From a.peacock at chime.ucl.ac.uk  Tue May  1 08:11:34 2007
From: a.peacock at chime.ucl.ac.uk (Anthony Peacock)
Date: Tue May  1 08:12:12 2007
Subject: A lot of spam getting through
In-Reply-To: <04D932B0071FE34FA63EBB1977B48D1502816DB1@woodenex.woodmaclaw.local>
References: <04D932B0071FE34FA63EBB1977B48D1502816DB1@woodenex.woodmaclaw.local>
Message-ID: <4636E826.1070104@chime.ucl.ac.uk>

Billy A. Pumphrey wrote:
> Hello everyone.  I am having quite a few spam get through.  I thought
> that I had quite a few things installed and configured correctly.
> Actually they used to work really well then when I had to rebuild bayes
> as there were too many FP and turn off RBL's, then a lot of spam are
> getting through.  Somewhere around 50-100 per user are seemingly getting
> through on a weekend.  I have put down as much information as I thought
> about for my configuration.  I am looking for recommendations to
> recrease my block rate.  Please let me know if I left any information
> out.  jThank you.
> 

<SNIP>

> After looking at a few emails I can see that pyzor and DCC and bayes are
> scoring:
> Score Matching Rule Description 
> cached not   
>  score=24.094   
> 6 required   
>  autolearn=spam   
> 2.17 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/) 
> 0.33 FH_DATE_ISNT_2006   
> 0.77 FH_DATE_ISNT_200X   
> 0.40 FH_LEADINGPREP   
> 0.71 FS_START_BUY   
> 3.70 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/) 
> 0.61 SARE_SXLIFE Talks about your sex life 
> 3.81 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist 
> 4.09 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist 
> 3.01 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist 
> 4.50 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist

Are these the scores that your system gives to one of the emails that 
are gettig through?  If so that scored 24 points.  So this email should 
have been filtered.  This suggests to me that the problem isn't with SA 
but with something in your MailScanner settings.

If these aren't the scores from one of the emails that are getting 
through can you save an email to a text file and send the output of the 
following command:

spamassassin --test-mode < email.txt



-- 
Anthony Peacock
CHIME, Royal Free & University College Medical School
WWW:    http://www.chime.ucl.ac.uk/~rmhiajp/
"If you have an apple and I have  an apple and we  exchange apples
then you and I will still each have  one apple. But  if you have an
idea and I have an idea and we exchange these ideas, then each of us
will have two ideas." -- George Bernard Shaw
From glenn.steen at gmail.com  Tue May  1 10:12:19 2007
From: glenn.steen at gmail.com (Glenn Steen)
Date: Tue May  1 10:12:23 2007
Subject: Postfix milter with MailScanner , extra 0 problem
In-Reply-To: <20070430193605.B02521224A1@mx-b.vdnet.lt>
References: <1177340488.25796.153.camel@localhost.localdomain>
	<223f97700704230818t3ffae2e3u1f28b09aad5d454@mail.gmail.com>
	<1177343963.25796.159.camel@localhost.localdomain>
	<223f97700704240216u4cbd4cbey1df9503fa3a2c7f6@mail.gmail.com>
	<20070430193605.B02521224A1@mx-b.vdnet.lt>
Message-ID: <223f97700705010212t3356ff62s4d7c93c10f2344f4@mail.gmail.com>

On 30/04/07, Nerijus Baliunas <nerijusb@dtiltas.lt> wrote:
> On Tue, 24 Apr 2007 11:16:23 +0200 Glenn Steen <glenn.steen@gmail.com> wrote:
>
> > These patches are for use with Postfix 2.3... Although PFDiskStore.pm
> > will handle the body edits we need do some check to see that all the
> > body is there by spinning through the p records in ReadQf (in
> > Postfix.pm)... Or something smarter (I'm open to sugegstions:-).
> > If you need that (and run PF 2.4) I can probably find my patch for
> > that too ... somewhere...:-)
>
> BTW, can I use these patches with PF 2.4 if my milter modifies headers
> only (not body)? Or should I need your patch for 2.4?
>
> Regards,
> Nerijus
They should work OK for milters only modifying headers using PF 2.4
... There isn't much difference between the patches, just the
verification part in ReadQf (IIRC:-)... So go ahead...
Please report any problems directly to me and I'll try see if there's
anything I can do;-)

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
From glenn.steen at gmail.com  Tue May  1 10:16:02 2007
From: glenn.steen at gmail.com (Glenn Steen)
Date: Tue May  1 10:16:05 2007
Subject: New Stable Release, Clamd and Postfix?
In-Reply-To: <f15j46$77q$1@sea.gmane.org>
References: <FF689DC51C3C1640BE668A0E31182AD002D15AD0@mail03.mira.co.uk>
	<4635F88E.4040509@slackadelic.com> <f15j46$77q$1@sea.gmane.org>
Message-ID: <223f97700705010216s6071bf87hd8a1a514ed72a4d1@mail.gmail.com>

On 30/04/07, Scott Silva <ssilva@sgvwater.com> wrote:
> Matt Hayes spake the following on 4/30/2007 7:09 AM:
> > Paul Hutchings wrote:
> >> My MailScanner box runs quite nicely running the previous stable version
> >> 4.58.9.
> >>
> >> I'm suffering from the slow clamscan performance issue, and noticed the
> >> new stable release supports clamd (which I'm running).
> >>
> >> Having looked at the manual it appears it should simply be a case of run
> >> the installer script, then use upgrade_MailScanner_conf to update
> >> MailScanner.conf with the new settings.
> >>
> >> Not having ever upgraded MailScanner before, I'd sooner ask the question
> >> than get caught out - is this all there is to it (barring something
> >> totally unforeseen happening)?
> >>
> >> Also as I run Postfix I have my MailScanner set to run as user "postfix"
> >> as per the docs.  Will this cause me a problem (or can someone point me
> >> where to go to RTFM?)
> >>
> >> Cheers,
> >> Paul
> >>
> >
> > Paul,
> >
> > That is basically all there is to it.  However, if you are like me,
> > anything custom that you've added like %rules-dir% files will more than
> > likely have to be re-entered in.  If you use Mailwatch, some things with
> > quarantine configuration to allow for released messages to bypass spam
> > checks may have to be reconfigured.
> >
> > The great thing about the upgrade of mailscanner.. it leaves your old
> > installation in place :)
> >
> > -Matt
> >
> >
> The last statement isn't totally true. The rpm version will replace the
> running files. I have a backup script I run that copies the running system
> into a new directory and then I can upgrade or go back.
>

And this is actually well documented (sort of:) in the MAQ and wiki
... Go have a look, it's rather prominetly visible;-)

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
From grpprod at gmail.com  Tue May  1 10:58:19 2007
From: grpprod at gmail.com (G P)
Date: Tue May  1 10:58:20 2007
Subject: Latest MS keeps restarting
Message-ID: <773fecad0705010258k6a71712fmf85ec9638b766bb4@mail.gmail.com>

Hi all,
I just installed latest version, and it keeps restarting its children every
1 minute. This wasn't happening with the previous version. I have just
switched back to 4.58.9, keeping the same configuration, and problem seems
solved now.

Any comments would be appreciated.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070501/443b739c/attachment.html
From raymond at prolocation.net  Tue May  1 11:00:59 2007
From: raymond at prolocation.net (Raymond Dijkxhoorn)
Date: Tue May  1 11:00:58 2007
Subject: Latest MS keeps restarting
In-Reply-To: <773fecad0705010258k6a71712fmf85ec9638b766bb4@mail.gmail.com>
References: <773fecad0705010258k6a71712fmf85ec9638b766bb4@mail.gmail.com>
Message-ID: <Pine.LNX.4.64.0705011200320.8974@control.prolocation.net>

Hi!

> I just installed latest version, and it keeps restarting its children every
> 1 minute. This wasn't happening with the previous version. I have just
> switched back to 4.58.9, keeping the same configuration, and problem seems
> solved now.

Run in debug mode pls, you most likely have a issue with the new one thats 
making it restart...

Bye,
Raymond.
From martinh at solidstatelogic.com  Tue May  1 11:06:23 2007
From: martinh at solidstatelogic.com (Martin.Hepworth)
Date: Tue May  1 11:06:39 2007
Subject: Latest MS keeps restarting
In-Reply-To: <773fecad0705010258k6a71712fmf85ec9638b766bb4@mail.gmail.com>
Message-ID: <a39365a7272fe940bbc8100db822a1a3@solidstatelogic.com>

Hi

What O/S and what virus scanners are being used......

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> bounces@lists.mailscanner.info] On Behalf Of G P
> Sent: 01 May 2007 10:58
> To: mailscanner@lists.mailscanner.info
> Subject: Latest MS keeps restarting
>
> Hi all,
> I just installed latest version, and it keeps restarting its children
> every 1 minute. This wasn't happening with the previous version. I
have
> just switched back to 4.58.9, keeping the same configuration, and
problem
> seems solved now.
>
> Any comments would be appreciated.





**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the 
addressee only and may be confidential. If they come to you in error 
you must take no action based on them, nor must you copy or show them 
to anyone. Please advise the sender by replying to this e-mail 
immediately and then delete the original from your computer.

Opinion : Any opinions expressed in this e-mail are entirely those of 
the author and unless specifically stated to the contrary, are not 
necessarily those of the author's employer.

Security Warning : Internet e-mail is not necessarily a secure 
communications medium and can be subject to data corruption. We advise 
that you consider this fact when e-mailing us. 

Viruses : We have taken steps to ensure that this e-mail and any 
attachments are free from known viruses but in keeping with good 
computing practice, you should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales 
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
United Kingdom
**********************************************************************

From grpprod at gmail.com  Tue May  1 11:32:59 2007
From: grpprod at gmail.com (G P)
Date: Tue May  1 11:33:02 2007
Subject: Latest MS keeps restarting
In-Reply-To: <a39365a7272fe940bbc8100db822a1a3@solidstatelogic.com>
References: <773fecad0705010258k6a71712fmf85ec9638b766bb4@mail.gmail.com>
	<a39365a7272fe940bbc8100db822a1a3@solidstatelogic.com>
Message-ID: <773fecad0705010332l15f21b31sf632839259b7bb9d@mail.gmail.com>

>
> What O/S and what virus scanners are being used......
>
>
It runs under CentOS 3.8, and clamavmodule is used. Haven't run it in debug
mode yet, I will do and let the list of the results.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070501/101605c2/attachment.html
From dave.list at pixelhammer.com  Tue May  1 13:32:18 2007
From: dave.list at pixelhammer.com (DAve)
Date: Tue May  1 13:33:40 2007
Subject: Slightly OT: How do you deal with domains you forward to who
 consider you a spammer based in user reports?
In-Reply-To: <57573D714A832C43B9D80EAFBDA48D03057BDAC1@inex3.herffjones.hj-int>
References: <57573D714A832C43B9D80EAFBDA48D03057BDAB2@inex3.herffjones.hj-int>	<46365924.7000202@pixelhammer.com>
	<57573D714A832C43B9D80EAFBDA48D03057BDAC1@inex3.herffjones.hj-int>
Message-ID: <46373352.3030904@pixelhammer.com>

Furnish, Trever G wrote:
>> -----Original Message-----
>> From: mailscanner-bounces@lists.mailscanner.info 
>> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of DAve
>> Sent: Monday, April 30, 2007 5:01 PM
>> To: MailScanner discussion
>> Subject: Re: Slightly OT: How do you deal with domains you 
>> forward to who consider you a spammer based in user reports?
> 
>> An exasperating situation. We have been dealing with the same 
>> issue for quite a awhile. Our current solution is to use 
>> verp, if AOL returns the message in a scomp report we remove 
>> the users email address and add it to a subscriber black 
>> list. That email address is never allowed to subscribe to 
>> another mail list we host. So far, no client has complained, 
>> AOL is happy, our scomp reports have plummeted.
> 
> Are you using verp only in conjunction with mailing lists?
> Unfortunately my forwards aren't going through any kind of mailing list
> manager -- they're just coming in and getting forwarded immediately back
> out, since each address goes to an individual.  The forwards were set up
> so that outside sales reps who don't pick up mail from out systems could
> still have a "company" email address -- a practice I'm hoping to end,
> but which I expect to continue.

Yes, verp just for the mail lists for now. We haven't had to go chase 
down a forwarding solution, yet. I am hoping we don't have to, but that 
will be my solution if needed.

> 
>> You might see if there is a way to inject something into the 
>> headers that AOL will no redact. Then, if the user reports 
>> their forwarded mail as spam, simply stop forwarding.
> 
> That might actually make a big difference.  Any ideas on how to
> implement it, short of placing a footer in the body of the message?

Not really ;^), but if it comes down to it I will have to find 
something. Likely I will look at removing the forward and letting the 
message deliver locally, then have a cron job read the mailbox, add the 
header, resend the mail.

Ideally, we provide webmail over ssh, imap, pop, and smtp-auth. So if it 
comes up again I will suggest that forwarding is not needed and the 
possibility that business correspondence is subject to family review and 
accidental use. Social solutions are almost always the better choice, 
training the user is harder than programming, but infinitely better in 
the long run.

 >I've noted that aol "redacts" anything that looks like an email address
 > in the headers, but not the body, but if I could insert a header that
 > says, for example, "X-HJ-MailScanner-To: foo at foo dot com", they
 > probably wouldn't redact that.  I suppose I could modify that bit of
 > code in mailscanner that adds that header...hmmm...  Painful for
 > upgrades, but better than nothing...

scomp reports are kinda funny, some are redacted some are not. We have 
even gotten scomp reports from a netblock we don't own.

> 
>> Not the 
>> best solution business wise, but the safe option for certain. 
>> If the user wants the authority to declare spam/not spam, 
>> they should be responsible for the actions they set into motion.
>>
>> In the end we all want to make the client happy, but 
>> protecting your network must come first. You can't make a 
>> client happy if no one will accept your server's mail.
> 
> Good points and it's nice to know I'm not the only one who feels that
> way.
> 

DAve


-- 
Three years now I've asked Google why they don't have a
logo change for Memorial Day. Why do they choose to do logos
for other non-international holidays, but nothing for
Veterans?

Maybe they forgot who made that choice possible.
From bpumphrey at woodmclaw.com  Tue May  1 14:36:52 2007
From: bpumphrey at woodmclaw.com (Billy A. Pumphrey)
Date: Tue May  1 14:36:56 2007
Subject: A lot of spam getting through
In-Reply-To: <IGEOKMEENEPEICNOFDGJCEDKCPAA.list-mailscanner@linguaphone.com>
Message-ID: <04D932B0071FE34FA63EBB1977B48D1502816F72@woodenex.woodmaclaw.local>

> > > 2) Install Fuzzyocr which works well at detecting the image spams
> > > (http://www.gbnetwork.co.uk/mailscanner/ for the URL's)
> >
> > I got this installed and a lint shows OK.
> 
> Have a look at http://www.freespamfilter.org/forum/viewforum.php?f=25
> That forum although quiet has some good tips for additional fuzzyocr
> configuration such as additional words and scansets. Did you install
gocr
> and ocrad OCR plugins?

I followed the instructions and then when I was double checking that I
had what you mentioned, I realized that I downloaded and installed the
2.3b version.  I will now have to go back and install the 3.5.1 version.
I hope that this is as simple as running the install of the new version.
I really don't know how to Uninstall the old version.

From alex at nkpanama.com  Tue May  1 14:46:18 2007
From: alex at nkpanama.com (Alex Neuman van der Hans)
Date: Tue May  1 14:47:03 2007
Subject: A lot of spam getting through
In-Reply-To: <04D932B0071FE34FA63EBB1977B48D1502816E99@woodenex.woodmaclaw.local>
References: <04D932B0071FE34FA63EBB1977B48D1502816E99@woodenex.woodmaclaw.local>
Message-ID: <463744AA.40504@nkpanama.com>

Billy A. Pumphrey wrote:
>
> Ok, I had edited this file but it points to my local domain windows dns
> server.  Does that mean that I should change it to something else?
>   

Definitely. Feel free to install a more respectable operating system on 
it at any time. ;-)

In regards to your actual problem, you may want to install a caching 
nameserver on your MailScanner box and point resolv.conf to 127.0.0.1 
(and maybe something else, like your ISP's DNS servers as secondary, 
just in case). Unless your setup *requires* it, you shouldn't have to 
ask for DNS information from the *ugh* Windows machine ;-)
From campbell at cnpapers.com  Tue May  1 15:07:13 2007
From: campbell at cnpapers.com (Steve Campbell)
Date: Tue May  1 15:07:29 2007
Subject: A lot of spam getting through
References: <04D932B0071FE34FA63EBB1977B48D1502816E99@woodenex.woodmaclaw.local>
	<463744AA.40504@nkpanama.com>
Message-ID: <002901c78bfa$045b5dd0$0705000a@ddf5dw71>


----- Original Message ----- 
From: "Alex Neuman van der Hans" <alex@nkpanama.com>
To: "MailScanner discussion" <mailscanner@lists.mailscanner.info>
Sent: Tuesday, May 01, 2007 9:46 AM
Subject: Re: A lot of spam getting through


> Billy A. Pumphrey wrote:
>>
>> Ok, I had edited this file but it points to my local domain windows dns
>> server.  Does that mean that I should change it to something else?
>>
>
> Definitely. Feel free to install a more respectable operating system on it 
> at any time. ;-)
>
Just curious now.

What OS are you running on this machine currently? What does your Windows 
DNS server manage?

Steve 


From bpumphrey at woodmclaw.com  Tue May  1 15:11:09 2007
From: bpumphrey at woodmclaw.com (Billy A. Pumphrey)
Date: Tue May  1 15:11:12 2007
Subject: A lot of spam getting through
In-Reply-To: <IGEOKMEENEPEICNOFDGJCEDKCPAA.list-mailscanner@linguaphone.com>
Message-ID: <04D932B0071FE34FA63EBB1977B48D1502816FAA@woodenex.woodmaclaw.local>

> Have a look at http://www.freespamfilter.org/forum/viewforum.php?f=25
> That forum although quiet has some good tips for additional fuzzyocr
> configuration such as additional words and scansets. Did you install
gocr
> and ocrad OCR plugins?
> 

Ok, after I downloaded it, I remembered and seen that they are just
files to be put in the directories.  As far as the installs, I
installed:

I had some of the things installed before I upgraded fuzzy, then I
installed more.  I went through the instructions seemingly thoroughly
for the install of the 3.5.1 version.  I installed a ton of stuff, well
seems like it.  The only thing that I did not install was the DBD::mysql
module part.  I install the optional MLDBM and other.  I am now getting
some errors in the lint test.  

I have not enabled the hashing yet.

[8894] warn: FuzzyOcr: Cannot find executable for giftopnm 0.00013 
[8894] warn: FuzzyOcr: Cannot find executable for jpegtopnm 0.00012 
[8894] warn: FuzzyOcr: Cannot find executable for pngtopnm 0.00012 
[8894] warn: FuzzyOcr: Cannot find executable for bmptopnm 0.00012 
[8894] warn: FuzzyOcr: Cannot find executable for tifftopnm 0.00012 
[8894] warn: FuzzyOcr: Cannot find executable for ppmhist 0.00012 
[8894] warn: FuzzyOcr: Cannot find executable for pamfile 0.00012 
[8894] info: FuzzyOcr: Using ocrad => /usr/local/bin/ocrad 0.00017 
[8894] info: FuzzyOcr: Using gocr => /usr/local/bin/gocr 0.00012 
[8894] warn: FuzzyOcr: Cannot find executable for pnmnorm 0.0001 
[8894] warn: FuzzyOcr: Cannot find executable for pnminvert 0.0001 
[8894] warn: FuzzyOcr: Cannot find executable for pamthreshold 0.00011 
[8894] warn: FuzzyOcr: Cannot find executable for ppmtopgm 0.00012 
[8894] warn: FuzzyOcr: Cannot find executable for pamtopnm 0.00012 
[8894] warn: FuzzyOcr: Cannot find executable for tesseract

Man, there are a lot of entries for the fuzzy in the lint.  Do you have
a quick answer on how to fix the above?
From bpumphrey at woodmclaw.com  Tue May  1 15:12:17 2007
From: bpumphrey at woodmclaw.com (Billy A. Pumphrey)
Date: Tue May  1 15:12:20 2007
Subject: A lot of spam getting through
In-Reply-To: <463744AA.40504@nkpanama.com>
Message-ID: <04D932B0071FE34FA63EBB1977B48D1502816FAC@woodenex.woodmaclaw.local>

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> bounces@lists.mailscanner.info] On Behalf Of Alex Neuman van der Hans
> Sent: Tuesday, May 01, 2007 9:46 AM
> To: MailScanner discussion
> Subject: Re: A lot of spam getting through
> 
> Billy A. Pumphrey wrote:
> >
> > Ok, I had edited this file but it points to my local domain windows
dns
> > server.  Does that mean that I should change it to something else?
> >
> 
> Definitely. Feel free to install a more respectable operating system
on
> it at any time. ;-)
> 

And what would that be?  :)
From bpumphrey at woodmclaw.com  Tue May  1 15:13:11 2007
From: bpumphrey at woodmclaw.com (Billy A. Pumphrey)
Date: Tue May  1 15:13:14 2007
Subject: A lot of spam getting through
In-Reply-To: <002901c78bfa$045b5dd0$0705000a@ddf5dw71>
Message-ID: <04D932B0071FE34FA63EBB1977B48D1502816FAD@woodenex.woodmaclaw.local>

> 
> What OS are you running on this machine currently? What does your
Windows
> DNS server manage?
> 
> Steve
> 
> 
> --

CentOS 4.4
From mogens at fumlersoft.dk  Tue May  1 15:13:08 2007
From: mogens at fumlersoft.dk (Mogens Melander)
Date: Tue May  1 15:14:01 2007
Subject: A lot of spam getting through
In-Reply-To: <463744AA.40504@nkpanama.com>
References: <04D932B0071FE34FA63EBB1977B48D1502816E99@woodenex.woodmaclaw.local>
	<463744AA.40504@nkpanama.com>
Message-ID: <2465.90.184.17.152.1178028788.squirrel@mail.fumlersoft.dk>


On Tue, May 1, 2007 15:46, Alex Neuman van der Hans wrote:
> Billy A. Pumphrey wrote:
>>
>> Ok, I had edited this file but it points to my local domain windows dns
>> server.  Does that mean that I should change it to something else?
>>
>
> Definitely. Feel free to install a more respectable operating system on
> it at any time. ;-)
>
> In regards to your actual problem, you may want to install a caching
> nameserver on your MailScanner box and point resolv.conf to 127.0.0.1
> (and maybe something else, like your ISP's DNS servers as secondary,
> just in case). Unless your setup *requires* it, you shouldn't have to
> ask for DNS information from the *ugh* Windows machine ;-)

I think something like dnsmasq could be used for this.

-- 
Later

Mogens Melander
+45 40 85 71 38
+66 870 133 224



-- 
This message has been scanned for viruses and
dangerous content by OpenProtect(http://www.openprotect.com), and is
believed to be clean.

From bpumphrey at woodmclaw.com  Tue May  1 15:17:58 2007
From: bpumphrey at woodmclaw.com (Billy A. Pumphrey)
Date: Tue May  1 15:18:00 2007
Subject: A lot of spam getting through
In-Reply-To: <IGEOKMEENEPEICNOFDGJKEDJCPAA.list-mailscanner@linguaphone.com>
Message-ID: <04D932B0071FE34FA63EBB1977B48D1502816FBD@woodenex.woodmaclaw.local>

> 4) Add this following custom rule to match those spams which just link
to
> a
> picture.
> uri             GRB_Imagehost
> /\.(?:|imageshack|2and2|afreeimagehost|imagehosting)\.(?:com|net|us)/i
> score           GRB_Imagehost  1.0
> describe        GRB_Imagehost  Linking to free image hosting service
> 

Well I thought there were no error.  Please excuse me for being dense.
I am getting the below.  Maybe I am seeing word wrap on your rule and it
is messing me up.  I put the rule in as I see it above.  Each line
starting with:
Uri
/\.
Score
Describe

Is that correct?

[8894] warn: config: SpamAssassin failed to parse line, no value
provided for "uri", skipping: uri GRB_Imagehost 0.05375 
[8894] warn: config: failed to parse line, skipping:
/\.(?:|imageshack|2and2|afreeimagehost|imagehosting)\.(?:com|net|us)/i
0.00016 
[8894] warn: config: warning: description exists for non-existent rule
GRB_Imagehost 0.39171 
[8894] warn: config: warning: score set for non-existent rule
GRB_Imagehost
From list-mailscanner at linguaphone.com  Tue May  1 15:18:35 2007
From: list-mailscanner at linguaphone.com (Gareth)
Date: Tue May  1 15:18:53 2007
Subject: A lot of spam getting through
In-Reply-To: <04D932B0071FE34FA63EBB1977B48D1502816FAA@woodenex.woodmaclaw.local>
References: <04D932B0071FE34FA63EBB1977B48D1502816FAA@woodenex.woodmaclaw.local>
Message-ID: <1178029114.14746.28.camel@gblades-suse.linguaphone-intranet.co.uk>

On Tue, 2007-05-01 at 15:11, Billy A. Pumphrey wrote:
> > Have a look at http://www.freespamfilter.org/forum/viewforum.php?f=25
> > That forum although quiet has some good tips for additional fuzzyocr
> > configuration such as additional words and scansets. Did you install
> gocr
> > and ocrad OCR plugins?
> > 
> 
> Ok, after I downloaded it, I remembered and seen that they are just
> files to be put in the directories.  As far as the installs, I
> installed:
> 
> I had some of the things installed before I upgraded fuzzy, then I
> installed more.  I went through the instructions seemingly thoroughly
> for the install of the 3.5.1 version.  I installed a ton of stuff, well
> seems like it.  The only thing that I did not install was the DBD::mysql
> module part.  I install the optional MLDBM and other.  I am now getting
> some errors in the lint test.  
> 
> I have not enabled the hashing yet.
> 
> [8894] warn: FuzzyOcr: Cannot find executable for giftopnm 0.00013 
> [8894] warn: FuzzyOcr: Cannot find executable for jpegtopnm 0.00012 
> [8894] warn: FuzzyOcr: Cannot find executable for pngtopnm 0.00012 
> [8894] warn: FuzzyOcr: Cannot find executable for bmptopnm 0.00012 
> [8894] warn: FuzzyOcr: Cannot find executable for tifftopnm 0.00012 
> [8894] warn: FuzzyOcr: Cannot find executable for ppmhist 0.00012 
> [8894] warn: FuzzyOcr: Cannot find executable for pamfile 0.00012 
> [8894] info: FuzzyOcr: Using ocrad => /usr/local/bin/ocrad 0.00017 
> [8894] info: FuzzyOcr: Using gocr => /usr/local/bin/gocr 0.00012 
> [8894] warn: FuzzyOcr: Cannot find executable for pnmnorm 0.0001 
> [8894] warn: FuzzyOcr: Cannot find executable for pnminvert 0.0001 
> [8894] warn: FuzzyOcr: Cannot find executable for pamthreshold 0.00011 
> [8894] warn: FuzzyOcr: Cannot find executable for ppmtopgm 0.00012 
> [8894] warn: FuzzyOcr: Cannot find executable for pamtopnm 0.00012 
> [8894] warn: FuzzyOcr: Cannot find executable for tesseract
> 
> Man, there are a lot of entries for the fuzzy in the lint.  Do you have
> a quick answer on how to fix the above?

It looks as though you dont have the netpbm package installed. You may
have the netpbm rpm installed but that is only the libraries. Redhat for
example also has netpbm-progs which you also need to install.

From list-mailscanner at linguaphone.com  Tue May  1 15:21:33 2007
From: list-mailscanner at linguaphone.com (Gareth)
Date: Tue May  1 15:21:40 2007
Subject: A lot of spam getting through
In-Reply-To: <04D932B0071FE34FA63EBB1977B48D1502816FBD@woodenex.woodmaclaw.local>
References: <04D932B0071FE34FA63EBB1977B48D1502816FBD@woodenex.woodmaclaw.local>
Message-ID: <1178029293.14744.31.camel@gblades-suse.linguaphone-intranet.co.uk>

On Tue, 2007-05-01 at 15:17, Billy A. Pumphrey wrote:
> > 4) Add this following custom rule to match those spams which just link
> to
> > a
> > picture.
> > uri             GRB_Imagehost
> > /\.(?:|imageshack|2and2|afreeimagehost|imagehosting)\.(?:com|net|us)/i
> > score           GRB_Imagehost  1.0
> > describe        GRB_Imagehost  Linking to free image hosting service
> > 
> 
> Well I thought there were no error.  Please excuse me for being dense.
> I am getting the below.  Maybe I am seeing word wrap on your rule and it
> is messing me up.  I put the rule in as I see it above.  Each line
> starting with:
> Uri
> /\.
> Score
> Describe
> 
> Is that correct?
> 
> [8894] warn: config: SpamAssassin failed to parse line, no value
> provided for "uri", skipping: uri GRB_Imagehost 0.05375 
> [8894] warn: config: failed to parse line, skipping:
> /\.(?:|imageshack|2and2|afreeimagehost|imagehosting)\.(?:com|net|us)/i
> 0.00016 
> [8894] warn: config: warning: description exists for non-existent rule
> GRB_Imagehost 0.39171 
> [8894] warn: config: warning: score set for non-existent rule
> GRB_Imagehost

The line which appears to start with /\. is a continuation of the first
line. Just join the lines and it should be ok.

From bpumphrey at woodmclaw.com  Tue May  1 15:30:49 2007
From: bpumphrey at woodmclaw.com (Billy A. Pumphrey)
Date: Tue May  1 15:30:53 2007
Subject: A lot of spam getting through
In-Reply-To: <002901c78bfa$045b5dd0$0705000a@ddf5dw71>
Message-ID: <04D932B0071FE34FA63EBB1977B48D1502816FDA@woodenex.woodmaclaw.local>

> > Billy A. Pumphrey wrote:
> >>
> >> Ok, I had edited this file but it points to my local domain windows
dns
> >> server.  Does that mean that I should change it to something else?
> >>
> >
> > Definitely. Feel free to install a more respectable operating system
on
> it
> > at any time. ;-)
> >
> Just curious now.
> 
> What OS are you running on this machine currently?

CentOS 4.4

> What does your Windows DNS server manage?


It is a domain controller,  WINS, DNS, Active Directory, DHCP

> Steve
> 
> 
> --

From bpumphrey at woodmclaw.com  Tue May  1 15:34:05 2007
From: bpumphrey at woodmclaw.com (Billy A. Pumphrey)
Date: Tue May  1 15:34:07 2007
Subject: A lot of spam getting through
In-Reply-To: <001701c78b6a$ddc5caf0$0705000a@ddf5dw71>
Message-ID: <04D932B0071FE34FA63EBB1977B48D1502816FDC@woodenex.woodmaclaw.local>

Results of the DNS server commands.  I am pretty sure that I don't have
a DNS server on this machine.

> > --
> If you're running RH flavor OS,  do one of the following as root:
> 
> ps -ax | grep named

11957 pts/0    S+     0:00 grep named

> 
> chkconfig --list named

error reading information on service named: No such file or directory

> 
> ls /etc/rc.d/init.d/named

ls: /etc/rc.d/init.d/named: No such file or directory

> 
> netstat -an | grep 53

tcp        0      0 127.0.0.1:11553             0.0.0.0:*
LISTEN
tcp        0      0 127.0.0.1:11553             127.0.0.1:51545
CLOSE_WAIT
tcp        0    116 10.1.1.24:25                81.217.42.147:35365
FIN_WAIT1
tcp        0      0 127.0.0.1:51525             127.0.0.1:11553
TIME_WAIT
tcp        0      0 127.0.0.1:51527             127.0.0.1:11553
TIME_WAIT
tcp        0      0 127.0.0.1:51523             127.0.0.1:11553
TIME_WAIT
tcp        0      0 127.0.0.1:51532             127.0.0.1:11553
TIME_WAIT
tcp        0      0 127.0.0.1:51535             127.0.0.1:11553
TIME_WAIT
tcp        0      0 127.0.0.1:51534             127.0.0.1:11553
TIME_WAIT
tcp        0      0 127.0.0.1:51528             127.0.0.1:11553
TIME_WAIT
tcp        0      0 127.0.0.1:51531             127.0.0.1:11553
TIME_WAIT
tcp        0      0 127.0.0.1:51530             127.0.0.1:11553
TIME_WAIT
tcp        0      0 127.0.0.1:51540             127.0.0.1:11553
TIME_WAIT
tcp        0      0 127.0.0.1:51542             127.0.0.1:11553
TIME_WAIT
tcp        0      0 127.0.0.1:51536             127.0.0.1:11553
TIME_WAIT
tcp        0      0 127.0.0.1:51538             127.0.0.1:11553
TIME_WAIT
tcp        0      0 127.0.0.1:51545             127.0.0.1:11553
FIN_WAIT2
tcp        0      0 127.0.0.1:51544             127.0.0.1:11553
TIME_WAIT
tcp        0      0 ::ffff:10.1.1.24:51537      ::ffff:10.1.1.22:25
TIME_WAIT
tcp        0      0 ::ffff:10.1.1.24:51533      ::ffff:10.1.1.22:25
TIME_WAIT
unix  2      [ ACC ]     STREAM     LISTENING     12953341
/var/lib/mysql/mysql.sock
unix  2      [ ACC ]     STREAM     LISTENING     25378793
/var/run/dcc/dccm
unix  3      [ ]         STREAM     CONNECTED     25538221
/var/lib/mysql/mysql.sock
unix  3      [ ]         STREAM     CONNECTED     25538220
unix  2      [ ]         DGRAM                    25538209
unix  2      [ ]         DGRAM                    25537800
unix  2      [ ]         DGRAM                    25537373
unix  2      [ ]         DGRAM                    25536669
unix  2      [ ]         DGRAM                    25536086
unix  2      [ ]         DGRAM                    25378792
[root@WoodenMS2 spamassassin]#

> One of these should maybe give you an idea about a DNS server. If
you're
> running some other OS, I can't really help.
> 
> Steve
> 
> 
From campbell at cnpapers.com  Tue May  1 15:53:03 2007
From: campbell at cnpapers.com (Steve Campbell)
Date: Tue May  1 15:54:10 2007
Subject: A lot of spam getting through
References: <04D932B0071FE34FA63EBB1977B48D1502816FDC@woodenex.woodmaclaw.local>
Message-ID: <002a01c78c00$6bd68ce0$0705000a@ddf5dw71>


----- Original Message ----- 
From: "Billy A. Pumphrey" <bpumphrey@woodmclaw.com>
To: "MailScanner discussion" <mailscanner@lists.mailscanner.info>
Sent: Tuesday, May 01, 2007 10:34 AM
Subject: RE: A lot of spam getting through


> Results of the DNS server commands.  I am pretty sure that I don't have
> a DNS server on this machine.
>
>> > --
>> If you're running RH flavor OS,  do one of the following as root:
>>
>> ps -ax | grep named
>
> 11957 pts/0    S+     0:00 grep named
>
>>
>> chkconfig --list named
>
> error reading information on service named: No such file or directory
>
>>
>> ls /etc/rc.d/init.d/named
>
> ls: /etc/rc.d/init.d/named: No such file or directory
>
>>
>> netstat -an | grep 53
>
> tcp        0      0 127.0.0.1:11553             0.0.0.0:*
> LISTEN
> tcp        0      0 127.0.0.1:11553             127.0.0.1:51545
> CLOSE_WAIT
> tcp        0    116 10.1.1.24:25                81.217.42.147:35365
> FIN_WAIT1
> tcp        0      0 127.0.0.1:51525             127.0.0.1:11553
> TIME_WAIT
> tcp        0      0 127.0.0.1:51527             127.0.0.1:11553
> TIME_WAIT
> tcp        0      0 127.0.0.1:51523             127.0.0.1:11553
> TIME_WAIT
> tcp        0      0 127.0.0.1:51532             127.0.0.1:11553
> TIME_WAIT
> tcp        0      0 127.0.0.1:51535             127.0.0.1:11553
> TIME_WAIT
> tcp        0      0 127.0.0.1:51534             127.0.0.1:11553
> TIME_WAIT
> tcp        0      0 127.0.0.1:51528             127.0.0.1:11553
> TIME_WAIT
> tcp        0      0 127.0.0.1:51531             127.0.0.1:11553
> TIME_WAIT
> tcp        0      0 127.0.0.1:51530             127.0.0.1:11553
> TIME_WAIT
> tcp        0      0 127.0.0.1:51540             127.0.0.1:11553
> TIME_WAIT
> tcp        0      0 127.0.0.1:51542             127.0.0.1:11553
> TIME_WAIT
> tcp        0      0 127.0.0.1:51536             127.0.0.1:11553
> TIME_WAIT
> tcp        0      0 127.0.0.1:51538             127.0.0.1:11553
> TIME_WAIT
> tcp        0      0 127.0.0.1:51545             127.0.0.1:11553
> FIN_WAIT2
> tcp        0      0 127.0.0.1:51544             127.0.0.1:11553
> TIME_WAIT
> tcp        0      0 ::ffff:10.1.1.24:51537      ::ffff:10.1.1.22:25
> TIME_WAIT
> tcp        0      0 ::ffff:10.1.1.24:51533      ::ffff:10.1.1.22:25
> TIME_WAIT
> unix  2      [ ACC ]     STREAM     LISTENING     12953341
> /var/lib/mysql/mysql.sock
> unix  2      [ ACC ]     STREAM     LISTENING     25378793
> /var/run/dcc/dccm
> unix  3      [ ]         STREAM     CONNECTED     25538221
> /var/lib/mysql/mysql.sock
> unix  3      [ ]         STREAM     CONNECTED     25538220
> unix  2      [ ]         DGRAM                    25538209
> unix  2      [ ]         DGRAM                    25537800
> unix  2      [ ]         DGRAM                    25537373
> unix  2      [ ]         DGRAM                    25536669
> unix  2      [ ]         DGRAM                    25536086
> unix  2      [ ]         DGRAM                    25378792
> [root@WoodenMS2 spamassassin]#
>
>> One of these should maybe give you an idea about a DNS server. If
> you're
>> running some other OS, I can't really help.
>>
>> Steve
>>
>>
> -- 
OK, it looks pretty certain that you aren't running a DNS server on the box. 
Don't change your resolv.conf, then, until you install Bind or, as Mogens 
Melander suggested, one of the other DNS servers. But that's a project for 
another day, it sounds like.

Steve


From gmane at tippingmar.com  Tue May  1 17:46:58 2007
From: gmane at tippingmar.com (Mark Nienberg)
Date: Tue May  1 17:47:24 2007
Subject: how to block mail where From and To are the same?
In-Reply-To: <1E293D3FF63A3740B10AD5AAD88535D204CD3925@UBIMAIL1.ubisoft.org>
References: <1E293D3FF63A3740B10AD5AAD88535D204CD3925@UBIMAIL1.ubisoft.org>
Message-ID: <f17qu2$5fc$1@sea.gmane.org>

Daniel Maher wrote:

> net result is that many of my users appear to be receiving spam /from 
> themselves/, which is causing some distress amongst the user base.

If you can publish a SPF record for your domain, then the SPF checking in SA would 
catch this.  Personally, I increase the score for SPF Fail, but see recent discussion 
about this for other points of view.

Mark Nienberg

From alex at nkpanama.com  Tue May  1 17:54:54 2007
From: alex at nkpanama.com (Alex Neuman van der Hans)
Date: Tue May  1 17:55:38 2007
Subject: A lot of spam getting through
In-Reply-To: <04D932B0071FE34FA63EBB1977B48D1502816FAC@woodenex.woodmaclaw.local>
References: <04D932B0071FE34FA63EBB1977B48D1502816FAC@woodenex.woodmaclaw.local>
Message-ID: <463770DE.40307@nkpanama.com>

Billy A. Pumphrey wrote:
> And what would that be?  :)
>   
Anything after CP/M, I'd think, but I would look to the download page 
for a list of highly respectable operating systems:

    * Version 4.59.4-2 for RedHat, Fedora and Mandrake Linux (and other
      RPM-based Linux distributions)
      <http://www.mailscanner.info/files/4/rpm/MailScanner-4.59.4-2.rpm.tar.gz>

      (PGP signature)
      <http://www.mailscanner.info/files/4/rpm/MailScanner-4.59.4-2.rpm.tar.gz.sig>

    * Version 4.59.4-2 for SuSE
      <http://www.mailscanner.info/files/4/suse/MailScanner-4.59.4-2.suse.tar.gz>

      (PGP signature)
      <http://www.mailscanner.info/files/4/suse/MailScanner-4.59.4-2.suse.tar.gz.sig>

    * Version 4.59.4-2 for Solaris / BSD / Other Linux / Other Unix
      <http://www.mailscanner.info/files/4/tar/MailScanner-install-4.59.4-2.tar.gz>

      (PGP signature)
      <http://www.mailscanner.info/files/4/tar/MailScanner-install-4.59.4-2.tar.gz.sig>


So your safest bet would be, RedHat (or CentOS), Fedora, Mandrake, SuSE, 
Solaris, BSD, Other Linux, or Other Unix, probably in that order...

Anything else and MailScanner could cause swapping! ;-)

From e.bloodaxe at gold.ac.uk  Tue May  1 18:58:37 2007
From: e.bloodaxe at gold.ac.uk (e.bloodaxe@gold.ac.uk)
Date: Tue May  1 18:58:50 2007
Subject: SophosAVI
Message-ID: <46377FCD.2080608@gold.ac.uk>

Can someone point me to or tell me why I might want to use SophosAVI 
over plain Sophos.  although there is documenatation about how to 
install SophosAVI
there is nothing telling me why I would want to do this.

Eric
From bpumphrey at woodmclaw.com  Tue May  1 20:18:51 2007
From: bpumphrey at woodmclaw.com (Billy A. Pumphrey)
Date: Tue May  1 20:18:55 2007
Subject: A lot of spam getting through
In-Reply-To: <4636E826.1070104@chime.ucl.ac.uk>
Message-ID: <04D932B0071FE34FA63EBB1977B48D15028171C9@woodenex.woodmaclaw.local>

> > After looking at a few emails I can see that pyzor and DCC and bayes
are
> > scoring:
> > Score Matching Rule Description
> > cached not
> >  score=24.094
> > 6 required
> >  autolearn=spam
> > 2.17 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
> > 0.33 FH_DATE_ISNT_2006
> > 0.77 FH_DATE_ISNT_200X
> > 0.40 FH_LEADINGPREP
> > 0.71 FS_START_BUY
> > 3.70 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/)
> > 0.61 SARE_SXLIFE Talks about your sex life
> > 3.81 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
> > 4.09 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
> > 3.01 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
> > 4.50 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
> 
> Are these the scores that your system gives to one of the emails that
> are gettig through?  If so that scored 24 points.  So this email
should
> have been filtered.  This suggests to me that the problem isn't with
SA
> but with something in your MailScanner settings.
> 

This email was tagged as spam so good to go there.

> If these aren't the scores from one of the emails that are getting
> through can you save an email to a text file and send the output of
the
> following command:
> 
> spamassassin --test-mode < email.txt
> 
> 
> 
> --
> Anthony Peacock
> CHIME, Royal Free & University College Medical School
> WWW:    http://www.chime.ucl.ac.uk/~rmhiajp/
> "If you have an apple and I have  an apple and we  exchange apples
> then you and I will still each have  one apple. But  if you have an
> idea and I have an idea and we exchange these ideas, then each of us
> will have two ideas." -- George Bernard Shaw
> --


From drew at technologytiger.net  Tue May  1 21:56:54 2007
From: drew at technologytiger.net (Drew Marshall)
Date: Tue May  1 21:57:13 2007
Subject: ClamAV Module Core Dump
Message-ID: <8264588D-CE5E-443D-AC9A-20BCB16F3C24@technologytiger.net>

Hi all

Ok another challenge that I hope you can help with. I am running a  
FreeBSD 6 box that I have just upgraded to ClamAV 0.90.2 which was  
upgraded from the ports tree. Knowing there can be issues, I also  
forced an update (Which in effect recompiles) of the Clam perl  
module. Restarted MailScanner and ever since MS core dumps. I can run  
MS using ClamAV only but it makes quite a performance hit so I want  
to get t reinstalled ASAP.

Running in debug mode, I helpfully get:

root@mx1 /usr/local/etc/MailScanner # mailscanner --debug
In Debugging mode, not forking...
Segmentation fault

/var/log/messages gets:

May  1 20:34:14 mx1 kernel: pid 43095 (perl5.8.8), uid 0: exited on  
signal 11 (core dumped)

Again no clues that I can see. Can any one give me some ideas where  
to start with this?

For the record:

This is MailScanner version 4.58.9
Module versions are:
1.00    AnyDBM_File
1.18    Archive::Zip
1.04    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.05    Fcntl
2.74    File::Basename
2.09    File::Copy
2.01    FileHandle
1.08    File::Path
0.18    File::Temp
0.92    Filesys::Df
1.35    HTML::Entities
3.56    HTML::Parser
2.37    HTML::TokeParser
1.22    IO
1.13    IO::File
1.13    IO::Pipe
1.74    Mail::Header
3.07    MIME::Base64
5.420   MIME::Decoder
5.420   MIME::Decoder::UU
5.420   MIME::Head
5.420   MIME::Parser
3.07    MIME::QuotedPrint
5.420   MIME::Tools
0.11    Net::CIDR
1.09    POSIX
1.78    Socket
1.4     Sys::Hostname::Long
0.13    Sys::Syslog
1.9707  Time::HiRes
1.02    Time::localtime

Optional module versions are:
0.17    Convert::TNEF
1.814   DB_File
1.13    DBD::SQLite
1.54    DBI
1.15    Digest
1.01    Digest::HMAC
2.36    Digest::MD5
2.11    Digest::SHA1
0.44    Inline
Segmentation fault (core dumped)  #(It really doesn't like the ClamAV  
module, which I have uninstalled and reinstalled to no effect.)

TIA

Drew

-- 
In line with our policy, this message has been scanned 
for viruses and dangerous content by the Technology Tiger MailScanner.
Further information can be found at www.technologytiger.net/policy

Technology Tiger Limited is registered in Scotland with registration number: 310997
Registered Office 55-57 West High Street Inverurie AB51 3QQ

From r.berber at computer.org  Tue May  1 22:23:47 2007
From: r.berber at computer.org (=?ISO-8859-1?Q?Ren=E9_Berber?=)
Date: Tue May  1 22:24:09 2007
Subject: ClamAV Module Core Dump
In-Reply-To: <8264588D-CE5E-443D-AC9A-20BCB16F3C24@technologytiger.net>
References: <8264588D-CE5E-443D-AC9A-20BCB16F3C24@technologytiger.net>
Message-ID: <f18b55$p5q$1@sea.gmane.org>

Drew Marshall wrote:

> Ok another challenge that I hope you can help with. I am running a 
> FreeBSD 6 box that I have just upgraded to ClamAV 0.90.2 which was 
> upgraded from the ports tree. Knowing there can be issues, I also forced 
> an update (Which in effect recompiles) of the Clam perl module. 

Which version of Mail::ClamAV?  your long list below doesn't include it, version 
0.20 is required.

Did you also run ldconfig? (required when installing clamav-0.90.2)

> Restarted MailScanner and ever since MS core dumps. I can run MS using 
> ClamAV only but it makes quite a performance hit so I want to get t 
> reinstalled ASAP.

You can also use clamd/clamdscan with the new beta version of MS or with a few 
changes to the version you have.

> Running in debug mode, I helpfully get:
> 
> root@mx1 /usr/local/etc/MailScanner # mailscanner --debug
> In Debugging mode, not forking...
> Segmentation fault

Do you have a core file?  can you run the debugger on it?

> /var/log/messages gets:
> 
> May  1 20:34:14 mx1 kernel: pid 43095 (perl5.8.8), uid 0: exited on 
> signal 11 (core dumped)
> 
> Again no clues that I can see. Can any one give me some ideas where to 
> start with this?
> 
> For the record:
> 
> This is MailScanner version 4.58.9
...
-- 
Ren? Berber

From drew at technologytiger.net  Tue May  1 22:35:07 2007
From: drew at technologytiger.net (Drew Marshall)
Date: Tue May  1 22:35:25 2007
Subject: ClamAV Module Core Dump
In-Reply-To: <f18b55$p5q$1@sea.gmane.org>
References: <8264588D-CE5E-443D-AC9A-20BCB16F3C24@technologytiger.net>
	<f18b55$p5q$1@sea.gmane.org>
Message-ID: <089CB271-EBCE-4738-9AF2-7F7867567CB3@technologytiger.net>

On 1 May 2007, at 22:23, Ren? Berber wrote:

> Drew Marshall wrote:
>
>> Ok another challenge that I hope you can help with. I am running a  
>> FreeBSD 6 box that I have just upgraded to ClamAV 0.90.2 which was  
>> upgraded from the ports tree. Knowing there can be issues, I also  
>> forced an update (Which in effect recompiles) of the Clam perl  
>> module.
>
> Which version of Mail::ClamAV?  your long list below doesn't  
> include it, version 0.20 is required.

It is version 0.20, I forgot that it core dumped while trying to even  
list it.

>
> Did you also run ldconfig? (required when installing clamav-0.90.2)

As part of the ports build process, I believe so. I normally just  
portupgrade and sit back and wait.

>
>> Restarted MailScanner and ever since MS core dumps. I can run MS  
>> using ClamAV only but it makes quite a performance hit so I want  
>> to get t reinstalled ASAP.
>
> You can also use clamd/clamdscan with the new beta version of MS or  
> with a few changes to the version you have.

True.

>
>> Running in debug mode, I helpfully get:
>> root@mx1 /usr/local/etc/MailScanner # mailscanner --debug
>> In Debugging mode, not forking...
>> Segmentation fault
>
> Do you have a core file?  can you run the debugger on it?

No, I can't find the damn thing. I would have expected it to drop  
into the directory that either I was in or MS was running in and  
neither (Unless MS is cleaning it up when starting/ failing).

Thanks for your help.

Drew
-- 
In line with our policy, this message has been scanned 
for viruses and dangerous content by the Technology Tiger MailScanner.
Further information can be found at www.technologytiger.net/policy

Technology Tiger Limited is registered in Scotland with registration number: 310997
Registered Office 55-57 West High Street Inverurie AB51 3QQ

From ssilva at sgvwater.com  Tue May  1 22:41:20 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Tue May  1 22:41:35 2007
Subject: ClamAV Module Core Dump
In-Reply-To: <8264588D-CE5E-443D-AC9A-20BCB16F3C24@technologytiger.net>
References: <8264588D-CE5E-443D-AC9A-20BCB16F3C24@technologytiger.net>
Message-ID: <f18c5s$udb$1@sea.gmane.org>

Drew Marshall spake the following on 5/1/2007 1:56 PM:
> Hi all
> 
> Ok another challenge that I hope you can help with. I am running a
> FreeBSD 6 box that I have just upgraded to ClamAV 0.90.2 which was
> upgraded from the ports tree. Knowing there can be issues, I also forced
> an update (Which in effect recompiles) of the Clam perl module.
> Restarted MailScanner and ever since MS core dumps. I can run MS using
> ClamAV only but it makes quite a performance hit so I want to get t
> reinstalled ASAP.
> 
> Running in debug mode, I helpfully get:
> 
> root@mx1 /usr/local/etc/MailScanner # mailscanner --debug
> In Debugging mode, not forking...
> Segmentation fault
> 
> /var/log/messages gets:
> 
> May  1 20:34:14 mx1 kernel: pid 43095 (perl5.8.8), uid 0: exited on
> signal 11 (core dumped)
> 
> Again no clues that I can see. Can any one give me some ideas where to
> start with this?
I have a similar issue in Centos 4. While I am not getting cores, MailScanner
will not run with the 0.20 module and 0.90.2 on one of my servers. It runs
fine with the commandline scanner, and I haven't had the time to upgrade to
the new version of MailScanner to test the clamd functionality. I get nothing
in debug, either.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From z at ziff.net  Tue May  1 23:01:42 2007
From: z at ziff.net (Zivago Lee)
Date: Tue May  1 23:01:50 2007
Subject: ClamAV Module Core Dump
In-Reply-To: <f18c5s$udb$1@sea.gmane.org>
References: <8264588D-CE5E-443D-AC9A-20BCB16F3C24@technologytiger.net>
	<f18c5s$udb$1@sea.gmane.org>
Message-ID: <63170.209.104.55.7.1178056902.squirrel@mail.ziff.net>


> Drew Marshall spake the following on 5/1/2007 1:56 PM:
>> Hi all
>>
>> Ok another challenge that I hope you can help with. I am running a
>> FreeBSD 6 box that I have just upgraded to ClamAV 0.90.2 which was
>> upgraded from the ports tree. Knowing there can be issues, I also forced
>> an update (Which in effect recompiles) of the Clam perl module.
>> Restarted MailScanner and ever since MS core dumps. I can run MS using
>> ClamAV only but it makes quite a performance hit so I want to get t
>> reinstalled ASAP.
>>
>> Running in debug mode, I helpfully get:
>>
>> root@mx1 /usr/local/etc/MailScanner # mailscanner --debug
>> In Debugging mode, not forking...
>> Segmentation fault
>>
>> /var/log/messages gets:
>>
>> May  1 20:34:14 mx1 kernel: pid 43095 (perl5.8.8), uid 0: exited on
>> signal 11 (core dumped)
>>
>> Again no clues that I can see. Can any one give me some ideas where to
>> start with this?
> I have a similar issue in Centos 4. While I am not getting cores,
> MailScanner
> will not run with the 0.20 module and 0.90.2 on one of my servers. It runs
> fine with the commandline scanner, and I haven't had the time to upgrade
> to
> the new version of MailScanner to test the clamd functionality. I get
> nothing
> in debug, either.

Wow.. I thought it was just my server and/or config on why the
clamavmodule was not working.  It would just keep restarting the
MailScanner processes and -debug would not display any issues.  clamd
works just fine, however, and works really well!

-- 
Zivago Lee
z@ziff.net
From ssilva at sgvwater.com  Tue May  1 23:15:03 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Tue May  1 23:15:16 2007
Subject: ClamAV Module Core Dump
In-Reply-To: <63170.209.104.55.7.1178056902.squirrel@mail.ziff.net>
References: <8264588D-CE5E-443D-AC9A-20BCB16F3C24@technologytiger.net>	<f18c5s$udb$1@sea.gmane.org>
	<63170.209.104.55.7.1178056902.squirrel@mail.ziff.net>
Message-ID: <f18e52$5km$1@sea.gmane.org>

Zivago Lee spake the following on 5/1/2007 3:01 PM:
>> Drew Marshall spake the following on 5/1/2007 1:56 PM:
>>> Hi all
>>>
>>> Ok another challenge that I hope you can help with. I am running a
>>> FreeBSD 6 box that I have just upgraded to ClamAV 0.90.2 which was
>>> upgraded from the ports tree. Knowing there can be issues, I also forced
>>> an update (Which in effect recompiles) of the Clam perl module.
>>> Restarted MailScanner and ever since MS core dumps. I can run MS using
>>> ClamAV only but it makes quite a performance hit so I want to get t
>>> reinstalled ASAP.
>>>
>>> Running in debug mode, I helpfully get:
>>>
>>> root@mx1 /usr/local/etc/MailScanner # mailscanner --debug
>>> In Debugging mode, not forking...
>>> Segmentation fault
>>>
>>> /var/log/messages gets:
>>>
>>> May  1 20:34:14 mx1 kernel: pid 43095 (perl5.8.8), uid 0: exited on
>>> signal 11 (core dumped)
>>>
>>> Again no clues that I can see. Can any one give me some ideas where to
>>> start with this?
>> I have a similar issue in Centos 4. While I am not getting cores,
>> MailScanner
>> will not run with the 0.20 module and 0.90.2 on one of my servers. It runs
>> fine with the commandline scanner, and I haven't had the time to upgrade
>> to
>> the new version of MailScanner to test the clamd functionality. I get
>> nothing
>> in debug, either.
> 
> Wow.. I thought it was just my server and/or config on why the
> clamavmodule was not working.  It would just keep restarting the
> MailScanner processes and -debug would not display any issues.  clamd
> works just fine, however, and works really well!
> 
I have tried installing more than once, and I am near to wiping out the clam
library and installing again. I might try clamd first, as anything has to be
better than the commandline scanner. I am already running a few scanners, and
every bit of load adds up.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From mbneto at gmail.com  Wed May  2 00:20:15 2007
From: mbneto at gmail.com (mbneto)
Date: Wed May  2 00:20:16 2007
Subject: Switching to clamd in new MailScanner
Message-ID: <5cf776b80705011620h7eeba9a9k170132219527bff3@mail.gmail.com>

Hi,

I am currently using clamav (rpm) with my MailScanner setup.   I've noticed
that it  calls a  clamav-wrapper so I am assuming that every email that the
server receives invokes this wrapper.

Some posts in this list mentioned that using clamd would give faster results
so how can I make MailScanner use clamav such way?

thanks.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070501/0366eb41/attachment.html
From z at ziff.net  Wed May  2 00:26:26 2007
From: z at ziff.net (Zivago Lee)
Date: Wed May  2 00:26:30 2007
Subject: Switching to clamd in new MailScanner
In-Reply-To: <5cf776b80705011620h7eeba9a9k170132219527bff3@mail.gmail.com>
References: <5cf776b80705011620h7eeba9a9k170132219527bff3@mail.gmail.com>
Message-ID: <55632.209.104.55.7.1178061986.squirrel@mail.ziff.net>

> I am currently using clamav (rpm) with my MailScanner setup.   I've
> noticed
> that it  calls a  clamav-wrapper so I am assuming that every email that
> the
> server receives invokes this wrapper.
>
> Some posts in this list mentioned that using clamd would give faster
> results
> so how can I make MailScanner use clamav such way?

Upgrade to the latest version of MS and the use the clamd virus scanner
instead of clamav.

-- 
Zivago Lee
z@ziff.net
From simon.walter at hp-factory.de  Wed May  2 00:42:42 2007
From: simon.walter at hp-factory.de (Simon Walter)
Date: Wed May  2 00:42:47 2007
Subject: ANNOUNCE: MailScanner stable 4.59
In-Reply-To: <4635D8B9.1010202@ecs.soton.ac.uk> (Julian Field's message of
	"Mon, 30 Apr 2007 12:53:29 +0100")
References: <804d04538f794f46b267ddf96294c135@solidstatelogic.com>
	<4635D8B9.1010202@ecs.soton.ac.uk>
Message-ID: <87ejm0t8jx.fsf@hp-factory.de>


Hello

Julian Field <MailScanner@ecs.soton.ac.uk> writes:

> Please can you try 4.49.4-2 and see if this still works for you. It 
> still includes the patch but is wrapped up so the truncation only 
> happens if his regexp matches.

Duh! I found this problem shortly after I send you the patch and fixed
it in the debian package. If anyone would have asked me I would have
sworn I informed you about the buggy patch, but I can't find any mail.
So I probably thought about sending you a mail but never did it. Sorry for that.

-- 
Regards Simon
From markee at bandwidthco.com  Wed May  2 03:34:03 2007
From: markee at bandwidthco.com (markee)
Date: Wed May  2 03:36:57 2007
Subject: ClamAV Module Core Dump
In-Reply-To: <f18e52$5km$1@sea.gmane.org>
Message-ID: <004601c78c62$5973bf70$0300a8c0@bandwidthco.com>

I have tried installing more than once, and I am near to wiping out the clam
library and installing again. I might try clamd first, as anything has to be
better than the commandline scanner. I am already running a few scanners,
and every bit of load adds up.

-- 

I'm thinking perhaps we need some of Julian's expert help here. The
clamavmodule does not seem to be working period for me on my two gateway
boxes. It did start once I upgraded to 0.90.2.


########################################################
This message has been scanned for viruses and dangerous content by
MailScanner, and is believed to be clean.

postmaster@bandwidthco.com
MailScanner at Bandwidthco Computer Security is for your absolute
protection.
########################################################




########################################################
This message has been scanned for viruses and dangerous 
content by MailScanner, and is believed to be clean.

postmaster@bandwidthco.com
MailScanner at Bandwidthco Computer Security is for your absolute protection.
########################################################

From goetz.reinicke at filmakademie.de  Wed May  2 07:04:30 2007
From: goetz.reinicke at filmakademie.de (=?ISO-8859-15?Q?G=F6tz_Reinicke?=)
Date: Wed May  2 07:04:38 2007
Subject: log message MailScanner: waiting for children to die
Message-ID: <463829EE.7080009@filmakademie.de>

Hi,

we recently upgraded our mailserver from Red Hat Enterprise Linux 4 to 
RHEL 5. We use the latest release of mailscanner and sendmail-8.13.8.

Everything is up and running very good, beside I do get the following 
message lots of time:

MailScanner: waiting for children to die: Process did not exit cleanly, 
returned 255 with signal 0

I'm using our "old" configuration from RHEL4 which worked without the 
message for a couple off years.

Any ideas or tips?


Best regards

G?tz Reinicke
-- 
G?tz Reinicke
IT Koordinator

Tel. +49 7141 969 420
Fax  +49 7141 969 55 420
E-Mail goetz.reinicke@filmakademie.de

Filmakademie Baden-W?rttemberg GmbH
Mathildenstr. 20
71638 Ludwigsburg
www.filmakademie.de

Eintragung Amtsgericht Stuttgart HRB 205016
Vorsitzender des Aufsichtsrats:
Dr. Christoph Palmer, MdL, Minister a.D.

Gesch?ftsf?hrer:
Prof. Thomas Schadt

From stork at openenterprise.ca  Wed May  2 07:50:57 2007
From: stork at openenterprise.ca (Johnny Stork)
Date: Wed May  2 07:51:04 2007
Subject: Mailscanner 4.59.4 and Mailwatch with clamd?
Message-ID: <463834D1.8050602@openenterprise.ca>

Skipped content of type multipart/alternative-------------- next part --------------
A non-text attachment was scrubbed...
Name: stork.vcf
Type: text/x-vcard
Size: 330 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070501/e04cf7fd/stork-0001.vcf
From stork at openenterprise.ca  Wed May  2 07:52:32 2007
From: stork at openenterprise.ca (Johnny Stork)
Date: Wed May  2 07:52:39 2007
Subject: Mailscanner 4.59.4 and Mailwatch with clamd?
In-Reply-To: <463834D1.8050602@openenterprise.ca>
References: <463834D1.8050602@openenterprise.ca>
Message-ID: <46383530.5000008@openenterprise.ca>

Skipped content of type multipart/alternative-------------- next part --------------
A non-text attachment was scrubbed...
Name: stork.vcf
Type: text/x-vcard
Size: 330 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070501/16bd86b1/stork.vcf
From benedict at kmun.gov.kw  Wed May  2 07:31:23 2007
From: benedict at kmun.gov.kw (benedict@kmun.gov.kw)
Date: Wed May  2 08:31:04 2007
Subject: query regading quarintine items
Message-ID: <2487.62.150.152.42.1178087483.squirrel@webmail.baladia.gov.kw>


dear All


I have been recently using mailSacnner and its workin beautifully

but i do have a query

suppose i get an zip attachment which contains an exe file the mailscanner
put the attachment in my quarantine directory which is perfect

now the user says he recived it from trusted source and want the attachement

how could i get the attachement back in his inbox so he could download it
to his computer

thnks and regards



simon





From bilias at edu.physics.uoc.gr  Wed May  2 08:52:33 2007
From: bilias at edu.physics.uoc.gr (Kapetanakis Giannis)
Date: Wed May  2 08:52:46 2007
Subject: Mailscanner 4.59.4 and Mailwatch with clamd?
In-Reply-To: <463834D1.8050602@openenterprise.ca>
References: <463834D1.8050602@openenterprise.ca>
Message-ID: <Pine.LNX.4.64.0705021051001.18856@python.edu.physics.uoc.gr>

On Tue, 1 May 2007, Johnny Stork wrote:

> Just upgraded to MS 4.59.4 and switched to clamd, but when I try to 
> get to the mailwatch interface I get
>
> *Error:*
> Unable to select a regular expression for your primary virus scanner 
> (clamd) - please see the examples in functions.php to create one.
>
> but there does not appear to be any settings for using clamd?
>
> Any suggestions?

That is not MailScanner's problem.
It is mailwatch.

anyway...
edit functions.php and and add the above under the clamav definition
case 'clamd':
    define(VIRUS_REGEX, '/(.+) contains (\S+)/');
    break;

Giannis
From list-mailscanner at linguaphone.com  Wed May  2 08:55:28 2007
From: list-mailscanner at linguaphone.com (Gareth)
Date: Wed May  2 08:55:43 2007
Subject: query regading quarintine items
In-Reply-To: <2487.62.150.152.42.1178087483.squirrel@webmail.baladia.gov.kw>
References: <2487.62.150.152.42.1178087483.squirrel@webmail.baladia.gov.kw>
Message-ID: <1178092528.17439.5.camel@gblades-suse.linguaphone-intranet.co.uk>

On Wed, 2007-05-02 at 07:31, benedict@kmun.gov.kw wrote:
> dear All
> 
> 
> I have been recently using mailSacnner and its workin beautifully
> 
> but i do have a query
> 
> suppose i get an zip attachment which contains an exe file the mailscanner
> put the attachment in my quarantine directory which is perfect
> 
> now the user says he recived it from trusted source and want the attachement
> 
> how could i get the attachement back in his inbox so he could download it
> to his computer

I would install Mailwatch and then you can release it from the quaranteen.
You could even give the user an account and they can release their own messages if you wish.
Note that mailwatch wont allow you to release a message if it contains a virus.

From martinh at solidstatelogic.com  Wed May  2 09:23:16 2007
From: martinh at solidstatelogic.com (Martin.Hepworth)
Date: Wed May  2 09:23:50 2007
Subject: SophosAVI
In-Reply-To: <46377FCD.2080608@gold.ac.uk>
Message-ID: <9edf4c5b34771e4b9445252efd4055fe@solidstatelogic.com>

Eric

1) its cheaper - about 33% discount for the server last time I renewed
(but that was about 3 years ago so I'm just about to find out by how
much this time!)

2) It's faster - you don't have to start a new process to scan the
email.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> bounces@lists.mailscanner.info] On Behalf Of e.bloodaxe@gold.ac.uk
> Sent: 01 May 2007 18:59
> To: MailScanner discussion
> Subject: SophosAVI
>
> Can someone point me to or tell me why I might want to use SophosAVI
> over plain Sophos.  although there is documenatation about how to
> install SophosAVI
> there is nothing telling me why I would want to do this.
>
> Eric
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!




**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the 
addressee only and may be confidential. If they come to you in error 
you must take no action based on them, nor must you copy or show them 
to anyone. Please advise the sender by replying to this e-mail 
immediately and then delete the original from your computer.

Opinion : Any opinions expressed in this e-mail are entirely those of 
the author and unless specifically stated to the contrary, are not 
necessarily those of the author's employer.

Security Warning : Internet e-mail is not necessarily a secure 
communications medium and can be subject to data corruption. We advise 
that you consider this fact when e-mailing us. 

Viruses : We have taken steps to ensure that this e-mail and any 
attachments are free from known viruses but in keeping with good 
computing practice, you should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales 
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
United Kingdom
**********************************************************************

From martinh at solidstatelogic.com  Wed May  2 09:26:06 2007
From: martinh at solidstatelogic.com (Martin.Hepworth)
Date: Wed May  2 09:26:10 2007
Subject: ClamAV Module Core Dump
In-Reply-To: <089CB271-EBCE-4738-9AF2-7F7867567CB3@technologytiger.net>
Message-ID: <774368311c56f847880c7861fc0135b6@solidstatelogic.com>

Drew

I've never managed to get clammodule working with FreeBSD (well the 4.x
version of FreeBSD).

Just switched to the clamd version and it's working fine.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> bounces@lists.mailscanner.info] On Behalf Of Drew Marshall
> Sent: 01 May 2007 22:35
> To: MailScanner discussion
> Subject: Re: ClamAV Module Core Dump
>
> On 1 May 2007, at 22:23, Ren? Berber wrote:
>
> > Drew Marshall wrote:
> >
> >> Ok another challenge that I hope you can help with. I am running a
> >> FreeBSD 6 box that I have just upgraded to ClamAV 0.90.2 which was
> >> upgraded from the ports tree. Knowing there can be issues, I also
> >> forced an update (Which in effect recompiles) of the Clam perl
> >> module.
> >
> > Which version of Mail::ClamAV?  your long list below doesn't
> > include it, version 0.20 is required.
>
> It is version 0.20, I forgot that it core dumped while trying to even
> list it.
>
> >
> > Did you also run ldconfig? (required when installing clamav-0.90.2)
>
> As part of the ports build process, I believe so. I normally just
> portupgrade and sit back and wait.
>
> >
> >> Restarted MailScanner and ever since MS core dumps. I can run MS
> >> using ClamAV only but it makes quite a performance hit so I want
> >> to get t reinstalled ASAP.
> >
> > You can also use clamd/clamdscan with the new beta version of MS or
> > with a few changes to the version you have.
>
> True.
>
> >
> >> Running in debug mode, I helpfully get:
> >> root@mx1 /usr/local/etc/MailScanner # mailscanner --debug
> >> In Debugging mode, not forking...
> >> Segmentation fault
> >
> > Do you have a core file?  can you run the debugger on it?
>
> No, I can't find the damn thing. I would have expected it to drop
> into the directory that either I was in or MS was running in and
> neither (Unless MS is cleaning it up when starting/ failing).
>
> Thanks for your help.
>
> Drew
> --
> In line with our policy, this message has been scanned
> for viruses and dangerous content by the Technology Tiger MailScanner.
> Further information can be found at www.technologytiger.net/policy
>
> Technology Tiger Limited is registered in Scotland with registration
> number: 310997
> Registered Office 55-57 West High Street Inverurie AB51 3QQ
>
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!




**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the 
addressee only and may be confidential. If they come to you in error 
you must take no action based on them, nor must you copy or show them 
to anyone. Please advise the sender by replying to this e-mail 
immediately and then delete the original from your computer.

Opinion : Any opinions expressed in this e-mail are entirely those of 
the author and unless specifically stated to the contrary, are not 
necessarily those of the author's employer.

Security Warning : Internet e-mail is not necessarily a secure 
communications medium and can be subject to data corruption. We advise 
that you consider this fact when e-mailing us. 

Viruses : We have taken steps to ensure that this e-mail and any 
attachments are free from known viruses but in keeping with good 
computing practice, you should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales 
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
United Kingdom
**********************************************************************

From martinh at solidstatelogic.com  Wed May  2 09:27:38 2007
From: martinh at solidstatelogic.com (Martin.Hepworth)
Date: Wed May  2 09:27:43 2007
Subject: log message MailScanner: waiting for children to die
In-Reply-To: <463829EE.7080009@filmakademie.de>
Message-ID: <7749f34107be65419d7a566a3b67215f@solidstatelogic.com>


Hi

You say - 'old' configuration. Did you run the upgrade scripts to make
sure new settings get inserted etc or just copy MailScanner.conf across?

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> bounces@lists.mailscanner.info] On Behalf Of G?tz Reinicke
> Sent: 02 May 2007 07:05
> To: mailscanner@lists.mailscanner.info
> Subject: log message MailScanner: waiting for children to die
>
> Hi,
>
> we recently upgraded our mailserver from Red Hat Enterprise Linux 4 to
> RHEL 5. We use the latest release of mailscanner and sendmail-8.13.8.
>
> Everything is up and running very good, beside I do get the following
> message lots of time:
>
> MailScanner: waiting for children to die: Process did not exit
cleanly,
> returned 255 with signal 0
>
> I'm using our "old" configuration from RHEL4 which worked without the
> message for a couple off years.
>
> Any ideas or tips?
>
>
> Best regards
>
> G?tz Reinicke
> --
> G?tz Reinicke
> IT Koordinator
>
> Tel. +49 7141 969 420
> Fax  +49 7141 969 55 420
> E-Mail goetz.reinicke@filmakademie.de
>
> Filmakademie Baden-W?rttemberg GmbH
> Mathildenstr. 20
> 71638 Ludwigsburg
> www.filmakademie.de
>
> Eintragung Amtsgericht Stuttgart HRB 205016
> Vorsitzender des Aufsichtsrats:
> Dr. Christoph Palmer, MdL, Minister a.D.
>
> Gesch?ftsf?hrer:
> Prof. Thomas Schadt
>
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!




**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the 
addressee only and may be confidential. If they come to you in error 
you must take no action based on them, nor must you copy or show them 
to anyone. Please advise the sender by replying to this e-mail 
immediately and then delete the original from your computer.

Opinion : Any opinions expressed in this e-mail are entirely those of 
the author and unless specifically stated to the contrary, are not 
necessarily those of the author's employer.

Security Warning : Internet e-mail is not necessarily a secure 
communications medium and can be subject to data corruption. We advise 
that you consider this fact when e-mailing us. 

Viruses : We have taken steps to ensure that this e-mail and any 
attachments are free from known viruses but in keeping with good 
computing practice, you should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales 
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
United Kingdom
**********************************************************************

From a.peacock at chime.ucl.ac.uk  Wed May  2 09:53:20 2007
From: a.peacock at chime.ucl.ac.uk (Anthony Peacock)
Date: Wed May  2 09:53:44 2007
Subject: A lot of spam getting through
In-Reply-To: <04D932B0071FE34FA63EBB1977B48D15028171C9@woodenex.woodmaclaw.local>
References: <04D932B0071FE34FA63EBB1977B48D15028171C9@woodenex.woodmaclaw.local>
Message-ID: <46385180.5090601@chime.ucl.ac.uk>

Hi,

Billy A. Pumphrey wrote:
>>> After looking at a few emails I can see that pyzor and DCC and bayes
> are
>>> scoring:
>>> Score Matching Rule Description
>>> cached not
>>>  score=24.094
>>> 6 required
>>>  autolearn=spam
>>> 2.17 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
>>> 0.33 FH_DATE_ISNT_2006
>>> 0.77 FH_DATE_ISNT_200X
>>> 0.40 FH_LEADINGPREP
>>> 0.71 FS_START_BUY
>>> 3.70 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/)
>>> 0.61 SARE_SXLIFE Talks about your sex life
>>> 3.81 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
>>> 4.09 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
>>> 3.01 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
>>> 4.50 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
>> Are these the scores that your system gives to one of the emails that
>> are gettig through?  If so that scored 24 points.  So this email
> should
>> have been filtered.  This suggests to me that the problem isn't with
> SA
>> but with something in your MailScanner settings.
>>
> 
> This email was tagged as spam so good to go there.

So, help us out and show us the scores and headers from one that does 
get through.  We might be able to see where they are failing then.

Even better...  Save one of the misdiagnosed emails as a text file, post 
it to a web address and let us know.  We can then run that email through 
our systems and tell you what scores we get and what rules helped.

> 
>> If these aren't the scores from one of the emails that are getting
>> through can you save an email to a text file and send the output of
> the
>> following command:
>>
>> spamassassin --test-mode < email.txt
>>
>>
>>
>> --
>> Anthony Peacock
>> CHIME, Royal Free & University College Medical School
>> WWW:    http://www.chime.ucl.ac.uk/~rmhiajp/
>> "If you have an apple and I have  an apple and we  exchange apples
>> then you and I will still each have  one apple. But  if you have an
>> idea and I have an idea and we exchange these ideas, then each of us
>> will have two ideas." -- George Bernard Shaw
>> --
> 
> 


-- 
Anthony Peacock
CHIME, Royal Free & University College Medical School
WWW:    http://www.chime.ucl.ac.uk/~rmhiajp/
"If you have an apple and I have  an apple and we  exchange apples
then you and I will still each have  one apple. But  if you have an
idea and I have an idea and we exchange these ideas, then each of us
will have two ideas." -- George Bernard Shaw
From goetz.reinicke at filmakademie.de  Wed May  2 09:55:50 2007
From: goetz.reinicke at filmakademie.de (=?ISO-8859-1?Q?G=F6tz_Reinicke?=)
Date: Wed May  2 09:56:03 2007
Subject: log message MailScanner: waiting for children to die
In-Reply-To: <7749f34107be65419d7a566a3b67215f@solidstatelogic.com>
References: <7749f34107be65419d7a566a3b67215f@solidstatelogic.com>
Message-ID: <46385216.1070501@filmakademie.de>

Hallo,

yes, I run the upgrade scripts.

Regards

G?tz

Martin.Hepworth schrieb:
> Hi
> 
> You say - 'old' configuration. Did you run the upgrade scripts to make
> sure new settings get inserted etc or just copy MailScanner.conf across?
> 
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
> 
>> -----Original Message-----
>> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
>> bounces@lists.mailscanner.info] On Behalf Of G?tz Reinicke
>> Sent: 02 May 2007 07:05
>> To: mailscanner@lists.mailscanner.info
>> Subject: log message MailScanner: waiting for children to die
>>
>> Hi,
>>
>> we recently upgraded our mailserver from Red Hat Enterprise Linux 4 to
>> RHEL 5. We use the latest release of mailscanner and sendmail-8.13.8.
>>
>> Everything is up and running very good, beside I do get the following
>> message lots of time:
>>
>> MailScanner: waiting for children to die: Process did not exit
> cleanly,
>> returned 255 with signal 0
>>
>> I'm using our "old" configuration from RHEL4 which worked without the
>> message for a couple off years.


-- 
G?tz Reinicke
IT Koordinator

Tel. +49 7141 969 420
Fax  +49 7141 969 55 420
E-Mail goetz.reinicke@filmakademie.de

Filmakademie Baden-W?rttemberg GmbH
Mathildenstr. 20
71638 Ludwigsburg
www.filmakademie.de

Eintragung Amtsgericht Stuttgart HRB 205016
Vorsitzender des Aufsichtsrats:
Dr. Christoph Palmer, MdL, Minister a.D.

Gesch?ftsf?hrer:
Prof. Thomas Schadt

From martinh at solidstatelogic.com  Wed May  2 10:11:28 2007
From: martinh at solidstatelogic.com (Martin.Hepworth)
Date: Wed May  2 10:11:36 2007
Subject: log message MailScanner: waiting for children to die
In-Reply-To: <46385216.1070501@filmakademie.de>
Message-ID: <b632dc522e6c1b4b9b0d6e370675da30@solidstatelogic.com>


OK,

Can you do a MailScanner -v and post the output. I wonder if the upgrade
to RHES5 broke something.

Other thing to do is stop mailscanner then run, "MailScanner -debug"
which will hopefully show you where things are breaking.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> bounces@lists.mailscanner.info] On Behalf Of G?tz Reinicke
> Sent: 02 May 2007 09:56
> To: MailScanner discussion
> Subject: Re: log message MailScanner: waiting for children to die
>
> Hallo,
>
> yes, I run the upgrade scripts.
>
> Regards
>
> G?tz
>
> Martin.Hepworth schrieb:
> > Hi
> >
> > You say - 'old' configuration. Did you run the upgrade scripts to
make
> > sure new settings get inserted etc or just copy MailScanner.conf
across?
> >
> > --
> > Martin Hepworth
> > Snr Systems Administrator
> > Solid State Logic
> > Tel: +44 (0)1865 842300
> >
> >> -----Original Message-----
> >> From: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-
> >> bounces@lists.mailscanner.info] On Behalf Of G?tz Reinicke
> >> Sent: 02 May 2007 07:05
> >> To: mailscanner@lists.mailscanner.info
> >> Subject: log message MailScanner: waiting for children to die
> >>
> >> Hi,
> >>
> >> we recently upgraded our mailserver from Red Hat Enterprise Linux 4
to
> >> RHEL 5. We use the latest release of mailscanner and
sendmail-8.13.8.
> >>
> >> Everything is up and running very good, beside I do get the
following
> >> message lots of time:
> >>
> >> MailScanner: waiting for children to die: Process did not exit
> > cleanly,
> >> returned 255 with signal 0
> >>
> >> I'm using our "old" configuration from RHEL4 which worked without
the
> >> message for a couple off years.
>
>
> --
> G?tz Reinicke
> IT Koordinator
>
> Tel. +49 7141 969 420
> Fax  +49 7141 969 55 420
> E-Mail goetz.reinicke@filmakademie.de
>
> Filmakademie Baden-W?rttemberg GmbH
> Mathildenstr. 20
> 71638 Ludwigsburg
> www.filmakademie.de
>
> Eintragung Amtsgericht Stuttgart HRB 205016
> Vorsitzender des Aufsichtsrats:
> Dr. Christoph Palmer, MdL, Minister a.D.
>
> Gesch?ftsf?hrer:
> Prof. Thomas Schadt
>
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!




