38.118.132.70] (may be forged) cat /etc/resolv.conf domain mydomain.com nameserver 127.0.0.1 i changed it to mydomain.com for annonynimity but i have the actual name in the file cat /etc/bind/named.conf options { directory "/var/bind"; // uncomment the following lines to turn on DNS forwarding, // and change the forwarding ip address(es) : //forward first; //forwarders { // 123.123.123.123; // 123.123.123.123; //}; listen-on-v6 { none; }; listen-on { 127.0.0.1; }; // to allow only specific hosts to use the DNS server: allow-query { 127.0.0.1; }; // if you have problems and are behind a firewall: //query-source address * port 53; pid-file "/var/run/named/named.pid"; }; zone "." IN { type hint; file "named.ca"; }; zone "localhost" IN { type master; file "pri/localhost.zone"; allow-update { none; }; notify no; }; zone "127.in-addr.arpa" IN { type master; file "pri/127.zone"; allow-update { none; }; notify no; }; logging { category lame-servers { null; }; }; dig doesnt return anything for this domain dig MX barwol.com ; <<>> DiG 9.2.2-P1 <<>> MX barwol.com ;; global options: printcmd ;; connection timed out; no servers could be reached but i can resolv rest of the domains dig MX google.com ; <<>> DiG 9.2.2-P1 <<>> MX google.com ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30555 ;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 4, ADDITIONAL: 8 ;; QUESTION SECTION: ;google.com. IN MX ;; ANSWER SECTION: google.com. 3600 IN MX 10 smtp4.google.com. google.com. 3600 IN MX 10 smtp1.google.com. google.com. 3600 IN MX 10 smtp2.google.com. google.com. 3600 IN MX 10 smtp3.google.com. ;; AUTHORITY SECTION: google.com. 345600 IN NS ns3.google.com. google.com. 345600 IN NS ns4.google.com. google.com. 345600 IN NS ns1.google.com. google.com. 345600 IN NS ns2.google.com. ;; ADDITIONAL SECTION: smtp1.google.com. 600 IN A 216.239.57.25 smtp2.google.com. 600 IN A 64.233.167.25 smtp3.google.com. 600 IN A 64.233.183.25 smtp4.google.com. 600 IN A 66.102.9.25 ns1.google.com. 345410 IN A 216.239.32.10 ns2.google.com. 345410 IN A 216.239.34.10 ns3.google.com. 345410 IN A 216.239.36.10 ns4.google.com. 345410 IN A 216.239.38.10 ;; Query time: 16 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Fri Oct 14 10:22:51 2005 ;; MSG SIZE rcvd: 316 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lbergman at WTXS.NET Fri Oct 14 18:40:37 2005 From: lbergman at WTXS.NET (Lewis Bergman) Date: Thu Jan 12 21:30:57 2006 Subject: OT: DNS problems Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Venkata Achanta said: > hello list, > > Looks like i am having problem with resolving certain domains ONLY.Any > pointers/things to check for would be helpful. This is weired problem,i > can > resolv this on other boxes but not on this one. > > Oct 14 10:09:50 asav sendmail[3378]: j9EH9UGR003378: ruleset=check_mail, > arg1=, relay=smtp.barwol.com [38.118.132.70] (may > be forged), reject=451 4.1.8 Domain of sender address > geisenreich@barwol.com does not resolve > Oct 14 10:09:50 asav sendmail[3378]: j9EH9UGR003378: > from=, size=14532, class=0, nrcpts=0, proto=ESMTP, > daemon=MTA, relay=smtp.barwol.com [38.118.132.70] (may be forged) > Since it is a caching name server have you tried flushing the cache with "rndc flush" or a named restart? Your cache may be poisened. -- Lewis Bergman Texas Communications 4309 Maple ST. Abilene, TX 79602 325-691-3301 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From vachanta at GMAIL.COM Fri Oct 14 18:55:43 2005 From: vachanta at GMAIL.COM (Venkata Achanta) Date: Thu Jan 12 21:30:57 2006 Subject: OT: DNS problems Message-ID: >Since it is a caching name server have you tried flushing the cache with >"rndc flush" or a named restart? Your cache may be poisened. Tried that but nothing changed.Thanks for the fast response. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Fri Oct 14 18:59:09 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:57 2006 Subject: Phishing RBL? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Glenn Steen wrote: >On 14/10/05, Denis Beauchemin wrote: >(snip) > > >>I don't run Clamav mainly because at one point it detected malware where >>I didn't see any (but it was a long time ago and I don't remember what >>it was about). But even if I did it wouldn't give me a pure phishing >>detection that could be used to make some phishing attempts get deleted. >> >> > >Define "pure" in this context. Sure it missed the recent "nordea" >phish (swedish bank... c:a 4 million e-banking customers), but so >would most any solution (well, perhaps not Jules phishing net)... But >then, we're all still trying to get up off the floor from all the >rolling and laughing ... The silly buggers used a translation >program... Need one say more? ISTR we had a fun "autotranslation >thread" a while back, detailing most of all the woes one would have >with that approach. >Not that I'm complaining about their infinite stupidity:-). > >Anyway, to my mind clamav is pretty darned close to getting most of >all known phishing _and_ is a very good virus detector... So why not >use it? Every AV has its flaws, so that it missed some few can't be a >reason to forego it. > > Just enabled ClamAV on my servers. About 5 minutes later I saw this message: ClamAVModule::INFECTED:: Exploit.HTML.IFrame:: ./j9EFjc3L008255/msg-4991-81.html Then I remembered why I disabled Clam... I cannot block all emails with IFrames... There seems to be the --no-html flag. I enabled it in clamav-wrapper. We'll see if it does what I hope (couldn't find much info about this). Had to switch from clamavmodule to clamav, though... Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From taz at TAZ-MANIA.COM Fri Oct 14 19:11:34 2005 From: taz at TAZ-MANIA.COM (Dennis Willson) Date: Thu Jan 12 21:30:57 2006 Subject: OT: DNS problems Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Have you tried doing a dig from the machine that can't resolve the name? I would make sure what the name server is really responding. If it can't resolve the name, then maybe it can't reach the authoritive server(s) for some reason. Venkata Achanta wrote: >>Since it is a caching name server have you tried flushing the cache with >>"rndc flush" or a named restart? Your cache may be poisened. > > > Tried that but nothing changed.Thanks for the fast response. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From vachanta at GMAIL.COM Fri Oct 14 19:37:16 2005 From: vachanta at GMAIL.COM (Venkata Achanta) Date: Thu Jan 12 21:30:57 2006 Subject: OT: DNS problems Message-ID: named is running and responding but for some reason its not resolving that barwol.com domain while the rest of the machines can. i changed /etc/resolv.conf to use to known good DNS servers and i am able to resolve that domain now but still Oct 14 11:22:12 asav sendmail[23818]: j9EILqQj023818: ruleset=check_mail, arg1=, relay=smtp.barwol.com [38.118.132.70] (may be forged), reject=451 4.1.8 Domain of sender address dkatz@barwol.com does not resolve Oct 14 11:22:12 asav sendmail[23818]: j9EILqQj023818: from=, size=1058, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=smtp.barwol.com [38.118.132.70] (may be forged) is something going on with sendmail then ? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Fri Oct 14 23:12:24 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:57 2006 Subject: Best practice Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Matt Hampton spake the following on 10/13/2005 5:33 PM: > Scott Silva wrote: > >> But wouldn't blocking executables by filetype catch anything that could >> be executable? Even if the filename is obscured? >> The file command is pretty good with dos and windows executables, no >> matter the extension. I usually catch the newer viruses here as their >> signatures are written and distributed through the virus scanner >> channels. >> >> > Still testing the code but I am implementing a safe filename/filetype > function. If the file extension ends .pdf (with anything before it) and > "file" returns that it is a PDF allow it. At the same time if something > other than PDF is returned by "file" the attachment is is handled like a > virus....... > > Once I am happy with the code I'll post it..... (otherwise engaged at > the moment - my daughter was born two days ago :-) ) > > matt > Congratulations!!! Mine are 15 and 20, so I miss having a little one around!! -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From strombrg at DCS.NAC.UCI.EDU Sat Oct 15 01:04:05 2005 From: strombrg at DCS.NAC.UCI.EDU (Dan Stromberg) Date: Thu Jan 12 21:30:57 2006 Subject: spam filtering ceased Message-ID: Hi folks. I looked around on gmane a bit for a solution to this, but I really only found someone with the same question and no answers. Googling for this one seems messy, as I'm not sure what keywords to use this time. Anyway, I run a mail server, and someone else was tasked with setting up mailscanner on it. He's on vacation, and doesn't appear to have any doc written up. This mail server, I'm told, has suddenly stopped doing antispam filtering. I tried killing and restarting all the sendmail's and mailscanner, but that's not (necessarily) helping. I'd really benefit from two things: 1) A decision procedure for determining if antispam filtering is functional again. For example, can I just search for a recent message with antispam headers, or is it more complicated than that? 2) A procedure for determining what happened to the antispam filtering I attempted "MailScanner -v" as mentioned in another post, but that just said something about configuration file -v not existing. I also attempted the lint-related spamassassin command mentioned in the same post, but I recall the person who set this up saying that spamassassin is used via a perl module, and I have no spamassassin's on my $PATH. Suggestions? Thanks! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at gmail.com Sat Oct 15 10:47:53 2005 From: glenn.steen at gmail.com (Glenn Steen) Date: Thu Jan 12 21:30:57 2006 Subject: Phishing RBL? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 14/10/05, Denis Beauchemin wrote: (snip) > Just enabled ClamAV on my servers. About 5 minutes later I saw this > message: > ClamAVModule::INFECTED:: Exploit.HTML.IFrame:: > ./j9EFjc3L008255/msg-4991-81.html > > Then I remembered why I disabled Clam... I cannot block all emails with > IFrames... > > There seems to be the --no-html flag. I enabled it in clamav-wrapper. > We'll see if it does what I hope (couldn't find much info about this). > > Had to switch from clamavmodule to clamav, though... I might be completely wrong, but.... I *don't* use that flag, and it only catches really bad iframes... Not like the MS thing that catch *all* ...So far at least. Did you check that the IFrame in question wasn't malicious? -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Oct 15 12:59:43 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:57 2006 Subject: spam filtering ceased Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Have you considered just upgrading to the latest versions of MailScanner and spamassassin? It might well be the quickest way out of your trouble. But first make sure /usr/bin/perl points to the latest version of Perl that is installed on your machine. You don't want to install in 1 perl and then run another. If you haven't got "MailScanner -v" working, then you have a pretty ancient version. If your SA is that old then an upgrade to the latest would help too. Upgrade SA using the ClamAV+SA package that I distribute on the MailScanner downloads page. It will save you a lot of time than doing it by hand. Dan Stromberg wrote: >Hi folks. > >I looked around on gmane a bit for a solution to this, but I really only >found someone with the same question and no answers. Googling for this >one seems messy, as I'm not sure what keywords to use this time. > >Anyway, I run a mail server, and someone else was tasked with setting up >mailscanner on it. He's on vacation, and doesn't appear to have any doc >written up. > >This mail server, I'm told, has suddenly stopped doing antispam >filtering. > >I tried killing and restarting all the sendmail's and mailscanner, but >that's not (necessarily) helping. > >I'd really benefit from two things: > > 1) A decision procedure for determining if antispam filtering is > functional again. For example, can I just search for a recent message > with antispam headers, or is it more complicated than that? > > 2) A procedure for determining what happened to the antispam > filtering > >I attempted "MailScanner -v" as mentioned in another post, but that just >said something about configuration file -v not existing. > >I also attempted the lint-related spamassassin command mentioned in the >same post, but I recall the person who set this up saying that >spamassassin is used via a perl module, and I have no spamassassin's on my >$PATH. > >Suggestions? > >Thanks! > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQ1DvMRH2WUcUFbZUEQIGsACg9px8SS/hr5oFg+DAhJbwl2q09CAAn2a+ AzNrE4hWK8bHRcph3xZVmnkD =CQMR -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dmaluski at n1ety.com Sat Oct 15 16:35:54 2005 From: dmaluski at n1ety.com (Dean Maluski) Date: Thu Jan 12 21:30:57 2006 Subject: Mailwatch &SQLWhitelist Message-ID: I just got mailwatch working, sortof. I altered /etc/MailScanner.conf to support Is Definitely Spam = &SQLBlacklist and Is Definitely Not Spam = &SQLWhitelist. I added a test sender to SQLblacklist via web interface and sure enough it worked. I also have been creating whitelist entries. Those don't seem to be working. At least they are not showing up in weblist as green. I will have to sift through instructions again but I think that whitelist would work tyhe same as blacklist without any major changes or something I did that was stupid possibly. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Sat Oct 15 22:17:40 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:57 2006 Subject: OT: Need proofreading for MailScanner article Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, I've written an article about MailScanner, to be published in a free magazine. I'm not paid for that. I would appreciate if some of you could proofread my text before I send it to the editor, to ensure accuracy and that my English is ok (english is not my mother tongue). It is about 3 pages long. Please contact me off-list, stating what format you prefer: Word, PDF or an URL to a html format. If you have Acrobat (not just the reader), you could write me your comments/corrections as "comments". In word you can use the proofreading feature to show your corrections and add comments. Regards, -- Ugo ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Sat Oct 15 22:38:01 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:57 2006 Subject: Phishing RBL? