[MAILSCANNER] {MCP?} RE: [MAILSCANNER] {MCP?} RE: [MAILSCANNER]
Problem with new MCP rules?
Johnny Stork
jstork at PBCO.CA
Tue Sep 20 21:32:23 IST 2005
I was wondering about that cause earlier today I misstakenly applied the 3.0.0 patches when in fact I was running 3.0.4. And when I said in my last post that it scanned insided Word, I was again mistaken cause I had a bunch of test emails in the que and didnt realize that the one with the word attachement had not gone through yet. When it did it did not get scanned. I also just upgraded MS t0 4.45.4 so do you think I can still apply the 3.0.4 patches? I think they are already in 4.45.4 arent they?
I just did another test and it scanned and found a text file with banned content, but not the word doc. Also, below are some messages that show in the maillog? After upgrading to MS 4.45.4, I followed the instructions for upgrading mailscanner.conf and languages.conf?
Looks like I missed something ?
Sep 20 13:27:34 pbco-server3 MailScanner[22619]: New Batch: Scanning 1 messages, 4358 bytes
Sep 20 13:27:34 pbco-server3 MailScanner[22619]: Looked up unknown string mcp in language translation file /etc/MailScanner/reports/en/languages.conf
Sep 20 13:27:44 pbco-server3 MailScanner[22619]: Looked up unknown string score in language translation file /etc/MailScanner/reports/en/languages.conf
Sep 20 13:27:44 pbco-server3 MailScanner[22619]: Looked up unknown string required in language translation file /etc/MailScanner/reports/en/languages.conf
Sep 20 13:27:44 pbco-server3 MailScanner[22619]: Looked up unknown string mcpspamassassin in language translation file /etc/MailScanner/reports/en/languages.conf
Sep 20 13:27:44 pbco-server3 MailScanner[22619]: MCP Checks: Found 1 MCP messages
Sep 20 13:27:44 pbco-server3 MailScanner[22619]: Looked up unknown string spam in language translation file /etc/MailScanner/reports/en/languages.conf
Sep 20 13:27:44 pbco-server3 MailScanner[22619]: Looked up unknown string notspam in language translation file /etc/MailScanner/reports/en/languages.conf
Sep 20 13:28:12 pbco-server3 MailScanner[22619]: Looked up unknown string score in language translation file /etc/MailScanner/reports/en/languages.conf
Sep 20 13:28:12 pbco-server3 MailScanner[22619]: Looked up unknown string required in language translation file /etc/MailScanner/reports/en/languages.conf
Sep 20 13:28:12 pbco-server3 MailScanner[22619]: Looked up unknown string spamassassin in language translation file /etc/MailScanner/reports/en/languages.conf
Sep 20 13:28:12 pbco-server3 MailScanner[22619]: Looked up unknown string mailscanner in language translation file /etc/MailScanner/reports/en/languages.conf
Sep 20 13:28:12 pbco-server3 MailScanner[22619]: Looked up unknown string unreadablearchive in language translation file /etc/MailScanner/reports/en/languages.conf
Sep 20 13:28:12 pbco-server3 MailScanner[22619]: Looked up unknown string passwordedarchive in language translation file /etc/MailScanner/reports/en/languages.conf
Sep 20 13:28:12 pbco-server3 MailScanner[22619]: Looked up unknown string archivetoodeep in language translation file /etc/MailScanner/reports/en/languages.conf
Sep 20 13:28:12 pbco-server3 MailScanner[22619]: Virus and Content Scanning: Starting
Sep 20 13:28:13 pbco-server3 MailScanner[22619]: Looked up unknown string mailscanner in language translation file /etc/MailScanner/reports/en/languages.conf
-----Original Message-----
From: Julian Field [mailto:MailScanner at ECS.SOTON.AC.UK]
Sent: September 20, 2005 1:02 PM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: [MAILSCANNER] {MCP?} RE: [MAILSCANNER] Problem with new MCP
rules?
Have you tried my SpamAssassin 3.0.4 patches on SpamAssassin 3.1.0 yet?
I would be very interested to hear if they apply okay.
Johnny Stork wrote:
>Thanks Julian and Scott, that fixed it. Was the name of the rule, just changed to underscores. And yes Scott, the name of the rules file was not *.cf, it is pbco_passwords.cf.
>
>Just tested it out, way too cool and even inside Word docs...excellent!!
>
>-----Original Message-----
>From: Julian Field [mailto:MailScanner at ECS.SOTON.AC.UK]
>Sent: September 20, 2005 12:28 PM
>To: MAILSCANNER at JISCMAIL.AC.UK
>Subject: Re: [MAILSCANNER] Problem with new MCP rules?
>
>
>Scott Silva wrote:
>
>
>
>>Johnny Stork spake the following on 9/20/2005 10:27 AM:
>>
>>
>>
>>
>>>After going through the instructions for coniguring MCP, I had no problem getting MailScanner to identify subject or body text contained in the default example rule file 10_example.cf. So I created a new file with the extension *cf, with the contents below, and resstared MailScanner. Going to the MailWatch interface, Tools, and "Update MCP Rules Descriptions" and it correctly showed the new rules listed below, But sending an email with only the word "password" in the subject line got through just fine? What am I missing?
>>>
>>>Thanks
>>>
>>>
>>>
>>># Rules for PBCO Message Content Protection
>>>#
>>>
>>>header PASSWORD-SUBJECT-RULE Subject =~ /password/i
>>>describe PASSWORD-SUBJECT-RULE Banned Subject
>>>score PASSWORD-SUBJECT-RULE 5
>>>
>>>body PASSWORD-BODY-RULE /password/i
>>>describe PASSWORD-BODY-RULE Banned body text
>>>score PASSWORD-BODY-RULE 5
>>>
>>>
>>>
>>>
>>>
>>I don't see any rules with "-" dashes, they all have '_' underscores.
>>Maybe this isn't an allowed character in a rule name.
>>
>>
>>
>>
>SpamAssassin generates a Perl function for each rule, so only the
>characters allowed in Perl function names are allowed in SpamAssassin
>rule names. So "-" is certainly not allowed, as it is the arithmetic
>"minus" operator.
>
>
>
--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!
More information about the MailScanner
mailing list