**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the 
addressee only and may be confidential. If they come to you in error 
you must take no action based on them, nor must you copy or show them 
to anyone. Please advise the sender by replying to this e-mail 
immediately and then delete the original from your computer.

Opinion : Any opinions expressed in this e-mail are entirely those of 
the author and unless specifically stated to the contrary, are not 
necessarily those of the author's employer.

Security Warning : Internet e-mail is not necessarily a secure 
communications medium and can be subject to data corruption. We advise 
that you consider this fact when e-mailing us. 

Viruses : We have taken steps to ensure that this e-mail and any 
attachments are free from known viruses but in keeping with good 
computing practice, you should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales 
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
United Kingdom
**********************************************************************

From fssilva at gmail.com  Wed May  2 12:15:17 2007
From: fssilva at gmail.com (Fabio Silva)
Date: Wed May  2 12:15:53 2007
Subject: Fwd: [shell-script] Oportunidade - TALENT FOUR/ Administrador de
	Redes e Sistemas - LINUX
In-Reply-To: <6C590FEEFDEC05478512F3771363C6DB489830@tfcmail02.tfc.com.br>
References: <6C590FEEFDEC05478512F3771363C6DB489830@tfcmail02.tfc.com.br>
Message-ID: <c8c4ee450705020415l648e0934rdeec679441ce3e98@mail.gmail.com>

---------- Forwarded message ----------
From: Renata Dardis de Souza <renata.souza@talentfour.com.br>
Date: Apr 30, 2007 4:30 PM
Subject: [shell-script] Oportunidade - TALENT FOUR/ Administrador de Redes e
Sistemas  - LINUX
To: shell-script@yahoogrupos.com.br

  Ol? Grupo,

Boa tarde!!!!

A Talent Four Consulting ? uma empresa de consultoria em projetos de
Tecnologia da Informa??o, especializada em servi?os e terceiriza??o de
Profissionais.
Atuamos em servi?os de Body Shop, Desenvolvimento de Sistemas, F?brica de
Software e Documenta??o de Sistemas Legados, Help Desk e Recrutamento e
Sele??o (exclusivamente para profissionais de T.I).
Nosso quadro de consultores contempla mais de 300 Profissionais ativos com
capilaridade nacional de atendimento.
Acesse nosso site: www.talentfour.com.br e verifique todas as nossas
oportunidades e servi?os.
Favor encaminhar curr?culos para
renata.souza@talentfour.com.br<renata.souza%40talentfour.com.br><mailto:
renata.souza%40talentfour.com.br>

ADMINISTRADOR DE REDES E SISTEMAS

Experi?ncia: Sistemas Operacionais: Linux (Dom?nio)

Linguagens de programa??o, Shell Script, Perl

Servi?os/Aplicativos de redes de computadores: SNMP, SMTP, POP, IMAP, Samba,
HTTP, VPN

Hardware: Conhecimentos Avan?ados

Switches e Roteadores: Exigido

Conhecimento em ITIL: Exigido

P?s-graduado em Administra??o de Redes, Gest?o de TI e/ou Gerenciamento de
Projetos em ?nfase em Ti

Certifica??es (Exigido): CCNA, LPI, MCSE

Gest?o de redes, sistemas operacionais e hardwares

Gest?o de monitoramento do ambiente computacional

Gera??o de relat?rios relacionados ao ambiente gerenciado

Idiomas:

Ingl?s - Fluente

Espanhol - Intermedi?rio

Contrata??o: CLT - diretamente pelo cliente.

Hor?rio de Expediente: 08h00 as 17h00 - flexibilidade para trabalhos
espor?dicos fora do hor?rio de expediente

Local de trabalho: Vl Ol?mpia - S?o Paulo - SP

Disponibilidade: Imediata.

Caso houver indica??es de profissionais dentro deste perfil, ficarei
aguardando.

OS: C.Vs fora do perfil ser?o desconsiderados automaticamente.

Att,

Renata Dardis de Souza
Talent Four - Analista de RH

Avenida Dr. Cardoso de Melo, 1608 4o. Vila Ol?mpia

04548-005 S?o Paulo-SP

Fone: 55 11 3848-4445

Celular: 55 11 9283-9093

E-mail: renata.souza@talentfour.com.br <renata.souza%40talentfour.com.br>

www.talentfour.com.br <http://www.talentfour.com.br/>

[As partes desta mensagem que n?o continham texto foram removidas]

 __._,_.___  Mensagens neste t?pico
<http://br.groups.yahoo.com/group/shell-script/message/22583;_ylc=X3oDMTM2NWEwaGY0BF9TAzk3NDkwNDM3BGdycElkAzE5NDEzMTIEZ3Jwc3BJZAMyMTM3MTExMjU0BG1zZ0lkAzIyNTgzBHNlYwNmdHIEc2xrA3Z0cGMEc3RpbWUDMTE3Nzk2MjA5NAR0cGNJZAMyMjU4Mw-->(
1)  Responder (atrav?s da web)
<http://br.groups.yahoo.com/group/shell-script/post;_ylc=X3oDMTJxcXFlNnBzBF9TAzk3NDkwNDM3BGdycElkAzE5NDEzMTIEZ3Jwc3BJZAMyMTM3MTExMjU0BG1zZ0lkAzIyNTgzBHNlYwNmdHIEc2xrA3JwbHkEc3RpbWUDMTE3Nzk2MjA5NA--?act=reply&messageNum=22583>|
Adicionar
um novo t?pico
<http://br.groups.yahoo.com/group/shell-script/post;_ylc=X3oDMTJlMWhnbHZoBF9TAzk3NDkwNDM3BGdycElkAzE5NDEzMTIEZ3Jwc3BJZAMyMTM3MTExMjU0BHNlYwNmdHIEc2xrA250cGMEc3RpbWUDMTE3Nzk2MjA5NA-->
 Mensagens<http://br.groups.yahoo.com/group/shell-script/messages;_ylc=X3oDMTJlaGlsOGQxBF9TAzk3NDkwNDM3BGdycElkAzE5NDEzMTIEZ3Jwc3BJZAMyMTM3MTExMjU0BHNlYwNmdHIEc2xrA21zZ3MEc3RpbWUDMTE3Nzk2MjA5NA-->|
Arquivos<http://br.groups.yahoo.com/group/shell-script/files;_ylc=X3oDMTJmcGFmOXE3BF9TAzk3NDkwNDM3BGdycElkAzE5NDEzMTIEZ3Jwc3BJZAMyMTM3MTExMjU0BHNlYwNmdHIEc2xrA2ZpbGVzBHN0aW1lAzExNzc5NjIwOTQ->|
Fotos<http://br.groups.yahoo.com/group/shell-script/photos;_ylc=X3oDMTJlZ29oZWVuBF9TAzk3NDkwNDM3BGdycElkAzE5NDEzMTIEZ3Jwc3BJZAMyMTM3MTExMjU0BHNlYwNmdHIEc2xrA3Bob3QEc3RpbWUDMTE3Nzk2MjA5NA-->|
Links<http://br.groups.yahoo.com/group/shell-script/links;_ylc=X3oDMTJmZ3RndGVzBF9TAzk3NDkwNDM3BGdycElkAzE5NDEzMTIEZ3Jwc3BJZAMyMTM3MTExMjU0BHNlYwNmdHIEc2xrA2xpbmtzBHN0aW1lAzExNzc5NjIwOTQ->
 ---------------------------------------------------------------------
Esta lista n?o admite a abordagem de outras liguagens de programa??o, como
perl, C etc. Quem insistir em n?o seguir esta regra ser? moderado sem pr?vio
aviso.
---------------------------------------------------------------------
Sair da lista: shell-script-unsubscribe@yahoogrupos.com.br
---------------------------------------------------------------------
Esta lista ? moderada de acordo com o previsto em
http://www.listas-discussao.cjb.net
---------------------------------------------------------------------
Servidor Newsgroup da lista: news.gmane.org
Grupo: gmane.org.user-groups.programming.shell.brazil

  [image: Yahoo!
Grupos]<http://br.groups.yahoo.com/;_ylc=X3oDMTJkaDlib2ZnBF9TAzk3NDkwNDM3BGdycElkAzE5NDEzMTIEZ3Jwc3BJZAMyMTM3MTExMjU0BHNlYwNmdHIEc2xrA2dmcARzdGltZQMxMTc3OTYyMDk0>
Alterar configura??es via
web<http://br.groups.yahoo.com/group/shell-script/join;_ylc=X3oDMTJmZ3ZlazhpBF9TAzk3NDkwNDM3BGdycElkAzE5NDEzMTIEZ3Jwc3BJZAMyMTM3MTExMjU0BHNlYwNmdHIEc2xrA3N0bmdzBHN0aW1lAzExNzc5NjIwOTQ->(Requer
Yahoo! ID)
Alterar configura??es via e-mail: Alterar recebimento para lista di?ria de
mensagens<shell-script-digest@yahoogrupos.com.br?subject=+Recebimento+de+e-mail:+Lista+de+mensagens>|
Alterar
formato para o tradicional<shell-script-traditional@yahoogrupos.com.br?subject=Alterar+formato+de+distribui%C3%A7%C3%A3o:+Tradicional>
 Visite seu Grupo
<http://br.groups.yahoo.com/group/shell-script;_ylc=X3oDMTJka284c3Y2BF9TAzk3NDkwNDM3BGdycElkAzE5NDEzMTIEZ3Jwc3BJZAMyMTM3MTExMjU0BHNlYwNmdHIEc2xrA2hwZgRzdGltZQMxMTc3OTYyMDk0>|
Termos
de uso do Yahoo! Grupos <http://br.yahoo.com/info/utos.html> | Sair do grupo
<shell-script-unsubscribe@yahoogrupos.com.br?subject=>
  Atividade nos ?ltimos dias

   -  21
   Novos usu?rios<http://br.groups.yahoo.com/group/shell-script/members;_ylc=X3oDMTJmNWJicGRqBF9TAzk3NDkwNDM3BGdycElkAzE5NDEzMTIEZ3Jwc3BJZAMyMTM3MTExMjU0BHNlYwN2dGwEc2xrA3ZtYnJzBHN0aW1lAzExNzc5NjIwOTQ->

 Visite seu Grupo
<http://br.groups.yahoo.com/group/shell-script;_ylc=X3oDMTJlZnBycWZhBF9TAzk3NDkwNDM3BGdycElkAzE5NDEzMTIEZ3Jwc3BJZAMyMTM3MTExMjU0BHNlYwN2dGwEc2xrA3ZnaHAEc3RpbWUDMTE3Nzk2MjA5NA-->
 Yahoo! Mail

Conecte-se ao mundo<http://us.lrd.yahoo.com/_ylc=X3oDMTJsajg5djhtBF9TAzk3NDkwNDM3BF9wAzEEZ3JwSWQDMTk0MTMxMgRncnBzcElkAzIxMzcxMTEyNTQEc2VjA25jbW9kBHNsawNtYWlsBHN0aW1lAzExNzc5NjIwOTQ-;_ylg=1/SIG=10ujd6ds6/**http%3A//mail.yahoo.com.br/>

Prote??o anti-spam

Muito mais espa?o
 Yahoo! Barra

Instale gr?tis<http://us.lrd.yahoo.com/_ylc=X3oDMTJvcmpmdmxjBF9TAzk3NDkwNDM3BF9wAzIEZ3JwSWQDMTk0MTMxMgRncnBzcElkAzIxMzcxMTEyNTQEc2VjA25jbW9kBHNsawN0b29sYmFyBHN0aW1lAzExNzc5NjIwOTQ-;_ylg=1/SIG=111ngvtas/**http%3A//br.toolbar.yahoo.com/>

Buscar sites na web

Checar seus e-mails .
 Yahoo! Grupos

Crie seu pr?prio
grupo<http://br.groups.yahoo.com/;_ylc=X3oDMTJvZjJpM2dyBF9TAzk3NDkwNDM3BF9wAzMEZ3JwSWQDMTk0MTMxMgRncnBzcElkAzIxMzcxMTEyNTQEc2VjA25jbW9kBHNsawNncm91cHMyBHN0aW1lAzExNzc5NjIwOTQ->

A melhor forma de comunica??o

  .

__,_._,___


-- 
Fabio S. Silva
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070502/f8be7ff7/attachment.html
From rcooper at dwford.com  Wed May  2 12:43:55 2007
From: rcooper at dwford.com (Rick Cooper)
Date: Wed May  2 12:44:01 2007
Subject: Mailscanner 4.59.4 and Mailwatch with clamd?
In-Reply-To: <46383530.5000008@openenterprise.ca>
References: <463834D1.8050602@openenterprise.ca>
	<46383530.5000008@openenterprise.ca>
Message-ID: <032101c78caf$2a805f50$0301a8c0@SAHOMELT>

 


________________________________

	From: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Johnny
Stork
	Sent: Wednesday, May 02, 2007 2:53 AM
	To: MailScanner discussion
	Subject: Re: Mailscanner 4.59.4 and Mailwatch with clamd?
	
	
	oops...meant to send this to the mailwatch list....sorry....but feel
free to answer if someone has a solution.
	
	Johnny Stork wrote: 

		Just upgraded to MS 4.59.4 and switched to clamd, but when I
try to get to the mailwatch interface I get
		
		Error:
		 Unable to select a regular expression for your primary
virus scanner (clamd) - please see the examples in functions.php to create
one.
		
		but there does not appear to be any settings for using
clamd?
		
		Any suggestions?
[..]

Find functions.php in your MailWatch web directory (ie
/var/www/html/mailscanner). Open functions.php in an editor and look for
(about line 71) :

  case 'clamav':
   define(VIRUS_REGEX, '/(.+) contains (\S+)/');
   break;

Insert below the "break;" line:

  case 'clamd':
   define(VIRUS_REGEX, '/(.+) contains (\S+)/');
   break;


I don't remember if you need to restart MS, I would think not.

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


From goetz.reinicke at filmakademie.de  Wed May  2 13:24:16 2007
From: goetz.reinicke at filmakademie.de (=?ISO-8859-1?Q?G=F6tz_Reinicke?=)
Date: Wed May  2 13:24:23 2007
Subject: log message MailScanner: waiting for children to die
In-Reply-To: <b632dc522e6c1b4b9b0d6e370675da30@solidstatelogic.com>
References: <b632dc522e6c1b4b9b0d6e370675da30@solidstatelogic.com>
Message-ID: <463882F0.3060207@filmakademie.de>

Martin.Hepworth schrieb:
> OK,
> 
> Can you do a MailScanner -v and post the output. I wonder if the upgrade
> to RHES5 broke something.

[root@mail en]# MailScanner -v
Running on
Linux mail.filmakademie.de 2.6.18-8.1.1.el5 #1 SMP Mon Feb 26 20:38:02 
EST 2007 i686 i686 i386 GNU/Linux
This is Red Hat Enterprise Linux Server release 5 (Tikanga)
This is Perl version 5.008008 (5.8.8)

This is MailScanner version 4.59.4
Module versions are:
1.00    AnyDBM_File
1.16    Archive::Zip
1.04    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.05    Fcntl
2.74    File::Basename
2.09    File::Copy
2.01    FileHandle
1.08    File::Path
0.16    File::Temp
0.90    Filesys::Df
1.35    HTML::Entities
3.55    HTML::Parser
2.37    HTML::TokeParser
1.22    IO
1.13    IO::File
1.13    IO::Pipe
1.76    Mail::Header
3.05    MIME::Base64
5.420   MIME::Decoder
5.420   MIME::Decoder::UU
5.420   MIME::Head
5.420   MIME::Parser
3.03    MIME::QuotedPrint
5.420   MIME::Tools
0.11    Net::CIDR
1.09    POSIX
1.78    Socket
1.4     Sys::Hostname::Long
0.18    Sys::Syslog
1.86    Time::HiRes
1.02    Time::localtime

Optional module versions are:
0.17    Convert::TNEF
1.814   DB_File
1.13    DBD::SQLite
1.52    DBI
1.14    Digest
1.01    Digest::HMAC
2.36    Digest::MD5
2.11    Digest::SHA1
0.44    Inline
missing Mail::ClamAV
3.001008        Mail::SpamAssassin
1.999001        Mail::SPF::Query
0.20    Net::CIDR::Lite
1.25    Net::IP
0.59    Net::DNS
0.32    Net::LDAP
missing Parse::RecDescent
missing SAVI
2.56    Test::Harness
0.62    Test::Simple
1.95    Text::Balanced
1.35    URI


> 
> Other thing to do is stop mailscanner then run, "MailScanner -debug"
> which will hopefully show you where things are breaking.

This didn't show anything yet ...

Thanks and regards

G?tz
-- 
G?tz Reinicke
IT Koordinator

Tel. +49 7141 969 420
Fax  +49 7141 969 55 420
E-Mail goetz.reinicke@filmakademie.de

Filmakademie Baden-W?rttemberg GmbH
Mathildenstr. 20
71638 Ludwigsburg
www.filmakademie.de

Eintragung Amtsgericht Stuttgart HRB 205016
Vorsitzender des Aufsichtsrats:
Dr. Christoph Palmer, MdL, Minister a.D.

Gesch?ftsf?hrer:
Prof. Thomas Schadt

From list-mailscanner at linguaphone.com  Wed May  2 13:25:48 2007
From: list-mailscanner at linguaphone.com (Gareth)
Date: Wed May  2 13:26:08 2007
Subject: Spam detection rates
Message-ID: <1178108748.17627.17.camel@gblades-suse.linguaphone-intranet.co.uk>

I was wondering what sort of detection rates people are getting when
using Mailscanner.
Our old spamassassin 2.64 based system was only getting about 80% but
with Mailscanner and the latest software we seem to be getting over
99.5% which is extremely good. False positives are very low aswell.

We do tend to be very strict about pictures attached to emails as I
think we have a few rules which do the same sort of checks. Some
external people using the incredimail 'piece of cr**p' mail client get a
continuous score about 4.3 which leaves the AWL little room to bring the
occasional higher scoring mail back below the 5.0 threshold. It hasn't
caused any people to complain though.

From martinh at solidstatelogic.com  Wed May  2 13:42:56 2007
From: martinh at solidstatelogic.com (Martin.Hepworth)
Date: Wed May  2 13:43:07 2007
Subject: Spam detection rates
In-Reply-To: <1178108748.17627.17.camel@gblades-suse.linguaphone-intranet.co.uk>
Message-ID: <4ba8efec2dc55e4fb46d4580263ece61@solidstatelogic.com>


About the same - I've got lots of extra rules and also use dcc/pyzor etc
so it's difficult to say there's been an improvement as I updated from
2.64 when 3.01 came along a few years ago.


BTW - any just noticed 3.2.0 has been released !

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300
> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> bounces@lists.mailscanner.info] On Behalf Of Gareth
> Sent: 02 May 2007 13:26
> To: mailscanner@lists.mailscanner.info
> Subject: Spam detection rates
>
> I was wondering what sort of detection rates people are getting when
> using Mailscanner.
> Our old spamassassin 2.64 based system was only getting about 80% but
> with Mailscanner and the latest software we seem to be getting over
> 99.5% which is extremely good. False positives are very low aswell.
>
> We do tend to be very strict about pictures attached to emails as I
> think we have a few rules which do the same sort of checks. Some
> external people using the incredimail 'piece of cr**p' mail client get
a
> continuous score about 4.3 which leaves the AWL little room to bring
the
> occasional higher scoring mail back below the 5.0 threshold. It hasn't
> caused any people to complain though.
>
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!




**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the 
addressee only and may be confidential. If they come to you in error 
you must take no action based on them, nor must you copy or show them 
to anyone. Please advise the sender by replying to this e-mail 
immediately and then delete the original from your computer.

Opinion : Any opinions expressed in this e-mail are entirely those of 
the author and unless specifically stated to the contrary, are not 
necessarily those of the author's employer.

Security Warning : Internet e-mail is not necessarily a secure 
communications medium and can be subject to data corruption. We advise 
that you consider this fact when e-mailing us. 

Viruses : We have taken steps to ensure that this e-mail and any 
attachments are free from known viruses but in keeping with good 
computing practice, you should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales 
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
United Kingdom
**********************************************************************

From dominian at slackadelic.com  Wed May  2 13:43:09 2007
From: dominian at slackadelic.com (Matt Hayes)
Date: Wed May  2 13:43:21 2007
Subject: Mailscanner 4.59.4 and Mailwatch with clamd?
In-Reply-To: <46383530.5000008@openenterprise.ca>
References: <463834D1.8050602@openenterprise.ca>
	<46383530.5000008@openenterprise.ca>
Message-ID: <4638875D.5090800@slackadelic.com>

Johnny Stork wrote:
> oops...meant to send this to the mailwatch list....sorry....but feel 
> free to answer if someone has a solution.
> 
> Johnny Stork wrote:
>> Just upgraded to MS 4.59.4 and switched to clamd, but when I try to 
>> get to the mailwatch interface I get
>>
>> *Error:*
>>  Unable to select a regular expression for your primary virus scanner 
>> (clamd) - please see the examples in functions.php to create one.
>>
>> but there does not appear to be any settings for using clamd?
>>
>> Any suggestions?
>>

What you need to do is add in another antivirus for mailwatch to use.

In your mailwatch directory in the functions.php just under the 
clamavmodule definition I added:

   case 'clamd':
    define(VIRUS_REGEX, '/(.+) contains (\S+)/');
    break;


Then mailwatch works fine :)

-Matt


From prandal at herefordshire.gov.uk  Wed May  2 13:42:57 2007
From: prandal at herefordshire.gov.uk (Randal, Phil)
Date: Wed May  2 13:43:22 2007
Subject: Spam detection rates
In-Reply-To: <1178108748.17627.17.camel@gblades-suse.linguaphone-intranet.co.uk>
References: <1178108748.17627.17.camel@gblades-suse.linguaphone-intranet.co.uk>
Message-ID: <7EF0EE5CB3B263488C8C18823239BEBA9222C4@HC-MBX02.herefordshire.gov.uk>

We consistently get over 99.5% of spam too.

Last month we blocked around 260,000 at the sendmail level
(cbl.abuseat.org RBL and GreetPause), and 400,000 in MailScanner.

Spam seems to be around 75% of total emails here.

Cheers,

Phil
--
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK  

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info 
> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf 
> Of Gareth
> Sent: 02 May 2007 13:26
> To: mailscanner@lists.mailscanner.info
> Subject: Spam detection rates
> 
> I was wondering what sort of detection rates people are getting when
> using Mailscanner.
> Our old spamassassin 2.64 based system was only getting about 80% but
> with Mailscanner and the latest software we seem to be getting over
> 99.5% which is extremely good. False positives are very low aswell.
> 
> We do tend to be very strict about pictures attached to emails as I
> think we have a few rules which do the same sort of checks. Some
> external people using the incredimail 'piece of cr**p' mail 
> client get a
> continuous score about 4.3 which leaves the AWL little room 
> to bring the
> occasional higher scoring mail back below the 5.0 threshold. It hasn't
> caused any people to complain though.
> 
> -- 
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website! 
> 
From jonbjorn at mbl.is  Wed May  2 14:39:33 2007
From: jonbjorn at mbl.is (Jon Bjorn Njalsson)
Date: Wed May  2 14:39:50 2007
Subject: No Programs allowed
Message-ID: <1178113173.14147.16.camel@viper.mbl.is>

Why does MS think msg-26670-41.txt is a program ?

MailScanner: No programs allowed (msg-26670-41.txt)

regards
Jon Bjorn

From martinh at solidstatelogic.com  Wed May  2 14:44:21 2007
From: martinh at solidstatelogic.com (Martin.Hepworth)
Date: Wed May  2 14:44:21 2007
Subject: No Programs allowed
In-Reply-To: <1178113173.14147.16.camel@viper.mbl.is>
Message-ID: <edfa16c4a0fc254ba62ada22a956f081@solidstatelogic.com>

Jon

The file command is showing it as a program.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> bounces@lists.mailscanner.info] On Behalf Of Jon Bjorn Njalsson
> Sent: 02 May 2007 14:40
> To: MailScanner discussion
> Subject: No Programs allowed
>
> Why does MS think msg-26670-41.txt is a program ?
>
> MailScanner: No programs allowed (msg-26670-41.txt)
>
> regards
> Jon Bjorn
>
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!




**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the 
addressee only and may be confidential. If they come to you in error 
you must take no action based on them, nor must you copy or show them 
to anyone. Please advise the sender by replying to this e-mail 
immediately and then delete the original from your computer.

Opinion : Any opinions expressed in this e-mail are entirely those of 
the author and unless specifically stated to the contrary, are not 
necessarily those of the author's employer.

Security Warning : Internet e-mail is not necessarily a secure 
communications medium and can be subject to data corruption. We advise 
that you consider this fact when e-mailing us. 

Viruses : We have taken steps to ensure that this e-mail and any 
attachments are free from known viruses but in keeping with good 
computing practice, you should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales 
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
United Kingdom
**********************************************************************

From jonbjorn at mbl.is  Wed May  2 14:48:46 2007
From: jonbjorn at mbl.is (Jon Bjorn Njalsson)
Date: Wed May  2 14:48:58 2007
Subject: No Programs allowed
In-Reply-To: <edfa16c4a0fc254ba62ada22a956f081@solidstatelogic.com>
References: <edfa16c4a0fc254ba62ada22a956f081@solidstatelogic.com>
Message-ID: <1178113726.14147.20.camel@viper.mbl.is>

so is it safe to disable File Command = /usr/bin/file ?

On mi?, 2007-05-02 at 14:44 +0100, Martin.Hepworth wrote:
> Jon
> 
> The file command is showing it as a program.
> 
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
> 
> > -----Original Message-----
> > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> > bounces@lists.mailscanner.info] On Behalf Of Jon Bjorn Njalsson
> > Sent: 02 May 2007 14:40
> > To: MailScanner discussion
> > Subject: No Programs allowed
> >
> > Why does MS think msg-26670-41.txt is a program ?
> >
> > MailScanner: No programs allowed (msg-26670-41.txt)
> >
> > regards
> > Jon Bjorn
> >
> > --
> > MailScanner mailing list
> > mailscanner@lists.mailscanner.info
> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >
> > Before posting, read http://wiki.mailscanner.info/posting
> >
> > Support MailScanner development - buy the book off the website!
> 
> 
> 
> 
> **********************************************************************
> Confidentiality : This e-mail and any attachments are intended for the 
> addressee only and may be confidential. If they come to you in error 
> you must take no action based on them, nor must you copy or show them 
> to anyone. Please advise the sender by replying to this e-mail 
> immediately and then delete the original from your computer.
> 
> Opinion : Any opinions expressed in this e-mail are entirely those of 
> the author and unless specifically stated to the contrary, are not 
> necessarily those of the author's employer.
> 
> Security Warning : Internet e-mail is not necessarily a secure 
> communications medium and can be subject to data corruption. We advise 
> that you consider this fact when e-mailing us. 
> 
> Viruses : We have taken steps to ensure that this e-mail and any 
> attachments are free from known viruses but in keeping with good 
> computing practice, you should ensure that they are virus free.
> 
> Red Lion 49 Ltd T/A Solid State Logic
> Registered as a limited company in England and Wales 
> (Company No:5362730)
> Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
> United Kingdom
> **********************************************************************
> 

From list-mailscanner at linguaphone.com  Wed May  2 14:51:01 2007
From: list-mailscanner at linguaphone.com (Gareth)
Date: Wed May  2 14:51:17 2007
Subject: No Programs allowed
In-Reply-To: <1178113173.14147.16.camel@viper.mbl.is>
References: <1178113173.14147.16.camel@viper.mbl.is>
Message-ID: <1178113860.17628.21.camel@gblades-suse.linguaphone-intranet.co.uk>

On Wed, 2007-05-02 at 14:39, Jon Bjorn Njalsson wrote:
> Why does MS think msg-26670-41.txt is a program ?
> 
> MailScanner: No programs allowed (msg-26670-41.txt)
> 
> regards
> Jon Bjorn

One of the checks Mailscanner does is use the 'file' command to check
the actual type of the file. I have seen it get confused sometimes when
a TNEF is decoded and the body message in the form you describe. I
assume the message is in a foreign character set or may even be corrupt.

From martinh at solidstatelogic.com  Wed May  2 14:52:02 2007
From: martinh at solidstatelogic.com (Martin.Hepworth)
Date: Wed May  2 14:52:14 2007
Subject: No Programs allowed
In-Reply-To: <1178113726.14147.20.camel@viper.mbl.is>
Message-ID: <7c1f6fd152c6644ba6e543b0384f6f4a@solidstatelogic.com>

I wouldn't advise it - why is that file showing as a program when file
runs against it..

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> bounces@lists.mailscanner.info] On Behalf Of Jon Bjorn Njalsson
> Sent: 02 May 2007 14:49
> To: MailScanner discussion
> Subject: RE: No Programs allowed
>
> so is it safe to disable File Command = /usr/bin/file ?
>
> On mi?, 2007-05-02 at 14:44 +0100, Martin.Hepworth wrote:
> > Jon
> >
> > The file command is showing it as a program.
> >
> > --
> > Martin Hepworth
> > Snr Systems Administrator
> > Solid State Logic
> > Tel: +44 (0)1865 842300
> >
> > > -----Original Message-----
> > > From: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-
> > > bounces@lists.mailscanner.info] On Behalf Of Jon Bjorn Njalsson
> > > Sent: 02 May 2007 14:40
> > > To: MailScanner discussion
> > > Subject: No Programs allowed
> > >
> > > Why does MS think msg-26670-41.txt is a program ?
> > >
> > > MailScanner: No programs allowed (msg-26670-41.txt)
> > >
> > > regards
> > > Jon Bjorn
> > >
> > > --
> > > MailScanner mailing list
> > > mailscanner@lists.mailscanner.info
> > > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> > >
> > > Before posting, read http://wiki.mailscanner.info/posting
> > >
> > > Support MailScanner development - buy the book off the website!
> >
> >
> >
> >
> >
**********************************************************************
> > Confidentiality : This e-mail and any attachments are intended for
the
> > addressee only and may be confidential. If they come to you in error
> > you must take no action based on them, nor must you copy or show
them
> > to anyone. Please advise the sender by replying to this e-mail
> > immediately and then delete the original from your computer.
> >
> > Opinion : Any opinions expressed in this e-mail are entirely those
of
> > the author and unless specifically stated to the contrary, are not
> > necessarily those of the author's employer.
> >
> > Security Warning : Internet e-mail is not necessarily a secure
> > communications medium and can be subject to data corruption. We
advise
> > that you consider this fact when e-mailing us.
> >
> > Viruses : We have taken steps to ensure that this e-mail and any
> > attachments are free from known viruses but in keeping with good
> > computing practice, you should ensure that they are virus free.
> >
> > Red Lion 49 Ltd T/A Solid State Logic
> > Registered as a limited company in England and Wales
> > (Company No:5362730)
> > Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU,
> > United Kingdom
> >
**********************************************************************
> >
>
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!




**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the 
addressee only and may be confidential. If they come to you in error 
you must take no action based on them, nor must you copy or show them 
to anyone. Please advise the sender by replying to this e-mail 
immediately and then delete the original from your computer.

Opinion : Any opinions expressed in this e-mail are entirely those of 
the author and unless specifically stated to the contrary, are not 
necessarily those of the author's employer.

Security Warning : Internet e-mail is not necessarily a secure 
communications medium and can be subject to data corruption. We advise 
that you consider this fact when e-mailing us. 

Viruses : We have taken steps to ensure that this e-mail and any 
attachments are free from known viruses but in keeping with good 
computing practice, you should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales 
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
United Kingdom
**********************************************************************

From pete at enitech.com.au  Wed May  2 15:00:20 2007
From: pete at enitech.com.au (Pete Russell)
Date: Wed May  2 15:00:32 2007
Subject: Spam detection rates
In-Reply-To: <7EF0EE5CB3B263488C8C18823239BEBA9222C4@HC-MBX02.herefordshire.gov.uk>
References: <1178108748.17627.17.camel@gblades-suse.linguaphone-intranet.co.uk>
	<7EF0EE5CB3B263488C8C18823239BEBA9222C4@HC-MBX02.herefordshire.gov.uk>
Message-ID: <46389974.9060000@enitech.com.au>

I dont see how its possible to measure. Unless users report (and you 
count) every single spam they receive that they shouldnt have.

I can tell you that my systems cathc more FPs and less spam than they 
did 6 months ago. Maybe its a sing i need fuzzy ocr and greylisting?

Hope the new MS and SA this month will cure some of it.


Randal, Phil wrote:
> We consistently get over 99.5% of spam too.
> 
> Last month we blocked around 260,000 at the sendmail level
> (cbl.abuseat.org RBL and GreetPause), and 400,000 in MailScanner.
> 
> Spam seems to be around 75% of total emails here.
> 
> Cheers,
> 
> Phil
> --
> Phil Randal
> Network Engineer
> Herefordshire Council
> Hereford, UK  
> 
>> -----Original Message-----
>> From: mailscanner-bounces@lists.mailscanner.info 
>> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf 
>> Of Gareth
>> Sent: 02 May 2007 13:26
>> To: mailscanner@lists.mailscanner.info
>> Subject: Spam detection rates
>>
>> I was wondering what sort of detection rates people are getting when
>> using Mailscanner.
>> Our old spamassassin 2.64 based system was only getting about 80% but
>> with Mailscanner and the latest software we seem to be getting over
>> 99.5% which is extremely good. False positives are very low aswell.
>>
>> We do tend to be very strict about pictures attached to emails as I
>> think we have a few rules which do the same sort of checks. Some
>> external people using the incredimail 'piece of cr**p' mail 
>> client get a
>> continuous score about 4.3 which leaves the AWL little room 
>> to bring the
>> occasional higher scoring mail back below the 5.0 threshold. It hasn't
>> caused any people to complain though.
>>
>> -- 
>> MailScanner mailing list
>> mailscanner@lists.mailscanner.info
>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>> Before posting, read http://wiki.mailscanner.info/posting
>>
>> Support MailScanner development - buy the book off the website! 
>>
From jon at radel.com  Wed May  2 15:07:45 2007
From: jon at radel.com (Jon Radel)
Date: Wed May  2 15:07:59 2007
Subject: No Programs allowed
In-Reply-To: <1178113726.14147.20.camel@viper.mbl.is>
References: <edfa16c4a0fc254ba62ada22a956f081@solidstatelogic.com>
	<1178113726.14147.20.camel@viper.mbl.is>
Message-ID: <46389B31.4040809@radel.com>

Jon Bjorn Njalsson wrote:
> so is it safe to disable File Command = /usr/bin/file ?

That would be between you, your management (if any), and your security
policy (should you have one).

What I would consider not safe at all is expecting us to know the local
factors that govern the trade offs between:

* The low probability, but potentially extremely expensive, scenario
where file turns out to have been capable of catching that brand new
nasty that just reduced your LAN to a smoldering ruin, and

* The much higher probability, but much lower cost, cases of false
positives.

--Jon Radel
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2890 bytes
Desc: S/MIME Cryptographic Signature
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070502/9928ebbc/smime.bin
From jonbjorn at mbl.is  Wed May  2 15:14:47 2007
From: jonbjorn at mbl.is (Jon Bjorn Njalsson)
Date: Wed May  2 15:15:04 2007
Subject: No Programs allowed
In-Reply-To: <7c1f6fd152c6644ba6e543b0384f6f4a@solidstatelogic.com>
References: <7c1f6fd152c6644ba6e543b0384f6f4a@solidstatelogic.com>
Message-ID: <1178115287.14147.24.camel@viper.mbl.is>

I have no idea, looking at the message in mailwatch I see at the bottom
of the page File msg-26492-33.txt Type text/plain; charset=iso-8859-1
and the file command run against message body says ASCII HTML document
text.

On mi?, 2007-05-02 at 14:52 +0100, Martin.Hepworth wrote:
> I wouldn't advise it - why is that file showing as a program when file
> runs against it..
> 
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
> 
> > -----Original Message-----
> > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> > bounces@lists.mailscanner.info] On Behalf Of Jon Bjorn Njalsson
> > Sent: 02 May 2007 14:49
> > To: MailScanner discussion
> > Subject: RE: No Programs allowed
> >
> > so is it safe to disable File Command = /usr/bin/file ?
> >
> > On mi?, 2007-05-02 at 14:44 +0100, Martin.Hepworth wrote:
> > > Jon
> > >
> > > The file command is showing it as a program.
> > >
> > > --
> > > Martin Hepworth
> > > Snr Systems Administrator
> > > Solid State Logic
> > > Tel: +44 (0)1865 842300
> > >
> > > > -----Original Message-----
> > > > From: mailscanner-bounces@lists.mailscanner.info
> [mailto:mailscanner-
> > > > bounces@lists.mailscanner.info] On Behalf Of Jon Bjorn Njalsson
> > > > Sent: 02 May 2007 14:40
> > > > To: MailScanner discussion
> > > > Subject: No Programs allowed
> > > >
> > > > Why does MS think msg-26670-41.txt is a program ?
> > > >
> > > > MailScanner: No programs allowed (msg-26670-41.txt)
> > > >
> > > > regards
> > > > Jon Bjorn
> > > >
> > > > --
> > > > MailScanner mailing list
> > > > mailscanner@lists.mailscanner.info
> > > > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> > > >
> > > > Before posting, read http://wiki.mailscanner.info/posting
> > > >
> > > > Support MailScanner development - buy the book off the website!
> > >
> > >
> > >
> > >
> > >
> **********************************************************************
> > > Confidentiality : This e-mail and any attachments are intended for
> the
> > > addressee only and may be confidential. If they come to you in error
> > > you must take no action based on them, nor must you copy or show
> them
> > > to anyone. Please advise the sender by replying to this e-mail
> > > immediately and then delete the original from your computer.
> > >
> > > Opinion : Any opinions expressed in this e-mail are entirely those
> of
> > > the author and unless specifically stated to the contrary, are not
> > > necessarily those of the author's employer.
> > >
> > > Security Warning : Internet e-mail is not necessarily a secure
> > > communications medium and can be subject to data corruption. We
> advise
> > > that you consider this fact when e-mailing us.
> > >
> > > Viruses : We have taken steps to ensure that this e-mail and any
> > > attachments are free from known viruses but in keeping with good
> > > computing practice, you should ensure that they are virus free.
> > >
> > > Red Lion 49 Ltd T/A Solid State Logic
> > > Registered as a limited company in England and Wales
> > > (Company No:5362730)
> > > Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU,
> > > United Kingdom
> > >
> **********************************************************************
> > >
> >
> > --
> > MailScanner mailing list
> > mailscanner@lists.mailscanner.info
> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >
> > Before posting, read http://wiki.mailscanner.info/posting
> >
> > Support MailScanner development - buy the book off the website!
> 
> 
> 
> 
> **********************************************************************
> Confidentiality : This e-mail and any attachments are intended for the 
> addressee only and may be confidential. If they come to you in error 
> you must take no action based on them, nor must you copy or show them 
> to anyone. Please advise the sender by replying to this e-mail 
> immediately and then delete the original from your computer.
> 
> Opinion : Any opinions expressed in this e-mail are entirely those of 
> the author and unless specifically stated to the contrary, are not 
> necessarily those of the author's employer.
> 
> Security Warning : Internet e-mail is not necessarily a secure 
> communications medium and can be subject to data corruption. We advise 
> that you consider this fact when e-mailing us. 
> 
> Viruses : We have taken steps to ensure that this e-mail and any 
> attachments are free from known viruses but in keeping with good 
> computing practice, you should ensure that they are virus free.
> 
> Red Lion 49 Ltd T/A Solid State Logic
> Registered as a limited company in England and Wales 
> (Company No:5362730)
> Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
> United Kingdom
> **********************************************************************
> 

From martinh at solidstatelogic.com  Wed May  2 15:21:37 2007
From: martinh at solidstatelogic.com (Martin.Hepworth)
Date: Wed May  2 15:21:33 2007
Subject: No Programs allowed
In-Reply-To: <1178115287.14147.24.camel@viper.mbl.is>
Message-ID: <9fdae64d9cb45742839ee4b8c753c7c3@solidstatelogic.com>

Jon

Any attachments in the email?


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> bounces@lists.mailscanner.info] On Behalf Of Jon Bjorn Njalsson
> Sent: 02 May 2007 15:15
> To: MailScanner discussion
> Subject: RE: No Programs allowed
>
> I have no idea, looking at the message in mailwatch I see at the
bottom
> of the page File msg-26492-33.txt Type text/plain; charset=iso-8859-1
> and the file command run against message body says ASCII HTML document
> text.
>
> On mi?, 2007-05-02 at 14:52 +0100, Martin.Hepworth wrote:
> > I wouldn't advise it - why is that file showing as a program when
file
> > runs against it..
> >
> > --
> > Martin Hepworth
> > Snr Systems Administrator
> > Solid State Logic
> > Tel: +44 (0)1865 842300
> >
> > > -----Original Message-----
> > > From: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-
> > > bounces@lists.mailscanner.info] On Behalf Of Jon Bjorn Njalsson
> > > Sent: 02 May 2007 14:49
> > > To: MailScanner discussion
> > > Subject: RE: No Programs allowed
> > >
> > > so is it safe to disable File Command = /usr/bin/file ?
> > >
> > > On mi?, 2007-05-02 at 14:44 +0100, Martin.Hepworth wrote:
> > > > Jon
> > > >
> > > > The file command is showing it as a program.
> > > >
> > > > --
> > > > Martin Hepworth
> > > > Snr Systems Administrator
> > > > Solid State Logic
> > > > Tel: +44 (0)1865 842300
> > > >
> > > > > -----Original Message-----
> > > > > From: mailscanner-bounces@lists.mailscanner.info
> > [mailto:mailscanner-
> > > > > bounces@lists.mailscanner.info] On Behalf Of Jon Bjorn
Njalsson
> > > > > Sent: 02 May 2007 14:40
> > > > > To: MailScanner discussion
> > > > > Subject: No Programs allowed
> > > > >
> > > > > Why does MS think msg-26670-41.txt is a program ?
> > > > >
> > > > > MailScanner: No programs allowed (msg-26670-41.txt)
> > > > >
> > > > > regards
> > > > > Jon Bjorn
> > > > >
> > > > > --
> > > > > MailScanner mailing list
> > > > > mailscanner@lists.mailscanner.info
> > > > > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> > > > >
> > > > > Before posting, read http://wiki.mailscanner.info/posting
> > > > >
> > > > > Support MailScanner development - buy the book off the
website!
> > > >
> > > >
> > > >
> > > >
> > > >
> >
**********************************************************************
> > > > Confidentiality : This e-mail and any attachments are intended
for
> > the
> > > > addressee only and may be confidential. If they come to you in
error
> > > > you must take no action based on them, nor must you copy or show
> > them
> > > > to anyone. Please advise the sender by replying to this e-mail
> > > > immediately and then delete the original from your computer.
> > > >
> > > > Opinion : Any opinions expressed in this e-mail are entirely
those
> > of
> > > > the author and unless specifically stated to the contrary, are
not
> > > > necessarily those of the author's employer.
> > > >
> > > > Security Warning : Internet e-mail is not necessarily a secure
> > > > communications medium and can be subject to data corruption. We
> > advise
> > > > that you consider this fact when e-mailing us.
> > > >
> > > > Viruses : We have taken steps to ensure that this e-mail and any
> > > > attachments are free from known viruses but in keeping with good
> > > > computing practice, you should ensure that they are virus free.
> > > >
> > > > Red Lion 49 Ltd T/A Solid State Logic
> > > > Registered as a limited company in England and Wales
> > > > (Company No:5362730)
> > > > Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5
1RU,
> > > > United Kingdom
> > > >
> >
**********************************************************************
> > > >
> > >
> > > --
> > > MailScanner mailing list
> > > mailscanner@lists.mailscanner.info
> > > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> > >
> > > Before posting, read http://wiki.mailscanner.info/posting
> > >
> > > Support MailScanner development - buy the book off the website!
> >
> >
> >
> >
> >
**********************************************************************
> > Confidentiality : This e-mail and any attachments are intended for
the
> > addressee only and may be confidential. If they come to you in error
> > you must take no action based on them, nor must you copy or show
them
> > to anyone. Please advise the sender by replying to this e-mail
> > immediately and then delete the original from your computer.
> >
> > Opinion : Any opinions expressed in this e-mail are entirely those
of
> > the author and unless specifically stated to the contrary, are not
> > necessarily those of the author's employer.
> >
> > Security Warning : Internet e-mail is not necessarily a secure
> > communications medium and can be subject to data corruption. We
advise
> > that you consider this fact when e-mailing us.
> >
> > Viruses : We have taken steps to ensure that this e-mail and any
> > attachments are free from known viruses but in keeping with good
> > computing practice, you should ensure that they are virus free.
> >
> > Red Lion 49 Ltd T/A Solid State Logic
> > Registered as a limited company in England and Wales
> > (Company No:5362730)
> > Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU,
> > United Kingdom
> >
**********************************************************************
> >
>
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!




**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the 
addressee only and may be confidential. If they come to you in error 
you must take no action based on them, nor must you copy or show them 
to anyone. Please advise the sender by replying to this e-mail 
immediately and then delete the original from your computer.

Opinion : Any opinions expressed in this e-mail are entirely those of 
the author and unless specifically stated to the contrary, are not 
necessarily those of the author's employer.

Security Warning : Internet e-mail is not necessarily a secure 
communications medium and can be subject to data corruption. We advise 
that you consider this fact when e-mailing us. 

Viruses : We have taken steps to ensure that this e-mail and any 
attachments are free from known viruses but in keeping with good 
computing practice, you should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales 
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
United Kingdom
**********************************************************************

From glenn.steen at gmail.com  Wed May  2 15:27:08 2007
From: glenn.steen at gmail.com (Glenn Steen)
Date: Wed May  2 15:27:11 2007
Subject: No Programs allowed
In-Reply-To: <1178115287.14147.24.camel@viper.mbl.is>
References: <7c1f6fd152c6644ba6e543b0384f6f4a@solidstatelogic.com>
	<1178115287.14147.24.camel@viper.mbl.is>
Message-ID: <223f97700705020727i503181cdp1598aebd456a1c64@mail.gmail.com>

On 02/05/07, Jon Bjorn Njalsson <jonbjorn@mbl.is> wrote:
> I have no idea, looking at the message in mailwatch I see at the bottom
> of the page File msg-26492-33.txt Type text/plain; charset=iso-8859-1
> and the file command run against message body says ASCII HTML document
> text.
So it is already decoded to its own file in the quarantine... If you
run file on that file, what does it (literally) say?

-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
From ajs at vifilfell.is  Wed May  2 15:30:40 2007
From: ajs at vifilfell.is (ajs@vifilfell.is)
Date: Wed May  2 15:33:04 2007
Subject: No Programs allowed
In-Reply-To: <223f97700705020727i503181cdp1598aebd456a1c64@mail.gmail.com>
Message-ID: <OF6BC64E7F.9013ACB8-ON002572CF.004F7B6A-002572CF.00500525@vifilfell.is>

This is related to the letter '?'. If a mail or an attachment starts with 
this character (hex 0xC9), file flags the mail as a DOS executable.

Regards, Asgeir.





"Glenn Steen" <glenn.steen@gmail.com> 
Sent by: mailscanner-bounces@lists.mailscanner.info
02.05.2007 14:27
Please respond to
MailScanner discussion <mailscanner@lists.mailscanner.info>


To
"MailScanner discussion" <mailscanner@lists.mailscanner.info>
cc

Subject
Re: No Programs allowed








On 02/05/07, Jon Bjorn Njalsson <jonbjorn@mbl.is> wrote:
> I have no idea, looking at the message in mailwatch I see at the bottom
> of the page File msg-26492-33.txt Type text/plain; charset=iso-8859-1
> and the file command run against message body says ASCII HTML document
> text.
So it is already decoded to its own file in the quarantine... If you
run file on that file, what does it (literally) say?

-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070502/bf3a9b69/attachment-0001.html
From ajs at vifilfell.is  Wed May  2 15:34:41 2007
From: ajs at vifilfell.is (ajs@vifilfell.is)
Date: Wed May  2 15:37:04 2007
Subject: No Programs allowed
In-Reply-To: <223f97700705020727i503181cdp1598aebd456a1c64@mail.gmail.com>
Message-ID: <OFBD05D298.19A59A85-ON002572CF.004FF4EB-002572CF.0050639C@vifilfell.is>

forgot to add, that it is possible to edit the file 'magic' so that emails 
starting with this letter will no longer get flagged as a DOS executable

Asgeir.





"Glenn Steen" <glenn.steen@gmail.com> 
Sent by: mailscanner-bounces@lists.mailscanner.info
02.05.2007 14:27
Please respond to
MailScanner discussion <mailscanner@lists.mailscanner.info>


To
"MailScanner discussion" <mailscanner@lists.mailscanner.info>
cc

Subject
Re: No Programs allowed








On 02/05/07, Jon Bjorn Njalsson <jonbjorn@mbl.is> wrote:
> I have no idea, looking at the message in mailwatch I see at the bottom
> of the page File msg-26492-33.txt Type text/plain; charset=iso-8859-1
> and the file command run against message body says ASCII HTML document
> text.
So it is already decoded to its own file in the quarantine... If you
run file on that file, what does it (literally) say?

-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070502/d81c2c16/attachment.html
From glenn.steen at gmail.com  Wed May  2 15:46:33 2007
From: glenn.steen at gmail.com (Glenn Steen)
Date: Wed May  2 15:46:37 2007
Subject: No Programs allowed
In-Reply-To: <OFBD05D298.19A59A85-ON002572CF.004FF4EB-002572CF.0050639C@vifilfell.is>
References: <223f97700705020727i503181cdp1598aebd456a1c64@mail.gmail.com>
	<OFBD05D298.19A59A85-ON002572CF.004FF4EB-002572CF.0050639C@vifilfell.is>
Message-ID: <223f97700705020746u3015ab59r3cdbe3c0dac2f7c5@mail.gmail.com>

On 02/05/07, ajs@vifilfell.is <ajs@vifilfell.is> wrote:
>
> forgot to add, that it is possible to edit the file 'magic' so that emails starting with this letter will no longer get flagged as a DOS executable
>
> Asgeir.
>
Yes Asgeir, this may very well be the case this time too... We're
slowly moving in this direction:-). Personally I tend to want the
complete picture, or do some "nudging" (by way of some well phrased
(hopefully:) questions) before stating my pet guess as fact
though...;)

As I'm sure you've noted (while checking over your own magic file)
there are a few other "possible misdetections" in there;-).

BTW, could you refrain from HTML mails to the list? Please...

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
From ajs at vifilfell.is  Wed May  2 16:00:43 2007
From: ajs at vifilfell.is (ajs@vifilfell.is)
Date: Wed May  2 16:03:06 2007
Subject: No Programs allowed
In-Reply-To: <223f97700705020746u3015ab59r3cdbe3c0dac2f7c5@mail.gmail.com>
Message-ID: <OF144BAE95.79191AE5-ON002572CF.00522ECD-002572CF.0052C5BB@vifilfell.is>

this is the case, Jon has tried the solution I pm-ed him and it works.

I use Lotus for email and sometimes forget to switch to plain text when 
sending email to mailing list, will try to remember it next time.

cheers, asgeir,





"Glenn Steen" <glenn.steen@gmail.com> 
Sent by: mailscanner-bounces@lists.mailscanner.info
02.05.2007 14:46
Please respond to
MailScanner discussion <mailscanner@lists.mailscanner.info>


To
"MailScanner discussion" <mailscanner@lists.mailscanner.info>
cc

Subject
Re: No Programs allowed








On 02/05/07, ajs@vifilfell.is <ajs@vifilfell.is> wrote:
>
> forgot to add, that it is possible to edit the file 'magic' so that 
emails starting with this letter will no longer get flagged as a DOS 
executable
>
> Asgeir.
>
Yes Asgeir, this may very well be the case this time too... We're
slowly moving in this direction:-). Personally I tend to want the
complete picture, or do some "nudging" (by way of some well phrased
(hopefully:) questions) before stating my pet guess as fact
though...;)

As I'm sure you've noted (while checking over your own magic file)
there are a few other "possible misdetections" in there;-).

BTW, could you refrain from HTML mails to the list? Please...

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 


From paul.hutchings at mira.co.uk  Wed May  2 16:25:49 2007
From: paul.hutchings at mira.co.uk (Paul Hutchings)
Date: Wed May  2 16:26:58 2007
Subject: 32 bit distro or 64?
Message-ID: <FF689DC51C3C1640BE668A0E31182AD002D15B68@mail03.mira.co.uk>

Again probably not a MailScanner specific query but as this box is
specifically to run MailScanner I'll ask here.

 

I have a new DL360 G5 and I'm planning on installing OpenSuse 10.2.
Should I be using the 32 bit or 64 bit with regards to MailScanner,
basically are there any reasons to choose one over the other?

 

The box has 2gb of RAM so there's no "large memory" type issues involved
it's purely why I might choose one over the other for this application.

 

Cheers,

Paul

 

Paul Hutchings

Network Administrator, MIRA Ltd.

Tel: 44 (0)24 7635 5378

Fax: 44 (0)24 7635 8378

mailto:paul.hutchings@mira.co.uk

 


-- 
MIRA Ltd.

Watling Street, Nuneaton, Warwickshire, CV10 0TU, England.

Registered in England No. 402570
VAT Registration  GB 114 5409 96

The contents of this e-mail are confidential and are solely for the use of the intended recipient.
If you receive this e-mail in error, please delete it and notify us either by e-mail, telephone or fax.
You should not copy, forward or otherwise disclose the content of the e-mail as this is prohibited.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070502/1d128d31/attachment.html
From amaclach at yahoo.co.uk  Wed May  2 16:33:55 2007
From: amaclach at yahoo.co.uk (Andrew MacLachlan)
Date: Wed May  2 16:33:56 2007
Subject: Spam detection rates
Message-ID: <20070502153355.21002.qmail@web26306.mail.ukl.yahoo.com>

SQLgrey is very effective at the postfix level  - and cheap in terms of system resources. You just need a mysql database you can attach to. I have used postgrey in the past but it's not nice to manage.
 
Regards, 
Andrew MacLachlan



----- Original Message ----
From: Pete Russell <pete@enitech.com.au>
To: MailScanner discussion <mailscanner@lists.mailscanner.info>
Sent: Wednesday, 2 May, 2007 3:00:20 PM
Subject: Re: Spam detection rates

I dont see how its possible to measure. Unless users report (and you 
count) every single spam they receive that they shouldnt have.

I can tell you that my systems cathc more FPs and less spam than they 
did 6 months ago. Maybe its a sing i need fuzzy ocr and greylisting?

Hope the new MS and SA this month will cure some of it.


Randal, Phil wrote:
> We consistently get over 99.5% of spam too.
> 
> Last month we blocked around 260,000 at the sendmail level
> (cbl.abuseat.org RBL and GreetPause), and 400,000 in MailScanner.
> 
> Spam seems to be around 75% of total emails here.
> 
> Cheers,
> 
> Phil
> --
> Phil Randal
> Network Engineer
> Herefordshire Council
> Hereford, UK  
> 
>> -----Original Message-----
>> From: mailscanner-bounces@lists.mailscanner.info 
>> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf 
>> Of Gareth
>> Sent: 02 May 2007 13:26
>> To: mailscanner@lists.mailscanner.info
>> Subject: Spam detection rates
>>
>> I was wondering what sort of detection rates people are getting when
>> using Mailscanner.
>> Our old spamassassin 2.64 based system was only getting about 80% but
>> with Mailscanner and the latest software we seem to be getting over
>> 99.5% which is extremely good. False positives are very low aswell.
>>
>> We do tend to be very strict about pictures attached to emails as I
>> think we have a few rules which do the same sort of checks. Some
>> external people using the incredimail 'piece of cr**p' mail 
>> client get a
>> continuous score about 4.3 which leaves the AWL little room 
>> to bring the
>> occasional higher scoring mail back below the 5.0 threshold. It hasn't
>> caused any people to complain though.
>>
>> -- 
>> MailScanner mailing list
>> mailscanner@lists.mailscanner.info
>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>> Before posting, read http://wiki.mailscanner.info/posting
>>
>> Support MailScanner development - buy the book off the website! 
>>
-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 




From cleveland at winnefox.org  Wed May  2 16:46:59 2007
From: cleveland at winnefox.org (Jody Cleveland)
Date: Wed May  2 16:47:03 2007
Subject: Can't locate Convert/BinHex.pm in @INC
Message-ID: <C25E1CA3.322C%cleveland@winnefox.org>

Hello,

I just tried to install the latest version of MailScanner on my RedHat 5
server, and I get this error when trying to start mailscanner:

Starting MailScanner daemons:
         incoming postfix:                                 [  OK  ]
         outgoing postfix:                                 [  OK  ]
         MailScanner:       Can't locate Convert/BinHex.pm in @INC (@INC
contains: /usr/lib/MailScanner
/usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi
/usr/lib/perl5/site_perl/5.8.7/i386-linux-thread-multi
/usr/lib/perl5/site_perl/5.8.6/i386-linux-thread-multi
/usr/lib/perl5/site_perl/5.8.5/i386-linux-thread-multi
/usr/lib/perl5/site_perl/5.8.8 /usr/lib/perl5/site_perl/5.8.7
/usr/lib/perl5/site_perl/5.8.6 /usr/lib/perl5/site_perl/5.8.5
/usr/lib/perl5/site_perl
/usr/lib/perl5/vendor_perl/5.8.8/i386-linux-thread-multi
/usr/lib/perl5/vendor_perl/5.8.7/i386-linux-thread-multi
/usr/lib/perl5/vendor_perl/5.8.6/i386-linux-thread-multi
/usr/lib/perl5/vendor_perl/5.8.5/i386-linux-thread-multi
/usr/lib/perl5/vendor_perl/5.8.8 /usr/lib/perl5/vendor_perl/5.8.7
/usr/lib/perl5/vendor_perl/5.8.6 /usr/lib/perl5/vendor_perl/5.8.5
/usr/lib/perl5/vendor_perl /usr/lib/perl5/5.8.8/i386-linux-thread-multi
/usr/lib/perl5/5.8.8 . /usr/lib/MailScanner) at
/usr/lib/perl5/site_perl/5.8.8/MIME/Decoder/BinHex.pm line 44.
BEGIN failed--compilation aborted at
/usr/lib/perl5/site_perl/5.8.8/MIME/Decoder/BinHex.pm line 44.
Compilation failed in require at /usr/lib/MailScanner/MailScanner/Message.pm
line 43.
BEGIN failed--compilation aborted at
/usr/lib/MailScanner/MailScanner/Message.pm line 43.
Compilation failed in require at /usr/sbin/MailScanner line 79.
BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 79.

I checked, and Convert::BinHex is installed. Any ideas what may be wrong?

- jody

From prandal at herefordshire.gov.uk  Wed May  2 15:56:19 2007
From: prandal at herefordshire.gov.uk (Randal, Phil)
Date: Wed May  2 17:19:39 2007
Subject: Spam detection rates
In-Reply-To: <46389974.9060000@enitech.com.au>
References: <1178108748.17627.17.camel@gblades-suse.linguaphone-intranet.co.uk><7EF0EE5CB3B263488C8C18823239BEBA9222C4@HC-MBX02.herefordshire.gov.uk>
	<46389974.9060000@enitech.com.au>
Message-ID: <7EF0EE5CB3B263488C8C18823239BEBA92230B@HC-MBX02.herefordshire.gov.uk>

We have a zealous bunch of users who love reporting spam which gets
through to their inboxes to me.

And I do spot checks of our Mailwatch logs from time to time.

About 3000 emails get flagged as low-scoring (possible) spam here, and
delivered.  Of those around 80% are spam, the rest are what I call
"subscriber spam" - special offers mailing lists, etc.

Cheers,

Phil

--
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK  

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info 
> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf 
> Of Pete Russell
> Sent: 02 May 2007 15:00
> To: MailScanner discussion
> Subject: Re: Spam detection rates
> 
> I dont see how its possible to measure. Unless users report (and you 
> count) every single spam they receive that they shouldnt have.
> 
> I can tell you that my systems cathc more FPs and less spam than they 
> did 6 months ago. Maybe its a sing i need fuzzy ocr and greylisting?
> 
> Hope the new MS and SA this month will cure some of it.
> 
> 
> Randal, Phil wrote:
> > We consistently get over 99.5% of spam too.
> > 
> > Last month we blocked around 260,000 at the sendmail level
> > (cbl.abuseat.org RBL and GreetPause), and 400,000 in MailScanner.
> > 
> > Spam seems to be around 75% of total emails here.
> > 
> > Cheers,
> > 
> > Phil
> > --
> > Phil Randal
> > Network Engineer
> > Herefordshire Council
> > Hereford, UK  
> > 
> >> -----Original Message-----
> >> From: mailscanner-bounces@lists.mailscanner.info 
> >> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf 
> >> Of Gareth
> >> Sent: 02 May 2007 13:26
> >> To: mailscanner@lists.mailscanner.info
> >> Subject: Spam detection rates
> >>
> >> I was wondering what sort of detection rates people are 
> getting when
> >> using Mailscanner.
> >> Our old spamassassin 2.64 based system was only getting 
> about 80% but
> >> with Mailscanner and the latest software we seem to be getting over
> >> 99.5% which is extremely good. False positives are very low aswell.
> >>
> >> We do tend to be very strict about pictures attached to emails as I
> >> think we have a few rules which do the same sort of checks. Some
> >> external people using the incredimail 'piece of cr**p' mail 
> >> client get a
> >> continuous score about 4.3 which leaves the AWL little room 
> >> to bring the
> >> occasional higher scoring mail back below the 5.0 
> threshold. It hasn't
> >> caused any people to complain though.
> >>
> >> -- 
> >> MailScanner mailing list
> >> mailscanner@lists.mailscanner.info
> >> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >>
> >> Before posting, read http://wiki.mailscanner.info/posting
> >>
> >> Support MailScanner development - buy the book off the website! 
> >>
> -- 
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website! 
> 
From bpumphrey at woodmclaw.com  Wed May  2 17:24:07 2007
From: bpumphrey at woodmclaw.com (Billy A. Pumphrey)
Date: Wed May  2 17:24:09 2007
Subject: A lot of spam getting through
In-Reply-To: <46385180.5090601@chime.ucl.ac.uk>
Message-ID: <04D932B0071FE34FA63EBB1977B48D150281747A@woodenex.woodmaclaw.local>

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> bounces@lists.mailscanner.info] On Behalf Of Anthony Peacock
> Sent: Wednesday, May 02, 2007 4:53 AM
> To: MailScanner discussion
> Subject: Re: A lot of spam getting through
> So, help us out and show us the scores and headers from one that does
> get through.  We might be able to see where they are failing then.
> 
> Even better...  Save one of the misdiagnosed emails as a text file,
post
> it to a web address and let us know.  We can then run that email
through
> our systems and tell you what scores we get and what rules helped.
> 

I am having trouble getting the testing to work, or knowing how to test
it.  I have saved some messages from Oulook with the extension of .msg.
When I run a spamassassin -t message.msg it returns a bunch of junk and
then the score:

Content analysis details:   (51.5 points, 5.0 required)

 pts rule name              description
---- ----------------------
--------------------------------------------------
-0.0 NO_RELAYS              Informational: message was not relayed via
SMTP
 2.5 MISSING_HB_SEP         Missing blank line between message header
and body
 2.3 MANGLED_DOSE           BODY: mangled dose
 2.3 MANGLED_OFF            BODY: mangled off
 2.3 MANGLED_YOUR           BODY: mangled your
 2.3 MANGLED_FORM           BODY: mangled form
 2.3 MANGLED_HERE           BODY: mangled here
 2.3 MANGLED_HALF           BODY: mangled half
 2.3 MANGLED_TIME           BODY: mangled time
 2.3 MANGLED_MEDS           BODY: mangled med(s)
 2.3 MANGLED_GIRL           BODY: mangled girl(s)
 2.3 MANGLED_FROM           BODY: mangled from
 2.3 MANGLED_LOVE           BODY: mangled love
 2.3 MANGLED_TEXT           BODY: mangled text
 2.3 MANGLED_LOOK           BODY: mangled look(s)
 2.3 MANGLED_SPAM           BODY: mangled spam
 2.3 MANGLED_PRIOR          BODY: mangled prior
 2.3 MANGLED_PLEASE         BODY: mangled please
 2.3 MANGLED_TRNFER         BODY: mangled TRANSFER
 2.3 MANGLED_TOOL           BODY: mangled tool
 3.5 BAYES_99               BODY: Bayesian spam probability is 99 to
100%
                            [score: 1.0000]
 2.2 NULL_IN_BODY           FULL: Message has NUL (ASCII 0) byte in
message
 1.8 MISSING_SUBJECT        Missing Subject: header
 0.0 UPPERCASE_25_50        message body is 25-50% uppercase
 0.1 TO_CC_NONE             No To: or Cc: header
-0.0 NO_RECEIVED            Informational: message has no Received
headers

(then some more junk)
[root@WoodenMS2 spamemail]#
PuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPu
TTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTT
YPuTTYPuTTYPuTTYPuTTYPuTTYTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPu


Does the testing support .msg files?  Also what is the best way to
convert the email to text and have it correct?
From cleveland at winnefox.org  Wed May  2 17:25:51 2007
From: cleveland at winnefox.org (Jody Cleveland)
Date: Wed May  2 17:25:56 2007
Subject: Can't locate Convert/BinHex.pm in @INC
In-Reply-To: <C25E1CA3.322C%cleveland@winnefox.org>
Message-ID: <C25E25BF.3239%cleveland@winnefox.org>

Hello again,


On 5/2/07 10:46 AM, "Jody Cleveland" <cleveland@winnefox.org> wrote:

> Hello,
> 
> I just tried to install the latest version of MailScanner on my RedHat 5
> server, and I get this error when trying to start mailscanner:
> 
> Starting MailScanner daemons:
>          incoming postfix:                                 [  OK  ]
>          outgoing postfix:                                 [  OK  ]
>          MailScanner:       Can't locate Convert/BinHex.pm in @INC (@INC

Ok, I did a force install, and that reinstalled the pm, and I was able to
start MailScanner.

BUT, now MailScanner isn't checking incoming mail. I can send a message from
gmail, and the message never goes through. I looked in my maillog, and this
is what shows up when I start mailscanner:

May  2 11:22:44 destiny postfix/postfix-script: starting the Postfix mail
system
May  2 11:22:44 destiny postfix/master[5581]: daemon started -- version
2.3.3, configuration /etc/postfix
May  2 11:22:44 destiny postfix/qmgr[5591]: warning: bounce_queue_lifetime
is larger than maximal_queue_lifetime - adjusting bounce_queue_lifetime
May  2 11:22:44 destiny postfix/qmgr[5591]: 19B3C3E4029: from=<>, size=4046,
nrcpt=1 (queue active)
May  2 11:22:44 destiny postfix/qmgr[5591]: 7B5D73E402A: from=<>, size=4102,
nrcpt=1 (queue active)
May  2 11:22:44 destiny postfix/qmgr[5591]: CEB1A3E402D: from=<>, size=4394,
nrcpt=1 (queue active)
May  2 11:22:44 destiny postfix/qmgr[5591]: 101313E4027: from=<>, size=4020,
nrcpt=1 (queue active)
May  2 11:22:44 destiny postfix/local[5598]: fatal: open database
/etc/postfix/aliases.db: No such file or directory
May  2 11:22:45 destiny postfix/master[5581]: warning: process
/usr/libexec/postfix/local pid 5598 exit status 1
May  2 11:22:45 destiny postfix/master[5581]: warning:
/usr/libexec/postfix/local: bad command startup -- throttling
May  2 11:22:46 destiny MailScanner[5604]: MailScanner E-Mail Virus Scanner
version 4.59.4 starting...
May  2 11:22:46 destiny MailScanner[5604]: Skipping Custom Function file
SQLBlackWhiteList.old as its name does not end in .pm or .pl
May  2 11:22:46 destiny MailScanner[5604]: Skipping Custom Function file
SQLBlackWhiteList.pm~ as its name does not end in .pm or .pl
May  2 11:22:46 destiny MailScanner[5604]: Read 778 hostnames from the
phishing whitelist 
May  2 11:22:46 destiny MailScanner[5604]: Config: calling custom init
function SQLBlacklist
May  2 11:22:46 destiny MailScanner[5604]: Starting up SQL Blacklist
May  2 11:22:46 destiny MailScanner[5604]: Read 29 blacklist entries
May  2 11:22:46 destiny MailScanner[5604]: Config: calling custom init
function MailWatchLogging
May  2 11:22:46 destiny MailScanner[5604]: Started SQL Logging child
May  2 11:22:46 destiny MailScanner[5604]: Config: calling custom init
function SQLWhitelist
May  2 11:22:46 destiny MailScanner[5604]: Starting up SQL Whitelist
May  2 11:22:46 destiny MailScanner[5604]: Read 59 whitelist entries
May  2 11:22:46 destiny MailScanner[5604]: User's home directory
/var/spool/postfix is not writable
May  2 11:22:46 destiny MailScanner[5604]: You need to set the "SpamAssassin
User State Dir" to a directory that the "Run As User" can write to
May  2 11:22:46 destiny MailScanner[5604]: Using SpamAssassin results cache
May  2 11:22:46 destiny MailScanner[5604]: Connected to SpamAssassin cache
database 
May  2 11:22:49 destiny MailScanner[5604]: Expired 654 records from the
SpamAssassin cache 
May  2 11:22:49 destiny MailScanner[5604]: Enabling SpamAssassin
auto-whitelist functionality...
May  2 11:22:49 destiny postfix/smtpd[5613]: fatal: open database
/etc/postfix/aliases.db: No such file or directory
May  2 11:22:50 destiny postfix/master[5581]: warning: process
/usr/libexec/postfix/smtpd pid 5613 exit status 1
May  2 11:22:50 destiny postfix/master[5581]: warning:
/usr/libexec/postfix/smtpd: bad command startup -- throttling
May  2 11:22:51 destiny MailScanner[5615]: MailScanner E-Mail Virus Scanner
version 4.59.4 starting...
May  2 11:22:51 destiny MailScanner[5615]: Skipping Custom Function file
SQLBlackWhiteList.old as its name does not end in .pm or .pl
May  2 11:22:51 destiny MailScanner[5615]: Skipping Custom Function file
SQLBlackWhiteList.pm~ as its name does not end in .pm or .pl
May  2 11:22:51 destiny MailScanner[5615]: Read 778 hostnames from the
phishing whitelist 
May  2 11:22:51 destiny MailScanner[5615]: Config: calling custom init
function SQLBlacklist
May  2 11:22:51 destiny MailScanner[5615]: Starting up SQL Blacklist
May  2 11:22:51 destiny MailScanner[5615]: Read 29 blacklist entries
May  2 11:22:51 destiny MailScanner[5615]: Config: calling custom init
function MailWatchLogging
May  2 11:22:51 destiny MailScanner[5615]: Started SQL Logging child
May  2 11:22:51 destiny MailScanner[5615]: Config: calling custom init
function SQLWhitelist
May  2 11:22:51 destiny MailScanner[5615]: Starting up SQL Whitelist
May  2 11:22:51 destiny MailScanner[5615]: Read 59 whitelist entries
May  2 11:22:51 destiny MailScanner[5615]: User's home directory
/var/spool/postfix is not writable
May  2 11:22:51 destiny MailScanner[5615]: You need to set the "SpamAssassin
User State Dir" to a directory that the "Run As User" can write to
May  2 11:22:52 destiny MailScanner[5615]: Using SpamAssassin results cache
May  2 11:22:52 destiny MailScanner[5615]: Connected to SpamAssassin cache
database 
May  2 11:22:52 destiny MailScanner[5615]: Enabling SpamAssassin
auto-whitelist functionality...
May  2 11:22:56 destiny MailScanner[5624]: MailScanner E-Mail Virus Scanner
version 4.59.4 starting...
May  2 11:22:56 destiny MailScanner[5624]: Skipping Custom Function file
SQLBlackWhiteList.old as its name does not end in .pm or .pl
May  2 11:22:56 destiny MailScanner[5624]: Skipping Custom Function file
SQLBlackWhiteList.pm~ as its name does not end in .pm or .pl

Is there anything in there that is a problem? If not, any ideas where I can
look to find the problem?

- jody

From mikea at mikea.ath.cx  Wed May  2 17:28:45 2007
From: mikea at mikea.ath.cx (mikea)
Date: Wed May  2 17:28:54 2007
Subject: Can't locate Convert/BinHex.pm in @INC
In-Reply-To: <C25E1CA3.322C%cleveland@winnefox.org>
References: <C25E1CA3.322C%cleveland@winnefox.org>
Message-ID: <20070502162845.GM20170@mikea.ath.cx>

On Wed, May 02, 2007 at 10:46:59AM -0500, Jody Cleveland wrote:
> Hello,
> 
> I just tried to install the latest version of MailScanner on my RedHat 5
> server, and I get this error when trying to start mailscanner:
> 
> Starting MailScanner daemons:
>          incoming postfix:                                 [  OK  ]
>          outgoing postfix:                                 [  OK  ]
>          MailScanner:       Can't locate Convert/BinHex.pm in @INC (@INC
> contains: /usr/lib/MailScanner
> /usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi
> /usr/lib/perl5/site_perl/5.8.7/i386-linux-thread-multi
> /usr/lib/perl5/site_perl/5.8.6/i386-linux-thread-multi
> /usr/lib/perl5/site_perl/5.8.5/i386-linux-thread-multi
> /usr/lib/perl5/site_perl/5.8.8 /usr/lib/perl5/site_perl/5.8.7
> /usr/lib/perl5/site_perl/5.8.6 /usr/lib/perl5/site_perl/5.8.5
> /usr/lib/perl5/site_perl
> /usr/lib/perl5/vendor_perl/5.8.8/i386-linux-thread-multi
> /usr/lib/perl5/vendor_perl/5.8.7/i386-linux-thread-multi
> /usr/lib/perl5/vendor_perl/5.8.6/i386-linux-thread-multi
> /usr/lib/perl5/vendor_perl/5.8.5/i386-linux-thread-multi
> /usr/lib/perl5/vendor_perl/5.8.8 /usr/lib/perl5/vendor_perl/5.8.7
> /usr/lib/perl5/vendor_perl/5.8.6 /usr/lib/perl5/vendor_perl/5.8.5
> /usr/lib/perl5/vendor_perl /usr/lib/perl5/5.8.8/i386-linux-thread-multi
> /usr/lib/perl5/5.8.8 . /usr/lib/MailScanner) at
> /usr/lib/perl5/site_perl/5.8.8/MIME/Decoder/BinHex.pm line 44.
> BEGIN failed--compilation aborted at
> /usr/lib/perl5/site_perl/5.8.8/MIME/Decoder/BinHex.pm line 44.
> Compilation failed in require at /usr/lib/MailScanner/MailScanner/Message.pm
> line 43.
> BEGIN failed--compilation aborted at
> /usr/lib/MailScanner/MailScanner/Message.pm line 43.
> Compilation failed in require at /usr/sbin/MailScanner line 79.
> BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 79.
> 
> I checked, and Convert::BinHex is installed. Any ideas what may be wrong?

Exactly where is Convert::BinHex installed? Is that directory in @INC?

-- 
Mike Andrews, W5EGO
mikea@mikea.ath.cx
Tired old sysadmin 
From grpprod at gmail.com  Wed May  2 17:58:25 2007
From: grpprod at gmail.com (G P)
Date: Wed May  2 17:58:28 2007
Subject: Latest MS keeps restarting
In-Reply-To: <Pine.LNX.4.64.0705011200320.8974@control.prolocation.net>
References: <773fecad0705010258k6a71712fmf85ec9638b766bb4@mail.gmail.com>
	<Pine.LNX.4.64.0705011200320.8974@control.prolocation.net>
Message-ID: <773fecad0705020958h7ac092fcpaeced7e08a5375a7@mail.gmail.com>

>
> Run in debug mode pls, you most likely have a issue with the new one thats
> making it restart...
>
> OK, here are the results of debug mode:

In Debugging mode, not forking...
> Ignore errors about failing to find EOCD signature
> format error: can't find EOCD signature
>  at /opt/MailScanner/bin/MailScanner line 832
> format error: can't find EOCD signature
>  at /opt/MailScanner/bin/MailScanner line 832
> format error: can't find EOCD signature
>  at /opt/MailScanner/bin/MailScanner line 832
> format error: can't find EOCD signature
>  at /opt/MailScanner/bin/MailScanner line 832
> format error: can't find EOCD signature
>  at /opt/MailScanner/bin/MailScanner line 832
> format error: can't find EOCD signature
>  at /opt/MailScanner/bin/MailScanner line 832
> format error: can't find EOCD signature
>  at /opt/MailScanner/bin/MailScanner line 832
> format error: can't find EOCD signature
>  at /opt/MailScanner/bin/MailScanner line 832
> format error: can't find EOCD signature
>  at /opt/MailScanner/bin/MailScanner line 832
> format error: can't find EOCD signature
>  at /opt/MailScanner/bin/MailScanner line 832
> format error: can't find EOCD signature
>  at /opt/MailScanner/bin/MailScanner line 832
> format error: can't find EOCD signature
>  at /opt/MailScanner/bin/MailScanner line 832
> format error: can't find EOCD signature
>  at /opt/MailScanner/bin/MailScanner line 832
> format error: can't find EOCD signature
>  at /opt/MailScanner/bin/MailScanner line 832
> format error: can't find EOCD signature
>  at /opt/MailScanner/bin/MailScanner line 832
> format error: can't find EOCD signature
>  at /opt/MailScanner/bin/MailScanner line 832
> format error: can't find EOCD signature
>  at /opt/MailScanner/bin/MailScanner line 832
> DisarmPhishingFound = 0 on message l42GsXJX012133
> DisarmPhishingFound = 0 on message l42GsUaU012126
> DisarmPhishingFound = 0 on message l42Gt6ML012174
> DisarmPhishingFound = 0 on message l42GskTX012165
> DisarmPhishingFound = 0 on message l42Gt6L6012193
> DisarmPhishingFound = 0 on message l42GsRkR012119
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070502/a1b0a106/attachment.html
From list-mailscanner at linguaphone.com  Wed May  2 18:02:08 2007
From: list-mailscanner at linguaphone.com (Gareth)
Date: Wed May  2 18:02:13 2007
Subject: Can't locate Convert/BinHex.pm in @INC
In-Reply-To: <C25E25BF.3239%cleveland@winnefox.org>
Message-ID: <IGEOKMEENEPEICNOFDGJEEDLCPAA.list-mailscanner@linguaphone.com>

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info
> [mailto:mailscanner-bounces@lists.mailscanner.info]On Behalf Of Jody
> Cleveland
> Sent: 02 May 2007 17:26
> To: MailScanner discussion
> Subject: Re: Can't locate Convert/BinHex.pm in @INC
> 
> 
> May  2 11:22:49 destiny postfix/smtpd[5613]: fatal: open database
> /etc/postfix/aliases.db: No such file or directory
> May  2 11:22:50 destiny postfix/master[5581]: warning: process
> /usr/libexec/postfix/smtpd pid 5613 exit status 1
> May  2 11:22:50 destiny postfix/master[5581]: warning:
> /usr/libexec/postfix/smtpd: bad command startup -- throttling

Looks like a permissions issue where postfix cant open its alias database.
From list-mailscanner at linguaphone.com  Wed May  2 18:03:47 2007
From: list-mailscanner at linguaphone.com (Gareth)
Date: Wed May  2 18:03:50 2007
Subject: A lot of spam getting through
In-Reply-To: <04D932B0071FE34FA63EBB1977B48D150281747A@woodenex.woodmaclaw.local>
Message-ID: <IGEOKMEENEPEICNOFDGJIEDLCPAA.list-mailscanner@linguaphone.com>

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info
> [mailto:mailscanner-bounces@lists.mailscanner.info]On Behalf Of Billy A.
> Pumphrey
> Sent: 02 May 2007 17:24
> To: MailScanner discussion
> Subject: RE: A lot of spam getting through
>
>
> I am having trouble getting the testing to work, or knowing how to test
> it.  I have saved some messages from Oulook with the extension of .msg.
> When I run a spamassassin -t message.msg it returns a bunch of junk and
> then the score:
>
> Content analysis details:   (51.5 points, 5.0 required)
snip
>
> Does the testing support .msg files?  Also what is the best way to
> convert the email to text and have it correct?

I think msg files are encrypted in some way. I use IMAP as the mail store so
I just query the message that is stored on the mail servers file system
directly.