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Glenn Steen wrote: > On 14/10/05, Denis Beauchemin wrote: > (snip) >> Just enabled ClamAV on my servers. About 5 minutes later I saw this >> message: >> ClamAVModule::INFECTED:: Exploit.HTML.IFrame:: >> ./j9EFjc3L008255/msg-4991-81.html >> >> Then I remembered why I disabled Clam... I cannot block all emails with >> IFrames... >> >> There seems to be the --no-html flag. I enabled it in clamav-wrapper. >> We'll see if it does what I hope (couldn't find much info about this). >> >> Had to switch from clamavmodule to clamav, though... > > I might be completely wrong, but.... I *don't* use that flag, and it > only catches really bad iframes... Not like the MS thing that catch > *all* ...So far at least. > Did you check that the IFrame in question wasn't malicious? I agree, I don't think it catches all IFRAMEs... > > -- > -- Glenn > email: glenn < dot > steen < at > gmail < dot > com > work: glenn < dot > steen < at > ap1 < dot > se > -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Sun Oct 16 02:44:30 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:57 2006 Subject: Phishing RBL? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ugo Bellavance wrote: > Glenn Steen wrote: >> On 14/10/05, Denis Beauchemin wrote: >> (snip) >>> Just enabled ClamAV on my servers. About 5 minutes later I saw this >>> message: >>> ClamAVModule::INFECTED:: Exploit.HTML.IFrame:: >>> ./j9EFjc3L008255/msg-4991-81.html >>> >>> Then I remembered why I disabled Clam... I cannot block all emails >>> with >>> IFrames... >>> >>> There seems to be the --no-html flag. I enabled it in clamav-wrapper. >>> We'll see if it does what I hope (couldn't find much info about this). >>> >>> Had to switch from clamavmodule to clamav, though... >> >> I might be completely wrong, but.... I *don't* use that flag, and it >> only catches really bad iframes... Not like the MS thing that catch >> *all* ...So far at least. >> Did you check that the IFrame in question wasn't malicious? > > I agree, I don't think it catches all IFRAMEs... > OK, then can someone point me to some documentation about that feature? Thanks! Denis PS: I think it was malicious (it was part of an infected email) ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cparker at SWATGEAR.COM Sun Oct 16 02:56:44 2005 From: cparker at SWATGEAR.COM (Chris W. Parker) Date: Thu Jan 12 21:30:57 2006 Subject: MailScanner-MRTG timeout error message Message-ID: Hello, I'm getting an error in the emails that MailScanner-MRTG sends after running. (7 times total per email) Timeout: No Response from localhost:161 Is there a MailScanner-MRTG user mailing list? I could only find an announce list. I am using the latest version of MSMRTG and it is building (some) graphs even though this error is being reported. Thanks, Chris. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Sun Oct 16 02:45:02 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:58 2006 Subject: OT: Need proofreading for MailScanner article Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi again, There are already enough persons to proofread. I'll contact the list again for the 2nd proofreading round. Thanks a lot everyone! -- Ugo ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cparker at SWATGEAR.COM Sun Oct 16 04:24:44 2005 From: cparker at SWATGEAR.COM (Chris W. Parker) Date: Thu Jan 12 21:30:58 2006 Subject: New MS install is acting very strangely (misconfiguration somewhere) Message-ID: Hello, Well I got my new MS box up and running tonight and I was able to send inbound one email successfully. All further attempts never came through. The strange part is that maillog says it's delivered successfully. "Uninfected: Delivered 1 message". Another strange thing is that I can send emails out with no problem. (MS is acting as a gateway in front of Exchange 2000.) When I downed my new MS box and brought back up my old one everything started flowing normally again. I've checked (and rechecked) my setup in /etc/mail to no avail. What am I missing? One last thing is that I use the Message Tracking feature of Exchange to see if it had actually received any email from my new box and it hadn't (even though MS reported in /var/log/maillog that the message was delivered). I have not changed any settings on the Exchange box nor did I change any ip information on the new/old MS boxes. The way I worked it out was by changing the ip address of the old box and then changing the new box to the appropriate ip address. (To get them back to normal I did the opposite of course.) Thanks! Chris. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From strombrg at DCS.NAC.UCI.EDU Sun Oct 16 05:54:13 2005 From: strombrg at DCS.NAC.UCI.EDU (Dan Stromberg) Date: Thu Jan 12 21:30:58 2006 Subject: spam filtering ceased Message-ID: On Sat, 2005-10-15 at 12:59 +0100, Julian Field wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Have you considered just upgrading to the latest versions of MailScanner > and spamassassin? I've considered it, but then this is a production system, and I've never upgraded or installed MailScanner before... > It might well be the quickest way out of your trouble. But first make > sure /usr/bin/perl points to the latest version of Perl that is > installed on your machine. You don't want to install in 1 perl and then > run another. Hmmmmm: meter-root) type -all perl perl is /dcs/bin/perl perl is /bin/perl perl is /usr/bin/perl meter-root) /dcs/bin/perl -v This is perl, v5.8.1 built for sun4-solaris Copyright 1987-2003, Larry Wall Perl may be copied only under the terms of either the Artistic License or the GNU General Public License, which may be found in the Perl 5 source kit. Complete documentation for Perl, including FAQ lists, should be found on this system using `man perl' or `perldoc perl'. If you have access to the Internet, point your browser at http://www.perl.com/, the Perl Home Page. meter-root) /usr/bin/perl -v This is perl, version 5.005_03 built for sun4-solaris Copyright 1987-1999, Larry Wall Perl may be copied only under the terms of either the Artistic License or the GNU General Public License, which may be found in the Perl 5.0 source kit. Complete documentation for Perl, including FAQ lists, should be found on this system using `man perl' or `perldoc perl'. If you have access to the Internet, point your browser at http://www.perl.com/, the Perl Home Page. meter-root) > If you haven't got "MailScanner -v" working, then you have a pretty > ancient version. If your SA is that old then an upgrade to the latest > would help too. Upgrade SA using the ClamAV+SA package that I distribute > on the MailScanner downloads page. It will save you a lot of time than > doing it by hand. I like the idea of upgrading, but having never done a mailscanner upgrade or install, it doesn't sound safe enough to be a quick fix. I'd have to go configure the software on some other test host first. Are there any other possibilities? > Dan Stromberg wrote: > > >Hi folks. > > > >I looked around on gmane a bit for a solution to this, but I really only > >found someone with the same question and no answers. Googling for this > >one seems messy, as I'm not sure what keywords to use this time. > > > >Anyway, I run a mail server, and someone else was tasked with setting up > >mailscanner on it. He's on vacation, and doesn't appear to have any doc > >written up. > > > >This mail server, I'm told, has suddenly stopped doing antispam > >filtering. > > > >I tried killing and restarting all the sendmail's and mailscanner, but > >that's not (necessarily) helping. > > > >I'd really benefit from two things: > > > > 1) A decision procedure for determining if antispam filtering is > > functional again. For example, can I just search for a recent message > > with antispam headers, or is it more complicated than that? > > > > 2) A procedure for determining what happened to the antispam > > filtering > > > >I attempted "MailScanner -v" as mentioned in another post, but that just > >said something about configuration file -v not existing. > > > >I also attempted the lint-related spamassassin command mentioned in the > >same post, but I recall the person who set this up saying that > >spamassassin is used via a perl module, and I have no spamassassin's on my > >$PATH. > > > >Suggestions? > > > >Thanks! > > > >------------------------ MailScanner list ------------------------ > >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >'leave mailscanner' in the body of the email. > >Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >Support MailScanner development - buy the book off the website! > > > > > > - -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > -----BEGIN PGP SIGNATURE----- > Version: PGP Desktop 9.0.2 (Build 2424) > > iQA/AwUBQ1DvMRH2WUcUFbZUEQIGsACg9px8SS/hr5oFg+DAhJbwl2q09CAAn2a+ > AzNrE4hWK8bHRcph3xZVmnkD > =CQMR > -----END PGP SIGNATURE----- > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sun Oct 16 11:20:29 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:58 2006 Subject: spam filtering ceased Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dan Stromberg wrote: >On Sat, 2005-10-15 at 12:59 +0100, Julian Field wrote: > > >>-----BEGIN PGP SIGNED MESSAGE----- >>Hash: SHA1 >> >>Have you considered just upgrading to the latest versions of MailScanner >>and spamassassin? >> >> > >I've considered it, but then this is a production system, and I've never >upgraded or installed MailScanner before... > > > >>It might well be the quickest way out of your trouble. But first make >>sure /usr/bin/perl points to the latest version of Perl that is >>installed on your machine. You don't want to install in 1 perl and then >>run another. >> >> > >Hmmmmm: > > meter-root) type -all perl > perl is /dcs/bin/perl > perl is /bin/perl > perl is /usr/bin/perl > meter-root) /dcs/bin/perl -v > > This is perl, v5.8.1 built for sun4-solaris > > > meter-root) /usr/bin/perl -v > > This is perl, version 5.005_03 built for sun4-solaris > > By default, MailScanner will always use /usr/bin/perl. But anything that looks for perl in your path may well pick up /dcs/bin/perl. Having these 2 different is very dangerous and the cause of a whole host of problems. Consider replacing /usr/bin/perl with a link to /dcs/bin/perl. And who put perl in /bin? It doesn't belong there. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQ1IpbhH2WUcUFbZUEQJi7ACguNxBD8MDqMpYHjnDz1Ou7XevAAkAn1or FbXbocHa6SV4agiGsO8Vth5P =wAUk -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Sun Oct 16 12:22:36 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:58 2006 Subject: Phishing RBL? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 16/10/05, Denis Beauchemin wrote: > Ugo Bellavance wrote: > > Glenn Steen wrote: > >> On 14/10/05, Denis Beauchemin wrote: > >> (snip) > >>> Just enabled ClamAV on my servers. About 5 minutes later I saw this > >>> message: > >>> ClamAVModule::INFECTED:: Exploit.HTML.IFrame:: > >>> ./j9EFjc3L008255/msg-4991-81.html > >>> > >>> Then I remembered why I disabled Clam... I cannot block all emails > >>> with > >>> IFrames... > >>> > >>> There seems to be the --no-html flag. I enabled it in clamav-wrapper. > >>> We'll see if it does what I hope (couldn't find much info about this). > >>> > >>> Had to switch from clamavmodule to clamav, though... > >> > >> I might be completely wrong, but.... I *don't* use that flag, and it > >> only catches really bad iframes... Not like the MS thing that catch > >> *all* ...So far at least. > >> Did you check that the IFrame in question wasn't malicious? > > > > I agree, I don't think it catches all IFRAMEs... > > > OK, then can someone point me to some documentation about that feature? > > Thanks! > > Denis > PS: I think it was malicious (it was part of an infected email) Ah yes, and those it really should pick up, now shouldn't it;). Haven't looked for docs, but have had it running for a while (a year more or less), and unlike you I don't allow IFrames at all (well, some financial newsletter senders have been WL'd for IFrames). It is the very few really dangerous ones that Clamav picks up, never the more or less harmless ones picked up by MailScanner. I'd imagine asking at a relevant clamav mailing-list would give the fastest/best info. -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From fabienpenso at GMAIL.COM Sun Oct 16 13:21:02 2005 From: fabienpenso at GMAIL.COM (Fabien Penso) Date: Thu Jan 12 21:30:58 2006 Subject: First message - Keep X-*-MailScanner* headers? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi everyone, hi julian, I am a currently happy new user of Mailscanner. I was looking for a better alternative to amavis and I guess I found it. I looked into the FAQ but I didn't find an answer to the following. I'd like to keep the X-*-MailScanner* in the quarantined emails, is there an option for that ? The idea is to insert in database the quarantined email so users can see them through a web interface, and see what scored it did get. I'd also like to have a X-*-MailScanner-To: which would make my life easier to see who the mail was for, and so who should be allowed to see it through the web interface. Thanks. -- http://penso.info/ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sun Oct 16 13:50:48 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:58 2006 Subject: First message - Keep X-*-MailScanner* headers? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The archive is intentionally a clean copy of the original messages in their untouched form. However, take a look at the "Quarantine Modified Body" setting, it may do what you are looking for. The neatest web interface by far is MailWatch, take a look at it. Fabien Penso wrote: >Hi everyone, hi julian, > >I am a currently happy new user of Mailscanner. I was looking for a >better alternative to amavis and I guess I found it. > >I looked into the FAQ but I didn't find an answer to the following. >I'd like to keep the X-*-MailScanner* in the quarantined emails, is >there an option for that ? The idea is to insert in database the >quarantined email so users can see them through a web interface, and >see what scored it did get. > >I'd also like to have a X-*-MailScanner-To: which would make my life >easier to see who the mail was for, and so who should be allowed to >see it through the web interface. > >Thanks. > >-- >http://penso.info/ > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQ1JMqRH2WUcUFbZUEQIV8QCg9zC9IFLvNdXBHacrG567w7vARjEAoOZ4 RRi6u0wAVjhk4ANMgB5ZKsO7 =Q/O+ -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From fabienpenso at GMAIL.COM Sun Oct 16 15:38:59 2005 From: fabienpenso at GMAIL.COM (Fabien Penso) Date: Thu Jan 12 21:30:58 2006 Subject: First message - Keep X-*-MailScanner* headers? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > However, take a look at the "Quarantine Modified Body" setting, it may > do what you are looking for. It is not, but after installing mailwatch I got that informations anyway. I also now understood how I can get the same result using similar technics. Thanks, ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Sun Oct 16 15:18:55 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:58 2006 Subject: MailScanner-MRTG timeout error message Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Chris W. Parker wrote: > Hello, > > I'm getting an error in the emails that MailScanner-MRTG sends after > running. > > (7 times total per email) > Timeout: No Response from localhost:161 Everytime it is run, or only once in a while? It happens on my servers when they're overloaded. This only means that it could not connect to the snmp agent in a timely manner. > > Is there a MailScanner-MRTG user mailing list? I could only find an > announce list. I think there is a list on sourceforge for that. > > I am using the latest version of MSMRTG and it is building (some) graphs > even though this error is being reported. As I said, if you have very busy servers and you don't get those messages often, don't worry. > > > > Thanks, > Chris. > -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rpotter at RPCS.NET Sun Oct 16 19:40:50 2005 From: rpotter at RPCS.NET (Richard Potter) Date: Thu Jan 12 21:30:58 2006 Subject: OT: DNS problems Message-ID: On Fri, Oct 14, 2005 at 07:37:16PM +0100, Venkata Achanta wrote: > named is running and responding but for some reason its not resolving that > barwol.com domain while the rest of the machines can. > > i changed /etc/resolv.conf to use to known good DNS servers and i am able > to resolve that domain now > > but still > > Oct 14 11:22:12 asav sendmail[23818]: j9EILqQj023818: ruleset=check_mail, > arg1=, relay=smtp.barwol.com [38.118.132.70] (may be > forged), reject=451 4.1.8 Domain of sender address dkatz@barwol.com does > not resolve > Oct 14 11:22:12 asav sendmail[23818]: j9EILqQj023818: > from=, size=1058, class=0, nrcpts=0, proto=ESMTP, > daemon=MTA, relay=smtp.barwol.com [38.118.132.70] (may be forged) > > is something going on with sendmail then ? Yes and No. This is almost always a DNS error that sendmail gets picky about. A quick check of the domain at http://www.dnsreport.com will probably lead you in the right direction. Cheers! -- Richard Potter ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Sun Oct 16 23:30:08 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:58 2006 Subject: New MS install is acting very strangely (misconfiguration somewhere) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Chris W. Parker wrote: > Hello, > > Well I got my new MS box up and running tonight and I was able to send > inbound one email successfully. All further attempts never came through. > The strange part is that maillog says it's delivered successfully. > "Uninfected: Delivered 1 message". Another strange thing is that I can > send emails out with no problem. > > (MS is acting as a gateway in front of Exchange 2000.) > > When I downed my new MS box and brought back up my old one everything > started flowing normally again. I've checked (and rechecked) my setup in > /etc/mail to no avail. What am I missing? > > One last thing is that I use the Message Tracking feature of Exchange to > see if it had actually received any email from my new box and it hadn't > (even though MS reported in /var/log/maillog that the message was > delivered). > > I have not changed any settings on the Exchange box nor did I change any > ip information on the new/old MS boxes. The way I worked it out was by > changing the ip address of the old box and then changing the new box to > the appropriate ip address. (To get them back to normal I did the > opposite of course.) > > > Thanks! > Chris. > Maybe running a packet sniffer could help see where it 'delivered' the undelivered mail. Regards, -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From raymond at PROLOCATION.NET Mon Oct 17 00:19:12 2005 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:30:58 2006 Subject: Beta release 4.47.2 Message-ID: Hi Julian, > I have just released another beta to tidy up a couple of issues. > > - - Empty or non-existent filename.rules.conf or filetype.rules.conf > were stopping MailScanner working. If you don't want to upgrade to > this beta release, just create a 1 line file for each one containing > "allow . - -" where each field is separated by a tab character. > - - The Maximum Attachments Per Message setting was not working properly. > > Download as usual from www.mailscanner.info. > > Feedback to the mailing list please. Let me know how you get on. Could you add a check to the phising update script to check if people do need updates? Find Phishing Fraud = no Then i guess that updater isnt of any use either. :) Thanks, Raymond. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From taz at TAZ-MANIA.COM Mon Oct 17 00:25:49 2005 From: taz at TAZ-MANIA.COM (Dennis Willson) Date: Thu Jan 12 21:30:58 2006 Subject: New MS install is acting very strangely (misconfiguration somewhere) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] "Uninfected: Delivered 1 message" is from MailScanner, not the MTA. If it was really delivered, there should be another message from the MTA that says it was delivered. I believe that the message from MailScanner means it was put in the output queue for the MTA to pickup and deliver (at least if sendmail is the MTA). Then it's up to the MTA to actually deliver the message. I would check your input and output queues for the email you tried to send through. Ugo Bellavance wrote: > Chris W. Parker wrote: > >> Hello, >> >> Well I got my new MS box up and running tonight and I was able to send >> inbound one email successfully. All further attempts never came through. >> The strange part is that maillog says it's delivered successfully. >> "Uninfected: Delivered 1 message". Another strange thing is that I can >> send emails out with no problem. >> >> (MS is acting as a gateway in front of Exchange 2000.) >> >> When I downed my new MS box and brought back up my old one everything >> started flowing normally again. I've checked (and rechecked) my setup in >> /etc/mail to no avail. What am I missing? >> >> One last thing is that I use the Message Tracking feature of Exchange to >> see if it had actually received any email from my new box and it hadn't >> (even though MS reported in /var/log/maillog that the message was >> delivered). >> >> I have not changed any settings on the Exchange box nor did I change any >> ip information on the new/old MS boxes. The way I worked it out was by >> changing the ip address of the old box and then changing the new box to >> the appropriate ip address. (To get them back to normal I did the >> opposite of course.) >> >> >> Thanks! >> Chris. >> > Maybe running a packet sniffer could help see where it 'delivered' the > undelivered mail. > > Regards, > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard.gray at DNS.CO.UK Mon Oct 17 11:54:58 2005 From: richard.gray at DNS.CO.UK (Gray, Richard) Date: Thu Jan 12 21:30:58 2006 Subject: New MS install is acting very strangely (misconfiguration somewhere) Message-ID: > >> > >> I have not changed any settings on the Exchange box nor > did I change > >> any ip information on the new/old MS boxes. The way I > worked it out > >> was by changing the ip address of the old box and then > changing the > >> new box to the appropriate ip address. (To get them back > to normal I > >> did the opposite of course.) > >> > >> > >> Thanks! > >> Chris. > >> > > Maybe running a packet sniffer could help see where it > 'delivered' the > > undelivered mail. > > I've actually noticed some slightly strange behaviour in exchange regarding the message tracking feature. We had a problem where if a message was quarantined, it would send the decontaminated message out. If I went and located the message in quarantine and copied it into exims delivery queue, exim would pick the message up and deliver it, but the exchange server would have no record of having received it. I was never able to tie this down to anything specific, and we ended up fixing it by not sending through notifications rather than the defanged message. Just something to be aware about if you are working on this. R ----------------------- This email from dns has been validated by dnsMSS(TM) Managed Email Security and is free from all known viruses. For further information contact email-integrity@dns.co.uk ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Oct 17 12:04:06 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:58 2006 Subject: New MS install is acting very strangely (misconfiguration somewhere) Message-ID: -----BEGIN PGP SIGNED MESSAGE----- On 17 Oct 2005, at 11:54, Gray, Richard wrote: >>>> >>>> I have not changed any settings on the Exchange box nor >>>> >> did I change >> >>>> any ip information on the new/old MS boxes. The way I >>>> >> worked it out >> >>>> was by changing the ip address of the old box and then >>>> >> changing the >> >>>> new box to the appropriate ip address. (To get them back >>>> >> to normal I >> >>>> did the opposite of course.) >>>> >>>> >>>> Thanks! >>>> Chris. >>>> >>>> >>> Maybe running a packet sniffer could help see where it >>> >> 'delivered' the >> >>> undelivered mail. >>> >>> > > I've actually noticed some slightly strange behaviour in exchange > regarding the message tracking feature. We had a problem where if a > message was quarantined, it would send the decontaminated message out. > If I went and located the message in quarantine and copied it into > exims > delivery queue, exim would pick the message up and deliver it, but the > exchange server would have no record of having received it. > > I was never able to tie this down to anything specific, and we > ended up > fixing it by not sending through notifications rather than the > defanged > message. Just something to be aware about if you are working on this. Switch off Exchange's duplicate message detection and try it again. The cleaned message will have the same message-id: as the original message, which might be causing you trouble. - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ1OFKfw32o+k+q+hAQEFDwf/aew3nkm0tM78ig90nInyJDtm70IFYuf1 pgUCyFSj2/+GtFfd0GEs2VNNBpbnv5usPa+AEKN2ZaroxYLHWB7KEAJqDmYBG5A4 noXFeITIL8e3oyJGsI8BX8txalmBVQQB+53GgUjKBINy2BQGI+8akOGZ7ykMjyl1 1WmzYIErDTS0kunFD/pD573x4xXpEjW+SAXpF/00JU/UarI8kFYQT2RwEniVeVo4 2XFzaU7FbC6uvlOPCj+9i//uE36gwBAtpJWq6Ja4C89Z3T2U3hrYeHdSdl8dWVeI BagkBgbPbblpqkUaKU94ueNWzkJHnoC6bo2/vRvLomfTHDT/HUesgw== =muH/ -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Mon Oct 17 16:28:27 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:58 2006 Subject: Mailwatch &SQLWhitelist Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dean Maluski spake the following on 10/15/2005 8:35 AM: > I just got mailwatch working, sortof. > I altered /etc/MailScanner.conf > to support > Is Definitely Spam = &SQLBlacklist and > > Is Definitely Not Spam = &SQLWhitelist. > I added a test sender to SQLblacklist via web interface and sure enough > it worked. I also have been creating whitelist entries. > Those don't seem to be working. At least they are not showing up in > weblist as green. > I will have to sift through instructions again but I think that > whitelist would work tyhe same as blacklist without any major changes or > something I did that was stupid possibly. > Try and restart MailScanner and tail -f the maillog. You can look for the startup loading of the black and whitelists to see if the whitelist is loading. If blacklists are working, I would think that either there is a typo in MailScanner.conf, or invalid whitelist entries. For instance, you can not wildcard a domain with "@somedomain.com" because the ampersand seems to be invalid if not in a single address. "user@somedomain.com" is valid, but for an entire domain you need "somedomain.com". Also look for another "Is Definitely Not Spam =" entry that is not commented out. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cparker at SWATGEAR.COM Mon Oct 17 18:31:03 2005 From: cparker at SWATGEAR.COM (Chris W. Parker) Date: Thu Jan 12 21:30:58 2006 Subject: New MS install is acting very strangely (misconfiguration somewhere) Message-ID: Dennis Willson on Sunday, October 16, 2005 4:26 PM said: > "Uninfected: Delivered 1 message" is from MailScanner, not the MTA. If > it was really delivered, there should be another message from the MTA > that says it was delivered. I'm using sendmail. Do you know what the message should say? > I believe that the message from > MailScanner means it was put in the output queue for the MTA to > pickup and deliver (at least if sendmail is the MTA). Then it's up to > the MTA to actually deliver the message. > > I would check your input and output queues for the email you tried to > send through. Ahh... I looked in my output queue and I have a bunch of emails in there. Looks like they never left my machine. I made a change in MailScanner.conf that is probably the culprit. I changed the output queue to /var/spool/mqueue.out (from /var/spool/mqueue) simply because it made more sense to me than the original location. I assumed that changing it in MailScanner.conf would also make sendmail aware of the change but it seems not to be the case. I looked through sendmail.mc but didn't find any setting to change the queue. However, in sendmail.mc I *did* find: # queue directory O QueueDirectory=/var/spool/mqueue Is there something I need to add to sendmail.mc to rebuild the .cf file or can I modify directly the .cf file? Thanks, Chris. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jd at BARITEC.COM Mon Oct 17 19:04:09 2005 From: jd at BARITEC.COM (JD Doelitzsch) Date: Thu Jan 12 21:30:58 2006 Subject: clamav-wrapper bash:not found. Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Im using Fedora 4 just installed clamav and MailScanner, and I updated the virus.scanners.conf to reflect the clamav installation in /usr/local/lib for clamscan etc. The clamav-wrapper is still giving me the not found error. Any other references im missing? Clamscan works fine by the way. -JD ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Mon Oct 17 19:17:51 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:58 2006 Subject: New MS install is acting very strangely (misconfiguration somewhere) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Chris W. Parker wrote: >Dennis Willson > on Sunday, October 16, 2005 4:26 PM said: > > > >>"Uninfected: Delivered 1 message" is from MailScanner, not the MTA. If >>it was really delivered, there should be another message from the MTA >>that says it was delivered. >> >> > >I'm using sendmail. Do you know what the message should say? > > > >>I believe that the message from >>MailScanner means it was put in the output queue for the MTA to >>pickup and deliver (at least if sendmail is the MTA). Then it's up to >>the MTA to actually deliver the message. >> >>I would check your input and output queues for the email you tried to >>send through. >> >> > >Ahh... I looked in my output queue and I have a bunch of emails in >there. Looks like they never left my machine. > >I made a change in MailScanner.conf that is probably the culprit. I >changed the output queue to /var/spool/mqueue.out (from >/var/spool/mqueue) simply because it made more sense to me than the >original location. I assumed that changing it in MailScanner.conf would >also make sendmail aware of the change but it seems not to be the case. > >I looked through sendmail.mc but didn't find any setting to change the >queue. However, in sendmail.mc I *did* find: > ># queue directory >O QueueDirectory=/var/spool/mqueue > >Is there something I need to add to sendmail.mc to rebuild the .cf file >or can I modify directly the .cf file? > > Chris, Why don't you start sendmail with this parameter: -oQ/var/spool/mqueue.out (or -OQueueDirectory=/var/spool/mqueue.out) Look into /etc/init.d/MailScanner (if you are on a Linux box) for: $SENDMAIL $([ -n "$QUEUETIME" ] && echo -q$QUEUETIME) \ -OPidFile=$OUTPID Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Oct 17 19:21:37 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:58 2006 Subject: clamav-wrapper bash:not found. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Change it to /usr/local and not /usr/local/lib. JD Doelitzsch wrote: >Im using Fedora 4 just installed clamav and MailScanner, and I updated the >virus.scanners.conf to reflect the clamav installation in /usr/local/lib for >clamscan etc. The clamav-wrapper is still giving me the not found error. Any >other references im missing? Clamscan works fine by the way. > >-JD > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQ1PrsRH2WUcUFbZUEQJpDwCg3xxwDKgqGLmkpdFD+JM469QbjC8AoKiv XzlxwWE55YR+37wuLwW35bwj =zfYi -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Oct 17 19:21:40 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:58 2006 Subject: clamav-wrapper bash:not found. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Change it to /usr/local and not /usr/local/lib. JD Doelitzsch wrote: >Im using Fedora 4 just installed clamav and MailScanner, and I updated the >virus.scanners.conf to reflect the clamav installation in /usr/local/lib for >clamscan etc. The clamav-wrapper is still giving me the not found error. Any >other references im missing? Clamscan works fine by the way. > >-JD > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQ1PrtRH2WUcUFbZUEQKGowCdGImhQNU5xv8V5kcu7K6Ar8EbpecAnj7J AD3rMkKWYuzZ5exNLHgt17Sj =tcV/ -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Mon Oct 17 19:21:58 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:30:58 2006 Subject: clamav-wrapper bash:not found. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] JD Doelitzsch wrote: >Im using Fedora 4 just installed clamav and MailScanner, and I updated the >virus.scanners.conf to reflect the clamav installation in /usr/local/lib for >clamscan etc. The clamav-wrapper is still giving me the not found error. Any >other references im missing? Clamscan works fine by the way. > > JD, You shouldn't call this script. Call this one: /etc/cron.hourly/update_virus_scanners (or /usr/sbin/update_virus_scanners). Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jd at BARITEC.COM Mon Oct 17 19:42:45 2005 From: jd at BARITEC.COM (JD Doelitzsch) Date: Thu Jan 12 21:30:58 2006 Subject: FW: clamav-wrapper bash:not found. Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Sorry, I made a typo. I meant /usr/local/bin which is where clamscan and freshclam resides, not lib. If i change to /usr/local does the script automatically look in */bin? -JD -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On Behalf Of Julian Field Sent: Monday, October 17, 2005 11:22 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: clamav-wrapper bash:not found. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Change it to /usr/local and not /usr/local/lib. JD Doelitzsch wrote: >Im using Fedora 4 just installed clamav and MailScanner, and I updated the >virus.scanners.conf to reflect the clamav installation in /usr/local/lib for >clamscan etc. The clamav-wrapper is still giving me the not found error. Any >other references im missing? Clamscan works fine by the way. > >-JD > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQ1PrtRH2WUcUFbZUEQKGowCdGImhQNU5xv8V5kcu7K6Ar8EbpecAnj7J AD3rMkKWYuzZ5exNLHgt17Sj =tcV/ -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From strombrg at DCS.NAC.UCI.EDU Mon Oct 17 20:08:59 2005 From: strombrg at DCS.NAC.UCI.EDU (Dan Stromberg) Date: Thu Jan 12 21:30:58 2006 Subject: spam filtering ceased Message-ID: On Sun, 2005-10-16 at 11:20 +0100, Julian Field wrote: > By default, MailScanner will always use /usr/bin/perl. But anything that > looks for perl in your path may well pick up /dcs/bin/perl. Having these > 2 different is very dangerous and the cause of a whole host of problems. > Consider replacing /usr/bin/perl with a link to /dcs/bin/perl. And who > put perl in /bin? It doesn't belong there. Hi Julian. Thanks for your comments. I'm reluctant to replace /usr/bin/perl with a symlink to /dcs/bin/perl, because /usr/bin/perl is the Sun version, and I'm concerned that there might be a perl script that ships with the OS that isn't compatibile with /dcs/bin/perl. /bin and /usr/bin are the same directory usually on most Sun's. Would it be sufficient to make sure the $PATH as known by MailScanner does not include /dcs/bin/perl? Thanks! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jaearick at COLBY.EDU Mon Oct 17 20:25:04 2005 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:30:58 2006 Subject: spam filtering ceased Message-ID: Hi, FWIW, when I cold-install Solaris 9 or 10 onto a system, I don't install either the SUNW perl packages, the SUNW sendmail package, or some other unwanted packages (like apache). You don't need them for the OS to work properly, and they are out-of-date relative to the public-domain releases anyway. Then I install the public-domain versions. Come on, be brave. Do a "cp /dcs/bin/perl /dcs/bin/perl.orig" to CYA before replacing with a symlink. Jeff Earickson Colby College On Mon, 17 Oct 2005, Dan Stromberg wrote: > Date: Mon, 17 Oct 2005 12:08:59 -0700 > From: Dan Stromberg > Reply-To: MailScanner mailing list > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: spam filtering ceased > > On Sun, 2005-10-16 at 11:20 +0100, Julian Field wrote: > >> By default, MailScanner will always use /usr/bin/perl. But anything that >> looks for perl in your path may well pick up /dcs/bin/perl. Having these >> 2 different is very dangerous and the cause of a whole host of problems. >> Consider replacing /usr/bin/perl with a link to /dcs/bin/perl. And who >> put perl in /bin? It doesn't belong there. > > Hi Julian. > > Thanks for your comments. > > I'm reluctant to replace /usr/bin/perl with a symlink to /dcs/bin/perl, > because /usr/bin/perl is the Sun version, and I'm concerned that there > might be a perl script that ships with the OS that isn't compatibile > with /dcs/bin/perl. > > /bin and /usr/bin are the same directory usually on most Sun's. > > Would it be sufficient to make sure the $PATH as known by MailScanner > does not include /dcs/bin/perl? > > Thanks! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From strombrg at DCS.NAC.UCI.EDU Mon Oct 17 21:29:37 2005 From: strombrg at DCS.NAC.UCI.EDU (Dan Stromberg) Date: Thu Jan 12 21:30:58 2006 Subject: spam filtering ceased Message-ID: LOL :) I used to do this stuff without thinking that much about it, like copying a tcsh overtop of an Ultrix system's csh, but then I got chewed out by a senior admin... On Mon, 2005-10-17 at 15:25 -0400, Jeff A. Earickson wrote: > Hi, > > FWIW, when I cold-install Solaris 9 or 10 onto a system, I don't > install either the SUNW perl packages, the SUNW sendmail package, > or some other unwanted packages (like apache). You don't need > them for the OS to work properly, and they are out-of-date relative > to the public-domain releases anyway. Then I install the > public-domain versions. > > Come on, be brave. Do a "cp /dcs/bin/perl /dcs/bin/perl.orig" to > CYA before replacing with a symlink. > > Jeff Earickson > Colby College > > On Mon, 17 Oct 2005, Dan Stromberg wrote: > > > Date: Mon, 17 Oct 2005 12:08:59 -0700 > > From: Dan Stromberg > > Reply-To: MailScanner mailing list > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: spam filtering ceased > > > > On Sun, 2005-10-16 at 11:20 +0100, Julian Field wrote: > > > >> By default, MailScanner will always use /usr/bin/perl. But anything that > >> looks for perl in your path may well pick up /dcs/bin/perl. Having these > >> 2 different is very dangerous and the cause of a whole host of problems. > >> Consider replacing /usr/bin/perl with a link to /dcs/bin/perl. And who > >> put perl in /bin? It doesn't belong there. > > > > Hi Julian. > > > > Thanks for your comments. > > > > I'm reluctant to replace /usr/bin/perl with a symlink to /dcs/bin/perl, > > because /usr/bin/perl is the Sun version, and I'm concerned that there > > might be a perl script that ships with the OS that isn't compatibile > > with /dcs/bin/perl. > > > > /bin and /usr/bin are the same directory usually on most Sun's. > > > > Would it be sufficient to make sure the $PATH as known by MailScanner > > does not include /dcs/bin/perl? > > > > Thanks! > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cparker at SWATGEAR.COM Mon Oct 17 21:57:25 2005 From: cparker at SWATGEAR.COM (Chris W. Parker) Date: Thu Jan 12 21:30:58 2006 Subject: New MS install is acting very strangely (misconfiguration somewhere) Message-ID: Denis Beauchemin on Monday, October 17, 2005 11:18 AM said: > Why don't you start sendmail with this parameter: > -oQ/var/spool/mqueue.out (or -OQueueDirectory=/var/spool/mqueue.out) > > Look into /etc/init.d/MailScanner (if you are on a Linux box) for: > $SENDMAIL $([ -n "$QUEUETIME" ] && echo -q$QUEUETIME) \ > -OPidFile=$OUTPID I decided to just go with the default directory instead and get used to it. Mail is flowing properly now. Thanks, Chris. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From gdoris at ROGERS.COM Mon Oct 17 22:50:01 2005 From: gdoris at ROGERS.COM (Gerry Doris) Date: Thu Jan 12 21:30:58 2006 Subject: Mailwatch &SQLWhitelist Message-ID: On Mon, 2005-10-17 at 08:28 -0700, Scott Silva wrote: > Dean Maluski spake the following on 10/15/2005 8:35 AM: > > I just got mailwatch working, sortof. > > I altered /etc/MailScanner.conf > > to support > > Is Definitely Spam = &SQLBlacklist and > > > > Is Definitely Not Spam = &SQLWhitelist. > > I added a test sender to SQLblacklist via web interface and sure enough > > it worked. I also have been creating whitelist entries. > > Those don't seem to be working. At least they are not showing up in > > weblist as green. > > I will have to sift through instructions again but I think that > > whitelist would work tyhe same as blacklist without any major changes or > > something I did that was stupid possibly. > > > Try and restart MailScanner and tail -f the maillog. You can look for > the startup loading of the black and whitelists to see if the whitelist > is loading. If blacklists are working, I would think that either there > is a typo in MailScanner.conf, or invalid whitelist entries. > For instance, you can not wildcard a domain with "@somedomain.com" > because the ampersand seems to be invalid if not in a single address. > "user@somedomain.com" is valid, but for an entire domain you need > "somedomain.com". > Also look for another "Is Definitely Not Spam =" entry that is not > commented out. > As a follow up question... Can you enable both the MailScanner whitelist/blacklist and the MailWatch SQLWhite/Black lists at the same time. I've been using MailScanner's whitelist/blacklists for some time now but it is convenient to be able to just click on email in MailWatch to add it to the SQL lists. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From vinet138 at YAHOO.COM Mon Oct 17 22:53:03 2005 From: vinet138 at YAHOO.COM (Bill Smith) Date: Thu Jan 12 21:30:58 2006 Subject: dcc-dccproc Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi Guys, I have been to this site http://www.rhyolite.com/anti-spam/dcc/ and find it impossible to find dcc-dccproc.tar.Z Can anyone send me the absolute link please. Cheers, Bill ________________________________________________________________________________ Yahoo! Music Unlimited - Access over 1 million songs. Try it free. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Mon Oct 17 23:25:37 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:30:58 2006 Subject: dcc-dccproc Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Bill Smith wrote: > Hi Guys, > > I have been to this site http://www.rhyolite.com/anti-spam/dcc/ and find > it impossible to find dcc-dccproc.tar.Z > Can anyone send me the absolute link please. > Are you sure that's what you want? The fact that there's no link to the package, and only a link to dcc.tar.Z suggests that they want to discourage people from just getting the dccproc package, and want people to get the whole dcc package instead. If it's really what you want, you can get it at: http://www.rhyolite.com/anti-spam/dcc/source/dcc-dccproc.tar.Z ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Mon Oct 17 23:22:59 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:58 2006 Subject: Mailwatch &SQLWhitelist Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Gerry Doris spake the following on 10/17/2005 2:50 PM: > On Mon, 2005-10-17 at 08:28 -0700, Scott Silva wrote: > >>Dean Maluski spake the following on 10/15/2005 8:35 AM: >> >>>I just got mailwatch working, sortof. >>>I altered /etc/MailScanner.conf >>>to support >>>Is Definitely Spam = &SQLBlacklist and >>> >>>Is Definitely Not Spam = &SQLWhitelist. >>>I added a test sender to SQLblacklist via web interface and sure enough >>>it worked. I also have been creating whitelist entries. >>>Those don't seem to be working. At least they are not showing up in >>>weblist as green. >>>I will have to sift through instructions again but I think that >>>whitelist would work tyhe same as blacklist without any major changes or >>>something I did that was stupid possibly. >>> >> >>Try and restart MailScanner and tail -f the maillog. You can look for >>the startup loading of the black and whitelists to see if the whitelist >>is loading. If blacklists are working, I would think that either there >>is a typo in MailScanner.conf, or invalid whitelist entries. >>For instance, you can not wildcard a domain with "@somedomain.com" >>because the ampersand seems to be invalid if not in a single address. >>"user@somedomain.com" is valid, but for an entire domain you need >>"somedomain.com". >>Also look for another "Is Definitely Not Spam =" entry that is not >>commented out. >> > > As a follow up question... > > Can you enable both the MailScanner whitelist/blacklist and the > MailWatch SQLWhite/Black lists at the same time. > > I've been using MailScanner's whitelist/blacklists for some time now but > it is convenient to be able to just click on email in MailWatch to add > it to the SQL lists. > AFAIK it is one or the other, but you could manually add the entries from MailScanners files if you need them. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Mon Oct 17 23:24:56 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:58 2006 Subject: dcc-dccproc Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Bill Smith spake the following on 10/17/2005 2:53 PM: > Hi Guys, > > I have been to this site http://www.rhyolite.com/anti-spam/dcc/ and find > it impossible to find dcc-dccproc.tar.Z > Can anyone send me the absolute link please. > > Cheers, > > Bill > > ------------------------------------------------------------------------ > Yahoo! Music Unlimited - Access over 1 million songs. Try it free. > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* http://www.rhyolite.com/anti-spam/dcc/source/dcc.tar.Z All source is in the tarball. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From raymond at PROLOCATION.NET Mon Oct 17 23:50:07 2005 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:30:58 2006 Subject: dcc-dccproc Message-ID: Hi! > I have been to this site http://www.rhyolite.com/anti-spam/dcc/ and find it impossible to find dcc-dccproc.tar.Z > Can anyone send me the absolute link please. Did you ever hear about google. Its really usefull, you should try it. cough cough. http://www.rhyolite.com/anti-spam/dcc/source/dcc-dccproc.tar.Z Bye, Raymond. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Tue Oct 18 00:05:58 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:58 2006 Subject: dcc-dccproc Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Raymond Dijkxhoorn spake the following on 10/17/2005 3:50 PM: > Hi! > >> I have been to this site http://www.rhyolite.com/anti-spam/dcc/ and >> find it impossible to find dcc-dccproc.tar.Z >> Can anyone send me the absolute link please. > > > Did you ever hear about google. Its really usefull, you should try it. > cough cough. > > http://www.rhyolite.com/anti-spam/dcc/source/dcc-dccproc.tar.Z > > Bye, > Raymond. > Moot point as all links get the same source tarball. Just different names. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Tue Oct 18 00:09:53 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:58 2006 Subject: Mailwatch &SQLWhitelist Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Scott Silva spake the following on 10/17/2005 3:22 PM: > Gerry Doris spake the following on 10/17/2005 2:50 PM: > >>On Mon, 2005-10-17 at 08:28 -0700, Scott Silva wrote: >> >> >>>Dean Maluski spake the following on 10/15/2005 8:35 AM: >>> >>> >>>>I just got mailwatch working, sortof. >>>>I altered /etc/MailScanner.conf >>>>to support >>>>Is Definitely Spam = &SQLBlacklist and >>>> >>>>Is Definitely Not Spam = &SQLWhitelist. >>>>I added a test sender to SQLblacklist via web interface and sure enough >>>>it worked. I also have been creating whitelist entries. >>>>Those don't seem to be working. At least they are not showing up in >>>>weblist as green. >>>>I will have to sift through instructions again but I think that >>>>whitelist would work tyhe same as blacklist without any major changes or >>>>something I did that was stupid possibly. >>>> >>> >>>Try and restart MailScanner and tail -f the maillog. You can look for >>>the startup loading of the black and whitelists to see if the whitelist >>>is loading. If blacklists are working, I would think that either there >>>is a typo in MailScanner.conf, or invalid whitelist entries. >>>For instance, you can not wildcard a domain with "@somedomain.com" >>>because the ampersand seems to be invalid if not in a single address. >>>"user@somedomain.com" is valid, but for an entire domain you need >>>"somedomain.com". >>>Also look for another "Is Definitely Not Spam =" entry that is not >>>commented out. >>> >> >>As a follow up question... >> >>Can you enable both the MailScanner whitelist/blacklist and the >>MailWatch SQLWhite/Black lists at the same time. >> >>I've been using MailScanner's whitelist/blacklists for some time now but >>it is convenient to be able to just click on email in MailWatch to add >>it to the SQL lists. >> > > AFAIK it is one or the other, but you could manually add the entries > from MailScanners files if you need them. > > But I think you could enable the SQLBlacklist and the MailScanner Whitelist, or the SQLWhitelist and MailScanner Blacklist. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dmaluski at n1ety.com Tue Oct 18 01:46:35 2005 From: dmaluski at n1ety.com (Dean Maluski) Date: Thu Jan 12 21:30:58 2006 Subject: Mailwatch &SQLWhitelist Message-ID: On Mon, 2005-10-17 at 17:50, Gerry Doris wrote: > On Mon, 2005-10-17 at 08:28 -0700, Scott Silva wrote: > > Dean Maluski spake the following on 10/15/2005 8:35 AM: > > > I just got mailwatch working, sortof. > > > I altered /etc/MailScanner.conf > > > to support > > > Is Definitely Spam = &SQLBlacklist and > > > > > > Is Definitely Not Spam = &SQLWhitelist. > > > I added a test sender to SQLblacklist via web interface and sure enough > > > it worked. I also have been creating whitelist entries. > > > Those don't seem to be working. At least they are not showing up in > > > weblist as green. > > > I will have to sift through instructions again but I think that > > > whitelist would work tyhe same as blacklist without any major changes or > > > something I did that was stupid possibly. > > > > > Try and restart MailScanner and tail -f the maillog. You can look for > > the startup loading of the black and whitelists to see if the whitelist > > is loading. If blacklists are working, I would think that either there > > is a typo in MailScanner.conf, or invalid whitelist entries. > > For instance, you can not wildcard a domain with "@somedomain.com" > > because the ampersand seems to be invalid if not in a single address. > > "user@somedomain.com" is valid, but for an entire domain you need > > "somedomain.com". > > Also look for another "Is Definitely Not Spam =" entry that is not > > commented out. > > > As a follow up question... > > Can you enable both the MailScanner whitelist/blacklist and the > MailWatch SQLWhite/Black lists at the same time. > > I've been using MailScanner's whitelist/blacklists for some time now but > it is convenient to be able to just click on email in MailWatch to add > it to the SQL lists. > Yesterday after I rebooted mailscanner was working fine, I did a grep of log and it seemed OK but I wasn't getting any updates in mailwatch list. I put it aside as I had other things to do. Last night when I got back to it everything was working fine and has been all day today. I'll play around with various whitelist and blacklist settings and let you know. For now they are both OK using sql setting on both. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jflowers at EZO.NET Tue Oct 18 02:50:15 2005 From: jflowers at EZO.NET (Jim Flowers) Date: Thu Jan 12 21:30:58 2006 Subject: Bus Faults Error 10 with Perl Message-ID: I have a 4.42.9 MailScanner setup on a FreeBSD 5.4-RELEASE system that has just quit working after several months without a problem. It just stops processing every couple of hours with no errors indicated in the logs. Restarting MailScanner starts it working again. It has also started throwing bus-fault errors when it is running: Oct 17 10:49:58 mxgf1 kernel: pid 85142 (perl5.8.6), uid 0: exited on signal 10 pid 85142 is a child of a current Mailscanner process 84516: 84516 ?? S 0:05.06 /usr/bin/perl -I/usr/local/lib/MailScanner /usr/local/libexec/MailScanner/MailScanner /usr/local/etc/MailScanner/MailScanner.conf (perl5.8.6) and in terminating prematurely, it leaves a work file: -rw------- 1 root wheel 91387 Oct 17 10:49 /tmp/spamassassin.85142.xbLbt4.tmp Although signal 10 specifies a bus fault with a core dump, there is no sign of a .core file anywhere. Rebuilding and reinstalling perl did not resolve the problem. Although modified for MailWatch, that functionality is working correctly and returning to the unmodified version still has the same problem. Is there any reason to expect that this problem is hardware related or is it more likely to be something that changed in the execution of the child spawned by the MailScanner Perl script? Where should I look in troubleshooting this further? Thank you. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Oct 18 08:55:50 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:58 2006 Subject: clamav-wrapper bash:not found. Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Yes. As someone else said, you should always upgrade your virus scanners by calling update_virus_scanners, don't ever call the autoupdate script yourself, you will probably get the command line wrong. On 17 Oct 2005, at 19:42, JD Doelitzsch wrote: > Sorry, I made a typo. I meant /usr/local/bin which is where > clamscan and > freshclam resides, not lib. If i change to /usr/local does the script > automatically look in */bin? > > -JD > > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On > Behalf Of Julian Field > Sent: Monday, October 17, 2005 11:22 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: clamav-wrapper bash:not found. > > > * PGP Bad Signature, Signed by a unverified key: 10/17/05 at 19:21:41 > > Change it to /usr/local and not /usr/local/lib. > > JD Doelitzsch wrote: > > >> Im using Fedora 4 just installed clamav and MailScanner, and I >> updated the >> virus.scanners.conf to reflect the clamav installation in /usr/ >> local/lib >> > for > >> clamscan etc. The clamav-wrapper is still giving me the not found >> error. >> > Any > >> other references im missing? Clamscan works fine by the way. >> >> -JD >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> >> > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > * Julian Field > * 0x1415B654 - Unverified (L) > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ1SqiPw32o+k+q+hAQEVYQgAkUS4zRRxC4wFu9Fjyl3LetR/wgcFagmT GIBMIHzwhics6s1GzzoEaNozjB1K+CKa11pF04/rwCBU9j2owI0hxBBlNAUANEnk kLf+kd8e8VIvzpoEL13dviQ4gUmcH6DxBobOlGXzHVLTeibE0NkCCKE5JISYuAQo QlHz2wMu8+zTtDp0VVmzZ7S+1CrgqdeKhqkA383hYx0vJ40u7L9yQiRpV1C9qBmV p4UYCxieBBB18s6/RptIMdzgtNcaOOCLFg2loUaBcPsdAf6q9nshZZNiWSUnG0mS 8oJxR08wCrG5zSdp2vTox1WsYscrd35lmxpEsVgXMO3amISbaojslg== =pj1j -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From tac.forums at GMAIL.COM Tue Oct 18 12:23:31 2005 From: tac.forums at GMAIL.COM (TAC Forums) Date: Thu Jan 12 21:30:58 2006 Subject: Feature request to make the 'archive mail' fuction smarter. :-) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi Not sure if there is a way to solve this problem, but any ideas would be welcome. :-) We've enabled a feature in MailScanner called 'Archive Mail' which is forwarded to an e-mail ID.... say ABC@domain.com However, if someone send an email TO a person, say X and a copy CC to Y, then the ID ABC@domain.com receives two copies. Is there a way the system can figure out that actually just one archive copy is sufficient since it's the same message being sent to two different people on the same server. Regards -- TAC Support Team ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Tue Oct 18 13:13:03 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:58 2006 Subject: Bus Faults Error 10 with Perl Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 18/10/05, Jim Flowers wrote: > I have a 4.42.9 MailScanner setup on a FreeBSD 5.4-RELEASE system that has > just quit working after several months without a problem. It just stops > processing every couple of hours with no errors indicated in the logs. > Restarting MailScanner starts it working again. > > It has also started throwing bus-fault errors when it is running: > > Oct 17 10:49:58 mxgf1 kernel: pid 85142 (perl5.8.6), uid 0: exited on signal 10 > > pid 85142 is a child of a current Mailscanner process 84516: > > 84516 ?? S 0:05.06 /usr/bin/perl -I/usr/local/lib/MailScanner > /usr/local/libexec/MailScanner/MailScanner > /usr/local/etc/MailScanner/MailScanner.conf (perl5.8.6) > > and in terminating prematurely, it leaves a work file: > > -rw------- 1 root wheel 91387 Oct 17 10:49 > /tmp/spamassassin.85142.xbLbt4.tmp > > Although signal 10 specifies a bus fault with a core dump, there is no sign > of a .core file anywhere. Rebuilding and reinstalling perl did not resolve > the problem. > > Although modified for MailWatch, that functionality is working correctly and > returning to the unmodified version still has the same problem. > > Is there any reason to expect that this problem is hardware related or is it > more likely to be something that changed in the execution of the child > spawned by the MailScanner Perl script? > > Where should I look in troubleshooting this further? > > Thank you. > Just a bit of general advice: As you know, bus errors in just means that an attempt was (incorrectly) made to write to read-only memory (while a segment violation means you're trying to write to someone elses memory). So to answer your last question first... Yes. It might be bad hardware (memory likely, or possibly a swaparea going bad), but then you might be seeing this for other processes... Use a memory tester (like memtest86, if