From list-mailscanner at linguaphone.com  Wed May  2 18:05:40 2007
From: list-mailscanner at linguaphone.com (Gareth)
Date: Wed May  2 18:05:42 2007
Subject: Spam detection rates
In-Reply-To: <46389974.9060000@enitech.com.au>
Message-ID: <IGEOKMEENEPEICNOFDGJMEDLCPAA.list-mailscanner@linguaphone.com>

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info
> [mailto:mailscanner-bounces@lists.mailscanner.info]On Behalf Of Pete
> Russell
> Sent: 02 May 2007 15:00
> To: MailScanner discussion
> Subject: Re: Spam detection rates
>
>
> I dont see how its possible to measure. Unless users report (and you
> count) every single spam they receive that they shouldnt have.
>
> I can tell you that my systems cathc more FPs and less spam than they
> did 6 months ago. Maybe its a sing i need fuzzy ocr and greylisting?
>
> Hope the new MS and SA this month will cure some of it.

I have some addresses that have been receiving over 100 spams a day for a
long time. They are no longer in use so I redirect them to a test account
and have all identified spams deleted automatically. Thats makes it easy to
see what gets through and if required write a custom rule to detect them.

From ssilva at sgvwater.com  Wed May  2 18:24:53 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Wed May  2 18:25:30 2007
Subject: ClamAV Module Core Dump
In-Reply-To: <004601c78c62$5973bf70$0300a8c0@bandwidthco.com>
References: <f18e52$5km$1@sea.gmane.org>
	<004601c78c62$5973bf70$0300a8c0@bandwidthco.com>
Message-ID: <f1ahh6$r8k$1@sea.gmane.org>

markee spake the following on 5/1/2007 7:34 PM:
> I have tried installing more than once, and I am near to wiping out the clam
> library and installing again. I might try clamd first, as anything has to be
> better than the commandline scanner. I am already running a few scanners,
> and every bit of load adds up.
> 
I have 2 as near identical as possible boxes running CentOS 4. One works with
the module, and one doesn't.
I am currently looking for an init script for clamd since I installed from
Julian's tarball. I am just going to download the rpm and extract the init
script and check it. I wish he had a version of his spamassassin-clamav
tarball that did rpm like the mailscanner install can. Maybe I will give it a
shot and see what I can do next week.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From mikes at hartwellcorp.com  Wed May  2 18:45:46 2007
From: mikes at hartwellcorp.com (Michael St. Laurent)
Date: Wed May  2 18:46:11 2007
Subject: Spam detection rates
Message-ID: <3BF93070B3D1B047BA7ABF612958950D018FB9D5@hcex.hartwellcorp.com>

How long is your greet pause? 

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info 
> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf 
> Of Randal, Phil
> Sent: Wednesday, May 02, 2007 5:43 AM
> To: MailScanner discussion
> Subject: RE: Spam detection rates
> 
> We consistently get over 99.5% of spam too.
> 
> Last month we blocked around 260,000 at the sendmail level
> (cbl.abuseat.org RBL and GreetPause), and 400,000 in MailScanner.
> 
> Spam seems to be around 75% of total emails here.
> 
> Cheers,
> 
> Phil
> --
> Phil Randal
> Network Engineer
> Herefordshire Council
> Hereford, UK  
> 
> > -----Original Message-----
> > From: mailscanner-bounces@lists.mailscanner.info 
> > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf 
> > Of Gareth
> > Sent: 02 May 2007 13:26
> > To: mailscanner@lists.mailscanner.info
> > Subject: Spam detection rates
> > 
> > I was wondering what sort of detection rates people are getting when
> > using Mailscanner.
> > Our old spamassassin 2.64 based system was only getting 
> about 80% but
> > with Mailscanner and the latest software we seem to be getting over
> > 99.5% which is extremely good. False positives are very low aswell.
> > 
> > We do tend to be very strict about pictures attached to emails as I
> > think we have a few rules which do the same sort of checks. Some
> > external people using the incredimail 'piece of cr**p' mail 
> > client get a
> > continuous score about 4.3 which leaves the AWL little room 
> > to bring the
> > occasional higher scoring mail back below the 5.0 
> threshold. It hasn't
> > caused any people to complain though.
> > 
> > -- 
> > MailScanner mailing list
> > mailscanner@lists.mailscanner.info
> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> > 
> > Before posting, read http://wiki.mailscanner.info/posting
> > 
> > Support MailScanner development - buy the book off the website! 
> > 
> -- 
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website! 
> 
From ssilva at sgvwater.com  Wed May  2 19:05:51 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Wed May  2 19:06:27 2007
Subject: No Programs allowed
In-Reply-To: <OFBD05D298.19A59A85-ON002572CF.004FF4EB-002572CF.0050639C@vifilfell.is>
References: <223f97700705020727i503181cdp1598aebd456a1c64@mail.gmail.com>
	<OFBD05D298.19A59A85-ON002572CF.004FF4EB-002572CF.0050639C@vifilfell.is>
Message-ID: <f1ajtv$1hm$1@sea.gmane.org>

ajs@vifilfell.is spake the following on 5/2/2007 7:34 AM:
> 
> forgot to add, that it is possible to edit the file 'magic' so that
> emails starting with this letter will no longer get flagged as a DOS
> executable
> 
> Asgeir.
I had to do this for one of the quicktime entries. Every time someone started
a message with "I'm free ... " which seems to happen often here, it would get
detected as a quicktime movie.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From ssilva at sgvwater.com  Wed May  2 19:08:41 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Wed May  2 19:10:11 2007
Subject: No Programs allowed
In-Reply-To: <OF144BAE95.79191AE5-ON002572CF.00522ECD-002572CF.0052C5BB@vifilfell.is>
References: <223f97700705020746u3015ab59r3cdbe3c0dac2f7c5@mail.gmail.com>
	<OF144BAE95.79191AE5-ON002572CF.00522ECD-002572CF.0052C5BB@vifilfell.is>
Message-ID: <f1ak39$1hm$3@sea.gmane.org>

ajs@vifilfell.is spake the following on 5/2/2007 8:00 AM:
> this is the case, Jon has tried the solution I pm-ed him and it works.
> 
> I use Lotus for email and sometimes forget to switch to plain text when 
> sending email to mailing list, will try to remember it next time.
> 
> cheers, asgeir,
The last time I used Notes, you could set certain addresses to only get text
mail. But that was a long time ago.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From ssilva at sgvwater.com  Wed May  2 19:06:53 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Wed May  2 19:15:14 2007
Subject: Fwd: [shell-script] Oportunidade - TALENT FOUR/ Administrador
 de   Redes e Sistemas - LINUX
In-Reply-To: <c8c4ee450705020415l648e0934rdeec679441ce3e98@mail.gmail.com>
References: <6C590FEEFDEC05478512F3771363C6DB489830@tfcmail02.tfc.com.br>
	<c8c4ee450705020415l648e0934rdeec679441ce3e98@mail.gmail.com>
Message-ID: <f1ajvt$1hm$2@sea.gmane.org>

Fabio Silva spake the following on 5/2/2007 4:15 AM:
> 
> 
> ---------- Forwarded message ----------
> From: *Renata Dardis de Souza* <renata.souza@talentfour.com.br
> <mailto:renata.souza@talentfour.com.br> >
> Date: Apr 30, 2007 4:30 PM
> Subject: [shell-script] Oportunidade - TALENT FOUR/ Administrador de
> Redes e Sistemas  - LINUX
> To: shell-script@yahoogrupos.com.br
> <mailto:shell-script@yahoogrupos.com.br>
> 
> Ol? Grupo,
> 
> Boa tarde!!!!
> 
> A Talent Four Consulting ? uma empresa de consultoria em projetos de
> Tecnologia da Informa??o, especializada em servi?os e terceiriza??o de
> Profissionais.
Can't be too professional when you spam a spam-fighting mail list.


-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From mikes at hartwellcorp.com  Wed May  2 20:13:01 2007
From: mikes at hartwellcorp.com (Michael St. Laurent)
Date: Wed May  2 20:13:33 2007
Subject: RPM for milter-null?
Message-ID: <3BF93070B3D1B047BA7ABF612958950D018FB9D6@hcex.hartwellcorp.com>

Does anyone know of an RPM or SRPM for the milter-null package?
From jstevens at athensdistributing.com  Wed May  2 20:18:01 2007
From: jstevens at athensdistributing.com (James R. Stevens)
Date: Wed May  2 20:18:10 2007
Subject: RPM for milter-null?
References: <3BF93070B3D1B047BA7ABF612958950D018FB9D6@hcex.hartwellcorp.com>
Message-ID: <1A65E6BAEADF9B4F865314484A13ECF1608865@atlas.athensdistributing.com>

I wish.. Been trying to get libsnert to compile on RH 9 with the sole
purpose to install milter-null... no luck

-----Original Message-----
From: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Michael
St. Laurent
Sent: Wednesday, May 02, 2007 2:13 PM
To: MailScanner discussion
Subject: RPM for milter-null?

Does anyone know of an RPM or SRPM for the milter-null package?
--
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!

-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.


-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.

From ka at pacific.net  Wed May  2 20:21:21 2007
From: ka at pacific.net (Ken A)
Date: Wed May  2 20:21:18 2007
Subject: RPM for milter-null?
In-Reply-To: <3BF93070B3D1B047BA7ABF612958950D018FB9D6@hcex.hartwellcorp.com>
References: <3BF93070B3D1B047BA7ABF612958950D018FB9D6@hcex.hartwellcorp.com>
Message-ID: <4638E4B1.30809@pacific.net>

Michael St. Laurent wrote:
> Does anyone know of an RPM or SRPM for the milter-null package?

It gets compiled against libsnert (on which you only do 'make', not 
'make install') in com/snert/lib source tree, so there's no rpm. Just 
use the source for both from snertsoft.com. Both are free.

-- 
Ken Anderson
Pacific.Net
From jstevens at athensdistributing.com  Wed May  2 20:32:48 2007
From: jstevens at athensdistributing.com (James R. Stevens)
Date: Wed May  2 20:32:58 2007
Subject: RPM for milter-null?
References: <3BF93070B3D1B047BA7ABF612958950D018FB9D6@hcex.hartwellcorp.com>
	<4638E4B1.30809@pacific.net>
Message-ID: <1A65E6BAEADF9B4F865314484A13ECF1608866@atlas.athensdistributing.com>

Since this is already out there... Does this make sense to anyone?

Trying to make libsnert bombs with error 2

I pass /configure with no arguments and all seems fine

LibSnert/1.63.892
Copyright 1996, 2007 by Anthony Howe. All rights reserved.

  Platform............: Linux gcc
  Berkeley DB.........: 4.0 -ldb-4.0
  POSIX Threads.......: yes yes
  SQLite3.............: yes
  Sendmail libmilter..: yes
  Semaphore API.......: SYSTEMV_API
  Shared Memory API...: SYSTEMV_API
  Time API............: BSD_API
  CFLAGS..............: -I/usr/include/db4
-I/usr/local/org/sqlite/include -D_REENTRANT -O2 -Wall
-I${top_srcdir}/../../include 
  LDFLAGS.............: -L/usr/local/org/sqlite/lib
-L${top_srcdir}/../../lib 
  LIBS................: -lpthread -ldl

BUT after passing 'make clean build' it bombs..

***************************************************************
==> /usr/local/com/snert/src/lib/../tools
***************************************************************

gcc -I/usr/include/db4 -I/usr/local/org/sqlite/include -D_REENTRANT -O2
-Wall -I./../../include  -L/usr/local/org/sqlite/lib -L./../../lib  -o
ansi ansi.c
gcc -I/usr/include/db4 -I/usr/local/org/sqlite/include -D_REENTRANT -O2
-Wall -I./../../include  -L/usr/local/org/sqlite/lib -L./../../lib  -o
flip flip.c -lsnert
gcc -I/usr/include/db4 -I/usr/local/org/sqlite/include -D_REENTRANT -O2
-Wall -I./../../include  -L/usr/local/org/sqlite/lib -L./../../lib  -o
smtpout smtpout.c -lsnert -lpthread -ldl 
./../../lib/libsnert.a(socket2.o)(.text+0x3ee): In function
`socketAddressCreate':
: undefined reference to `VectorGet'
[SNIP-IT]
./../../lib/libsnert.a(TextSplit.o)(.text+0x4e): In function
`TextSplit':
: undefined reference to `VectorAdd'
collect2: ld returned 1 exit status
make[1]: *** [smtpout] Error 1
make[1]: Leaving directory `/usr/local/com/snert/src/tools'
make: *** [build] Error 2

-----Original Message-----
From: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Ken A
Sent: Wednesday, May 02, 2007 2:21 PM
To: MailScanner discussion
Subject: Re: RPM for milter-null?

Michael St. Laurent wrote:
> Does anyone know of an RPM or SRPM for the milter-null package?

It gets compiled against libsnert (on which you only do 'make', not 
'make install') in com/snert/lib source tree, so there's no rpm. Just 
use the source for both from snertsoft.com. Both are free.

-- 
Ken Anderson
Pacific.Net
-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 

-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.


-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.

From Denis.Beauchemin at USherbrooke.ca  Wed May  2 20:43:06 2007
From: Denis.Beauchemin at USherbrooke.ca (Denis Beauchemin)
Date: Wed May  2 20:43:31 2007
Subject: RPM for milter-null?
In-Reply-To: <1A65E6BAEADF9B4F865314484A13ECF1608866@atlas.athensdistributing.com>
References: <3BF93070B3D1B047BA7ABF612958950D018FB9D6@hcex.hartwellcorp.com>	<4638E4B1.30809@pacific.net>
	<1A65E6BAEADF9B4F865314484A13ECF1608866@atlas.athensdistributing.com>
Message-ID: <4638E9CA.1010908@USherbrooke.ca>

James R. Stevens a ?crit :
> Since this is already out there... Does this make sense to anyone?
>
> Trying to make libsnert bombs with error 2
>   

I think you need to install sendmail-devel under RH/CentOS for it to 
compile...

Denis

-- 
   _
  ?v?   Denis Beauchemin, analyste
 /(_)\  Universit? de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x62252 F: 819.821.8045


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3595 bytes
Desc: S/MIME Cryptographic Signature
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070502/d9dd3123/smime-0001.bin
From MailScanner at ecs.soton.ac.uk  Wed May  2 20:40:16 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Wed May  2 20:43:36 2007
Subject: 32 bit distro or 64?
In-Reply-To: <FF689DC51C3C1640BE668A0E31182AD002D15B68@mail03.mira.co.uk>
References: <FF689DC51C3C1640BE668A0E31182AD002D15B68@mail03.mira.co.uk>
Message-ID: <4638E920.6000706@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I've never had the time recently to do 32-bit versus 64-bit speed tests 
on the same hardware, I tend to install 64-bit on 64-bit machines by 
default, though.

One thing I can say: if you use Sophos, I believe they still don't have 
a 64-bit version of the SAVI library available. This will affect you if 
you are using the "sophossavi" Virus Scanners setting.

Jules.

Paul Hutchings wrote:
>
> Again probably not a MailScanner specific query but as this box is 
> specifically to run MailScanner I?ll ask here.
>
> I have a new DL360 G5 and I?m planning on installing OpenSuse 10.2. 
> Should I be using the 32 bit or 64 bit with regards to MailScanner, 
> basically are there any reasons to choose one over the other?
>
> The box has 2gb of RAM so there?s no ?large memory? type issues 
> involved it?s purely why I might choose one over the other for this 
> application.
>
> Cheers,
>
> Paul
>
> Paul Hutchings
>
> Network Administrator, MIRA Ltd.
>
> Tel: 44 (0)24 7635 5378
>
> Fax: 44 (0)24 7635 8378
>
> mailto:paul.hutchings@mira.co.uk
>
>
>
> ------------------------------------------------------------------------
> *MIRA Ltd.*
> Watling Street, Nuneaton, Warwickshire, CV10 0TU, England.
> Registered in England No. 402570
> VAT Registration GB 114 5409 96
>
> The contents of this e-mail are confidential and are solely for the 
> use of the intended recipient.
> If you receive this e-mail in error, please delete it and notify us 
> either by e-mail, telephone or fax.
> You should not copy, forward or otherwise disclose the content of the 
> e-mail as this is prohibited.

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk




-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: windows-1252

wj8DBQFGOOnJEfZZRxQVtlQRAuYwAJ9vQgHcjG/HdrrLm4QKtrutBdWK5QCfXD+o
EJPoQyOLMSzfsspnbiUcMeg=
=f3SB
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From MailScanner at ecs.soton.ac.uk  Wed May  2 20:45:16 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Wed May  2 20:48:14 2007
Subject: Latest MS keeps restarting
In-Reply-To: <773fecad0705020958h7ac092fcpaeced7e08a5375a7@mail.gmail.com>
References: <773fecad0705010258k6a71712fmf85ec9638b766bb4@mail.gmail.com>	<Pine.LNX.4.64.0705011200320.8974@control.prolocation.net>
	<773fecad0705020958h7ac092fcpaeced7e08a5375a7@mail.gmail.com>
Message-ID: <4638EA4C.7080307@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

The EOCD messages can be safe ignored, just as it says. So that's not it.
Was that the complete output of debug mode?
It doesn't show any signs of errors, except I'm worried you haven't 
posted what would normally be the last line of output:
       Stopping now as you are debugging me.

Jules.

G P wrote:
>
>     Run in debug mode pls, you most likely have a issue with the new
>     one thats
>     making it restart...
>
> OK, here are the results of debug mode:
>
>     In Debugging mode, not forking...
>     Ignore errors about failing to find EOCD signature
>     format error: can't find EOCD signature
>      at /opt/MailScanner/bin/MailScanner line 832
>     format error: can't find EOCD signature
>      at /opt/MailScanner/bin/MailScanner line 832
>     format error: can't find EOCD signature
>      at /opt/MailScanner/bin/MailScanner line 832
>     format error: can't find EOCD signature
>      at /opt/MailScanner/bin/MailScanner line 832
>     format error: can't find EOCD signature
>      at /opt/MailScanner/bin/MailScanner line 832
>     format error: can't find EOCD signature
>      at /opt/MailScanner/bin/MailScanner line 832
>     format error: can't find EOCD signature
>      at /opt/MailScanner/bin/MailScanner line 832
>     format error: can't find EOCD signature
>      at /opt/MailScanner/bin/MailScanner line 832
>     format error: can't find EOCD signature
>      at /opt/MailScanner/bin/MailScanner line 832
>     format error: can't find EOCD signature
>      at /opt/MailScanner/bin/MailScanner line 832
>     format error: can't find EOCD signature
>      at /opt/MailScanner/bin/MailScanner line 832
>     format error: can't find EOCD signature
>      at /opt/MailScanner/bin/MailScanner line 832
>     format error: can't find EOCD signature
>      at /opt/MailScanner/bin/MailScanner line 832
>     format error: can't find EOCD signature
>      at /opt/MailScanner/bin/MailScanner line 832
>     format error: can't find EOCD signature
>      at /opt/MailScanner/bin/MailScanner line 832
>     format error: can't find EOCD signature
>      at /opt/MailScanner/bin/MailScanner line 832
>     format error: can't find EOCD signature
>      at /opt/MailScanner/bin/MailScanner line 832
>     DisarmPhishingFound = 0 on message l42GsXJX012133
>     DisarmPhishingFound = 0 on message l42GsUaU012126
>     DisarmPhishingFound = 0 on message l42Gt6ML012174
>     DisarmPhishingFound = 0 on message l42GskTX012165
>     DisarmPhishingFound = 0 on message l42Gt6L6012193
>     DisarmPhishingFound = 0 on message l42GsRkR012119
>

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGOOrcEfZZRxQVtlQRAlE8AKDc1Hl8AYq5F2jHxsev+gy5bA3g0gCdET2S
foMf9JQ6i6MjmovQ7L9K4b4=
=9hQN
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From grpprod at gmail.com  Wed May  2 21:12:39 2007
From: grpprod at gmail.com (G P)
Date: Wed May  2 21:12:41 2007
Subject: Latest MS keeps restarting
In-Reply-To: <4638EA4C.7080307@ecs.soton.ac.uk>
References: <773fecad0705010258k6a71712fmf85ec9638b766bb4@mail.gmail.com>
	<Pine.LNX.4.64.0705011200320.8974@control.prolocation.net>
	<773fecad0705020958h7ac092fcpaeced7e08a5375a7@mail.gmail.com>
	<4638EA4C.7080307@ecs.soton.ac.uk>
Message-ID: <773fecad0705021312q4fad6f8fnc2976122321ed055@mail.gmail.com>

>
> The EOCD messages can be safe ignored, just as it says. So that's not it.
> Was that the complete output of debug mode?
> It doesn't show any signs of errors, except I'm worried you haven't
> posted what would normally be the last line of output:
>        Stopping now as you are debugging me.


You're right, yet I deliberately omitted the last line. I just
double-checked, and I can confirm this is the total output. I will make one
more attempt to switch to the latest version and post here the results.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070502/38518b0a/attachment.html
From mkettler at evi-inc.com  Wed May  2 21:51:34 2007
From: mkettler at evi-inc.com (Matt Kettler)
Date: Wed May  2 21:51:45 2007
Subject: 32 bit distro or 64?
In-Reply-To: <FF689DC51C3C1640BE668A0E31182AD002D15B68@mail03.mira.co.uk>
References: <FF689DC51C3C1640BE668A0E31182AD002D15B68@mail03.mira.co.uk>
Message-ID: <4638F9D6.1070003@evi-inc.com>

Paul Hutchings wrote:
> Again probably not a MailScanner specific query but as this box is
> specifically to run MailScanner I?ll ask here.
> 
>  
> 
> I have a new DL360 G5 and I?m planning on installing OpenSuse 10.2. 
> Should I be using the 32 bit or 64 bit with regards to MailScanner,
> basically are there any reasons to choose one over the other?
> 

I've not benchmarked it, but theoretically the difference should be insignificant.

On the up-side the 64bit version will use native 64bit math instructions for
64-bit arithmetic (ie: file offsets), making common additions take 1 instruction
cycle instead of 2. However, this isn't so common, particularly in a
MailScanner/SA/AV setup, that it would make a big difference.

The downside 64bit version will also use 64-bit pointers and code segments,
increasing memory usage slightly. However, this isn't big enough to make a
significant difference either. You've almost certainly increased memory usage by
less than 5%, and probably less than 1%.

However, if you ever expect to "scale up" the memory beyond 4gb, the 64-bit
version would be helpful. Otherwise, it's a wash. You gain a small amount of
performance for a small increase in memory use.


From res at ausics.net  Wed May  2 22:04:19 2007
From: res at ausics.net (Res)
Date: Wed May  2 22:04:30 2007
Subject: RPM for milter-null?
In-Reply-To: <4638E9CA.1010908@USherbrooke.ca>
References: <3BF93070B3D1B047BA7ABF612958950D018FB9D6@hcex.hartwellcorp.com>
	<4638E4B1.30809@pacific.net>
	<1A65E6BAEADF9B4F865314484A13ECF1608866@atlas.athensdistributing.com>
	<4638E9CA.1010908@USherbrooke.ca>
Message-ID: <Pine.LNX.4.64.0705030702180.22474@ebfjryy.nhfvpf.arg>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, 2 May 2007, Denis Beauchemin wrote:

> James R. Stevens a écrit :
>> Since this is already out there... Does this make sense to anyone?
>> 
>> Trying to make libsnert bombs with error 2
>> 
>
> I think you need to install sendmail-devel under RH/CentOS for it to 
> compile...
>

Since there has been no rpm update of RH9 sendmail (even from the now 
defunct legacy network) for several years I would HOPE he is not running
any rpm version of sendmail and has the actual tarballs of at least more 
current stuff.




- -- 

Cheers
Res

Vote for your favourite MTA at  http://polls.ausics.net/v3.php
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGOPzWsWhAmSIQh7MRAoh/AJ9PB/oIUGUM68mTYfcb1fKRgAcarwCeKQfA
OFo6kvpserOfyDM0Go+CX/g=
=1Xug
-----END PGP SIGNATURE-----
From mailscanner at yeticomputers.com  Wed May  2 22:21:58 2007
From: mailscanner at yeticomputers.com (Rick Chadderdon)
Date: Wed May  2 22:15:32 2007
Subject: 32 bit distro or 64?
In-Reply-To: <FF689DC51C3C1640BE668A0E31182AD002D15B68@mail03.mira.co.uk>
References: <FF689DC51C3C1640BE668A0E31182AD002D15B68@mail03.mira.co.uk>
Message-ID: <463900F6.1070103@yeticomputers.com>

Paul Hutchings wrote:
>
> I have a new DL360 G5 and I?m planning on installing OpenSuse 10.2. 
> Should I be using the 32 bit or 64 bit with regards to MailScanner,
> basically are there any reasons to choose one over the other?
>

It's probably worth some consideration that there is less software
available in 64-bit versions.  Julian touched on this with the Sophos
information he offered, and my personal experience leads me to believe
that Sophos is not likely to be the only vendor with this issue.  Hence,
a 64-bit distro likely limits your choices if you should need to look
for a variety of antivirus vendors (or if the future need should arise
to change vendors from ones you have already determined to be 64-bit
ready), and it will do so while offering a very minimal increase in
performance, if any.

Be aware that I have no knowledge of any specific virus scanner that
does/does not work in a 64-bit environment - I'm just cautious because
this issue has bitten me before, and have come to think of 64-bit as
"option limiting".  I only use 64-bit OSes when I have absolute
certainty that I will not need to rely on any closed-source vendor to
provide 64-bit support.

Rick
From MailScanner at ecs.soton.ac.uk  Wed May  2 22:20:49 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Wed May  2 22:23:42 2007
Subject: SpamAssassin 3.2.0
Message-ID: <463900B1.8080301@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Well, as someone else has already said, it's been released.

Its list of requirements has grown quite a lot. In addition to whatever 
else you already have from an existing SA install, you need to install 
this load of Perl modules, in this order:

      YAML -- requires y\n in perl Makefile.PL
      ExtUtils::CBuilder
      ExtUtils::ParseXS
    Module::Build
      version
    Net::DNS::Resolver::Programmable
    Error
    NetAddr::IP
    Net::DNS >=0.58
    Data::Dump
  Encode::Detect
  Mail::SPF
Mail::SpamAssassin -- requires \n in perl Makefile.PL

It puts in a v320.pre into /etc/mail/spamassassin and comes with a load 
of new plugins. Some of them are loaded by the default supplied v320.pre 
file, but here are the ones that aren't:

                          Hashcash.pm             Rule2XSBody.pm
ASN.pm                                            SpamCop.pm
AutoLearnThreshold.pm                             SPF.pm
AWL.pm                                            Test.pm
                                                  TextCat.pm
                          MIMEHeader.pm          
BodyRuleBaseExtractor.pm  OneLineBodyRuleType.pm  URIDNSBL.pm
                          Pyzor.pm              
DCC.pm                    Razor2.pm              
                          RelayCountry.pm         WhiteListSubject.pm
                          ReplaceTags.pm

My next step is to read the man pages for all of these, and work out 
which ones you probably want to load and which ones you don't, so that 
my install script can set you up with a sensible system. One thing I'm 
not installing is support for DKIM which, although available, requires 
so many pre-requisites that it's not feasible for me to do here. You 
have to start at the OpenSSL libraries and work your way up :-(

Once I've got something working here, I'll write up an install script 
for it all and wrap it into a package for you.

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGOQEwEfZZRxQVtlQRArCWAJ95n3Z0uHjg/25LaIHPFUauWsZ+vACfYdtP
qjZF/RoldGlTZywtz3b9U/8=
=yA8+
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From ssilva at sgvwater.com  Wed May  2 22:33:58 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Wed May  2 22:35:12 2007
Subject: SpamAssassin 3.2.0
In-Reply-To: <463900B1.8080301@ecs.soton.ac.uk>
References: <463900B1.8080301@ecs.soton.ac.uk>
Message-ID: <f1b047$skt$3@sea.gmane.org>

Julian Field spake the following on 5/2/2007 2:20 PM:
> Well, as someone else has already said, it's been released.
> 
> Its list of requirements has grown quite a lot. In addition to whatever
> else you already have from an existing SA install, you need to install
> this load of Perl modules, in this order:
> 
>       YAML -- requires y\n in perl Makefile.PL
>       ExtUtils::CBuilder
>       ExtUtils::ParseXS
>     Module::Build
>       version
>     Net::DNS::Resolver::Programmable
>     Error
>     NetAddr::IP
>     Net::DNS >=0.58
>     Data::Dump
>   Encode::Detect
>   Mail::SPF
> Mail::SpamAssassin -- requires \n in perl Makefile.PL
> 
> It puts in a v320.pre into /etc/mail/spamassassin and comes with a load
> of new plugins. Some of them are loaded by the default supplied v320.pre
> file, but here are the ones that aren't:
> 
>                           Hashcash.pm             Rule2XSBody.pm
> ASN.pm                                            SpamCop.pm
> AutoLearnThreshold.pm                             SPF.pm
> AWL.pm                                            Test.pm
>                                                   TextCat.pm
>                           MIMEHeader.pm
> BodyRuleBaseExtractor.pm  OneLineBodyRuleType.pm  URIDNSBL.pm
>                           Pyzor.pm
> DCC.pm                    Razor2.pm
>                           RelayCountry.pm         WhiteListSubject.pm
>                           ReplaceTags.pm
> 
> My next step is to read the man pages for all of these, and work out
> which ones you probably want to load and which ones you don't, so that
> my install script can set you up with a sensible system. One thing I'm
> not installing is support for DKIM which, although available, requires
> so many pre-requisites that it's not feasible for me to do here. You
> have to start at the OpenSSL libraries and work your way up :-(
> 
> Once I've got something working here, I'll write up an install script
> for it all and wrap it into a package for you.
> 
> Jules
> 
Looking at your daily increased activity on the list, I am assuming
(hopefully) that you are feeling somewhat better. Keep up the good healing,
and rest as much as you can without driving yourself crazy.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From Richard.Frovarp at sendit.nodak.edu  Wed May  2 22:38:02 2007
From: Richard.Frovarp at sendit.nodak.edu (Richard Frovarp)
Date: Wed May  2 22:38:07 2007
Subject: 32 bit distro or 64?
In-Reply-To: <463900F6.1070103@yeticomputers.com>
References: <FF689DC51C3C1640BE668A0E31182AD002D15B68@mail03.mira.co.uk>
	<463900F6.1070103@yeticomputers.com>
Message-ID: <463904BA.4040402@sendit.nodak.edu>

Rick Chadderdon wrote:
> Paul Hutchings wrote:
>   
>> I have a new DL360 G5 and I?m planning on installing OpenSuse 10.2. 
>> Should I be using the 32 bit or 64 bit with regards to MailScanner,
>> basically are there any reasons to choose one over the other?
>>
>>     
>
> It's probably worth some consideration that there is less software
> available in 64-bit versions.  Julian touched on this with the Sophos
> information he offered, and my personal experience leads me to believe
> that Sophos is not likely to be the only vendor with this issue.  Hence,
> a 64-bit distro likely limits your choices if you should need to look
> for a variety of antivirus vendors (or if the future need should arise
> to change vendors from ones you have already determined to be 64-bit
> ready), and it will do so while offering a very minimal increase in
> performance, if any.
>
> Be aware that I have no knowledge of any specific virus scanner that
> does/does not work in a 64-bit environment - I'm just cautious because
> this issue has bitten me before, and have come to think of 64-bit as
> "option limiting".  I only use 64-bit OSes when I have absolute
> certainty that I will not need to rely on any closed-source vendor to
> provide 64-bit support.
>
> Rick
>   

Couldn't you just run the 32bit versions of the virus scanners? We're 
not talking about full 64 bit like Itaniums or any other number of other 
processors out there. We're just talking about 64 bit extended OSs. I 
run plenty of 32bit applications on my 64bit OS without any problems. Of 
course I have the 32bit and 64bit versions of all the libraries 
installed to do this.

Richard
From spamtrap71892316634 at anime.net  Wed May  2 22:50:20 2007
From: spamtrap71892316634 at anime.net (Dan Hollis)
Date: Wed May  2 22:50:23 2007
Subject: 32 bit distro or 64?
In-Reply-To: <463900F6.1070103@yeticomputers.com>
References: <FF689DC51C3C1640BE668A0E31182AD002D15B68@mail03.mira.co.uk>
	<463900F6.1070103@yeticomputers.com>
Message-ID: <Pine.LNX.4.64.0705021450001.28073@sasami.anime.net>

On Wed, 2 May 2007, Rick Chadderdon wrote:
> Be aware that I have no knowledge of any specific virus scanner that
> does/does not work in a 64-bit environment - I'm just cautious because
> this issue has bitten me before, and have come to think of 64-bit as
> "option limiting".  I only use 64-bit OSes when I have absolute
> certainty that I will not need to rely on any closed-source vendor to
> provide 64-bit support.

I have never had any issues running 32bit apps on 64bit OS.

-Dan
From ms-list at alexb.ch  Wed May  2 23:04:02 2007
From: ms-list at alexb.ch (Alex Broens)
Date: Wed May  2 23:04:09 2007
Subject: SpamAssassin 3.2.0
In-Reply-To: <463900B1.8080301@ecs.soton.ac.uk>
References: <463900B1.8080301@ecs.soton.ac.uk>
Message-ID: <46390AD2.8010208@alexb.ch>

On 5/2/2007 11:20 PM, Julian Field wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Well, as someone else has already said, it's been released.
> 
> Its list of requirements has grown quite a lot. In addition to whatever 
> else you already have from an existing SA install, you need to install 
> this load of Perl modules, in this order:
> 
>       YAML -- requires y\n in perl Makefile.PL
>       ExtUtils::CBuilder
>       ExtUtils::ParseXS
>     Module::Build
>       version
>     Net::DNS::Resolver::Programmable
>     Error
>     NetAddr::IP
>     Net::DNS >=0.58
>     Data::Dump
>   Encode::Detect
>   Mail::SPF
> Mail::SpamAssassin -- requires \n in perl Makefile.PL
> 
> It puts in a v320.pre into /etc/mail/spamassassin and comes with a load 
> of new plugins. Some of them are loaded by the default supplied v320.pre 
> file, but here are the ones that aren't:
> 
>                           Hashcash.pm             Rule2XSBody.pm
> ASN.pm                                            SpamCop.pm
> AutoLearnThreshold.pm                             SPF.pm
> AWL.pm                                            Test.pm
>                                                   TextCat.pm
>                           MIMEHeader.pm          
> BodyRuleBaseExtractor.pm  OneLineBodyRuleType.pm  URIDNSBL.pm
>                           Pyzor.pm              
> DCC.pm                    Razor2.pm              
>                           RelayCountry.pm         WhiteListSubject.pm
>                           ReplaceTags.pm
> 
> My next step is to read the man pages for all of these, and work out 
> which ones you probably want to load and which ones you don't, so that 
> my install script can set you up with a sensible system. One thing I'm 
> not installing is support for DKIM which, although available, requires 
> so many pre-requisites that it's not feasible for me to do here. You 
> have to start at the OpenSSL libraries and work your way up :-(
> 
> Once I've got something working here, I'll write up an install script 
> for it all and wrap it into a package for you.
> 
> Jules

Julian

One of the nices features SA 3.2 has is the shortcicuiting of rules.
This may be a big resource saver and you may have to adapt MailScanner 
quite a bit to play with the shortcircuiting concept.

Alex

From root at doctor.nl2k.ab.ca  Wed May  2 23:07:58 2007
From: root at doctor.nl2k.ab.ca (Dave Shariff Yadallee - System Administrator a.k.a. The Root of the
	Problem)
Date: Wed May  2 23:10:35 2007
Subject: Bogus IPs in hearder
Message-ID: <20070502220757.GD1334@doctor.nl2k.ab.ca>

HEADERS!!  I cannot type today.

Still,  can we use mailscanner and/or Spam Assassin to
block out mail using and octet > 255 or < 0?

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

From r.berber at computer.org  Wed May  2 23:06:21 2007
From: r.berber at computer.org (=?ISO-8859-1?Q?Ren=E9_Berber?=)
Date: Wed May  2 23:10:43 2007
Subject: SpamAssassin 3.2.0
In-Reply-To: <463900B1.8080301@ecs.soton.ac.uk>
References: <463900B1.8080301@ecs.soton.ac.uk>
Message-ID: <f1b20r$4p1$1@sea.gmane.org>

Julian Field wrote:
[snip]
> Once I've got something working here, I'll write up an install script
> for it all and wrap it into a package for you.

SA 3.2.0 seems to have a nasty bug that leaves temporary files, it would be 
better to wait for a package until the dust settles.
-- 
Ren? Berber

From doc at maddoc.net  Wed May  2 23:11:08 2007
From: doc at maddoc.net (Doc Schneider)
Date: Wed May  2 23:11:14 2007
Subject: SpamAssassin 3.2.0
In-Reply-To: <463900B1.8080301@ecs.soton.ac.uk>
References: <463900B1.8080301@ecs.soton.ac.uk>
Message-ID: <46390C7C.70406@maddoc.net>

Julian Field wrote:
> Well, as someone else has already said, it's been released.
> 
> Its list of requirements has grown quite a lot. In addition to whatever
> else you already have from an existing SA install, you need to install
> this load of Perl modules, in this order:
> 
>       YAML -- requires y\n in perl Makefile.PL
>       ExtUtils::CBuilder
>       ExtUtils::ParseXS
>     Module::Build
>       version
>     Net::DNS::Resolver::Programmable
>     Error
>     NetAddr::IP
>     Net::DNS >=0.58
>     Data::Dump
>   Encode::Detect
>   Mail::SPF
> Mail::SpamAssassin -- requires \n in perl Makefile.PL
> 
> It puts in a v320.pre into /etc/mail/spamassassin and comes with a load
> of new plugins. Some of them are loaded by the default supplied v320.pre
> file, but here are the ones that aren't:
> 
>                           Hashcash.pm             Rule2XSBody.pm
> ASN.pm                                            SpamCop.pm
> AutoLearnThreshold.pm                             SPF.pm
> AWL.pm                                            Test.pm
>                                                   TextCat.pm
>                           MIMEHeader.pm
> BodyRuleBaseExtractor.pm  OneLineBodyRuleType.pm  URIDNSBL.pm
>                           Pyzor.pm
> DCC.pm                    Razor2.pm
>                           RelayCountry.pm         WhiteListSubject.pm
>                           ReplaceTags.pm
> 
> My next step is to read the man pages for all of these, and work out
> which ones you probably want to load and which ones you don't, so that
> my install script can set you up with a sensible system. One thing I'm
> not installing is support for DKIM which, although available, requires
> so many pre-requisites that it's not feasible for me to do here. You
> have to start at the OpenSSL libraries and work your way up :-(
> 
> Once I've got something working here, I'll write up an install script
> for it all and wrap it into a package for you.
> 
> Jules
> 

Don't forget this new SA can compile the rules using sa-compile and
needs re2c from http://re2c.sf.net/

sa-compile effectively speeds up spamassassin and while I didn't really
write much about it when I did the "What's new" for SA, I think it is
the best new feature!

Good to see you getting back into the swing of things Jules. Take it
from someone who knows, DO NOT over do it!

-- 
-Doc
Lincoln, NE.
http://www.genealogyforyou.com/
http://www.cairnproductions.com/

From ms-list at alexb.ch  Wed May  2 23:23:36 2007
From: ms-list at alexb.ch (Alex Broens)
Date: Wed May  2 23:23:43 2007
Subject: SpamAssassin 3.2.0
In-Reply-To: <f1b20r$4p1$1@sea.gmane.org>
References: <463900B1.8080301@ecs.soton.ac.uk> <f1b20r$4p1$1@sea.gmane.org>
Message-ID: <46390F68.8000002@alexb.ch>

On 5/3/2007 12:06 AM, Ren? Berber wrote:
> Julian Field wrote:
> [snip]
>> Once I've got something working here, I'll write up an install script
>> for it all and wrap it into a package for you.
> 
> SA 3.2.0 seems to have a nasty bug that leaves temporary files, it would 
> be better to wait for a package until the dust settles.

Do you really know if its a spamd/spamc issue or no?
Where are these supposed to be?


I've been testing SA 3.2trunk/RCs/whatever & MS for ages and haven't 
seen no such files anywhere.
btw:
The person who opened 
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5444 hasn't made a 
point of specifying how to reproduce it.


Alex






From doc at maddoc.net  Wed May  2 23:32:16 2007
From: doc at maddoc.net (Doc Schneider)
Date: Wed May  2 23:32:22 2007
Subject: SpamAssassin 3.2.0
In-Reply-To: <46390F68.8000002@alexb.ch>
References: <463900B1.8080301@ecs.soton.ac.uk> <f1b20r$4p1$1@sea.gmane.org>
	<46390F68.8000002@alexb.ch>
Message-ID: <46391170.1070401@maddoc.net>

Alex Broens wrote:
> On 5/3/2007 12:06 AM, Ren? Berber wrote:
>> Julian Field wrote:
>> [snip]
>>> Once I've got something working here, I'll write up an install script
>>> for it all and wrap it into a package for you.
>>
>> SA 3.2.0 seems to have a nasty bug that leaves temporary files, it
>> would be better to wait for a package until the dust settles.
> 
> Do you really know if its a spamd/spamc issue or no?
> Where are these supposed to be?
> 
> 
> I've been testing SA 3.2trunk/RCs/whatever & MS for ages and haven't
> seen no such files anywhere.
> btw:
> The person who opened
> http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5444 hasn't made a
> point of specifying how to reproduce it.
> 
> 
> Alex
> 

I followed this discussion on the sa-users list and it looks to me like
it might be a MIMEDefang problem. I've also been testing MS and SA and
never saw anything like this myself, either.

-- 
-Doc
Lincoln, NE.
http://www.genealogyforyou.com/
http://www.cairnproductions.com/

From r.berber at computer.org  Wed May  2 23:44:40 2007
From: r.berber at computer.org (=?ISO-8859-1?Q?Ren=E9_Berber?=)
Date: Wed May  2 23:44:59 2007
Subject: SpamAssassin 3.2.0
In-Reply-To: <46390F68.8000002@alexb.ch>
References: <463900B1.8080301@ecs.soton.ac.uk> <f1b20r$4p1$1@sea.gmane.org>
	<46390F68.8000002@alexb.ch>
Message-ID: <f1b48n$ds7$1@sea.gmane.org>

Alex Broens wrote:

> Do you really know if its a spamd/spamc issue or no?

Spamc so far, but as one message on SA list stated it may have been a last 
minute change so I'm not sure if the problem is wider.

[snip]
-- 
Ren? Berber

From hvdkooij at vanderkooij.org  Wed May  2 23:46:27 2007
From: hvdkooij at vanderkooij.org (Hugo van der Kooij)
Date: Wed May  2 23:46:56 2007
Subject: Bogus IPs in hearder
In-Reply-To: <20070502220757.GD1334@doctor.nl2k.ab.ca>
References: <20070502220757.GD1334@doctor.nl2k.ab.ca>
Message-ID: <Pine.LNX.4.64.0705030044510.21226@faramir.hugo.vanderkooij.org>

On Wed, 2 May 2007, Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem wrote:

> Still,  can we use mailscanner and/or Spam Assassin to
> block out mail using and octet > 255 or < 0?

I think you will find these octets so rare they only hide out in a holy 
graal at the end of a rainbow but only on blue mondays.

Hugo.

-- 
 	hvdkooij@vanderkooij.org	http://hugo.vanderkooij.org/
 	    This message is using 100% recycled electrons.

 	Some men see computers as they are and say "Windows"
 	I use computers with Linux and say "Why Windows?"
 		(Thanks JFK, for the insight.)
From hvdkooij at vanderkooij.org  Wed May  2 23:50:37 2007
From: hvdkooij at vanderkooij.org (Hugo van der Kooij)
Date: Wed May  2 23:51:06 2007
Subject: RPM for milter-null?
In-Reply-To: <4638E4B1.30809@pacific.net>
References: <3BF93070B3D1B047BA7ABF612958950D018FB9D6@hcex.hartwellcorp.com>
	<4638E4B1.30809@pacific.net>
Message-ID: <Pine.LNX.4.64.0705030048050.21226@faramir.hugo.vanderkooij.org>

On Wed, 2 May 2007, Ken A wrote:

> Michael St. Laurent wrote:
>>  Does anyone know of an RPM or SRPM for the milter-null package?
>
> It gets compiled against libsnert (on which you only do 'make', not 'make 
> install') in com/snert/lib source tree, so there's no rpm. Just use the 
> source for both from snertsoft.com. Both are free.

While it may suite some I found this a rather startling way in the onld 
sendmail days. It is among other things the reasons I abonded it.

Being burnt too much with these package and do-it-yourself combinations I 
put in some effort to get a package supported into a repository to spare 
me the pain in the future.

Hugo.

-- 
 	hvdkooij@vanderkooij.org	http://hugo.vanderkooij.org/
 	    This message is using 100% recycled electrons.

 	Some men see computers as they are and say "Windows"
 	I use computers with Linux and say "Why Windows?"
 		(Thanks JFK, for the insight.)
From ryanw at falsehope.com  Thu May  3 00:13:48 2007
From: ryanw at falsehope.com (Ryan Weaver)
Date: Thu May  3 00:15:27 2007
Subject: RPM for milter-null?
In-Reply-To: <Pine.LNX.4.64.0705030048050.21226@faramir.hugo.vanderkooij.org>
References: <3BF93070B3D1B047BA7ABF612958950D018FB9D6@hcex.hartwellcorp.com>	<4638E4B1.30809@pacific.net>
	<Pine.LNX.4.64.0705030048050.21226@faramir.hugo.vanderkooij.org>
Message-ID: <002a01c78d0f$9616f020$c244d060$@com>

In the archives of the list you will see that I got smacked down for simply
providing a .spec for the building of a snertsoft program... However... if
needed, contacting me offlist... 

Thanks,
Ryan


-----Original Message-----
From: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Hugo van
der Kooij
Sent: Wednesday, May 02, 2007 5:51 PM
To: MailScanner discussion
Subject: Re: RPM for milter-null?

On Wed, 2 May 2007, Ken A wrote:

> Michael St. Laurent wrote:
>>  Does anyone know of an RPM or SRPM for the milter-null package?
>
> It gets compiled against libsnert (on which you only do 'make', not 'make 
> install') in com/snert/lib source tree, so there's no rpm. Just use the 
> source for both from snertsoft.com. Both are free.

While it may suite some I found this a rather startling way in the onld 
sendmail days. It is among other things the reasons I abonded it.

Being burnt too much with these package and do-it-yourself combinations I 
put in some effort to get a package supported into a repository to spare 
me the pain in the future.

Hugo.

-- 
 	hvdkooij@vanderkooij.org	http://hugo.vanderkooij.org/
 	    This message is using 100% recycled electrons.

 	Some men see computers as they are and say "Windows"
 	I use computers with Linux and say "Why Windows?"
 		(Thanks JFK, for the insight.)
-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 

From ajs at vifilfell.is  Thu May  3 00:28:11 2007
From: ajs at vifilfell.is (ajs@vifilfell.is)
Date: Thu May  3 00:30:45 2007
Subject: No Programs allowed
In-Reply-To: <f1ak39$1hm$3@sea.gmane.org>
Message-ID: <OF82176173.0985E5A4-ON002572CF.007EFE87-002572CF.008119A9@vifilfell.is>

thanks for the tip. so far I've only seen the option to select between 
html and plain text for all internet mail, but I'll check it out.





Scott Silva <ssilva@sgvwater.com> 
Sent by: mailscanner-bounces@lists.mailscanner.info
02.05.2007 18:08
Please respond to
MailScanner discussion <mailscanner@lists.mailscanner.info>


To
mailscanner@lists.mailscanner.info
cc

Subject
Re: No Programs allowed








ajs@vifilfell.is spake the following on 5/2/2007 8:00 AM:
> this is the case, Jon has tried the solution I pm-ed him and it works.
> 
> I use Lotus for email and sometimes forget to switch to plain text when 
> sending email to mailing list, will try to remember it next time.
> 
> cheers, asgeir,
The last time I used Notes, you could set certain addresses to only get 
text
mail. But that was a long time ago.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 


From ssilva at sgvwater.com  Thu May  3 00:48:44 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Thu May  3 00:48:59 2007
Subject: No Programs allowed
In-Reply-To: <OF82176173.0985E5A4-ON002572CF.007EFE87-002572CF.008119A9@vifilfell.is>
References: <f1ak39$1hm$3@sea.gmane.org>
	<OF82176173.0985E5A4-ON002572CF.007EFE87-002572CF.008119A9@vifilfell.is>
Message-ID: <f1b80s$mth$1@sea.gmane.org>

ajs@vifilfell.is spake the following on 5/2/2007 4:28 PM:
> thanks for the tip. so far I've only seen the option to select between 
> html and plain text for all internet mail, but I'll check it out.
> 
As I said, it was a long time ago. It might have been in the attributes for
the address. Or I might just be mistaken, and probably had everything as text
only. That is how long ago it was. Probably Notes 4.1 or so. I think I still
have the box somewhere.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From res at ausics.net  Thu May  3 00:52:43 2007
From: res at ausics.net (Res)
Date: Thu May  3 00:52:54 2007
Subject: RPM for milter-null?
In-Reply-To: <002a01c78d0f$9616f020$c244d060$@com>
References: <3BF93070B3D1B047BA7ABF612958950D018FB9D6@hcex.hartwellcorp.com>
	<4638E4B1.30809@pacific.net>
	<Pine.LNX.4.64.0705030048050.21226@faramir.hugo.vanderkooij.org>
	<002a01c78d0f$9616f020$c244d060$@com>
Message-ID: <Pine.LNX.4.64.0705030947540.22914@ebfjryy.nhfvpf.arg>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, 2 May 2007, Ryan Weaver wrote:

> In the archives of the list you will see that I got smacked down for simply
> providing a .spec for the building of a snertsoft program... However... if
> needed, contacting me offlist...

Thats strange, most people who provide packages they dont charge for, are 
greatful of the provision of many different types of distributions, as it 
permits their software to be reached by those who otherwise would not 
touch it, or even be aware of it, be it for policy, or because of the 
desire to stick to RPM, like debian folk rather stick with DEB than sue 
sources.

Their loss Ryan, you have provided many others for long time, and it's 
been welcomed and received by not only software programers, but the 
users, keep up the great work.


- -- 

Cheers
Res

Vote for your favourite MTA at  http://polls.ausics.net/v3.php
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGOSRNsWhAmSIQh7MRAo45AJ9nF8WFlaGlNnDbpfX4DwVjszHHrACgoH3R
zlikQHYQZO06N/LsfgRNpTQ=
=kwli
-----END PGP SIGNATURE-----
From a.peacock at chime.ucl.ac.uk  Thu May  3 09:09:00 2007
From: a.peacock at chime.ucl.ac.uk (Anthony Peacock)
Date: Thu May  3 09:09:37 2007
Subject: A lot of spam getting through
In-Reply-To: <04D932B0071FE34FA63EBB1977B48D150281747A@woodenex.woodmaclaw.local>
References: <04D932B0071FE34FA63EBB1977B48D150281747A@woodenex.woodmaclaw.local>
Message-ID: <4639989C.9040204@chime.ucl.ac.uk>

Billy A. Pumphrey wrote:
>> -----Original Message-----
>> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
>> bounces@lists.mailscanner.info] On Behalf Of Anthony Peacock
>> Sent: Wednesday, May 02, 2007 4:53 AM
>> To: MailScanner discussion
>> Subject: Re: A lot of spam getting through
>> So, help us out and show us the scores and headers from one that does
>> get through.  We might be able to see where they are failing then.
>>
>> Even better...  Save one of the misdiagnosed emails as a text file,
> post
>> it to a web address and let us know.  We can then run that email
> through
>> our systems and tell you what scores we get and what rules helped.
>>
> 
> I am having trouble getting the testing to work, or knowing how to test
> it.  I have saved some messages from Oulook with the extension of .msg.
> When I run a spamassassin -t message.msg it returns a bunch of junk and
> then the score:
> 
> Content analysis details:   (51.5 points, 5.0 required)
> 
>  pts rule name              description
> ---- ----------------------
> --------------------------------------------------
> -0.0 NO_RELAYS              Informational: message was not relayed via
> SMTP
>  2.5 MISSING_HB_SEP         Missing blank line between message header
> and body
>  2.3 MANGLED_DOSE           BODY: mangled dose
>  2.3 MANGLED_OFF            BODY: mangled off
>  2.3 MANGLED_YOUR           BODY: mangled your
>  2.3 MANGLED_FORM           BODY: mangled form
>  2.3 MANGLED_HERE           BODY: mangled here
>  2.3 MANGLED_HALF           BODY: mangled half
>  2.3 MANGLED_TIME           BODY: mangled time
>  2.3 MANGLED_MEDS           BODY: mangled med(s)
>  2.3 MANGLED_GIRL           BODY: mangled girl(s)
>  2.3 MANGLED_FROM           BODY: mangled from
>  2.3 MANGLED_LOVE           BODY: mangled love
>  2.3 MANGLED_TEXT           BODY: mangled text
>  2.3 MANGLED_LOOK           BODY: mangled look(s)
>  2.3 MANGLED_SPAM           BODY: mangled spam
>  2.3 MANGLED_PRIOR          BODY: mangled prior
>  2.3 MANGLED_PLEASE         BODY: mangled please
>  2.3 MANGLED_TRNFER         BODY: mangled TRANSFER
>  2.3 MANGLED_TOOL           BODY: mangled tool
>  3.5 BAYES_99               BODY: Bayesian spam probability is 99 to
> 100%
>                             [score: 1.0000]
>  2.2 NULL_IN_BODY           FULL: Message has NUL (ASCII 0) byte in
> message
>  1.8 MISSING_SUBJECT        Missing Subject: header
>  0.0 UPPERCASE_25_50        message body is 25-50% uppercase
>  0.1 TO_CC_NONE             No To: or Cc: header
> -0.0 NO_RECEIVED            Informational: message has no Received
> headers
> 
> (then some more junk)
> [root@WoodenMS2 spamemail]#
> PuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPu
> TTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTT
> YPuTTYPuTTYPuTTYPuTTYPuTTYTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPu
> 
> 
> Does the testing support .msg files?  Also what is the best way to
> convert the email to text and have it correct?

I think the msg file format is an Outlook specific file format.  You 
need to find a way to save the messages as plain text files with all the 
headers intact.

-- 
Anthony Peacock
CHIME, Royal Free & University College Medical School
WWW:    http://www.chime.ucl.ac.uk/~rmhiajp/
"If you have an apple and I have  an apple and we  exchange apples
then you and I will still each have  one apple. But  if you have an
idea and I have an idea and we exchange these ideas, then each of us
will have two ideas." -- George Bernard Shaw
From prandal at herefordshire.gov.uk  Thu May  3 10:47:22 2007
From: prandal at herefordshire.gov.uk (Randal, Phil)
Date: Thu May  3 11:16:20 2007
Subject: SpamAssassin 3.2.0
In-Reply-To: <463900B1.8080301@ecs.soton.ac.uk>
References: <463900B1.8080301@ecs.soton.ac.uk>
Message-ID: <7EF0EE5CB3B263488C8C18823239BEBA9223AF@HC-MBX02.herefordshire.gov.uk>

Thanks for that, Jules.

Basically, what I did was install spamassassin 3.2.0 using your
installer and then used CPAN to install Mail::DKIM and Mail::SPF (and a
host of dependencies).

One thing I found was problems with DNS resolution after installing
Mail::SPF from CPAN (all URIBLs failed).

I think it's to do with Net::DNS and Net::DNS::Resolver::Programmable,
and is probably an issue (reported on the spamassassin-users mailing
list) to do with Mail::SPF-2.004 and
Net::DNS::Resolver::Programmable-2.002.  Mail::SPF-2.005 is due
imminently to fix this.

In the end to get it to work I had to uninstall any old perl-Net-DNS
RPMs and any dependencies, and then force install both
Net::DNS::Resolver::Programmable and Net::DNS.

It wasn't easy and I'm still not entirely sure of the magical
incantations which made it work.

All this on CentOS 4.4 and an ancient Fedora Core 1 box.

sa-compile works fine after downloading re2c-0.12.0-1.src.rpm
sourceforge.net/projects/re2c and rpmbuilding it.

Any rules_du_jour scripts and /etc/cron.daily/sa-update will need
updating to do a sa-compile if you use it.

Cheers,

Phil

--
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK  

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info 
> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf 
> Of Julian Field
> Sent: 02 May 2007 22:21
> To: MailScanner discussion
> Subject: SpamAssassin 3.2.0
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Well, as someone else has already said, it's been released.
> 
> Its list of requirements has grown quite a lot. In addition 
> to whatever 
> else you already have from an existing SA install, you need 
> to install 
> this load of Perl modules, in this order:
> 
>       YAML -- requires y\n in perl Makefile.PL
>       ExtUtils::CBuilder
>       ExtUtils::ParseXS
>     Module::Build
>       version
>     Net::DNS::Resolver::Programmable
>     Error
>     NetAddr::IP
>     Net::DNS >=0.58
>     Data::Dump
>   Encode::Detect
>   Mail::SPF
> Mail::SpamAssassin -- requires \n in perl Makefile.PL
> 
> It puts in a v320.pre into /etc/mail/spamassassin and comes 
> with a load 
> of new plugins. Some of them are loaded by the default 
> supplied v320.pre 
> file, but here are the ones that aren't:
> 
>                           Hashcash.pm             Rule2XSBody.pm
> ASN.pm                                            SpamCop.pm
> AutoLearnThreshold.pm                             SPF.pm
> AWL.pm                                            Test.pm
>                                                   TextCat.pm
>                           MIMEHeader.pm          
> BodyRuleBaseExtractor.pm  OneLineBodyRuleType.pm  URIDNSBL.pm
>                           Pyzor.pm              
> DCC.pm                    Razor2.pm              
>                           RelayCountry.pm         WhiteListSubject.pm
>                           ReplaceTags.pm
> 
> My next step is to read the man pages for all of these, and work out 
> which ones you probably want to load and which ones you 
> don't, so that 
> my install script can set you up with a sensible system. One 
> thing I'm 
> not installing is support for DKIM which, although available, 
> requires 
> so many pre-requisites that it's not feasible for me to do here. You 
> have to start at the OpenSSL libraries and work your way up :-(
> 
> Once I've got something working here, I'll write up an install script 
> for it all and wrap it into a package for you.
> 
> Jules
> 
> - -- 
> Julian Field MEng CITP
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> 
> MailScanner customisation, or any advanced system administration help?
> Contact me at Jules@Jules.FM
> 
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> For all your IT requirements visit www.transtec.co.uk
> 
> 
> 
> -----BEGIN PGP SIGNATURE-----
> Version: PGP Desktop 9.6.1 (Build 1012)
> Charset: ISO-8859-1
> 
> wj8DBQFGOQEwEfZZRxQVtlQRArCWAJ95n3Z0uHjg/25LaIHPFUauWsZ+vACfYdtP
> qjZF/RoldGlTZywtz3b9U/8=
> =yA8+
> -----END PGP SIGNATURE-----
> 
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> For all your IT requirements visit www.transtec.co.uk
> 
> -- 
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website! 
> 
From declan.grady at nuvotem.com  Thu May  3 12:15:26 2007
From: declan.grady at nuvotem.com (Declan Grady)
Date: Thu May  3 12:16:43 2007
Subject: Very newbie relaying question
Message-ID: <1DF321991CD3084EAD65737D82C6D07E145A86@sbs1.nuvotem.local>

Hi folks,
I've just rebuilt my mailscanner+sendmail box using debian etch, and
after a lot of head-scratching got it up & running ok.
(Old box suffered hardware failure, was a redhat 7 with a lot of patches
& updates, etc, but was handy for upgrading mailscanner from rpms.)

While watching the spam messages, I've noticed quite a few supposedly
coming from my own domain name.

I'm 99% sure I can restrict it so that if the sender is supposed to be
in my own domain, it must be from a local IP address, otherwise reject
it.

I have googled, but get lost in all the authentication stuff.

My mailscanner box is a gateway - just takes incoming mail, scans &
passes on to a windows exchange box, using a sendmail mailertable.

What do I need to do to my sendmail config to permit mail from my domain
to be only accepted from internal IP's ?

I'm guessing I need to change my /etc/mail/access file somehow ?
Currently it has (among other things)

mydomain.com             RELAY
localhost.mydomain.com   RELAY
mail.mydomain.com        RELAY
mailserver.mydomain.com  RELAY
mydomain.ie              RELAY
exchange_server_name     RELAY

Obviously some of these are not necessary, and are from my tweaking it
trying to get it working. 

Or, is there some clever way to do it.


Thinking out loud, all mail from mydomain will come from the exchange
server, which has a single fixed IP address - Mabye that is a way to do
it ?

Thanks for suggestions.
From cleveland at winnefox.org  Thu May  3 12:52:59 2007
From: cleveland at winnefox.org (Jody Cleveland)
Date: Thu May  3 12:53:06 2007
Subject: MailScanner no longer scanning mail
Message-ID: <C25F374B.32A0%cleveland@winnefox.org>

Hello,

I updated to the latest version of MailScanner on my redhat 5.0 enterprise
server, and it's not working properly.

Mail is coming into the server, I can see 1500 messages in the postfix
queue. But, they just sit there. I'm not seeing any error messages in the
maillog. But, it does appear that MS restarts every 5 seconds.

Any ideas what may be wrong?

- jody

From raymond at prolocation.net  Thu May  3 12:56:56 2007
From: raymond at prolocation.net (Raymond Dijkxhoorn)
Date: Thu May  3 12:56:56 2007
Subject: MailScanner no longer scanning mail
In-Reply-To: <C25F374B.32A0%cleveland@winnefox.org>
References: <C25F374B.32A0%cleveland@winnefox.org>
Message-ID: <Pine.LNX.4.64.0705031356110.2935@control.prolocation.net>

Hi!

> I updated to the latest version of MailScanner on my redhat 5.0 enterprise
> server, and it's not working properly.
>
> Mail is coming into the server, I can see 1500 messages in the postfix
> queue. But, they just sit there. I'm not seeing any error messages in the
> maillog. But, it does appear that MS restarts every 5 seconds.
>
> Any ideas what may be wrong?

Default answer... : change to debug mode and see what it outputs.

Bye,
Raymond.
From cleveland at winnefox.org  Thu May  3 13:16:43 2007
From: cleveland at winnefox.org (Jody Cleveland)
Date: Thu May  3 13:16:49 2007
Subject: MailScanner no longer scanning mail
In-Reply-To: <Pine.LNX.4.64.0705031356110.2935@control.prolocation.net>
Message-ID: <C25F3CDB.32A5%cleveland@winnefox.org>

Hello,

> Default answer... : change to debug mode and see what it outputs.

Ok, I switched to debug mode, and this is what I get:

[root@destiny MailScanner]# service MailScanner start
Starting MailScanner daemons:
         incoming postfix:                                 [  OK  ]
         outgoing postfix:                                 [  OK  ]
         MailScanner:       In Debugging mode, not forking...


And it just sits there. I sent a few messages to it, but after 10 minutes it
still just sat there. So, I ctrl-z'd to get out of it and looked at the
maillog. This is what it said:

May  3 07:09:17 destiny postfix/postfix-script: starting the Postfix mail
system
May  3 07:09:17 destiny postfix/master[5525]: daemon started -- version
2.3.3, configuration /etc/postfix
May  3 07:09:17 destiny postfix/qmgr[5535]: warning: bounce_queue_lifetime
is larger than maximal_queue_lifetime - adjusting bounce_queue_lifetime
May  3 07:09:19 destiny MailScanner[5543]: MailScanner E-Mail Virus Scanner
version 4.59.4 starting...
May  3 07:09:19 destiny MailScanner[5543]: Read 778 hostnames from the
phishing whitelist 
May  3 07:09:19 destiny MailScanner[5543]: Config: calling custom init
function SQLBlacklist
May  3 07:09:19 destiny MailScanner[5543]: Starting up SQL Blacklist
May  3 07:09:19 destiny MailScanner[5543]: Read 29 blacklist entries
May  3 07:09:19 destiny MailScanner[5543]: Config: calling custom init
function MailWatchLogging
May  3 07:09:19 destiny MailScanner[5543]: Started SQL Logging child
May  3 07:09:19 destiny MailScanner[5543]: Config: calling custom init
function SQLWhitelist
May  3 07:09:19 destiny MailScanner[5543]: Starting up SQL Whitelist
May  3 07:09:19 destiny MailScanner[5543]: Read 59 whitelist entries
May  3 07:09:19 destiny MailScanner[5543]: Using SpamAssassin results cache
May  3 07:09:19 destiny MailScanner[5543]: Connected to SpamAssassin cache
database 
May  3 07:09:19 destiny MailScanner[5543]: Enabling SpamAssassin
auto-whitelist functionality...
May  3 07:09:22 destiny MailScanner[5543]: lock.pl sees Config  LockType =
flock 
May  3 07:09:22 destiny MailScanner[5543]: lock.pl sees have_module =  0
May  3 07:09:22 destiny MailScanner[5543]: Using locktype = flock
May  3 07:09:22 destiny MailScanner[5543]: New Batch: Found 1420 messages
waiting 
May  3 07:09:22 destiny MailScanner[5543]: New Batch: Scanning 30 messages,
151181 bytes 
May  3 07:09:22 destiny MailScanner[5543]: Created attachment dirs for 30
messages 
May  3 07:09:43 destiny MailScanner[5543]: RBL Checks: returned 0
May  3 07:09:43 destiny MailScanner[5543]: SpamAssassin cache hit for
message D20223E425E.0C4FB
May  3 07:09:48 destiny postfix/smtpd[5556]: connect from
unknown[203.188.225.208]
May  3 07:09:50 destiny postfix/smtpd[5556]: 435F83E4380:
client=unknown[203.188.225.208]
May  3 07:09:50 destiny postfix/smtpd[5554]: connect from
static-66-16-148-219.dsl.cavtel.net[66.16.148.219]
May  3 07:09:50 destiny postfix/smtpd[5554]: E7C293E4382:
client=static-66-16-148-219.dsl.cavtel.net[66.16.148.219]
May  3 07:09:51 destiny postfix/cleanup[5571]: E7C293E4382: hold: header
Received: from static-66-16-148-219.dsl.cavtel.net
(static-66-16-148-219.dsl.cavtel.net [66.16.148.219])??by
destiny.winnefox.org (Postfix) with SMTP id E7C293E4382??for
<jackisch@oshkoshpubliclibrary from
static-66-16-148-219.dsl.cavtel.net[66.16.148.219];
from=<cservice.refS89652695WO.cm@bbt.com>
to=<jackisch@oshkoshpubliclibrary.org> proto=SMTP
helo=<static-66-16-148-219.dsl.cavtel.net>
May  3 07:09:51 destiny postfix/cleanup[5571]: E7C293E4382:
message-id=<20070503120950.E7C293E4382@destiny.winnefox.org>
May  3 07:09:51 destiny postfix/smtpd[5554]: disconnect from
static-66-16-148-219.dsl.cavtel.net[66.16.148.219]

Is that helpful at all?

- jody

From ms-list at alexb.ch  Thu May  3 13:39:06 2007
From: ms-list at alexb.ch (Alex Broens)
Date: Thu May  3 13:39:14 2007
Subject: MailScanner no longer scanning mail
In-Reply-To: <C25F3CDB.32A5%cleveland@winnefox.org>
References: <C25F3CDB.32A5%cleveland@winnefox.org>
Message-ID: <4639D7EA.6090504@alexb.ch>

On 5/3/2007 2:16 PM, Jody Cleveland wrote:
> Hello,
> 
>> Default answer... : change to debug mode and see what it outputs.
> 
> Ok, I switched to debug mode, and this is what I get:
> 
> [root@destiny MailScanner]# service MailScanner start
> Starting MailScanner daemons:
>          incoming postfix:                                 [  OK  ]
>          outgoing postfix:                                 [  OK  ]
>          MailScanner:       In Debugging mode, not forking...
> 
> 
> And it just sits there. I sent a few messages to it, but after 10 minutes it
> still just sat there. So, I ctrl-z'd to get out of it and looked at the
> maillog. This is what it said:
> 
> May  3 07:09:17 destiny postfix/postfix-script: starting the Postfix mail
> system
> May  3 07:09:17 destiny postfix/master[5525]: daemon started -- version
> 2.3.3, configuration /etc/postfix
> May  3 07:09:17 destiny postfix/qmgr[5535]: warning: bounce_queue_lifetime
> is larger than maximal_queue_lifetime - adjusting bounce_queue_lifetime

fix that and I'd bet it will work

Alex


From cleveland at winnefox.org  Thu May  3 14:14:34 2007
From: cleveland at winnefox.org (Jody Cleveland)
Date: Thu May  3 14:14:40 2007
Subject: MailScanner no longer scanning mail
In-Reply-To: <4639D7EA.6090504@alexb.ch>
Message-ID: <C25F4A6A.32AF%cleveland@winnefox.org>




On 5/3/07 7:39 AM, "Alex Broens" <ms-list@alexb.ch> wrote:

>> May  3 07:09:17 destiny postfix/postfix-script: starting the Postfix mail
>> system
>> May  3 07:09:17 destiny postfix/master[5525]: daemon started -- version
>> 2.3.3, configuration /etc/postfix
>> May  3 07:09:17 destiny postfix/qmgr[5535]: warning: bounce_queue_lifetime
>> is larger than maximal_queue_lifetime - adjusting bounce_queue_lifetime
> 
> fix that and I'd bet it will work

Ok, I fixed that. If I tail the maillog, I can see mail come in and get
processed. But, the queue just keeps filling, and nothing actually gets
delivered.

- jody

From ms-list at alexb.ch  Thu May  3 14:31:31 2007
From: ms-list at alexb.ch (Alex Broens)
Date: Thu May  3 14:31:41 2007
Subject: MailScanner no longer scanning mail
In-Reply-To: <C25F4A6A.32AF%cleveland@winnefox.org>
References: <C25F4A6A.32AF%cleveland@winnefox.org>
Message-ID: <4639E433.4020100@alexb.ch>

On 5/3/2007 3:14 PM, Jody Cleveland wrote:
> 
> 
> On 5/3/07 7:39 AM, "Alex Broens" <ms-list@alexb.ch> wrote:
> 
>>> May  3 07:09:17 destiny postfix/postfix-script: starting the Postfix mail
>>> system
>>> May  3 07:09:17 destiny postfix/master[5525]: daemon started -- version
>>> 2.3.3, configuration /etc/postfix
>>> May  3 07:09:17 destiny postfix/qmgr[5535]: warning: bounce_queue_lifetime
>>> is larger than maximal_queue_lifetime - adjusting bounce_queue_lifetime
>> fix that and I'd bet it will work
> 
> Ok, I fixed that. If I tail the maillog, I can see mail come in and get
> processed. But, the queue just keeps filling, and nothing actually gets
> delivered.

assuming postfixis correctly configured for postfix (permsisions 
wise)hot in the dark:


From ms-list at alexb.ch  Thu May  3 14:36:00 2007
From: ms-list at alexb.ch (Alex Broens)
Date: Thu May  3 14:36:04 2007
Subject: MailScanner no longer scanning mail
In-Reply-To: <C25F4A6A.32AF%cleveland@winnefox.org>
References: <C25F4A6A.32AF%cleveland@winnefox.org>
Message-ID: <4639E540.9070004@alexb.ch>

On 5/3/2007 3:14 PM, Jody Cleveland wrote:
> 
> 
> On 5/3/07 7:39 AM, "Alex Broens" <ms-list@alexb.ch> wrote:
> 
>>> May  3 07:09:17 destiny postfix/postfix-script: starting the Postfix mail
>>> system
>>> May  3 07:09:17 destiny postfix/master[5525]: daemon started -- version
>>> 2.3.3, configuration /etc/postfix
>>> May  3 07:09:17 destiny postfix/qmgr[5535]: warning: bounce_queue_lifetime
>>> is larger than maximal_queue_lifetime - adjusting bounce_queue_lifetime
>> fix that and I'd bet it will work
> 
> Ok, I fixed that. If I tail the maillog, I can see mail come in and get
> processed. But, the queue just keeps filling, and nothing actually gets
> delivered.

Opps - pressed wrong key - sent too fast!

assuming postfix is correctly configured for MailScanner - queue path & 
permissions

shot in the dark:

try setting:

MailScanner.conf

# 5 for only one CPU
Max Children = 10

# set to 10 if you have only one CPU
Queue Scan Interval = 13

Max Unscanned Bytes Per Scan = 100m
Max Unsafe Bytes Per Scan = 50m
Max Unscanned Messages Per Scan = 5
Max Unsafe Messages Per Scan = 5


Alex




From steinkel at pa.net  Thu May  3 15:06:54 2007
From: steinkel at pa.net (Leland J. Steinke)
Date: Thu May  3 15:08:12 2007
Subject: MailScanner no longer scanning mail
In-Reply-To: <4639E540.9070004@alexb.ch>
References: <C25F4A6A.32AF%cleveland@winnefox.org> <4639E540.9070004@alexb.ch>
Message-ID: <4639EC7E.5060108@pa.net>

Another thing to try would be to kill the MailScanner processes running 
in the background and do "check_mailscanner" at the command line, so as 
to see all the helpful debug messages that will go whizzing by.


Leland
From support-lists at petdoctors.co.uk  Thu May  3 15:04:58 2007
From: support-lists at petdoctors.co.uk (Nigel Kendrick)
Date: Thu May  3 15:13:08 2007
Subject: A lot of spam getting through
In-Reply-To: <4639989C.9040204@chime.ucl.ac.uk>
Message-ID: <015701c78d8c$0893a4a0$0202fea9@support01>

 
-----Original Message-----
From: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Anthony
Peacock
Sent: Thursday, May 03, 2007 9:09 AM
To: MailScanner discussion
Subject: Re: A lot of spam getting through
> 
> Does the testing support .msg files?  Also what is the best way to
> convert the email to text and have it correct?

I think the msg file format is an Outlook specific file format.  You 
need to find a way to save the messages as plain text files with all the 
headers intact.




Our corporate standard is Outlook, but if I want to check a message, I
forward it to my 'spam@...' account and then pick it up in Thunderbird. Life
gets easier then!


From cleveland at winnefox.org  Thu May  3 15:23:16 2007
From: cleveland at winnefox.org (Jody Cleveland)
Date: Thu May  3 15:23:18 2007
Subject: MailScanner no longer scanning mail
In-Reply-To: <4639EC7E.5060108@pa.net>
Message-ID: <C25F5A84.32C0%cleveland@winnefox.org>


On 5/3/07 9:06 AM, "Leland J. Steinke" <steinkel@pa.net> wrote:

> Another thing to try would be to kill the MailScanner processes running
> in the background and do "check_mailscanner" at the command line, so as
> to see all the helpful debug messages that will go whizzing by.

That gave me this:

[root@destiny ~]# check_mailscanner
Starting MailScanner... Done.

- jody

From adrian at senn.ch  Thu May  3 15:37:58 2007
From: adrian at senn.ch (Adrian Senn)
Date: Thu May  3 15:38:02 2007
Subject: Postfix analyzer to blocking ip addresses
Message-ID: <4639F3C6.1070401@senn.ch>

Hello all

I'm searching a script which has the possibility to write some ip 
addresses, which are sending to much spam, into the postscript
reject files.

The actual spam run is breaking the greylisting and i see a lot of
log entries in the log from mailscanner.

It would be very nice if there is something around the world :-)

Regards Adrian
From cleveland at winnefox.org  Thu May  3 15:47:33 2007
From: cleveland at winnefox.org (Jody Cleveland)
Date: Thu May  3 15:47:36 2007
Subject: MailScanner no longer scanning mail
In-Reply-To: <4639E540.9070004@alexb.ch>
Message-ID: <C25F6035.32C6%cleveland@winnefox.org>


On 5/3/07 8:36 AM, "Alex Broens" <ms-list@alexb.ch> wrote:

> Opps - pressed wrong key - sent too fast!
> 
> assuming postfix is correctly configured for MailScanner - queue path &
> permissions
> 
> shot in the dark:
> 
> try setting:
> 
> MailScanner.conf
> 
> # 5 for only one CPU
> Max Children = 10
> 
> # set to 10 if you have only one CPU
> Queue Scan Interval = 13
> 
> Max Unscanned Bytes Per Scan = 100m
> Max Unsafe Bytes Per Scan = 50m
> Max Unscanned Messages Per Scan = 5
> Max Unsafe Messages Per Scan = 5

My, how the floodgates have opened!

That took care of it. And, now, MS is whittling away at the queue.

With that said, why would those changes fix it? Is there something with the
new version that changed something with that?

- jody

From mogens at fumlersoft.dk  Thu May  3 15:48:14 2007
From: mogens at fumlersoft.dk (Mogens Melander)
Date: Thu May  3 15:48:56 2007
Subject: Postfix analyzer to blocking ip addresses
In-Reply-To: <4639F3C6.1070401@senn.ch>
References: <4639F3C6.1070401@senn.ch>
Message-ID: <2928.90.184.17.152.1178203694.squirrel@mail.fumlersoft.dk>


On Thu, May 3, 2007 16:37, Adrian Senn wrote:
> Hello all
>
> I'm searching a script which has the possibility to write some ip
> addresses, which are sending to much spam, into the postscript
> reject files.
>
> The actual spam run is breaking the greylisting and i see a lot of
> log entries in the log from mailscanner.
>
> It would be very nice if there is something around the world :-)
>
> Regards Adrian

Well, i'm having a lot of fun getting sshblack daemon to block
all kinds of unwanted trafic. I'm shure it can be modified to
do exactly what you want. Have a look at:

http://www.pettingers.org/code/sshblack.html


-- 
Later

Mogens Melander
+45 40 85 71 38
+66 870 133 224



-- 
This message has been scanned for viruses and
dangerous content by OpenProtect(http://www.openprotect.com), and is
believed to be clean.

From MailScanner at ecs.soton.ac.uk  Thu May  3 16:01:09 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Thu May  3 16:06:36 2007
Subject: A lot of spam getting through
In-Reply-To: <015701c78d8c$0893a4a0$0202fea9@support01>
References: <015701c78d8c$0893a4a0$0202fea9@support01>
Message-ID: <4639F935.6080800@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Nigel Kendrick wrote:
>  
> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info
> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Anthony
> Peacock
> Sent: Thursday, May 03, 2007 9:09 AM
> To: MailScanner discussion
> Subject: Re: A lot of spam getting through
>   
>> Does the testing support .msg files?  Also what is the best way to
>> convert the email to text and have it correct?
>>     
>
> I think the msg file format is an Outlook specific file format.  You 
> need to find a way to save the messages as plain text files with all the 
> headers intact.
>   
In Outlook, in the View menu, there is a View Options... option (at the 
bottom I think?). In there you can view the "Internet Source" of the 
message which is the raw text of the message including all headers. You 
can copy to the clipboard from there.

I think that's where it is :-)

>
>
>
> Our corporate standard is Outlook, but if I want to check a message, I
> forward it to my 'spam@...' account and then pick it up in Thunderbird. Life
> gets easier then!
>
>
>   

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGOfpdEfZZRxQVtlQRAjohAKD7hcbgDL29JdfgMMzp5j2SogFtagCfa8J1
eCDKxPslWB2lOUrioqjzO1E=
=izJC
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From ms-list at alexb.ch  Thu May  3 16:07:11 2007
From: ms-list at alexb.ch (Alex Broens)
Date: Thu May  3 16:07:19 2007
Subject: MailScanner no longer scanning mail
In-Reply-To: <C25F6035.32C6%cleveland@winnefox.org>
References: <C25F6035.32C6%cleveland@winnefox.org>
Message-ID: <4639FA9F.6000808@alexb.ch>

On 5/3/2007 4:47 PM, Jody Cleveland wrote:
> On 5/3/07 8:36 AM, "Alex Broens" <ms-list@alexb.ch> wrote:
> 
>> Opps - pressed wrong key - sent too fast!
>>
>> assuming postfix is correctly configured for MailScanner - queue path &
>> permissions
>>
>> shot in the dark:
>>
>> try setting:
>>
>> MailScanner.conf
>>
>> # 5 for only one CPU
>> Max Children = 10
>>
>> # set to 10 if you have only one CPU
>> Queue Scan Interval = 13
>>
>> Max Unscanned Bytes Per Scan = 100m
>> Max Unsafe Bytes Per Scan = 50m
>> Max Unscanned Messages Per Scan = 5
>> Max Unsafe Messages Per Scan = 5
> 
> My, how the floodgates have opened!
> 
> That took care of it. And, now, MS is whittling away at the queue.
> 
> With that said, why would those changes fix it? Is there something with the
> new version that changed something with that?

glad to hear your MS is purring again

afaik, it comes to a point that if MS' threads doesn't get enough air 
between checking for msgs to process, they race to catch the same msg, 
and msgs get processed over and over again, till a msg has been 
processed a few hundred times and then finally delivered to the MTA.

I've seen this happen with older versions, under a default config, as 
well so I don't think it has anything to do with th MS version - more a 
configuration/tuning thing.

You'll need to play around with the threads and msgs per scan settings 
till you get the right balance for your hardware/traffic/bandwidth 
requirements.



Alex


From MailScanner at ecs.soton.ac.uk  Thu May  3 16:06:11 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Thu May  3 16:12:34 2007
Subject: MailScanner no longer scanning mail
In-Reply-To: <C25F3CDB.32A5%cleveland@winnefox.org>
References: <C25F3CDB.32A5%cleveland@winnefox.org>
Message-ID: <4639FA63.5000505@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Jody Cleveland wrote:
> Hello,
>
>   
>> Default answer... : change to debug mode and see what it outputs.
>>     
>
> Ok, I switched to debug mode, and this is what I get:
>
> [root@destiny MailScanner]# service MailScanner start
> Starting MailScanner daemons:
>          incoming postfix:                                 [  OK  ]
>          outgoing postfix:                                 [  OK  ]
>          MailScanner:       In Debugging mode, not forking...
>
>
> And it just sits there. I sent a few messages to it, but after 10 minutes it
> still just sat there. So, I ctrl-z'd to get out of it and looked at the
> maillog. This is what it said:
>
> May  3 07:09:17 destiny postfix/postfix-script: starting the Postfix mail
> system
> May  3 07:09:17 destiny postfix/master[5525]: daemon started -- version
> 2.3.3, configuration /etc/postfix
> May  3 07:09:17 destiny postfix/qmgr[5535]: warning: bounce_queue_lifetime
> is larger than maximal_queue_lifetime - adjusting bounce_queue_lifetime
> May  3 07:09:19 destiny MailScanner[5543]: MailScanner E-Mail Virus Scanner
> version 4.59.4 starting...
> May  3 07:09:19 destiny MailScanner[5543]: Read 778 hostnames from the
> phishing whitelist 
> May  3 07:09:19 destiny MailScanner[5543]: Config: calling custom init
> function SQLBlacklist
> May  3 07:09:19 destiny MailScanner[5543]: Starting up SQL Blacklist
> May  3 07:09:19 destiny MailScanner[5543]: Read 29 blacklist entries
> May  3 07:09:19 destiny MailScanner[5543]: Config: calling custom init
> function MailWatchLogging
> May  3 07:09:19 destiny MailScanner[5543]: Started SQL Logging child
> May  3 07:09:19 destiny MailScanner[5543]: Config: calling custom init
> function SQLWhitelist
> May  3 07:09:19 destiny MailScanner[5543]: Starting up SQL Whitelist
> May  3 07:09:19 destiny MailScanner[5543]: Read 59 whitelist entries
> May  3 07:09:19 destiny MailScanner[5543]: Using SpamAssassin results cache
> May  3 07:09:19 destiny MailScanner[5543]: Connected to SpamAssassin cache
> database 
> May  3 07:09:19 destiny MailScanner[5543]: Enabling SpamAssassin
> auto-whitelist functionality...
> May  3 07:09:22 destiny MailScanner[5543]: lock.pl sees Config  LockType =
> flock 
> May  3 07:09:22 destiny MailScanner[5543]: lock.pl sees have_module =  0
> May  3 07:09:22 destiny MailScanner[5543]: Using locktype = flock
> May  3 07:09:22 destiny MailScanner[5543]: New Batch: Found 1420 messages
> waiting 
> May  3 07:09:22 destiny MailScanner[5543]: New Batch: Scanning 30 messages,
> 151181 bytes 
> May  3 07:09:22 destiny MailScanner[5543]: Created attachment dirs for 30
> messages 
> May  3 07:09:43 destiny MailScanner[5543]: RBL Checks: returned 0
> May  3 07:09:43 destiny MailScanner[5543]: SpamAssassin cache hit for
> message D20223E425E.0C4FB
> May  3 07:09:48 destiny postfix/smtpd[5556]: connect from
> unknown[203.188.225.208]
> May  3 07:09:50 destiny postfix/smtpd[5556]: 435F83E4380:
> client=unknown[203.188.225.208]
> May  3 07:09:50 destiny postfix/smtpd[5554]: connect from
> static-66-16-148-219.dsl.cavtel.net[66.16.148.219]
> May  3 07:09:50 destiny postfix/smtpd[5554]: E7C293E4382:
> client=static-66-16-148-219.dsl.cavtel.net[66.16.148.219]
> May  3 07:09:51 destiny postfix/cleanup[5571]: E7C293E4382: hold: header
> Received: from static-66-16-148-219.dsl.cavtel.net
> (static-66-16-148-219.dsl.cavtel.net [66.16.148.219])??by
> destiny.winnefox.org (Postfix) with SMTP id E7C293E4382??for
> <jackisch@oshkoshpubliclibrary from
> static-66-16-148-219.dsl.cavtel.net[66.16.148.219];
> from=<cservice.refS89652695WO.cm@bbt.com>
> to=<jackisch@oshkoshpubliclibrary.org> proto=SMTP
> helo=<static-66-16-148-219.dsl.cavtel.net>
> May  3 07:09:51 destiny postfix/cleanup[5571]: E7C293E4382:
> message-id=<20070503120950.E7C293E4382@destiny.winnefox.org>
> May  3 07:09:51 destiny postfix/smtpd[5554]: disconnect from
> static-66-16-148-219.dsl.cavtel.net[66.16.148.219]
>
> Is that helpful at all?
>   
Do
    service MailScanner stop
then wait a few seconds, then
    service MailScaner startin
and that should start incoming mail going into the queue that feeds 
MailScanner, without starting MailScanner itself at all. So then do
    MailScanner -debug
and see what it says. It will sit and wait until it has at least 1 
message to process, then it will process them completely, then 
gracefully die of old age.

Post the entire output of that command.

Then
    service MailScanner stop
again so the incoming queue doesn't keep building up.

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGOfuIEfZZRxQVtlQRAiCpAKDXOPT7WwMDyKHwAvnNyAEMsS/DdwCg0z/L
Zgkbp+dB9G++9uqTfaqLQ+8=
=IDs4
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From mailscanner at yeticomputers.com  Thu May  3 16:39:15 2007
From: mailscanner at yeticomputers.com (Rick Chadderdon)
Date: Thu May  3 16:32:34 2007
Subject: 32 bit distro or 64?
In-Reply-To: <463904BA.4040402@sendit.nodak.edu>
References: <FF689DC51C3C1640BE668A0E31182AD002D15B68@mail03.mira.co.uk>	<463900F6.1070103@yeticomputers.com>
	<463904BA.4040402@sendit.nodak.edu>
Message-ID: <463A0223.3000803@yeticomputers.com>

Richard Frovarp wrote:
> Couldn't you just run the 32bit versions of the virus scanners? We're
> not talking about full 64 bit like Itaniums or any other number of
> other processors out there. We're just talking about 64 bit extended
> OSs. I run plenty of 32bit applications on my 64bit OS without any
> problems. Of course I have the 32bit and 64bit versions of all the
> libraries installed to do this.
>
> Richard

Yes.  It is normally not a problem (although I would not say "never",
since I have had issues with some apps simply not working in a 64-bit
environment, 32-bit version or not) to run 32-bit apps.  However, I
don't really see the point of running a 64-bit OS if one is going to run
a bunch of 32-bit apps for "compatibility".  It's a personal call, of
course.  For mission critical apps, I prefer to run software than was
designed specifically to work properly in the environment I'm using. 
But...  I break that rule sometimes, so I guess I can't fault anyone
else for doing so.  :)

Still, it is much easier to get support from a vendor if you're using
their software the way that they intended.  I can already hear, "Oh, I'm
sorry, we don't support that product running on a 64-bit OS."  Even if
the problem you're having is not related to the OS at all.  Just
something to consider.

Rick
From carles at unlimitedmail.org  Thu May  3 17:12:20 2007
From: carles at unlimitedmail.org (Carles Xavier Munyoz =?iso-8859-1?q?Bald=F3?=)
Date: Thu May  3 17:12:38 2007
Subject: Very newbie relaying question
In-Reply-To: <1DF321991CD3084EAD65737D82C6D07E145A86@sbs1.nuvotem.local>
References: <1DF321991CD3084EAD65737D82C6D07E145A86@sbs1.nuvotem.local>
Message-ID: <200705031812.20616.carles@unlimitedmail.org>

Hi,
You need to setup SPF in your domain's DNS database.
More info in google ;-D

Greetings.


On Thursday 03 May 2007, Declan Grady wrote:
> Hi folks,
> I've just rebuilt my mailscanner+sendmail box using debian etch, and
> after a lot of head-scratching got it up & running ok.
> (Old box suffered hardware failure, was a redhat 7 with a lot of patches
> & updates, etc, but was handy for upgrading mailscanner from rpms.)
>
> While watching the spam messages, I've noticed quite a few supposedly
> coming from my own domain name.
>
> I'm 99% sure I can restrict it so that if the sender is supposed to be
> in my own domain, it must be from a local IP address, otherwise reject
> it.
>
> I have googled, but get lost in all the authentication stuff.
>
> My mailscanner box is a gateway - just takes incoming mail, scans &
> passes on to a windows exchange box, using a sendmail mailertable.
>
> What do I need to do to my sendmail config to permit mail from my domain
> to be only accepted from internal IP's ?
>
> I'm guessing I need to change my /etc/mail/access file somehow ?
> Currently it has (among other things)
>
> mydomain.com             RELAY
> localhost.mydomain.com   RELAY
> mail.mydomain.com        RELAY
> mailserver.mydomain.com  RELAY
> mydomain.ie              RELAY
> exchange_server_name     RELAY
>
> Obviously some of these are not necessary, and are from my tweaking it
> trying to get it working.
>
> Or, is there some clever way to do it.
>
>
> Thinking out loud, all mail from mydomain will come from the exchange
> server, which has a single fixed IP address - Mabye that is a way to do
> it ?
>
> Thanks for suggestions.



-- 
---
Carles Xavier Munyoz Bald?
cmunyoz@unlimitedmail.net
http://www.unlimitedmail.net/
---
From r.berber at computer.org  Thu May  3 18:19:01 2007
From: r.berber at computer.org (=?ISO-8859-1?Q?Ren=E9_Berber?=)
Date: Thu May  3 18:19:20 2007
Subject: Very newbie relaying question
In-Reply-To: <1DF321991CD3084EAD65737D82C6D07E145A86@sbs1.nuvotem.local>
References: <1DF321991CD3084EAD65737D82C6D07E145A86@sbs1.nuvotem.local>
Message-ID: <f1d5i3$mjg$1@sea.gmane.org>

Declan Grady wrote:

[snip]
> What do I need to do to my sendmail config to permit mail from my domain
> to be only accepted from internal IP's ?
> 
> I'm guessing I need to change my /etc/mail/access file somehow ?
> Currently it has (among other things)
> 
> mydomain.com             RELAY
> localhost.mydomain.com   RELAY
> mail.mydomain.com        RELAY
> mailserver.mydomain.com  RELAY
> mydomain.ie              RELAY
> exchange_server_name     RELAY

You are using the old syntax, which may not be what you want.

If all your server IPs are public then you are on the right track, if your 
servers have internal/external addresses you are better off using the internal ones.

An example of what you can do is access as:

# Allow relying from LAN
Connect:192.168.0                       RELAY
Connect:127.0.0.1                       RELAY
Connect:exchange_server_IP              RELAY
# Whitelist
Connect:other_external_IP               RELAY

And don't forget to 'compile' access (i.e. makemap hash /etc/mail/access < 
/etc/mail/access).
-- 
Ren? Berber

From KGoods at AIAInsurance.com  Thu May  3 18:18:25 2007
From: KGoods at AIAInsurance.com (Ken Goods)
Date: Thu May  3 18:19:44 2007
Subject: Very newbie relaying question
Message-ID: <13C0059880FDD3118DC600508B6D4A6D01C29372@aiainsurance.com>

Declan Grady wrote:
> Hi folks,
> I've just rebuilt my mailscanner+sendmail box using debian etch, and
> after a lot of head-scratching got it up & running ok.
> (Old box suffered hardware failure, was a redhat 7 with a lot of
> patches & updates, etc, but was handy for upgrading mailscanner from
> rpms.) 
> 
> While watching the spam messages, I've noticed quite a few supposedly
> coming from my own domain name.

<snip>
 
> Thanks for suggestions.

If there really isn't any spam originating from your own domains, look into
trusted networks, or even easier, just whitelist your domain(s).

I've been running the same setup (e.g. MailScanner filter feeding an
exchange box) for a couple years now so if you have any other questions feel
free to contact me on list or directly.

HTH
Kind regards,
Ken

Ken Goods
Network Administrator
CropUSA Insurance, Inc.

From lundin at fini.net  Thu May  3 18:26:14 2007
From: lundin at fini.net (John Lundin)
Date: Thu May  3 18:27:12 2007
Subject: SpamAssassin 3.2.0
In-Reply-To: <463900B1.8080301@ecs.soton.ac.uk>
References: <463900B1.8080301@ecs.soton.ac.uk>
Message-ID: <20070503172614.GA31837@fini.net>

On Wed, May 02, 2007 at 10:20:49PM +0100, Julian Field wrote:
> Its list of requirements has grown quite a lot. In addition to whatever 
> else you already have from an existing SA install, you need to install 
> this load of Perl modules, in this order:
>
> ... One thing I'm not installing is support for DKIM which, although
> available, requires so many pre-requisites that it's not feasible
> for me to do here.

FWIW, DAG's repository now contains SA3.2.0 and Encode::Detect and
Mail::SPF -and- Mail::DKIM !  :-)  So if you're running RHEL4 or
Centos4, that's a place to look. http://dag.wieers.com/rpm/packages/

Unfortunately, they don't appear to have propagated to Dries'
repository or even DAG's master rpmforge listing yet. The
perl-Mail-DKIM source rpm compiled and appears to run on Fedora.

re2c is available from sourceforge as a src.rpm. As such, it builds
and runs under Fedora and Centos. Not using it in production yet.
From spamtrap71892316634 at anime.net  Thu May  3 18:42:02 2007
From: spamtrap71892316634 at anime.net (Dan Hollis)
Date: Thu May  3 18:42:07 2007
Subject: 32 bit distro or 64?
In-Reply-To: <463A0223.3000803@yeticomputers.com>
References: <FF689DC51C3C1640BE668A0E31182AD002D15B68@mail03.mira.co.uk>
	<463900F6.1070103@yeticomputers.com>
	<463904BA.4040402@sendit.nodak.edu>
	<463A0223.3000803@yeticomputers.com>
Message-ID: <Pine.LNX.4.64.0705031041380.3536@sasami.anime.net>

On Thu, 3 May 2007, Rick Chadderdon wrote:
> Still, it is much easier to get support from a vendor if you're using
> their software the way that they intended.  I can already hear, "Oh, I'm
> sorry, we don't support that product running on a 64-bit OS."  Even if
> the problem you're having is not related to the OS at all.  Just
> something to consider.

In this case you vote with your wallet and find another vendor. Works for 
me anyway :)

-Dan
From jan-peter at koopmann.eu  Thu May  3 18:53:06 2007
From: jan-peter at koopmann.eu (Koopmann, Jan-Peter)
Date: Thu May  3 18:53:15 2007
Subject: ANNOUNCE: MailScanner stable 4.59
In-Reply-To: <4635B2C4.50004@ecs.soton.ac.uk>
References: <4635B2C4.50004@ecs.soton.ac.uk>
Message-ID: <AEF86EFA5497434190F6D57E2666EA7A84EEC6@ERWIN.intern.seceidos.de>

On  SHA1 wrote:

> I have just released a new stable version, 4.59. The main new
> features this month are 
> 

FreeBSD port has just been submitted. Thanks Julian!
From amaclach at yahoo.co.uk  Thu May  3 20:06:24 2007
From: amaclach at yahoo.co.uk (Andrew MacLachlan)
Date: Thu May  3 20:06:28 2007
Subject: Testing the anti-virus stack
Message-ID: <642167.17343.qm@web26301.mail.ukl.yahoo.com>

OK - I'm pulling what's left of my hair out here trying to test Avast.
What I think is happening is that MailScanner is blocking all the test files before they get to the virus scanner.

How do I know when the virus scanner has picked up a virus (Nothing in the maillog)??
I also need to get the output strings so that I can configure MailWatch for avastd. I've already turned clam off.
 
If anyone has something infected feel free to send it to andy.mac@global-domination.org

Cheers,Andy


----- Original Message ----
From: Dan Hollis <spamtrap71892316634@anime.net>
To: MailScanner discussion <mailscanner@lists.mailscanner.info>
Sent: Thursday, 3 May, 2007 6:42:02 PM
Subject: Re: 32 bit distro or 64?

On Thu, 3 May 2007, Rick Chadderdon wrote:
> Still, it is much easier to get support from a vendor if you're using
> their software the way that they intended.  I can already hear, "Oh, I'm
> sorry, we don't support that product running on a 64-bit OS."  Even if
> the problem you're having is not related to the OS at all.  Just
> something to consider.

In this case you vote with your wallet and find another vendor. Works for 
me anyway :)

-Dan
-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 




From uxbod at splatnix.net  Thu May  3 20:21:14 2007
From: uxbod at splatnix.net (--[ UxBoD ]--)
Date: Thu May  3 20:21:24 2007
Subject: Testing the anti-virus stack
In-Reply-To: <642167.17343.qm@web26301.mail.ukl.yahoo.com>
References: <642167.17343.qm@web26301.mail.ukl.yahoo.com>
Message-ID: <051aabc2a3a191af981ddf4e54b7d2de@62.49.223.244>

Why not run in debug mode and test with eicar.com ?

On Thu, 3 May 2007 19:06:24 +0000 (GMT), Andrew MacLachlan <amaclach@yahoo.co.uk> wrote:
> OK - I'm pulling what's left of my hair out here trying to test Avast.
> What I think is happening is that MailScanner is blocking all the test
> files before they get to the virus scanner.
> 
> How do I know when the virus scanner has picked up a virus (Nothing in the
> maillog)??
> I also need to get the output strings so that I can configure MailWatch
> for avastd. I've already turned clam off.
> 
> If anyone has something infected feel free to send it to
> andy.mac@global-domination.org
> 
> Cheers,Andy
> 
> 
> ----- Original Message ----
> From: Dan Hollis <spamtrap71892316634@anime.net>
> To: MailScanner discussion <mailscanner@lists.mailscanner.info>
> Sent: Thursday, 3 May, 2007 6:42:02 PM
> Subject: Re: 32 bit distro or 64?
> 
> On Thu, 3 May 2007, Rick Chadderdon wrote:
>> Still, it is much easier to get support from a vendor if you're using
>> their software the way that they intended.  I can already hear, "Oh, I'm
>> sorry, we don't support that product running on a 64-bit OS."  Even if
>> the problem you're having is not related to the OS at all.  Just
>> something to consider.
> 
> In this case you vote with your wallet and find another vendor. Works for
> me anyway :)
> 
> -Dan
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
> 
> 
> 
> 
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
> 
> --
> This message has been scanned for viruses and dangerous content by
> MailScanner, and is
> believed to be clean.
-- 
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
// Phone: +44 (0) 845 869 2749  SIP: uxbod@sip.splatnix.net


-- 
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.

From dominian at slackadelic.com  Thu May  3 21:44:29 2007
From: dominian at slackadelic.com (Matt Hayes)
Date: Thu May  3 21:44:41 2007
Subject: Looks like permissions, but unsure where
Message-ID: <463A49AD.9020203@slackadelic.com>

Ok all,

Just upgraded to the newest MailScanner, did everything like I normally 
do.. switched to clamd and I'm getting this:

MailScanner[20004]: ./18D72272A.1574D.header: Unable to create temporary 
directory


Now, at first I thought it was clamd, switched it to clamav and still 
getting the same thing.  Any good ideas where to look?



Thanks,

Matt


From dominian at slackadelic.com  Thu May  3 22:16:59 2007
From: dominian at slackadelic.com (Matt Hayes)
Date: Thu May  3 22:17:15 2007
Subject: [Solved] Looks like permissions, but unsure where
In-Reply-To: <463A49AD.9020203@slackadelic.com>
References: <463A49AD.9020203@slackadelic.com>
Message-ID: <463A514B.1040909@slackadelic.com>

Matt Hayes wrote:
> Ok all,
> 
> Just upgraded to the newest MailScanner, did everything like I normally 
> do.. switched to clamd and I'm getting this:
> 
> MailScanner[20004]: ./18D72272A.1574D.header: Unable to create temporary 
> directory
> 
> 
> Now, at first I thought it was clamd, switched it to clamav and still 
> getting the same thing.  Any good ideas where to look?
> 
> 
> 
> Thanks,
> 
> Matt
> 


Nevermind.  If I had been a smart man and used DEBUGGING ... I would've 
found that it was looking to use /dev/shm to speed up the processing of 
the email.


It seems with the new MailScanner it wants to use /dev/shm.  What I 
found was that on whitelisted addresses I didn't get this error.  On 
anything else, I did. So, once I mounted /dev/shm and all is well.

Thanks,

Matt


From mailscanner at yeticomputers.com  Thu May  3 22:17:38 2007
From: mailscanner at yeticomputers.com (Rick Chadderdon)
Date: Thu May  3 22:17:48 2007
Subject: 32 bit distro or 64?
In-Reply-To: <Pine.LNX.4.64.0705031041380.3536@sasami.anime.net>
References: <FF689DC51C3C1640BE668A0E31182AD002D15B68@mail03.mira.co.uk>	<463900F6.1070103@yeticomputers.com>	<463904BA.4040402@sendit.nodak.edu>	<463A0223.3000803@yeticomputers.com>
	<Pine.LNX.4.64.0705031041380.3536@sasami.anime.net>
Message-ID: <463A5172.8090704@yeticomputers.com>

Dan Hollis wrote:
> On Thu, 3 May 2007, Rick Chadderdon wrote:
>> Still, it is much easier to get support from a vendor if you're using
>> their software the way that they intended.  I can already hear, "Oh, I'm
>> sorry, we don't support that product running on a 64-bit OS."  Even if
>> the problem you're having is not related to the OS at all.  Just
>> something to consider.
>
> In this case you vote with your wallet and find another vendor. Works
> for me anyway :)

Oh, absolutely.  But, it doesn't stop it from being a genuine issue. 
And, sometimes, you'll find that there is *not* a vendor that offers the
service/product you want, the way you want it.  I'm a very independent
person, so I'll do things my own way regardless of what support I can
get.  I do recognize, however, that this is not the best solution for
everyone. 

And, being self-employed, I can only shoot myself in the foot.  If you
work for someone else, it's important to understand how they feel about
such issues.  "Sir, we have to switch away from "Company A" because I
chose solution X, and they won't support it," just might cause a bit of
a ruckus if the company has a lot of money tied up in Company A's
products.  The old "Nobody ever got fired for buying IBM" argument. 
Sadly, due to the typical corporate mindset, it has some merit.

Rick
From dominian at slackadelic.com  Thu May  3 22:23:12 2007
From: dominian at slackadelic.com (Matt Hayes)
Date: Thu May  3 22:23:26 2007
Subject: [Solved] Looks like permissions, but unsure where
In-Reply-To: <463A514B.1040909@slackadelic.com>
References: <463A49AD.9020203@slackadelic.com>
	<463A514B.1040909@slackadelic.com>
Message-ID: <463A52C0.3060207@slackadelic.com>

Matt Hayes wrote:
> Matt Hayes wrote:
>> Ok all,
>>
>> Just upgraded to the newest MailScanner, did everything like I 
>> normally do.. switched to clamd and I'm getting this:
>>
>> MailScanner[20004]: ./18D72272A.1574D.header: Unable to create 
>> temporary directory
>>
>>
>> Now, at first I thought it was clamd, switched it to clamav and still 
>> getting the same thing.  Any good ideas where to look?
>>
>>
>>
>> Thanks,
>>
>> Matt
>>
> 
> 
> Nevermind.  If I had been a smart man and used DEBUGGING ... I would've 
> found that it was looking to use /dev/shm to speed up the processing of 
> the email.
> 
> 
> It seems with the new MailScanner it wants to use /dev/shm.  What I 
> found was that on whitelisted addresses I didn't get this error.  On 
> anything else, I did. So, once I mounted /dev/shm and all is well.
> 


Check that; check_mailscanner looks to see if /dev/shm is available.. if 
it does.. it forces SpamAssassin to use that instead.  Dunno why this 
wasn't being used on the other install I had.

-Matt


From drew at technologytiger.net  Thu May  3 23:02:44 2007
From: drew at technologytiger.net (Drew Marshall)
Date: Thu May  3 23:03:08 2007
Subject: ANNOUNCE: MailScanner stable 4.59
In-Reply-To: <AEF86EFA5497434190F6D57E2666EA7A84EEC6@ERWIN.intern.seceidos.de>
References: <4635B2C4.50004@ecs.soton.ac.uk>
	<AEF86EFA5497434190F6D57E2666EA7A84EEC6@ERWIN.intern.seceidos.de>
Message-ID: <E9505906-883D-45E9-9336-870CA7936807@technologytiger.net>

On 3 May 2007, at 18:53, Koopmann, Jan-Peter wrote:

> On  SHA1 wrote:
>
>> I have just released a new stable version, 4.59. The main new
>> features this month are
>>
>
> FreeBSD port has just been submitted. Thanks Julian!

Thanks JP. Could really do with that clamd option as the clamscan  
perl module has gone and broken on my box for no apparent reason (As  
my thread of the same subject says).

Drew

-- 
In line with our policy, this message has been scanned 
for viruses and dangerous content by the Technology Tiger MailScanner.
Further information can be found at www.technologytiger.net/policy

Technology Tiger Limited is registered in Scotland with registration number: 310997
Registered Office 55-57 West High Street Inverurie AB51 3QQ

From drew at technologytiger.net  Thu May  3 23:06:52 2007
From: drew at technologytiger.net (Drew Marshall)
Date: Thu May  3 23:07:17 2007
Subject: Looks like permissions, but unsure where
In-Reply-To: <463A49AD.9020203@slackadelic.com>
References: <463A49AD.9020203@slackadelic.com>
Message-ID: <2F4FF868-1C27-4485-AF50-4EB5EB3D846C@technologytiger.net>

On 3 May 2007, at 21:44, Matt Hayes wrote:

> Ok all,
>
> Just upgraded to the newest MailScanner, did everything like I  
> normally do.. switched to clamd and I'm getting this:
>
> MailScanner[20004]: ./18D72272A.1574D.header: Unable to create  
> temporary directory
>
>
> Now, at first I thought it was clamd, switched it to clamav and  
> still getting the same thing.  Any good ideas where to look?

Looks like a Postfix queue reference so I'll venture /var/spool/ 
MailScanner/incoming would be a good place to begin This is one of  
the complications of running Postfix. It's secure in so much as  
nothing has an elevated user status but it does make permissions a  
challenge particularly as Clam does the same thing and MailScanner  
needs to run a both.

Drew

-- 
In line with our policy, this message has been scanned 
for viruses and dangerous content by the Technology Tiger MailScanner.
Further information can be found at www.technologytiger.net/policy

Technology Tiger Limited is registered in Scotland with registration number: 310997
Registered Office 55-57 West High Street Inverurie AB51 3QQ

From alex at nkpanama.com  Thu May  3 23:15:24 2007
From: alex at nkpanama.com (Alex Neuman van der Hans)
Date: Thu May  3 23:16:17 2007
Subject: Very newbie relaying question
In-Reply-To: <f1d5i3$mjg$1@sea.gmane.org>
References: <1DF321991CD3084EAD65737D82C6D07E145A86@sbs1.nuvotem.local>
	<f1d5i3$mjg$1@sea.gmane.org>
Message-ID: <463A5EFC.2020007@nkpanama.com>

Ren? Berber wrote:
> You are using the old syntax, which may not be what you want.
>
> If all your server IPs are public then you are on the right track, if 
> your servers have internal/external addresses you are better off using 
> the internal ones.
>
> An example of what you can do is access as:
>
> # Allow relying from LAN
> Connect:192.168.0                       RELAY
> Connect:127.0.0.1                       RELAY
> Connect:exchange_server_IP              RELAY
> # Whitelist
> Connect:other_external_IP               RELAY
>
You're assuming there is a zero percent chance any of the machines on 
the internal network may be spam zombies. This isn't usually true.

You might want to look into SMTP AUTHentication and/or allow relaying 
only from the (ugh) exchange box, which should be set to only allow 
relaying from AUTHenticated users.
From amaclach at yahoo.co.uk  Fri May  4 00:33:53 2007
From: amaclach at yahoo.co.uk (Andrew MacLachlan)
Date: Fri May  4 00:33:55 2007
Subject: Testing the anti-virus stack
Message-ID: <878270.64176.qm@web26304.mail.ukl.yahoo.com>

OK - it's automagically started working.

I got the output strings for avast by running an interactive cmdline scan against eicar.com. If anyone's interested they are:

/tmp/eicar.com [infected by: EICAR Test-NOT virus!!]

and the mailwatch mods (yes - I know - different list...) including the new clam strings in functions.php are:

if(!defined(VIRUS_REGEX) || !DISTRIBUTED_SETUP) {
 switch($scanner=get_primary_scanner()) {
  case 'none':
   define(VIRUS_REGEX, '/^Dummy$/');
   break;
  case 'sophos':
   define(VIRUS_REGEX, '/(>>>) Virus \'(\S+)\' found/');
   break;
  case 'sophossavi':
   define(VIRUS_REGEX, '/(\S+) was infected by (\S+)/');
   break;
  case 'clamav':
   define(VIRUS_REGEX, '/(.+) contains (\S+)/');
   break;
  case 'clamd':
   define(VIRUS_REGEX, '/(.+) contains (\S+)/');
   break;
  case 'clamavmodule':
   define(VIRUS_REGEX, '/(.+) was infected: (\S+)/');
   break;
  case 'f-prot':
   define(VIRUS_REGEX, '/(.+) Infection: (\S+)/');
   break;
  case 'mcafee':
   define(VIRUS_REGEX, '/(.+) Found the (\S+) virus !!!/');
   break;
  case 'f-secure':
   define(VIRUS_REGEX, '/(.+) Infected: (\S+)/');
   break;
  case 'trend':
   define(VIRUS_REGEX, '/(Found virus) (\S+) in file (\S+)/');
   break;
  case 'bitdefender':
   define(VIRUS_REGEX, '/(\S+) Found virus (\S+)/');
   break;
  case 'kaspersky-4.5':
   define(VIRUS_REGEX, '/(.+) INFECTED (\S+)/');
   break;
  case 'etrust':
   define(VIRUS_REGEX, '/(\S+) is infected by virus: (\S+)/');
   break;
  case 'avg':
   define(VIRUS_REGEX, '/(Found virus) (\S+) in file (\S+)/');
   break;
  case 'avast':
   define(VIRUS_REGEX, '/(.+) [infected by: (\S+) virus!!]/');
   break;
  case 'avastd':
   define(VIRUS_REGEX, '/(.+) [infected by: (\S+) virus!!]/');
   break;
  default:
   die("<B>Error:</B><BR>\n&nbsp;Unable to select a regular expression for your primary virus scanner ($scanner) - please see the examples in functions.php to create one.\n");
   break;
 }

Hope this is of use to someone!

 
Regards, 
Andy


----- Original Message ----
From: --[ UxBoD ]-- <uxbod@splatnix.net>
To: MailScanner discussion <mailscanner@lists.mailscanner.info>
Sent: Thursday, 3 May, 2007 8:21:14 PM
Subject: Re: Testing the anti-virus stack

Why not run in debug mode and test with eicar.com ?

On Thu, 3 May 2007 19:06:24 +0000 (GMT), Andrew MacLachlan <amaclach@yahoo.co.uk> wrote:
> OK - I'm pulling what's left of my hair out here trying to test Avast.
> What I think is happening is that MailScanner is blocking all the test
> files before they get to the virus scanner.
> 
> How do I know when the virus scanner has picked up a virus (Nothing in the
> maillog)??
> I also need to get the output strings so that I can configure MailWatch
> for avastd. I've already turned clam off.
> 
> If anyone has something infected feel free to send it to
> andy.mac@global-domination.org
> 
> Cheers,Andy
> 
> 
> ----- Original Message ----
> From: Dan Hollis <spamtrap71892316634@anime.net>
> To: MailScanner discussion <mailscanner@lists.mailscanner.info>
> Sent: Thursday, 3 May, 2007 6:42:02 PM
> Subject: Re: 32 bit distro or 64?
> 
> On Thu, 3 May 2007, Rick Chadderdon wrote:
>> Still, it is much easier to get support from a vendor if you're using
>> their software the way that they intended.  I can already hear, "Oh, I'm
>> sorry, we don't support that product running on a 64-bit OS."  Even if
>> the problem you're having is not related to the OS at all.  Just
>> something to consider.
> 
> In this case you vote with your wallet and find another vendor. Works for
> me anyway :)
> 
> -Dan
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
> 
> 
> 
> 
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
> 
> --
> This message has been scanned for viruses and dangerous content by
> MailScanner, and is
> believed to be clean.
-- 
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
// Phone: +44 (0) 845 869 2749  SIP: uxbod@sip.splatnix.net


-- 
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.

--
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!




From alex at nkpanama.com  Fri May  4 01:41:59 2007
From: alex at nkpanama.com (Alex Neuman van der Hans)
Date: Fri May  4 01:43:25 2007
Subject: Use of variables within archive rulesets
Message-ID: <463A8157.2050209@nkpanama.com>

I've got a few clients who choose to archive all their incoming and 
outgoing e-mail using the "Archive Mail =" function, using a ruleset 
such as:

From:   alice@domain.tld   /home/archiveaccount/mail/outgoing/alice
To:      alice@domain.tld   /home/archiveaccount/mail/incoming/alice
FromOrTo:   default   /home/archiveaccount/mail/BCCs

... so that mail from alice and to alice goes to the "alice" 
IMAP-accessible "folder" on the "archiveaccount" user's account, and 
those that aren't covered by any of the rules (such as BCCs, users I've 
forgotten to add to the ruleset list, and funky NDRs and stuff) get 
archived to a separate "BCCs and such" account.

I'd like to know if it would be possible to use some sort of variable 
(systemwide or generated) that would allow me to do something like:

From:   alice@domain.tld 
/home/archiveaccount/mail/%year%/%month%/outgoing/alice
To:   alice@domain.tld 
/home/archiveaccount/mail/%year%/%month%/incoming/alice

How would one go about this? I believe I'd have to create the structure 
first and change the ownerships and permissions so that the user 
MailScanner runs under can write to it, and the "archiveaccount" user 
can read from it, but besides that I wouldn't know where to begin.

Suggestions?
From jcb at dream.com.ph  Fri May  4 04:06:49 2007
From: jcb at dream.com.ph (jcb on dream)
Date: Fri May  4 04:08:02 2007
Subject: whitelist mcp 
Message-ID: <000f01c78df9$41fdbe70$960bbdcb@jepoy>

hi guys,

i had mcp activated and since im managing a whitelist file for spamassassin, can i create the same config for mcp to point it on the same white list file for spamassassin?

tnx.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070504/a11d9a14/attachment.html
From mogens at fumlersoft.dk  Fri May  4 09:27:53 2007
From: mogens at fumlersoft.dk (Mogens Melander)
Date: Fri May  4 09:28:32 2007
Subject: Use of variables within archive rulesets
In-Reply-To: <463A8157.2050209@nkpanama.com>
References: <463A8157.2050209@nkpanama.com>
Message-ID: <2252.90.184.17.152.1178267273.squirrel@mail.fumlersoft.dk>


On Fri, May 4, 2007 02:41, Alex Neuman van der Hans wrote:
> I've got a few clients who choose to archive all their incoming and
> outgoing e-mail using the "Archive Mail =" function, using a ruleset
> such as:
>
> From:   alice@domain.tld   /home/archiveaccount/mail/outgoing/alice
> To:      alice@domain.tld   /home/archiveaccount/mail/incoming/alice
> FromOrTo:   default   /home/archiveaccount/mail/BCCs
>
> ... so that mail from alice and to alice goes to the "alice"
> IMAP-accessible "folder" on the "archiveaccount" user's account, and
> those that aren't covered by any of the rules (such as BCCs, users I've
> forgotten to add to the ruleset list, and funky NDRs and stuff) get
> archived to a separate "BCCs and such" account.
>
> I'd like to know if it would be possible to use some sort of variable
> (systemwide or generated) that would allow me to do something like:
>
> From:   alice@domain.tld
> /home/archiveaccount/mail/%year%/%month%/outgoing/alice
> To:   alice@domain.tld
> /home/archiveaccount/mail/%year%/%month%/incoming/alice
>
> How would one go about this? I believe I'd have to create the structure
> first and change the ownerships and permissions so that the user
> MailScanner runs under can write to it, and the "archiveaccount" user
> can read from it, but besides that I wouldn't know where to begin.
>
> Suggestions?

How about a custom function ? Take a look at the MyExample.pm
in CustomFinctions directory. Mine are located in:

/usr/lib/MailScanner/MailScanner/CustomFunctions

-- 
Later

Mogens Melander
+45 40 85 71 38
+66 870 133 224



-- 
This message has been scanned for viruses and
dangerous content by OpenProtect(http://www.openprotect.com), and is
believed to be clean.

From pedretti at eco.unibs.it  Fri May  4 11:36:13 2007
From: pedretti at eco.unibs.it (Fabio Pedretti)
Date: Fri May  4 11:35:20 2007
Subject: Clamav suggestions
Message-ID: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it>

I have some suggestions on using clamav in MailScanner on which I have  
already sent a mail some time ago:
http://lists.mailscanner.info/pipermail/mailscanner/2007-March/071330.html

1) clamscan is called with the option --disable-summary , which is
deprecated (at least since clamav 0.70, released on 2004-04-16).  
--no-summary should be used instead in SweepViruses.pm.
2) I noticed (as well as others:
http://lists.mailscanner.info/pipermail/mailscanner/2007-April/072504.html
) that some phishing mail are not blocked (I am also using
the signatures of sanesecurity). If I do a clamscan on the full
original mail with headers, clamscan find the virus (I can provide a
sample if needed). Seems the problem is that MailScanner extracts the
content of the mail (body + attachment) and scans it, but some
phishing mail are only detected if the full headers are present (in
the clamav DB in the extended signature format, option 4 is for mail
files, look at signatures.pdf in clamav source, and are detected only
if full mail with headers is scanned).
MailScanner should be modified so that all the original mail (with
headers and without extracting attachment) should be passed to
clamscan/clamd, so all virus can be catched.
3) Support for clamd trough clamdscan is nice, however, best would be  
to connect to clamd directly to its socket (or network socket) from  
MailScanner, without call clamdscan, and fallback to clamscan if clamd  
is not working.
4) Would be nice to have the possibility to quarantine only the entire
message and not also the attachments: worse is that if there are some
compressed files, the original file as well as the content are
quarantined, doubling (or more) the space on the disk.

Thanks,
   Fabio

From ssilva at sgvwater.com  Fri May  4 17:19:00 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Fri May  4 17:19:36 2007
Subject: Clamav suggestions
In-Reply-To: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it>
References: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it>
Message-ID: <f1fmdk$ugo$1@sea.gmane.org>

Fabio Pedretti spake the following on 5/4/2007 3:36 AM:
> I have some suggestions on using clamav in MailScanner on which I have
> already sent a mail some time ago:
> http://lists.mailscanner.info/pipermail/mailscanner/2007-March/071330.html
> 
> 1) clamscan is called with the option --disable-summary , which is
> deprecated (at least since clamav 0.70, released on 2004-04-16).
> --no-summary should be used instead in SweepViruses.pm.
> 2) I noticed (as well as others:
> http://lists.mailscanner.info/pipermail/mailscanner/2007-April/072504.html
> ) that some phishing mail are not blocked (I am also using
> the signatures of sanesecurity). If I do a clamscan on the full
> original mail with headers, clamscan find the virus (I can provide a
> sample if needed). Seems the problem is that MailScanner extracts the
> content of the mail (body + attachment) and scans it, but some
> phishing mail are only detected if the full headers are present (in
> the clamav DB in the extended signature format, option 4 is for mail
> files, look at signatures.pdf in clamav source, and are detected only
> if full mail with headers is scanned).
> MailScanner should be modified so that all the original mail (with
> headers and without extracting attachment) should be passed to
> clamscan/clamd, so all virus can be catched.
> 3) Support for clamd trough clamdscan is nice, however, best would be to
> connect to clamd directly to its socket (or network socket) from
> MailScanner, without call clamdscan, and fallback to clamscan if clamd
> is not working.
> 4) Would be nice to have the possibility to quarantine only the entire
> message and not also the attachments: worse is that if there are some
> compressed files, the original file as well as the content are
> quarantined, doubling (or more) the space on the disk.
> 
I'm sure Julian would welcome some tested patches.


-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From Richard.Frovarp at sendit.nodak.edu  Fri May  4 17:25:46 2007
From: Richard.Frovarp at sendit.nodak.edu (Richard Frovarp)
Date: Fri May  4 17:25:50 2007
Subject: Clamav suggestions
In-Reply-To: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it>
References: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it>
Message-ID: <463B5E8A.2080400@sendit.nodak.edu>

Fabio Pedretti wrote:
>
> 3) Support for clamd trough clamdscan is nice, however, best would be 
> to connect to clamd directly to its socket (or network socket) from 
> MailScanner, without call clamdscan, and fallback to clamscan if clamd 
> is not working. 

Why not just run clamavmodule? From my understanding, the support for 
clamd was added so that those that didn't want to keep up with the Perl 
module required for clamavmodule would have something faster than 
clamscan. Any direct call to clamd from MailScanner would require a Perl 
module, so at that point you're losing the requirements benefit of 
running clamd.
From mkettler at evi-inc.com  Fri May  4 19:31:40 2007
From: mkettler at evi-inc.com (Matt Kettler)
Date: Fri May  4 19:31:53 2007
Subject: SpamAssassin 3.2.0
In-Reply-To: <463900B1.8080301@ecs.soton.ac.uk>
References: <463900B1.8080301@ecs.soton.ac.uk>
Message-ID: <463B7C0C.9000004@evi-inc.com>

Julian Field wrote:
> Well, as someone else has already said, it's been released.
> 
> Its list of requirements has grown quite a lot. In addition to whatever
> else you already have from an existing SA install, you need to install
> this load of Perl modules, in this order:
> 
>       YAML -- requires y\n in perl Makefile.PL
>       ExtUtils::CBuilder
>       ExtUtils::ParseXS
>     Module::Build
>       version
>     Net::DNS::Resolver::Programmable
>     Error
>     NetAddr::IP
>     Net::DNS >=0.58
>     Data::Dump
>   Encode::Detect
>   Mail::SPF
> Mail::SpamAssassin -- requires \n in perl Makefile.PL
> 
> It puts in a v320.pre into /etc/mail/spamassassin and comes with a load
> of new plugins. Some of them are loaded by the default supplied v320.pre
> file, but here are the ones that aren't:
> 
>                           Hashcash.pm             Rule2XSBody.pm
> ASN.pm                                            SpamCop.pm
> AutoLearnThreshold.pm                             SPF.pm
> AWL.pm                                            Test.pm
>                                                   TextCat.pm
>                           MIMEHeader.pm
> BodyRuleBaseExtractor.pm  OneLineBodyRuleType.pm  URIDNSBL.pm
>                           Pyzor.pm
> DCC.pm                    Razor2.pm
>                           RelayCountry.pm         WhiteListSubject.pm
>                           ReplaceTags.pm

Julian, Some of those plugins ARE loaded by default, but are loaded via older
.pre files. And yes, SA does parse *ALL* of the .pre files, and you need to have
ALL of them to work properly.

The whole idea of the multiple .pre files is that as new plugins are added, SA
doesn't have to do a config-merge. All it does is add the new .pre file that
supports the new plugins. Your choices about what plugins from 3.1.0 or 3.0.0 to
load won't be affected, and will remain in-place in your old .pre files.

Of the above plugins:
init.pre (SA 3.0.0) loads:
	URIDNSBL
	SPF
v310.pre loads:
	Spamcop
	DCC (disabled by default)
	Pyzor
	Razor2
	AWL
	AutoLearnThreshold
	TextCat (disabled by default)
	WhiteListSubject
	MimeHeader
	ReplaceTags
	DomainKeys (disabled by default)
v312.pre loads:
	DKIM (disabled by default)

V320.pre only handles the new plugins for 3.2.0, most of which are things that
used to be hard-coded into EvalTests.pm.


> 
> My next step is to read the man pages for all of these, and work out
> which ones you probably want to load and which ones you don't, so that
> my install script can set you up with a sensible system.

You really shouldn't have to do that for all of them. Only look at the ones that
aren't loaded by default.

> One thing I'm
> not installing is support for DKIM which, although available, requires
> so many pre-requisites that it's not feasible for me to do here. You
> have to start at the OpenSSL libraries and work your way up :-(

Makes sense, that's a v312.pre thing.

> 
> Once I've got something working here, I'll write up an install script
> for it all and wrap it into a package for you.
> 
> Jules
> 
From jaearick at colby.edu  Fri May  4 20:40:19 2007
From: jaearick at colby.edu (Jeff A. Earickson)
Date: Fri May  4 20:40:35 2007
Subject: SpamAssassin 3.2.0
In-Reply-To: <463900B1.8080301@ecs.soton.ac.uk>
References: <463900B1.8080301@ecs.soton.ac.uk>
Message-ID: <Pine.GSO.4.64.0705041538310.365@karst.colby.edu>

On Wed, 2 May 2007, Julian Field wrote:

> Date: Wed, 02 May 2007 22:20:49 +0100
> From: Julian Field <MailScanner@ecs.soton.ac.uk>
> Reply-To: MailScanner discussion <mailscanner@lists.mailscanner.info>
> To: MailScanner discussion <mailscanner@lists.mailscanner.info>
> Subject: SpamAssassin 3.2.0
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Well, as someone else has already said, it's been released.
>
> Its list of requirements has grown quite a lot. In addition to whatever
> else you already have from an existing SA install, you need to install
> this load of Perl modules, in this order:
>
>      YAML -- requires y\n in perl Makefile.PL
>      ExtUtils::CBuilder
>      ExtUtils::ParseXS
>    Module::Build
>      version
>    Net::DNS::Resolver::Programmable
>    Error
>    NetAddr::IP
>    Net::DNS >=0.58
>    Data::Dump
>  Encode::Detect
>  Mail::SPF
> Mail::SpamAssassin -- requires \n in perl Makefile.PL

I got it installed and running at my site.  I had to install the perl
modules above and then some (because I installed DKIM).  I probably had
to install or update 30+ perl modules.  Wow.  I also had to stare at
the *.pre files.  But it seems to work for me.  (Solaris 10).

Jeff Earickson
Colby College
From arto.saraniva at artio.net  Fri May  4 21:16:23 2007
From: arto.saraniva at artio.net (Arto)
Date: Fri May  4 21:16:20 2007
Subject: Clamav suggestions
In-Reply-To: <463B5E8A.2080400@sendit.nodak.edu>
References: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it>
	<463B5E8A.2080400@sendit.nodak.edu>
Message-ID: <f1g4a4$ks8$1@sea.gmane.org>

Richard Frovarp wrote:
> Fabio Pedretti wrote:
>>
>> 3) Support for clamd trough clamdscan is nice, however, best would be 
>> to connect to clamd directly to its socket (or network socket) from 
>> MailScanner, without call clamdscan, and fallback to clamscan if clamd 
>> is not working. 
> 
> Why not just run clamavmodule? From my understanding, the support for 
> clamd was added so that those that didn't want to keep up with the Perl 
> module required for clamavmodule would have something faster than 
> clamscan. Any direct call to clamd from MailScanner would require a Perl 
> module, so at that point you're losing the requirements benefit of 
> running clamd.

FYI, we have used all of those during last three weeks. First clamav 
(indeed about two year before this period), then clamavmodule and during 
this week clamd.

Our MX server passes normally about 10k mails/day (MS, postgrey, postfix 
and SA) and clamd is IMHO the most comfortable as regards load, memory 
and swap. The server is a vmware client (CentOS4.4 ) with 2 x 2,4 GHz 
and 775 Mb memory reserved to client. After start the swap is with clamd 
under 40 Mb and it will remain there. With clamavmodule and clamav the 
swap varies from 40 to 400 Mb and the load can be even over 20 with clamav.

More details from our Cacti stats:
http://www.artio.fi/.component/imageGenerator.php?fileName=%2Fwebroot%2Fweb%2Ffocus%2Fwww%2Fimnetti%2Fmedia%2F0%2F10841.png&cache=1&cachePrefix=.cache
The first week was runned with clamav till midday of thursday, after 
that with clamavmodule and this week with clamd.

With numbers this week (four workdays because of free Monday, otherwise 
typical):

received: 33307
spam: 836
rejected: 163033
virus: 5
bounced: 150
sent: 8331

-arto

From Richard.Frovarp at sendit.nodak.edu  Fri May  4 21:38:53 2007
From: Richard.Frovarp at sendit.nodak.edu (Richard Frovarp)
Date: Fri May  4 21:38:56 2007
Subject: Clamav suggestions
In-Reply-To: <f1g4a4$ks8$1@sea.gmane.org>
References: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it>	<463B5E8A.2080400@sendit.nodak.edu>
	<f1g4a4$ks8$1@sea.gmane.org>
Message-ID: <463B99DD.4020900@sendit.nodak.edu>

Arto wrote:
> Richard Frovarp wrote:
>> Fabio Pedretti wrote:
>>>
>>> 3) Support for clamd trough clamdscan is nice, however, best would 
>>> be to connect to clamd directly to its socket (or network socket) 
>>> from MailScanner, without call clamdscan, and fallback to clamscan 
>>> if clamd is not working. 
>>
>> Why not just run clamavmodule? From my understanding, the support for 
>> clamd was added so that those that didn't want to keep up with the 
>> Perl module required for clamavmodule would have something faster 
>> than clamscan. Any direct call to clamd from MailScanner would 
>> require a Perl module, so at that point you're losing the 
>> requirements benefit of running clamd.
>
> FYI, we have used all of those during last three weeks. First clamav 
> (indeed about two year before this period), then clamavmodule and 
> during this week clamd.
>
> Our MX server passes normally about 10k mails/day (MS, postgrey, 
> postfix and SA) and clamd is IMHO the most comfortable as regards 
> load, memory and swap. The server is a vmware client (CentOS4.4 ) with 
> 2 x 2,4 GHz and 775 Mb memory reserved to client. After start the swap 
> is with clamd under 40 Mb and it will remain there. With clamavmodule 
> and clamav the swap varies from 40 to 400 Mb and the load can be even 
> over 20 with clamav.
>
> More details from our Cacti stats:
> http://www.artio.fi/.component/imageGenerator.php?fileName=%2Fwebroot%2Fweb%2Ffocus%2Fwww%2Fimnetti%2Fmedia%2F0%2F10841.png&cache=1&cachePrefix=.cache 
>
> The first week was runned with clamav till midday of thursday, after 
> that with clamavmodule and this week with clamd.
>
> With numbers this week (four workdays because of free Monday, 
> otherwise typical):
>
> received: 33307
> spam: 836
> rejected: 163033
> virus: 5
> bounced: 150
> sent: 8331
>
> -arto
>

You may want to decrease the number of MailScanner processes running 
under Max Children. I've got a vmware guest with 1 GB of RAM. The host 
is a dual socket dual core 3.2 GHz Xeon. We're not see any swap at all 
running clamavmodule. However, I have Max Children set to 7. This 
particular scanner handles internal mail only and scan times are only a 
couple of seconds during the middle of the day with batch sizes of 1 or 
2. From Monday to Thursday I see these numbers:

Received: 202,866
Spam: 190
Virus: 456

From arto.saraniva at artio.net  Fri May  4 21:45:04 2007
From: arto.saraniva at artio.net (Arto)
Date: Fri May  4 21:45:04 2007
Subject: Clamav suggestions
In-Reply-To: <463B99DD.4020900@sendit.nodak.edu>
References: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it>	<463B5E8A.2080400@sendit.nodak.edu>	<f1g4a4$ks8$1@sea.gmane.org>
	<463B99DD.4020900@sendit.nodak.edu>
Message-ID: <f1g5vt$pnt$1@sea.gmane.org>

Richard Frovarp wrote:
> Arto wrote:
>> Richard Frovarp wrote:
>>> Fabio Pedretti wrote:
>>>>
>>>> 3) Support for clamd trough clamdscan is nice, however, best would 
>>>> be to connect to clamd directly to its socket (or network socket) 
>>>> from MailScanner, without call clamdscan, and fallback to clamscan 
>>>> if clamd is not working. 
>>>
>>> Why not just run clamavmodule? From my understanding, the support for 
>>> clamd was added so that those that didn't want to keep up with the 
>>> Perl module required for clamavmodule would have something faster 
>>> than clamscan. Any direct call to clamd from MailScanner would 
>>> require a Perl module, so at that point you're losing the 
>>> requirements benefit of running clamd.
>>
>> FYI, we have used all of those during last three weeks. First clamav 
>> (indeed about two year before this period), then clamavmodule and 
>> during this week clamd.
>>
>> Our MX server passes normally about 10k mails/day (MS, postgrey, 
>> postfix and SA) and clamd is IMHO the most comfortable as regards 
>> load, memory and swap. The server is a vmware client (CentOS4.4 ) with 
>> 2 x 2,4 GHz and 775 Mb memory reserved to client. After start the swap 
>> is with clamd under 40 Mb and it will remain there. With clamavmodule 
>> and clamav the swap varies from 40 to 400 Mb and the load can be even 
>> over 20 with clamav.
>>
>> More details from our Cacti stats:
>> http://www.artio.fi/.component/imageGenerator.php?fileName=%2Fwebroot%2Fweb%2Ffocus%2Fwww%2Fimnetti%2Fmedia%2F0%2F10841.png&cache=1&cachePrefix=.cache 
>>
>> The first week was runned with clamav till midday of thursday, after 
>> that with clamavmodule and this week with clamd.
>>
>> With numbers this week (four workdays because of free Monday, 
>> otherwise typical):
>>
>> received: 33307
>> spam: 836
>> rejected: 163033
>> virus: 5
>> bounced: 150
>> sent: 8331
>>
>> -arto
>>
> 
> You may want to decrease the number of MailScanner processes running 
> under Max Children. I've got a vmware guest with 1 GB of RAM. The host 
> is a dual socket dual core 3.2 GHz Xeon. We're not see any swap at all 
> running clamavmodule. However, I have Max Children set to 7. This 
> particular scanner handles internal mail only and scan times are only a 
> couple of seconds during the middle of the day with batch sizes of 1 or 

Max Children = 10 (which should be the recommended value with 2 processors.)

-arto

From Richard.Frovarp at sendit.nodak.edu  Fri May  4 21:47:57 2007
From: Richard.Frovarp at sendit.nodak.edu (Richard Frovarp)
Date: Fri May  4 21:48:00 2007
Subject: Clamav suggestions
In-Reply-To: <f1g5vt$pnt$1@sea.gmane.org>
References: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it>	<463B5E8A.2080400@sendit.nodak.edu>	<f1g4a4$ks8$1@sea.gmane.org>	<463B99DD.4020900@sendit.nodak.edu>
	<f1g5vt$pnt$1@sea.gmane.org>
Message-ID: <463B9BFD.6020807@sendit.nodak.edu>

Arto wrote:
> Richard Frovarp wrote:
>> Arto wrote:
>>> Richard Frovarp wrote:
>>>> Fabio Pedretti wrote:
>>>>>
>>>>> 3) Support for clamd trough clamdscan is nice, however, best would 
>>>>> be to connect to clamd directly to its socket (or network socket) 
>>>>> from MailScanner, without call clamdscan, and fallback to clamscan 
>>>>> if clamd is not working. 
>>>>
>>>> Why not just run clamavmodule? From my understanding, the support 
>>>> for clamd was added so that those that didn't want to keep up with 
>>>> the Perl module required for clamavmodule would have something 
>>>> faster than clamscan. Any direct call to clamd from MailScanner 
>>>> would require a Perl module, so at that point you're losing the 
>>>> requirements benefit of running clamd.
>>>
>>> FYI, we have used all of those during last three weeks. First clamav 
>>> (indeed about two year before this period), then clamavmodule and 
>>> during this week clamd.
>>>
>>> Our MX server passes normally about 10k mails/day (MS, postgrey, 
>>> postfix and SA) and clamd is IMHO the most comfortable as regards 
>>> load, memory and swap. The server is a vmware client (CentOS4.4 ) 
>>> with 2 x 2,4 GHz and 775 Mb memory reserved to client. After start 
>>> the swap is with clamd under 40 Mb and it will remain there. With 
>>> clamavmodule and clamav the swap varies from 40 to 400 Mb and the 
>>> load can be even over 20 with clamav.
>>>
>>> More details from our Cacti stats:
>>> http://www.artio.fi/.component/imageGenerator.php?fileName=%2Fwebroot%2Fweb%2Ffocus%2Fwww%2Fimnetti%2Fmedia%2F0%2F10841.png&cache=1&cachePrefix=.cache 
>>>
>>> The first week was runned with clamav till midday of thursday, after 
>>> that with clamavmodule and this week with clamd.
>>>
>>> With numbers this week (four workdays because of free Monday, 
>>> otherwise typical):
>>>
>>> received: 33307
>>> spam: 836
>>> rejected: 163033
>>> virus: 5
>>> bounced: 150
>>> sent: 8331
>>>
>>> -arto
>>>
>>
>> You may want to decrease the number of MailScanner processes running 
>> under Max Children. I've got a vmware guest with 1 GB of RAM. The 
>> host is a dual socket dual core 3.2 GHz Xeon. We're not see any swap 
>> at all running clamavmodule. However, I have Max Children set to 7. 
>> This particular scanner handles internal mail only and scan times are 
>> only a couple of seconds during the middle of the day with batch 
>> sizes of 1 or 
>
> Max Children = 10 (which should be the recommended value with 2 
> processors.)
>
> -arto
>
That's assuming you have the RAM. Each of mine are about 80 MB in size, 
10 of those would be 800 MB, which is more than you have allocated for RAM.
From arto.saraniva at artio.net  Fri May  4 21:50:12 2007
From: arto.saraniva at artio.net (Arto)
Date: Fri May  4 21:50:09 2007
Subject: Clamav suggestions
In-Reply-To: <463B9BFD.6020807@sendit.nodak.edu>
References: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it>	<463B5E8A.2080400@sendit.nodak.edu>	<f1g4a4$ks8$1@sea.gmane.org>	<463B99DD.4020900@sendit.nodak.edu>	<f1g5vt$pnt$1@sea.gmane.org>
	<463B9BFD.6020807@sendit.nodak.edu>
Message-ID: <f1g69h$r8l$1@sea.gmane.org>

Richard Frovarp wrote:
> Arto wrote:
>> Richard Frovarp wrote:
>>> Arto wrote:
>>>> Richard Frovarp wrote:
>>>>> Fabio Pedretti wrote:
>>>>>>
>>>>>> 3) Support for clamd trough clamdscan is nice, however, best would 
>>>>>> be to connect to clamd directly to its socket (or network socket) 
>>>>>> from MailScanner, without call clamdscan, and fallback to clamscan 
>>>>>> if clamd is not working. 
>>>>>
>>>>> Why not just run clamavmodule? From my understanding, the support 
>>>>> for clamd was added so that those that didn't want to keep up with 
>>>>> the Perl module required for clamavmodule would have something 
>>>>> faster than clamscan. Any direct call to clamd from MailScanner 
>>>>> would require a Perl module, so at that point you're losing the 
>>>>> requirements benefit of running clamd.
>>>>
>>>> FYI, we have used all of those during last three weeks. First clamav 
>>>> (indeed about two year before this period), then clamavmodule and 
>>>> during this week clamd.
>>>>
>>>> Our MX server passes normally about 10k mails/day (MS, postgrey, 
>>>> postfix and SA) and clamd is IMHO the most comfortable as regards 
>>>> load, memory and swap. The server is a vmware client (CentOS4.4 ) 
>>>> with 2 x 2,4 GHz and 775 Mb memory reserved to client. After start 
>>>> the swap is with clamd under 40 Mb and it will remain there. With 
>>>> clamavmodule and clamav the swap varies from 40 to 400 Mb and the 
>>>> load can be even over 20 with clamav.
>>>>
>>>> More details from our Cacti stats:
>>>> http://www.artio.fi/.component/imageGenerator.php?fileName=%2Fwebroot%2Fweb%2Ffocus%2Fwww%2Fimnetti%2Fmedia%2F0%2F10841.png&cache=1&cachePrefix=.cache 
>>>>
>>>> The first week was runned with clamav till midday of thursday, after 
>>>> that with clamavmodule and this week with clamd.
>>>>
>>>> With numbers this week (four workdays because of free Monday, 
>>>> otherwise typical):
>>>>
>>>> received: 33307
>>>> spam: 836
>>>> rejected: 163033
>>>> virus: 5
>>>> bounced: 150
>>>> sent: 8331
>>>>
>>>> -arto
>>>>
>>>
>>> You may want to decrease the number of MailScanner processes running 
>>> under Max Children. I've got a vmware guest with 1 GB of RAM. The 
>>> host is a dual socket dual core 3.2 GHz Xeon. We're not see any swap 
>>> at all running clamavmodule. However, I have Max Children set to 7. 
>>> This particular scanner handles internal mail only and scan times are 
>>> only a couple of seconds during the middle of the day with batch 
>>> sizes of 1 or 
>>
>> Max Children = 10 (which should be the recommended value with 2 
>> processors.)
>>
>> -arto
>>
> That's assuming you have the RAM. Each of mine are about 80 MB in size, 
> 10 of those would be 800 MB, which is more than you have allocated for RAM.

Ours are 54388 Mb.

From arto.saraniva at artio.net  Fri May  4 21:57:56 2007
From: arto.saraniva at artio.net (Arto)
Date: Fri May  4 21:57:51 2007
Subject: Clamav suggestions
In-Reply-To: <f1g69h$r8l$1@sea.gmane.org>
References: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it>	<463B5E8A.2080400@sendit.nodak.edu>	<f1g4a4$ks8$1@sea.gmane.org>	<463B99DD.4020900@sendit.nodak.edu>	<f1g5vt$pnt$1@sea.gmane.org>	<463B9BFD.6020807@sendit.nodak.edu>
	<f1g69h$r8l$1@sea.gmane.org>
Message-ID: <f1g6o0$r8l$2@sea.gmane.org>

Arto wrote:
> Richard Frovarp wrote:
>> Arto wrote:
>>> Richard Frovarp wrote:
>>>> Arto wrote:
>>>>> Richard Frovarp wrote:
>>>>>> Fabio Pedretti wrote:
>>>>>>>
>>>>>>> 3) Support for clamd trough clamdscan is nice, however, best 
>>>>>>> would be to connect to clamd directly to its socket (or network 
>>>>>>> socket) from MailScanner, without call clamdscan, and fallback to 
>>>>>>> clamscan if clamd is not working. 
>>>>>>
>>>>>> Why not just run clamavmodule? From my understanding, the support 
>>>>>> for clamd was added so that those that didn't want to keep up with 
>>>>>> the Perl module required for clamavmodule would have something 
>>>>>> faster than clamscan. Any direct call to clamd from MailScanner 
>>>>>> would require a Perl module, so at that point you're losing the 
>>>>>> requirements benefit of running clamd.
>>>>>
>>>>> FYI, we have used all of those during last three weeks. First 
>>>>> clamav (indeed about two year before this period), then 
>>>>> clamavmodule and during this week clamd.
>>>>>
>>>>> Our MX server passes normally about 10k mails/day (MS, postgrey, 
>>>>> postfix and SA) and clamd is IMHO the most comfortable as regards 
>>>>> load, memory and swap. The server is a vmware client (CentOS4.4 ) 
>>>>> with 2 x 2,4 GHz and 775 Mb memory reserved to client. After start 
>>>>> the swap is with clamd under 40 Mb and it will remain there. With 
>>>>> clamavmodule and clamav the swap varies from 40 to 400 Mb and the 
>>>>> load can be even over 20 with clamav.
>>>>>
>>>>> More details from our Cacti stats:
>>>>> http://www.artio.fi/.component/imageGenerator.php?fileName=%2Fwebroot%2Fweb%2Ffocus%2Fwww%2Fimnetti%2Fmedia%2F0%2F10841.png&cache=1&cachePrefix=.cache 
>>>>>
>>>>> The first week was runned with clamav till midday of thursday, 
>>>>> after that with clamavmodule and this week with clamd.
>>>>>
>>>>> With numbers this week (four workdays because of free Monday, 
>>>>> otherwise typical):
>>>>>
>>>>> received: 33307
>>>>> spam: 836
>>>>> rejected: 163033
>>>>> virus: 5
>>>>> bounced: 150
>>>>> sent: 8331
>>>>>
>>>>> -arto
>>>>>
>>>>
>>>> You may want to decrease the number of MailScanner processes running 
>>>> under Max Children. I've got a vmware guest with 1 GB of RAM. The 
>>>> host is a dual socket dual core 3.2 GHz Xeon. We're not see any swap 
>>>> at all running clamavmodule. However, I have Max Children set to 7. 
>>>> This particular scanner handles internal mail only and scan times 
>>>> are only a couple of seconds during the middle of the day with batch 
>>>> sizes of 1 or 
>>>
>>> Max Children = 10 (which should be the recommended value with 2 
>>> processors.)
>>>
>>> -arto
>>>
>> That's assuming you have the RAM. Each of mine are about 80 MB in 
>> size, 10 of those would be 800 MB, which is more than you have 
>> allocated for RAM.

And sure I mean about 54 Mb. :-)

From Richard.Frovarp at sendit.nodak.edu  Fri May  4 22:07:01 2007
From: Richard.Frovarp at sendit.nodak.edu (Richard Frovarp)
Date: Fri May  4 22:07:04 2007
Subject: Clamav suggestions
In-Reply-To: <f1g6o0$r8l$2@sea.gmane.org>
References: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it>	<463B5E8A.2080400@sendit.nodak.edu>	<f1g4a4$ks8$1@sea.gmane.org>	<463B99DD.4020900@sendit.nodak.edu>	<f1g5vt$pnt$1@sea.gmane.org>	<463B9BFD.6020807@sendit.nodak.edu>	<f1g69h$r8l$1@sea.gmane.org>
	<f1g6o0$r8l$2@sea.gmane.org>
Message-ID: <463BA075.5040004@sendit.nodak.edu>

Arto wrote:
> Arto wrote:
>> Richard Frovarp wrote:
>>> Arto wrote:
>>>> Richard Frovarp wrote:
>>>>> Arto wrote:
>>>>>> Richard Frovarp wrote:
>>>>>>> Fabio Pedretti wrote:
>>>>>>>>
>>>>>>>> 3) Support for clamd trough clamdscan is nice, however, best 
>>>>>>>> would be to connect to clamd directly to its socket (or network 
>>>>>>>> socket) from MailScanner, without call clamdscan, and fallback 
>>>>>>>> to clamscan if clamd is not working. 
>>>>>>>
>>>>>>> Why not just run clamavmodule? From my understanding, the 
>>>>>>> support for clamd was added so that those that didn't want to 
>>>>>>> keep up with the Perl module required for clamavmodule would 
>>>>>>> have something faster than clamscan. Any direct call to clamd 
>>>>>>> from MailScanner would require a Perl module, so at that point 
>>>>>>> you're losing the requirements benefit of running clamd.
>>>>>>
>>>>>> FYI, we have used all of those during last three weeks. First 
>>>>>> clamav (indeed about two year before this period), then 
>>>>>> clamavmodule and during this week clamd.
>>>>>>
>>>>>> Our MX server passes normally about 10k mails/day (MS, postgrey, 
>>>>>> postfix and SA) and clamd is IMHO the most comfortable as regards 
>>>>>> load, memory and swap. The server is a vmware client (CentOS4.4 ) 
>>>>>> with 2 x 2,4 GHz and 775 Mb memory reserved to client. After 
>>>>>> start the swap is with clamd under 40 Mb and it will remain 
>>>>>> there. With clamavmodule and clamav the swap varies from 40 to 
>>>>>> 400 Mb and the load can be even over 20 with clamav.
>>>>>>
>>>>>> More details from our Cacti stats:
>>>>>> http://www.artio.fi/.component/imageGenerator.php?fileName=%2Fwebroot%2Fweb%2Ffocus%2Fwww%2Fimnetti%2Fmedia%2F0%2F10841.png&cache=1&cachePrefix=.cache 
>>>>>>
>>>>>> The first week was runned with clamav till midday of thursday, 
>>>>>> after that with clamavmodule and this week with clamd.
>>>>>>
>>>>>> With numbers this week (four workdays because of free Monday, 
>>>>>> otherwise typical):
>>>>>>
>>>>>> received: 33307
>>>>>> spam: 836
>>>>>> rejected: 163033
>>>>>> virus: 5
>>>>>> bounced: 150
>>>>>> sent: 8331
>>>>>>
>>>>>> -arto
>>>>>>
>>>>>
>>>>> You may want to decrease the number of MailScanner processes 
>>>>> running under Max Children. I've got a vmware guest with 1 GB of 
>>>>> RAM. The host is a dual socket dual core 3.2 GHz Xeon. We're not 
>>>>> see any swap at all running clamavmodule. However, I have Max 
>>>>> Children set to 7. This particular scanner handles internal mail 
>>>>> only and scan times are only a couple of seconds during the middle 
>>>>> of the day with batch sizes of 1 or 
>>>>
>>>> Max Children = 10 (which should be the recommended value with 2 
>>>> processors.)
>>>>
>>>> -arto
>>>>
>>> That's assuming you have the RAM. Each of mine are about 80 MB in 
>>> size, 10 of those would be 800 MB, which is more than you have 
>>> allocated for RAM.
>
> And sure I mean about 54 Mb. :-)
>

If you aren't actively swapping (to check: vmstat 5) it probably isn't a 
big deal. If you are actively swapping, back it off some. Other 
processes on the box also need memory. You'll get greater performance 
from fewer children and no swapping than greater children and some 
swapping.
From ssilva at sgvwater.com  Fri May  4 23:17:32 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Fri May  4 23:17:55 2007
Subject: Clamav suggestions
In-Reply-To: <f1g5vt$pnt$1@sea.gmane.org>
References: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it>	<463B5E8A.2080400@sendit.nodak.edu>	<f1g4a4$ks8$1@sea.gmane.org>	<463B99DD.4020900@sendit.nodak.edu>
	<f1g5vt$pnt$1@sea.gmane.org>
Message-ID: <f1gbds$bjt$1@sea.gmane.org>

<<snip>>
>> You may want to decrease the number of MailScanner processes running
>> under Max Children. I've got a vmware guest with 1 GB of RAM. The host
>> is a dual socket dual core 3.2 GHz Xeon. We're not see any swap at all
>> running clamavmodule. However, I have Max Children set to 7. This
>> particular scanner handles internal mail only and scan times are only
>> a couple of seconds during the middle of the day with batch sizes of 1 or 
> 
> Max Children = 10 (which should be the recommended value with 2
> processors.)
> 
Don't forget the other recommendation: 1 GB ram  per processor, especially
with spamassassin.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From res at ausics.net  Fri May  4 23:29:56 2007
From: res at ausics.net (Res)
Date: Fri May  4 23:30:07 2007
Subject: SpamAssassin 3.2.0
In-Reply-To: <463B7C0C.9000004@evi-inc.com>
References: <463900B1.8080301@ecs.soton.ac.uk> <463B7C0C.9000004@evi-inc.com>
Message-ID: <Pine.LNX.4.64.0705050823120.3368@ebfjryy.nhfvpf.arg>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Fri, 4 May 2007, Matt Kettler wrote:

> 	URIDNSBL

I used to have this disabled for performance, for several versions, but as 
3.20 cries like a baby unless its enabled, RDJ and sa-update refuse to run 
because of found scores for non existant plugins, I must admit I only 
looked at it for 2 minutes, but decided it was not worth the effort and 
just enabled the plugin, until I have time to find what else now needs 
disabling to shut it up :) Might look at it again on monday morning.


- -- 

Cheers
Res

Vote for your favourite MTA at  http://polls.ausics.net/v3.php
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGO7PmsWhAmSIQh7MRAhCoAJ9Wqn9SbNyLdarLnUUv/InE1T4K0wCdGYoM
RDMoCPYan7wPupFNvfOAXGI=
=/S4d
-----END PGP SIGNATURE-----
From wilson.galafassi at gmail.com  Fri May  4 23:38:17 2007
From: wilson.galafassi at gmail.com (Wilson A. Galafassi Jr.)
Date: Fri May  4 23:38:32 2007
Subject: use mailscanner only for reports
Message-ID: <00a601c78e9c$eaa2f920$bfe8eb60$@com.br>


Hello.

It?s possible to use/configure mailscanner only for reporting mail traffic?
Thanks
Wilson


From mkettler at evi-inc.com  Fri May  4 23:39:07 2007
From: mkettler at evi-inc.com (Matt Kettler)
Date: Fri May  4 23:39:17 2007
Subject: SpamAssassin 3.2.0
In-Reply-To: <Pine.LNX.4.64.0705050823120.3368@ebfjryy.nhfvpf.arg>
References: <463900B1.8080301@ecs.soton.ac.uk> <463B7C0C.9000004@evi-inc.com>
	<Pine.LNX.4.64.0705050823120.3368@ebfjryy.nhfvpf.arg>
Message-ID: <463BB60B.3060608@evi-inc.com>

Res wrote:
> On Fri, 4 May 2007, Matt Kettler wrote:
> 
>>     URIDNSBL
> 
> I used to have this disabled for performance, for several versions, but
> as 3.20 cries like a baby unless its enabled, RDJ and sa-update refuse
> to run because of found scores for non existant plugins, I must admit I
> only looked at it for 2 minutes, but decided it was not worth the effort
> and just enabled the plugin, until I have time to find what else now
> needs disabling to shut it up :) Might look at it again on monday morning.
> 
> 

Sounds like a bug in the conditionals that disable parts of the ruleset.. I'll
look at it this weekend, time permitting.. If I can replicate it, I'll open a
bug with the SA dev team. If it's something I can make patches for, I'll do that
too.

From prandal at herefordshire.gov.uk  Fri May  4 23:54:29 2007
From: prandal at herefordshire.gov.uk (Randal, Phil)
Date: Fri May  4 23:54:42 2007
Subject: SpamAssassin 3.2.0
In-Reply-To: <463B7C0C.9000004@evi-inc.com>
References: <463900B1.8080301@ecs.soton.ac.uk> <463B7C0C.9000004@evi-inc.com>
Message-ID: <7EF0EE5CB3B263488C8C18823239BEBA03CECE@HC-MBX02.herefordshire.gov.uk>

The only thing which needs updating for a minimal install is Net::DNS up
a version or two from 0.57.

SA 3.2.0 will fall back to using Mail::SPF::Query if Mail::SPF is not
available.

However, I've been testing it with high volumes on an old Fedora Core 1
box and it's not happy - average message scan time is twice that of
3.1.8, and there's other weirdness.  One side effect is
MailScanner-mrtg's CPU load graph showing as zero when SA 3.2.0 is
struggling under load on this box (though the load averages aren't
higher than SA 3.1.8's under similar pressure).  I suspect something's
blocking when it shouldn't.

A mystery which I really don't have the time to investigate.

Cheers,

Phil

-----Original Message-----
From: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Matt
Kettler
Sent: 04 May 2007 19:32
To: MailScanner discussion
Subject: Re: SpamAssassin 3.2.0

Julian Field wrote:
> Well, as someone else has already said, it's been released.
> 
> Its list of requirements has grown quite a lot. In addition to
whatever
> else you already have from an existing SA install, you need to install
> this load of Perl modules, in this order:
> 
>       YAML -- requires y\n in perl Makefile.PL
>       ExtUtils::CBuilder
>       ExtUtils::ParseXS
>     Module::Build
>       version
>     Net::DNS::Resolver::Programmable
>     Error
>     NetAddr::IP
>     Net::DNS >=0.58
>     Data::Dump
>   Encode::Detect
>   Mail::SPF
> Mail::SpamAssassin -- requires \n in perl Makefile.PL
> 
> It puts in a v320.pre into /etc/mail/spamassassin and comes with a
load
> of new plugins. Some of them are loaded by the default supplied
v320.pre
> file, but here are the ones that aren't:
> 
>                           Hashcash.pm             Rule2XSBody.pm
> ASN.pm                                            SpamCop.pm
> AutoLearnThreshold.pm                             SPF.pm
> AWL.pm                                            Test.pm
>                                                   TextCat.pm
>                           MIMEHeader.pm
> BodyRuleBaseExtractor.pm  OneLineBodyRuleType.pm  URIDNSBL.pm
>                           Pyzor.pm
> DCC.pm                    Razor2.pm
>                           RelayCountry.pm         WhiteListSubject.pm
>                           ReplaceTags.pm

Julian, Some of those plugins ARE loaded by default, but are loaded via
older
.pre files. And yes, SA does parse *ALL* of the .pre files, and you need
to have
ALL of them to work properly.

The whole idea of the multiple .pre files is that as new plugins are
added, SA
doesn't have to do a config-merge. All it does is add the new .pre file
that
supports the new plugins. Your choices about what plugins from 3.1.0 or
3.0.0 to
load won't be affected, and will remain in-place in your old .pre files.

Of the above plugins:
init.pre (SA 3.0.0) loads:
	URIDNSBL
	SPF
v310.pre loads:
	Spamcop
	DCC (disabled by default)
	Pyzor
	Razor2
	AWL
	AutoLearnThreshold
	TextCat (disabled by default)
	WhiteListSubject
	MimeHeader
	ReplaceTags
	DomainKeys (disabled by default)
v312.pre loads:
	DKIM (disabled by default)

V320.pre only handles the new plugins for 3.2.0, most of which are
things that
used to be hard-coded into EvalTests.pm.


> 
> My next step is to read the man pages for all of these, and work out
> which ones you probably want to load and which ones you don't, so that
> my install script can set you up with a sensible system.

You really shouldn't have to do that for all of them. Only look at the
ones that
aren't loaded by default.

> One thing I'm
> not installing is support for DKIM which, although available, requires
> so many pre-requisites that it's not feasible for me to do here. You
> have to start at the OpenSSL libraries and work your way up :-(

Makes sense, that's a v312.pre thing.

> 
> Once I've got something working here, I'll write up an install script
> for it all and wrap it into a package for you.
> 
> Jules
> 
-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 
From amaclach at yahoo.co.uk  Sat May  5 00:03:48 2007
From: amaclach at yahoo.co.uk (Andrew MacLachlan)
Date: Sat May  5 00:03:50 2007
Subject: Clamav suggestions
Message-ID: <681587.85151.qm@web26302.mail.ukl.yahoo.com>

This is all very well, but make sure your host has enough memory and you have vmware-tools installed and running otherwise ESX will page for you if it's short of memory - and that isn't pretty...
CPU isn't that important with VMs - - I've never seen an ESX box max out it's processors unless it's already run out of physical memory.
 
Regards, 
Andrew MacLachlan



----- Original Message ----
From: Scott Silva <ssilva@sgvwater.com>
To: mailscanner@lists.mailscanner.info
Sent: Friday, 4 May, 2007 11:17:32 PM
Subject: Re: Clamav suggestions

<<snip>>
>> You may want to decrease the number of MailScanner processes running
>> under Max Children. I've got a vmware guest with 1 GB of RAM. The host
>> is a dual socket dual core 3.2 GHz Xeon. We're not see any swap at all
>> running clamavmodule. However, I have Max Children set to 7. This
>> particular scanner handles internal mail only and scan times are only
>> a couple of seconds during the middle of the day with batch sizes of 1 or 
> 
> Max Children = 10 (which should be the recommended value with 2
> processors.)
> 
Don't forget the other recommendation: 1 GB ram  per processor, especially
with spamassassin.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 




From mkettler at evi-inc.com  Sat May  5 00:14:57 2007
From: mkettler at evi-inc.com (Matt Kettler)
Date: Sat May  5 00:15:10 2007
Subject: use mailscanner only for reports
In-Reply-To: <00a601c78e9c$eaa2f920$bfe8eb60$@com.br>
References: <00a601c78e9c$eaa2f920$bfe8eb60$@com.br>
Message-ID: <463BBE71.9010505@evi-inc.com>

Wilson A. Galafassi Jr. wrote:
> Hello.
> 
> It?s possible to use/configure mailscanner only for reporting mail traffic?