you're on that type of HW), it's cheaper than replacing all the memory (the Big Blue way of doing service:-). If the tester OKs the memory, you can move on to the more likely culprit(s)... Either the program (perl? An AV-child?) or a lib it depends on have been updated to a ... bum version... Look hard at all the components and all the updates you did at the time it started happening. As to why you don't get cores... well, do you allow corefiles for the user in question? -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Tue Oct 18 13:22:47 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:58 2006 Subject: Feature request to make the 'archive mail' fuction smarter. :-) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 18/10/05, TAC Forums wrote: > Hi > > Not sure if there is a way to solve this problem, but any ideas would > be welcome. :-) > > We've enabled a feature in MailScanner called 'Archive Mail' which is > forwarded to an e-mail ID.... say ABC@domain.com > > However, if someone send an email TO a person, say X and a copy CC to > Y, then the ID ABC@domain.com receives two copies. > > Is there a way the system can figure out that actually just one > archive copy is sufficient since it's the same message being sent to > two different people on the same server. > > Regards > -- > TAC Support Team How could it? The splitting is done *well before MS gets it*... Sure, for a mailstore server of some kind, like M-Sexchange, it's rather simple to determine this (although I'm pretty sure that M-Sex doesn't do this... The mails end up in different mailstores after all), but that is not what you've got here. MS don't have any "memory" to speak of:-). -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner-user at NELAND.DK Tue Oct 18 16:06:00 2005 From: mailscanner-user at NELAND.DK (Leif Neland) Date: Thu Jan 12 21:30:58 2006 Subject: Feature request to make the 'archive mail' fuction smarter. :-) Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] ---- Original Message ---- From: "TAC Forums" To: Sent: Tuesday, October 18, 2005 1:23 PM Subject: Feature request to make the 'archive mail' fuction smarter. :-) > Hi > > Not sure if there is a way to solve this problem, but any ideas would > be welcome. :-) > > We've enabled a feature in MailScanner called 'Archive Mail' which is > forwarded to an e-mail ID.... say ABC@domain.com > > However, if someone send an email TO a person, say X and a copy CC to > Y, then the ID ABC@domain.com receives two copies. Serves him right for snooping in other peoples mail :-) Anyway, perhaps the Archive Mail line in MailScanner.cfg could be made a custom function, which looked up the message-id in the MailWatch database (or its own database) and returned "none" if the message-id had been seen before. (Not sure if the mail is logged to the MailWatch database at once, or at the end of the batch. If the latter is the case, it wouldn't work, as the duplicate messages are most probably in the same batch) Leif ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From a.peacock at CHIME.UCL.AC.UK Tue Oct 18 16:35:07 2005 From: a.peacock at CHIME.UCL.AC.UK (Anthony Peacock) Date: Thu Jan 12 21:30:58 2006 Subject: SpamAssassin and SQL Message-ID: Hi, Those configuration options are considered privileged settings by SpamAssassin, and as such cannot be set in a user preferences config file. The MailScanner file 'spam.assassin.prefs.conf' effectively acts like the SpamAssassin user preferences file for the MailScanner process. These settings need to be set in the SpamAssassin local.cf file which is usually found in /etc/mail/spamassassin. > I would like to know if its possible to make the MailScanner read the > user configurations in the spamassassin via sql. > I put in the spam.assassin.prefs.conf to maje it call the sql. > > > user_scores_dsn DBI:mysql:antispam:localhost > user_scores_sql_username antispam > user_scores_sql_password xxxxx > > but it keeps ignoring it. > > In the Amavis, I can run it without problems. But I hate Amavis. I > love MailScanner :) > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. Before posting, read the Wiki > (http://wiki.mailscanner.info/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Anthony Peacock CHIME, Royal Free & University College Medical School WWW: http://www.chime.ucl.ac.uk/~rmhiajp/ "In the beginning of a change, the patriot is a brave and scarce man, hated and scorned. When the cause succeeds, however, the timid join him...for then it costs nothing to be a patriot." -Mark Twain ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Tue Oct 18 16:43:56 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:58 2006 Subject: Feature request to make the 'archive mail' fuction smarter. :-) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 18/10/05, Leif Neland wrote: > ---- Original Message ---- > From: "TAC Forums" > To: > Sent: Tuesday, October 18, 2005 1:23 PM > Subject: Feature request to make the 'archive mail' fuction smarter. :-) > > > Hi > > > > Not sure if there is a way to solve this problem, but any ideas would > > be welcome. :-) > > > > We've enabled a feature in MailScanner called 'Archive Mail' which is > > forwarded to an e-mail ID.... say ABC@domain.com > > > > However, if someone send an email TO a person, say X and a copy CC to > > Y, then the ID ABC@domain.com receives two copies. > > Serves him right for snooping in other peoples mail :-) > > Anyway, perhaps the Archive Mail line in MailScanner.cfg could be made a > custom function, which looked up the message-id in the MailWatch database > (or its own database) and returned "none" if the message-id had been seen > before. > > (Not sure if the mail is logged to the MailWatch database at once, or at the > end of the batch. If the latter is the case, it wouldn't work, as the > duplicate messages are most probably in the same batch) > > Leif > End of the batch I'd imagine, from the "looked up last" thing:-). -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From algorges at GMAIL.COM Tue Oct 18 17:30:51 2005 From: algorges at GMAIL.COM (ASA) Date: Thu Jan 12 21:30:58 2006 Subject: SpamAssassin and SQL Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I would like to know if its possible to make the MailScanner read the user configurations in the spamassassin via sql. I put in the spam.assassin.prefs.conf to maje it call the sql. user_scores_dsn DBI:mysql:antispam:localhost user_scores_sql_username antispam user_scores_sql_password xxxxx but it keeps ignoring it. In the Amavis, I can run it without problems. But I hate Amavis. I love MailScanner :) ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Oct 18 18:23:59 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:58 2006 Subject: Fwd: Abwesenheitsnotiz: Bus Faults Error 10 with Perl Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have temporarily disabled his list delivery. He will receive a notification that this was done, and so he can enable it again when he returns. Glenn Steen wrote: >Hi Jules, > >Could you zap Mr Lotter a bit with that sweet little LART? >Or just bump him off the list. > >---------- Forwarded message ---------- >From: Lotter, Albrecht (LNG-MUE) >Date: 18-Oct-2005 14:14 >Subject: Abwesenheitsnotiz: Bus Faults Error 10 with Perl >To: Glenn Steen > > >I'm out of the office until 23rd of October with limited acesss to my email. >If you need immediate attention please contact Paul Homann, -337. > >### German ### > >Ich bin bis 23. Oktober außer Haus und habe nur eingeschränkten Zugriff auf >meine E-Mail. Bitte wenden sie sich in dringenden Fällen an Paul Homann, >-337 > > > >-- >-- Glenn >email: glenn < dot > steen < at > gmail < dot > com >work: glenn < dot > steen < at > ap1 < dot > se > > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQ1UvsBH2WUcUFbZUEQIcVwCfQMJGZrplak2ORW+OF9pJdEGUHpkAoMDM H+YuUpoH1a6zVTz8/VYhN7Zm =fmDW -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Tue Oct 18 19:07:28 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:58 2006 Subject: Fwd: Abwesenheitsnotiz: Bus Faults Error 10 with Perl Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field spake the following on 10/18/2005 10:23 AM: > I have temporarily disabled his list delivery. He will receive a > notification that this was done, and so he can enable it again when he > returns. > > Glenn Steen wrote: > > >>>Hi Jules, >>> >>>Could you zap Mr Lotter a bit with that sweet little LART? >>>Or just bump him off the list. One of the advantages of reading through GMANE. It seems to kill all the vacation messages. Now if it would just post faster.... -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From strombrg at DCS.NAC.UCI.EDU Tue Oct 18 19:45:57 2005 From: strombrg at DCS.NAC.UCI.EDU (Dan Stromberg) Date: Thu Jan 12 21:30:58 2006 Subject: Fwd: Abwesenheitsnotiz: Bus Faults Error 10 with Perl Message-ID: On Tue, 2005-10-18 at 11:07 -0700, Scott Silva wrote: > Julian Field spake the following on 10/18/2005 10:23 AM: > > I have temporarily disabled his list delivery. He will receive a > > notification that this was done, and so he can enable it again when he > > returns. > > > > Glenn Steen wrote: > > > > > >>>Hi Jules, > >>> > >>>Could you zap Mr Lotter a bit with that sweet little LART? > >>>Or just bump him off the list. > > One of the advantages of reading through GMANE. It seems to kill all the > vacation messages. > Now if it would just post faster.... Interesting. I tried to use this list through gmane before I subscribed recently, but I got a bounce from the list saying that whatever address gmane wanted to use for posting wasn't subscribed. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Tue Oct 18 19:56:18 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:30:58 2006 Subject: Fwd: Abwesenheitsnotiz: Bus Faults Error 10 with Perl Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dan Stromberg spake the following on 10/18/2005 11:45 AM: > On Tue, 2005-10-18 at 11:07 -0700, Scott Silva wrote: > >>Julian Field spake the following on 10/18/2005 10:23 AM: >> >>>I have temporarily disabled his list delivery. He will receive a >>>notification that this was done, and so he can enable it again when he >>>returns. >>> >>>Glenn Steen wrote: >>> >>> >>> >>>>>Hi Jules, >>>>> >>>>>Could you zap Mr Lotter a bit with that sweet little LART? >>>>>Or just bump him off the list. >> >>One of the advantages of reading through GMANE. It seems to kill all the >>vacation messages. >>Now if it would just post faster.... > > > Interesting. > > I tried to use this list through gmane before I subscribed recently, but > I got a bounce from the list saying that whatever address gmane wanted > to use for posting wasn't subscribed. > You have to subscribe, and then turn off mail after. That way you can post. If you are just lurking, you don't have to subscribe. -- /-----------------------\ |~~\_____/~~\__ | | MailScanner; The best |___________ \N1____====== )-+ | protection on the net!| ~~~|/~~ | \-----------------------/ () ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jflowers at EZO.NET Tue Oct 18 20:14:35 2005 From: jflowers at EZO.NET (Jim Flowers) Date: Thu Jan 12 21:30:58 2006 Subject: Bus Faults Error 10 with Perl Message-ID: Additional Information ---------------------- 1. Disabling SpamAssassin eliminates the bus fault error. 2. Enabling Spamassassin with DCC, Razor, Pyzor turned off still has the bus fault error. 3. Rebuilding Perl 5.8.6, and upgrading SpamAssasin to 3.1.0, MailScanner to 4.44.6 did not eliminate the bus fault errors. 4. Upgrading to Perl 5.8.7 and reinstalling all the perl modules did not eliminate the bus fault errors. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Tue Oct 18 21:16:52 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:58 2006 Subject: Bus Faults Error 10 with Perl Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 18/10/05, Jim Flowers wrote: > Additional Information > ---------------------- > 1. Disabling SpamAssassin eliminates the bus fault error. > > 2. Enabling Spamassassin with DCC, Razor, Pyzor turned off still has the bus > fault error. > > 3. Rebuilding Perl 5.8.6, and upgrading SpamAssasin to 3.1.0, MailScanner to > 4.44.6 did not eliminate the bus fault errors. > > 4. Upgrading to Perl 5.8.7 and reinstalling all the perl modules did not > eliminate the bus fault errors. > Hmmm, (wild guess) could it perhaps be related to the resolver/DNS? I presume you've checked that you've only got one SA(?)... I think you're on the right track though... Just a question of continuing with SA troubleshooting (mainly "turning things off" (worst case, rule by rule) and seeing when the SIGBUSes stop). The above pretty much rules out HW, but I think you knew that too:-). Then again, running some memory tester periodically is not a _bad_ idea. -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jflowers at EZO.NET Tue Oct 18 21:30:45 2005 From: jflowers at EZO.NET (Jim Flowers) Date: Thu Jan 12 21:30:58 2006 Subject: Bus Faults Error 10 with Perl Message-ID: Forgot to mention: Ran the memtest86 1 pass with no errors. One significant thing, I am running a sister ship that is (or was) an exact duplicate via dump/restore with identical hardware that has never had these kinds of problems. I think maybe recloning the disk before doing a rule-by-rule debug. Incidently, thanks for the response. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From naolson at GMAIL.COM Tue Oct 18 22:27:56 2005 From: naolson at GMAIL.COM (Nathan Olson) Date: Thu Jan 12 21:30:58 2006 Subject: Bus Faults Error 10 with Perl Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] 1 pass is often not enough to catch bad memory. Nate ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From craig at WESTPRESS.COM Tue Oct 18 22:36:13 2005 From: craig at WESTPRESS.COM (Craig Daters) Date: Thu Jan 12 21:30:58 2006 Subject: Turn off "{Spam not delivered}" messages? Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I am going crazy! I cannot locate which directive shuts off the "{Spam not delivered}" message to recipients when they receive spam? I have gone through MailScanner.conf time and time again, and I know I am passing over it every time. Could someone please slap me across the face or something? :) - --- Craig Daters (craig@westpress.com) Systems Administrator West Press 1663 West Grant Road Tucson, Arizona 85745 (520) 624-4939 x208 (520) 624-2715 fax www.westpress.com -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBQ1Vq3BBVT8XLuTbnEQJ0tQCg6fzMjm9MTsaHdTQ905zp5m62LP4An0oZ ioOjkKE+xyL+iaP1FpHbIybm =cjS/ -----END PGP SIGNATURE----- -- Please note: It is the policy of West Press that all e-mail sent to and from any @westpress.com address may be recorded and monitored. Unless it is West Press related business, please do not send any material of a private, personal, or confidential nature to this or any @westpress.com e-mail address. This message has been scanned for UCE (spam), viruses, and dangerous content, and is believed to be clean ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lists at HBCS.ORG Wed Oct 19 00:10:30 2005 From: lists at HBCS.ORG (Dave Coults) Date: Thu Jan 12 21:30:58 2006 Subject: Turn off "{Spam not delivered}" messages? Message-ID: On Tue, 18 Oct 2005 14:36:13 -0700, Craig Daters wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >I am going crazy! I cannot locate which directive shuts off the "{Spam >not delivered}" message to recipients when they receive spam? I have >gone through MailScanner.conf time and time again, and I know I am >passing over it every time. Could someone please slap me across the >face or something? :) If it's being sent to whom the spam was intended for, it's in the "What to do with spam" section - "Spam Actions". > >- --- >Craig Daters (craig@westpress.com) >Systems Administrator Dave C NetAdmin ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Wed Oct 19 02:36:35 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:58 2006 Subject: Turn off "{Spam not delivered}" messages? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dave Coults wrote: > On Tue, 18 Oct 2005 14:36:13 -0700, Craig Daters wrote: > >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> I am going crazy! I cannot locate which directive shuts off the "{Spam >> not delivered}" message to recipients when they receive spam? I have >> gone through MailScanner.conf time and time again, and I know I am >> passing over it every time. Could someone please slap me across the >> face or something? :) > > If it's being sent to whom the spam was intended for, it's in the "What to > do with spam" section - "Spam Actions". Or the "High Scoring Spam Actions" > >> - --- >> Craig Daters (craig@westpress.com) >> Systems Administrator > > Dave C > NetAdmin > -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Wed Oct 19 09:13:02 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:58 2006 Subject: Turn off "{Spam not delivered}" messages? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 18/10/05, Craig Daters wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > I am going crazy! I cannot locate which directive shuts off the "{Spam > not delivered}" message to recipients when they receive spam? I have > gone through MailScanner.conf time and time again, and I know I am > passing over it every time. Could someone please slap me across the > face or something? :) > If it's just the change to the subject line, I imagine the section about "Changes to the Subject: line" is where you should be looking;) -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From t.d.lee at DURHAM.AC.UK Wed Oct 19 12:41:31 2005 From: t.d.lee at DURHAM.AC.UK (David Lee) Date: Thu Jan 12 21:30:58 2006 Subject: phishing whitelist via DNS Message-ID: Julian: Last week we briefly discussed the possibility of doing the "phishing.safe.sites.conf" information via DNS, so that it could be maintained between releases and also follow more closely the methodology of RBL blacklists. I have cobbled together a quick "proof of concept" implementation: 1. loaded our DNS with data derived from a recent copy of the file; 2. patched "Message.pm" ("InPhishingWhitelist" subroutine; based on 4.47.1); 3. written a little driver program to call "InPhishingWhitelist" (loops on stdin: the domain name to be checked). Doubtless it needs more work (it doesn't yet handle the subtlety of a couple of ":81"-like entries in your data; you would probably want to rework it for interaction with the "REMOVE" option). And certainly the DNS zonename would have to change (something under "mailscanner.info"?). Attached are the Message.pm patch and the driver program. (The DNS data should, of course, be visible via DNS.) Enjoy. -- : David Lee I.T. Service : : Senior Systems Programmer Computer Centre : : Durham University : : http://www.dur.ac.uk/t.d.lee/ South Road : : Durham DH1 3LE : : Phone: +44 191 334 2752 U.K. : ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "Message.pm patch" Text/PLAIN (Name: "Message.pm.patch") ] [ 32 lines. ] [ Unable to print this part. ] [ Part 3, "Driver program" Text/PLAIN (Name: "test.pl") 6 lines. ] [ Unable to print this part. ] From ugob at CAMO-ROUTE.COM Wed Oct 19 13:06:32 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:58 2006 Subject: Previous message Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Glenn Steen wrote: > On 18/10/05, Glenn Steen wrote: >> On 18/10/05, Ugo Bellavance wrote: >>> Hi Glenn, >>> >>> Sorry to send an "empty" message. >>> >>> That was revision 3 of my article. >>> >>> Thanks, >>> >>> -- >>> Ugo Bellavance >>> Administrateur de système/réseau >>> Camo-route inc. >>> Tél.: (514) 593-5811 / Télec.: (514) 593-5611 >>> Courriel: ugob@camo-route.com >>> Site web: http://www.camo-route.com >>> Placement en ligne: https://placement.emploiquebec.net/ >>> >> >> OK, here goes (I'll just put the comments in here.... I detest word, >> so I don't handle it that well, and all the changes might be made in >> (snippety-snip) > > Did you get the reply with my changes? Were they approximately in the > general direction you needed/wanted? Yes, absolutely. I just didn't have time to look at it in details yet. Thanks a lot, Ugo > Yeah, I'm a sucker for feedback:-) Eheh, Ugo ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Wed Oct 19 13:48:19 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:30:58 2006 Subject: Previous message Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ugo Bellavance wrote: > Glenn Steen wrote: >> On 18/10/05, Glenn Steen wrote: >>> On 18/10/05, Ugo Bellavance wrote: >>>> Hi Glenn, >>>> >>>> Sorry to send an "empty" message. >>>> >>>> That was revision 3 of my article. >>>> >>>> Thanks, >>>> >>>> -- >>>> Ugo Bellavance >>>> Administrateur de système/réseau >>>> Camo-route inc. >>>> Tél.: (514) 593-5811 / Télec.: (514) 593-5611 >>>> Courriel: ugob@camo-route.com >>>> Site web: http://www.camo-route.com >>>> Placement en ligne: https://placement.emploiquebec.net/ >>>> >>> OK, here goes (I'll just put the comments in here.... I detest word, >>> so I don't handle it that well, and all the changes might be made in >>> (snippety-snip) >> Did you get the reply with my changes? Were they approximately in the >> general direction you needed/wanted? > > Yes, absolutely. I just didn't have time to look at it in details yet. > > Thanks a lot, > > Ugo > >> Yeah, I'm a sucker for feedback:-) > > Eheh, > > Ugo > Hmmm, how come this reply ended up on the mailing list? Well, please just ignore this thread. Thanks, Ugo -- Ugo -> Please don't send a copy of your reply by e-mail. I read the list. -> Please avoid top-posting, long signatures and HTML, and cut the irrelevant parts in your replies. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From craig at WESTPRESS.COM Wed Oct 19 16:03:12 2005 From: craig at WESTPRESS.COM (Craig Daters) Date: Thu Jan 12 21:30:58 2006 Subject: Turn off "{Spam not delivered}" messages? Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Oct 18, 2005, at 2:36 PM, Craig Daters wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > I am going crazy! I cannot locate which directive shuts off the "{Spam > not delivered}" message to recipients when they receive spam? I have > gone through MailScanner.conf time and time again, and I know I am > passing over it every time. Could someone please slap me across the > face or something? :) Thanks for all your help guys. It was in the "Spam Actions" directive. I had appended a "notify" action at the end per a request from some employee. It is driving others crazy, so I guess I will have to put it into a ruleset. Though I have not heard anything from the "one" that I need to release anything, so maybe I'll just shut it off.... - - Craig - --- Craig Daters (craig@westpress.com) Systems Administrator West Press 1663 West Grant Road Tucson, Arizona 85745 (520) 624-4939 x208 (520) 624-2715 fax www.westpress.com -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBQ1ZgORBVT8XLuTbnEQL8qgCgow9yTfjLEqnuUZ3JVWvAYiRUXqsAn0v8 hf3GNbZ75An14CgzfhXG8i+v =ch+R -----END PGP SIGNATURE----- -- Please note: It is the policy of West Press that all e-mail sent to and from any @westpress.com address may be recorded and monitored. Unless it is West Press related business, please do not send any material of a private, personal, or confidential nature to this or any @westpress.com e-mail address. This message has been scanned for UCE (spam), viruses, and dangerous content, and is believed to be clean ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cparker at SWATGEAR.COM Wed Oct 19 18:02:17 2005 From: cparker at SWATGEAR.COM (Chris W. Parker) Date: Thu Jan 12 21:30:58 2006 Subject: "spam" with negative score. What settings do I need to change? Message-ID: Hello, I had an email come in today with a negative score of 2.60. I searched the archives and read that it's probably because the email was found on a (some) RBL(s). I think this is in fact the reason it was marked as spam. 1. If an email gets a negative score shouldn't it NOT be considered spam, even if it does reach 'Spam Lists To Be Spam = 1'? In this case it is a legitimate piece of mail that usually isn't found on the two lists (SORBS-DNSBL and SORBS-SPAM). 2. I can't be sure of why it got a negative spam score because it wasn't included in the mail headers and it's not in the maillog either. Notice below that the line that USUALLY shows the scores and rules that were tripped is cutoff. (I marked the line with ***) It just says "to swatgear.com is" and that's it. Oct 18 11:05:06 localhost sendmail[24018]: j9II55g5024018: from=, size=2188, class=0, nrcpts=1, msgid=, proto=ESMTP, daemon=MTA, relay=bay104-f34.bay104.hotmail.com [65.54.175.44] Oct 18 11:05:06 localhost sendmail[24018]: j9II55g5024018: to=, delay=00:00:01, mailer=esmtp, pri=32188, stat=queued Oct 18 11:05:11 localhost MailScanner[22139]: New Batch: Scanning 1 messages, 2683 bytes Oct 18 11:05:11 localhost MailScanner[22139]: Spam Checks: Starting Oct 18 11:05:14 localhost MailScanner[22139]: RBL checks: j9II55g5024018 found in SORBS-DNSBL, SORBS-SPAM *** Oct 18 11:05:17 localhost MailScanner[22139]: Message j9II55g5024018 from 65.54.175.44 (abc@hotmail.com) to swatgear.com is Oct 18 11:05:17 localhost MailScanner[22139]: Spam Checks: Found 1 spam messages Oct 18 11:05:17 localhost MailScanner[22139]: Spam Actions: message j9II55g5024018 actions are deliver Oct 18 11:05:18 localhost MailScanner[22139]: Virus and Content Scanning: Starting I've since whitelisted this email address in the hopes that even if it does get found in an RBL (or two or three) it will not have the spam message added to the subject. Is this true? And some output from 'MailScanner -v': This is CentOS release 4.1 (Final) This is Perl version 5.008005 (5.8.5) This is MailScanner version 4.46.2 Thanks! Chris. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Wed Oct 19 18:16:27 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:30:58 2006 Subject: "spam" with negative score. What settings do I need to change? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Chris W. Parker wrote: > Hello, > > I had an email come in today with a negative score of 2.60. I searched > the archives and read that it's probably because the email was found on > a (some) RBL(s). I think this is in fact the reason it was marked as > spam. Yes, spam lists in MailScanner.conf will cause the message to be marked as spam, no matter what the spamassassin score is. They are absolute. > > 1. If an email gets a negative score shouldn't it NOT be considered > spam, even if it does reach 'Spam Lists To Be Spam = 1'? In this case it > is a legitimate piece of mail that usually isn't found on the two lists > (SORBS-DNSBL and SORBS-SPAM). No. If you trust a DNSBL enough to use it as a MailScanner spam list, then you should trust it all the time. If the DNSBL isn't sufficiently accurate for you to trust it, it shouldn't be in the spam lists, instead it should be called by SA and factored into the score. > > 2. I can't be sure of why it got a negative spam score because it wasn't > included in the mail headers and it's not in the maillog either. Notice > below that the line that USUALLY shows the scores and rules that were > tripped is cutoff. (I marked the line with ***) It just says "to > swatgear.com is" and that's it. That's weird, but I don't know why that would happen. > I've since whitelisted this email address in the hopes that even if it > does get found in an RBL (or two or three) it will not have the spam > message added to the subject. Is this true? If you whitelisted it using MailScanner's whitelist, yes. If you used SpamAssassin's whitelist (whitelist_from, etc) then no. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Oct 19 18:23:20 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:58 2006 Subject: "spam" with negative score. What settings do I need to change? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Edit /usr/lib/MailScanner/MailScanner/RBLs.pm. Right at the bottom of the file, edit the last few lines so that they look like this: - -----SNIP----- # The return from the pipe is a measure of how spammy it was MailScanner::Log::InfoLog("RBL checks: %s found in %s", $message->{id}, join(', ', @HitList)) if @HitList && MailScanner::Config::Value('logspam'); MailScanner::Log::DebugLog("RBL Checks: returned $PipeReturn"); # No point actually using $PipeReturn, as we want to get a # useful result even when the child never reached its exit() #$PipeReturn = $PipeReturn>>8; # JKF 3/10/2005 my $temp = @HitList; $temp = $temp + 0; return ($temp, join(', ', @HitList)); } 1; - -----SNIP----- The new bit is the JKF 3/10/2005 bit. This gets around a Perl bug, the same one has happened several times before. This should fix it for you. Note that you will of course need to restart MailScanner after making this change. Before you do this, it is worth syntax-checking your new file to be sure you haven't missed a ";" or anything like that: perl -c RBLs.pm That shouldn't output anything much at all. If that is okay, then do a "service MailScanner restart". Chris W. Parker wrote: >Hello, > >I had an email come in today with a negative score of 2.60. I searched >the archives and read that it's probably because the email was found on >a (some) RBL(s). I think this is in fact the reason it was marked as >spam. > >1. If an email gets a negative score shouldn't it NOT be considered >spam, even if it does reach 'Spam Lists To Be Spam = 1'? In this case it >is a legitimate piece of mail that usually isn't found on the two lists >(SORBS-DNSBL and SORBS-SPAM). > >2. I can't be sure of why it got a negative spam score because it wasn't >included in the mail headers and it's not in the maillog either. Notice >below that the line that USUALLY shows the scores and rules that were >tripped is cutoff. (I marked the line with ***) It just says "to >swatgear.com is" and that's it. > >Oct 18 11:05:06 localhost sendmail[24018]: j9II55g5024018: >from=, size=2188, class=0, nrcpts=1, >msgid=10@phx.gbl>, proto=ESMTP, daemon=MTA, >relay=bay104-f34.bay104.hotmail.com [65.54.175.44] >Oct 18 11:05:06 localhost sendmail[24018]: j9II55g5024018: >to=, delay=00:00:01, mailer=esmtp, pri=32188, >stat=queued >Oct 18 11:05:11 localhost MailScanner[22139]: New Batch: Scanning 1 >messages, 2683 bytes >Oct 18 11:05:11 localhost MailScanner[22139]: Spam Checks: Starting >Oct 18 11:05:14 localhost MailScanner[22139]: RBL checks: j9II55g5024018 >found in SORBS-DNSBL, SORBS-SPAM >*** Oct 18 11:05:17 localhost MailScanner[22139]: Message j9II55g5024018 >from 65.54.175.44 (abc@hotmail.com) to swatgear.com is >Oct 18 11:05:17 localhost MailScanner[22139]: Spam Checks: Found 1 spam >messages >Oct 18 11:05:17 localhost MailScanner[22139]: Spam Actions: message >j9II55g5024018 actions are deliver >Oct 18 11:05:18 localhost MailScanner[22139]: Virus and Content >Scanning: Starting > >I've since whitelisted this email address in the hopes that even if it >does get found in an RBL (or two or three) it will not have the spam >message added to the subject. Is this true? > >And some output from 'MailScanner -v': > >This is CentOS release 4.1 (Final) >This is Perl version 5.008005 (5.8.5) >This is MailScanner version 4.46.2 > > >Thanks! >Chris. > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQ1aBCRH2WUcUFbZUEQKnwQCgjhkmwCc5xVvvQ7tGhX8x99cbiaUAoIPZ I3R4z3u33vSDVhTbSVoFvoVA =arLi -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cparker at SWATGEAR.COM Wed Oct 19 18:31:30 2005 From: cparker at SWATGEAR.COM (Chris W. Parker) Date: Thu Jan 12 21:30:58 2006 Subject: "spam" with negative score. What settings do I need to change? Message-ID: Matt Kettler on Wednesday, October 19, 2005 10:16 AM said: > No. If you trust a DNSBL enough to use it as a MailScanner spam list, > then you should trust it all the time. > > If the DNSBL isn't sufficiently accurate for you to trust it, it > shouldn't be in the spam lists, instead it should be called by SA and > factored into the score. Good point. How do I get SA involved? > If you whitelisted it using MailScanner's whitelist, yes. If you used > SpamAssassin's whitelist (whitelist_from, etc) then no. OK good. I will be using MailScanner's whitelist. Thanks, Chris. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cparker at SWATGEAR.COM Wed Oct 19 19:33:29 2005 From: cparker at SWATGEAR.COM (Chris W. Parker) Date: Thu Jan 12 21:30:58 2006 Subject: "spam" with negative score. What settings do I need to change? Message-ID: Julian Field on Wednesday, October 19, 2005 10:23 AM said: > Edit /usr/lib/MailScanner/MailScanner/RBLs.pm. > Right at the bottom of the file, edit the last few lines so that they > look like this: [snip] > The new bit is the JKF 3/10/2005 bit. This gets around a Perl bug, the > same one has happened several times before. This should fix it for > you. [snip] > perl -c RBLs.pm > That shouldn't output anything much at all. If that is okay, then do a > "service MailScanner restart". I made the change you suggested, checked RBLs.pm for syntax errors, and restarted MailScanner but the logs are still being cut off*. Here is an example of one that just happened. Oct 19 11:24:29 localhost MailScanner[8077]: New Batch: Scanning 1 messages, 6385 bytes Oct 19 11:24:29 localhost MailScanner[8077]: Spam Checks: Starting Oct 19 11:24:29 localhost MailScanner[8077]: RBL checks: j9JIOG0p008056 found in SORBS-DNSBL, SORBS-SPAM Oct 19 11:24:32 localhost MailScanner[8077]: Message j9JIOG0p008056 from 199.181.134.25 (bouncesb@q.go.com) to swatgear.com is Oct 19 11:24:32 localhost MailScanner[8077]: Spam Checks: Found 1 spam messages Oct 19 11:24:32 localhost MailScanner[8077]: Spam Actions: message j9JIOG0p008056 actions are deliver Chris. * That is what the change to RBLs.pm was supposed to fix right? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Wed Oct 19 19:35:43 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:30:58 2006 Subject: "spam" with negative score. What settings do I need to change? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Chris W. Parker wrote: > Matt Kettler > on Wednesday, October 19, 2005 10:16 AM said: > > >>No. If you trust a DNSBL enough to use it as a MailScanner spam list, >>then you should trust it all the time. >> >>If the DNSBL isn't sufficiently accurate for you to trust it, it >>shouldn't be in the spam lists, instead it should be called by SA and >>factored into the score. > > > Good point. > > How do I get SA involved? SA should check the SORBS lists by default, provided you have Net::DNS installed and you haven't disabled network tests. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Oct 19 20:07:53 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:30:58 2006 Subject: "spam" with negative score. What settings do I need to change? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Sorry, there was another chunk of the patch I should have mentioned too, forgot about that. It's all in the latest beta anyway, so give that a try please. Chris W. Parker wrote: >Julian Field > on Wednesday, October 19, 2005 10:23 AM said: > > > >>Edit /usr/lib/MailScanner/MailScanner/RBLs.pm. >>Right at the bottom of the file, edit the last few lines so that they >>look like this: >> >> >[snip] > > >>The new bit is the JKF 3/10/2005 bit. This gets around a Perl bug, the >>same one has happened several times before. This should fix it for >>you. >> >> >[snip] > > >> perl -c RBLs.pm >>That shouldn't output anything much at all. If that is okay, then do a >>"service MailScanner restart". >> >> > >I made the change you suggested, checked RBLs.pm for syntax errors, and >restarted MailScanner but the logs are still being cut off*. Here is an >example of one that just happened. > >Oct 19 11:24:29 localhost MailScanner[8077]: New Batch: Scanning 1 >messages, 6385 bytes >Oct 19 11:24:29 localhost MailScanner[8077]: Spam Checks: Starting >Oct 19 11:24:29 localhost MailScanner[8077]: RBL checks: j9JIOG0p008056 >found in SORBS-DNSBL, SORBS-SPAM >Oct 19 11:24:32 localhost MailScanner[8077]: Message j9JIOG0p008056 from >199.181.134.25 (bouncesb@q.go.com) to swatgear.com is >Oct 19 11:24:32 localhost MailScanner[8077]: Spam Checks: Found 1 spam >messages >Oct 19 11:24:32 localhost MailScanner[8077]: Spam Actions: message >j9JIOG0p008056 actions are deliver > > >Chris. > >* That is what the change to RBLs.pm was supposed to fix right? > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > - -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2424) iQA/AwUBQ1aZiRH2WUcUFbZUEQI45ACgtP84cQZSGS+tU18tebfQ+8PFp/8AnRsr E8yPojVC6NXxDEdOj3Ld2+RB =CuKA -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cparker at SWATGEAR.COM Wed Oct 19 20:21:10 2005 From: cparker at SWATGEAR.COM (Chris W. Parker) Date: Thu Jan 12 21:30:58 2006 Subject: "spam" with negative score. What settings do I need to change? Message-ID: Julian Field on Wednesday, October 19, 2005 12:08 PM said: > Sorry, there was another chunk of the patch I should have mentioned > too, forgot about that. It's all in the latest beta anyway, so give > that a try please. Thanks. I'll just wait till it goes stable. Chris. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From taz at TAZ-MANIA.COM Wed Oct 19 21:25:19 2005 From: taz at TAZ-MANIA.COM (Dennis Willson) Date: Thu Jan 12 21:30:58 2006 Subject: [Mailwatch-users] Memory Bloat Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] This has nothing to do with Logging.... It has to do with custom functions for "Is Definitely Not Spam" and "Is Definitely Spam". Are all custom functions only done by the logger? And then why do I see the initialization code run for all custom functions for each of the MailScanner children? I know its allocating the HASH tables and populating them from the database each and every time. Are you saying that it's overwriting the previous one each time so there's only one copy in memory? If so why not just test for the existence of the previous one before going through all that? Dennis Glenn Steen wrote: > On 19/10/05, Dennis Willson wrote: > >>Well I believe I have found something that causes MailWatch to use way more memory than it really needs. I'm just learning Perl so >>maybe I'm wrong here and if so someone please explain it to me... >> >>Setup: MailScanner configured to have 10 children >> MailWatch configured with 50 whitelist entries and 50 blacklist entries >> >>Each MailScanner child starts its own copy of MailWatches SQLBlackWhite.pm which reads the 100 total blacklist/whitelist entries. >>Since there are 10 children total this means the 100 blacklist/whitelist entries are duplicated in memory 10 times making it take up >>1000 entiries worth of memory for only 100 actual entires. This multiples out very quickly. >> >>Provided this is true and there isn't something I'm missing, where there's really only one copy (which I doubt since watching the >>logs show each child invoking and creating its own copy of the list), is there a way in Perl to have "shared" memory? >> >>One other question is.. If using a proper connection pool to the database, individual queries should be plenty fast enough to keep >>up with an MTA processing mail. Why not just do the database queries "on the fly"? This would also get the latest updates instantly >>instead of waiting for MailScanner to restart its children or the SQLBlackWhite.pm to reload its HASH. >> >>Just some thoughts... >> >>Dennis >> > > Use "ps"... How many logging children do you see? > That's right, of all spawned children just one (is supposed to) > survive. And if (or rather when) that one dies, one of the MS children > will spawn a new one. Perhaps a bit confusing, but rather elegant in > its own way;-) > > -- > -- Glenn > email: glenn < dot > steen < at > gmail < dot > com > work: glenn < dot > steen < at > ap1 < dot > se > > > ------------------------------------------------------- > This SF.Net email is sponsored by: > Power Architecture Resource Center: Free content, downloads, discussions, > and more. http://solutions.newsforge.com/ibmarch.tmpl > _______________________________________________ > Mailwatch-users mailing list > Mailwatch-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/mailwatch-users ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From glenn.steen at GMAIL.COM Wed Oct 19 22:37:44 2005 From: glenn.steen at GMAIL.COM (Glenn Steen) Date: Thu Jan 12 21:30:58 2006 Subject: [Mailwatch-users] Memory Bloat Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 19/10/05, Dennis Willson wrote: > This has nothing to do with Logging.... It has to do with custom functions for "Is Definitely Not Spam" and "Is Definitely Spam". > Are all custom functions only done by the logger? And then why do I see the initialization code run for all custom functions for > each of the MailScanner children? I know its allocating the HASH tables and populating them from the database each and every time. > Are you saying that it's overwriting the previous one each time so there's only one copy in memory? If so why not just test for the > existence of the previous one before going through all that? > > Dennis > > Glenn Steen wrote: > > On 19/10/05, Dennis Willson wrote: > > > >>Well I believe I have found something that causes MailWatch to use way more memory than it really needs. I'm just learning Perl so > >>maybe I'm wrong here and if so someone please explain it to me... > >> > >>Setup: MailScanner configured to have 10 children > >> MailWatch configured with 50 whitelist entries and 50 blacklist entries > >> > >>Each MailScanner child starts its own copy of MailWatches SQLBlackWhite.pm which reads the 100 total blacklist/whitelist entries. > >>Since there are 10 children total this means the 100 blacklist/whitelist entries are duplicated in memory 10 times making it take up > >>1000 entiries worth of memory for only 100 actual entires. This multiples out very quickly. > >> > >>Provided this is true and there isn't something I'm missing, where there's really only one copy (which I doubt since watching the > >>logs show each child invoking and creating its own copy of the list), is there a way in Perl to have "shared" memory? > >> > >>One other question is.. If using a proper connection pool to the database, individual queries should be plenty fast enough to keep > >>up with an MTA processing mail. Why not just do the database queries "on the fly"? This would also get the latest updates instantly > >>instead of waiting for MailScanner to restart its children or the SQLBlackWhite.pm to reload its HASH. > >> > >>Just some thoughts... > >> > >>Dennis > >> > > > > Use "ps"... How many logging children do you see? > > That's right, of all spawned children just one (is supposed to) > > survive. And if (or rather when) that one dies, one of the MS children > > will spawn a new one. Perhaps a bit confusing, but rather elegant in > > its own way;-) > > > > -- > > -- Glenn > > email: glenn < dot > steen < at > gmail < dot > com > > work: glenn < dot > steen < at > ap1 < dot > se > > Brainshutdown. Sorry. -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From digital.java at GMAIL.COM Wed Oct 19 22:28:43 2005 From: digital.java at GMAIL.COM (Joe Young) Date: Thu Jan 12 21:30:58 2006 Subject: I have am issue with 'Allow Script Tags' rule. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have am issue with 'Allow Script Tags' rule. The ruleset that I created is not working. Here is the rule with in Mailscanner.conf: Allow Script Tags = %rules-dir%/strlg.script.blocking.rules Here is the contents of %rules-dir%/strlg.script.blocking.rules ---- FromorTo: default disarm From: joe@naos.sterling.net yes ---- When I send this test email through our filtering server, MailScanner disarms the script. What am I doing wrong? //ord=Math.random()*10000000000000000; document.write('