I'm not entirely sure I understand the question.

MailScanner doesn't make any reports of a broad statistical nature, so you
couldn't use it to make "just" make them, since it doesn't do that at all.

Or are you looking to run mailscanner in some kind of way that detects mail
viruses and spam, but only reports this to the system admin and doesn't modify
the message?

Or something entirely different?
From mikej at rogers.com  Sat May  5 01:30:31 2007
From: mikej at rogers.com (Mike Jakubik)
Date: Sat May  5 01:32:28 2007
Subject: ANNOUNCE: MailScanner stable 4.59
In-Reply-To: <AEF86EFA5497434190F6D57E2666EA7A84EEC6@ERWIN.intern.seceidos.de>
References: <4635B2C4.50004@ecs.soton.ac.uk>
	<AEF86EFA5497434190F6D57E2666EA7A84EEC6@ERWIN.intern.seceidos.de>
Message-ID: <463BD027.3070009@rogers.com>

Koopmann, Jan-Peter wrote:
> On  SHA1 wrote:
>
>   
>> I have just released a new stable version, 4.59. The main new
>> features this month are 
>>
>>     
>
> FreeBSD port has just been submitted. Thanks Julian!
>   
Just in time before the ports freeze! Thanks! Speaking of the new 
version, has anyone tried Postfix 2.4 yet?

From bilias at edu.physics.uoc.gr  Sat May  5 01:52:48 2007
From: bilias at edu.physics.uoc.gr (Kapetanakis Giannis)
Date: Sat May  5 01:53:04 2007
Subject: use mailscanner only for reports
In-Reply-To: <00a601c78e9c$eaa2f920$bfe8eb60$@com.br>
References: <00a601c78e9c$eaa2f920$bfe8eb60$@com.br>
Message-ID: <Pine.LNX.4.64.0705050351480.2410@python.edu.physics.uoc.gr>

On Fri, 4 May 2007, Wilson A. Galafassi Jr. wrote:

> Hello.
>
> It?s possible to use/configure mailscanner only for reporting mail traffic?
> Thanks
> Wilson
>

Yes if you set the spam actions to deliver
and do not change the subject of the mail.

It will forward all mails, but it will first scan them
and report.

Giannis
From wilson.galafassi at gmail.com  Sat May  5 04:48:10 2007
From: wilson.galafassi at gmail.com (Wilson A. Galafassi Jr.)
Date: Sat May  5 04:48:28 2007
Subject: RES: use mailscanner only for reports
In-Reply-To: <463BBE71.9010505@evi-inc.com>
References: <00a601c78e9c$eaa2f920$bfe8eb60$@com.br>
	<463BBE71.9010505@evi-inc.com>
Message-ID: <00b201c78ec8$34cf4230$9e6dc690$@com.br>

Hello.

In this case i want to use mailscanner + mailwatch only to generate reports
using mailwatch. It?s possible? The messages are scanned for spam and
viruses in other (external) server, so my utilization is only for reports.

Thanks
wilson

-----Mensagem original-----
De: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] Em nome de Matt Kettler
Enviada em: sexta-feira, 4 de maio de 2007 20:15
Para: MailScanner discussion
Assunto: Re: use mailscanner only for reports

Wilson A. Galafassi Jr. wrote:
> Hello.
> 
> It?s possible to use/configure mailscanner only for reporting mail
traffic?

I'm not entirely sure I understand the question.

MailScanner doesn't make any reports of a broad statistical nature, so you
couldn't use it to make "just" make them, since it doesn't do that at all.

Or are you looking to run mailscanner in some kind of way that detects mail
viruses and spam, but only reports this to the system admin and doesn't
modify
the message?

Or something entirely different?
-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 

From dcmwai at pl.jaring.my  Sat May  5 08:26:27 2007
From: dcmwai at pl.jaring.my (Chan Min Wai)
Date: Sat May  5 08:27:16 2007
Subject: No Programs allowed
In-Reply-To: <1178113173.14147.16.camel@viper.mbl.is>
References: <1178113173.14147.16.camel@viper.mbl.is>
Message-ID: <463C31A3.6050102@pl.jaring.my>

Jon Bjorn Njalsson wrote:
> Why does MS think msg-26670-41.txt is a program ?
>
> MailScanner: No programs allowed (msg-26670-41.txt)
>
> regards
> Jon Bjorn
>
>   
I've face this problem once.
The solution was to change how files read it.

On my situation the files is encoded using UTF-8 in an email.

This is the solution suggested.

Create a scrip of
replace
File Command = /usr/local/bin/file

inside /usr/local/bin/file
/usr/bin/file -i $1


That will help to solve the issue.

Regards,
Min Wai
From res at ausics.net  Sat May  5 09:45:17 2007
From: res at ausics.net (Res)
Date: Sat May  5 09:45:30 2007
Subject: SpamAssassin 3.2.0
In-Reply-To: <463BB60B.3060608@evi-inc.com>
References: <463900B1.8080301@ecs.soton.ac.uk> <463B7C0C.9000004@evi-inc.com>
	<Pine.LNX.4.64.0705050823120.3368@ebfjryy.nhfvpf.arg>
	<463BB60B.3060608@evi-inc.com>
Message-ID: <Pine.LNX.4.64.0705051844320.2735@ebfjryy.nhfvpf.arg>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Thanks Matt
If you can't reproduce it let me know, it must point to something else
I've enabled I suppose.

On Fri, 4 May 2007, Matt Kettler wrote:

> Res wrote:
>> On Fri, 4 May 2007, Matt Kettler wrote:
>>
>>>     URIDNSBL
>>
>> I used to have this disabled for performance, for several versions, but
>> as 3.20 cries like a baby unless its enabled, RDJ and sa-update refuse
>> to run because of found scores for non existant plugins, I must admit I
>> only looked at it for 2 minutes, but decided it was not worth the effort
>> and just enabled the plugin, until I have time to find what else now
>> needs disabling to shut it up :) Might look at it again on monday morning.
>>
>>
>
> Sounds like a bug in the conditionals that disable parts of the ruleset.. I'll
> look at it this weekend, time permitting.. If I can replicate it, I'll open a
> bug with the SA dev team. If it's something I can make patches for, I'll do that
> too.
>
>

- -- 

Cheers
Res

Vote for your favourite MTA at  http://polls.ausics.net/v3.php
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGPEQfsWhAmSIQh7MRAqEBAJkB1hOne+klemVn33sHeLZe0FeShgCeJddM
kvkigsKxFjkoNwAYsJWCzvM=
=z2L8
-----END PGP SIGNATURE-----
From MailScanner at ecs.soton.ac.uk  Sat May  5 12:26:51 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Sat May  5 12:27:23 2007
Subject: Clamav suggestions
In-Reply-To: <f1g4a4$ks8$1@sea.gmane.org>
References: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it>	<463B5E8A.2080400@sendit.nodak.edu>
	<f1g4a4$ks8$1@sea.gmane.org>
Message-ID: <463C69FB.7080301@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Arto wrote:
> Richard Frovarp wrote:
>> Fabio Pedretti wrote:
>>>
>>> 3) Support for clamd trough clamdscan is nice, however, best would 
>>> be to connect to clamd directly to its socket (or network socket) 
>>> from MailScanner, without call clamdscan, and fallback to clamscan 
>>> if clamd is not working. 
>>
>> Why not just run clamavmodule? From my understanding, the support for 
>> clamd was added so that those that didn't want to keep up with the 
>> Perl module required for clamavmodule would have something faster 
>> than clamscan. Any direct call to clamd from MailScanner would 
>> require a Perl module, so at that point you're losing the 
>> requirements benefit of running clamd.
>
> FYI, we have used all of those during last three weeks. First clamav 
> (indeed about two year before this period), then clamavmodule and 
> during this week clamd.
>
> Our MX server passes normally about 10k mails/day (MS, postgrey, 
> postfix and SA) and clamd is IMHO the most comfortable as regards 
> load, memory and swap. The server is a vmware client (CentOS4.4 ) with 
> 2 x 2,4 GHz and 775 Mb memory reserved to client. After start the swap 
> is with clamd under 40 Mb and it will remain there. With clamavmodule 
> and clamav the swap varies from 40 to 400 Mb and the load can be even 
> over 20 with clamav.
With 2 CPU's I would recommend 2Gb of RAM and not just 775Mb. With that 
little, it's bound to swap. And swapping in a VM is very slow. Either 
give your VM a lot more RAM or decrease Max Children by quite a bit.

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGPGoAEfZZRxQVtlQRArjuAJ0TLXKwPWs13OpgD7ZjNc2ZSiIqMACeIK9m
pR2Q7BOP/jy6kF/JJgDxpCY=
=Ypaq
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From MailScanner at ecs.soton.ac.uk  Sat May  5 12:42:06 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Sat May  5 12:42:40 2007
Subject: SpamAssassin 3.2.0 package
Message-ID: <463C6D8E.5040802@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

My first version of a ClamAV + SpamAssassin 3.2.0 package is here:
http://www.mailscanner.info/files/4/install-Clam-0.90.2-SA-3.2.0.tar.gz

Please give it a try and tell me what you think.

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGPG2SEfZZRxQVtlQRAp04AKDzcrpqjt9PQy1elmLrZ3brZ6n52QCg4XKf
vKBeYc0ONuI/vrut9Eur8Yo=
=fmSq
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From hvdkooij at vanderkooij.org  Sat May  5 14:33:29 2007
From: hvdkooij at vanderkooij.org (Hugo van der Kooij)
Date: Sat May  5 14:34:06 2007
Subject: RES: use mailscanner only for reports
In-Reply-To: <00b201c78ec8$34cf4230$9e6dc690$@com.br>
References: <00a601c78e9c$eaa2f920$bfe8eb60$@com.br>
	<463BBE71.9010505@evi-inc.com>
	<00b201c78ec8$34cf4230$9e6dc690$@com.br>
Message-ID: <Pine.LNX.4.64.0705051528590.30796@faramir.hugo.vanderkooij.org>

On Sat, 5 May 2007, Wilson A. Galafassi Jr. wrote:

> In this case i want to use mailscanner + mailwatch only to generate reports
> using mailwatch. It?s possible? The messages are scanned for spam and
> viruses in other (external) server, so my utilization is only for reports.

Just select deliver for all classes and be done with it.

But I fail to see the use of this. Are the other solutions soo poor they 
can not provide you with this information?

Why not park them outside next to the dustbin and let MailScanner + 
MailWatch do the job for you?

Hugo.

-- 
 	hvdkooij@vanderkooij.org	http://hugo.vanderkooij.org/
 	    This message is using 100% recycled electrons.

 	Some men see computers as they are and say "Windows"
 	I use computers with Linux and say "Why Windows?"
 		(Thanks JFK, for the insight.)
From hvdkooij at vanderkooij.org  Sat May  5 14:45:46 2007
From: hvdkooij at vanderkooij.org (Hugo van der Kooij)
Date: Sat May  5 14:46:22 2007
Subject: RES: use mailscanner only for reports
In-Reply-To: <00b201c78ec8$34cf4230$9e6dc690$@com.br>
References: <00a601c78e9c$eaa2f920$bfe8eb60$@com.br>
	<463BBE71.9010505@evi-inc.com>
	<00b201c78ec8$34cf4230$9e6dc690$@com.br>
Message-ID: <Pine.LNX.4.64.0705051543160.30796@faramir.hugo.vanderkooij.org>

On Sat, 5 May 2007, Wilson A. Galafassi Jr. wrote:

> In this case i want to use mailscanner + mailwatch only to generate reports
> using mailwatch. It?s possible? The messages are scanned for spam and
> viruses in other (external) server, so my utilization is only for reports.

And here is an afterthought. What do you expect to learn if someone 
cleared out the wrong messages before they get to you?

Then how can you tell the rate of SPAM vs HAM messages? Or how many three 
year old virus junk was taken from your SMTP stream.

Hugo.

-- 
 	hvdkooij@vanderkooij.org	http://hugo.vanderkooij.org/
 	    This message is using 100% recycled electrons.

 	Some men see computers as they are and say "Windows"
 	I use computers with Linux and say "Why Windows?"
 		(Thanks JFK, for the insight.)
From exp at protos.mine.nu  Sat May  5 16:10:52 2007
From: exp at protos.mine.nu (Hans Bergman)
Date: Sat May  5 16:11:29 2007
Subject: SpamAssassin 3.2.0 package
In-Reply-To: <463C6D8E.5040802@ecs.soton.ac.uk>
References: <463C6D8E.5040802@ecs.soton.ac.uk>
Message-ID: <463C9E7C.7040600@protos.mine.nu>

Julian Field skrev:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> My first version of a ClamAV + SpamAssassin 3.2.0 package is here:
> http://www.mailscanner.info/files/4/install-Clam-0.90.2-SA-3.2.0.tar.gz
>
> Please give it a try and tell me what you think.
>
> Jules
>
> - -- 
> Julian Field MEng CITP
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> MailScanner customisation, or any advanced system administration help?
> Contact me at Jules@Jules.FM
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> For all your IT requirements visit www.transtec.co.uk
>
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGP Desktop 9.6.1 (Build 1012)
> Charset: ISO-8859-1
>
> wj8DBQFGPG2SEfZZRxQVtlQRAp04AKDzcrpqjt9PQy1elmLrZ3brZ6n52QCg4XKf
> vKBeYc0ONuI/vrut9Eur8Yo=
> =fmSq
> -----END PGP SIGNATURE-----
>
>   

(1) Africa
(2) Asia
(3) Central America
(4) Europe
(5) North America
(6) Oceania
(7) South America
Select your continent (or several nearby continents) []
Sorry! since you don't have any existing picks, you must make a
geographic selection.

(1) Africa
(2) Asia
(3) Central America
(4) Europe
(5) North America
(6) Oceania
(7) South America
Select your continent (or several nearby continents) []
Sorry! since you don't have any existing picks, you must make a
geographic selection.

(1) Africa
(2) Asia
(3) Central America
(4) Europe
(5) North America
(6) Oceania
(7) South America
Select your continent (or several nearby continents) []
Sorry! since you don't have any existing picks, you must make a
geographic selection.

Loops here!!


-- 
Meddelandet har kontrollerats mot virus samt skadligt 
inneh?ll av MailScanner och f?rmodas vara s?kert.

From rcooper at dwford.com  Sat May  5 16:27:52 2007
From: rcooper at dwford.com (Rick Cooper)
Date: Sat May  5 16:27:59 2007
Subject: Clamav suggestions
In-Reply-To: <463B5E8A.2080400@sendit.nodak.edu>
References: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it>
	<463B5E8A.2080400@sendit.nodak.edu>
Message-ID: <085b01c78f29$f30cc540$0301a8c0@SAHOMELT>

 

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info 
> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf 
> Of Richard Frovarp
> Sent: Friday, May 04, 2007 12:26 PM
> To: MailScanner discussion
> Subject: Re: Clamav suggestions
> 
> Fabio Pedretti wrote:
> >
> > 3) Support for clamd trough clamdscan is nice, however, 
> best would be 
> > to connect to clamd directly to its socket (or network socket) from 
> > MailScanner, without call clamdscan, and fallback to 
> clamscan if clamd 
> > is not working. 
> 
> Why not just run clamavmodule? From my understanding, the support for 
> clamd was added so that those that didn't want to keep up 
> with the Perl 
> module required for clamavmodule would have something faster than 
> clamscan. Any direct call to clamd from MailScanner would 
> require a Perl 
> module, so at that point you're losing the requirements benefit of 
> running clamd.
[..]

That isn't really accurate. When I remove the clamavmodule scanner from
MailScanner I gain about 78mg of ram (with 3 children) which is certainly a
benefit. Unless the clam team completely revises their clamd protocol (which
hasn't happened as long as I can remember) then there is no concern about
core library changes that break clamavmodule, another benefit. Unless the
team changed the output regarding viruses detected a direct call would just
work. 

I am in the process of incorporating a direct call to ClamD via sockets into
my own MailScanner installs and it wouldn't require additional modules
beyond IO::Socket::UNIX (could be done with just Socket but I prefer the
IO::Socket::UNIX wrapper). Also handles both Unix sockets as well as Inet
sockets. 

The benefit for someone like me is I use clamd with exim, so it's already
running and wouldn't require additional resources and it's very fast (faster
than calling clamdscan). It wouldn't require MailScanner to watch the clam
data files as the freshclam process already notifies clamd as to changes.
Anyone who is using clamdscan would certainly benefit by calling clamd
directly rather than via any of the wrappers.

As far as fallback is concerned I am inclined to add an options for a
restart script if clamd is found to be down, or doesn't respond (properly)
to PING. I have been very busy the last few months so I haven't gotten past
a stand alone proof of concept perl program, but I am hoping to have it
integrated in the next week or so time permitting. If Julian is interested I
would certainly send patches to the list when I am satisfied.

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


From wilson.galafassi at gmail.com  Sat May  5 16:50:37 2007
From: wilson.galafassi at gmail.com (Wilson A. Galafassi Jr.)
Date: Sat May  5 16:50:57 2007
Subject: RES: RES: use mailscanner only for reports
In-Reply-To: <Pine.LNX.4.64.0705051543160.30796@faramir.hugo.vanderkooij.org>
References: <00a601c78e9c$eaa2f920$bfe8eb60$@com.br>	<463BBE71.9010505@evi-inc.com>	<00b201c78ec8$34cf4230$9e6dc690$@com.br>
	<Pine.LNX.4.64.0705051543160.30796@faramir.hugo.vanderkooij.org>
Message-ID: <001a01c78f2d$21b6d900$65248b00$@com.br>

My external (valid) email Server Just use mailscanner to identify and block
spam and viruses. I need to use the reports of mailwatch in the internal
Server to catch all email traffic including local mail traffic. You
understand me?
Thanks
Wilson


-----Mensagem original-----
De: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] Em nome de Hugo van der
Kooij
Enviada em: s?bado, 5 de maio de 2007 10:46
Para: MailScanner discussion
Assunto: Re: RES: use mailscanner only for reports

On Sat, 5 May 2007, Wilson A. Galafassi Jr. wrote:

> In this case i want to use mailscanner + mailwatch only to generate 
> reports using mailwatch. It?s possible? The messages are scanned for 
> spam and viruses in other (external) server, so my utilization is only for
reports.

And here is an afterthought. What do you expect to learn if someone cleared
out the wrong messages before they get to you?

Then how can you tell the rate of SPAM vs HAM messages? Or how many three
year old virus junk was taken from your SMTP stream.

Hugo.

-- 
 	hvdkooij@vanderkooij.org	http://hugo.vanderkooij.org/
 	    This message is using 100% recycled electrons.

 	Some men see computers as they are and say "Windows"
 	I use computers with Linux and say "Why Windows?"
 		(Thanks JFK, for the insight.)

From MailScanner at ecs.soton.ac.uk  Sat May  5 17:14:08 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Sat May  5 17:15:13 2007
Subject: SpamAssassin 3.2.0 package
In-Reply-To: <463C9E7C.7040600@protos.mine.nu>
References: <463C6D8E.5040802@ecs.soton.ac.uk>
	<463C9E7C.7040600@protos.mine.nu>
Message-ID: <463CAD50.3050806@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I have fixed this one. Module::Build was after 
Net::DNS::Resolver::Programmable instead of being before it.
I have updated the package on the website. You should find this new one 
works just fine.


Hans Bergman wrote:
> Julian Field skrev:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> My first version of a ClamAV + SpamAssassin 3.2.0 package is here:
>> http://www.mailscanner.info/files/4/install-Clam-0.90.2-SA-3.2.0.tar.gz
>>
>> Please give it a try and tell me what you think.
>>
>> Jules
>>
>> - -- Julian Field MEng CITP
>> www.MailScanner.info
>> Buy the MailScanner book at www.MailScanner.info/store
>>
>> MailScanner customisation, or any advanced system administration help?
>> Contact me at Jules@Jules.FM
>>
>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>> For all your IT requirements visit www.transtec.co.uk
>>
>>
>>
>> -----BEGIN PGP SIGNATURE-----
>> Version: PGP Desktop 9.6.1 (Build 1012)
>> Charset: ISO-8859-1
>>
>> wj8DBQFGPG2SEfZZRxQVtlQRAp04AKDzcrpqjt9PQy1elmLrZ3brZ6n52QCg4XKf
>> vKBeYc0ONuI/vrut9Eur8Yo=
>> =fmSq
>> -----END PGP SIGNATURE-----
>>
>>   
>
> (1) Africa
> (2) Asia
> (3) Central America
> (4) Europe
> (5) North America
> (6) Oceania
> (7) South America
> Select your continent (or several nearby continents) []
> Sorry! since you don't have any existing picks, you must make a
> geographic selection.
>
> (1) Africa
> (2) Asia
> (3) Central America
> (4) Europe
> (5) North America
> (6) Oceania
> (7) South America
> Select your continent (or several nearby continents) []
> Sorry! since you don't have any existing picks, you must make a
> geographic selection.
>
> (1) Africa
> (2) Asia
> (3) Central America
> (4) Europe
> (5) North America
> (6) Oceania
> (7) South America
> Select your continent (or several nearby continents) []
> Sorry! since you don't have any existing picks, you must make a
> geographic selection.
>
> Loops here!!
>
>

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGPK10EfZZRxQVtlQRAkUsAJ4ouodrQgW3jMASSEy6w4da9jUZKACcDr0L
LbPeS6xQws9UwvD8j42l/2Q=
=9TZw
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From MailScanner at ecs.soton.ac.uk  Sat May  5 17:22:40 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Sat May  5 17:25:11 2007
Subject: Clamav suggestions
In-Reply-To: <085b01c78f29$f30cc540$0301a8c0@SAHOMELT>
References: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it>	<463B5E8A.2080400@sendit.nodak.edu>
	<085b01c78f29$f30cc540$0301a8c0@SAHOMELT>
Message-ID: <463CAF50.8030305@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Rick Cooper wrote:
>
> I am in the process of incorporating a direct call to ClamD via sockets into
> my own MailScanner installs and it wouldn't require additional modules
> beyond IO::Socket::UNIX (could be done with just Socket but I prefer the
> IO::Socket::UNIX wrapper). Also handles both Unix sockets as well as Inet
> sockets. 
>
> The benefit for someone like me is I use clamd with exim, so it's already
> running and wouldn't require additional resources and it's very fast (faster
> than calling clamdscan). It wouldn't require MailScanner to watch the clam
> data files as the freshclam process already notifies clamd as to changes.
> Anyone who is using clamdscan would certainly benefit by calling clamd
> directly rather than via any of the wrappers.
>
> As far as fallback is concerned I am inclined to add an options for a
> restart script if clamd is found to be down, or doesn't respond (properly)
> to PING. I have been very busy the last few months so I haven't gotten past
> a stand alone proof of concept perl program, but I am hoping to have it
> integrated in the next week or so time permitting. If Julian is interested I
> would certainly send patches to the list when I am satisfied.
>   
Yes, I welcome any contribution, so long as the patch isn't *too* big! :-)
Please try to keep your patch as self-contained as possible, so you 
just, for example, rewrite the init code for the clamd parser and the 
output parser itself. Please just make it as clean and modular as you 
can. You can see from the rest of the code the type of Perl I write. I 
use the syntactical short-cut facilities in the language, I don't just 
write Java/C in Perl the way a lot of people do. And please don't feel 
upset if I take your code and appear to rewrite it :-)

Thanks,
Jules.

> Rick
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
>
>   

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGPK/MEfZZRxQVtlQRAlsXAKCFibv5MLP/+fZwto6JByw3nPt5JQCgyiBU
9TPh91uiEs2IfTSOU4Tf9dA=
=DRtW
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From MailScanner at ecs.soton.ac.uk  Sat May  5 18:04:37 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Sat May  5 18:05:14 2007
Subject: SpamAssassin 3.2.0 package
In-Reply-To: <463CAD50.3050806@ecs.soton.ac.uk>
References: <463C6D8E.5040802@ecs.soton.ac.uk>	<463C9E7C.7040600@protos.mine.nu>
	<463CAD50.3050806@ecs.soton.ac.uk>
Message-ID: <463CB925.2050609@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I have done some basic tests with my SpamAssassin 3.2.0 package and 
MailScanner 4.59 and it is working fine.

I'll do some more tests of it and probably start using it on a 
production machine tomorrow if I feel so inclined (and there again I 
might well just put my feet up and watch TV). It's a public holiday this 
weekend (I think!) so by definition it should rain on Monday at least. :-)

Jules.


Julian Field wrote:
> * PGP Signed: 05/05/07 at 17:14:44
>
> I have fixed this one. Module::Build was after 
> Net::DNS::Resolver::Programmable instead of being before it.
> I have updated the package on the website. You should find this new 
> one works just fine.
>
>
> Hans Bergman wrote:
>> Julian Field skrev:
>>> -----BEGIN PGP SIGNED MESSAGE-----
>>> Hash: SHA1
>>>
>>> My first version of a ClamAV + SpamAssassin 3.2.0 package is here:
>>> http://www.mailscanner.info/files/4/install-Clam-0.90.2-SA-3.2.0.tar.gz
>>>
>>> Please give it a try and tell me what you think.
>>>
>>> Jules
>>>
>>> - -- Julian Field MEng CITP
>>> www.MailScanner.info
>>> Buy the MailScanner book at www.MailScanner.info/store
>>>
>>> MailScanner customisation, or any advanced system administration help?
>>> Contact me at Jules@Jules.FM
>>>
>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>> For all your IT requirements visit www.transtec.co.uk
>>>
>>>
>>>
>>> -----BEGIN PGP SIGNATURE-----
>>> Version: PGP Desktop 9.6.1 (Build 1012)
>>> Charset: ISO-8859-1
>>>
>>> wj8DBQFGPG2SEfZZRxQVtlQRAp04AKDzcrpqjt9PQy1elmLrZ3brZ6n52QCg4XKf
>>> vKBeYc0ONuI/vrut9Eur8Yo=
>>> =fmSq
>>> -----END PGP SIGNATURE-----
>>>
>>>   
>>
>> (1) Africa
>> (2) Asia
>> (3) Central America
>> (4) Europe
>> (5) North America
>> (6) Oceania
>> (7) South America
>> Select your continent (or several nearby continents) []
>> Sorry! since you don't have any existing picks, you must make a
>> geographic selection.
>>
>> (1) Africa
>> (2) Asia
>> (3) Central America
>> (4) Europe
>> (5) North America
>> (6) Oceania
>> (7) South America
>> Select your continent (or several nearby continents) []
>> Sorry! since you don't have any existing picks, you must make a
>> geographic selection.
>>
>> (1) Africa
>> (2) Asia
>> (3) Central America
>> (4) Europe
>> (5) North America
>> (6) Oceania
>> (7) South America
>> Select your continent (or several nearby continents) []
>> Sorry! since you don't have any existing picks, you must make a
>> geographic selection.
>>
>> Loops here!!
>>
>>
>
> Jules
>

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGPLktEfZZRxQVtlQRAhbVAKChfm6CpXtG2gYYgOrV07TNCSORnwCgiuQU
VONO85De2EEz10EOxYYkcNM=
=d69x
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From rcooper at dwford.com  Sat May  5 19:23:22 2007
From: rcooper at dwford.com (Rick Cooper)
Date: Sat May  5 19:24:39 2007
Subject: Clamav suggestions
In-Reply-To: <463CAF50.8030305@ecs.soton.ac.uk>
References: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it>	<463B5E8A.2080400@sendit.nodak.edu><085b01c78f29$f30cc540$0301a8c0@SAHOMELT>
	<463CAF50.8030305@ecs.soton.ac.uk>
Message-ID: <089801c78f42$78529500$0301a8c0@SAHOMELT>

 

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info 
> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf 
> Of Julian Field
> Sent: Saturday, May 05, 2007 12:23 PM
> To: MailScanner discussion
> Subject: Re: Clamav suggestions
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
[...]

> Yes, I welcome any contribution, so long as the patch isn't 
> *too* big! :-)
> Please try to keep your patch as self-contained as possible, so you 
> just, for example, rewrite the init code for the clamd parser and the 
> output parser itself. Please just make it as clean and modular as you 
> can. You can see from the rest of the code the type of Perl I 
> write. I 
> use the syntactical short-cut facilities in the language, I 
> don't just 
> write Java/C in Perl the way a lot of people do. And please 
> don't feel 
> upset if I take your code and appear to rewrite it :-)
> 
> Thanks,
> Jules.
> 

I will have to try and rememeber the program flow, and look at the
clamavmodule code and how it's called because this would work pretty much
the same. It would be easy enough to make the output the same as the
clamavmodule output so the same parser could be used if the current parser
had some minor changes such as MailScanner::Log::InfoLog("ClamAVModule:: to
MailScanner::Log::InfoLog("$Name:: would it not? I have already tried to
make the code more like yours (from my unrar experience) such as "last if
time > $TimeOut;" or "LogIt("ClamD Timed Out!\n") if $TimeOut < time &&
$Debug;". In any event you know I don't care if you rewrite everything..
It's your program ;-) The size should be pretty fair, the current stand
alone proof of concept code is only 144 lines including a Logging function,
line comments, 18 lines of description comments, the various "use "
statements and debug and blank lines. I would expect the finished MS ready
code would be half that, maybe less (even with comments). There would, of
course, be additional config lines. I would expect you should have:
	clamd socket (IpAddr or full path to socket file)
	clamd port default 3310
	clamd lock file (to check if clamd is even running)
	clamd timeout 

And would you want to scan an entire batch at once, or one message/dir at a
time? I can even send you the stand alone code I have an let you play with
it at your leasure if you wish.

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


From alden at engineno9inc.com  Sat May  5 20:12:57 2007
From: alden at engineno9inc.com (Alden Levy)
Date: Sat May  5 20:13:07 2007
Subject: SMPID vs. INPID
Message-ID: <002101c78f49$651fdcc0$5a01a8c0@AldenLap>

I had a problem a long time ago on my old server that never got solved;
unfortunately, it's reared it's ugly head on the new server (I had to copy
over a file from the old server), and I'd like to put it to bed for good.

Basically, when I start MS, all works well, but when I check status, I get
an error 
# service MailScanner status
Checking MailScanner daemons:
         MailScanner:                                      [  OK  ]
         incoming sendmail:                                [ FAIL ]
         outgoing sendmail:                                [  OK  ]

However, it works fine as it is.  In order to get rid of the fail, though,
I've been updating sendmail.in.pid with the proper pid, and everything
works.

I finally had a few minutes to track down the issue, and it seems that
something (I did something??) confused SMPID and INPID in
MailScanner_app_init.

The relevant code is:
In StartInSendmail:
      elif [ $MTA = 'sendmail' ]; then
        /usr/bin/newaliases > /dev/null 2>&1
        if test -x /usr/bin/make -a -f /etc/mail/Makefile ; then
            make -C /etc/mail -s
        else
            for i in virtusertable access domaintable mailertable ; do
                if [ -f /etc/mail/$i ] ; then
                    makemap hash /etc/mail/$i < /etc/mail/$i
                fi
            done
        fi
        $SENDMAIL -bd -OPrivacyOptions=noetrn \
                      -ODeliveryMode=queueonly \
                      -OQueueDirectory=$INQDIR \
                      -OPidFile=$INPID
        touch /var/run/sm-client.pid
        chown $MSPUSER:$MSPGROUP /var/run/sm-client.pid 2>/dev/null
        $SENDMAIL -L sm-msp-queue -Ac -q15m -OPidFile=$SMPID 2>/dev/null
        success
        echo
 
And in status:
  status)
        # Work out if all of MailScanner is running
        echo    'Checking MailScanner daemons:'
        echo -n '         MailScanner:       '
        pid=`pidofproc MailScanner`
        if [ -z "$pid" ] ; then failure; else success; fi
        echo
        if [ $MTA = "sendmail" ]; then
          # Now the incoming sendmail
          echo -n '         incoming sendmail: '
          pid=`head -1 $INPID`
          alive=`ps ax | awk '{ print $1 }' | grep '^'$pid'$'`
          #pid=`ps ax | egrep '\[sendmail\]|sendmai[l]: accepting
connections'`
          if [ -z "$alive" ] ; then failure; else success; fi
          echo
 

Please note that both $INPID and $SMPID (as well as /var/run/sm-client.pid)
are referenced in StartInSendmail and only $INPID is checked in status.

Any help would be greatly appreciated.

For the record, I am running MS 4.68.9-1 and SA 3.18 on CentOS 4.4.

Thanks,
Alden

Alden Levy
Engine No. 9, Inc.
130 W. 57th Street, Suite 2F
New York, NY 10019
(212) 981-1122
(212) 504-9598 fax

From amaclach at yahoo.co.uk  Sun May  6 00:55:38 2007
From: amaclach at yahoo.co.uk (Andrew MacLachlan)
Date: Sun May  6 00:55:40 2007
Subject: Strange clamd messages
Message-ID: <711094.52154.qm@web26308.mail.ukl.yahoo.com>

Has anyone experienced anything like this with clamd?
It appears to be working but I'm concerned by the lstat() message...

May  5 12:28:25 mail-gw MailScanner[1774]: Virus and Content Scanning: Starting
May  5 12:28:25 mail-gw clamd[1543]: No stats for Database check - forcing reload
May  5 12:28:25 mail-gw clamd[1543]: Reading databases from /var/lib/clamav
May  5 12:28:27 mail-gw MailScanner[1774]: /var/spool/MailScanner/incoming/1774/.: lstat() failed. ERROR
May  5 12:28:28 mail-gw MailScanner[1774]: Requeue: 5CE7527F11.91A87 to 9E60927F21
May  5 12:28:28 mail-gw MailScanner[1774]: Uninfected: Delivered 1 messages

clamd is 0.90.2-1 on FC4

Cheers,
Andy

From r.berber at computer.org  Sun May  6 01:47:46 2007
From: r.berber at computer.org (=?ISO-8859-1?Q?Ren=E9_Berber?=)
Date: Sun May  6 01:46:53 2007
Subject: Strange clamd messages
In-Reply-To: <711094.52154.qm@web26308.mail.ukl.yahoo.com>
References: <711094.52154.qm@web26308.mail.ukl.yahoo.com>
Message-ID: <f1j8fn$7c4$1@sea.gmane.org>

Andrew MacLachlan wrote:

> Has anyone experienced anything like this with clamd?
> It appears to be working but I'm concerned by the lstat() message...
> 
> May  5 12:28:25 mail-gw MailScanner[1774]: Virus and Content Scanning: Starting
> May  5 12:28:25 mail-gw clamd[1543]: No stats for Database check - forcing reload
> May  5 12:28:25 mail-gw clamd[1543]: Reading databases from /var/lib/clamav
> May  5 12:28:27 mail-gw MailScanner[1774]: /var/spool/MailScanner/incoming/1774/.: lstat() failed. ERROR
> May  5 12:28:28 mail-gw MailScanner[1774]: Requeue: 5CE7527F11.91A87 to 9E60927F21
> May  5 12:28:28 mail-gw MailScanner[1774]: Uninfected: Delivered 1 messages

Is not working, and the problem are permissions: clamd cannot see what's in the 
incomming directory, much less test it.
-- 
Ren? Berber

From jimc at laridian.com  Sun May  6 02:56:38 2007
From: jimc at laridian.com (Jim Coates)
Date: Sun May  6 03:01:08 2007
Subject: MailScanner failing to deliver
In-Reply-To: <f1j8fn$7c4$1@sea.gmane.org>
Message-ID: <060701c78f81$c8fdae10$6501a8c0@zorak>

Hey all...

My host had to upgrade some things on our server and in the process upgraded
MailScanner to the latest available from the ports tree (FreeBSD).

The version is 4.50.15.

Since the upgrade, its been having issues... it seems to receive email (I
can tail the maillog and see stuff coming in), but it only delivers inbound
and outbound for a short period of time.  I then have to restart
MailScanner, and it will once again deliver for just a short period of time.

Another oddity... when tailing the maillog, I see MailScanne start multiple
times... IE - it puts up the version info and the number of messages in
queue etc... then a few seconds later I see the same thing twice more.

Any ideas?  I wasn't having these issues at all with the older version of
MailScanner that I was running.

Thank you in advance,
Jim Coates

From jimc at laridian.com  Sun May  6 05:04:12 2007
From: jimc at laridian.com (Jim Coates)
Date: Sun May  6 05:09:56 2007
Subject: MailScanner failing to deliver
Message-ID: <06a301c78f93$9cd5cbd0$6501a8c0@zorak>

I'm reposting this simply because I accidentally tagged it onto another
thread.. sorry:
 
 
Hey all...
 
My host had to upgrade some things on our server and in the process upgraded
MailScanner to the latest available from the ports tree (FreeBSD).  The
version is 4.50.15.
 
Since the upgrade, its been having issues... it seems to receive email (I
can tail the maillog and see stuff coming in), but it only delivers inbound
and outbound for a short period of time. I then have to restart MailScanner,
and it will once again deliver for just a short period of time.
 
When it restarts (and seemingly before it fails too) there are a group of
messages that get processed over and over.
 
Another oddity... when tailing the maillog, I see MailScanner start multiple
times... IE - it puts up the version info and the number of messages in
queue etc... then a few seconds later I see the same thing twice more.
 
Any ideas? I wasn't having these issues at all with the older version of
MailScanner that I was running.
 
NEW INFORMATION: when I do a "mailscanner --lint" it tells me the following:
 
mail2# mailscanner --lint
Read 701 hostnames from the phishing whitelist
Config: calling custom init function MailWatchLogging
Cannot write pid file , No such file or directory at
/usr/local/sbin/mailscanner line 1238
Checking for SpamAssassin errors (if you use it)...
Using SpamAssassin results cache
Connected to SpamAssassin cache database
SpamAssassin reported no errors.
MailScanner.conf says "Virus Scanners = clamav"
Found these virus scanners installed: clamavmodule
mail2#

I also had MailWatch installed, but the host recently upgraded MySQL and it
has not worked since then.  Not sure what the cause is or if its adding to
this trouble.  I do get a considerable amount of :
 
May  5 22:56:57 mail2 MailScanner[98183]: Started SQL Logging child
May  5 22:56:57 mail2 MailScanner[98106]: Started SQL Logging child
May  5 22:56:58 mail2 MailScanner[58029]: Started SQL Logging child
May  5 22:57:00 mail2 MailScanner[96343]: Started SQL Logging child
May  5 22:57:08 mail2 MailScanner[98200]: Started SQL Logging child

Basically I am having to restart it about every 30 minutes right now, so I'd
love any help you can give me.
 
Thank you in advance,
Jim Coates
 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070505/91d2265c/attachment.html
From hvdkooij at vanderkooij.org  Sun May  6 09:05:17 2007
From: hvdkooij at vanderkooij.org (Hugo van der Kooij)
Date: Sun May  6 09:05:49 2007
Subject: MailScanner failing to deliver
In-Reply-To: <06a301c78f93$9cd5cbd0$6501a8c0@zorak>
References: <06a301c78f93$9cd5cbd0$6501a8c0@zorak>
Message-ID: <Pine.LNX.4.64.0705061000580.8847@faramir.hugo.vanderkooij.org>

On Sat, 5 May 2007, Jim Coates wrote:

> My host had to upgrade some things on our server and in the process upgraded
> MailScanner to the latest available from the ports tree (FreeBSD).  The
> version is 4.50.15.
>
> Since the upgrade, its been having issues... it seems to receive email (I
> can tail the maillog and see stuff coming in), but it only delivers inbound
> and outbound for a short period of time. I then have to restart MailScanner,
> and it will once again deliver for just a short period of time.
>
> When it restarts (and seemingly before it fails too) there are a group of
> messages that get processed over and over.
>
> Another oddity... when tailing the maillog, I see MailScanner start multiple
> times... IE - it puts up the version info and the number of messages in
> queue etc... then a few seconds later I see the same thing twice more.
>
> Any ideas? I wasn't having these issues at all with the older version of
> MailScanner that I was running.
>
> NEW INFORMATION: when I do a "mailscanner --lint" it tells me the following:
>
> mail2# mailscanner --lint
> Read 701 hostnames from the phishing whitelist
> Config: calling custom init function MailWatchLogging
> Cannot write pid file , No such file or directory at
> /usr/local/sbin/mailscanner line 1238

I suggest you check this out and fix what is required to be fixed.

> Checking for SpamAssassin errors (if you use it)...
> Using SpamAssassin results cache
> Connected to SpamAssassin cache database
> SpamAssassin reported no errors.
> MailScanner.conf says "Virus Scanners = clamav"
> Found these virus scanners installed: clamavmodule
> mail2#
>
> I also had MailWatch installed, but the host recently upgraded MySQL and it
> has not worked since then.  Not sure what the cause is or if its adding to
> this trouble.  I do get a considerable amount of :
>
> May  5 22:56:57 mail2 MailScanner[98183]: Started SQL Logging child
> May  5 22:56:57 mail2 MailScanner[98106]: Started SQL Logging child
> May  5 22:56:58 mail2 MailScanner[58029]: Started SQL Logging child
> May  5 22:57:00 mail2 MailScanner[96343]: Started SQL Logging child
> May  5 22:57:08 mail2 MailScanner[98200]: Started SQL Logging child
>
> Basically I am having to restart it about every 30 minutes right now, so I'd
> love any help you can give me.

If MailWatch is not working there is nothing to be lost from removing the 
MailWatch line(s) from your config now. See if it is degrading your 
MailScanner  functionality.

Did you go over the changelog to see if things changed from your old 
version to your current one?

Hugo.

-- 
 	hvdkooij@vanderkooij.org	http://hugo.vanderkooij.org/
 	    This message is using 100% recycled electrons.

 	Some men see computers as they are and say "Windows"
 	I use computers with Linux and say "Why Windows?"
 		(Thanks JFK, for the insight.)
From amaclach at yahoo.co.uk  Sun May  6 11:13:59 2007
From: amaclach at yahoo.co.uk (Andrew MacLachlan)
Date: Sun May  6 11:14:02 2007
Subject: Strange clamd messages
Message-ID: <524616.6557.qm@web26315.mail.ukl.yahoo.com>

Working properly now - Thanks for the pointer!

Cheers,
Andy

----- Original Message ----
From: Ren? Berber <r.berber@computer.org>
To: mailscanner@lists.mailscanner.info
Sent: Sunday, 6 May, 2007 1:47:46 AM
Subject: Re: Strange clamd messages

Andrew MacLachlan wrote:

> Has anyone experienced anything like this with clamd?
> It appears to be working but I'm concerned by the lstat() message...
> 
> May  5 12:28:25 mail-gw MailScanner[1774]: Virus and Content Scanning: Starting
> May  5 12:28:25 mail-gw clamd[1543]: No stats for Database check - forcing reload
> May  5 12:28:25 mail-gw clamd[1543]: Reading databases from /var/lib/clamav
> May  5 12:28:27 mail-gw MailScanner[1774]: /var/spool/MailScanner/incoming/1774/.: lstat() failed. ERROR
> May  5 12:28:28 mail-gw MailScanner[1774]: Requeue: 5CE7527F11.91A87 to 9E60927F21
> May  5 12:28:28 mail-gw MailScanner[1774]: Uninfected: Delivered 1 messages

Is not working, and the problem are permissions: clamd cannot see what's in the 
incomming directory, much less test it.
-- 
Ren? Berber

--
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!




From MailScanner at ecs.soton.ac.uk  Sun May  6 11:51:26 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Sun May  6 11:56:16 2007
Subject: HOWTO: Use re2c and compiled SpamAssassin rules
Message-ID: <463DB32E.5070702@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This is intended as a brief guide to using the program "re2c" to 
generate compiled rules which speeds up SpamAssassin quite a bit.

Please can someone (who understands the wiki's text formatting system) 
upload this to the wiki for me!

1) Download the program "re2c" from 
"http://sourceforge.net/projects/re2c". If you are running an RPM-based 
system then download the .src.rpm file, else download the .tar.gz file.
2) Build "re2c".
2a) If you downloaded the .src.rpm file, then
       rpmbuild --rebuild re2c*.src.rpm
       cd /usr/src/redhat/RPMS/i386 (swap "redhat" for "packages" if 
that dir doesn't exist)
       rpm -Uvh re2c-0.12.0-1.i386.rpm (i.e. not the "debuginfo" version 
of the file)
2b) If you downloaded the .tar.gz file, then
       tar xzf re2c*tar*gz
       cd re2c*
       ./configure
       make
       make test
       make install
3) Compile the current set of SpamAssassin rules
       sa-compile
4) Tell SpamAssassin to use the compiled rules. Edit 
/etc/mail/spamassassin/v320.pre and uncomment the line
       loadplugin Mail::SpamAssassin::Plugin::Rule2XSBody
    by removing the "# " from the start of the line.
5) If you are using Rules-Du-Jour then tell it to recompile the rules 
after it downloads them. Edit the file /usr/bin/rules_du_jour and look 
for the line that contains
       SA_RESTART="
    Change this line to say
       SA_RESTART="sa-compile && /etc/init.d/spamassassin restart";
6) Restart MailScanner.

If you have any problems, let the mailing list know.

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGPbQxEfZZRxQVtlQRAiIDAJ96MwjVldiCLcqhPghe+iHdKdq+4wCdE94p
J5dKYLH+ldoVOIqTR74s8Mo=
=Z068
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From asakawa at quickd.net  Sun May  6 13:08:11 2007
From: asakawa at quickd.net (asakawa)
Date: Sun May  6 13:08:37 2007
Subject: can't detect avast
Message-ID: <20070506210337.62F3.ASAKAWA@quickd.net>

can't detect avast

MailScanner --lint

Creating hardcoded struct_flock subroutine for linux (Linux-type)
MailScanner.conf says "Virus Scanners = antivir clamd bitdefender f-prot avg f-secure avast"
Found these virus scanners installed: bitdefender, f-prot, clamav, f-secure, clamd, avg, antivir

virus.scanners.conf


avast		/usr/lib/MailScanner/avast-wrapper	/usr/bin/avast
avastd		/usr/lib/MailScanner/avastd-wrapper	/usr/bin/avast

[root@ns ~]# /usr/bin/avast -V
avast: avast v1.0.8
VPS: 000714-0 (date: 15.02.2007)
Copyright(C) 2003-2007. ALWIL Software. All rights reserved.



Asakawa



From ms-list at alexb.ch  Sun May  6 13:47:49 2007
From: ms-list at alexb.ch (Alex Broens)
Date: Sun May  6 13:47:52 2007
Subject: HOWTO: Use re2c and compiled SpamAssassin rules
In-Reply-To: <463DB32E.5070702@ecs.soton.ac.uk>
References: <463DB32E.5070702@ecs.soton.ac.uk>
Message-ID: <463DCE75.7090905@alexb.ch>

On 5/6/2007 12:51 PM, Julian Field wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> This is intended as a brief guide to using the program "re2c" to 
> generate compiled rules which speeds up SpamAssassin quite a bit.
> 
> Please can someone (who understands the wiki's text formatting system) 
> upload this to the wiki for me!
> 
> 1) Download the program "re2c" from 
> "http://sourceforge.net/projects/re2c". If you are running an RPM-based 
> system then download the .src.rpm file, else download the .tar.gz file.
> 2) Build "re2c".
> 2a) If you downloaded the .src.rpm file, then
>        rpmbuild --rebuild re2c*.src.rpm
>        cd /usr/src/redhat/RPMS/i386 (swap "redhat" for "packages" if 
> that dir doesn't exist)
>        rpm -Uvh re2c-0.12.0-1.i386.rpm (i.e. not the "debuginfo" version 
> of the file)
> 2b) If you downloaded the .tar.gz file, then
>        tar xzf re2c*tar*gz
>        cd re2c*
>        ./configure
>        make
>        make test
>        make install
> 3) Compile the current set of SpamAssassin rules
>        sa-compile
> 4) Tell SpamAssassin to use the compiled rules. Edit 
> /etc/mail/spamassassin/v320.pre and uncomment the line
>        loadplugin Mail::SpamAssassin::Plugin::Rule2XSBody
>     by removing the "# " from the start of the line.
> 5) If you are using Rules-Du-Jour then tell it to recompile the rules 
> after it downloads them. Edit the file /usr/bin/rules_du_jour and look 
> for the line that contains
>        SA_RESTART="
>     Change this line to say
>        SA_RESTART="sa-compile && /etc/init.d/spamassassin restart";
> 6) Restart MailScanner.
> 
> If you have any problems, let the mailing list know.

Jules

I'd say that if you use MS and RDJ the restart command should be

  SA_RESTART="sa-compile && /etc/init.d/MailScanner reload";

Alex

From MailScanner at ecs.soton.ac.uk  Sun May  6 13:50:40 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Sun May  6 13:51:08 2007
Subject: can't detect avast
In-Reply-To: <20070506210337.62F3.ASAKAWA@quickd.net>
References: <20070506210337.62F3.ASAKAWA@quickd.net>
Message-ID: <463DCF20.8080706@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Your virus.scanners.conf is wrong. For the avast lines it should just be 
/usr.

asakawa wrote:
> can't detect avast
>
> MailScanner --lint
>
> Creating hardcoded struct_flock subroutine for linux (Linux-type)
> MailScanner.conf says "Virus Scanners = antivir clamd bitdefender f-prot avg f-secure avast"
> Found these virus scanners installed: bitdefender, f-prot, clamav, f-secure, clamd, avg, antivir
>
> virus.scanners.conf
>
>
> avast		/usr/lib/MailScanner/avast-wrapper	/usr/bin/avast
> avastd		/usr/lib/MailScanner/avastd-wrapper	/usr/bin/avast
>
> [root@ns ~]# /usr/bin/avast -V
> avast: avast v1.0.8
> VPS: 000714-0 (date: 15.02.2007)
> Copyright(C) 2003-2007. ALWIL Software. All rights reserved.
>
>
>
> Asakawa
>
>
>
>   

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGPc8jEfZZRxQVtlQRAo74AJ42Fegygf0xhnKx+LHuQWoy9qEcWQCg2PDP
0TGhQPJMr816K5pjxeNJ2GA=
=U3OV
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From smlists at shaw.ca  Sun May  6 14:40:37 2007
From: smlists at shaw.ca (Steve Mason)
Date: Sun May  6 14:40:41 2007
Subject: MailScanner and Centos 5
In-Reply-To: <7EF0EE5CB3B263488C8C18823239BEBA921765@HC-MBX02.herefordshire.gov.uk>
References: <462BE389.7060802@shaw.ca>
	<7EF0EE5CB3B263488C8C18823239BEBA921765@HC-MBX02.herefordshire.gov.uk>
Message-ID: <463DDAD5.5030405@shaw.ca>

Thanks. I decided to go with 4.4, and it's up and running (except for 
FuzzyOCR which I'm leaving for another day)

Steve
From smlists at shaw.ca  Sun May  6 14:42:50 2007
From: smlists at shaw.ca (Steve Mason)
Date: Sun May  6 14:44:53 2007
Subject: Multi (split) image spam
In-Reply-To: <462BE389.7060802@shaw.ca>
References: <462BE389.7060802@shaw.ca>
Message-ID: <463DDB5A.3050405@shaw.ca>

Is anyone else seeing drug image spam with the .gif images  split into 4 
vertical strip files?

Nice new tactic by the spammers.... any new methods to handle this yet?

Thanks,

Steve
From uxbod at splatnix.net  Sun May  6 14:57:52 2007
From: uxbod at splatnix.net (--[ UxBoD ]--)
Date: Sun May  6 14:55:47 2007
Subject: Multi (split) image spam
In-Reply-To: <463DDB5A.3050405@shaw.ca>
References: <462BE389.7060802@shaw.ca>
	<463DDB5A.3050405@shaw.ca>
Message-ID: <20070506145752.5fa3f497@uxbod.splatnix.net>

I haven't seen any of those yet Steve.  Could you make one available
for analysis ?

All, FuzzyOCR is broke with SA 3.2.0 at the moment.

Cheers,

On Sun, 06 May 2007 07:42:50 -0600
Steve Mason <smlists@shaw.ca> wrote:

> Is anyone else seeing drug image spam with the .gif images  split
> into 4 vertical strip files?
> 
> Nice new tactic by the spammers.... any new methods to handle this
> yet?
> 
> Thanks,
> 
> Steve


-- 
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
// Phone: +44 845 869 2749
// SIP Phone: uxbod@sip.splatnix.net

-- 
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.

From uxbod at splatnix.net  Sun May  6 14:59:32 2007
From: uxbod at splatnix.net (--[ UxBoD ]--)
Date: Sun May  6 14:57:27 2007
Subject: nod32-1.99
Message-ID: <20070506145932.1be9c82b@uxbod.splatnix.net>

Julian,

I am running this AV here and have had to add -b to the nod32-wrapper
so that it performs a silent operation.  ie. no licensing details being
slapped into /var/log/messages, and MailScanner trying to scan that :)

Maybe worth adding as a default too the wrapper ?

Cheers,

-- 
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
// Phone: +44 845 869 2749
// SIP Phone: uxbod@sip.splatnix.net

-- 
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.

From smlists at shaw.ca  Sun May  6 15:10:23 2007
From: smlists at shaw.ca (Steve Mason)
Date: Sun May  6 15:10:29 2007
Subject: Multi (split) image spam
In-Reply-To: <20070506145752.5fa3f497@uxbod.splatnix.net>
References: <462BE389.7060802@shaw.ca> <463DDB5A.3050405@shaw.ca>
	<20070506145752.5fa3f497@uxbod.splatnix.net>
Message-ID: <463DE1CF.3050804@shaw.ca>

--[ UxBoD ]-- wrote:
> I haven't seen any of those yet Steve.  Could you make one available
> for analysis ?
>
> All, FuzzyOCR is broke with SA 3.2.0 at the moment.
>
> Cheers,
>   
No problem..
wget  http://www.masoncomputing.com/spamsamples/spam1.tar

Steve

From mkettler at evi-inc.com  Sun May  6 18:39:24 2007
From: mkettler at evi-inc.com (Matt Kettler)
Date: Sun May  6 18:39:34 2007
Subject: SpamAssassin 3.2.0
In-Reply-To: <Pine.LNX.4.64.0705051844320.2735@ebfjryy.nhfvpf.arg>
References: <463900B1.8080301@ecs.soton.ac.uk>
	<463B7C0C.9000004@evi-inc.com>	<Pine.LNX.4.64.0705050823120.3368@ebfjryy.nhfvpf.arg>	<463BB60B.3060608@evi-inc.com>
	<Pine.LNX.4.64.0705051844320.2735@ebfjryy.nhfvpf.arg>
Message-ID: <463E12CC.7080806@evi-inc.com>

Yes, it's a genuine bug.

I reproduced it at home and produced a patch, which I tried to send you a link
to, but unfortunately you don't seem to accept mail from my home ISP (verizon).

I don't have the link handy, so you'll have to dig around the SA bugzilla. It
shouldn't be hard to find. Search for open bugs involving uridnsbl.

Res wrote:
> Thanks Matt
> If you can't reproduce it let me know, it must point to something else
> I've enabled I suppose.
> 
> On Fri, 4 May 2007, Matt Kettler wrote:
> 
>> Res wrote:
>>> On Fri, 4 May 2007, Matt Kettler wrote:
>>>
>>>>     URIDNSBL
>>>
>>> I used to have this disabled for performance, for several versions, but
>>> as 3.20 cries like a baby unless its enabled, RDJ and sa-update refuse
>>> to run because of found scores for non existant plugins, I must admit I
>>> only looked at it for 2 minutes, but decided it was not worth the effort
>>> and just enabled the plugin, until I have time to find what else now
>>> needs disabling to shut it up :) Might look at it again on monday
>>> morning.
>>>
>>>
> 
>> Sounds like a bug in the conditionals that disable parts of the
>> ruleset.. I'll
>> look at it this weekend, time permitting.. If I can replicate it, I'll
>> open a
>> bug with the SA dev team. If it's something I can make patches for,
>> I'll do that
>> too.
> 
> 
> 
From hvdkooij at vanderkooij.org  Sun May  6 19:39:08 2007
From: hvdkooij at vanderkooij.org (Hugo van der Kooij)
Date: Sun May  6 19:39:44 2007
Subject: Multi (split) image spam
In-Reply-To: <463DDB5A.3050405@shaw.ca>
References: <462BE389.7060802@shaw.ca> <463DDB5A.3050405@shaw.ca>
Message-ID: <Pine.LNX.4.64.0705062038080.15826@faramir.hugo.vanderkooij.org>

On Sun, 6 May 2007, Steve Mason wrote:

> Is anyone else seeing drug image spam with the .gif images  split into 4 
> vertical strip files?
>
> Nice new tactic by the spammers.... any new methods to handle this yet?

Perhaps the fact that they are in strip files?

Hugo.

-- 
 	hvdkooij@vanderkooij.org	http://hugo.vanderkooij.org/
 	    This message is using 100% recycled electrons.

 	Some men see computers as they are and say "Windows"
 	I use computers with Linux and say "Why Windows?"
 		(Thanks JFK, for the insight.)
From hvdkooij at vanderkooij.org  Sun May  6 19:42:18 2007
From: hvdkooij at vanderkooij.org (Hugo van der Kooij)
Date: Sun May  6 19:42:57 2007
Subject: Multi (split) image spam
In-Reply-To: <463DE1CF.3050804@shaw.ca>
References: <462BE389.7060802@shaw.ca> <463DDB5A.3050405@shaw.ca>
	<20070506145752.5fa3f497@uxbod.splatnix.net> <463DE1CF.3050804@shaw.ca>
Message-ID: <Pine.LNX.4.64.0705062040540.15826@faramir.hugo.vanderkooij.org>

On Sun, 6 May 2007, Steve Mason wrote:

> --[ UxBoD ]-- wrote:
>>  I haven't seen any of those yet Steve.  Could you make one available
>>  for analysis ?
>>
>>  All, FuzzyOCR is broke with SA 3.2.0 at the moment.
>>
>>  Cheers,
>> 
> No problem..
> wget  http://www.masoncomputing.com/spamsamples/spam1.tar

Great shooting Tex. ;-) I think we got a genuine logwatch report here. I 
think you need to check it.

Hugo.

-- 
 	hvdkooij@vanderkooij.org	http://hugo.vanderkooij.org/
 	    This message is using 100% recycled electrons.

 	Some men see computers as they are and say "Windows"
 	I use computers with Linux and say "Why Windows?"
 		(Thanks JFK, for the insight.)
From MailScanner at ecs.soton.ac.uk  Sun May  6 20:24:37 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Sun May  6 20:26:44 2007
Subject: nod32-1.99
In-Reply-To: <20070506145932.1be9c82b@uxbod.splatnix.net>
References: <20070506145932.1be9c82b@uxbod.splatnix.net>
Message-ID: <463E2B75.7050102@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Thanks for that. I have added it to SweepViruses.pm. It will be in the 
next release.

Cheers,
Jules.


- --[ UxBoD ]-- wrote:
> Julian,
>
> I am running this AV here and have had to add -b to the nod32-wrapper
> so that it performs a silent operation.  ie. no licensing details being
> slapped into /var/log/messages, and MailScanner trying to scan that :)
>
> Maybe worth adding as a default too the wrapper ?
>
> Cheers,
>
>   

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGPivWEfZZRxQVtlQRAkxiAJ9+9OHQeqV1sHVBpFqsU1by6OVxOQCfUI39
dIvb3Fw1ZhpS3qsvJGvrhhE=
=O4Sz
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From amaclach at yahoo.co.uk  Sun May  6 22:16:43 2007
From: amaclach at yahoo.co.uk (Andrew MacLachlan)
Date: Sun May  6 22:16:46 2007
Subject: MailScanner and Centos 5
Message-ID: <802996.33232.qm@web26302.mail.ukl.yahoo.com>

Fuzzy's a complete sh... to get right, but it's great once it's working properly and you have all the components installed (oh why can't someone put it all into a nice easy rpm...)
I found Tesseract the worst... It just wouldn't build... 

Regards, 
Andrew MacLachlan
H: +44 20 84677939
M: +44 7900 980314
E: amaclach@yahoo.co.uk

----- Original Message ----
From: Steve Mason <smlists@shaw.ca>
To: MailScanner discussion <mailscanner@lists.mailscanner.info>
Sent: Sunday, 6 May, 2007 2:40:37 PM
Subject: Re: MailScanner and Centos 5

Thanks. I decided to go with 4.4, and it's up and running (except for 
FuzzyOCR which I'm leaving for another day)

Steve
-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 




From amaclach at yahoo.co.uk  Sun May  6 22:22:20 2007
From: amaclach at yahoo.co.uk (Andrew MacLachlan)
Date: Sun May  6 22:22:22 2007
Subject: Multi (split) image spam
Message-ID: <727373.44781.qm@web26307.mail.ukl.yahoo.com>

Nope, but I've seen some quite cool wobbly lines just today - didn't fool Fuzzy though - an instant 6 points for that effort plus incidental scores giving it a total of 16 or so.

Some of the spammers are doing resends though to get around greylisting - this is a worrying trend, however it also means that they can only send half as many from each bot...

Maybe time to re-tune the greylisting software so it does a second 450 before it finally accepts a sender?
 
Regards, 
Andrew MacLachlan
H: +44 20 84677939
M: +44 7900 980314
E: amaclach@yahoo.co.uk

----- Original Message ----
From: Steve Mason <smlists@shaw.ca>
To: MailScanner discussion <mailscanner@lists.mailscanner.info>
Sent: Sunday, 6 May, 2007 2:42:50 PM
Subject: Multi (split) image spam

Is anyone else seeing drug image spam with the .gif images  split into 4 
vertical strip files?

Nice new tactic by the spammers.... any new methods to handle this yet?

Thanks,

Steve
-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 




From amaclach at yahoo.co.uk  Sun May  6 22:24:17 2007
From: amaclach at yahoo.co.uk (Andrew MacLachlan)
Date: Sun May  6 22:24:19 2007
Subject: SpamAssassin 3.2.0
Message-ID: <963369.66510.qm@web26310.mail.ukl.yahoo.com>

I can host that patch if you want.
 
Andy

----- Original Message ----
From: Matt Kettler <mkettler@evi-inc.com>
To: MailScanner discussion <mailscanner@lists.mailscanner.info>
Sent: Sunday, 6 May, 2007 6:39:24 PM
Subject: Re: SpamAssassin 3.2.0

Yes, it's a genuine bug.

I reproduced it at home and produced a patch, which I tried to send you a link
to, but unfortunately you don't seem to accept mail from my home ISP (verizon).

I don't have the link handy, so you'll have to dig around the SA bugzilla. It
shouldn't be hard to find. Search for open bugs involving uridnsbl.

Res wrote:
> Thanks Matt
> If you can't reproduce it let me know, it must point to something else
> I've enabled I suppose.
> 
> On Fri, 4 May 2007, Matt Kettler wrote:
> 
>> Res wrote:
>>> On Fri, 4 May 2007, Matt Kettler wrote:
>>>
>>>>     URIDNSBL
>>>
>>> I used to have this disabled for performance, for several versions, but
>>> as 3.20 cries like a baby unless its enabled, RDJ and sa-update refuse
>>> to run because of found scores for non existant plugins, I must admit I
>>> only looked at it for 2 minutes, but decided it was not worth the effort
>>> and just enabled the plugin, until I have time to find what else now
>>> needs disabling to shut it up :) Might look at it again on monday
>>> morning.
>>>
>>>
> 
>> Sounds like a bug in the conditionals that disable parts of the
>> ruleset.. I'll
>> look at it this weekend, time permitting.. If I can replicate it, I'll
>> open a
>> bug with the SA dev team. If it's something I can make patches for,
>> I'll do that
>> too.
> 
> 
> 
-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 




From hvdkooij at vanderkooij.org  Sun May  6 23:07:18 2007
From: hvdkooij at vanderkooij.org (Hugo van der Kooij)
Date: Sun May  6 23:07:54 2007
Subject: Multi (split) image spam
In-Reply-To: <727373.44781.qm@web26307.mail.ukl.yahoo.com>
References: <727373.44781.qm@web26307.mail.ukl.yahoo.com>
Message-ID: <Pine.LNX.4.64.0705070006000.15826@faramir.hugo.vanderkooij.org>

On Sun, 6 May 2007, Andrew MacLachlan wrote:

> Some of the spammers are doing resends though to get around greylisting - this is a worrying trend, however it also means that they can only send half as many from each bot...
>
> Maybe time to re-tune the greylisting software so it does a second 450 before it finally accepts a sender?

Most greylisting solutions I have seen use a time window. So you need to 
resend it after the timewindow or you will still hit the greylist.

Hugo.

-- 
 	hvdkooij@vanderkooij.org	http://hugo.vanderkooij.org/
 	    This message is using 100% recycled electrons.

 	Some men see computers as they are and say "Windows"
 	I use computers with Linux and say "Why Windows?"
 		(Thanks JFK, for the insight.)
From res at ausics.net  Sun May  6 23:25:20 2007
From: res at ausics.net (Res)
Date: Sun May  6 23:25:38 2007
Subject: Multi (split) image spam
In-Reply-To: <727373.44781.qm@web26307.mail.ukl.yahoo.com>
References: <727373.44781.qm@web26307.mail.ukl.yahoo.com>
Message-ID: <Pine.LNX.4.64.0705070816370.13685@ebfjryy.nhfvpf.arg>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sun, 6 May 2007, Andrew MacLachlan wrote:

> Some of the spammers are doing resends though to get around greylisting

This is one of the reasons I consider greylisting useless :)
I've seen this from this part of the world (oceania/asia area) for about
as long as greylisting came about.

It's the same ol same ol, we do something to stop em, they circumvent it, 
we counter it and they will try counter it again, and so on and as grey 
listing is the most simplest thing to get around, i've always regarded it 
as a joke, and all it does it build up your own outgoing queues, this 
might be fine for those who do 1K messages a day but when you do millions,
thats just not on, anyhow you might as well firewall off your primary MX 
making mail fail and force resend via secondary MX's.


- -- 

Cheers
Res

Vote for your favourite MTA at  http://polls.ausics.net/v3.php
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGPlXSsWhAmSIQh7MRAriLAKC1gppSuVoeUKFUBlkcft2Uza6OqQCfWQTM
JvxRuyNv2n7IlyXHAPPulAM=
=lBlX
-----END PGP SIGNATURE-----
From amaclach at yahoo.co.uk  Sun May  6 23:31:23 2007
From: amaclach at yahoo.co.uk (Andrew MacLachlan)
Date: Sun May  6 23:31:25 2007
Subject: Clever bots - was Re: Multi (split) image spam
Message-ID: <123569.36742.qm@web26303.mail.ukl.yahoo.com>

That's right - most are 5 mins, which is about right for most MTAs first retry.
Any decent greylister will tell an early retry to go away again, but either more spammers are using MTAs or the bots are getting cleverer. I'd say the latter is more likely.
A cursory glance at a couple of spams from today gives me headers like this:

X-Greylist: delayed 00:10:01 by SQLgrey-1.7.5

Received: from 89-172-120-92.adsl.net.t-com.hr (89-172-120-92.adsl.net.t-com.hr [89.172.120.92])

X-Greylist: delayed 00:10:02 by SQLgrey-1.7.5

Received: from 236.Red-81-36-176.dynamicIP.rima-tde.net (236.red-81-36-176.dynamicip.rima-tde.net [81.36.176.236])

Interestingly the delay was over 10 mins by a second or 2 - so this means that grey needs to extend to 11 mins... Not sure what the effect of this will be - is  the bot smart enough to retry again if rejected at 10 mins?

Andy


----- Original Message ----
From: Hugo van der Kooij <hvdkooij@vanderkooij.org>
To: MailScanner discussion <mailscanner@lists.mailscanner.info>
Sent: Sunday, 6 May, 2007 11:07:18 PM
Subject: Re: Multi (split) image spam

On Sun, 6 May 2007, Andrew MacLachlan wrote:

> Some of the spammers are doing resends though to get around greylisting - this is a worrying trend, however it also means that they can only send half as many from each bot...
>
> Maybe time to re-tune the greylisting software so it does a second 450 before it finally accepts a sender?

Most greylisting solutions I have seen use a time window. So you need to 
resend it after the timewindow or you will still hit the greylist.

Hugo.

-- 
     hvdkooij@vanderkooij.org    http://hugo.vanderkooij.org/
         This message is using 100% recycled electrons.

     Some men see computers as they are and say "Windows"
     I use computers with Linux and say "Why Windows?"
         (Thanks JFK, for the insight.)
-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 




From res at ausics.net  Sun May  6 23:32:09 2007
From: res at ausics.net (Res)
Date: Sun May  6 23:32:25 2007
Subject: SpamAssassin 3.2.0
In-Reply-To: <463E12CC.7080806@evi-inc.com>
References: <463900B1.8080301@ecs.soton.ac.uk> <463B7C0C.9000004@evi-inc.com>
	<Pine.LNX.4.64.0705050823120.3368@ebfjryy.nhfvpf.arg>
	<463BB60B.3060608@evi-inc.com>
	<Pine.LNX.4.64.0705051844320.2735@ebfjryy.nhfvpf.arg>
	<463E12CC.7080806@evi-inc.com>
Message-ID: <Pine.LNX.4.64.0705070825330.13685@ebfjryy.nhfvpf.arg>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Sun, 6 May 2007, Matt Kettler wrote:

> Yes, it's a genuine bug.
>
> I reproduced it at home and produced a patch, which I tried to send you a link
> to, but unfortunately you don't seem to accept mail from my home ISP (verizon).

Thanks Matt, I'll have a look later this morning. BTW I wouldn't have got
the mail anyway if you had got in as res@ is a list/newsgroup only 
account unless your mail is sorted into a list folder its /dev/null'd
primarily because I've used this a/c on usenet for along time so would
have to be in every spam list, sendmail/MS get rid of 99% of the junk, my 
pine filtering rules eliminate the remaining :)

- --
Cheers
Res

Vote for your favourite MTA at  http://polls.ausics.net/v3.php
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGPldrsWhAmSIQh7MRAgNtAJ9NsY9wb0MB1LjuojOGUj5PVxZ6VACdF/ON
kFxrQGYHjp6Hy/pBJ6Go7Zk=
=r1J5
-----END PGP SIGNATURE-----
From amaclach at yahoo.co.uk  Sun May  6 23:49:11 2007
From: amaclach at yahoo.co.uk (Andrew MacLachlan)
Date: Sun May  6 23:49:14 2007
Subject: Multi (split) image spam
Message-ID: <694855.76046.qm@web26301.mail.ukl.yahoo.com>

Not useless - just less effective - and no-one said it was the perfect solution - but it does effectively cut the number of spams a bot can send in half, which is always a good thing.
Most spam is stopped dead in its tracks by greylisting and is a very effective (also efficient) method of cutting down on the amount of spam that MS has to process.

> and all it does it build up your own outgoing queues
Not sure how the logic on that one works...

> you might as well firewall off your primary MX 
> making mail fail and force resend via secondary MX's.
A bit extreme - and anyway spammers have been sending directly to secondaries for years as a lot of organisations don't have spam defences on them so the messages just sail on thru...
 
As the old saying goes - defence in depth...


-Andy

----- Original Message ----
From: Res <res@ausics.net>
To: MailScanner discussion <mailscanner@lists.mailscanner.info>
Sent: Sunday, 6 May, 2007 11:25:20 PM
Subject: Re: Multi (split) image spam

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sun, 6 May 2007, Andrew MacLachlan wrote:

> Some of the spammers are doing resends though to get around greylisting

This is one of the reasons I consider greylisting useless :)
I've seen this from this part of the world (oceania/asia area) for about
as long as greylisting came about.

It's the same ol same ol, we do something to stop em, they circumvent it, 
we counter it and they will try counter it again, and so on and as grey 
listing is the most simplest thing to get around, i've always regarded it 
as a joke, and all it does it build up your own outgoing queues, this 
might be fine for those who do 1K messages a day but when you do millions,
thats just not on, anyhow you might as well firewall off your primary MX 
making mail fail and force resend via secondary MX's.


- -- 

Cheers
Res

Vote for your favourite MTA at  http://polls.ausics.net/v3.php
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGPlXSsWhAmSIQh7MRAriLAKC1gppSuVoeUKFUBlkcft2Uza6OqQCfWQTM
JvxRuyNv2n7IlyXHAPPulAM=
=lBlX
-----END PGP SIGNATURE-----
-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 




From jaearick at colby.edu  Mon May  7 03:09:36 2007
From: jaearick at colby.edu (Jeff A. Earickson)
Date: Mon May  7 03:09:47 2007
Subject: Multi (split) image spam
In-Reply-To: <694855.76046.qm@web26301.mail.ukl.yahoo.com>
References: <694855.76046.qm@web26301.mail.ukl.yahoo.com>
Message-ID: <Pine.GSO.4.64.0705062205520.29405@karst.colby.edu>

On Sun, 6 May 2007, Andrew MacLachlan wrote:
> Subject: Re: Multi (split) image spam
> 
> Not useless - just less effective - and no-one said it was the perfect solution - but it does effectively cut the number of spams a bot can send in half, which is always a good thing.
> Most spam is stopped dead in its tracks by greylisting and is a very effective (also efficient) method of cutting down on the amount of spam that MS has to process.
>
>> and all it does it build up your own outgoing queues
> Not sure how the logic on that one works...
>
>> you might as well firewall off your primary MX
>> making mail fail and force resend via secondary MX's.
> A bit extreme - and anyway spammers have been sending directly to secondaries for years as a lot of organisations don't have spam defences on them so the messages just sail on thru...

I run smtptrapd (see http://smtptrapd.inodes.org/) on another box which is
a secondary MX.  It keeps the spammers busy and helps keep them away from
my primary MX.  If my primary is down, so what?  The legit stuff will
retry later.

Jeff Earickson
Colby College
From hvdkooij at vanderkooij.org  Mon May  7 06:41:03 2007
From: hvdkooij at vanderkooij.org (Hugo van der Kooij)
Date: Mon May  7 06:41:38 2007
Subject: Clever bots - was Re: Multi (split) image spam
In-Reply-To: <123569.36742.qm@web26303.mail.ukl.yahoo.com>
References: <123569.36742.qm@web26303.mail.ukl.yahoo.com>
Message-ID: <Pine.LNX.4.64.0705070728580.24305@faramir.hugo.vanderkooij.org>

On Sun, 6 May 2007, Andrew MacLachlan wrote:

> That's right - most are 5 mins, which is about right for most MTAs first retry.
> Any decent greylister will tell an early retry to go away again, but either more spammers are using MTAs or the bots are getting cleverer. I'd say the latter is more likely.
> A cursory glance at a couple of spams from today gives me headers like this:
>
> X-Greylist: delayed 00:10:01 by SQLgrey-1.7.5
>
> Received: from 89-172-120-92.adsl.net.t-com.hr (89-172-120-92.adsl.net.t-com.hr [89.172.120.92])
>
> X-Greylist: delayed 00:10:02 by SQLgrey-1.7.5
>
> Received: from 236.Red-81-36-176.dynamicIP.rima-tde.net (236.red-81-36-176.dynamicip.rima-tde.net [81.36.176.236])
>
> Interestingly the delay was over 10 mins by a second or 2 - so this means that grey needs to extend to 11 mins... Not sure what the effect of this will be - is  the bot smart enough to retry again if rejected at 10 mins?

Given that disabling greylisting still results in a significant rise of 
traffic for MailScanner I would say it is a usefull addition to the bag of 
tricks at this time.

At irregular intervals I play with some of them to see if disabling a 
restriction is having an effect. At this point I wrote a small script to 
report on greylisted entries daily and have added all the noisy entries to 
a static blacklist.

The first way I added was abo.wanadoo.fr and it had an immediate impact. 
Wanadoo users will need to send through their ISP mailserver to get a 
message delivered.

Hugo.

-- 
 	hvdkooij@vanderkooij.org	http://hugo.vanderkooij.org/
 	    This message is using 100% recycled electrons.

 	Some men see computers as they are and say "Windows"
 	I use computers with Linux and say "Why Windows?"
 		(Thanks JFK, for the insight.)

A: Yes.
>Q: Are you sure?
>>A: Because it reverses the logical flow of conversation.
>>>Q: Why is top posting frowned upon?

From res at ausics.net  Mon May  7 10:10:11 2007
From: res at ausics.net (Res)
Date: Mon May  7 10:10:22 2007
Subject: Multi (split) image spam
In-Reply-To: <694855.76046.qm@web26301.mail.ukl.yahoo.com>
References: <694855.76046.qm@web26301.mail.ukl.yahoo.com>
Message-ID: <Pine.LNX.4.64.0705071903400.15271@ebfjryy.nhfvpf.arg>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sun, 6 May 2007, Andrew MacLachlan wrote:

>> and all it does it build up your own outgoing queues
> Not sure how the logic on that one works...

errr logic? WTF? if the queue cant send it right away it stays in the 
queue so lamelisted_mail+current_submissions=building_up_queue
like I said it might be fine if you run a small office 1K emails p/day, 
but not when you do millions p/day, however I have tuned sendmail queue 
running so that new stuff goes first, I'm not going to allow new stuff
to be delayed in oversized queue runners because some lamers server wont 
accept it on first attempt.


- -- 

Cheers
Res

Vote for your favourite MTA at  http://polls.ausics.net/v3.php
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGPuz2sWhAmSIQh7MRAhUsAJ0ZANXqiiOnAFGLv3e5mvUyUK3ZagCfeaJX
koKex5fcZnwvDfx+GSV3wSM=
=Byf/
-----END PGP SIGNATURE-----
From uxbod at splatnix.net  Mon May  7 12:59:47 2007
From: uxbod at splatnix.net (--[ UxBoD ]--)
Date: Mon May  7 12:57:43 2007
Subject: SA 3.2.0 Woes
Message-ID: <20070507125947.05ede1ea@uxbod.splatnix.net>

Hi,

Not sure whether this is a issue or not, but since upgrading SA and
MailScanner I never seem to get any hits via RBLs. I am using MailWatch
and that just says "SpamAssassin Listed in RBL". Bayes never seems to
trigger aswell now.

Have others experienced anything like this ?

TIA

-- 
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
// Phone: +44 845 869 2749
// SIP Phone: uxbod@sip.splatnix.net

-- 
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.

From daniel.maher at ubisoft.com  Mon May  7 13:46:29 2007
From: daniel.maher at ubisoft.com (Daniel Maher)
Date: Mon May  7 13:46:33 2007
Subject: Multi (split) image spam
In-Reply-To: <20070506145752.5fa3f497@uxbod.splatnix.net>
Message-ID: <1E293D3FF63A3740B10AD5AAD88535D204D6D68B@UBIMAIL1.ubisoft.org>


> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> bounces@lists.mailscanner.info] On Behalf Of --[ UxBoD ]--
> Sent: May 6, 2007 9:58 AM
> To: mailscanner@lists.mailscanner.info
> Subject: Re: Multi (split) image spam
> 
> I haven't seen any of those yet Steve.  Could you make one available
> for analysis ?
> 
> All, FuzzyOCR is broke with SA 3.2.0 at the moment.
> 
> Cheers,

As I understand it, FuzzyOCR still works in 3.2.0, in that it detects and analyses images; what is broken is the output in the spam report.  In fact, as I recall, Ren? Berber submitted a patch for it...

I could be wrong, though. :P

--
  _
 ?v?  Daniel Maher
/(_)\ Administrateur Syst?me Unix
 ^ ^  Unix System Administrator
 
"How can a man choose between Fresh and Fly?  And believe me, there IS a difference." - Crack Stuntman, 2007.
From daniel.maher at ubisoft.com  Mon May  7 15:18:34 2007
From: daniel.maher at ubisoft.com (Daniel Maher)
Date: Mon May  7 15:18:37 2007
Subject: MailScanner and postfix 2.4
Message-ID: <1E293D3FF63A3740B10AD5AAD88535D204D6D84F@UBIMAIL1.ubisoft.org>

Hello all,

 

I would love to hear some first-hand accounts of people who are using MailScanner with Postfix 2.4.  Does it work well?  Are there any particular nuances which need to be addressed in specific?  Does anybody have any horror stories?

 

Thank you, all.

 

--

  _
 ?v?  Daniel Maher
/(_)\ Administrateur Syst?me Unix
 ^ ^  Unix System Administrator

 

"How can a man choose between Fresh and Fly?  And believe me, there IS a difference." - Crack Stuntman, 2007.

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070507/e4374a5d/attachment.html
From mikael at syska.dk  Mon May  7 15:28:40 2007
From: mikael at syska.dk (Mikael Syska)
Date: Mon May  7 15:29:16 2007
Subject: MailScanner and postfix 2.4
In-Reply-To: <1E293D3FF63A3740B10AD5AAD88535D204D6D84F@UBIMAIL1.ubisoft.org>
References: <1E293D3FF63A3740B10AD5AAD88535D204D6D84F@UBIMAIL1.ubisoft.org>
Message-ID: <463F3798.4070809@syska.dk>

Hey,

Running with that setup soon ... Postfix 2.3.x for now ... but I will be 
upgrading to 2.4.x soon ... should there be anything since you ask ? or 
are you just worried about upgrading ?

// ouT

Daniel Maher wrote:
>
> Hello all,
>
> I would love to hear some first-hand accounts of people who are using 
> MailScanner with Postfix 2.4. Does it work well? Are there any 
> particular nuances which need to be addressed in specific? Does 
> anybody have any horror stories?
>
> Thank you, all.
>
> --
>
> _
> ?v? Daniel Maher
> /(_)\ Administrateur Syst?me Unix
> ^ ^ Unix System Administrator
>
> //?How can a man choose between Fresh and Fly? And believe me, there 
> IS a difference.? ? Crack Stuntman, 2007.////
>

From claude.gagne at multitech.qc.ca  Mon May  7 15:31:32 2007
From: claude.gagne at multitech.qc.ca (=?windows-1252?Q?Claude_Gagn=E9?=)
Date: Mon May  7 15:29:36 2007
Subject: MailScanner and postfix 2.4
In-Reply-To: <1E293D3FF63A3740B10AD5AAD88535D204D6D84F@UBIMAIL1.ubisoft.org>
References: <1E293D3FF63A3740B10AD5AAD88535D204D6D84F@UBIMAIL1.ubisoft.org>
Message-ID: <463F3844.5090101@multitech.qc.ca>

Daniel Maher a ?crit :
>
> Hello all,
>
> I would love to hear some first-hand accounts of people who are using 
> MailScanner with Postfix 2.4. Does it work well? Are there any 
> particular nuances which need to be addressed in specific? Does 
> anybody have any horror stories?
>
> Thank you, all.
>
> --
>
> _
> ?v? Daniel Maher
> /(_)\ Administrateur Syst?me Unix
> ^ ^ Unix System Administrator
>
> //?How can a man choose between Fresh and Fly? And believe me, there 
> IS a difference.? ? Crack Stuntman, 2007.////
>
Works good for me so far.
From dominian at slackadelic.com  Mon May  7 15:37:19 2007
From: dominian at slackadelic.com (Matt Hayes)
Date: Mon May  7 15:37:28 2007
Subject: MailScanner and postfix 2.4
In-Reply-To: <463F3844.5090101@multitech.qc.ca>
References: <1E293D3FF63A3740B10AD5AAD88535D204D6D84F@UBIMAIL1.ubisoft.org>
	<463F3844.5090101@multitech.qc.ca>
Message-ID: <463F399F.3010708@slackadelic.com>

Claude Gagn? wrote:
> Daniel Maher a ?crit :
>>
>> Hello all,
>>
>> I would love to hear some first-hand accounts of people who are using 
>> MailScanner with Postfix 2.4. Does it work well? Are there any 
>> particular nuances which need to be addressed in specific? Does 
>> anybody have any horror stories?
>>
>> Thank you, all.
>>
>> -- 
>>
>> _
>> ?v? Daniel Maher
>> /(_)\ Administrateur Syst?me Unix
>> ^ ^ Unix System Administrator
>>
>> //?How can a man choose between Fresh and Fly? And believe me, there 
>> IS a difference.? ? Crack Stuntman, 2007.////
>>
> Works good for me so far.


Works fine for me as well.

-Matt


From glenn.steen at gmail.com  Mon May  7 15:39:12 2007
From: glenn.steen at gmail.com (Glenn Steen)
Date: Mon May  7 15:39:15 2007
Subject: MailScanner and postfix 2.4
In-Reply-To: <463F3844.5090101@multitech.qc.ca>
References: <1E293D3FF63A3740B10AD5AAD88535D204D6D84F@UBIMAIL1.ubisoft.org>
	<463F3844.5090101@multitech.qc.ca>
Message-ID: <223f97700705070739n3f1f319fo5a4c7fa27a93f933@mail.gmail.com>

On 07/05/07, Claude Gagn? <claude.gagne@multitech.qc.ca> wrote:
> Daniel Maher a ?crit :
> >
> > Hello all,
> >
> > I would love to hear some first-hand accounts of people who are using
> > MailScanner with Postfix 2.4. Does it work well? Are there any
> > particular nuances which need to be addressed in specific? Does
> > anybody have any horror stories?
> >
> > Thank you, all.
> >
> > --
> >
> > _
> > ?v? Daniel Maher
> > /(_)\ Administrateur Syst?me Unix
> > ^ ^ Unix System Administrator
> >
> > //"How can a man choose between Fresh and Fly? And believe me, there
> > IS a difference." ? Crack Stuntman, 2007.////
> >
> Works good for me so far.

As it should... It is only if you a) use milters and b) those milters
do full body edits... Then you can, and will, run into problems. If a)
but not b) (that is: only header edits) then I've supplied some
patches that should take care of this ... and a+b patches is in the
works:-).

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
From glenn.steen at gmail.com  Mon May  7 15:43:44 2007
From: glenn.steen at gmail.com (Glenn Steen)
Date: Mon May  7 15:43:47 2007
Subject: Clamav suggestions
In-Reply-To: <089801c78f42$78529500$0301a8c0@SAHOMELT>
References: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it>
	<463B5E8A.2080400@sendit.nodak.edu>
	<085b01c78f29$f30cc540$0301a8c0@SAHOMELT>
	<463CAF50.8030305@ecs.soton.ac.uk>
	<089801c78f42$78529500$0301a8c0@SAHOMELT>
Message-ID: <223f97700705070743l47a131cayc53ff788c9642f37@mail.gmail.com>

On 05/05/07, Rick Cooper <rcooper@dwford.com> wrote:
>
>
> > -----Original Message-----
> > From: mailscanner-bounces@lists.mailscanner.info
> > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf
> > Of Julian Field
> > Sent: Saturday, May 05, 2007 12:23 PM
> > To: MailScanner discussion
> > Subject: Re: Clamav suggestions
> >
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> [...]
>
> > Yes, I welcome any contribution, so long as the patch isn't
> > *too* big! :-)
> > Please try to keep your patch as self-contained as possible, so you
> > just, for example, rewrite the init code for the clamd parser and the
> > output parser itself. Please just make it as clean and modular as you
> > can. You can see from the rest of the code the type of Perl I
> > write. I
> > use the syntactical short-cut facilities in the language, I
> > don't just
> > write Java/C in Perl the way a lot of people do. And please
> > don't feel
> > upset if I take your code and appear to rewrite it :-)
> >
> > Thanks,
> > Jules.
> >
>
> I will have to try and rememeber the program flow, and look at the
> clamavmodule code and how it's called because this would work pretty much
> the same. It would be easy enough to make the output the same as the
> clamavmodule output so the same parser could be used if the current parser
> had some minor changes such as MailScanner::Log::InfoLog("ClamAVModule:: to
> MailScanner::Log::InfoLog("$Name:: would it not? I have already tried to
> make the code more like yours (from my unrar experience) such as "last if
> time > $TimeOut;" or "LogIt("ClamD Timed Out!\n") if $TimeOut < time &&
> $Debug;". In any event you know I don't care if you rewrite everything..
> It's your program ;-) The size should be pretty fair, the current stand
> alone proof of concept code is only 144 lines including a Logging function,
> line comments, 18 lines of description comments, the various "use "
> statements and debug and blank lines. I would expect the finished MS ready
> code would be half that, maybe less (even with comments). There would, of
> course, be additional config lines. I would expect you should have:
>         clamd socket (IpAddr or full path to socket file)
>         clamd port default 3310
>         clamd lock file (to check if clamd is even running)
>         clamd timeout
>
> And would you want to scan an entire batch at once, or one message/dir at a
> time? I can even send you the stand alone code I have an let you play with
> it at your leasure if you wish.
>
> Rick

Hey Rick, I'm pretty certain Jules isn't needling you about style....
Rather me and my "p record patches":-):-). Oh well, there is a reason
I don't write "Programmer" on my cards anymore:-)

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
From tmartins at gmail.com  Mon May  7 16:18:17 2007
From: tmartins at gmail.com (Thiago Martins)
Date: Mon May  7 16:18:20 2007
Subject: MailScanner and postfix 2.4
In-Reply-To: <223f97700705070739n3f1f319fo5a4c7fa27a93f933@mail.gmail.com>
References: <1E293D3FF63A3740B10AD5AAD88535D204D6D84F@UBIMAIL1.ubisoft.org>
	<463F3844.5090101@multitech.qc.ca>
	<223f97700705070739n3f1f319fo5a4c7fa27a93f933@mail.gmail.com>
Message-ID: <fced6f550705070818j2591d6e1k5905eb4aa2cb137c@mail.gmail.com>

I have MS + Postfix 2.4 + Postgrey working fine here.

[]?s
Thiago

On 5/7/07, Glenn Steen <glenn.steen@gmail.com> wrote:
>
> On 07/05/07, Claude Gagn? <claude.gagne@multitech.qc.ca> wrote:
> > Daniel Maher a ?crit :
> > >
> > > Hello all,
> > >
> > > I would love to hear some first-hand accounts of people who are using
> > > MailScanner with Postfix 2.4. Does it work well? Are there any
> > > particular nuances which need to be addressed in specific? Does
> > > anybody have any horror stories?
> > >
> > > Thank you, all.
> > >
> > > --
> > >
> > > _
> > > ?v? Daniel Maher
> > > /(_)\ Administrateur Syst?me Unix
> > > ^ ^ Unix System Administrator
> > >
> > > //"How can a man choose between Fresh and Fly? And believe me, there
> > > IS a difference." ? Crack Stuntman, 2007.////
> > >
> > Works good for me so far.
>
> As it should... It is only if you a) use milters and b) those milters
> do full body edits... Then you can, and will, run into problems. If a)
> but not b) (that is: only header edits) then I've supplied some
> patches that should take care of this ... and a+b patches is in the
> works:-).
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070507/0687997a/attachment.html
From ssilva at sgvwater.com  Mon May  7 16:20:37 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Mon May  7 16:20:58 2007
Subject: SpamAssassin 3.2.0 package
In-Reply-To: <463CB925.2050609@ecs.soton.ac.uk>
References: <463C6D8E.5040802@ecs.soton.ac.uk>	<463C9E7C.7040600@protos.mine.nu>	<463CAD50.3050806@ecs.soton.ac.uk>
	<463CB925.2050609@ecs.soton.ac.uk>
Message-ID: <f1ng46$6t7$2@sea.gmane.org>

Julian Field spake the following on 5/5/2007 10:04 AM:
> I have done some basic tests with my SpamAssassin 3.2.0 package and 
> MailScanner 4.59 and it is working fine.
> 
> I'll do some more tests of it and probably start using it on a 
> production machine tomorrow if I feel so inclined (and there again I 
> might well just put my feet up and watch TV). It's a public holiday this 
> weekend (I think!) so by definition it should rain on Monday at least. :-)
> 
> Jules.
Julian,
I haven't had an opportunity to look at it yet, but are you or did you add an
init script for clamd? I was going to throw one together if it didn't have
one. But if it is already there, I won't bother.
-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From painethom at gmail.com  Mon May  7 16:33:53 2007
From: painethom at gmail.com (Thom Paine)
Date: Mon May  7 16:33:54 2007
Subject: New SA and Clam and MS 4.59.4-2
Message-ID: <9e1340d20705070833o682a3c08j2feadc9c3d4e2d51@mail.gmail.com>

I am trying to update a server to all the latest patches, and I'm
having trouble getting some stuff working.

I have debug enabled in my mailscanner.conf file and when I try the
clamavmodule I get libclamav warning, virus definitions are older than
7 days.
I just successfully ran freshclam and I have defined my freshclam.conf
and my clamd.conf to both point to /var/lib/clamav. The definitions
downloaded no problem and are in that directory now.

I tried testing the wrapper script for it but it is giving me an error as well.

[root@mail MailScanner]# /usr/lib/MailScanner/clamav-wrapper /tmp
/usr/lib/MailScanner/clamav-wrapper: line 162: /usr/bin/clamscan: No
such file or directory

however my clamscan is in /usr/local/bin. For some reason it's not
looking there properly I guess.

I haven't tested the SA stuff yet, as I seem to be held up with my
clamav issues.

Thanks.
-- 
-=/>Thom
From mkercher at nfsmith.com  Mon May  7 16:34:32 2007
From: mkercher at nfsmith.com (Mike Kercher)
Date: Mon May  7 16:38:12 2007
Subject: New SA and Clam and MS 4.59.4-2
References: <9e1340d20705070833o682a3c08j2feadc9c3d4e2d51@mail.gmail.com>
Message-ID: <6DEF8ABC1767C045B91F42066D36358E3AEB@HOUPEX01.nfsmith.info>

Thom Paine <> wrote on Monday, May 07, 2007 10:34 AM:

: I am trying to update a server to all the latest patches, and I'm
: having trouble getting some stuff working. 
: 
: I have debug enabled in my mailscanner.conf file and when I try the
: clamavmodule I get libclamav warning, virus definitions are older
: than 7 days. 
: I just successfully ran freshclam and I have defined my
: freshclam.conf and my clamd.conf to both point to /var/lib/clamav.
: The definitions downloaded no problem and are in that directory now.  
: 
: I tried testing the wrapper script for it but it is giving me an
: error as well. 
: 
: [root@mail MailScanner]# /usr/lib/MailScanner/clamav-wrapper /tmp
: /usr/lib/MailScanner/clamav-wrapper: line 162: /usr/bin/clamscan: No
: such file or directory 
: 
: however my clamscan is in /usr/local/bin. For some reason it's not
: looking there properly I guess. 
: 
: I haven't tested the SA stuff yet, as I seem to be held up with my
: clamav issues. 
: 
: Thanks.
: --
: -=/>Thom

Do you have /usr/local/lib in /etc/ld.so.conf ?

If not, add it and run ldconfig and try again.

-Mike
From painethom at gmail.com  Mon May  7 16:43:33 2007
From: painethom at gmail.com (Thom Paine)
Date: Mon May  7 16:43:36 2007
Subject: New SA and Clam and MS 4.59.4-2
In-Reply-To: <6DEF8ABC1767C045B91F42066D36358E3AEB@HOUPEX01.nfsmith.info>
References: <9e1340d20705070833o682a3c08j2feadc9c3d4e2d51@mail.gmail.com>
	<6DEF8ABC1767C045B91F42066D36358E3AEB@HOUPEX01.nfsmith.info>
Message-ID: <9e1340d20705070843h5e1a4b24l4e09b9dd91aca29c@mail.gmail.com>

> Do you have /usr/local/lib in /etc/ld.so.conf ?
>

Yes, it is there.

I forgot to say that I have RHEL 3 U8.

Thanks.
-- 
-=/>Thom
From ssilva at sgvwater.com  Mon May  7 16:43:58 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Mon May  7 16:44:12 2007
Subject: Multi (split) image spam
In-Reply-To: <Pine.LNX.4.64.0705070816370.13685@ebfjryy.nhfvpf.arg>
References: <727373.44781.qm@web26307.mail.ukl.yahoo.com>
	<Pine.LNX.4.64.0705070816370.13685@ebfjryy.nhfvpf.arg>
Message-ID: <f1nhfv$js3$1@sea.gmane.org>

Res spake the following on 5/6/2007 3:25 PM:
> On Sun, 6 May 2007, Andrew MacLachlan wrote:
> 
>> Some of the spammers are doing resends though to get around greylisting
> 
> This is one of the reasons I consider greylisting useless :)
> I've seen this from this part of the world (oceania/asia area) for about
> as long as greylisting came about.
> 
> It's the same ol same ol, we do something to stop em, they circumvent
> it, we counter it and they will try counter it again, and so on and as
> grey listing is the most simplest thing to get around, i've always
> regarded it as a joke, and all it does it build up your own outgoing
> queues, this might be fine for those who do 1K messages a day but when
> you do millions,
> thats just not on, anyhow you might as well firewall off your primary MX
> making mail fail and force resend via secondary MX's.
> 
> 
That won't even help, as most of my spam goes straight for the secondaries anyway.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From edwardbruce at sbcglobal.net  Mon May  7 16:47:04 2007
From: edwardbruce at sbcglobal.net (Ed Bruce)
Date: Mon May  7 16:47:10 2007
Subject: Multi (split) image spam
In-Reply-To: <Pine.LNX.4.64.0705071903400.15271@ebfjryy.nhfvpf.arg>
References: <694855.76046.qm@web26301.mail.ukl.yahoo.com>
	<Pine.LNX.4.64.0705071903400.15271@ebfjryy.nhfvpf.arg>
Message-ID: <463F49F8.6080304@sbcglobal.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Res wrote:
> On Sun, 6 May 2007, Andrew MacLachlan wrote:
> 
>>> and all it does it build up your own outgoing queues
>> Not sure how the logic on that one works...
> 
> errr logic? WTF? if the queue cant send it right away it stays in the
> queue so lamelisted_mail+current_submissions=building_up_queue
> like I said it might be fine if you run a small office 1K emails p/day,
> but not when you do millions p/day, however I have tuned sendmail queue
> running so that new stuff goes first, I'm not going to allow new stuff
> to be delayed in oversized queue runners because some lamers server wont
> accept it on first attempt.
> 
> 

Res I didn't understand what you meant at first. Well I may still not
understand, but I'm guessing you are saying that if my MTA is running
some sort of gray listing and your MTA attempts a connection it will
cause your queues to back up???

I took your original message to mean that if I run gray listing then my
queues would back up. That didn't seem to make much sense to me as I
wouldn't gray list myself.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Cygwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGP0n4pdNaP9x3McgRArgZAKCRGB0GISE0JH2n0PF5lKidri3+OQCfXw9y
KsDBaz/j6cFRsvK9ABgXEYk=
=V5KN
-----END PGP SIGNATURE-----
From rpoe at plattesheriff.org  Mon May  7 16:53:07 2007
From: rpoe at plattesheriff.org (Rob Poe)
Date: Mon May  7 16:53:44 2007
Subject: Interesting need
Message-ID: <463F0518.65ED.00A2.0@plattesheriff.org>

This might not be so much a MailScanner function ... but 

I have a Linux / Sendmail / MailScanner box set up in front of a corporate mail system.  It's doing the domain as relay-domains and mailertable.  One of their users wants all of his EXTERNAL incoming mail to go to both HIM and his assistant.  

I tried with the aliases and virtusertable ... didn't work (just forwarded on to the corp mail system as if nothing was in there).  

Is this something I can do with a MailScanner rule?



From mkettler at evi-inc.com  Mon May  7 17:13:28 2007
From: mkettler at evi-inc.com (Matt Kettler)
Date: Mon May  7 17:13:47 2007
Subject: SpamAssassin 3.2.0
In-Reply-To: <Pine.LNX.4.64.0705070825330.13685@ebfjryy.nhfvpf.arg>
References: <463900B1.8080301@ecs.soton.ac.uk>
	<463B7C0C.9000004@evi-inc.com>	<Pine.LNX.4.64.0705050823120.3368@ebfjryy.nhfvpf.arg>	<463BB60B.3060608@evi-inc.com>	<Pine.LNX.4.64.0705051844320.2735@ebfjryy.nhfvpf.arg>	<463E12CC.7080806@evi-inc.com>
	<Pine.LNX.4.64.0705070825330.13685@ebfjryy.nhfvpf.arg>
Message-ID: <463F5028.9060201@evi-inc.com>

Res wrote:
> 
> On Sun, 6 May 2007, Matt Kettler wrote:
> 
>> Yes, it's a genuine bug.
> 
>> I reproduced it at home and produced a patch, which I tried to send
>> you a link
>> to, but unfortunately you don't seem to accept mail from my home ISP
>> (verizon).
> 
> Thanks Matt, I'll have a look later this morning. BTW I wouldn't have got
> the mail anyway if you had got in as res@ is a list/newsgroup only
> account unless your mail is sorted into a list folder its /dev/null'd
> primarily because I've used this a/c on usenet for along time so would
> have to be in every spam list, sendmail/MS get rid of 99% of the junk,
> my pine filtering rules eliminate the remaining :)
> 

Fair enough.. At home I don't use MailScanner, its a little bit of overkill for
a single-user vpopmail setup, so I'm not subscribed to this list there, hence
the off-list message.

For reference, the bug is this one:

http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5436

From MailScanner at ecs.soton.ac.uk  Mon May  7 17:37:17 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Mon May  7 17:37:53 2007
Subject: SpamAssassin 3.2.0 package
In-Reply-To: <f1ng46$6t7$2@sea.gmane.org>
References: <463C6D8E.5040802@ecs.soton.ac.uk>	<463C9E7C.7040600@protos.mine.nu>	<463CAD50.3050806@ecs.soton.ac.uk>	<463CB925.2050609@ecs.soton.ac.uk>
	<f1ng46$6t7$2@sea.gmane.org>
Message-ID: <463F55BD.7080209@ecs.soton.ac.uk>

Skipped content of type multipart/mixed-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070507/b1c5ec58/PGP.bin
From ssilva at sgvwater.com  Mon May  7 17:42:44 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Mon May  7 17:43:01 2007
Subject: SpamAssassin 3.2.0 package
In-Reply-To: <463F55BD.7080209@ecs.soton.ac.uk>
References: <463C6D8E.5040802@ecs.soton.ac.uk>	<463C9E7C.7040600@protos.mine.nu>	<463CAD50.3050806@ecs.soton.ac.uk>	<463CB925.2050609@ecs.soton.ac.uk>	<f1ng46$6t7$2@sea.gmane.org>
	<463F55BD.7080209@ecs.soton.ac.uk>
Message-ID: <f1nku5$bm$1@sea.gmane.org>

Julian Field spake the following on 5/7/2007 9:37 AM:
> 
> 
> Scott Silva wrote:
>> Julian Field spake the following on 5/5/2007 10:04 AM:
>>  
>>> I have done some basic tests with my SpamAssassin 3.2.0 package and
>>> MailScanner 4.59 and it is working fine.
>>>
>>> I'll do some more tests of it and probably start using it on a
>>> production machine tomorrow if I feel so inclined (and there again I
>>> might well just put my feet up and watch TV). It's a public holiday
>>> this weekend (I think!) so by definition it should rain on Monday at
>>> least. :-)
>>>
>>> Jules.
>>>     
>> Julian,
>> I haven't had an opportunity to look at it yet, but are you or did you
>> add an
>> init script for clamd? I was going to throw one together if it didn't
>> have
>> one. But if it is already there, I won't bother.
>>   
> No, I haven't done an init script for clamd. It should be easy enough to
> knock one up based on the MailScanner ones. The SuSE and RedHat-based
> ones need to be different, so if you fancy writing both based on the
> MailScanner ones that would be great.
> 
> Attached are the RedHat and SuSE init.d scripts for MailScanner itself
> so you can see the differences needed.
> 
> Obviously the clamd ones will be a lot shorter :-)
> 
> Jules
> 
I will get a Redhat script together asap. I will install SUSE in a VM to have
something to test on for it. It might be a few days for that one.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From MailScanner at ecs.soton.ac.uk  Mon May  7 17:40:33 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Mon May  7 17:43:12 2007
Subject: New SA and Clam and MS 4.59.4-2
In-Reply-To: <9e1340d20705070833o682a3c08j2feadc9c3d4e2d51@mail.gmail.com>
References: <9e1340d20705070833o682a3c08j2feadc9c3d4e2d51@mail.gmail.com>
Message-ID: <463F5681.3030301@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Thom Paine wrote:
> I am trying to update a server to all the latest patches, and I'm
> having trouble getting some stuff working.
>
> I have debug enabled in my mailscanner.conf file and when I try the
> clamavmodule I get libclamav warning, virus definitions are older than
> 7 days.
> I just successfully ran freshclam and I have defined my freshclam.conf
> and my clamd.conf to both point to /var/lib/clamav. The definitions
> downloaded no problem and are in that directory now.
>
> I tried testing the wrapper script for it but it is giving me an error 
> as well.
>
> [root@mail MailScanner]# /usr/lib/MailScanner/clamav-wrapper /tmp
> /usr/lib/MailScanner/clamav-wrapper: line 162: /usr/bin/clamscan: No
> such file or directory
The first command-line argument to all the -wrapper and -autoupdate 
scripts is the installation path for that scanner. MailScanner itself 
reads this from virus.scanners.conf. So if you want to run the wrapper 
by hand, then you need

/usr/lib/MailScanner/clamav-wrapper /usr/local /tmp

in order to scan /tmp, with ClamAV installed under /usr/local (which is 
where my ClamAV+SA package puts it, as that is the default installation 
location built into the ClamAV source code).

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGP1buEfZZRxQVtlQRArAlAKD8mEIJckSh7dGN09kXjbE+JsRyEACePad5
2xizdcIZAkPTcybj7L3gvCo=
=YiUI
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From Richard.Frovarp at sendit.nodak.edu  Mon May  7 17:53:15 2007
From: Richard.Frovarp at sendit.nodak.edu (Richard Frovarp)
Date: Mon May  7 17:53:19 2007
Subject: Multi (split) image spam
In-Reply-To: <f1nhfv$js3$1@sea.gmane.org>
References: <727373.44781.qm@web26307.mail.ukl.yahoo.com>	<Pine.LNX.4.64.0705070816370.13685@ebfjryy.nhfvpf.arg>
	<f1nhfv$js3$1@sea.gmane.org>
Message-ID: <463F597B.6060608@sendit.nodak.edu>

Scott Silva wrote:
> Res spake the following on 5/6/2007 3:25 PM:
>   
>> On Sun, 6 May 2007, Andrew MacLachlan wrote:
>>
>>     
>>> Some of the spammers are doing resends though to get around greylisting
>>>       
>> This is one of the reasons I consider greylisting useless :)
>> I've seen this from this part of the world (oceania/asia area) for about
>> as long as greylisting came about.
>>
>> It's the same ol same ol, we do something to stop em, they circumvent
>> it, we counter it and they will try counter it again, and so on and as
>> grey listing is the most simplest thing to get around, i've always
>> regarded it as a joke, and all it does it build up your own outgoing
>> queues, this might be fine for those who do 1K messages a day but when
>> you do millions,
>> thats just not on, anyhow you might as well firewall off your primary MX
>> making mail fail and force resend via secondary MX's.
>>
>>
>>     
> That won't even help, as most of my spam goes straight for the secondaries anyway.
>
>   

Our primary is firewalled off. I have no clue as to how much spam it 
blocks. However, we have allowed the three large internal networks to go 
through the firewall. We did this because we were getting too much spam 
and our incoming queues were building up. People kind of expect that 
mail from the person sitting next to them to come through pretty 
quickly, and we were having trouble making that happen. Since our 
primary only processes mail from the networks my organization is 
associated with (the state, k12, and higher ed networks in the state), 
it can fire mail through very quickly. It might not be effective for 
stopping spam, but it certainly can help with processing delays of local 
mail.

A subsequent upgrade to milter-greylist 3.0 resulted in massive speed 
improvements on the other machines to pretty much remove the queue build up.
From Richard.Frovarp at sendit.nodak.edu  Mon May  7 17:56:03 2007
From: Richard.Frovarp at sendit.nodak.edu (Richard Frovarp)
Date: Mon May  7 17:56:05 2007
Subject: New SA and Clam and MS 4.59.4-2
In-Reply-To: <9e1340d20705070833o682a3c08j2feadc9c3d4e2d51@mail.gmail.com>
References: <9e1340d20705070833o682a3c08j2feadc9c3d4e2d51@mail.gmail.com>
Message-ID: <463F5A23.7010204@sendit.nodak.edu>

Thom Paine wrote:
> I am trying to update a server to all the latest patches, and I'm
> having trouble getting some stuff working.
>
> I have debug enabled in my mailscanner.conf file and when I try the
> clamavmodule I get libclamav warning, virus definitions are older than
> 7 days.
> I just successfully ran freshclam and I have defined my freshclam.conf
> and my clamd.conf to both point to /var/lib/clamav. The definitions
> downloaded no problem and are in that directory now.
>
> I tried testing the wrapper script for it but it is giving me an error 
> as well.
>
> [root@mail MailScanner]# /usr/lib/MailScanner/clamav-wrapper /tmp
> /usr/lib/MailScanner/clamav-wrapper: line 162: /usr/bin/clamscan: No
> such file or directory
>
> however my clamscan is in /usr/local/bin. For some reason it's not
> looking there properly I guess.
>
> I haven't tested the SA stuff yet, as I seem to be held up with my
> clamav issues.
>
> Thanks.

In MailScanner.conf:

Monitors for ClamAV Updates = /usr/local/share/clamav/*.inc/* 
/usr/local/share/clamav/*.cvd

From MailScanner at ecs.soton.ac.uk  Mon May  7 18:04:16 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Mon May  7 18:07:52 2007
Subject: Interesting need
In-Reply-To: <463F0518.65ED.00A2.0@plattesheriff.org>
References: <463F0518.65ED.00A2.0@plattesheriff.org>
Message-ID: <463F5C10.7080307@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dead easy. Put a ruleset on "Archive Mail =".

For example, say "theboss@yourdomain.com" wants all his incoming 
external mail to go to himself and "assistant@yourdomain.com".

In MailScanner.conf, set

Archive Mail = %rules-dir%/archive.mail.rules

Put the ruleset in /etc/MailScanner/rules/archive.mail.rules. In this 
file, put:

FromOrTo: default
To: theboss@yourdomain.com assistant@yourdomain.com

Then just force a MailScanner configuration reload with

service MailScanner reload


Rob Poe wrote:
> This might not be so much a MailScanner function ... but 
>
> I have a Linux / Sendmail / MailScanner box set up in front of a corporate mail system.  It's doing the domain as relay-domains and mailertable.  One of their users wants all of his EXTERNAL incoming mail to go to both HIM and his assistant.  
>
> I tried with the aliases and virtusertable ... didn't work (just forwarded on to the corp mail system as if nothing was in there).  
>
> Is this something I can do with a MailScanner rule?
>
>
>
>   

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGP1zKEfZZRxQVtlQRAjv8AJ9aKslrMJC6Od0vG1XaNRmQw1JboACbBZ+Z
qWfLcoajUFGC5li684N5+2Q=
=cwWu
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From ssilva at sgvwater.com  Mon May  7 19:17:00 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Mon May  7 19:17:39 2007
Subject: SpamAssassin 3.2.0 package
In-Reply-To: <463F55BD.7080209@ecs.soton.ac.uk>
References: <463C6D8E.5040802@ecs.soton.ac.uk>	<463C9E7C.7040600@protos.mine.nu>	<463CAD50.3050806@ecs.soton.ac.uk>	<463CB925.2050609@ecs.soton.ac.uk>	<f1ng46$6t7$2@sea.gmane.org>
	<463F55BD.7080209@ecs.soton.ac.uk>
Message-ID: <f1nqeu$klb$1@sea.gmane.org>

Julian Field spake the following on 5/7/2007 9:37 AM:
> 
> 
> Scott Silva wrote:
>> Julian Field spake the following on 5/5/2007 10:04 AM:
>>  
>>> I have done some basic tests with my SpamAssassin 3.2.0 package and
>>> MailScanner 4.59 and it is working fine.
>>>
>>> I'll do some more tests of it and probably start using it on a
>>> production machine tomorrow if I feel so inclined (and there again I
>>> might well just put my feet up and watch TV). It's a public holiday
>>> this weekend (I think!) so by definition it should rain on Monday at
>>> least. :-)
>>>
>>> Jules.
>>>     
>> Julian,
>> I haven't had an opportunity to look at it yet, but are you or did you
>> add an
>> init script for clamd? I was going to throw one together if it didn't
>> have
>> one. But if it is already there, I won't bother.
>>   
> No, I haven't done an init script for clamd. It should be easy enough to
> knock one up based on the MailScanner ones. The SuSE and RedHat-based
> ones need to be different, so if you fancy writing both based on the
> MailScanner ones that would be great.
> 
> Attached are the RedHat and SuSE init.d scripts for MailScanner itself
> so you can see the differences needed.
> 
> Obviously the clamd ones will be a lot shorter :-)
> 
> Jules
> 
In looking at this, there will need to be more than just an init script. There
will need to be a clamd.conf file, and probably a logrotate script. I don't
know how much extra stuff you want to add, but I'm game if you dont mind the
extra fluff.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From rcooper at dwford.com  Mon May  7 19:24:08 2007
From: rcooper at dwford.com (Rick Cooper)
Date: Mon May  7 19:24:12 2007
Subject: Clamav suggestions
In-Reply-To: <223f97700705070743l47a131cayc53ff788c9642f37@mail.gmail.com>
References: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it><463B5E8A.2080400@sendit.nodak.edu><085b01c78f29$f30cc540$0301a8c0@SAHOMELT><463CAF50.8030305@ecs.soton.ac.uk><089801c78f42$78529500$0301a8c0@SAHOMELT>
	<223f97700705070743l47a131cayc53ff788c9642f37@mail.gmail.com>
Message-ID: <0ba101c790d4$e72226b0$0301a8c0@SAHOMELT>

 

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info 
> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf 
> Of Glenn Steen
> Sent: Monday, May 07, 2007 10:44 AM
> To: MailScanner discussion
> Subject: Re: Clamav suggestions
> 
[..]
> 
> Hey Rick, I'm pretty certain Jules isn't needling you about style....
> Rather me and my "p record patches":-):-). Oh well, there is a reason
> I don't write "Programmer" on my cards anymore:-)
> 
> Cheers
> -- 
> -- Glenn
> email: glenn < dot > steen < at > gmail < dot > com
> work: glenn < dot > steen < at > ap1 < dot > se
> -- 

Yeah, actually he is (good naturedly of course). Perl isn't my first choice
for languages and most don't have the short circuiting that perl does so I
have a tendency to write

	if (! $blather){
		dothis;
	}
	
Instead of 
	unless $blather do this;

A lot of the rewriting I did on the unrar stuff was done so the code flowed
better with Julian's style, and since I could fall off the planet tomorrow I
think it best to try and code things for his ease of reading not mine. I try
and get close and he can change anything he likes from there, it's his
program after all.

I think I will be pretty close this time around because I am cheating. I
decided I would take the core out of the clamavmodule core and wrap the
socket programming around that so it's about the same except sending the
"$dirname/$childname/$filename" to the clamavmodule instance it's sent to
the clam socket, 45/50 lines of code are Julian's own so that should be
pretty close to his style ;-) Besides that will allow reusing the
clamavmodule parser code to keep the bloat down, if Julian approves, that
is.

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


From Denis.Beauchemin at USherbrooke.ca  Mon May  7 19:54:08 2007
From: Denis.Beauchemin at USherbrooke.ca (Denis Beauchemin)
Date: Mon May  7 19:54:28 2007
Subject: Updates Script to fetch Steve Basford's Phihing Sigs for ClamAV
In-Reply-To: <86144ED6CE5B004DA23E1EAC0B569B580CC0B081@isabella.herefordshire.gov.uk>
References: <86144ED6CE5B004DA23E1EAC0B569B580CC0B081@isabella.herefordshire.gov.uk>
Message-ID: <463F75D0.40007@USherbrooke.ca>

Randal, Phil a ?crit :
> Folks,
>
> Steve Basford has a ClamAV phishing database over at
>  
>    http://www.sanesecurity.com/clamav/
>
> and has recently updated his site to provide a gzipped version of the
> file.
>
> The attached script is a modified version of the one I posted to this
> list back in March.  This version uses curl to fetch newer versions of
> the gzipped database.
>
>   
Phil,

Your script stopped working during lunchtime and when I got back there 
was a huge backlog on my servers.

I found the following error message in my logs:
  ClamAV Module ERROR:: Could not load databases from 
/usr/local/share/clamav

Turns out there was an empty definition file in Clam's directory:
# cd /usr/local/share/clamav/
# ls -l
total 16
drwxr-xr-x 2 clamav clamav 4096 May  7 14:09 daily.inc/
drwxr-xr-x 2 clamav clamav 4096 May  7 13:49 main.inc/
-rw------- 1 clamav clamav  208 May  7 14:09 mirrors.dat
-rw-r--r-- 1 clamav clamav    0 May  7 12:25 phish.ndb
-rw-r--r-- 1 root   root    316 May  7 12:25 phish.ndb.gz

I changed your script to get the definitions from a mirror (the 
recommended way nowadays).  Take a look at 
http://sanesecurity.co.uk/clamav/downloads.htm

I decided to use :
phish_file=http://mirrors.dotsrc.org/clamav-sanesigs/$phish_gz

There are other download scripts on this page:
http://sanesecurity.co.uk/clamav/usage.htm

Denis

-- 
   _
  ?v?   Denis Beauchemin, analyste
 /(_)\  Universit? de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x62252 F: 819.821.8045


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3595 bytes
Desc: S/MIME Cryptographic Signature
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070507/eb496a07/smime-0001.bin
From alex at nkpanama.com  Mon May  7 20:01:23 2007
From: alex at nkpanama.com (Alex Neuman van der Hans)
Date: Mon May  7 20:02:20 2007
Subject: Interesting need
In-Reply-To: <463F5C10.7080307@ecs.soton.ac.uk>
References: <463F0518.65ED.00A2.0@plattesheriff.org>
	<463F5C10.7080307@ecs.soton.ac.uk>
Message-ID: <463F7783.7070608@nkpanama.com>

Archive mail "forwards" email? I thought it only "archived" it...

I would have used an "actions =" statement with "forward 
blabla@blablah.com" where blablah@blablah.com is an alias for both 
addresses.

Julian Field wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Dead easy. Put a ruleset on "Archive Mail =".
>
> For example, say "theboss@yourdomain.com" wants all his incoming 
> external mail to go to himself and "assistant@yourdomain.com".
>
> In MailScanner.conf, set
>
> Archive Mail = %rules-dir%/archive.mail.rules
>
> Put the ruleset in /etc/MailScanner/rules/archive.mail.rules. In this 
> file, put:
>
> FromOrTo: default
> To: theboss@yourdomain.com assistant@yourdomain.com
>
> Then just force a MailScanner configuration reload with
>
> service MailScanner reload
>
>
> Rob Poe wrote:
>   
>> This might not be so much a MailScanner function ... but 
>>
>> I have a Linux / Sendmail / MailScanner box set up in front of a corporate mail system.  It's doing the domain as relay-domains and mailertable.  One of their users wants all of his EXTERNAL incoming mail to go to both HIM and his assistant.  
>>
>> I tried with the aliases and virtusertable ... didn't work (just forwarded on to the corp mail system as if nothing was in there).  
>>
>> Is this something I can do with a MailScanner rule?
>>
>>
>>
>>   
>>     
>
> Jules
>
> - -- 
> Julian Field MEng CITP
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> MailScanner customisation, or any advanced system administration help?
> Contact me at Jules@Jules.FM
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> For all your IT requirements visit www.transtec.co.uk
>
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGP Desktop 9.6.1 (Build 1012)
> Charset: ISO-8859-1
>
> wj8DBQFGP1zKEfZZRxQVtlQRAjv8AJ9aKslrMJC6Od0vG1XaNRmQw1JboACbBZ+Z
> qWfLcoajUFGC5li684N5+2Q=
> =cwWu
> -----END PGP SIGNATURE-----
>
>   

From jimc at laridian.com  Mon May  7 20:25:22 2007
From: jimc at laridian.com (Jim Coates)
Date: Mon May  7 20:28:12 2007
Subject: MailScanner failing to deliver
In-Reply-To: <Pine.LNX.4.64.0705061000580.8847@faramir.hugo.vanderkooij.org>
Message-ID: <00b901c790dd$76066050$6501a8c0@zorak>

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info 
> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf 
> Of Hugo van der Kooij
> Sent: Sunday, May 06, 2007 3:05 AM
> To: MailScanner discussion
> Subject: Re: MailScanner failing to deliver
> 
> 
> On Sat, 5 May 2007, Jim Coates wrote:
> 
> > My host had to upgrade some things on our server and in the process 
> > upgraded MailScanner to the latest available from the ports tree 
> > (FreeBSD).  The version is 4.50.15.
> >
> > Since the upgrade, its been having issues... it seems to 
> receive email 
> > (I can tail the maillog and see stuff coming in), but it 
> only delivers 
> > inbound and outbound for a short period of time. I then have to 
> > restart MailScanner, and it will once again deliver for 
> just a short 
> > period of time.
> >
> > When it restarts (and seemingly before it fails too) there 
> are a group 
> > of messages that get processed over and over.
> >
> > Another oddity... when tailing the maillog, I see MailScanner start 
> > multiple times... IE - it puts up the version info and the 
> number of 
> > messages in queue etc... then a few seconds later I see the 
> same thing 
> > twice more.
> >
> > Any ideas? I wasn't having these issues at all with the 
> older version 
> > of MailScanner that I was running.
> >
> > NEW INFORMATION: when I do a "mailscanner --lint" it tells me the 
> > following:
> >
> > mail2# mailscanner --lint
> > Read 701 hostnames from the phishing whitelist
> > Config: calling custom init function MailWatchLogging
> > Cannot write pid file , No such file or directory at 
> > /usr/local/sbin/mailscanner line 1238
> 
> I suggest you check this out and fix what is required to be fixed.
> 
> > Checking for SpamAssassin errors (if you use it)...
> > Using SpamAssassin results cache
> > Connected to SpamAssassin cache database
> > SpamAssassin reported no errors.
> > MailScanner.conf says "Virus Scanners = clamav"
> > Found these virus scanners installed: clamavmodule
> > mail2#
> >
> > I also had MailWatch installed, but the host recently 
> upgraded MySQL 
> > and it has not worked since then.  Not sure what the cause is or if 
> > its adding to this trouble.  I do get a considerable amount of :
> >
> > May  5 22:56:57 mail2 MailScanner[98183]: Started SQL Logging child 
> > May  5 22:56:57 mail2 MailScanner[98106]: Started SQL Logging child 
> > May  5 22:56:58 mail2 MailScanner[58029]: Started SQL Logging child 
> > May  5 22:57:00 mail2 MailScanner[96343]: Started SQL Logging child 
> > May  5 22:57:08 mail2 MailScanner[98200]: Started SQL Logging child
> >
> > Basically I am having to restart it about every 30 minutes 
> right now, 
> > so I'd love any help you can give me.
> 
> If MailWatch is not working there is nothing to be lost from 
> removing the 
> MailWatch line(s) from your config now. See if it is degrading your 
> MailScanner  functionality.
> 
> Did you go over the changelog to see if things changed from your old 
> version to your current one?
> 
> Hugo.

Turns out it was MailWatch that was hanging up MailScanner.  Haven't figured
out why, but removing the MailWatchLogging line fixed it for now.

Jim

From MailScanner at ecs.soton.ac.uk  Mon May  7 20:39:33 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Mon May  7 20:42:56 2007
Subject: SpamAssassin 3.2.0 package
In-Reply-To: <f1nqeu$klb$1@sea.gmane.org>
References: <463C6D8E.5040802@ecs.soton.ac.uk>	<463C9E7C.7040600@protos.mine.nu>	<463CAD50.3050806@ecs.soton.ac.uk>	<463CB925.2050609@ecs.soton.ac.uk>	<f1ng46$6t7$2@sea.gmane.org>	<463F55BD.7080209@ecs.soton.ac.uk>
	<f1nqeu$klb$1@sea.gmane.org>
Message-ID: <463F8075.60900@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Scott Silva wrote:
> Julian Field spake the following on 5/7/2007 9:37 AM:
>   
>> Scott Silva wrote:
>>     
>>> Julian Field spake the following on 5/5/2007 10:04 AM:
>>>  
>>>       
>>>> I have done some basic tests with my SpamAssassin 3.2.0 package and
>>>> MailScanner 4.59 and it is working fine.
>>>>
>>>> I'll do some more tests of it and probably start using it on a
>>>> production machine tomorrow if I feel so inclined (and there again I
>>>> might well just put my feet up and watch TV). It's a public holiday
>>>> this weekend (I think!) so by definition it should rain on Monday at
>>>> least. :-)
>>>>
>>>> Jules.
>>>>     
>>>>         
>>> Julian,
>>> I haven't had an opportunity to look at it yet, but are you or did you
>>> add an
>>> init script for clamd? I was going to throw one together if it didn't
>>> have
>>> one. But if it is already there, I won't bother.
>>>   
>>>       
>> No, I haven't done an init script for clamd. It should be easy enough to
>> knock one up based on the MailScanner ones. The SuSE and RedHat-based
>> ones need to be different, so if you fancy writing both based on the
>> MailScanner ones that would be great.
>>
>> Attached are the RedHat and SuSE init.d scripts for MailScanner itself
>> so you can see the differences needed.
>>
>> Obviously the clamd ones will be a lot shorter :-)
>>
>> Jules
>>
>>     
> In looking at this, there will need to be more than just an init script. There
> will need to be a clamd.conf file, and probably a logrotate script. I don't
> know how much extra stuff you want to add, but I'm game if you dont mind the
> extra fluff.
>   
Is it really true that no-one else has done a decent RPM of clamd yet? I 
would be surprised if Dag Wieers hasn't done one already, for starters. 
If there is one, why are we duplicating the effort?

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: UTF-8

wj8DBQFGP4EeEfZZRxQVtlQRAnIPAKCQnsIUEthWQbi2R6bbRiO7Q8DCnQCg6zXv
y5RNQN2fTRygk4Xny1Opi64=
=gz9L
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From MailScanner at ecs.soton.ac.uk  Mon May  7 20:46:54 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Mon May  7 20:47:47 2007
Subject: Interesting need
In-Reply-To: <463F7783.7070608@nkpanama.com>
References: <463F0518.65ED.00A2.0@plattesheriff.org>	<463F5C10.7080307@ecs.soton.ac.uk>
	<463F7783.7070608@nkpanama.com>
Message-ID: <463F822E.2010108@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Alex Neuman van der Hans wrote:
> Archive mail "forwards" email? I thought it only "archived" it...
RTFM my friend :-)

Best regards,

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGP4I8EfZZRxQVtlQRAukRAJ4/kR547/Yym2whwfTU2xPp4w/AMgCfcwcM
LvwmIoikao6OZY+E6MvOp94=
=+Jsy
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From MailScanner at ecs.soton.ac.uk  Mon May  7 20:44:48 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Mon May  7 20:48:04 2007
Subject: Clamav suggestions
In-Reply-To: <0ba101c790d4$e72226b0$0301a8c0@SAHOMELT>
References: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it><463B5E8A.2080400@sendit.nodak.edu><085b01c78f29$f30cc540$0301a8c0@SAHOMELT><463CAF50.8030305@ecs.soton.ac.uk><089801c78f42$78529500$0301a8c0@SAHOMELT>	<223f97700705070743l47a131cayc53ff788c9642f37@mail.gmail.com>
	<0ba101c790d4$e72226b0$0301a8c0@SAHOMELT>
Message-ID: <463F81B0.9010002@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Rick Cooper wrote:
>  
>
>   
>> -----Original Message-----
>> From: mailscanner-bounces@lists.mailscanner.info 
>> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf 
>> Of Glenn Steen
>> Sent: Monday, May 07, 2007 10:44 AM
>> To: MailScanner discussion
>> Subject: Re: Clamav suggestions
>>
>>     
> [..]
>   
>> Hey Rick, I'm pretty certain Jules isn't needling you about style....
>> Rather me and my "p record patches":-):-). Oh well, there is a reason
>> I don't write "Programmer" on my cards anymore:-)
>>
>> Cheers
>> -- 
>> -- Glenn
>> email: glenn < dot > steen < at > gmail < dot > com
>> work: glenn < dot > steen < at > ap1 < dot > se
>> -- 
>>     
>
> Yeah, actually he is (good naturedly of course). Perl isn't my first choice
> for languages and most don't have the short circuiting that perl does so I
> have a tendency to write
>
> 	if (! $blather){
> 		dothis;
> 	}
> 	
> Instead of 
> 	unless $blather do this;
>   
Personally I would "dothis unless $blather;".
> A lot of the rewriting I did on the unrar stuff was done so the code flowed
> better with Julian's style, and since I could fall off the planet tomorrow I
> think it best to try and code things for his ease of reading not mine.
Personal history has shown that I am considerably more likely to fall 
off the planet tomorrow than you are. My friends and I have this theory 
that I'm actually a cat, and therefore have 9 lives. I've used up 6 so 
far...
:-)
>  I try
> and get close and he can change anything he likes from there, it's his
> program after all.
>
> I think I will be pretty close this time around because I am cheating. I
> decided I would take the core out of the clamavmodule core and wrap the
> socket programming around that so it's about the same except sending the
> "$dirname/$childname/$filename" to the clamavmodule instance it's sent to
> the clam socket, 45/50 lines of code are Julian's own so that should be
> pretty close to his style ;-) Besides that will allow reusing the
> clamavmodule parser code to keep the bloat down, if Julian approves, that
> is.
>   
Reusing the clamavmodule parser code sounds like a very good idea.

Best regards,

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGP4I7EfZZRxQVtlQRAm4vAKDapzek6R32CBMQEzGrD3KepZjgMACeOdsB
Vy0f9Ga6unwwkRaYHmTfxtk=
=tOQo
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From doc at maddoc.net  Mon May  7 20:50:03 2007
From: doc at maddoc.net (Doc Schneider)
Date: Mon May  7 20:50:14 2007
Subject: SpamAssassin 3.2.0 package
In-Reply-To: <463F8075.60900@ecs.soton.ac.uk>
References: <463C6D8E.5040802@ecs.soton.ac.uk>	<463C9E7C.7040600@protos.mine.nu>	<463CAD50.3050806@ecs.soton.ac.uk>	<463CB925.2050609@ecs.soton.ac.uk>	<f1ng46$6t7$2@sea.gmane.org>	<463F55BD.7080209@ecs.soton.ac.uk>	<f1nqeu$klb$1@sea.gmane.org>
	<463F8075.60900@ecs.soton.ac.uk>
Message-ID: <463F82EB.9080404@maddoc.net>

Julian Field wrote:
> 
> 
> Scott Silva wrote:
>> Julian Field spake the following on 5/7/2007 9:37 AM:
> 
>>> Scott Silva wrote:
>>>     
>>>> Julian Field spake the following on 5/5/2007 10:04 AM:
>>>>  
>>>>       
>>>>> I have done some basic tests with my SpamAssassin 3.2.0 package and
>>>>> MailScanner 4.59 and it is working fine.
>>>>>
>>>>> I'll do some more tests of it and probably start using it on a
>>>>> production machine tomorrow if I feel so inclined (and there again I
>>>>> might well just put my feet up and watch TV). It's a public holiday
>>>>> this weekend (I think!) so by definition it should rain on Monday at
>>>>> least. :-)
>>>>>
>>>>> Jules.
>>>>>     
>>>>>         
>>>> Julian,
>>>> I haven't had an opportunity to look at it yet, but are you or did you
>>>> add an
>>>> init script for clamd? I was going to throw one together if it didn't
>>>> have
>>>> one. But if it is already there, I won't bother.
>>>>   
>>>>       
>>> No, I haven't done an init script for clamd. It should be easy enough to
>>> knock one up based on the MailScanner ones. The SuSE and RedHat-based
>>> ones need to be different, so if you fancy writing both based on the
>>> MailScanner ones that would be great.
>>>
>>> Attached are the RedHat and SuSE init.d scripts for MailScanner itself
>>> so you can see the differences needed.
>>>
>>> Obviously the clamd ones will be a lot shorter :-)
>>>
>>> Jules
>>>
>>>     
>> In looking at this, there will need to be more than just an init script. There
>> will need to be a clamd.conf file, and probably a logrotate script. I don't
>> know how much extra stuff you want to add, but I'm game if you dont mind the
>> extra fluff.
> 
> Is it really true that no-one else has done a decent RPM of clamd yet? I 
> would be surprised if Dag Wieers hasn't done one already, for starters. 
> If there is one, why are we duplicating the effort?
> 
> Jules
> 

Jules,

Dag Wieers has a current rpm for clamav-0.90.2 was there less than 24
hours after it was released.

-- 
-Doc
Lincoln, NE.
http://www.genealogyforyou.com/
http://www.cairnproductions.com/

From ssilva at sgvwater.com  Mon May  7 21:02:17 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Mon May  7 21:07:42 2007
Subject: SpamAssassin 3.2.0 package
In-Reply-To: <463F8075.60900@ecs.soton.ac.uk>
References: <463C6D8E.5040802@ecs.soton.ac.uk>	<463C9E7C.7040600@protos.mine.nu>	<463CAD50.3050806@ecs.soton.ac.uk>	<463CB925.2050609@ecs.soton.ac.uk>	<f1ng46$6t7$2@sea.gmane.org>	<463F55BD.7080209@ecs.soton.ac.uk>	<f1nqeu$klb$1@sea.gmane.org>
	<463F8075.60900@ecs.soton.ac.uk>
Message-ID: <f1o0ka$e2o$1@sea.gmane.org>

Julian Field spake the following on 5/7/2007 12:39 PM:
> 
> 
> Scott Silva wrote:
>> Julian Field spake the following on 5/7/2007 9:37 AM:
> 
>>> Scott Silva wrote:
>>>     
>>>> Julian Field spake the following on 5/5/2007 10:04 AM:
>>>>  
>>>>       
>>>>> I have done some basic tests with my SpamAssassin 3.2.0 package and
>>>>> MailScanner 4.59 and it is working fine.
>>>>>
>>>>> I'll do some more tests of it and probably start using it on a
>>>>> production machine tomorrow if I feel so inclined (and there again I
>>>>> might well just put my feet up and watch TV). It's a public holiday
>>>>> this weekend (I think!) so by definition it should rain on Monday at
>>>>> least. :-)
>>>>>
>>>>> Jules.
>>>>>     
>>>>>         
>>>> Julian,
>>>> I haven't had an opportunity to look at it yet, but are you or did you
>>>> add an
>>>> init script for clamd? I was going to throw one together if it didn't
>>>> have
>>>> one. But if it is already there, I won't bother.
>>>>   
>>>>       
>>> No, I haven't done an init script for clamd. It should be easy enough to
>>> knock one up based on the MailScanner ones. The SuSE and RedHat-based
>>> ones need to be different, so if you fancy writing both based on the
>>> MailScanner ones that would be great.
>>>
>>> Attached are the RedHat and SuSE init.d scripts for MailScanner itself
>>> so you can see the differences needed.
>>>
>>> Obviously the clamd ones will be a lot shorter :-)
>>>
>>> Jules
>>>
>>>     
>> In looking at this, there will need to be more than just an init script. There
>> will need to be a clamd.conf file, and probably a logrotate script. I don't
>> know how much extra stuff you want to add, but I'm game if you dont mind the
>> extra fluff.
> 
> Is it really true that no-one else has done a decent RPM of clamd yet? I 
> would be surprised if Dag Wieers hasn't done one already, for starters. 
> If there is one, why are we duplicating the effort?
> 
> Jules
> 
I was thinking the same thing in the last hour or so. I am leaning to Dag's or
Axel's rpm's. I just need to find all the old stuff and delete it so I don't
get any duplication or problems later.
-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From ssilva at sgvwater.com  Mon May  7 22:07:40 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Mon May  7 22:08:09 2007
Subject: SpamAssassin 3.2.0 package
In-Reply-To: <463F8075.60900@ecs.soton.ac.uk>
References: <463C6D8E.5040802@ecs.soton.ac.uk>	<463C9E7C.7040600@protos.mine.nu>	<463CAD50.3050806@ecs.soton.ac.uk>	<463CB925.2050609@ecs.soton.ac.uk>	<f1ng46$6t7$2@sea.gmane.org>	<463F55BD.7080209@ecs.soton.ac.uk>	<f1nqeu$klb$1@sea.gmane.org>
	<463F8075.60900@ecs.soton.ac.uk>
Message-ID: <f1o4et$tf1$1@sea.gmane.org>

Julian Field spake the following on 5/7/2007 12:39 PM:
> 
> 
> Scott Silva wrote:
>> Julian Field spake the following on 5/7/2007 9:37 AM:
> 
>>> Scott Silva wrote:
>>>     
>>>> Julian Field spake the following on 5/5/2007 10:04 AM:
>>>>  
>>>>       
>>>>> I have done some basic tests with my SpamAssassin 3.2.0 package and
>>>>> MailScanner 4.59 and it is working fine.
>>>>>
>>>>> I'll do some more tests of it and probably start using it on a
>>>>> production machine tomorrow if I feel so inclined (and there again I
>>>>> might well just put my feet up and watch TV). It's a public holiday
>>>>> this weekend (I think!) so by definition it should rain on Monday at
>>>>> least. :-)
>>>>>
>>>>> Jules.
>>>>>     
>>>>>         
>>>> Julian,
>>>> I haven't had an opportunity to look at it yet, but are you or did you
>>>> add an
>>>> init script for clamd? I was going to throw one together if it didn't
>>>> have
>>>> one. But if it is already there, I won't bother.
>>>>   
>>>>       
>>> No, I haven't done an init script for clamd. It should be easy enough to
>>> knock one up based on the MailScanner ones. The SuSE and RedHat-based
>>> ones need to be different, so if you fancy writing both based on the
>>> MailScanner ones that would be great.
>>>
>>> Attached are the RedHat and SuSE init.d scripts for MailScanner itself
>>> so you can see the differences needed.
>>>
>>> Obviously the clamd ones will be a lot shorter :-)
>>>
>>> Jules
>>>
>>>     
>> In looking at this, there will need to be more than just an init script. There
>> will need to be a clamd.conf file, and probably a logrotate script. I don't
>> know how much extra stuff you want to add, but I'm game if you dont mind the
>> extra fluff.
> 
> Is it really true that no-one else has done a decent RPM of clamd yet? I 
> would be surprised if Dag Wieers hasn't done one already, for starters. 
> If there is one, why are we duplicating the effort?
> 
> Jules
> 
I would be happy if I could just get the clamavmodule running on the system
that seems hosed. I still haven't seen any kind of code to give me a better
idea of where it is bombing. I will try another --debug run later tonite, but
can't stop the server until after 17:00 hours local. Clamscan works OK, but
when the upgrade first applied, the bad system couldn't even run clamscan.
Maybe the module isn't pointing at the correct library?
I will do a force install of the clamavmodule before the debug run, although I
thought I did already.


Never mind now -- force install from cpan would fail tests and not re-install,
but compiling from the Mail::Clamav tarball finally kicked the POS into gear.
And this is the busier of the 2 servers.  The load is already dropping.
-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From amaclach at yahoo.co.uk  Mon May  7 22:09:03 2007
From: amaclach at yahoo.co.uk (Andrew MacLachlan)
Date: Mon May  7 22:09:06 2007
Subject: Multi (split) image spam
Message-ID: <795384.84076.qm@web26315.mail.ukl.yahoo.com>

Thanks Ed - That was my take as well.
To be fair, I can see both sides of the argument, however I consider greylisting to still be an essential tool in the fight against spam. As always there are many different implementations and each has it's pros and cons.
I have yet to see the perfect greylist implementation, but there has been some good work done by someone in Japan who modified postgrey so that it would only greylist dynamic addresses (determined by regex). Although this is nowhere near perfect it is certainly a step in the right direction (and should keep Res happy as well as his mailservers would be unlikely to be hit.) by adding some intelligence to the default postgrey implementation - which is a fairly blunt  -yet effective instrument.

No reply earlier to this to avoid a flame war which is never a good look!

-Andy

----- Original Message ----
From: Ed Bruce <edwardbruce@sbcglobal.net>
To: MailScanner discussion <mailscanner@lists.mailscanner.info>
Sent: Monday, 7 May, 2007 4:47:04 PM
Subject: Re: Multi (split) image spam

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Res wrote:
> On Sun, 6 May 2007, Andrew MacLachlan wrote:
> 
>>> and all it does it build up your own outgoing queues
>> Not sure how the logic on that one works...
> 
> errr logic? WTF? if the queue cant send it right away it stays in the
> queue so lamelisted_mail+current_submissions=building_up_queue
> like I said it might be fine if you run a small office 1K emails p/day,
> but not when you do millions p/day, however I have tuned sendmail queue
> running so that new stuff goes first, I'm not going to allow new stuff
> to be delayed in oversized queue runners because some lamers server wont
> accept it on first attempt.
> 
> 

Res I didn't understand what you meant at first. Well I may still not
understand, but I'm guessing you are saying that if my MTA is running
some sort of gray listing and your MTA attempts a connection it will
cause your queues to back up???

I took your original message to mean that if I run gray listing then my
queues would back up. That didn't seem to make much sense to me as I
wouldn't gray list myself.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Cygwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGP0n4pdNaP9x3McgRArgZAKCRGB0GISE0JH2n0PF5lKidri3+OQCfXw9y
KsDBaz/j6cFRsvK9ABgXEYk=
=V5KN
-----END PGP SIGNATURE-----
-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 



From amaclach at yahoo.co.uk  Mon May  7 22:14:26 2007
From: amaclach at yahoo.co.uk (Andrew MacLachlan)
Date: Mon May  7 22:14:28 2007
Subject: Interesting need
Message-ID: <589025.24756.qm@web26311.mail.ukl.yahoo.com>

Or if you use Exchange internally - setup a rule, that way you can also forward all internal messages. (no anti exchange rants please - It's paid many of my bills...)

----- Original Message ----
From: Julian Field <MailScanner@ecs.soton.ac.uk>
To: MailScanner discussion <mailscanner@lists.mailscanner.info>
Sent: Monday, 7 May, 2007 8:46:54 PM
Subject: Re: Interesting need

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Alex Neuman van der Hans wrote:
> Archive mail "forwards" email? I thought it only "archived" it...
RTFM my friend :-)

Best regards,

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGP4I8EfZZRxQVtlQRAukRAJ4/kR547/Yym2whwfTU2xPp4w/AMgCfcwcM
LvwmIoikao6OZY+E6MvOp94=
=+Jsy
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 



From amaclach at yahoo.co.uk  Mon May  7 22:21:36 2007
From: amaclach at yahoo.co.uk (Andrew MacLachlan)
Date: Mon May  7 22:21:38 2007
Subject: SpamAssassin 3.2.0 package
Message-ID: <106296.50838.qm@web26314.mail.ukl.yahoo.com>

Dag has one and it works just fine.

----- Original Message ----
From: Julian Field <MailScanner@ecs.soton.ac.uk>
To: MailScanner discussion <mailscanner@lists.mailscanner.info>
Sent: Monday, 7 May, 2007 8:39:33 PM
Subject: Re: SpamAssassin 3.2.0 package

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Scott Silva wrote:
> Julian Field spake the following on 5/7/2007 9:37 AM:
>   
>> Scott Silva wrote:
>>     
>>> Julian Field spake the following on 5/5/2007 10:04 AM:
>>>  
>>>       
>>>> I have done some basic tests with my SpamAssassin 3.2.0 package and
>>>> MailScanner 4.59 and it is working fine.
>>>>
>>>> I'll do some more tests of it and probably start using it on a
>>>> production machine tomorrow if I feel so inclined (and there again I
>>>> might well just put my feet up and watch TV). It's a public holiday
>>>> this weekend (I think!) so by definition it should rain on Monday at
>>>> least. :-)
>>>>
>>>> Jules.
>>>>     
>>>>         
>>> Julian,
>>> I haven't had an opportunity to look at it yet, but are you or did you
>>> add an
>>> init script for clamd? I was going to throw one together if it didn't
>>> have
>>> one. But if it is already there, I won't bother.
>>>   
>>>       
>> No, I haven't done an init script for clamd. It should be easy enough to
>> knock one up based on the MailScanner ones. The SuSE and RedHat-based
>> ones need to be different, so if you fancy writing both based on the
>> MailScanner ones that would be great.
>>
>> Attached are the RedHat and SuSE init.d scripts for MailScanner itself
>> so you can see the differences needed.
>>
>> Obviously the clamd ones will be a lot shorter :-)
>>
>> Jules
>>
>>     
> In looking at this, there will need to be more than just an init script. There
> will need to be a clamd.conf file, and probably a logrotate script. I don't
> know how much extra stuff you want to add, but I'm game if you dont mind the
> extra fluff.
>   
Is it really true that no-one else has done a decent RPM of clamd yet? I 
would be surprised if Dag Wieers hasn't done one already, for starters. 
If there is one, why are we duplicating the effort?

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: UTF-8

wj8DBQFGP4EeEfZZRxQVtlQRAnIPAKCQnsIUEthWQbi2R6bbRiO7Q8DCnQCg6zXv
y5RNQN2fTRygk4Xny1Opi64=
=gz9L
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

--
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!



From MailScanner at ecs.soton.ac.uk  Mon May  7 22:21:36 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Mon May  7 22:22:44 2007
Subject: SpamAssassin 3.2.0 package
In-Reply-To: <463F82EB.9080404@maddoc.net>
References: <463C6D8E.5040802@ecs.soton.ac.uk>	<463C9E7C.7040600@protos.mine.nu>	<463CAD50.3050806@ecs.soton.ac.uk>	<463CB925.2050609@ecs.soton.ac.uk>	<f1ng46$6t7$2@sea.gmane.org>	<463F55BD.7080209@ecs.soton.ac.uk>	<f1nqeu$klb$1@sea.gmane.org>	<463F8075.60900@ecs.soton.ac.uk>
	<463F82EB.9080404@maddoc.net>
Message-ID: <463F9860.1060003@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Doc Schneider wrote:
> Julian Field wrote:
>   
>> Scott Silva wrote:
>>     
>>> Julian Field spake the following on 5/7/2007 9:37 AM:
>>>       
>>>> Scott Silva wrote:
>>>>     
>>>>         
>>>>> Julian Field spake the following on 5/5/2007 10:04 AM:
>>>>>  
>>>>>       
>>>>>           
>>>>>> I have done some basic tests with my SpamAssassin 3.2.0 package and
>>>>>> MailScanner 4.59 and it is working fine.
>>>>>>
>>>>>> I'll do some more tests of it and probably start using it on a
>>>>>> production machine tomorrow if I feel so inclined (and there again I
>>>>>> might well just put my feet up and watch TV). It's a public holiday
>>>>>> this weekend (I think!) so by definition it should rain on Monday at
>>>>>> least. :-)
>>>>>>
>>>>>> Jules.
>>>>>>     
>>>>>>         
>>>>>>             
>>>>> Julian,
>>>>> I haven't had an opportunity to look at it yet, but are you or did you
>>>>> add an
>>>>> init script for clamd? I was going to throw one together if it didn't
>>>>> have
>>>>> one. But if it is already there, I won't bother.
>>>>>   
>>>>>       
>>>>>           
>>>> No, I haven't done an init script for clamd. It should be easy enough to
>>>> knock one up based on the MailScanner ones. The SuSE and RedHat-based
>>>> ones need to be different, so if you fancy writing both based on the
>>>> MailScanner ones that would be great.
>>>>
>>>> Attached are the RedHat and SuSE init.d scripts for MailScanner itself
>>>> so you can see the differences needed.
>>>>
>>>> Obviously the clamd ones will be a lot shorter :-)
>>>>
>>>> Jules
>>>>
>>>>     
>>>>         
>>> In looking at this, there will need to be more than just an init script. There
>>> will need to be a clamd.conf file, and probably a logrotate script. I don't
>>> know how much extra stuff you want to add, but I'm game if you dont mind the
>>> extra fluff.
>>>       
>> Is it really true that no-one else has done a decent RPM of clamd yet? I 
>> would be surprised if Dag Wieers hasn't done one already, for starters. 
>> If there is one, why are we duplicating the effort?
>>
>> Jules
>>
>>     
>
> Jules,
>
> Dag Wieers has a current rpm for clamav-0.90.2 was there less than 24
> hours after it was released.
>
>   
I have just added considerably to the Clam+SA install.sh script. It now 
asks you whether you want it to install ClamAV or not. If it doesn't 
install it for you, it asks you where ClamAV is installed. It has 
sensible defaults set, so you can just do what it suggests.

I'll give it another test in the morning to check it all works (getting 
late now) and will post it on the website if it all goes okay.

Then you can still use my package to install the ClamAV perl module and 
SpamAssassin without necessarily having to install another copy of 
ClamAV that you didn't want, if you want to use an RPM of it.

That way no-one has to duplicate any effort writing yet another RPM of 
ClamAV.
:-)

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGP5iHEfZZRxQVtlQRAsHrAKCftgE9qQRNdsr1zV4vQkO1EmJtGwCgsh0e
sqTKuI8ts170Dv+LZi7/3eQ=
=GKJC
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From glenn.steen at gmail.com  Mon May  7 22:42:40 2007
From: glenn.steen at gmail.com (Glenn Steen)
Date: Mon May  7 22:42:43 2007
Subject: Interesting need
In-Reply-To: <463F822E.2010108@ecs.soton.ac.uk>
References: <463F0518.65ED.00A2.0@plattesheriff.org>
	<463F5C10.7080307@ecs.soton.ac.uk> <463F7783.7070608@nkpanama.com>
	<463F822E.2010108@ecs.soton.ac.uk>
Message-ID: <223f97700705071442w106785bu1a9a50405476f9cb@mail.gmail.com>

On 07/05/07, Julian Field <MailScanner@ecs.soton.ac.uk> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
>
> Alex Neuman van der Hans wrote:
> > Archive mail "forwards" email? I thought it only "archived" it...
> RTFM my friend :-)

Yes I did, and I have a question...Wouldn't using Archive Mail
forwarding include all the spam etc? Call me crazy (who knows, I might
be:-) but in that sense I'd go for Alex suggestion...;)

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
From mkettler at evi-inc.com  Mon May  7 22:59:44 2007
From: mkettler at evi-inc.com (Matt Kettler)
Date: Mon May  7 22:59:55 2007
Subject: SA 3.2.0 Woes
In-Reply-To: <20070507125947.05ede1ea@uxbod.splatnix.net>
References: <20070507125947.05ede1ea@uxbod.splatnix.net>
Message-ID: <463FA150.5070909@evi-inc.com>

--[ UxBoD ]-- wrote:
> Hi,
> 
> Not sure whether this is a issue or not, but since upgrading SA and
> MailScanner I never seem to get any hits via RBLs. I am using MailWatch
> and that just says "SpamAssassin Listed in RBL". Bayes never seems to
> trigger aswell now.
> 
> Have others experienced anything like this ?

I've not tried 3.2.0 with MailScanner. However, this sounds like it might be a
purely spamassassin issue.

You might want to try running the following basic debugging steps:

First, run "spamassassin --lint", and make sure it's got nothing to complain
about in your config files. It should just exit quietly. I strongly recommend
doing this first, as the version with debug below often spits out so much text
it  becomes easy to miss the important warning messages.

Second, run "spamassassin --lint -D" and take a look if SA thinks network tests
are enabled. It might be that your version of Net::DNS isn't new enough for
3.2's needs, and thus this feature is disabled. Ditto bayes and your version of
DB_File and/or DBI.

As a further check of bayes, try a "sa-learn --dump magic" and see if sa can
make sense of the bayes DB at all.
From ssilva at sgvwater.com  Mon May  7 23:21:33 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Mon May  7 23:25:12 2007
Subject: SpamAssassin 3.2.0 package
In-Reply-To: <463CB925.2050609@ecs.soton.ac.uk>
References: <463C6D8E.5040802@ecs.soton.ac.uk>	<463C9E7C.7040600@protos.mine.nu>	<463CAD50.3050806@ecs.soton.ac.uk>
	<463CB925.2050609@ecs.soton.ac.uk>
Message-ID: <f1o8pd$g2l$2@sea.gmane.org>

Julian Field spake the following on 5/5/2007 10:04 AM:
> I have done some basic tests with my SpamAssassin 3.2.0 package and 
> MailScanner 4.59 and it is working fine.
> 
> I'll do some more tests of it and probably start using it on a 
> production machine tomorrow if I feel so inclined (and there again I 
> might well just put my feet up and watch TV). It's a public holiday this 
> weekend (I think!) so by definition it should rain on Monday at least. :-)
> 
> Jules.
I hope you voted for putting your feet up and watching the TV!!  ;-P

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From ssilva at sgvwater.com  Mon May  7 23:30:52 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Mon May  7 23:31:11 2007
Subject: Multi (split) image spam
In-Reply-To: <795384.84076.qm@web26315.mail.ukl.yahoo.com>
References: <795384.84076.qm@web26315.mail.ukl.yahoo.com>
Message-ID: <f1o9at$kcp$1@sea.gmane.org>

Andrew MacLachlan spake the following on 5/7/2007 2:09 PM:
> Thanks Ed - That was my take as well.
> To be fair, I can see both sides of the argument, however I consider greylisting to still be an essential tool in the fight against spam. As always there are many different implementations and each has it's pros and cons.
> I have yet to see the perfect greylist implementation, but there has been some good work done by someone in Japan who modified postgrey so that it would only greylist dynamic addresses (determined by regex). Although this is nowhere near perfect it is certainly a step in the right direction (and should keep Res happy as well as his mailservers would be unlikely to be hit.) by adding some intelligence to the default postgrey implementation - which is a fairly blunt  -yet effective instrument.
> 
> No reply earlier to this to avoid a flame war which is never a good look!
If you just reject mail from dynamic ip's unless it is authenticated roaming
users, you will be better off. I still think that if you need a mail server,
you need a static address or a smarthost that is on one.
There is no good reason (IMHO) besides the costs to try and serve mail from a
dynamic IP, unless your ISP will not sell or rent you a static address. When
we upgraded from a SDSL circuit to a T1, we went from a /24  block to to a /19
block at each site. I didn't ask for the 64 addresses, they just didn't want
to split the block any smaller. And they gave me the reverse mappings also, so
I can't complain.
-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From gmane at tippingmar.com  Mon May  7 23:34:48 2007
From: gmane at tippingmar.com (Mark Nienberg)
Date: Mon May  7 23:35:11 2007
Subject: writing to /var/spool/MailScanner/incoming
Message-ID: <f1o9i8$lh9$1@sea.gmane.org>

I have /var/spool/MailScanner/incoming mounted as tmpfs.

I have a mail related script (duplicate msg remover) that could benefit from writing 
to tmpfs instead of physical disk.  Is it OK for my script to use some space in 
MailScanner/incoming or does MailScanner only expect to see it's own stuff in there?

Thanks,
Mark

From ssilva at sgvwater.com  Mon May  7 23:36:56 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Mon May  7 23:40:17 2007
Subject: SA 3.2.0 Woes
In-Reply-To: <463FA150.5070909@evi-inc.com>
References: <20070507125947.05ede1ea@uxbod.splatnix.net>
	<463FA150.5070909@evi-inc.com>
Message-ID: <f1o9m8$kcp$3@sea.gmane.org>

Matt Kettler spake the following on 5/7/2007 2:59 PM:
> --[ UxBoD ]-- wrote:
>> Hi,
>>
>> Not sure whether this is a issue or not, but since upgrading SA and
>> MailScanner I never seem to get any hits via RBLs. I am using MailWatch
>> and that just says "SpamAssassin Listed in RBL". Bayes never seems to
>> trigger aswell now.
>>
>> Have others experienced anything like this ?
> 
> I've not tried 3.2.0 with MailScanner. However, this sounds like it might be a
> purely spamassassin issue.
> 
> You might want to try running the following basic debugging steps:
> 
> First, run "spamassassin --lint", and make sure it's got nothing to complain
> about in your config files. It should just exit quietly. I strongly recommend
> doing this first, as the version with debug below often spits out so much text
> it  becomes easy to miss the important warning messages.
> 
> Second, run "spamassassin --lint -D" and take a look if SA thinks network tests
> are enabled. It might be that your version of Net::DNS isn't new enough for
> 3.2's needs, and thus this feature is disabled. Ditto bayes and your version of
> DB_File and/or DBI.

Does 3.2.0 do network tests in a lint? Because 3.1.8 didn't unless you piped a
message through it.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From ssilva at sgvwater.com  Mon May  7 23:40:14 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Mon May  7 23:45:07 2007
Subject: Interesting need
In-Reply-To: <223f97700705071442w106785bu1a9a50405476f9cb@mail.gmail.com>
References: <463F0518.65ED.00A2.0@plattesheriff.org>	<463F5C10.7080307@ecs.soton.ac.uk>
	<463F7783.7070608@nkpanama.com>	<463F822E.2010108@ecs.soton.ac.uk>
	<223f97700705071442w106785bu1a9a50405476f9cb@mail.gmail.com>
Message-ID: <f1o9se$kcp$4@sea.gmane.org>

Glenn Steen spake the following on 5/7/2007 2:42 PM:
> On 07/05/07, Julian Field <MailScanner@ecs.soton.ac.uk> wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>>
>>
>> Alex Neuman van der Hans wrote:
>> > Archive mail "forwards" email? I thought it only "archived" it...
>> RTFM my friend :-)
> 
> Yes I did, and I have a question...Wouldn't using Archive Mail
> forwarding include all the spam etc? Call me crazy (who knows, I might
> be:-) but in that sense I'd go for Alex suggestion...;)
> 
> Cheers
I think the archive mail option would be for those organizations that are
required to keep "everything" that crosses their gateway. So unless you can
stop it at the MTA, you would have to keep it.
I would rather use a forward at the non-spam actions also if it were up to me,
and I had no legal requirement to keep everything.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From ssilva at sgvwater.com  Mon May  7 23:43:37 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Mon May  7 23:50:04 2007
Subject: Interesting need
In-Reply-To: <589025.24756.qm@web26311.mail.ukl.yahoo.com>
References: <589025.24756.qm@web26311.mail.ukl.yahoo.com>
Message-ID: <f1oa2p$kcp$5@sea.gmane.org>

Andrew MacLachlan spake the following on 5/7/2007 2:14 PM:
> Or if you use Exchange internally - setup a rule, that way you can also forward all internal messages. (no anti exchange rants please - It's paid many of my bills...)
> 
No anti-exchange rants here, you administer what the check signers want to run.
I am fending off a possible move to Exchange or Notes. I am hoping that they
will wince at the costs. They pay me anyway, and I have told them that they
would need to add a warm body for either option. I don't have any time left in
the day.
-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From mkettler at evi-inc.com  Mon May  7 23:58:57 2007
From: mkettler at evi-inc.com (Matt Kettler)
Date: Tue May  8 00:18:19 2007
Subject: SA 3.2.0 Woes
In-Reply-To: <f1o9m8$kcp$3@sea.gmane.org>
References: <20070507125947.05ede1ea@uxbod.splatnix.net>	<463FA150.5070909@evi-inc.com>
	<f1o9m8$kcp$3@sea.gmane.org>
Message-ID: <463FAF31.7060800@evi-inc.com>

Scott Silva wrote:
> Matt Kettler spake the following on 5/7/2007 2:59 PM:
>> --[ UxBoD ]-- wrote:
>>> Hi,
>>>
>>> Not sure whether this is a issue or not, but since upgrading SA and
>>> MailScanner I never seem to get any hits via RBLs. I am using MailWatch
>>> and that just says "SpamAssassin Listed in RBL". Bayes never seems to
>>> trigger aswell now.
>>>
>>> Have others experienced anything like this ?
>> I've not tried 3.2.0 with MailScanner. However, this sounds like it might be a
>> purely spamassassin issue.
>>
>> You might want to try running the following basic debugging steps:
>>
>> First, run "spamassassin --lint", and make sure it's got nothing to complain
>> about in your config files. It should just exit quietly. I strongly recommend
>> doing this first, as the version with debug below often spits out so much text
>> it  becomes easy to miss the important warning messages.
>>
>> Second, run "spamassassin --lint -D" and take a look if SA thinks network tests
>> are enabled. It might be that your version of Net::DNS isn't new enough for
>> 3.2's needs, and thus this feature is disabled. Ditto bayes and your version of
>> DB_File and/or DBI.
> 
> Does 3.2.0 do network tests in a lint? Because 3.1.8 didn't unless you piped a
> message through it.
> 

Gah! you're right, forgot about that.

You'd have to do a "spamassassin -D < sample-spam.txt >/dev/null"



From ssilva at sgvwater.com  Tue May  8 00:18:43 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Tue May  8 00:18:54 2007
Subject: writing to /var/spool/MailScanner/incoming
In-Reply-To: <f1o9i8$lh9$1@sea.gmane.org>
References: <f1o9i8$lh9$1@sea.gmane.org>
Message-ID: <f1oc4j$19e$1@sea.gmane.org>

Mark Nienberg spake the following on 5/7/2007 3:34 PM:
> I have /var/spool/MailScanner/incoming mounted as tmpfs.
> 
> I have a mail related script (duplicate msg remover) that could benefit
> from writing to tmpfs instead of physical disk.  Is it OK for my script
> to use some space in MailScanner/incoming or does MailScanner only
> expect to see it's own stuff in there?
> 
> Thanks,
> Mark
> 
You could have another mountpoint to tmpfs if you want. They would be separate
filesystems to the OS, but would still only use the same total amount of ram.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From res at ausics.net  Tue May  8 00:36:15 2007
From: res at ausics.net (Res)
Date: Tue May  8 00:36:26 2007
Subject: Multi (split) image spam
In-Reply-To: <463F49F8.6080304@sbcglobal.net>
References: <694855.76046.qm@web26301.mail.ukl.yahoo.com>
	<Pine.LNX.4.64.0705071903400.15271@ebfjryy.nhfvpf.arg>
	<463F49F8.6080304@sbcglobal.net>
Message-ID: <Pine.LNX.4.64.0705080933490.20818@ebfjryy.nhfvpf.arg>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, 7 May 2007, Ed Bruce wrote:

>> errr logic? WTF? if the queue cant send it right away it stays in the
>> queue so lamelisted_mail+current_submissions=building_up_queue
>> like I said it might be fine if you run a small office 1K emails p/day,
>> but not when you do millions p/day, however I have tuned sendmail queue
>> running so that new stuff goes first, I'm not going to allow new stuff
>> to be delayed in oversized queue runners because some lamers server wont
>> accept it on first attempt.
>>
>>
>
> Res I didn't understand what you meant at first. Well I may still not
> understand, but I'm guessing you are saying that if my MTA is running
> some sort of gray listing and your MTA attempts a connection it will
> cause your queues to back up???

Correct, this affects the sending MTA, not the recipient server.

> I took your original message to mean that if I run gray listing then my
> queues would back up. That didn't seem to make much sense to me as I
> wouldn't gray list myself.

LOL no it wouldnt :)

- -- 

Cheers
Res

Vote for your favourite MTA at  http://polls.ausics.net/v3.php
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD4DBQFGP7fxsWhAmSIQh7MRAv85AJdZBssbVh0cfXdri+cUzCpPcQO7AJ47E5mQ
xo21w0V79ggqYrCTM2AO8g==
=56s9
-----END PGP SIGNATURE-----
From res at ausics.net  Tue May  8 00:40:11 2007
From: res at ausics.net (Res)
Date: Tue May  8 00:40:19 2007
Subject: SpamAssassin 3.2.0
In-Reply-To: <463F5028.9060201@evi-inc.com>
References: <463900B1.8080301@ecs.soton.ac.uk> <463B7C0C.9000004@evi-inc.com>
	<Pine.LNX.4.64.0705050823120.3368@ebfjryy.nhfvpf.arg>
	<463BB60B.3060608@evi-inc.com>
	<Pine.LNX.4.64.0705051844320.2735@ebfjryy.nhfvpf.arg>
	<463E12CC.7080806@evi-inc.com>
	<Pine.LNX.4.64.0705070825330.13685@ebfjryy.nhfvpf.arg>
	<463F5028.9060201@evi-inc.com>
Message-ID: <Pine.LNX.4.64.0705080939440.20818@ebfjryy.nhfvpf.arg>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, 7 May 2007, Matt Kettler wrote:

Thanks Matt.

> For reference, the bug is this one:
>
> http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5436


- -- 

Cheers
Res

Vote for your favourite MTA at  http://polls.ausics.net/v3.php
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGP7jdsWhAmSIQh7MRAh8cAJ4o9u7LI6VJuKQazRYZ5lF34AhqwgCfUs1f
dvD/trShOTp0NycaYOg6M3Q=
=pynS
-----END PGP SIGNATURE-----
From res at ausics.net  Tue May  8 00:52:30 2007
From: res at ausics.net (Res)
Date: Tue May  8 00:52:40 2007
Subject: Interesting need
In-Reply-To: <f1o9se$kcp$4@sea.gmane.org>
References: <463F0518.65ED.00A2.0@plattesheriff.org>
	<463F5C10.7080307@ecs.soton.ac.uk>
	<463F7783.7070608@nkpanama.com> <463F822E.2010108@ecs.soton.ac.uk>
	<223f97700705071442w106785bu1a9a50405476f9cb@mail.gmail.com>
	<f1o9se$kcp$4@sea.gmane.org>
Message-ID: <Pine.LNX.4.64.0705080948140.20818@ebfjryy.nhfvpf.arg>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, 7 May 2007, Scott Silva wrote:

> I think the archive mail option would be for those organizations that are
> required to keep "everything" that crosses their gateway. So unless you can

Not to mention for obtaining copies of mail sent from/to a norti user that 
the feds have an interest in :) and with the forwarding ability they get 
it all in real time.



- -- 

Cheers
Res

Vote for your favourite MTA at  http://polls.ausics.net/v3.php
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGP7vAsWhAmSIQh7MRAqlgAJ9cq6M330IfKjOSgA4+B1DC0kfmigCfYTnO
1i7vLA+s2UB08lqxcOVQICQ=
=hOg0
-----END PGP SIGNATURE-----
From amaclach at yahoo.co.uk  Tue May  8 00:58:41 2007
From: amaclach at yahoo.co.uk (Andrew MacLachlan)
Date: Tue May  8 00:58:44 2007
Subject: Multi (split) image spam
Message-ID: <38033.93041.qm@web26312.mail.ukl.yahoo.com>

It is true that there is no good reason to use dynamic addresses (for obvious reasons), however some ISPs refuse to update the reverse mappings so that even though an address is static, it still appears to be dynamic because of the netblock and reverse mapping.
While it could be argued that smarthosts are the correct way for small businesses to send mail, depending on the provider these can be worse than dynamic for RBLs etc!

----- Original Message ----
From: Scott Silva <ssilva@sgvwater.com>
To: mailscanner@lists.mailscanner.info
Sent: Monday, 7 May, 2007 11:30:52 PM
Subject: Re: Multi (split) image spam

Andrew MacLachlan spake the following on 5/7/2007 2:09 PM:
> Thanks Ed - That was my take as well.
> To be fair, I can see both sides of the argument, however I consider greylisting to still be an essential tool in the fight against spam. As always there are many different implementations and each has it's pros and cons.
> I have yet to see the perfect greylist implementation, but there has been some good work done by someone in Japan who modified postgrey so that it would only greylist dynamic addresses (determined by regex). Although this is nowhere near perfect it is certainly a step in the right direction (and should keep Res happy as well as his mailservers would be unlikely to be hit.) by adding some intelligence to the default postgrey implementation - which is a fairly blunt  -yet effective instrument.
> 
> No reply earlier to this to avoid a flame war which is never a good look!
If you just reject mail from dynamic ip's unless it is authenticated roaming
users, you will be better off. I still think that if you need a mail server,
you need a static address or a smarthost that is on one.
There is no good reason (IMHO) besides the costs to try and serve mail from a
dynamic IP, unless your ISP will not sell or rent you a static address. When
we upgraded from a SDSL circuit to a T1, we went from a /24  block to to a /19
block at each site. I didn't ask for the 64 addresses, they just didn't want
to split the block any smaller. And they gave me the reverse mappings also, so
I can't complain.
-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 



From info at ittsl.com  Tue May  8 05:03:31 2007
From: info at ittsl.com (=?ISO-8859-1?Q?ittsl01=20?=)
Date: Tue May  8 01:03:40 2007
Subject: Automated Reply from ittsl01 <info@ittsl.com>
Message-ID: <200705080403.l4843VtQ016175@server30055.uk2net.com>

ITTSL is out of the office until 14th May on Business in Europe. If you require urgent assistance, please a problem ticket at http://www.ittsl.net and we will respond to as soon as possible. Many Thanks.


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

From amaclach at yahoo.co.uk  Tue May  8 01:04:25 2007
From: amaclach at yahoo.co.uk (Andrew MacLachlan)
Date: Tue May  8 01:04:27 2007
Subject: Interesting need
Message-ID: <65028.16389.qm@web26307.mail.ukl.yahoo.com>

lol - Exchange isn't too bad to run, but it needs a specialist - not just someone to do a next, next, next install and hope it's still working in a year.
Maybe Zimbra?

----- Original Message ----
From: Scott Silva <ssilva@sgvwater.com>
To: mailscanner@lists.mailscanner.info
Sent: Monday, 7 May, 2007 11:43:37 PM
Subject: Re: Interesting need

Andrew MacLachlan spake the following on 5/7/2007 2:14 PM:
> Or if you use Exchange internally - setup a rule, that way you can also forward all internal messages. (no anti exchange rants please - It's paid many of my bills...)
> 
No anti-exchange rants here, you administer what the check signers want to run.
I am fending off a possible move to Exchange or Notes. I am hoping that they
will wince at the costs. They pay me anyway, and I have told them that they
would need to add a warm body for either option. I don't have any time left in
the day.
-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 



From alden at engineno9inc.com  Tue May  8 01:11:09 2007
From: alden at engineno9inc.com (Alden Levy)
Date: Tue May  8 01:11:19 2007
Subject: SMPID vs. INPID
Message-ID: <005b01c79105$617db200$5e01a8c0@AldenLap>

I'm still scratching my head over this one.  Would someone with a Redhat
install please post the relevant lines of their MailScanner_app_init, so I
can compare it to mine?

>Basically, when I start MS, all works well, but when I check status, I get
>an error 
># service MailScanner status
>Checking MailScanner daemons:
>         MailScanner:                                      [  OK  ]
>         incoming sendmail:                                [ FAIL ]
>         outgoing sendmail:                                [  OK  ]
>
>However, it works fine as it is.  In order to get rid of the fail, though,
>I've been updating sendmail.in.pid with the proper pid, and everything
>works.
>
>I finally had a few minutes to track down the issue, and it seems that
>something (I did something??) confused SMPID and INPID in
>MailScanner_app_init.
>
>The relevant code is:
>In StartInSendmail:
>      elif [ $MTA = 'sendmail' ]; then
>        /usr/bin/newaliases > /dev/null 2>&1
>        if test -x /usr/bin/make -a -f /etc/mail/Makefile ; then
>            make -C /etc/mail -s
>        else
>            for i in virtusertable access domaintable mailertable ; do
>                if [ -f /etc/mail/$i ] ; then
>                    makemap hash /etc/mail/$i < /etc/mail/$i
>                fi
>            done
>        fi
>        $SENDMAIL -bd -OPrivacyOptions=noetrn \
>                      -ODeliveryMode=queueonly \
>                      -OQueueDirectory=$INQDIR \
>                      -OPidFile=$INPID
>        touch /var/run/sm-client.pid
>        chown $MSPUSER:$MSPGROUP /var/run/sm-client.pid 2>/dev/null
>        $SENDMAIL -L sm-msp-queue -Ac -q15m -OPidFile=$SMPID 2>/dev/null
>        success
>        echo
> 
>And in status:
>  status)
>        # Work out if all of MailScanner is running
>        echo    'Checking MailScanner daemons:'
>        echo -n '         MailScanner:       '
>        pid=`pidofproc MailScanner`
>        if [ -z "$pid" ] ; then failure; else success; fi
>        echo
>        if [ $MTA = "sendmail" ]; then
>          # Now the incoming sendmail
>          echo -n '         incoming sendmail: '
>          pid=`head -1 $INPID`
>          alive=`ps ax | awk '{ print $1 }' | grep '^'$pid'$'`
>          #pid=`ps ax | egrep '\[sendmail\]|sendmai[l]: accepting
>connections'`
>          if [ -z "$alive" ] ; then failure; else success; fi
>          echo
> 


Thanks,
Alden 


Alden Levy
Engine No. 9, Inc.
130 W. 57th Street, Suite 2F
New York, NY 10019
(212) 981-1122
(212) 504-9598 fax


From mkettler at evi-inc.com  Tue May  8 01:25:26 2007
From: mkettler at evi-inc.com (Matt Kettler)
Date: Tue May  8 01:25:37 2007
Subject: Automated Reply from ittsl01 <info@ittsl.com>
In-Reply-To: <200705080403.l4843VtQ016175@server30055.uk2net.com>
References: <200705080403.l4843VtQ016175@server30055.uk2net.com>
Message-ID: <463FC376.6020103@evi-inc.com>

ittsl01 wrote:
> ITTSL is out of the office until 14th May on Business in Europe. If you require urgent assistance, please a problem ticket at http://www.ittsl.net and we will respond to as soon as possible. Many Thanks.

Hmm, should we ALL go and open tickets? :)
From tenderby at mailwash.com.au  Tue May  8 05:39:52 2007
From: tenderby at mailwash.com.au (Tony Enderby)
Date: Tue May  8 05:40:26 2007
Subject: FuzzyOCR SA 3.20
Message-ID: <200705080440.l484eA1u014384@mail.mailwash.com.au>

Hi All,

 

Just wondering if anyone knows of a workaround for the FuzzyOCR prob with
the latest version of SpamAssassin.

 

Post upgrade I tried the test emails that ship with the latest FuzzyOCR
distribution and am not getting any output in the returned

spam report.

 

Thanks in advance.

 

Tony.


-----------------------------------------------------------------------------------
Scanned by MailWash Australia - http://www.mailwash.com.au
-----------------------------------------------------------------------------------

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070508/ee7f7d6b/attachment.html
From r.berber at computer.org  Tue May  8 05:58:23 2007
From: r.berber at computer.org (=?ISO-8859-1?Q?Ren=E9_Berber?=)
Date: Tue May  8 05:56:31 2007
Subject: FuzzyOCR SA 3.20
In-Reply-To: <200705080440.l484eA1u014384@mail.mailwash.com.au>
References: <200705080440.l484eA1u014384@mail.mailwash.com.au>
Message-ID: <f1ovtl$27g$1@sea.gmane.org>

Tony Enderby wrote:

> Just wondering if anyone knows of a workaround for the FuzzyOCR prob 
> with the latest version of SpamAssassin.
> 
> Post upgrade I tried the test emails that ship with the latest FuzzyOCR 
> distribution and am not getting any output in the returned spam report.

You mean no details in the report?

That can be fixed by changing line 932 of FuzzyOcr.pm (version 3.5.1) :

-        $pms->_handle_hit( "FUZZY_OCR", $score, "BODY: ",
+        $pms->_handle_hit( "FUZZY_OCR", $score, "BODY: ", "rawbody",

There are other problems brought by changes in SA, like formatting of the report 
being lost (since 3.1.8, thanks to Util::wrap()), and when the image is known to 
be spam there is no detail in the report.
-- 
Ren? Berber

From tenderby at mailwash.com.au  Tue May  8 06:34:57 2007
From: tenderby at mailwash.com.au (Tony Enderby)
Date: Tue May  8 06:35:33 2007
Subject: FuzzyOCR SA 3.20
In-Reply-To: <f1ovtl$27g$1@sea.gmane.org>
Message-ID: <200705080535.l485ZFDe019297@mail.mailwash.com.au>

Many thanks, working a treat again.

Tony.

-----Original Message-----
From: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Ren? Berber
Sent: Tuesday, May 08, 2007 2:58 PM
To: mailscanner@lists.mailscanner.info
Subject: Re: FuzzyOCR SA 3.20

Tony Enderby wrote:

> Just wondering if anyone knows of a workaround for the FuzzyOCR prob 
> with the latest version of SpamAssassin.
> 
> Post upgrade I tried the test emails that ship with the latest FuzzyOCR 
> distribution and am not getting any output in the returned spam report.

You mean no details in the report?

That can be fixed by changing line 932 of FuzzyOcr.pm (version 3.5.1) :

-        $pms->_handle_hit( "FUZZY_OCR", $score, "BODY: ",
+        $pms->_handle_hit( "FUZZY_OCR", $score, "BODY: ", "rawbody",

There are other problems brought by changes in SA, like formatting of the
report 
being lost (since 3.1.8, thanks to Util::wrap()), and when the image is
known to 
be spam there is no detail in the report.
-- 
Ren? Berber

--
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!

----------------------------------------------------------------------------
-------
Scanned by MailWash Australia - http://www.mailwash.com.au
----------------------------------------------------------------------------
-------




-----------------------------------------------------------------------------------
Scanned by MailWash Australia - http://www.mailwash.com.au
-----------------------------------------------------------------------------------

From alvaro at hostalia.com  Tue May  8 09:04:35 2007
From: alvaro at hostalia.com (=?ISO-8859-15?Q?Alvaro_Mar=EDn?=)
Date: Tue May  8 09:04:40 2007
Subject: Error with SA 3.2.0
Message-ID: <46402F13.5090602@hostalia.com>

Hello,

I've upgraded SA to 3.2.0 version and MailScanner doesn't check/deliver
messages. Running in debug mode, I get:

...
[31624] dbg: config: score set 3 chosen.
[31624] dbg: message: main message type: text/plain
[31624] dbg: message: ---- MIME PARSER START ----
[31624] dbg: message: parsing normal part
[31624] dbg: message: ---- MIME PARSER END ----
check: no loaded plugin implements 'check_main': cannot scan! at
/usr/lib/perl5/site_perl/5.8.7/Mail/SpamAssassin/PerMsgStatus.pm line 164.
 Failed.

Any idea about this? If I downgrade to SA 3.1.8 all runs fine
Thanks!

Regards,

-- 
Alvaro Mar?n Illera
Hostalia Internet
www.hostalia.com

From drew at technologytiger.net  Tue May  8 09:10:10 2007
From: drew at technologytiger.net (Drew Marshall)
Date: Tue May  8 09:10:16 2007
Subject: Automated Reply from ittsl01 <info@ittsl.com>
In-Reply-To: <463FC376.6020103@evi-inc.com>
References: <200705080403.l4843VtQ016175@server30055.uk2net.com>
	<463FC376.6020103@evi-inc.com>
Message-ID: <E1A7A1B4-3C61-4BD2-AAAE-37EDCF8BE036@technologytiger.net>

On 8 May 2007, at 01:25, Matt Kettler wrote:

> ittsl01 wrote:
>> ITTSL is out of the office until 14th May on Business in Europe.  
>> If you require urgent assistance, please a problem ticket at  
>> http://www.ittsl.net and we will respond to as soon as possible.  
>> Many Thanks.
>
> Hmm, should we ALL go and open tickets? :)

It IS tempting...

Dear problem dept

How do I set my out of office up?

Regards ...

:-)

Drew

-- 
In line with our policy, this message has been scanned 
for viruses and dangerous content by the Technology Tiger MailScanner.
Further information can be found at www.technologytiger.net/policy

Technology Tiger Limited is registered in Scotland with registration number: 310997
Registered Office 55-57 West High Street Inverurie AB51 3QQ

From glenn.steen at gmail.com  Tue May  8 09:27:08 2007
From: glenn.steen at gmail.com (Glenn Steen)
Date: Tue May  8 09:27:13 2007
Subject: SpamAssassin 3.2.0 package
In-Reply-To: <f1o8pd$g2l$2@sea.gmane.org>
References: <463C6D8E.5040802@ecs.soton.ac.uk>
	<463C9E7C.7040600@protos.mine.nu> <463CAD50.3050806@ecs.soton.ac.uk>
	<463CB925.2050609@ecs.soton.ac.uk> <f1o8pd$g2l$2@sea.gmane.org>
Message-ID: <223f97700705080127t2b5436e9m8fd50d8bbf481eb4@mail.gmail.com>

On 08/05/07, Scott Silva <ssilva@sgvwater.com> wrote:
> Julian Field spake the following on 5/5/2007 10:04 AM:
> > I have done some basic tests with my SpamAssassin 3.2.0 package and
> > MailScanner 4.59 and it is working fine.
> >
> > I'll do some more tests of it and probably start using it on a
> > production machine tomorrow if I feel so inclined (and there again I
> > might well just put my feet up and watch TV). It's a public holiday this
> > weekend (I think!) so by definition it should rain on Monday at least. :-)
> >
> > Jules.
> I hope you voted for putting your feet up and watching the TV!!  ;-P
You are not alone in hoping that Scott!
It's not that we want you to be bored Jules, nor that we don't
appreciate the effort you make... We kind of want you to stick around
for the long run, more than giving the immediate fix... Essentially
see us as your virtual mother hens;-)

-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
From list-mailscanner at linguaphone.com  Tue May  8 09:32:51 2007
From: list-mailscanner at linguaphone.com (Gareth)
Date: Tue May  8 09:33:22 2007
Subject: Multi (split) image spam
In-Reply-To: <38033.93041.qm@web26312.mail.ukl.yahoo.com>
References: <38033.93041.qm@web26312.mail.ukl.yahoo.com>
Message-ID: <1178613171.30898.3.camel@gblades-suse.linguaphone-intranet.co.uk>

Does anyone have an example of one of these spams?

I was thinking it should be possible to write a rule to detect these as
there is no real reason why two images should be directly next to each
other.

From glenn.steen at gmail.com  Tue May  8 09:47:02 2007
From: glenn.steen at gmail.com (Glenn Steen)
Date: Tue May  8 09:47:06 2007
Subject: Multi (split) image spam
In-Reply-To: <1178613171.30898.3.camel@gblades-suse.linguaphone-intranet.co.uk>
References: <38033.93041.qm@web26312.mail.ukl.yahoo.com>
	<1178613171.30898.3.camel@gblades-suse.linguaphone-intranet.co.uk>
Message-ID: <223f97700705080147s448b9553p856f0f02984d1584@mail.gmail.com>

On 08/05/07, Gareth <list-mailscanner@linguaphone.com> wrote:
> Does anyone have an example of one of these spams?
>
> I was thinking it should be possible to write a rule to detect these as
> there is no real reason why two images should be directly next to each
> other.

... Apart from (decidedly crappy, but still) tabulated "layouting" in
HTML mails?

-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
From jim.barber at ddihealth.com  Tue May  8 09:51:54 2007
From: jim.barber at ddihealth.com (Jim Barber)
Date: Tue May  8 09:52:29 2007
Subject: Multi (split) image spam
In-Reply-To: <1178613171.30898.3.camel@gblades-suse.linguaphone-intranet.co.uk>
References: <38033.93041.qm@web26312.mail.ukl.yahoo.com>
	<1178613171.30898.3.camel@gblades-suse.linguaphone-intranet.co.uk>
Message-ID: <46403A2A.5010407@ddihealth.com>

I don't know if it's possible or not, but perhaps these images could be stitched together into one large image before they are presented to FuzzyOCR.
That would probably take a bit of work as you'd need to know from the layout how to stitch the images together (side-by-side? top-to-bottom? 2x2, etc).
But once stitched and passed to FuzzyOCR it should then be able to extract complete words from the final image.

----------
Jim Barber
DDI Health


Gareth wrote:
> Does anyone have an example of one of these spams?
> 
> I was thinking it should be possible to write a rule to detect these as
> there is no real reason why two images should be directly next to each
> other.
> 
From alvaro at hostalia.com  Tue May  8 09:53:57 2007
From: alvaro at hostalia.com (=?ISO-8859-15?Q?Alvaro_Mar=EDn?=)
Date: Tue May  8 09:54:02 2007
Subject: Error with SA 3.2.0
In-Reply-To: <46402F13.5090602@hostalia.com>
References: <46402F13.5090602@hostalia.com>
Message-ID: <46403AA5.10709@hostalia.com>

Hello again,

> check: no loaded plugin implements 'check_main': cannot scan! at
> /usr/lib/perl5/site_perl/5.8.7/Mail/SpamAssassin/PerMsgStatus.pm line 164.
>  Failed.

Copying v320.pre to /usr/share/spamassassin solves the problem but I've
changed SpamAssassin Local Rules Dir and know runs fine.

Regards,

-- 
Alvaro Mar?n Illera
Hostalia Internet
www.hostalia.com

From martinh at solidstatelogic.com  Tue May  8 09:54:52 2007
From: martinh at solidstatelogic.com (Martin.Hepworth)
Date: Tue May  8 09:54:54 2007
Subject: Interesting need
In-Reply-To: <463F0518.65ED.00A2.0@plattesheriff.org>
Message-ID: <fcfb8528a8986841ab16edf9a71ee371@solidstatelogic.com>

Rob

As others have said, surely this is down to the 'corporate email server'
to handle?


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> bounces@lists.mailscanner.info] On Behalf Of Rob Poe
> Sent: 07 May 2007 16:53
> To: MailScanner discussion
> Subject: Interesting need
>
> This might not be so much a MailScanner function ... but
>
> I have a Linux / Sendmail / MailScanner box set up in front of a
corporate
> mail system.  It's doing the domain as relay-domains and mailertable.
One
> of their users wants all of his EXTERNAL incoming mail to go to both
HIM
> and his assistant.
>
> I tried with the aliases and virtusertable ... didn't work (just
forwarded
> on to the corp mail system as if nothing was in there).
>
> Is this something I can do with a MailScanner rule?
>
>
>
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!




**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the 
addressee only and may be confidential. If they come to you in error 
you must take no action based on them, nor must you copy or show them 
to anyone. Please advise the sender by replying to this e-mail 
immediately and then delete the original from your computer.

Opinion : Any opinions expressed in this e-mail are entirely those of 
the author and unless specifically stated to the contrary, are not 
necessarily those of the author's employer.

Security Warning : Internet e-mail is not necessarily a secure 
communications medium and can be subject to data corruption. We advise 
that you consider this fact when e-mailing us. 

Viruses : We have taken steps to ensure that this e-mail and any 
attachments are free from known viruses but in keeping with good 
computing practice, you should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales 
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
United Kingdom
**********************************************************************

From MailScanner at ecs.soton.ac.uk  Tue May  8 11:15:06 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Tue May  8 11:16:44 2007
Subject: writing to /var/spool/MailScanner/incoming
In-Reply-To: <f1o9i8$lh9$1@sea.gmane.org>
References: <f1o9i8$lh9$1@sea.gmane.org>
Message-ID: <46404DAA.9040900@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Why not just do another tmpfs mount somewhere else as well? It's quite 
reasonable in most circumstances to mount /tmp on tmpfs and then use a 
subdirectory of that.

Mark Nienberg wrote:
> I have /var/spool/MailScanner/incoming mounted as tmpfs.
>
> I have a mail related script (duplicate msg remover) that could 
> benefit from writing to tmpfs instead of physical disk.  Is it OK for 
> my script to use some space in MailScanner/incoming or does 
> MailScanner only expect to see it's own stuff in there?
>
> Thanks,
> Mark
>

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGQE3oEfZZRxQVtlQRAiRGAJ0dNjZyHdVEk98CQpBc6ttdXgui8wCfX3L8
8JEO9/ba0pBGIpFZ3BnUzG8=
=+inB
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From hvdkooij at vanderkooij.org  Tue May  8 13:19:08 2007
From: hvdkooij at vanderkooij.org (Hugo van der Kooij)
Date: Tue May  8 13:19:39 2007
Subject: Error with SA 3.2.0
In-Reply-To: <46402F13.5090602@hostalia.com>
References: <46402F13.5090602@hostalia.com>
Message-ID: <Pine.LNX.4.64.0705081416490.12778@faramir.hugo.vanderkooij.org>

On Tue, 8 May 2007, Alvaro Mar?n wrote:

> I've upgraded SA to 3.2.0 version and MailScanner doesn't check/deliver
> messages. Running in debug mode, I get:
>
> ...
> [31624] dbg: config: score set 3 chosen.
> [31624] dbg: message: main message type: text/plain
> [31624] dbg: message: ---- MIME PARSER START ----
> [31624] dbg: message: parsing normal part
> [31624] dbg: message: ---- MIME PARSER END ----
> check: no loaded plugin implements 'check_main': cannot scan! at
> /usr/lib/perl5/site_perl/5.8.7/Mail/SpamAssassin/PerMsgStatus.pm line 164.
> Failed.
>
> Any idea about this? If I downgrade to SA 3.1.8 all runs fine

I just did an update and noticed it did not work well. I then did run the 
-lint option through MailWatch. It showed 75 lines with scores no longer 
in use.

Once I got rid of those I just needed to restart the proper service to get 
it all going.

Hugo.

-- 
 	hvdkooij@vanderkooij.org	http://hugo.vanderkooij.org/
 	    This message is using 100% recycled electrons.

 	Some men see computers as they are and say "Windows"
 	I use computers with Linux and say "Why Windows?"
 		(Thanks JFK, for the insight.)
From hvdkooij at vanderkooij.org  Tue May  8 13:20:53 2007
From: hvdkooij at vanderkooij.org (Hugo van der Kooij)
Date: Tue May  8 13:21:24 2007
Subject: SpamAssassin 3.2.0 package
In-Reply-To: <223f97700705080127t2b5436e9m8fd50d8bbf481eb4@mail.gmail.com>
References: <463C6D8E.5040802@ecs.soton.ac.uk>
	<463C9E7C.7040600@protos.mine.nu>
	<463CAD50.3050806@ecs.soton.ac.uk> <463CB925.2050609@ecs.soton.ac.uk>
	<f1o8pd$g2l$2@sea.gmane.org>
	<223f97700705080127t2b5436e9m8fd50d8bbf481eb4@mail.gmail.com>
Message-ID: <Pine.LNX.4.64.0705081420130.12778@faramir.hugo.vanderkooij.org>

On Tue, 8 May 2007, Glenn Steen wrote:

> It's not that we want you to be bored Jules, nor that we don't
> appreciate the effort you make... We kind of want you to stick around
> for the long run, more than giving the immediate fix... Essentially
> see us as your virtual mother hens;-)

Somehow I have a problem picturing Jules as a chick ;-)

Hugo.

-- 
 	hvdkooij@vanderkooij.org	http://hugo.vanderkooij.org/
 	    This message is using 100% recycled electrons.

 	Some men see computers as they are and say "Windows"
 	I use computers with Linux and say "Why Windows?"
 		(Thanks JFK, for the insight.)
From MailScanner at ecs.soton.ac.uk  Tue May  8 13:34:11 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Tue May  8 13:34:59 2007
Subject: SpamAssassin 3.2.0 package
In-Reply-To: <Pine.LNX.4.64.0705081420130.12778@faramir.hugo.vanderkooij.org>
References: <463C6D8E.5040802@ecs.soton.ac.uk>	<463C9E7C.7040600@protos.mine.nu>	<463CAD50.3050806@ecs.soton.ac.uk>
	<463CB925.2050609@ecs.soton.ac.uk>	<f1o8pd$g2l$2@sea.gmane.org>	<223f97700705080127t2b5436e9m8fd50d8bbf481eb4@mail.gmail.com>
	<Pine.LNX.4.64.0705081420130.12778@faramir.hugo.vanderkooij.org>
Message-ID: <46406E43.6040609@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Hugo van der Kooij wrote:
> On Tue, 8 May 2007, Glenn Steen wrote:
>
>> It's not that we want you to be bored Jules, nor that we don't
>> appreciate the effort you make... We kind of want you to stick around
>> for the long run, more than giving the immediate fix... Essentially
>> see us as your virtual mother hens;-)
>
> Somehow I have a problem picturing Jules as a chick ;-)
Quack?

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGQG5HEfZZRxQVtlQRApQqAKCs2RXY9MsliQFjSZnuUookEUq/fQCgh+wb
szANL0FvwkGpcRuehWPwWos=
=U17m
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From glenn.steen at gmail.com  Tue May  8 13:48:47 2007
From: glenn.steen at gmail.com (Glenn Steen)
Date: Tue May  8 13:48:51 2007
Subject: SpamAssassin 3.2.0 package
In-Reply-To: <Pine.LNX.4.64.0705081420130.12778@faramir.hugo.vanderkooij.org>
References: <463C6D8E.5040802@ecs.soton.ac.uk>
	<463C9E7C.7040600@protos.mine.nu> <463CAD50.3050806@ecs.soton.ac.uk>
	<463CB925.2050609@ecs.soton.ac.uk> <f1o8pd$g2l$2@sea.gmane.org>
	<223f97700705080127t2b5436e9m8fd50d8bbf481eb4@mail.gmail.com>
	<Pine.LNX.4.64.0705081420130.12778@faramir.hugo.vanderkooij.org>
Message-ID: <223f97700705080548w5738443fx175119f359a8766e@mail.gmail.com>

On 08/05/07, Hugo van der Kooij <hvdkooij@vanderkooij.org> wrote:
> On Tue, 8 May 2007, Glenn Steen wrote:
>
> > It's not that we want you to be bored Jules, nor that we don't
> > appreciate the effort you make... We kind of want you to stick around
> > for the long run, more than giving the immediate fix... Essentially
> > see us as your virtual mother hens;-)
>
> Somehow I have a problem picturing Jules as a chick ;-)
>
But not us others, Eh...? ... :-D

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
From glenn.steen at gmail.com  Tue May  8 13:53:43 2007
From: glenn.steen at gmail.com (Glenn Steen)
Date: Tue May  8 13:53:47 2007
Subject: SpamAssassin 3.2.0 package
In-Reply-To: <46406E43.6040609@ecs.soton.ac.uk>
References: <463C6D8E.5040802@ecs.soton.ac.uk>
	<463C9E7C.7040600@protos.mine.nu> <463CAD50.3050806@ecs.soton.ac.uk>
	<463CB925.2050609@ecs.soton.ac.uk> <f1o8pd$g2l$2@sea.gmane.org>
	<223f97700705080127t2b5436e9m8fd50d8bbf481eb4@mail.gmail.com>
	<Pine.LNX.4.64.0705081420130.12778@faramir.hugo.vanderkooij.org>
	<46406E43.6040609@ecs.soton.ac.uk>
Message-ID: <223f97700705080553q79f19096v7b0f704032014b6f@mail.gmail.com>

On 08/05/07, Julian Field <MailScanner@ecs.soton.ac.uk> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
>
> Hugo van der Kooij wrote:
> > On Tue, 8 May 2007, Glenn Steen wrote:
> >
> >> It's not that we want you to be bored Jules, nor that we don't
> >> appreciate the effort you make... We kind of want you to stick around
> >> for the long run, more than giving the immediate fix... Essentially
> >> see us as your virtual mother hens;-)
> >
> > Somehow I have a problem picturing Jules as a chick ;-)
> Quack?
Straight from chick to duck....I'm not sure exactly how to treat that
typing ailment... Perhaps you've overindulged in infomercials, perhaps
an overdose of West Wing... Best take to more <fav painkiller> and
call us in the morning...:-)

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
From root at doctor.nl2k.ab.ca  Tue May  8 14:44:37 2007
From: root at doctor.nl2k.ab.ca (Dave Shariff Yadallee - System Administrator a.k.a. The Root of the
	Problem)
Date: Tue May  8 14:51:21 2007
Subject: New 550s getting automagically placed into access file
Message-ID: <20070508134436.GB29293@doctor.nl2k.ab.ca>

I know there are 3 new packages out for MailScanner, spamd and clamd
however I cannot determine with is adding to the /etc/mail/access file 
550 We do not accept junk mail .

I need to turn of this feature as it block transmission from secondary to primary.

Also I am running Botnet 0.7 .

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

From paul.hutchings at mira.co.uk  Tue May  8 15:05:25 2007
From: paul.hutchings at mira.co.uk (Paul Hutchings)
Date: Tue May  8 15:05:32 2007
Subject: Permissions to use Clamd with Postfix?
Message-ID: <FF689DC51C3C1640BE668A0E31182AD002D15C61@mail03.mira.co.uk>

As subject really, I'm a little confused.  I'm running MailScanner with
Postfix and would like to be able to use ClamD simply as I presume it's
going to be faster than Clamscan.

 

My "run as" user/group is Postfix.  The permissions on
/var/incoming/mail are postfix.postfix. 

 

What do I need to do to make MailScanner work with Clamd as at the
moment when I try it I simply get an
"/var/spool/MailScanner/incoming/14276/.: lstat() failed. ERROR" or
similar.

 

TIA,

Paul

 

Paul Hutchings

Network Administrator, MIRA Ltd.

Tel: 44 (0)24 7635 5378

Fax: 44 (0)24 7635 8378

mailto:paul.hutchings@mira.co.uk

 


-- 
MIRA Ltd.

Watling Street, Nuneaton, Warwickshire, CV10 0TU, England.

Registered in England No. 402570
VAT Registration  GB 114 5409 96

The contents of this e-mail are confidential and are solely for the use of the intended recipient.
If you receive this e-mail in error, please delete it and notify us either by e-mail, telephone or fax.
You should not copy, forward or otherwise disclose the content of the e-mail as this is prohibited.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070508/cc997d31/attachment.html
From uxbod at splatnix.net  Tue May  8 15:10:39 2007
From: uxbod at splatnix.net (--[ UxBoD ]--)
Date: Tue May  8 15:10:45 2007
Subject: Permissions to use Clamd with Postfix?
In-Reply-To: <FF689DC51C3C1640BE668A0E31182AD002D15C61@mail03.mira.co.uk>
References: <FF689DC51C3C1640BE668A0E31182AD002D15C61@mail03.mira.co.uk>
Message-ID: <71fd9958f73f0cdb9bc160af3e176412@62.49.223.244>

Personally I added clamav to the postfix group. and also set the following in MailScanner.conf :-

Incoming Work User = clamav
Incoming Work Permissions = 0660

Seems to be running okay.

On Tue, 8 May 2007 15:05:25 +0100, "Paul Hutchings" <paul.hutchings@mira.co.uk> wrote:
> As subject really, I'm a little confused.  I'm running MailScanner with
> Postfix and would like to be able to use ClamD simply as I presume it's
> going to be faster than Clamscan.
> 
>  
> 
> My "run as" user/group is Postfix.  The permissions on
> /var/incoming/mail are postfix.postfix. 
> 
>  
> 
> What do I need to do to make MailScanner work with Clamd as at the
> moment when I try it I simply get an
> "/var/spool/MailScanner/incoming/14276/.: lstat() failed. ERROR" or
> similar.
> 
>  
> 
> TIA,
> 
> Paul
> 
>  
> 
> Paul Hutchings
> 
> Network Administrator, MIRA Ltd.
> 
> Tel: 44 (0)24 7635 5378
> 
> Fax: 44 (0)24 7635 8378
> 
> mailto:paul.hutchings@mira.co.uk
> 
>  
> 
> 
> -- 
> MIRA Ltd.
> 
> Watling Street, Nuneaton, Warwickshire, CV10 0TU, England.
> 
> Registered in England No. 402570
> VAT Registration  GB 114 5409 96
> 
> The contents of this e-mail are confidential and are solely for the use of
> the intended recipient.
> If you receive this e-mail in error, please delete it and notify us either
> by e-mail, telephone or fax.
> You should not copy, forward or otherwise disclose the content of the
> e-mail as this is prohibited.
> 
> 
> 
>
-- 
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
// Phone: +44 (0) 845 869 2749  SIP: uxbod@sip.splatnix.net


-- 
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.

From daniel.maher at ubisoft.com  Tue May  8 15:14:30 2007
From: daniel.maher at ubisoft.com (Daniel Maher)
Date: Tue May  8 15:14:33 2007
Subject: Permissions to use Clamd with Postfix?
In-Reply-To: <FF689DC51C3C1640BE668A0E31182AD002D15C61@mail03.mira.co.uk>
Message-ID: <1E293D3FF63A3740B10AD5AAD88535D204DC3453@UBIMAIL1.ubisoft.org>

________________________________________
From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Paul Hutchings
Sent: May 8, 2007 10:05 AM
To: MailScanner discussion
Subject: Permissions to use Clamd with Postfix?

As subject really, I'm a little confused.? I'm running MailScanner with Postfix and would like to be able to use ClamD simply as I presume it's going to be faster than Clamscan.

My "run as" user/group is Postfix.? The permissions on /var/incoming/mail are postfix.postfix. 

What do I need to do to make MailScanner work with Clamd as at the moment when I try it I simply get an "/var/spool/MailScanner/incoming/14276/.: lstat() failed. ERROR" or similar.

Clamd is likely running as user "clamav", which doesn't have read permissions for the incoming directory.
________________________________________


The solution is twofold:
1. Change your "run as" options to use to "postfix.clamav"
2. Change the ownership of incoming to postfix.clamav, and give it group read perms

I had to setgid the incoming directory in order to make sure that the runtime dirs under incoming actually had their ownership set properly, but ymmv.

Cheers!

--
  _
 ?v?  Daniel Maher
/(_)\ Administrateur Syst?me Unix
 ^ ^  Unix System Administrator
 
"How can a man choose between Fresh and Fly?  And believe me, there IS a difference." - Crack Stuntman, 2007.
From Richard.Frovarp at sendit.nodak.edu  Tue May  8 15:21:40 2007
From: Richard.Frovarp at sendit.nodak.edu (Richard Frovarp)
Date: Tue May  8 15:21:44 2007
Subject: writing to /var/spool/MailScanner/incoming
In-Reply-To: <f1o9i8$lh9$1@sea.gmane.org>
References: <f1o9i8$lh9$1@sea.gmane.org>
Message-ID: <46408774.1060606@sendit.nodak.edu>

Mark Nienberg wrote:
> I have /var/spool/MailScanner/incoming mounted as tmpfs.
>
> I have a mail related script (duplicate msg remover) that could 
> benefit from writing to tmpfs instead of physical disk.  Is it OK for 
> my script to use some space in MailScanner/incoming or does 
> MailScanner only expect to see it's own stuff in there?
>
> Thanks,
> Mark
>

Isn't this really dangerous? If you lose power or reboot the machine 
without an empty incoming queue, you will lose messages. To reboot you 
would have to stop the incoming mail process, let MailScanner clean out 
the queue, then reboot. Or am I missing something that would prevent you 
from losing messages?
From ugob at lubik.ca  Tue May  8 15:35:24 2007
From: ugob at lubik.ca (Ugo Bellavance)
Date: Tue May  8 15:36:01 2007
Subject: New 550s getting automagically placed into access file
In-Reply-To: <20070508134436.GB29293@doctor.nl2k.ab.ca>
References: <20070508134436.GB29293@doctor.nl2k.ab.ca>
Message-ID: <f1q1re$llp$1@sea.gmane.org>

Dave Shariff Yadallee - System Administrator a.k.a. The Root of the 
Problem wrote:
> I know there are 3 new packages out for MailScanner, spamd and clamd
> however I cannot determine with is adding to the /etc/mail/access file 
> 550 We do not accept junk mail .
> 
> I need to turn of this feature as it block transmission from secondary to primary.
> 
> Also I am running Botnet 0.7 .
> 

This is probably more a third-party program: Vispan.

From lists at jfworks.net  Tue May  8 15:41:48 2007
From: lists at jfworks.net (James)
Date: Tue May  8 15:41:54 2007
Subject: New 550s getting automagically placed into access file
In-Reply-To: <20070508134436.GB29293@doctor.nl2k.ab.ca>
References: <20070508134436.GB29293@doctor.nl2k.ab.ca>
Message-ID: <46408C2C.8070608@jfworks.net>

Dave Shariff Yadallee - System Administrator a.k.a. The Root of the 
Problem wrote:
> I know there are 3 new packages out for MailScanner, spamd and clamd
> however I cannot determine with is adding to the /etc/mail/access file 
> 550 We do not accept junk mail .
>
> I need to turn of this feature as it block transmission from secondary to primary.
>
> Also I am running Botnet 0.7 .
>
>   
As far as I know MailScanner doesn't write to the access file or at 
least has never in my case.
From ugob at lubik.ca  Tue May  8 15:43:12 2007
From: ugob at lubik.ca (Ugo Bellavance)
Date: Tue May  8 15:43:50 2007
Subject: writing to /var/spool/MailScanner/incoming
In-Reply-To: <46408774.1060606@sendit.nodak.edu>
References: <f1o9i8$lh9$1@sea.gmane.org> <46408774.1060606@sendit.nodak.edu>
Message-ID: <f1q2a1$ncr$1@sea.gmane.org>

Richard Frovarp wrote:
> 
> Isn't this really dangerous? If you lose power or reboot the machine 
> without an empty incoming queue, you will lose messages. To reboot you 
> would have to stop the incoming mail process, let MailScanner clean out 
> the queue, then reboot. Or am I missing something that would prevent you 
> from losing messages?

Messages stays in the MTA inbound queue until processed.  They are 
copied to /var/spool/MailScanner/incoming, processed and it is copied to 
the outbound MTA queue once processed.  Once copied in the outbount 
queue, it is deleted from the inbound queue.

I think this is in the MAQ...

ugo

From Richard.Frovarp at sendit.nodak.edu  Tue May  8 15:51:04 2007
From: Richard.Frovarp at sendit.nodak.edu (Richard Frovarp)
Date: Tue May  8 15:51:07 2007
Subject: writing to /var/spool/MailScanner/incoming
In-Reply-To: <f1q2a1$ncr$1@sea.gmane.org>
References: <f1o9i8$lh9$1@sea.gmane.org> <46408774.1060606@sendit.nodak.edu>
	<f1q2a1$ncr$1@sea.gmane.org>
Message-ID: <46408E58.2000800@sendit.nodak.edu>

Ugo Bellavance wrote:
> Richard Frovarp wrote:
>>
>> Isn't this really dangerous? If you lose power or reboot the machine 
>> without an empty incoming queue, you will lose messages. To reboot 
>> you would have to stop the incoming mail process, let MailScanner 
>> clean out the queue, then reboot. Or am I missing something that 
>> would prevent you from losing messages?
>
> Messages stays in the MTA inbound queue until processed.  They are 
> copied to /var/spool/MailScanner/incoming, processed and it is copied 
> to the outbound MTA queue once processed.  Once copied in the outbount 
> queue, it is deleted from the inbound queue.
>
> I think this is in the MAQ...
>
> ugo
>
Right and if /var/spool/MailScanner/incoming is in tempfs, the only 
place it exists is in RAM. The state of RAM goes away during reboot or 
power loss. Hence it is really dangerous to have incoming in tempfs. If 
that queue isn't empty when the state is lost, messages will be lost.
From mkercher at nfsmith.com  Tue May  8 15:52:01 2007
From: mkercher at nfsmith.com (Mike Kercher)
Date: Tue May  8 15:55:44 2007
Subject: writing to /var/spool/MailScanner/incoming
References: <f1o9i8$lh9$1@sea.gmane.org>
	<46408774.1060606@sendit.nodak.edu><f1q2a1$ncr$1@sea.gmane.org>
	<46408E58.2000800@sendit.nodak.edu>
Message-ID: <6DEF8ABC1767C045B91F42066D36358E3AF6@HOUPEX01.nfsmith.info>

Richard Frovarp <> wrote on Tuesday, May 08, 2007 9:51 AM:

: Ugo Bellavance wrote:
:: Richard Frovarp wrote:
::: 
::: Isn't this really dangerous? If you lose power or reboot the machine
::: without an empty incoming queue, you will lose messages. To reboot
::: you would have to stop the incoming mail process, let MailScanner
::: clean out the queue, then reboot. Or am I missing something that
::: would prevent you from losing messages?
:: 
:: Messages stays in the MTA inbound queue until processed.  They are
:: copied to /var/spool/MailScanner/incoming, processed and it is copied
:: to the outbound MTA queue once processed.  Once copied in the
:: outbount queue, it is deleted from the inbound queue.
:: 
:: I think this is in the MAQ...
:: 
:: ugo
:: 
: Right and if /var/spool/MailScanner/incoming is in tempfs, the only
: place it exists is in RAM. The state of RAM goes away during reboot
: or power loss. Hence it is really dangerous to have incoming in
: tempfs. If that queue isn't empty when the state is lost, messages
: will be lost.    

I think he's talking about /var/spool/mqueue.in

-Mike
From paul.hutchings at mira.co.uk  Tue May  8 16:00:46 2007
From: paul.hutchings at mira.co.uk (Paul Hutchings)
Date: Tue May  8 16:00:54 2007
Subject: Permissions to use Clamd with Postfix?
References: <1E293D3FF63A3740B10AD5AAD88535D204DC3453@UBIMAIL1.ubisoft.org>
Message-ID: <FF689DC51C3C1640BE668A0E31182AD002D15C67@mail03.mira.co.uk>

Ok so two answers two methods.  Who's right? :-)

Paul Hutchings
Network Administrator, MIRA Ltd.
Tel: 44 (0)24 7635 5378
Fax: 44 (0)24 7635 8378
mailto:paul.hutchings@mira.co.uk

-----Original Message-----
From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Daniel Maher
Sent: 08 May 2007 15:15
To: MailScanner discussion
Subject: RE: Permissions to use Clamd with Postfix?

________________________________________
From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Paul Hutchings
Sent: May 8, 2007 10:05 AM
To: MailScanner discussion
Subject: Permissions to use Clamd with Postfix?

As subject really, I'm a little confused.? I'm running MailScanner with Postfix and would like to be able to use ClamD simply as I presume it's going to be faster than Clamscan.

My "run as" user/group is Postfix.? The permissions on /var/incoming/mail are postfix.postfix. 

What do I need to do to make MailScanner work with Clamd as at the moment when I try it I simply get an "/var/spool/MailScanner/incoming/14276/.: lstat() failed. ERROR" or similar.

Clamd is likely running as user "clamav", which doesn't have read permissions for the incoming directory.
________________________________________


The solution is twofold:
1. Change your "run as" options to use to "postfix.clamav"
2. Change the ownership of incoming to postfix.clamav, and give it group read perms

I had to setgid the incoming directory in order to make sure that the runtime dirs under incoming actually had their ownership set properly, but ymmv.

Cheers!

--
  _
 ?v?  Daniel Maher
/(_)\ Administrateur Syst?me Unix
 ^ ^  Unix System Administrator
 
"How can a man choose between Fresh and Fly?  And believe me, there IS a difference." - Crack Stuntman, 2007.
-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 

-- 
MIRA Ltd.

Watling Street, Nuneaton, Warwickshire, CV10 0TU, England.

Registered in England No. 402570
VAT Registration  GB 114 5409 96

The contents of this e-mail are confidential and are solely for the use of the intended recipient.
If you receive this e-mail in error, please delete it and notify us either by e-mail, telephone or fax.
You should not copy, forward or otherwise disclose the content of the e-mail as this is prohibited.


From rcooper at dwford.com  Tue May  8 16:01:16 2007
From: rcooper at dwford.com (Rick Cooper)
Date: Tue May  8 16:01:21 2007
Subject: writing to /var/spool/MailScanner/incoming
In-Reply-To: <46408E58.2000800@sendit.nodak.edu>
References: <f1o9i8$lh9$1@sea.gmane.org>
	<46408774.1060606@sendit.nodak.edu><f1q2a1$ncr$1@sea.gmane.org>
	<46408E58.2000800@sendit.nodak.edu>
Message-ID: <0ced01c79181$babd3800$0301a8c0@SAHOMELT>

 

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info 
> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf 
> Of Richard Frovarp
> Sent: Tuesday, May 08, 2007 10:51 AM
> To: MailScanner discussion
> Subject: Re: writing to /var/spool/MailScanner/incoming
> 
> Ugo Bellavance wrote:
> > Richard Frovarp wrote:
> >>
> >> Isn't this really dangerous? If you lose power or reboot 
> the machine 
> >> without an empty incoming queue, you will lose messages. To reboot 
> >> you would have to stop the incoming mail process, let MailScanner 
> >> clean out the queue, then reboot. Or am I missing something that 
> >> would prevent you from losing messages?
> >
> > Messages stays in the MTA inbound queue until processed.  They are 
> > copied to /var/spool/MailScanner/incoming, processed and it 
> is copied 
> > to the outbound MTA queue once processed.  Once copied in 
> the outbount 
> > queue, it is deleted from the inbound queue.
> >
> > I think this is in the MAQ...
> >
> > ugo
> >
> Right and if /var/spool/MailScanner/incoming is in tempfs, the only 
> place it exists is in RAM. The state of RAM goes away during 
> reboot or 
> power loss. Hence it is really dangerous to have incoming in 
> tempfs. If 
> that queue isn't empty when the state is lost, messages will be lost.
> -- 

Only half correct. The MailScanner queue is lost but the MTA queue is still
intact. When MailScanner restarts it will process all the MTA's queue again
so everything lost in the MailScanner working dir is rebuilt anyway. Nothing
in the MTA queue is touched until it's in the MTA outbound queue.

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


From daniel.maher at ubisoft.com  Tue May  8 16:06:26 2007
From: daniel.maher at ubisoft.com (Daniel Maher)
Date: Tue May  8 16:06:28 2007
Subject: Permissions to use Clamd with Postfix?
In-Reply-To: <FF689DC51C3C1640BE668A0E31182AD002D15C67@mail03.mira.co.uk>
Message-ID: <1E293D3FF63A3740B10AD5AAD88535D204DC3577@UBIMAIL1.ubisoft.org>



> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> bounces@lists.mailscanner.info] On Behalf Of Paul Hutchings
> Sent: May 8, 2007 11:01 AM
> To: MailScanner discussion
> Subject: RE: Permissions to use Clamd with Postfix?
> 
> Ok so two answers two methods.  Who's right? :-)

Thanks to the swiss-army-knife style of Linux, we're both correct.  There are likely even other options. :P


--
  _
 ?v?  Daniel Maher
/(_)\ Administrateur Syst?me Unix
 ^ ^  Unix System Administrator
 
"How can a man choose between Fresh and Fly?  And believe me, there IS a difference." - Crack Stuntman, 2007.
From Richard.Frovarp at sendit.nodak.edu  Tue May  8 16:06:54 2007
From: Richard.Frovarp at sendit.nodak.edu (Richard Frovarp)
Date: Tue May  8 16:06:57 2007
Subject: writing to /var/spool/MailScanner/incoming
In-Reply-To: <6DEF8ABC1767C045B91F42066D36358E3AF6@HOUPEX01.nfsmith.info>
References: <f1o9i8$lh9$1@sea.gmane.org>	<46408774.1060606@sendit.nodak.edu><f1q2a1$ncr$1@sea.gmane.org>	<46408E58.2000800@sendit.nodak.edu>
	<6DEF8ABC1767C045B91F42066D36358E3AF6@HOUPEX01.nfsmith.info>
Message-ID: <4640920E.5080801@sendit.nodak.edu>

Mike Kercher wrote:
> Richard Frovarp <> wrote on Tuesday, May 08, 2007 9:51 AM:
>
> : Ugo Bellavance wrote:
> :: Richard Frovarp wrote:
> ::: 
> ::: Isn't this really dangerous? If you lose power or reboot the machine
> ::: without an empty incoming queue, you will lose messages. To reboot
> ::: you would have to stop the incoming mail process, let MailScanner
> ::: clean out the queue, then reboot. Or am I missing something that
> ::: would prevent you from losing messages?
> :: 
> :: Messages stays in the MTA inbound queue until processed.  They are
> :: copied to /var/spool/MailScanner/incoming, processed and it is copied
> :: to the outbound MTA queue once processed.  Once copied in the
> :: outbount queue, it is deleted from the inbound queue.
> :: 
> :: I think this is in the MAQ...
> :: 
> :: ugo
> :: 
> : Right and if /var/spool/MailScanner/incoming is in tempfs, the only
> : place it exists is in RAM. The state of RAM goes away during reboot
> : or power loss. Hence it is really dangerous to have incoming in
> : tempfs. If that queue isn't empty when the state is lost, messages
> : will be lost.    
>
> I think he's talking about /var/spool/mqueue.in
>
> -Mike
>   

Yeah, that's what I was thinking of. Sorry. More sleep would be good.

Richard
From root at doctor.nl2k.ab.ca  Tue May  8 16:00:22 2007
From: root at doctor.nl2k.ab.ca (Dave Shariff Yadallee - System Administrator a.k.a. The Root of the
	Problem)
Date: Tue May  8 16:07:13 2007
Subject: [root@doctor.nl2k.ab.ca: New 550s getting automagically placed into
	access file]
Message-ID: <20070508150022.GA20343@doctor.nl2k.ab.ca>

I have to resend this as I found in my logs the mailscanner.info mailserver
got listed as below.

----- Forwarded message from "Dave Shariff Yadallee -  System Administrator a.k.a. The Root of the Problem" <root@doctor.nl2k.ab.ca> -----

Date: Tue, 8 May 2007 07:44:36 -0600
From: "Dave Shariff Yadallee -  System Administrator a.k.a. The Root of the Problem" <root@doctor.nl2k.ab.ca>
To: mailscanner@lists.mailscanner.info
Subject: New 550s getting automagically placed into access file
User-Agent: Mutt/1.5.12-2006-07-14

I know there are 3 new packages out for MailScanner, spamd and clamd
however I cannot determine with is adding to the /etc/mail/access file 
550 We do not accept junk mail .

I need to turn of this feature as it block transmission from secondary to primary.

Also I am running Botnet 0.7 .

----- End forwarded message -----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

From martinh at solidstatelogic.com  Tue May  8 16:27:29 2007
From: martinh at solidstatelogic.com (Martin.Hepworth)
Date: Tue May  8 16:27:43 2007
Subject: [root@doctor.nl2k.ab.ca: New 550s getting automagically placed
	into access file]
In-Reply-To: <20070508150022.GA20343@doctor.nl2k.ab.ca>
Message-ID: <f71fa3154051344f9c05dfff42bd38fd@solidstatelogic.com>

Dave

There's a CustomFunction called IPBlock that will update this list based
on number of messages received from an ip-address.....

Normally it's attached to "Always Looked Up Last" in the following
manner inside MailScanner.conf..

Always Looked Up Last = &IPBlock



--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> bounces@lists.mailscanner.info] On Behalf Of Dave Shariff Yadallee -
> System Administrator a.k.a. The Root of the Problem
> Sent: 08 May 2007 16:00
> To: mailscanner@lists.mailscanner.info
> Subject: [root@doctor.nl2k.ab.ca: New 550s getting automagically
placed
> into access file]
>
> I have to resend this as I found in my logs the mailscanner.info
> mailserver
> got listed as below.
>
> ----- Forwarded message from "Dave Shariff Yadallee -  System
> Administrator a.k.a. The Root of the Problem" <root@doctor.nl2k.ab.ca>
---
> --
>
> Date: Tue, 8 May 2007 07:44:36 -0600
> From: "Dave Shariff Yadallee -  System Administrator a.k.a. The Root
of
> the Problem" <root@doctor.nl2k.ab.ca>
> To: mailscanner@lists.mailscanner.info
> Subject: New 550s getting automagically placed into access file
> User-Agent: Mutt/1.5.12-2006-07-14
>
> I know there are 3 new packages out for MailScanner, spamd and clamd
> however I cannot determine with is adding to the /etc/mail/access file
> 550 We do not accept junk mail .
>
> I need to turn of this feature as it block transmission from secondary
to
> primary.
>
> Also I am running Botnet 0.7 .
>
> ----- End forwarded message -----
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!




**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the 
addressee only and may be confidential. If they come to you in error 
you must take no action based on them, nor must you copy or show them 
to anyone. Please advise the sender by replying to this e-mail 
immediately and then delete the original from your computer.

Opinion : Any opinions expressed in this e-mail are entirely those of 
the author and unless specifically stated to the contrary, are not 
necessarily those of the author's employer.

Security Warning : Internet e-mail is not necessarily a secure 
communications medium and can be subject to data corruption. We advise 
that you consider this fact when e-mailing us. 

Viruses : We have taken steps to ensure that this e-mail and any 
attachments are free from known viruses but in keeping with good 
computing practice, you should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales 
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
United Kingdom
**********************************************************************

From root at doctor.nl2k.ab.ca  Tue May  8 16:29:18 2007
From: root at doctor.nl2k.ab.ca (Dave Shariff Yadallee - System Administrator a.k.a. The Root of the
	Problem)
Date: Tue May  8 16:33:06 2007
Subject: [root@doctor.nl2k.ab.ca: New 550s getting automagically placed
	into access file]
In-Reply-To: <f71fa3154051344f9c05dfff42bd38fd@solidstatelogic.com>
References: <20070508150022.GA20343@doctor.nl2k.ab.ca>
	<f71fa3154051344f9c05dfff42bd38fd@solidstatelogic.com>
Message-ID: <20070508152917.GA736@doctor.nl2k.ab.ca>

On Tue, May 08, 2007 at 04:27:29PM +0100, Martin.Hepworth wrote:
> Dave
> 
> There's a CustomFunction called IPBlock that will update this list based
> on number of messages received from an ip-address.....
> 
> Normally it's attached to "Always Looked Up Last" in the following
> manner inside MailScanner.conf..
> 
> Always Looked Up Last = &IPBlock
> 
>

My setting is:

Always Looked Up Last = no
 
> 
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
> 
> > -----Original Message-----
> > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> > bounces@lists.mailscanner.info] On Behalf Of Dave Shariff Yadallee -
> > System Administrator a.k.a. The Root of the Problem
> > Sent: 08 May 2007 16:00
> > To: mailscanner@lists.mailscanner.info
> > Subject: [root@doctor.nl2k.ab.ca: New 550s getting automagically
> placed
> > into access file]
> >
> > I have to resend this as I found in my logs the mailscanner.info
> > mailserver
> > got listed as below.
> >
> > ----- Forwarded message from "Dave Shariff Yadallee -  System
> > Administrator a.k.a. The Root of the Problem" <root@doctor.nl2k.ab.ca>
> ---
> > --
> >
> > Date: Tue, 8 May 2007 07:44:36 -0600
> > From: "Dave Shariff Yadallee -  System Administrator a.k.a. The Root
> of
> > the Problem" <root@doctor.nl2k.ab.ca>
> > To: mailscanner@lists.mailscanner.info
> > Subject: New 550s getting automagically placed into access file
> > User-Agent: Mutt/1.5.12-2006-07-14
> >
> > I know there are 3 new packages out for MailScanner, spamd and clamd
> > however I cannot determine with is adding to the /etc/mail/access file
> > 550 We do not accept junk mail .
> >
> > I need to turn of this feature as it block transmission from secondary
> to
> > primary.
> >
> > Also I am running Botnet 0.7 .
> >
> > ----- End forwarded message -----
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean.
> >
> > --
> > MailScanner mailing list
> > mailscanner@lists.mailscanner.info
> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >
> > Before posting, read http://wiki.mailscanner.info/posting
> >
> > Support MailScanner development - buy the book off the website!
> 
> 
> 
> 
> **********************************************************************
> Confidentiality : This e-mail and any attachments are intended for the 
> addressee only and may be confidential. If they come to you in error 
> you must take no action based on them, nor must you copy or show them 
> to anyone. Please advise the sender by replying to this e-mail 
> immediately and then delete the original from your computer.
> 
> Opinion : Any opinions expressed in this e-mail are entirely those of 
> the author and unless specifically stated to the contrary, are not 
> necessarily those of the author's employer.
> 
> Security Warning : Internet e-mail is not necessarily a secure 
> communications medium and can be subject to data corruption. We advise 
> that you consider this fact when e-mailing us. 
> 
> Viruses : We have taken steps to ensure that this e-mail and any 
> attachments are free from known viruses but in keeping with good 
> computing practice, you should ensure that they are virus free.
> 
> Red Lion 49 Ltd T/A Solid State Logic
> Registered as a limited company in England and Wales 
> (Company No:5362730)
> Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
> United Kingdom
> **********************************************************************
> 
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
> 
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> 
From root at doctor.nl2k.ab.ca  Tue May  8 16:48:12 2007
From: root at doctor.nl2k.ab.ca (Dave Shariff Yadallee - System Administrator a.k.a. The Root of the
	Problem)
Date: Tue May  8 16:56:34 2007
Subject: [root@doctor.nl2k.ab.ca: New 550s getting automagically placed
	into access file]
In-Reply-To: <f71fa3154051344f9c05dfff42bd38fd@solidstatelogic.com>
References: <20070508150022.GA20343@doctor.nl2k.ab.ca>
	<f71fa3154051344f9c05dfff42bd38fd@solidstatelogic.com>
Message-ID: <20070508154810.GA7356@doctor.nl2k.ab.ca>

On Tue, May 08, 2007 at 04:27:29PM +0100, Martin.Hepworth wrote:
> Dave
> 
> There's a CustomFunction called IPBlock that will update this list based
> on number of messages received from an ip-address.....
> 
> Normally it's attached to "Always Looked Up Last" in the following
> manner inside MailScanner.conf..
> 
> Always Looked Up Last = &IPBlock
>

As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:

 

As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:



As I said this is set to no;
however, when I did a tail on /etc/mail/acess I got:


66.220.2.220    550 Persistent Virus Source
212.122.114.249 550 Persistent Virus Source
85.68.131.183   550 Persistent Virus Source
69.11.213.106   550 Persistent Virus Source
66.201.40.102   550 Persistent Virus Source
85.2.209.213    550 Persistent Virus Source
83.112.32.94    550 Persistent Virus Source
200.62.150.49   550 We do not accept junk mail
89.24.82.141    550 We do not accept junk mail  


All that has changed recently is

clamd from 0.88.7 to 0.90.2
spamd from 3.1.X to 3.2.0

and 

MailScanner 4.58.9 to 4.59.4-2 just this weekend.


I would like to turn off the 550 We do not accept junk mail
feature as I would term it to be buggy, however the
Presistent Virus Source can stay for now; get rid of the fraud/Virus
mail thank you.
 
> 
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
> 
> > -----Original Message-----
> > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> > bounces@lists.mailscanner.info] On Behalf Of Dave Shariff Yadallee -
> > System Administrator a.k.a. The Root of the Problem
> > Sent: 08 May 2007 16:00
> > To: mailscanner@lists.mailscanner.info
> > Subject: [root@doctor.nl2k.ab.ca: New 550s getting automagically
> placed
> > into access file]
> >
> > I have to resend this as I found in my logs the mailscanner.info
> > mailserver
> > got listed as below.
> >
> > ----- Forwarded message from "Dave Shariff Yadallee -  System
> > Administrator a.k.a. The Root of the Problem" <root@doctor.nl2k.ab.ca>
> ---
> > --
> >
> > Date: Tue, 8 May 2007 07:44:36 -0600
> > From: "Dave Shariff Yadallee -  System Administrator a.k.a. The Root
> of
> > the Problem" <root@doctor.nl2k.ab.ca>
> > To: mailscanner@lists.mailscanner.info
> > Subject: New 550s getting automagically placed into access file
> > User-Agent: Mutt/1.5.12-2006-07-14
> >
> > I know there are 3 new packages out for MailScanner, spamd and clamd
> > however I cannot determine with is adding to the /etc/mail/access file
> > 550 We do not accept junk mail .
> >
> > I need to turn of this feature as it block transmission from secondary
> to
> > primary.
> >
> > Also I am running Botnet 0.7 .
> >
> > ----- End forwarded message -----
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean.
> >
> > --
> > MailScanner mailing list
> > mailscanner@lists.mailscanner.info
> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >
> > Before posting, read http://wiki.mailscanner.info/posting
> >
> > Support MailScanner development - buy the book off the website!
> 
> 
> 
> 
> **********************************************************************
> Confidentiality : This e-mail and any attachments are intended for the 
> addressee only and may be confidential. If they come to you in error 
> you must take no action based on them, nor must you copy or show them 
> to anyone. Please advise the sender by replying to this e-mail 
> immediately and then delete the original from your computer.
> 
> Opinion : Any opinions expressed in this e-mail are entirely those of 
> the author and unless specifically stated to the contrary, are not 
> necessarily those of the author's employer.
> 
> Security Warning : Internet e-mail is not necessarily a secure 
> communications medium and can be subject to data corruption. We advise 
> that you consider this fact when e-mailing us. 
> 
> Viruses : We have taken steps to ensure that this e-mail and any 
> attachments are free from known viruses but in keeping with good 
> computing practice, you should ensure that they are virus free.
> 
> Red Lion 49 Ltd T/A Solid State Logic
> Registered as a limited company in England and Wales 
> (Company No:5362730)
> Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
> United Kingdom
> **********************************************************************
> 
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
> 
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> 

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

From mkercher at nfsmith.com  Tue May  8 17:06:46 2007
From: mkercher at nfsmith.com (Mike Kercher)
Date: Tue May  8 17:10:33 2007
Subject: [root@doctor.nl2k.ab.ca: New 550s getting automagically
	placedinto access file]
References: <20070508150022.GA20343@doctor.nl2k.ab.ca><f71fa3154051344f9c05dfff42bd38fd@solidstatelogic.com>
	<20070508154810.GA7356@doctor.nl2k.ab.ca>
Message-ID: <6DEF8ABC1767C045B91F42066D36358E3AF7@HOUPEX01.nfsmith.info>

Dave Shariff Yadallee - System Administrator a.k.a. The Root of
theProblem <> wrote on Tuesday, May 08, 2007 10:48 AM:

: On Tue, May 08, 2007 at 04:27:29PM +0100, Martin.Hepworth wrote:
:: Dave
:: 
:: There's a CustomFunction called IPBlock that will update this list
:: based on number of messages received from an ip-address.....
:: 
:: Normally it's attached to "Always Looked Up Last" in the following
:: manner inside MailScanner.conf..
:: 
:: Always Looked Up Last = &IPBlock
:: 
: 

: 
: 
: 
: As I said this is set to no;
: however, when I did a tail on /etc/mail/acess I got:
: 
: 
: 66.220.2.220    550 Persistent Virus Source
: 212.122.114.249 550 Persistent Virus Source
: 85.68.131.183   550 Persistent Virus Source
: 69.11.213.106   550 Persistent Virus Source
: 66.201.40.102   550 Persistent Virus Source
: 85.2.209.213    550 Persistent Virus Source
: 83.112.32.94    550 Persistent Virus Source
: 200.62.150.49   550 We do not accept junk mail
: 89.24.82.141    550 We do not accept junk mail
: 
: 
: All that has changed recently is
: 
: clamd from 0.88.7 to 0.90.2
: spamd from 3.1.X to 3.2.0
: 
: and
: 
: MailScanner 4.58.9 to 4.59.4-2 just this weekend.
: 
: 
: I would like to turn off the 550 We do not accept junk mail
: feature as I would term it to be buggy, however the
: Presistent Virus Source can stay for now; get rid of the fraud/Virus
: mail thank you.
: 
:: 
:: --
:: Martin Hepworth
:: Snr Systems Administrator
:: Solid State Logic
:: Tel: +44 (0)1865 842300
:: 
::: -----Original Message-----
::: From: mailscanner-bounces@lists.mailscanner.info
::: [mailto:mailscanner- bounces@lists.mailscanner.info] On Behalf Of
::: Dave Shariff Yadallee - System Administrator a.k.a. The Root of the
::: Problem 
::: Sent: 08 May 2007 16:00
::: To: mailscanner@lists.mailscanner.info
::: Subject: [root@doctor.nl2k.ab.ca: New 550s getting automagically
::: placed into access file] 
::: 
::: I have to resend this as I found in my logs the mailscanner.info
::: mailserver got listed as below.
::: 
::: ----- Forwarded message from "Dave Shariff Yadallee -  System
::: Administrator a.k.a. The Root of the Problem"
::: <root@doctor.nl2k.ab.ca> --- -- 
::: 
::: Date: Tue, 8 May 2007 07:44:36 -0600
::: From: "Dave Shariff Yadallee -  System Administrator a.k.a. The
::: Root of the Problem" <root@doctor.nl2k.ab.ca>
::: To: mailscanner@lists.mailscanner.info
::: Subject: New 550s getting automagically placed into access file
::: User-Agent: Mutt/1.5.12-2006-07-14
::: 
::: I know there are 3 new packages out for MailScanner, spamd and clamd
::: however I cannot determine with is adding to the /etc/mail/access
::: file 550 We do not accept junk mail .
::: 
::: I need to turn of this feature as it block transmission from
::: secondary to primary. 
::: 
::: Also I am running Botnet 0.7 .
::: 
::: ----- End forwarded message -----

Are you running Vispan?

-Mike
From amaclach at yahoo.co.uk  Tue May  8 17:35:19 2007
From: amaclach at yahoo.co.uk (Andrew MacLachlan)
Date: Tue May  8 17:35:21 2007
Subject: Permissions to use Clamd with Postfix?
Message-ID: <892920.61461.qm@web26309.mail.ukl.yahoo.com>

You can also chmod 755 /var/spool/MailScanner and MailScanner/incoming.

The correct answer is the one that works.

----- Original Message ----
From: Paul Hutchings <paul.hutchings@mira.co.uk>
To: MailScanner discussion <mailscanner@lists.mailscanner.info>
Sent: Tuesday, 8 May, 2007 4:00:46 PM
Subject: RE: Permissions to use Clamd with Postfix?

Ok so two answers two methods.  Who's right? :-)

Paul Hutchings
Network Administrator, MIRA Ltd.
Tel: 44 (0)24 7635 5378
Fax: 44 (0)24 7635 8378
mailto:paul.hutchings@mira.co.uk

-----Original Message-----
From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Daniel Maher
Sent: 08 May 2007 15:15
To: MailScanner discussion
Subject: RE: Permissions to use Clamd with Postfix?

________________________________________
From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Paul Hutchings
Sent: May 8, 2007 10:05 AM
To: MailScanner discussion
Subject: Permissions to use Clamd with Postfix?

As subject really, I'm a little confused.  I'm running MailScanner with Postfix and would like to be able to use ClamD simply as I presume it's going to be faster than Clamscan.

My "run as" user/group is Postfix.  The permissions on /var/incoming/mail are postfix.postfix. 

What do I need to do to make MailScanner work with Clamd as at the moment when I try it I simply get an "/var/spool/MailScanner/incoming/14276/.: lstat() failed. ERROR" or similar.

Clamd is likely running as user "clamav", which doesn't have read permissions for the incoming directory.
________________________________________


The solution is twofold:
1. Change your "run as" options to use to "postfix.clamav"
2. Change the ownership of incoming to postfix.clamav, and give it group read perms

I had to setgid the incoming directory in order to make sure that the runtime dirs under incoming actually had their ownership set properly, but ymmv.

Cheers!

--
  _
 ?v?  Daniel Maher
/(_)\ Administrateur Syst?me Unix
 ^ ^  Unix System Administrator
 
"How can a man choose between Fresh and Fly?  And believe me, there IS a difference." - Crack Stuntman, 2007.
-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 

-- 
MIRA Ltd.

Watling Street, Nuneaton, Warwickshire, CV10 0TU, England.

Registered in England No. 402570
VAT Registration  GB 114 5409 96

The contents of this e-mail are confidential and are solely for the use of the intended recipient.
If you receive this e-mail in error, please delete it and notify us either by e-mail, telephone or fax.
You should not copy, forward or otherwise disclose the content of the e-mail as this is prohibited.


--
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!



From MailScanner at ecs.soton.ac.uk  Tue May  8 17:50:48 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Tue May  8 17:52:10 2007
Subject: writing to /var/spool/MailScanner/incoming
In-Reply-To: <46408774.1060606@sendit.nodak.edu>
References: <f1o9i8$lh9$1@sea.gmane.org> <46408774.1060606@sendit.nodak.edu>
Message-ID: <4640AA68.8050305@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Richard Frovarp wrote:
> Mark Nienberg wrote:
>> I have /var/spool/MailScanner/incoming mounted as tmpfs.
>>
>> I have a mail related script (duplicate msg remover) that could 
>> benefit from writing to tmpfs instead of physical disk.  Is it OK for 
>> my script to use some space in MailScanner/incoming or does 
>> MailScanner only expect to see it's own stuff in there?
>>
>> Thanks,
>> Mark
>>
>
> Isn't this really dangerous? If you lose power or reboot the machine 
> without an empty incoming queue, you will lose messages. To reboot you 
> would have to stop the incoming mail process, let MailScanner clean 
> out the queue, then reboot. Or am I missing something that would 
> prevent you from losing messages?
It is perfectly safe. The name "incoming" is probably not the best thing 
I could have called it, with hindsight. It is actually the working 
directory used by MailScanner while it is in the middle of processing 
the messages. There is always either (a) a copy in mqueue.in or (b) a 
copy in mqueue.in and mqueue or (c) a copy in mqueue. There is no time 
at which there is no copy on disk. There is *always* a copy on a 
disk-based filesystem, so it is perfectly safe.

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGQKqcEfZZRxQVtlQRAlOPAJoD45xf592WtAT/vgtZO1JsTlSdTgCgr5eh
RJVrQFW4ZjdsiRAK1OJ2JDA=
=qbRN
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From list-mailscanner at linguaphone.com  Tue May  8 18:33:06 2007
From: list-mailscanner at linguaphone.com (Gareth)
Date: Tue May  8 18:33:14 2007
Subject: FuzzyOcr customisations
Message-ID: <IGEOKMEENEPEICNOFDGJMEDNCPAA.list-mailscanner@linguaphone.com>

Thought people might be interested in the forum at
http://www.freespamfilter.org/forum/viewforum.php?f=25 where there are some
good tips for customising FuzzyOcr.

Today I have also had a stab at creating an image utility which can be added
to a scanset to hopefully improve its detection. Basically it works by
producing a grayscale image which contains the differences between a pixel
and the average colour over the whole image (rgb calculated separately)

You can see a couple of examples and download and have a play with it
yourself on my webpage at http://www.gbnetwork.co.uk/mailscanner/gbpgmdiff/
It is still very much a work in progress and I haven't even got round to
putting it into one of my scansets yet.

From hvdkooij at vanderkooij.org  Tue May  8 18:54:22 2007
From: hvdkooij at vanderkooij.org (Hugo van der Kooij)
Date: Tue May  8 18:54:55 2007
Subject: [root@doctor.nl2k.ab.ca: New 550s getting automagically placed
 into access file]
In-Reply-To: <20070508154810.GA7356@doctor.nl2k.ab.ca>
References: <20070508150022.GA20343@doctor.nl2k.ab.ca>
	<f71fa3154051344f9c05dfff42bd38fd@solidstatelogic.com>
	<20070508154810.GA7356@doctor.nl2k.ab.ca>
Message-ID: <Pine.LNX.4.64.0705081935460.16855@faramir.hugo.vanderkooij.org>

On Tue, 8 May 2007, Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem wrote:

> On Tue, May 08, 2007 at 04:27:29PM +0100, Martin.Hepworth wrote:
>> Dave
>>
>> There's a CustomFunction called IPBlock that will update this list based
>> on number of messages received from an ip-address.....
>>
>> Normally it's attached to "Always Looked Up Last" in the following
>> manner inside MailScanner.conf..
>>
>> Always Looked Up Last = &IPBlock
>>
>
> As I said this is set to no;
> however, when I did a tail on /etc/mail/acess I got:
>
>
>
> As I said this is set to no;
> however, when I did a tail on /etc/mail/acess I got:
>
>
>
> As I said this is set to no;
> however, when I did a tail on /etc/mail/acess I got:

..... (Zillion more of these removed)

I am not exactly what is happening on your system. But I would start 
scanning for other roots. I have strong reservations if someone starts to 
send email as root.

To troubleshoot the issue I would round up the usual suspects and start 
grepping some files for the exact string.

Then I would set the file readonly to see who is complaining.

I think with these two steps you should have a reasonable chang to find 
out who is adding the entries.

Hugo.

-- 
 	hvdkooij@vanderkooij.org	http://hugo.vanderkooij.org/
 	    This message is using 100% recycled electrons.

 	Some men see computers as they are and say "Windows"
 	I use computers with Linux and say "Why Windows?"
 		(Thanks JFK, for the insight.)
From ssilva at sgvwater.com  Tue May  8 19:03:44 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Tue May  8 19:04:25 2007
Subject: SpamAssassin 3.2.0 package
In-Reply-To: <223f97700705080127t2b5436e9m8fd50d8bbf481eb4@mail.gmail.com>
References: <463C6D8E.5040802@ecs.soton.ac.uk>	<463C9E7C.7040600@protos.mine.nu>
	<463CAD50.3050806@ecs.soton.ac.uk>	<463CB925.2050609@ecs.soton.ac.uk>
	<f1o8pd$g2l$2@sea.gmane.org>
	<223f97700705080127t2b5436e9m8fd50d8bbf481eb4@mail.gmail.com>
Message-ID: <f1qe20$vct$1@sea.gmane.org>

Glenn Steen spake the following on 5/8/2007 1:27 AM:
> On 08/05/07, Scott Silva <ssilva@sgvwater.com> wrote:
>> Julian Field spake the following on 5/5/2007 10:04 AM:
>> > I have done some basic tests with my SpamAssassin 3.2.0 package and
>> > MailScanner 4.59 and it is working fine.
>> >
>> > I'll do some more tests of it and probably start using it on a
>> > production machine tomorrow if I feel so inclined (and there again I
>> > might well just put my feet up and watch TV). It's a public holiday
>> this
>> > weekend (I think!) so by definition it should rain on Monday at
>> least. :-)
>> >
>> > Jules.
>> I hope you voted for putting your feet up and watching the TV!!  ;-P
> You are not alone in hoping that Scott!
> It's not that we want you to be bored Jules, nor that we don't
> appreciate the effort you make... We kind of want you to stick around
> for the long run, more than giving the immediate fix... Essentially
> see us as your virtual mother hens;-)
> 
And he never calls!
How about some nice chicken soup! ;-)

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From ssilva at sgvwater.com  Tue May  8 19:08:38 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Tue May  8 19:10:18 2007
Subject: SMPID vs. INPID
In-Reply-To: <005b01c79105$617db200$5e01a8c0@AldenLap>
References: <005b01c79105$617db200$5e01a8c0@AldenLap>
Message-ID: <f1qeb6$vct$2@sea.gmane.org>

Alden Levy spake the following on 5/7/2007 5:11 PM:
> I'm still scratching my head over this one.  Would someone with a Redhat
> install please post the relevant lines of their MailScanner_app_init, so I
> can compare it to mine?
> 
Here are the init scripts for RedHat and SUSE as given to me by Julian yesterday.
 Maybe you can find what is wrong with yours.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!
-------------- next part --------------
A non-text attachment was scrubbed...
Name: init.scripts.tgz
Type: application/x-compressed
Size: 4188 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070508/499cdc91/init.scripts.bin
From ssilva at sgvwater.com  Tue May  8 19:13:27 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Tue May  8 19:15:14 2007
Subject: Interesting need
In-Reply-To: <Pine.LNX.4.64.0705080948140.20818@ebfjryy.nhfvpf.arg>
References: <463F0518.65ED.00A2.0@plattesheriff.org>	<463F5C10.7080307@ecs.soton.ac.uk>	<463F7783.7070608@nkpanama.com>
	<463F822E.2010108@ecs.soton.ac.uk>	<223f97700705071442w106785bu1a9a50405476f9cb@mail.gmail.com>	<f1o9se$kcp$4@sea.gmane.org>
	<Pine.LNX.4.64.0705080948140.20818@ebfjryy.nhfvpf.arg>
Message-ID: <f1qek7$vct$3@sea.gmane.org>

Res spake the following on 5/7/2007 4:52 PM:
> On Mon, 7 May 2007, Scott Silva wrote:
> 
>> I think the archive mail option would be for those organizations that are
>> required to keep "everything" that crosses their gateway. So unless
>> you can
> 
> Not to mention for obtaining copies of mail sent from/to a norti user
> that the feds have an interest in :) and with the forwarding ability
> they get it all in real time.
> 
> 
> 
I really have to hope that I don't ever have that problem. Besides, the feds
can set up a Carnivore and get everything they want anyway.
-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From ssilva at sgvwater.com  Tue May  8 19:17:41 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Tue May  8 19:20:30 2007
Subject: Automated Reply from ittsl01 <info@ittsl.com>
In-Reply-To: <E1A7A1B4-3C61-4BD2-AAAE-37EDCF8BE036@technologytiger.net>
References: <200705080403.l4843VtQ016175@server30055.uk2net.com>	<463FC376.6020103@evi-inc.com>
	<E1A7A1B4-3C61-4BD2-AAAE-37EDCF8BE036@technologytiger.net>
Message-ID: <f1qes5$vct$4@sea.gmane.org>

Drew Marshall spake the following on 5/8/2007 1:10 AM:
> On 8 May 2007, at 01:25, Matt Kettler wrote:
> 
>> ittsl01 wrote:
>>> ITTSL is out of the office until 14th May on Business in Europe. If
>>> you require urgent assistance, please a problem ticket at
>>> http://www.ittsl.net and we will respond to as soon as possible. Many
>>> Thanks.
>>
>> Hmm, should we ALL go and open tickets? :)
> 
> It IS tempting...
> 
> Dear problem dept
> 
> How do I set my out of office up?
> 
> Regards ...
> 
> :-)
Not going to get a good answer for that one IMHO! ;-P


-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From alden at engineno9inc.com  Tue May  8 19:34:28 2007
From: alden at engineno9inc.com (Alden Levy)
Date: Tue May  8 19:34:42 2007
Subject: SMPID vs. INPID
Message-ID: <002101c7919f$83cb39f0$5a01a8c0@AldenLap>

Scott Silva wrote the following on Tue May 8 19:08:38 IST 2007
>Alden Levy spake the following on 5/7/2007 5:11 PM:
>> I'm still scratching my head over this one.  Would someone with a Redhat
>> install please post the relevant lines of their MailScanner_app_init, so
I
>> can compare it to mine?
>> 
>Here are the init scripts for RedHat and SUSE as given to me by Julian
yesterday.
> Maybe you can find what is wrong with yours.
>
>-- 
>
>MailScanner is like deodorant...
>You hope everybody uses it, and
>you notice quickly if they don't!!!!
>-------------- next part --------------
>A non-text attachment was scrubbed...
>Name: init.scripts.tgz
>Type: application/x-compressed
>Size: 4188 bytes
>Desc: not available
>Url :
http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070508/499
cdc91/init.scripts.bin


Thanks for this.  Now, I'm really confused; the RedHat init script is
identical to the one I'm using.

Does anyone have an idea of where else I should look? (Quick recap:
/var/run/sendmail.in.pid is not getting updated, so /etc/init.d/MailScanner
status lists incoming sendmail as failed.  sm-client.pid looks fine,
though.)

Thanks,
Alden

From root at doctor.nl2k.ab.ca  Tue May  8 19:36:53 2007
From: root at doctor.nl2k.ab.ca (Dave Shariff Yadallee - System Administrator a.k.a. The Root of the
	Problem)
Date: Tue May  8 19:41:31 2007
Subject: [root@doctor.nl2k.ab.ca: New 550s getting automagically
	placedinto access file]
In-Reply-To: <6DEF8ABC1767C045B91F42066D36358E3AF7@HOUPEX01.nfsmith.info>
References: <20070508154810.GA7356@doctor.nl2k.ab.ca>
	<6DEF8ABC1767C045B91F42066D36358E3AF7@HOUPEX01.nfsmith.info>
Message-ID: <20070508183652.GA26936@doctor.nl2k.ab.ca>

On Tue, May 08, 2007 at 11:06:46AM -0500, Mike Kercher wrote:
> Dave Shariff Yadallee - System Administrator a.k.a. The Root of
> theProblem <> wrote on Tuesday, May 08, 2007 10:48 AM:
> 
> : On Tue, May 08, 2007 at 04:27:29PM +0100, Martin.Hepworth wrote:
> :: Dave
> :: 
> :: There's a CustomFunction called IPBlock that will update this list
> :: based on number of messages received from an ip-address.....
> :: 
> :: Normally it's attached to "Always Looked Up Last" in the following
> :: manner inside MailScanner.conf..
> :: 
> :: Always Looked Up Last = &IPBlock
> :: 
> : 
> 
> : 
> : 
> : 
> : As I said this is set to no;
> : however, when I did a tail on /etc/mail/acess I got:
> : 
> : 
> : 66.220.2.220    550 Persistent Virus Source
> : 212.122.114.249 550 Persistent Virus Source
> : 85.68.131.183   550 Persistent Virus Source
> : 69.11.213.106   550 Persistent Virus Source
> : 66.201.40.102   550 Persistent Virus Source
> : 85.2.209.213    550 Persistent Virus Source
> : 83.112.32.94    550 Persistent Virus Source
> : 200.62.150.49   550 We do not accept junk mail
> : 89.24.82.141    550 We do not accept junk mail
> : 
> : 
> : All that has changed recently is
> : 
> : clamd from 0.88.7 to 0.90.2
> : spamd from 3.1.X to 3.2.0
> : 
> : and
> : 
> : MailScanner 4.58.9 to 4.59.4-2 just this weekend.
> : 
> : 
> : I would like to turn off the 550 We do not accept junk mail
> : feature as I would term it to be buggy, however the
> : Presistent Virus Source can stay for now; get rid of the fraud/Virus
> : mail thank you.
> : 
> :: 
> :: --
> :: Martin Hepworth
> :: Snr Systems Administrator
> :: Solid State Logic
> :: Tel: +44 (0)1865 842300
> :: 
> ::: -----Original Message-----
> ::: From: mailscanner-bounces@lists.mailscanner.info
> ::: [mailto:mailscanner- bounces@lists.mailscanner.info] On Behalf Of
> ::: Dave Shariff Yadallee - System Administrator a.k.a. The Root of the
> ::: Problem 
> ::: Sent: 08 May 2007 16:00
> ::: To: mailscanner@lists.mailscanner.info
> ::: Subject: [root@doctor.nl2k.ab.ca: New 550s getting automagically
> ::: placed into access file] 
> ::: 
> ::: I have to resend this as I found in my logs the mailscanner.info
> ::: mailserver got listed as below.
> ::: 
> ::: ----- Forwarded message from "Dave Shariff Yadallee -  System
> ::: Administrator a.k.a. The Root of the Problem"
> ::: <root@doctor.nl2k.ab.ca> --- -- 
> ::: 
> ::: Date: Tue, 8 May 2007 07:44:36 -0600
> ::: From: "Dave Shariff Yadallee -  System Administrator a.k.a. The
> ::: Root of the Problem" <root@doctor.nl2k.ab.ca>
> ::: To: mailscanner@lists.mailscanner.info
> ::: Subject: New 550s getting automagically placed into access file
> ::: User-Agent: Mutt/1.5.12-2006-07-14
> ::: 
> ::: I know there are 3 new packages out for MailScanner, spamd and clamd
> ::: however I cannot determine with is adding to the /etc/mail/access
> ::: file 550 We do not accept junk mail .
> ::: 
> ::: I need to turn of this feature as it block transmission from
> ::: secondary to primary. 
> ::: 
> ::: Also I am running Botnet 0.7 .
> ::: 
> ::: ----- End forwarded message -----
> 
> Are you running Vispan?
>

Yes Vispan 3.0
 
> -Mike
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
> 
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> 

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

From hvdkooij at vanderkooij.org  Tue May  8 20:09:32 2007
From: hvdkooij at vanderkooij.org (Hugo van der Kooij)
Date: Tue May  8 20:10:06 2007
Subject: SMPID vs. INPID
In-Reply-To: <002101c7919f$83cb39f0$5a01a8c0@AldenLap>
References: <002101c7919f$83cb39f0$5a01a8c0@AldenLap>
Message-ID: <Pine.LNX.4.64.0705082108210.16855@faramir.hugo.vanderkooij.org>

On Tue, 8 May 2007, Alden Levy wrote:

> Thanks for this.  Now, I'm really confused; the RedHat init script is
> identical to the one I'm using.
>
> Does anyone have an idea of where else I should look? (Quick recap:
> /var/run/sendmail.in.pid is not getting updated, so /etc/init.d/MailScanner
> status lists incoming sendmail as failed.  sm-client.pid looks fine,
> though.)

If you stop MailScanner the PID file should be gone. If not then you 
should remove it by hand and see if it happens to get recreated at 
startup.

Hugo.

-- 
 	hvdkooij@vanderkooij.org	http://hugo.vanderkooij.org/
 	    This message is using 100% recycled electrons.

 	Some men see computers as they are and say "Windows"
 	I use computers with Linux and say "Why Windows?"
 		(Thanks JFK, for the insight.)
From alden at engineno9inc.com  Tue May  8 20:16:08 2007
From: alden at engineno9inc.com (Alden Levy)
Date: Tue May  8 20:16:23 2007
Subject: SMPID vs. INPID
Message-ID: <000901c791a5$55ceb530$5a01a8c0@AldenLap>

Hugo van der Kooij wrote on Tue May 8 20:09:32 IST 2007
>On Tue, 8 May 2007, Alden Levy wrote:
>
>> Thanks for this.  Now, I'm really confused; the RedHat init script is
>> identical to the one I'm using.
>>
>> Does anyone have an idea of where else I should look? (Quick recap:
>> /var/run/sendmail.in.pid is not getting updated, so
/etc/init.d/MailScanner
>> status lists incoming sendmail as failed.  sm-client.pid looks fine,
>> though.)
>
>If you stop MailScanner the PID file should be gone. If not then you 
>should remove it by hand and see if it happens to get recreated at 
>startup.
>
>Hugo.
>
>-- 
> 	hvdkooij at vanderkooij.org	http://hugo.vanderkooij.org/
> 	    This message is using 100% recycled electrons. 

Well, that was a mistake!  Now after removing the file by hand, and
restarting, I run status and get:
Checking MailScanner daemons:
         MailScanner:                                      [  OK  ]
         incoming sendmail: head: cannot open `/var/run/sendmail.in.pid' for
reading: No such file or directory
                                                           [FAILED]
         outgoing sendmail:                                [  OK  ]


Any other thoughts?
 Thanks,
Alden

From dnsadmin at 1bigthink.com  Tue May  8 20:33:10 2007
From: dnsadmin at 1bigthink.com (dnsadmin 1bigthink.com)
Date: Tue May  8 20:33:31 2007
Subject: Interesting need
In-Reply-To: <f1qek7$vct$3@sea.gmane.org>
References: <463F0518.65ED.00A2.0@plattesheriff.org>
	<463F5C10.7080307@ecs.soton.ac.uk> <463F7783.7070608@nkpanama.com>
	<463F822E.2010108@ecs.soton.ac.uk>
	<223f97700705071442w106785bu1a9a50405476f9cb@mail.gmail.com>
	<f1o9se$kcp$4@sea.gmane.org>
	<Pine.LNX.4.64.0705080948140.20818@ebfjryy.nhfvpf.arg>
	<f1qek7$vct$3@sea.gmane.org>
Message-ID: <200705081933.l48JXUwY016426@mxt.1bigthink.com>

At 02:13 PM 5/8/2007, you wrote:

>Res spake the following on 5/7/2007 4:52 PM:
> > On Mon, 7 May 2007, Scott Silva wrote:
> >
> >> I think the archive mail option would be for those organizations that are
> >> required to keep "everything" that crosses their gateway. So unless
> >> you can
> >
> > Not to mention for obtaining copies of mail sent from/to a norti user
> > that the feds have an interest in :) and with the forwarding ability
> > they get it all in real time.
> >
> >
> >
>I really have to hope that I don't ever have that problem. Besides, the feds
>can set up a Carnivore and get everything they want anyway.
>--

Carnivore is so '90's We're on son of TIA now! I'll bet it can sniff 
a packet before you even thought what to type!

>MailScanner is like deodorant...
>You hope everybody uses it, and
>you notice quickly if they don't!!!!

Yes it is! Please keep that in your sigs unless or until you think up 
one as witty! 

From ssilva at sgvwater.com  Tue May  8 21:08:43 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Tue May  8 21:11:50 2007
Subject: SMPID vs. INPID
In-Reply-To: <000901c791a5$55ceb530$5a01a8c0@AldenLap>
References: <000901c791a5$55ceb530$5a01a8c0@AldenLap>
Message-ID: <f1qlca$5c0$1@sea.gmane.org>

Alden Levy spake the following on 5/8/2007 12:16 PM:
> Hugo van der Kooij wrote on Tue May 8 20:09:32 IST 2007
>> On Tue, 8 May 2007, Alden Levy wrote:
>>
>>> Thanks for this.  Now, I'm really confused; the RedHat init script is
>>> identical to the one I'm using.
>>>
>>> Does anyone have an idea of where else I should look? (Quick recap:
>>> /var/run/sendmail.in.pid is not getting updated, so
> /etc/init.d/MailScanner
>>> status lists incoming sendmail as failed.  sm-client.pid looks fine,
>>> though.)
>> If you stop MailScanner the PID file should be gone. If not then you 
>> should remove it by hand and see if it happens to get recreated at 
>> startup.
>>
>> Hugo.
>>
>> -- 
>> 	hvdkooij at vanderkooij.org	http://hugo.vanderkooij.org/
>> 	    This message is using 100% recycled electrons. 
> 
> Well, that was a mistake!  Now after removing the file by hand, and
> restarting, I run status and get:
> Checking MailScanner daemons:
>          MailScanner:                                      [  OK  ]
>          incoming sendmail: head: cannot open `/var/run/sendmail.in.pid' for
> reading: No such file or directory
>                                                            [FAILED]
>          outgoing sendmail:                                [  OK  ]
> 
> 
> Any other thoughts?
>  Thanks,
> Alden
> 
Your init script could be either damaged, or an old version.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From ssilva at sgvwater.com  Tue May  8 21:11:25 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Tue May  8 21:15:06 2007
Subject: [root@doctor.nl2k.ab.ca: New 550s getting automagically
 placedinto access file]
In-Reply-To: <20070508183652.GA26936@doctor.nl2k.ab.ca>
References: <20070508154810.GA7356@doctor.nl2k.ab.ca>	<6DEF8ABC1767C045B91F42066D36358E3AF7@HOUPEX01.nfsmith.info>
	<20070508183652.GA26936@doctor.nl2k.ab.ca>
Message-ID: <f1qlhd$5c0$3@sea.gmane.org>

Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem
spake the following on 5/8/2007 11:36 AM:
> On Tue, May 08, 2007 at 11:06:46AM -0500, Mike Kercher wrote:
>> Dave Shariff Yadallee - System Administrator a.k.a. The Root of
>> theProblem <> wrote on Tuesday, May 08, 2007 10:48 AM:
>>
>> : On Tue, May 08, 2007 at 04:27:29PM +0100, Martin.Hepworth wrote:
>> :: Dave
>> :: 
>> :: There's a CustomFunction called IPBlock that will update this list
>> :: based on number of messages received from an ip-address.....
>> :: 
>> :: Normally it's attached to "Always Looked Up Last" in the following
>> :: manner inside MailScanner.conf..
>> :: 
>> :: Always Looked Up Last = &IPBlock
>> :: 
>> : 
>>
>> : 
>> : 
>> : 
>> : As I said this is set to no;
>> : however, when I did a tail on /etc/mail/acess I got:
>> : 
>> : 
>> : 66.220.2.220    550 Persistent Virus Source
>> : 212.122.114.249 550 Persistent Virus Source
>> : 85.68.131.183   550 Persistent Virus Source
>> : 69.11.213.106   550 Persistent Virus Source
>> : 66.201.40.102   550 Persistent Virus Source
>> : 85.2.209.213    550 Persistent Virus Source
>> : 83.112.32.94    550 Persistent Virus Source
>> : 200.62.150.49   550 We do not accept junk mail
>> : 89.24.82.141    550 We do not accept junk mail
>> : 
>> : 
>> : All that has changed recently is
>> : 
>> : clamd from 0.88.7 to 0.90.2
>> : spamd from 3.1.X to 3.2.0
>> : 
>> : and
>> : 
>> : MailScanner 4.58.9 to 4.59.4-2 just this weekend.
>> : 
>> : 
>> : I would like to turn off the 550 We do not accept junk mail
>> : feature as I would term it to be buggy, however the
>> : Presistent Virus Source can stay for now; get rid of the fraud/Virus
>> : mail thank you.
>> : 
>> :: 
>> :: --
>> :: Martin Hepworth
>> :: Snr Systems Administrator
>> :: Solid State Logic
>> :: Tel: +44 (0)1865 842300
>> :: 
>> ::: -----Original Message-----
>> ::: From: mailscanner-bounces@lists.mailscanner.info
>> ::: [mailto:mailscanner- bounces@lists.mailscanner.info] On Behalf Of
>> ::: Dave Shariff Yadallee - System Administrator a.k.a. The Root of the
>> ::: Problem 
>> ::: Sent: 08 May 2007 16:00
>> ::: To: mailscanner@lists.mailscanner.info
>> ::: Subject: [root@doctor.nl2k.ab.ca: New 550s getting automagically
>> ::: placed into access file] 
>> ::: 
>> ::: I have to resend this as I found in my logs the mailscanner.info
>> ::: mailserver got listed as below.
>> ::: 
>> ::: ----- Forwarded message from "Dave Shariff Yadallee -  System
>> ::: Administrator a.k.a. The Root of the Problem"
>> ::: <root@doctor.nl2k.ab.ca> --- -- 
>> ::: 
>> ::: Date: Tue, 8 May 2007 07:44:36 -0600
>> ::: From: "Dave Shariff Yadallee -  System Administrator a.k.a. The
>> ::: Root of the Problem" <root@doctor.nl2k.ab.ca>
>> ::: To: mailscanner@lists.mailscanner.info
>> ::: Subject: New 550s getting automagically placed into access file
>> ::: User-Agent: Mutt/1.5.12-2006-07-14
>> ::: 
>> ::: I know there are 3 new packages out for MailScanner, spamd and clamd
>> ::: however I cannot determine with is adding to the /etc/mail/access
>> ::: file 550 We do not accept junk mail .
>> ::: 
>> ::: I need to turn of this feature as it block transmission from
>> ::: secondary to primary. 
>> ::: 
>> ::: Also I am running Botnet 0.7 .
>> ::: 
>> ::: ----- End forwarded message -----
>>
>> Are you running Vispan?
>>
> 
> Yes Vispan 3.0
>  
That is what is adding those entries.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From ssilva at sgvwater.com  Tue May  8 21:13:28 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Tue May  8 21:20:08 2007
Subject: [root@doctor.nl2k.ab.ca: New 550s getting automagically
 placedinto access file]
In-Reply-To: <20070508183652.GA26936@doctor.nl2k.ab.ca>
References: <20070508154810.GA7356@doctor.nl2k.ab.ca>	<6DEF8ABC1767C045B91F42066D36358E3AF7@HOUPEX01.nfsmith.info>
	<20070508183652.GA26936@doctor.nl2k.ab.ca>
Message-ID: <f1qll7$5c0$4@sea.gmane.org>

Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem
spake the following on 5/8/2007 11:36 AM:
> On Tue, May 08, 2007 at 11:06:46AM -0500, Mike Kercher wrote:
>> Dave Shariff Yadallee - System Administrator a.k.a. The Root of
>> theProblem <> wrote on Tuesday, May 08, 2007 10:48 AM:
>>
>> : On Tue, May 08, 2007 at 04:27:29PM +0100, Martin.Hepworth wrote:
>> :: Dave
>> :: 
>> :: There's a CustomFunction called IPBlock that will update this list
>> :: based on number of messages received from an ip-address.....
>> :: 
>> :: Normally it's attached to "Always Looked Up Last" in the following
>> :: manner inside MailScanner.conf..
>> :: 
>> :: Always Looked Up Last = &IPBlock
>> :: 
>> : 
>>
>> : 
>> : 
>> : 
>> : As I said this is set to no;
>> : however, when I did a tail on /etc/mail/acess I got:
>> : 
>> : 
>> : 66.220.2.220    550 Persistent Virus Source
>> : 212.122.114.249 550 Persistent Virus Source
>> : 85.68.131.183   550 Persistent Virus Source
>> : 69.11.213.106   550 Persistent Virus Source
>> : 66.201.40.102   550 Persistent Virus Source
>> : 85.2.209.213    550 Persistent Virus Source
>> : 83.112.32.94    550 Persistent Virus Source
>> : 200.62.150.49   550 We do not accept junk mail
>> : 89.24.82.141    550 We do not accept junk mail
>> : 
>> : 
>> : All that has changed recently is
>> : 
>> : clamd from 0.88.7 to 0.90.2
>> : spamd from 3.1.X to 3.2.0
>> : 
>> : and
>> : 
>> : MailScanner 4.58.9 to 4.59.4-2 just this weekend.
>> : 
>> : 
>> : I would like to turn off the 550 We do not accept junk mail
>> : feature as I would term it to be buggy, however the
>> : Presistent Virus Source can stay for now; get rid of the fraud/Virus
>> : mail thank you.
>> : 
>> :: 
>> :: --
>> :: Martin Hepworth
>> :: Snr Systems Administrator
>> :: Solid State Logic
>> :: Tel: +44 (0)1865 842300
>> :: 
>> ::: -----Original Message-----
>> ::: From: mailscanner-bounces@lists.mailscanner.info
>> ::: [mailto:mailscanner- bounces@lists.mailscanner.info] On Behalf Of
>> ::: Dave Shariff Yadallee - System Administrator a.k.a. The Root of the
>> ::: Problem 
>> ::: Sent: 08 May 2007 16:00
>> ::: To: mailscanner@lists.mailscanner.info
>> ::: Subject: [root@doctor.nl2k.ab.ca: New 550s getting automagically
>> ::: placed into access file] 
>> ::: 
>> ::: I have to resend this as I found in my logs the mailscanner.info
>> ::: mailserver got listed as below.
>> ::: 
>> ::: ----- Forwarded message from "Dave Shariff Yadallee -  System
>> ::: Administrator a.k.a. The Root of the Problem"
>> ::: <root@doctor.nl2k.ab.ca> --- -- 
>> ::: 
>> ::: Date: Tue, 8 May 2007 07:44:36 -0600
>> ::: From: "Dave Shariff Yadallee -  System Administrator a.k.a. The
>> ::: Root of the Problem" <root@doctor.nl2k.ab.ca>
>> ::: To: mailscanner@lists.mailscanner.info
>> ::: Subject: New 550s getting automagically placed into access file
>> ::: User-Agent: Mutt/1.5.12-2006-07-14
>> ::: 
>> ::: I know there are 3 new packages out for MailScanner, spamd and clamd
>> ::: however I cannot determine with is adding to the /etc/mail/access
>> ::: file 550 We do not accept junk mail .
>> ::: 
>> ::: I need to turn of this feature as it block transmission from
>> ::: secondary to primary. 
>> ::: 
>> ::: Also I am running Botnet 0.7 .
>> ::: 
>> ::: ----- End forwarded message -----
>>
>> Are you running Vispan?
>>
> 
> Yes Vispan 3.0
>  
Sorry, hit send too fast. You need to fix the whitelisting in the vispan.conf
file if you want to spare your secondaries. And make sure your secondaries are
in the spamassassin trusted networks to help with the scoring.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From mkercher at nfsmith.com  Tue May  8 21:19:30 2007
From: mkercher at nfsmith.com (Mike Kercher)
Date: Tue May  8 21:23:12 2007
Subject: [root@doctor.nl2k.ab.ca: New 550s getting automagically
	placedinto access file]
References: <20070508154810.GA7356@doctor.nl2k.ab.ca>	<6DEF8ABC1767C045B91F42066D36358E3AF7@HOUPEX01.nfsmith.info><20070508183652.GA26936@doctor.nl2k.ab.ca>
	<f1qlhd$5c0$3@sea.gmane.org>
Message-ID: <6DEF8ABC1767C045B91F42066D36358E3AFF@HOUPEX01.nfsmith.info>

Scott Silva <> wrote on Tuesday, May 08, 2007 3:11 PM:

: Dave Shariff Yadallee - System Administrator a.k.a. The Root of the
: Problem spake the following on 5/8/2007 11:36 AM: 
:: On Tue, May 08, 2007 at 11:06:46AM -0500, Mike Kercher wrote:
::: Dave Shariff Yadallee - System Administrator a.k.a. The Root of
::: theProblem <> wrote on Tuesday, May 08, 2007 10:48 AM:
::: 
:::: On Tue, May 08, 2007 at 04:27:29PM +0100, Martin.Hepworth wrote:
::::: Dave
::::: 
::::: There's a CustomFunction called IPBlock that will update this list
::::: based on number of messages received from an ip-address.....
::::: 
::::: Normally it's attached to "Always Looked Up Last" in the following
::::: manner inside MailScanner.conf..
::::: 
::::: Always Looked Up Last = &IPBlock
::::: 
:::: 
::: 
:::: 
:::: 
:::: 
:::: As I said this is set to no;
:::: however, when I did a tail on /etc/mail/acess I got:
:::: 
:::: 
:::: 66.220.2.220    550 Persistent Virus Source
:::: 212.122.114.249 550 Persistent Virus Source
:::: 85.68.131.183   550 Persistent Virus Source
:::: 69.11.213.106   550 Persistent Virus Source
:::: 66.201.40.102   550 Persistent Virus Source
:::: 85.2.209.213    550 Persistent Virus Source
:::: 83.112.32.94    550 Persistent Virus Source
:::: 200.62.150.49   550 We do not accept junk mail
:::: 89.24.82.141    550 We do not accept junk mail
:::: 
:::: 
:::: All that has changed recently is
:::: 
:::: clamd from 0.88.7 to 0.90.2
:::: spamd from 3.1.X to 3.2.0
:::: 
:::: and
:::: 
:::: MailScanner 4.58.9 to 4.59.4-2 just this weekend.
:::: 
:::: 
:::: I would like to turn off the 550 We do not accept junk mail
:::: feature as I would term it to be buggy, however the
:::: Presistent Virus Source can stay for now; get rid of the
:::: fraud/Virus mail thank you. 
:::: 
::::: 
::::: --
::::: Martin Hepworth
::::: Snr Systems Administrator
::::: Solid State Logic
::::: Tel: +44 (0)1865 842300
::::: 
:::::: -----Original Message-----
:::::: From: mailscanner-bounces@lists.mailscanner.info
:::::: [mailto:mailscanner- bounces@lists.mailscanner.info] On Behalf Of
:::::: Dave Shariff Yadallee - System Administrator a.k.a. The Root of
:::::: the Problem Sent: 08 May 2007 16:00
:::::: To: mailscanner@lists.mailscanner.info
:::::: Subject: [root@doctor.nl2k.ab.ca: New 550s getting automagically
:::::: placed into access file] 
:::::: 
:::::: I have to resend this as I found in my logs the mailscanner.info
:::::: mailserver got listed as below.
:::::: 
:::::: ----- Forwarded message from "Dave Shariff Yadallee -  System
:::::: Administrator a.k.a. The Root of the Problem"
:::::: <root@doctor.nl2k.ab.ca> --- --
:::::: 
:::::: Date: Tue, 8 May 2007 07:44:36 -0600
:::::: From: "Dave Shariff Yadallee -  System Administrator a.k.a. The
:::::: Root of the Problem" <root@doctor.nl2k.ab.ca>
:::::: To: mailscanner@lists.mailscanner.info
:::::: Subject: New 550s getting automagically placed into access file
:::::: User-Agent: Mutt/1.5.12-2006-07-14
:::::: 
:::::: I know there are 3 new packages out for MailScanner, spamd and
:::::: clamd however I cannot determine with is adding to the
:::::: /etc/mail/access file 550 We do not accept junk mail .
:::::: 
:::::: I need to turn of this feature as it block transmission from
:::::: secondary to primary. 
:::::: 
:::::: Also I am running Botnet 0.7 .
:::::: 
:::::: ----- End forwarded message -----
::: 
::: Are you running Vispan?
::: 
:: 
:: Yes Vispan 3.0
:: 
: That is what is adding those entries.
: 
: --
: 

That is correct.  There is a setting in the .conf file to use or not to
use the access file.


-Mike
From ssilva at sgvwater.com  Tue May  8 21:10:13 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Tue May  8 21:25:10 2007
Subject: Interesting need
In-Reply-To: <200705081933.l48JXUwY016426@mxt.1bigthink.com>
References: <463F0518.65ED.00A2.0@plattesheriff.org>	<463F5C10.7080307@ecs.soton.ac.uk>
	<463F7783.7070608@nkpanama.com>	<463F822E.2010108@ecs.soton.ac.uk>	<223f97700705071442w106785bu1a9a50405476f9cb@mail.gmail.com>	<f1o9se$kcp$4@sea.gmane.org>	<Pine.LNX.4.64.0705080948140.20818@ebfjryy.nhfvpf.arg>	<f1qek7$vct$3@sea.gmane.org>
	<200705081933.l48JXUwY016426@mxt.1bigthink.com>
Message-ID: <f1qlf4$5c0$2@sea.gmane.org>

dnsadmin 1bigthink.com spake the following on 5/8/2007 12:33 PM:
> At 02:13 PM 5/8/2007, you wrote:
> 
>> Res spake the following on 5/7/2007 4:52 PM:
>> > On Mon, 7 May 2007, Scott Silva wrote:
>> >
>> >> I think the archive mail option would be for those organizations
>> that are
>> >> required to keep "everything" that crosses their gateway. So unless
>> >> you can
>> >
>> > Not to mention for obtaining copies of mail sent from/to a norti user
>> > that the feds have an interest in :) and with the forwarding ability
>> > they get it all in real time.
>> >
>> >
>> >
>> I really have to hope that I don't ever have that problem. Besides,
>> the feds
>> can set up a Carnivore and get everything they want anyway.
>> -- 
> 
> Carnivore is so '90's We're on son of TIA now! I'll bet it can sniff a
> packet before you even thought what to type!
> 
>> MailScanner is like deodorant...
>> You hope everybody uses it, and
>> you notice quickly if they don't!!!!
> 
> Yes it is! Please keep that in your sigs unless or until you think up
> one as witty!
I don't think it is as popular on the mimedefang list  ;-)

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From ajos1 at onion.demon.co.uk  Tue May  8 21:53:46 2007
From: ajos1 at onion.demon.co.uk (ajos1@onion.demon.co.uk)
Date: Tue May  8 21:54:06 2007
Subject: No VirusScan on Local Messages...
Message-ID: <senttue08may2007215346gmtbstajos1@sonicbadger.com>

-

I have been trying to find the answer myself... but I know as soon as I send this... it will appear on the next page I look at (well I hope)!

Basically we have had a problem with MySql failing and we have MailWatch... so we are getting zillons of messages being generated... because MailWatch cannot write to MySql... now that is not really the problem (though it would be good not to have these warning messages).

The problem is that these locally produced warning messages are slowing down the machine to a grinding halt when they are VirusChecked... ClamAv being the main SLOW SLOW culprit.

I am trying to find out how to set up the system to NOT VIRUSCAN the locally produced warning messages... and to deliver them straight to the root/localhost account.

Thanks in Advance-o... Ajos1

==
=====================================================================
=
= "The council has asked residents with Christmas trees that are
=  unsuitable for use as maypoles to chop them up and put them in
=  recycling bins to be collected after the holiday."
=
=  Need help dealing with Parking Tickets, Bailiffs, Capita or NTL...
=  Call...    +44 8457 90 90 90    http://www.samaritans.org/
=
=====================================================================
From dominian at slackadelic.com  Tue May  8 22:09:52 2007
From: dominian at slackadelic.com (Matt Hayes)
Date: Tue May  8 22:09:57 2007
Subject: No VirusScan on Local Messages...
In-Reply-To: <senttue08may2007215346gmtbstajos1@sonicbadger.com>
References: <senttue08may2007215346gmtbstajos1@sonicbadger.com>
Message-ID: <4640E720.9060606@slackadelic.com>

ajos1@onion.demon.co.uk wrote:
> -
> 
> I have been trying to find the answer myself... but I know as soon as I send this... it will appear on the next page I look at (well I hope)!
> 
> Basically we have had a problem with MySql failing and we have MailWatch... so we are getting zillons of messages being generated... because MailWatch cannot write to MySql... now that is not really the problem (though it would be good not to have these warning messages).
> 
> The problem is that these locally produced warning messages are slowing down the machine to a grinding halt when they are VirusChecked... ClamAv being the main SLOW SLOW culprit.
> 
> I am trying to find out how to set up the system to NOT VIRUSCAN the locally produced warning messages... and to deliver them straight to the root/localhost account.
> 
> Thanks in Advance-o... Ajos1
> 


Search for "Scan Messages =" in your MailScanner.conf

And put: Scan Messages = %rules-dir%/scan.messages.rules

And in the %rules-dir% create scan.messages.rules with the following:

From:           127.0.0.1       no
FromOrTo:       default         yes



Save, restart MailScanner.


-Matt


From gmane at tippingmar.com  Tue May  8 22:35:48 2007
From: gmane at tippingmar.com (Mark Nienberg)
Date: Tue May  8 22:36:03 2007
Subject: writing to /var/spool/MailScanner/incoming
In-Reply-To: <46404DAA.9040900@ecs.soton.ac.uk>
References: <f1o9i8$lh9$1@sea.gmane.org> <46404DAA.9040900@ecs.soton.ac.uk>
Message-ID: <f1qqfk$p1p$1@sea.gmane.org>

Julian Field wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Why not just do another tmpfs mount somewhere else as well? It's quite 
> reasonable in most circumstances to mount /tmp on tmpfs and then use a 
> subdirectory of that.
> 

Well OK, that is probably the cleanest solution.  I was tying to shortcut a bit.

Thanks,
Mark

From alden at engineno9inc.com  Tue May  8 23:09:15 2007
From: alden at engineno9inc.com (Alden Levy)
Date: Tue May  8 23:09:30 2007
Subject: SMPID vs. INPID
Message-ID: <000001c791bd$84f120b0$7100000a@AldenLap>

Scott Silva ssilva wrote on Tue May 8 21:08:43 IST 2007
>Alden Levy spake the following on 5/8/2007 12:16 PM:
>> Hugo van der Kooij wrote on Tue May 8 20:09:32 IST 2007
>>> On Tue, 8 May 2007, Alden Levy wrote:
>>>
>>>> Thanks for this.  Now, I'm really confused; the RedHat init script is
>>>> identical to the one I'm using.
>>>>
>>>> Does anyone have an idea of where else I should look? (Quick recap:
>>>> /var/run/sendmail.in.pid is not getting updated, so
>> /etc/init.d/MailScanner
>>>> status lists incoming sendmail as failed.  sm-client.pid looks fine,
>>>> though.)
>>> If you stop MailScanner the PID file should be gone. If not then you 
>>> should remove it by hand and see if it happens to get recreated at 
>>> startup.
>>>
>>> Hugo.
>>>
>>> -- 
>>> 	hvdkooij at vanderkooij.org	http://hugo.vanderkooij.org/
>>> 	    This message is using 100% recycled electrons. 
>> 
>> Well, that was a mistake!  Now after removing the file by hand, and
>> restarting, I run status and get:
>> Checking MailScanner daemons:
>>          MailScanner:                                      [  OK  ]
>>          incoming sendmail: head: cannot open `/var/run/sendmail.in.pid'
for
>> reading: No such file or directory
>>                                                            [FAILED]
>>          outgoing sendmail:                                [  OK  ]
>> 
>> 
>> Any other thoughts?
>>  Thanks,
>> Alden
>> 
>Your init script could be either damaged, or an old version. 

But I did a diff on my init script and the RedHat script you sent earlier
today, and there is no difference.  Can it still be corrupted?

I was wondering if I should look elsewhere, or just try to reinstall.

Thanks,
Alden

From mogens at fumlersoft.dk  Tue May  8 23:16:44 2007
From: mogens at fumlersoft.dk (Mogens Melander)
Date: Tue May  8 23:17:14 2007
Subject: SMPID vs. INPID
In-Reply-To: <000901c791a5$55ceb530$5a01a8c0@AldenLap>
References: <000901c791a5$55ceb530$5a01a8c0@AldenLap>
Message-ID: <1326.90.184.17.152.1178662604.squirrel@mail.fumlersoft.dk>


On Tue, May 8, 2007 21:16, Alden Levy wrote:
> Hugo van der Kooij wrote on Tue May 8 20:09:32 IST 2007
>>On Tue, 8 May 2007, Alden Levy wrote:
>>
>>> Thanks for this.  Now, I'm really confused; the RedHat init script is
>>> identical to the one I'm using.
>>>
>>> Does anyone have an idea of where else I should look? (Quick recap:
>>> /var/run/sendmail.in.pid is not getting updated, so
> /etc/init.d/MailScanner
>>> status lists incoming sendmail as failed.  sm-client.pid looks fine,
>>> though.)
>>
>>If you stop MailScanner the PID file should be gone. If not then you
>>should remove it by hand and see if it happens to get recreated at
>>startup.
>>
>>Hugo.
>>
>>--
>> 	hvdkooij at vanderkooij.org	http://hugo.vanderkooij.org/
>> 	    This message is using 100% recycled electrons.
>
> Well, that was a mistake!  Now after removing the file by hand, and
> restarting, I run status and get:
> Checking MailScanner daemons:
>          MailScanner:                                      [  OK  ]
>          incoming sendmail: head: cannot open `/var/run/sendmail.in.pid'
> for
> reading: No such file or directory
>                                                            [FAILED]
>          outgoing sendmail:                                [  OK  ]
>
>
> Any other thoughts?
>  Thanks,
> Alden

Well, it's not enough to stop MailScanner. You got to stop Sendmail too :)

Then you can rm .pid files, and start again.

-- 
Later

Mogens Melander
+45 40 85 71 38
+66 870 133 224



-- 
This message has been scanned for viruses and
dangerous content by OpenProtect(http://www.openprotect.com), and is
believed to be clean.

From root at doctor.nl2k.ab.ca  Tue May  8 23:12:44 2007
From: root at doctor.nl2k.ab.ca (Dave Shariff Yadallee - System Administrator a.k.a. The Root of the
	Problem)
Date: Tue May  8 23:51:45 2007
Subject: [root@doctor.nl2k.ab.ca: New 550s getting automagically
	placedinto access file]
In-Reply-To: <f1qlhd$5c0$3@sea.gmane.org>
References: <20070508154810.GA7356@doctor.nl2k.ab.ca>
	<6DEF8ABC1767C045B91F42066D36358E3AF7@HOUPEX01.nfsmith.info>
	<20070508183652.GA26936@doctor.nl2k.ab.ca>
	<f1qlhd$5c0$3@sea.gmane.org>
Message-ID: <20070508221244.GB14816@doctor.nl2k.ab.ca>

On Tue, May 08, 2007 at 01:11:25PM -0700, Scott Silva wrote:
> Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem
> spake the following on 5/8/2007 11:36 AM:
> > On Tue, May 08, 2007 at 11:06:46AM -0500, Mike Kercher wrote:
> >> Dave Shariff Yadallee - System Administrator a.k.a. The Root of
> >> theProblem <> wrote on Tuesday, May 08, 2007 10:48 AM:
> >>
> >> : On Tue, May 08, 2007 at 04:27:29PM +0100, Martin.Hepworth wrote:
> >> :: Dave
> >> :: 
> >> :: There's a CustomFunction called IPBlock that will update this list
> >> :: based on number of messages received from an ip-address.....
> >> :: 
> >> :: Normally it's attached to "Always Looked Up Last" in the following
> >> :: manner inside MailScanner.conf..
> >> :: 
> >> :: Always Looked Up Last = &IPBlock
> >> :: 
> >> : 
> >>
> >> : 
> >> : 
> >> : 
> >> : As I said this is set to no;
> >> : however, when I did a tail on /etc/mail/acess I got:
> >> : 
> >> : 
> >> : 66.220.2.220    550 Persistent Virus Source
> >> : 212.122.114.249 550 Persistent Virus Source
> >> : 85.68.131.183   550 Persistent Virus Source
> >> : 69.11.213.106   550 Persistent Virus Source
> >> : 66.201.40.102   550 Persistent Virus Source
> >> : 85.2.209.213    550 Persistent Virus Source
> >> : 83.112.32.94    550 Persistent Virus Source
> >> : 200.62.150.49   550 We do not accept junk mail
> >> : 89.24.82.141    550 We do not accept junk mail
> >> : 
> >> : 
> >> : All that has changed recently is
> >> : 
> >> : clamd from 0.88.7 to 0.90.2
> >> : spamd from 3.1.X to 3.2.0
> >> : 
> >> : and
> >> : 
> >> : MailScanner 4.58.9 to 4.59.4-2 just this weekend.
> >> : 
> >> : 
> >> : I would like to turn off the 550 We do not accept junk mail
> >> : feature as I would term it to be buggy, however the
> >> : Presistent Virus Source can stay for now; get rid of the fraud/Virus
> >> : mail thank you.
> >> : 
> >> :: 
> >> :: --
> >> :: Martin Hepworth
> >> :: Snr Systems Administrator
> >> :: Solid State Logic
> >> :: Tel: +44 (0)1865 842300
> >> :: 
> >> ::: -----Original Message-----
> >> ::: From: mailscanner-bounces@lists.mailscanner.info
> >> ::: [mailto:mailscanner- bounces@lists.mailscanner.info] On Behalf Of
> >> ::: Dave Shariff Yadallee - System Administrator a.k.a. The Root of the
> >> ::: Problem 
> >> ::: Sent: 08 May 2007 16:00
> >> ::: To: mailscanner@lists.mailscanner.info
> >> ::: Subject: [root@doctor.nl2k.ab.ca: New 550s getting automagically
> >> ::: placed into access file] 
> >> ::: 
> >> ::: I have to resend this as I found in my logs the mailscanner.info
> >> ::: mailserver got listed as below.
> >> ::: 
> >> ::: ----- Forwarded message from "Dave Shariff Yadallee -  System
> >> ::: Administrator a.k.a. The Root of the Problem"
> >> ::: <root@doctor.nl2k.ab.ca> --- -- 
> >> ::: 
> >> ::: Date: Tue, 8 May 2007 07:44:36 -0600
> >> ::: From: "Dave Shariff Yadallee -  System Administrator a.k.a. The
> >> ::: Root of the Problem" <root@doctor.nl2k.ab.ca>
> >> ::: To: mailscanner@lists.mailscanner.info
> >> ::: Subject: New 550s getting automagically placed into access file
> >> ::: User-Agent: Mutt/1.5.12-2006-07-14
> >> ::: 
> >> ::: I know there are 3 new packages out for MailScanner, spamd and clamd
> >> ::: however I cannot determine with is adding to the /etc/mail/access
> >> ::: file 550 We do not accept junk mail .
> >> ::: 
> >> ::: I need to turn of this feature as it block transmission from
> >> ::: secondary to primary. 
> >> ::: 
> >> ::: Also I am running Botnet 0.7 .
> >> ::: 
> >> ::: ----- End forwarded message -----
> >>
> >> Are you running Vispan?
> >>
> > 
> > Yes Vispan 3.0
> >  
> That is what is adding those entries.
> 
> -- 
> 
> MailScanner is like deodorant...
> You hope everybody uses it, and
> you notice quickly if they don't!!!!
>

And tweaked accordingly. 

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

From root at doctor.nl2k.ab.ca  Tue May  8 23:14:22 2007
From: root at doctor.nl2k.ab.ca (Dave Shariff Yadallee - System Administrator a.k.a. The Root of the
	Problem)
Date: Tue May  8 23:51:51 2007
Subject: [root@doctor.nl2k.ab.ca: New 550s getting automagically
	placedinto access file]
In-Reply-To: <f1qll7$5c0$4@sea.gmane.org>
References: <20070508154810.GA7356@doctor.nl2k.ab.ca>
	<6DEF8ABC1767C045B91F42066D36358E3AF7@HOUPEX01.nfsmith.info>
	<20070508183652.GA26936@doctor.nl2k.ab.ca>
	<f1qll7$5c0$4@sea.gmane.org>
Message-ID: <20070508221422.GC14816@doctor.nl2k.ab.ca>

On Tue, May 08, 2007 at 01:13:28PM -0700, Scott Silva wrote:
> Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem
> spake the following on 5/8/2007 11:36 AM:
> > On Tue, May 08, 2007 at 11:06:46AM -0500, Mike Kercher wrote:
> >> Dave Shariff Yadallee - System Administrator a.k.a. The Root of
> >> theProblem <> wrote on Tuesday, May 08, 2007 10:48 AM:
> >>
> >> : On Tue, May 08, 2007 at 04:27:29PM +0100, Martin.Hepworth wrote:
> >> :: Dave
> >> :: 
> >> :: There's a CustomFunction called IPBlock that will update this list
> >> :: based on number of messages received from an ip-address.....
> >> :: 
> >> :: Normally it's attached to "Always Looked Up Last" in the following
> >> :: manner inside MailScanner.conf..
> >> :: 
> >> :: Always Looked Up Last = &IPBlock
> >> :: 
> >> : 
> >>
> >> : 
> >> : 
> >> : 
> >> : As I said this is set to no;
> >> : however, when I did a tail on /etc/mail/acess I got:
> >> : 
> >> : 
> >> : 66.220.2.220    550 Persistent Virus Source
> >> : 212.122.114.249 550 Persistent Virus Source
> >> : 85.68.131.183   550 Persistent Virus Source
> >> : 69.11.213.106   550 Persistent Virus Source
> >> : 66.201.40.102   550 Persistent Virus Source
> >> : 85.2.209.213    550 Persistent Virus Source
> >> : 83.112.32.94    550 Persistent Virus Source
> >> : 200.62.150.49   550 We do not accept junk mail
> >> : 89.24.82.141    550 We do not accept junk mail
> >> : 
> >> : 
> >> : All that has changed recently is
> >> : 
> >> : clamd from 0.88.7 to 0.90.2
> >> : spamd from 3.1.X to 3.2.0
> >> : 
> >> : and
> >> : 
> >> : MailScanner 4.58.9 to 4.59.4-2 just this weekend.
> >> : 
> >> : 
> >> : I would like to turn off the 550 We do not accept junk mail
> >> : feature as I would term it to be buggy, however the
> >> : Presistent Virus Source can stay for now; get rid of the fraud/Virus
> >> : mail thank you.
> >> : 
> >> :: 
> >> :: --
> >> :: Martin Hepworth
> >> :: Snr Systems Administrator
> >> :: Solid State Logic
> >> :: Tel: +44 (0)1865 842300
> >> :: 
> >> ::: -----Original Message-----
> >> ::: From: mailscanner-bounces@lists.mailscanner.info
> >> ::: [mailto:mailscanner- bounces@lists.mailscanner.info] On Behalf Of
> >> ::: Dave Shariff Yadallee - System Administrator a.k.a. The Root of the
> >> ::: Problem 
> >> ::: Sent: 08 May 2007 16:00
> >> ::: To: mailscanner@lists.mailscanner.info
> >> ::: Subject: [root@doctor.nl2k.ab.ca: New 550s getting automagically
> >> ::: placed into access file] 
> >> ::: 
> >> ::: I have to resend this as I found in my logs the mailscanner.info
> >> ::: mailserver got listed as below.
> >> ::: 
> >> ::: ----- Forwarded message from "Dave Shariff Yadallee -  System
> >> ::: Administrator a.k.a. The Root of the Problem"
> >> ::: <root@doctor.nl2k.ab.ca> --- -- 
> >> ::: 
> >> ::: Date: Tue, 8 May 2007 07:44:36 -0600
> >> ::: From: "Dave Shariff Yadallee -  System Administrator a.k.a. The
> >> ::: Root of the Problem" <root@doctor.nl2k.ab.ca>
> >> ::: To: mailscanner@lists.mailscanner.info
> >> ::: Subject: New 550s getting automagically placed into access file
> >> ::: User-Agent: Mutt/1.5.12-2006-07-14
> >> ::: 
> >> ::: I know there are 3 new packages out for MailScanner, spamd and clamd
> >> ::: however I cannot determine with is adding to the /etc/mail/access
> >> ::: file 550 We do not accept junk mail .
> >> ::: 
> >> ::: I need to turn of this feature as it block transmission from
> >> ::: secondary to primary. 
> >> ::: 
> >> ::: Also I am running Botnet 0.7 .
> >> ::: 
> >> ::: ----- End forwarded message -----
> >>
> >> Are you running Vispan?
> >>
> > 
> > Yes Vispan 3.0
> >  
> Sorry, hit send too fast. You need to fix the whitelisting in the vispan.conf
> file if you want to spare your secondaries. And make sure your secondaries are
> in the spamassassin trusted networks to help with the scoring.
> 
> -- 
> 
> MailScanner is like deodorant...
> You hope everybody uses it, and
> you notice quickly if they don't!!!!
>

Not to worry, thanks to everyone here,
it is done.
 
> -- 
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website! 
> 
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> 

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

From ssilva at sgvwater.com  Wed May  9 00:17:19 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Wed May  9 00:17:38 2007
Subject: SMPID vs. INPID
In-Reply-To: <000001c791bd$84f120b0$7100000a@AldenLap>
References: <000001c791bd$84f120b0$7100000a@AldenLap>
Message-ID: <f1r0dv$bse$1@sea.gmane.org>

Alden Levy spake the following on 5/8/2007 3:09 PM:
> Scott Silva ssilva wrote on Tue May 8 21:08:43 IST 2007
>> Alden Levy spake the following on 5/8/2007 12:16 PM:
>>> Hugo van der Kooij wrote on Tue May 8 20:09:32 IST 2007
>>>> On Tue, 8 May 2007, Alden Levy wrote:
>>>>
>>>>> Thanks for this.  Now, I'm really confused; the RedHat init script is
>>>>> identical to the one I'm using.
>>>>>
>>>>> Does anyone have an idea of where else I should look? (Quick recap:
>>>>> /var/run/sendmail.in.pid is not getting updated, so
>>> /etc/init.d/MailScanner
>>>>> status lists incoming sendmail as failed.  sm-client.pid looks fine,
>>>>> though.)
>>>> If you stop MailScanner the PID file should be gone. If not then you 
>>>> should remove it by hand and see if it happens to get recreated at 
>>>> startup.
>>>>
>>>> Hugo.
>>>>
>>>> -- 
>>>> 	hvdkooij at vanderkooij.org	http://hugo.vanderkooij.org/
>>>> 	    This message is using 100% recycled electrons. 
>>> Well, that was a mistake!  Now after removing the file by hand, and
>>> restarting, I run status and get:
>>> Checking MailScanner daemons:
>>>          MailScanner:                                      [  OK  ]
>>>          incoming sendmail: head: cannot open `/var/run/sendmail.in.pid'
> for
>>> reading: No such file or directory
>>>                                                            [FAILED]
>>>          outgoing sendmail:                                [  OK  ]
>>>
>>>
>>> Any other thoughts?
>>>  Thanks,
>>> Alden
>>>
>> Your init script could be either damaged, or an old version. 
> 
> But I did a diff on my init script and the RedHat script you sent earlier
> today, and there is no difference.  Can it still be corrupted?
> 
> I was wondering if I should look elsewhere, or just try to reinstall.
> 
> Thanks,
> Alden
> 
You do have sendmail disabled, don't you?


-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From alden at engineno9inc.com  Wed May  9 03:39:42 2007
From: alden at engineno9inc.com (Alden Levy)
Date: Wed May  9 03:39:58 2007
Subject: SMPID vs. INPID
Message-ID: <001b01c791e3$4c9d7620$7100000a@AldenLap>

>Scott Silva ssilva wrote on Wed May 9 00:17:19 IST 2007
>>Scott Silva ssilva wrote on Tue May 8 21:08:43 IST 2007
>>>Alden Levy spake the following on 5/8/2007 12:16 PM:
>>>> Hugo van der Kooij wrote on Tue May 8 20:09:32 IST 2007
>>>>> On Tue, 8 May 2007, Alden Levy wrote:
>>>>>
>>>>>> Thanks for this.  Now, I'm really confused; the RedHat init script is
>>>>>> identical to the one I'm using.
>>>>>>
>>>>>> Does anyone have an idea of where else I should look? (Quick recap:
>>>>>> /var/run/sendmail.in.pid is not getting updated, so
>>>>>> /etc/init.d/MailScanner
>>>>>> status lists incoming sendmail as failed.  sm-client.pid looks fine,
>>>>>> though.)
>>>>> If you stop MailScanner the PID file should be gone. If not then you 
>>>>> should remove it by hand and see if it happens to get recreated at 
>>>>> startup.
>>>>>
>>>>> Hugo.
>>>>>
>>>>> -- 
>>>>> 	hvdkooij at vanderkooij.org	http://hugo.vanderkooij.org/
>>>>> 	    This message is using 100% recycled electrons. 
>>>> 
>>>> Well, that was a mistake!  Now after removing the file by hand, and
>>>> restarting, I run status and get:
>>>> Checking MailScanner daemons:
>>>>          MailScanner:                                      [  OK  ]
>>>>          incoming sendmail: head: cannot open
`/var/run/sendmail.in.pid' for
>>>> reading: No such file or directory
>>>>                                                            [FAILED]
>>>>          outgoing sendmail:                                [  OK  ]
>>>> 
>>>> 
>>>> Any other thoughts?
>>>>  Thanks,
>>>> Alden
>>>> 
>>>Your init script could be either damaged, or an old version. 
>>
>>But I did a diff on my init script and the RedHat script you sent earlier 
>>today, and there is no difference.  Can it still be corrupted?
>>
>>I was wondering if I should look elsewhere, or just try to reinstall.
>>
>>Thanks,
>>Alden
>>
>You do have sendmail disabled, don't you?

Yep.  But I'm going to double check, anyway.  I've done "chkconfig sendmail
off" a few times, but I'll try again.

However, when I start sendmail, I have 3 instances running:
# ps aux|grep sendmail
root     23940  0.0  0.0  9092 1888 ?        Ss   22:36   0:00 sendmail:
accepting connections

smmsp    23944  0.0  0.0  6940 1656 ?        Ss   22:36   0:00 sendmail:
Queue runner@00:15:00 for /var/spool/clientmqueue
root     23949  0.0  0.0  8296 1780 ?        Ss   22:36   0:00 sendmail:
Queue runner@00:15:00 for
/home/virtual/FILESYSTEMTEMPLATE/services/sendmail/mqueue

The first one doesn't stop when I service MailScanner stop, and I have to
issue a service sendmail stop in order to kill it.

Curiouser and curiouser... Is this good/bad/indifferent?  I've been seeing
this for a while, as this was what I had on my old server, but I don't
remember what was running when it was working properly.


From ssilva at sgvwater.com  Wed May  9 04:40:53 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Wed May  9 04:41:06 2007
Subject: SMPID vs. INPID
In-Reply-To: <001b01c791e3$4c9d7620$7100000a@AldenLap>
References: <001b01c791e3$4c9d7620$7100000a@AldenLap>
Message-ID: <f1rfs5$gam$1@sea.gmane.org>

Alden Levy spake the following on 5/8/2007 7:39 PM:
>> Scott Silva ssilva wrote on Wed May 9 00:17:19 IST 2007
>>> Scott Silva ssilva wrote on Tue May 8 21:08:43 IST 2007
>>>> Alden Levy spake the following on 5/8/2007 12:16 PM:
>>>>> Hugo van der Kooij wrote on Tue May 8 20:09:32 IST 2007
>>>>>> On Tue, 8 May 2007, Alden Levy wrote:
>>>>>>
>>>>>>> Thanks for this.  Now, I'm really confused; the RedHat init script is
>>>>>>> identical to the one I'm using.
>>>>>>>
>>>>>>> Does anyone have an idea of where else I should look? (Quick recap:
>>>>>>> /var/run/sendmail.in.pid is not getting updated, so
>>>>>>> /etc/init.d/MailScanner
>>>>>>> status lists incoming sendmail as failed.  sm-client.pid looks fine,
>>>>>>> though.)
>>>>>> If you stop MailScanner the PID file should be gone. If not then you 
>>>>>> should remove it by hand and see if it happens to get recreated at 
>>>>>> startup.
>>>>>>
>>>>>> Hugo.
>>>>>>
>>>>>> -- 
>>>>>> 	hvdkooij at vanderkooij.org	http://hugo.vanderkooij.org/
>>>>>> 	    This message is using 100% recycled electrons. 
>>>>> Well, that was a mistake!  Now after removing the file by hand, and
>>>>> restarting, I run status and get:
>>>>> Checking MailScanner daemons:
>>>>>          MailScanner:                                      [  OK  ]
>>>>>          incoming sendmail: head: cannot open
> `/var/run/sendmail.in.pid' for
>>>>> reading: No such file or directory
>>>>>                                                            [FAILED]
>>>>>          outgoing sendmail:                                [  OK  ]
>>>>>
>>>>>
>>>>> Any other thoughts?
>>>>>  Thanks,
>>>>> Alden
>>>>>
>>>> Your init script could be either damaged, or an old version. 
>>> But I did a diff on my init script and the RedHat script you sent earlier 
>>> today, and there is no difference.  Can it still be corrupted?
>>>
>>> I was wondering if I should look elsewhere, or just try to reinstall.
>>>
>>> Thanks,
>>> Alden
>>>
>> You do have sendmail disabled, don't you?
> 
> Yep.  But I'm going to double check, anyway.  I've done "chkconfig sendmail
> off" a few times, but I'll try again.
> 
> However, when I start sendmail, I have 3 instances running:
> # ps aux|grep sendmail
> root     23940  0.0  0.0  9092 1888 ?        Ss   22:36   0:00 sendmail:
> accepting connections
> 
> smmsp    23944  0.0  0.0  6940 1656 ?        Ss   22:36   0:00 sendmail:
> Queue runner@00:15:00 for /var/spool/clientmqueue
> root     23949  0.0  0.0  8296 1780 ?        Ss   22:36   0:00 sendmail:
> Queue runner@00:15:00 for
> /home/virtual/FILESYSTEMTEMPLATE/services/sendmail/mqueue
> 
> The first one doesn't stop when I service MailScanner stop, and I have to
> issue a service sendmail stop in order to kill it.
> 
> Curiouser and curiouser... Is this good/bad/indifferent?  I've been seeing
> this for a while, as this was what I had on my old server, but I don't
> remember what was running when it was working properly.
> 
> 
Look in /etc/sysconfig for a MailScanner.rpmnew. Maybe you have an old version
in there.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From cplists at princeservices.com  Wed May  9 04:44:48 2007
From: cplists at princeservices.com (Cameron B. Prince)
Date: Wed May  9 04:44:54 2007
Subject: MailScanner w/ Qmail / Plesk
Message-ID: <C266ADE0.DF1E%cplists@princeservices.com>

Hey guys,

I have a new dedicated server with Plesk. I originally purchased the
SpamAssassin and Dr. Web anti-virus plugins but they just don't compare to
MailScanner w/ MailWatch.

I followed the instructions to setup MailScanner with Qmail here:

http://qms.ausics.net/

I verified all the perl modules and checked the updates to the
MailScanner.conf file. When I started MailScanner the init script complained
that the MTA was invalid. I started Qmail manually and sent a test message.
When the message hit the SMTP I got a queue error returned to the client.

I ran this command and the queue errors went away:

chmod u+s /var/qmail/bin/qmail-queue

Now a test message produces this in the log:

relaylock: /var/qmail/bin/relaylock: mail from xxx.xxx.xxx.xxx:61451
(my.domain.com)
MailScanner[6489]: New Batch: Scanning 1 messages, 668 bytes
MailScanner[6489]: SpamAssassin cache hit for message 7064403
MailScanner[6489]: Virus and Content Scanning: Starting
MailScanner[6489]: Uninfected: Delivered 1 messages
MailScanner[6489]: Logging message 7064403 to SQL
MailScanner[6451]: 7064403: Logged to MailWatch SQL

When I checked the other mailbox for the message I found that it was never
received. I enabled debugging and got this output when I tried another test
message:

/usr/sbin/MailScanner
In Debugging mode, not forking...
Ignore errors about failing to find EOCD signature
format error: file is too short
 at /usr/sbin/MailScanner line 832
Stopping now as you are debugging me.
commit ineffective with AutoCommit enabled at
/usr/lib/MailScanner/MailScanner/CustomFunctions/MailWatch.pm line 93,
<CLIENT> line 34.
Commmit ineffective while AutoCommit is on at
/usr/lib/MailScanner/MailScanner/CustomFunctions/MailWatch.pm line 93,
<CLIENT> line 34. 



I know this patch for Qmail is pretty old and I wonder if this is the cause
or if it's more likely to be a problem with the Plesk version of Qmail. Can
anyone give me some ideas to troubleshoot this?


Thanks,
Cameron



PS Here's the output of a lint test:

/usr/sbin/MailScanner --lint
Read 764 hostnames from the phishing whitelist
Config: calling custom init function SQLBlacklist
Config: calling custom init function MailWatchLogging
Config: calling custom init function SQLWhitelist
Checking version numbers...
Version number in MailScanner.conf (4.58.9) is correct.
MailScanner setting GID to  (2520)
MailScanner setting UID to  (2520)

Checking for SpamAssassin errors (if you use it)...
Using SpamAssassin results cache
Connected to SpamAssassin cache database
SpamAssassin reported no errors.
lock.pl sees Config  LockType =  flock
lock.pl sees have_module =  0
Using locktype = flock
MailScanner.conf says "Virus Scanners = f-prot"
Found these virus scanners installed: f-prot





From prandal at herefordshire.gov.uk  Wed May  9 06:04:40 2007
From: prandal at herefordshire.gov.uk (Randal, Phil)
Date: Wed May  9 06:04:49 2007
Subject: SA 3.2.0 Woes
In-Reply-To: <20070507125947.05ede1ea@uxbod.splatnix.net>
References: <20070507125947.05ede1ea@uxbod.splatnix.net>
Message-ID: <7EF0EE5CB3B263488C8C18823239BEBA03CED1@HC-MBX02.herefordshire.gov.uk>

I found that the the speed halved with SA 3.2.0 on a Fedora Core 1 test
box.

I was getting lots of dnsrbl timeouts which I didn't get with SA 3.1.8.

What's your rbl_timeout set to?  Does increasing that value make a
difference?

Cheers,

Phil

-----Original Message-----
From: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of --[
UxBoD ]--
Sent: 07 May 2007 13:00
To: MailScanner discussion
Subject: SA 3.2.0 Woes

Hi,

Not sure whether this is a issue or not, but since upgrading SA and
MailScanner I never seem to get any hits via RBLs. I am using MailWatch
and that just says "SpamAssassin Listed in RBL". Bayes never seems to
trigger aswell now.

Have others experienced anything like this ?

TIA

-- 
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
// Phone: +44 845 869 2749
// SIP Phone: uxbod@sip.splatnix.net

-- 
This message has been scanned for viruses and dangerous content by
MailScanner, and is
believed to be clean.

-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 
From hvdkooij at vanderkooij.org  Wed May  9 07:05:17 2007
From: hvdkooij at vanderkooij.org (Hugo van der Kooij)
Date: Wed May  9 07:05:47 2007
Subject: SMPID vs. INPID
In-Reply-To: <001b01c791e3$4c9d7620$7100000a@AldenLap>
References: <001b01c791e3$4c9d7620$7100000a@AldenLap>
Message-ID: <Pine.LNX.4.64.0705090803040.19555@faramir.hugo.vanderkooij.org>

On Tue, 8 May 2007, Alden Levy wrote:

>> Scott Silva ssilva wrote on Wed May 9 00:17:19 IST 2007

>> You do have sendmail disabled, don't you?
>
> Yep.  But I'm going to double check, anyway.  I've done "chkconfig sendmail
> off" a few times, but I'll try again.

That will NOT stop a running service. Just prevent it from starting again 
if you reboot the system.

You need to stop the service manualy as well with `service sendmail stop`.

Hugo.

-- 
 	hvdkooij@vanderkooij.org	http://hugo.vanderkooij.org/
 	    This message is using 100% recycled electrons.

 	Some men see computers as they are and say "Windows"
 	I use computers with Linux and say "Why Windows?"
 		(Thanks JFK, for the insight.)
From alex at nkpanama.com  Wed May  9 08:23:42 2007
From: alex at nkpanama.com (Alex Neuman van der Hans)
Date: Wed May  9 08:24:37 2007
Subject: Archive Mail Settings
Message-ID: <464176FE.60807@nkpanama.com>

According to mailscanner.conf,

# Any of the items above can contain the magic string _DATE_ in them
# which will be replaced with the current date in yyyymmdd format.
# This will make archive-rolling and maintenance much easier, as you can
# guarantee that yesterday's mail archive will not be in active use today.

Could it be possible to modify _DATE_ so that it only shows yyyymm 
instead? That way monthly archives would be a cinch.

I have *no* idea how to do this in perl (only thing I know about perl is 
how to "try to" install modules using CPAN), but I'm sure a kind soul 
here would know how to do a sed incantation that would make this possible.
From uxbod at splatnix.net  Wed May  9 09:16:27 2007
From: uxbod at splatnix.net (--[ UxBoD ]--)
Date: Wed May  9 09:16:31 2007
Subject: FuzzyOcr customisations
In-Reply-To: <IGEOKMEENEPEICNOFDGJMEDNCPAA.list-mailscanner@linguaphone.com>
References: <IGEOKMEENEPEICNOFDGJMEDNCPAA.list-mailscanner@linguaphone.com>
Message-ID: <1a4a684c8ab130c556e463c9cc909041@62.49.223.244>

Very clever indeed Sir. Thats really cool, got me thinking now ;)

On Tue, 8 May 2007 18:33:06 +0100, "Gareth" <list-mailscanner@linguaphone.com> wrote:
> Thought people might be interested in the forum at
> http://www.freespamfilter.org/forum/viewforum.php?f=25 where there are
> some
> good tips for customising FuzzyOcr.
> 
> Today I have also had a stab at creating an image utility which can be
> added
> to a scanset to hopefully improve its detection. Basically it works by
> producing a grayscale image which contains the differences between a pixel
> and the average colour over the whole image (rgb calculated separately)
> 
> You can see a couple of examples and download and have a play with it
> yourself on my webpage at
> http://www.gbnetwork.co.uk/mailscanner/gbpgmdiff/
> It is still very much a work in progress and I haven't even got round to
> putting it into one of my scansets yet.
> 
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
> 
> --
> This message has been scanned for viruses and dangerous content by
> MailScanner, and is
> believed to be clean.
-- 
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
// Phone: +44 (0) 845 869 2749  SIP: uxbod@sip.splatnix.net


-- 
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.

From amaclach at yahoo.co.uk  Wed May  9 09:46:15 2007
From: amaclach at yahoo.co.uk (Andrew MacLachlan)
Date: Wed May  9 09:46:16 2007
Subject: FuzzyOcr customisations
Message-ID: <209489.14074.qm@web26301.mail.ukl.yahoo.com>

I'd use it...

----- Original Message ----
From: --[ UxBoD ]-- <uxbod@splatnix.net>
To: MailScanner discussion <mailscanner@lists.mailscanner.info>
Sent: Wednesday, 9 May, 2007 9:16:27 AM
Subject: Re: FuzzyOcr customisations

Very clever indeed Sir. Thats really cool, got me thinking now ;)

On Tue, 8 May 2007 18:33:06 +0100, "Gareth" <list-mailscanner@linguaphone.com> wrote:
> Thought people might be interested in the forum at
> http://www.freespamfilter.org/forum/viewforum.php?f=25 where there are
> some
> good tips for customising FuzzyOcr.
> 
> Today I have also had a stab at creating an image utility which can be
> added
> to a scanset to hopefully improve its detection. Basically it works by
> producing a grayscale image which contains the differences between a pixel
> and the average colour over the whole image (rgb calculated separately)
> 
> You can see a couple of examples and download and have a play with it
> yourself on my webpage at
> http://www.gbnetwork.co.uk/mailscanner/gbpgmdiff/
> It is still very much a work in progress and I haven't even got round to
> putting it into one of my scansets yet.
> 
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
> 
> --
> This message has been scanned for viruses and dangerous content by
> MailScanner, and is
> believed to be clean.
-- 
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
// Phone: +44 (0) 845 869 2749  SIP: uxbod@sip.splatnix.net


-- 
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.

--
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!



From pedretti at eco.unibs.it  Wed May  9 09:55:22 2007
From: pedretti at eco.unibs.it (Fabio Pedretti)
Date: Wed May  9 09:53:45 2007
Subject: Clamav suggestions
In-Reply-To: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it>
References: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it>
Message-ID: <20070509105522.y9h0nbimg4kg0oks@luna.eco.unibs.it>

> 2) I noticed (as well as others:
> http://lists.mailscanner.info/pipermail/mailscanner/2007-April/072504.html
> ) that some phishing mail are not blocked (I am also using
> the signatures of sanesecurity). If I do a clamscan on the full
> original mail with headers, clamscan find the virus (I can provide a
> sample if needed). Seems the problem is that MailScanner extracts the
> content of the mail (body + attachment) and scans it, but some
> phishing mail are only detected if the full headers are present (in
> the clamav DB in the extended signature format, option 4 is for mail
> files, look at signatures.pdf in clamav source, and are detected only
> if full mail with headers is scanned).
> MailScanner should be modified so that all the original mail (with
> headers and without extracting attachment) should be passed to
> clamscan/clamd, so all virus can be catched.

To try the problem send a mail with the following text:
2.83:9999/webscrr/ind
on a MailScanner with clamav mail server.
The mail does not get filtered.

However if you do a clamscan on the received mail, you get:
test.eml: Email.Phishing.Pay-20 FOUND

From list-mailscanner at linguaphone.com  Wed May  9 10:49:45 2007
From: list-mailscanner at linguaphone.com (Gareth)
Date: Wed May  9 10:49:56 2007
Subject: FuzzyOcr customisations
In-Reply-To: <1a4a684c8ab130c556e463c9cc909041@62.49.223.244>
References: <IGEOKMEENEPEICNOFDGJMEDNCPAA.list-mailscanner@linguaphone.com>
	<1a4a684c8ab130c556e463c9cc909041@62.49.223.244>
Message-ID: <1178704185.905.19.camel@gblades-suse.linguaphone-intranet.co.uk>

I have version 0.2 available now and the wrapper script now takes the
threshold as a parameter. There is a 3rd example image included (and on
my website) which requires a slightly lower threshold in order to give
the best results.

Unforunetly even with the cleaned images ocrad and gocr still dont
appear to be able to recognise the images very well. I think the problem
with the first two is that the letters touch each other but I dont know
why the 3rd doesn't work. Perhaps its an issue with the font.


On Wed, 2007-05-09 at 09:16, --[ UxBoD ]-- wrote:
> Very clever indeed Sir. Thats really cool, got me thinking now ;)
> 
> On Tue, 8 May 2007 18:33:06 +0100, "Gareth" <list-mailscanner@linguaphone.com> wrote:
> > Thought people might be interested in the forum at
> > http://www.freespamfilter.org/forum/viewforum.php?f=25 where there are
> > some
> > good tips for customising FuzzyOcr.
> > 
> > Today I have also had a stab at creating an image utility which can be
> > added
> > to a scanset to hopefully improve its detection. Basically it works by
> > producing a grayscale image which contains the differences between a pixel
> > and the average colour over the whole image (rgb calculated separately)
> > 
> > You can see a couple of examples and download and have a play with it
> > yourself on my webpage at
> > http://www.gbnetwork.co.uk/mailscanner/gbpgmdiff/
> > It is still very much a work in progress and I haven't even got round to
> > putting it into one of my scansets yet.
> > 
> > --
> > MailScanner mailing list
> > mailscanner@lists.mailscanner.info
> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> > 
> > Before posting, read http://wiki.mailscanner.info/posting
> > 
> > Support MailScanner development - buy the book off the website!
> > 
> > --
> > This message has been scanned for viruses and dangerous content by
> > MailScanner, and is
> > believed to be clean.
> -- 
> --[ UxBoD ]--
> // PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
> // Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
> // Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
> // Phone: +44 (0) 845 869 2749  SIP: uxbod@sip.splatnix.net
> 
> 
> -- 
> This message has been scanned for viruses and dangerous content by MailScanner, and is
> believed to be clean.

From gmourani at prival.ca  Wed May  9 13:38:05 2007
From: gmourani at prival.ca (Gerhard Mourani)
Date: Wed May  9 13:38:29 2007
Subject: Issue with Blackberry
Message-ID: <3123E1B72B666243917E340F3C8FD4A10696E3@privaldc2003.prival.local>

Hello,

 

I'm using MailScanner + Postfix + SpamAssassin on Linux and having strange issues with email coming from blackberry servers, here how the received email look like:

 

Subject: Re: Hand Mixer Trial-Produce Report

 

\Ib?HTjy?Z.hm%yXxj?'p?'wJI+{E+.1I?U)?g?g*"(tjdj?6V??6 R w&FR FR&GbV v F2fVC 
________________________________

6wB 6VRB

 

&W&o??G2 W&vVB 6RVVFVBf"7[1] FW7Fp??F0?? 
________________________________

V&V6? &GV7B 
________________________________

vW" 
________________________________

6V6 
________________________________

2?F&V7B?S 
________________________________

SB 
________________________________

##r 
________________________________

s3r[1]??&v 
________________________________

W76vR?g&?[1]$FfBVr" 
________________________________

FfBVt VIFVw&W26?FFSGVR 
________________________________

________________________________

________________________________

# 
________________________________

________________________________

r 
________________________________

##?F&fW&F" 
________________________________

fW&FF?VIFVw&W26&W&2&W&" 
________________________________

W&2 &W&VIFVw&W26?63&FFv"" 
________________________________

FFv$VIFVw&W26%6Tr" 
________________________________

6Rt 6V626&V&V" 
________________________________

V&V6 6V626'6G&'W&F" 
________________________________

6G&'W&FVIFVw&W26&VWB" 
________________________________

VWBGW&W6vTVIFVw&W26&VFV" 
________________________________

VFV6 VVIFVw&W266TVIFVw&W26&V'F" 
________________________________

zV'FVIFVw&W26$FR" 
________________________________

zFRWG64VIFVw&W 26&FfBGW&" 
________________________________

FfBGW&VIFVw&W26%F" 
________________________________

FTVIFVw&W26'o R" 
________________________________

oTVIFVw&W26&66r" 
________________________________

?66tVIFVw&W26&'R" 
________________________________

'TVIFVw&W26$66R" 
________________________________

66VF v?v6%6&?R" 
________________________________

F?6$6" 
________________________________

?6Fv?v6&VfVr" 
________________________________

VfVtF?6?7V&V7C 
________________________________

B 
________________________________

?W"G& &GV6R&W'@??FV" 
________________________________

fW&FW&2V6R 6VRB?W" G&

 

&GV7" &W'B7V7F &W7VB2fVB&W7B &Vv&G2FfBVpVIFR 
________________________________

w&W[1] 
________________________________

2 
________________________________

6 
________________________________

ff6P&S 
________________________________

b3 
________________________________

________________________________

cs#cV?VIFW2?6 
________________________________

c26? 
________________________________

FVIFW2?6 
________________________________

c26R#FfBVtVIFVw&W26 
________________________________

FFfBVtVIFVw&W26vV'6FS wwrVIFVw&W26 
________________________________

?GG 
________________________________

wwrVIFVw&W26%F2Vf76?R6F26fFVFf&FFVFVBof" FR W6Rb FR W'6VB&fR 
________________________________

b R&RB FRFVFVB &V6VBb F2Vf76?R" FRVVR"vVB &W76&Rf"FVIfW&rB F FRFVFVB &V6VB R&RW&V'FfVB FBF76V?F"6 |*[1]b F2Vf76?\*[1]2 7G&7Fo

 

&&FVB 
________________________________

b RfR &V6VfVB F2Vf76?RW'&" V6R &WGW& F W2C 
________________________________

sR6RGR 
________________________________

g&W&R 
________________________________

G&R 
________________________________

G&VVV&V2*[1] 
________________________________

6F 
________________________________

4" 
________________________________

5,*[1]'fC 
________________________________

SB? 
________________________________

rS#s " F FR 6VFW"w2VFG&W72F6FVB&fR

 

Gerhard,


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070509/0200447e/attachment.html
From Olaf.Ohlenmacher at colt.net  Wed May  9 13:42:15 2007
From: Olaf.Ohlenmacher at colt.net (Ohlenmacher, Olaf)
Date: Wed May  9 13:42:18 2007
Subject: Attachment filename filter rules (sophisticated)
Message-ID: <08AD7B42A2698345BA90F9E33A46F2C401AC8394@ULPGCTMVMAI003.EU.COLT>


Hello,
we drop attachments by filenames extentions. Nowerdays attachment filenames are MIME-coded so that Umlauts and other special characters can be handled in a 7-Bit clean way.

My question:
Are the regular expressions applied to the decoded filenames or are they applied to the encoded filenames.

Background:
I have found binary-UTF-8 encoded attachment filenames in the wild which looks like 

  =?UTF-8?B?ZGFzIGlzdCBlaW4gw6TDtsO8w58gdGVzdGZpbGUgbWl0?=
  =?UTF-8?B?IHNvbmRlcnplaWNoZW4gMTIzNDU2Nzg5MC56aXA=?=

which is a file with the name "das ist ein ???? testfile mit sonderzeichen 1234567890.zip". 
These binary-coded MIME are not regular, so they can not be parsed from regular expressions.

Best regards,
  Olaf Ohlenmacher

-- 
COLT Telecom GmbH, Herriotstra?e 4, 60528 Frankfurt/Main, Deutschland
 * Tel +49 (0)69 56606 0 * Fax +49 (0)69 56606 2222
 * Gesch?ftsf?hrer: Detlef Spang (Vors.), Albertus Marinus Oosterom,
   Rita Thies
 * Amtsgericht Frankfurt/Main HRB 53898 * USt.-IdNr. DE 220 772 475


*************************************************************************************
The message is intended for the named addressee only and may not be disclosed to or used by anyone else, nor may it be copied in any way. 

The contents of this message and its attachments are confidential and may also be subject to legal privilege.  If you are not the named addressee and/or have received this message in error, please advise us by e-mailing security@colt.net and delete the message and any attachments without retaining any copies. 

Internet communications are not secure and COLT does not accept responsibility for this message, its contents nor responsibility for any viruses. 

No contracts can be created or varied on behalf of COLT Telecommunications, its subsidiaries or affiliates ("COLT") and any other party by email Communications unless expressly agreed in writing with such other party.  

Please note that incoming emails will be automatically scanned to eliminate potential viruses and unsolicited promotional emails. For more information refer to www.colt.net or contact us on +44(0)20 7390 3900.

From uxbod at splatnix.net  Wed May  9 14:07:47 2007
From: uxbod at splatnix.net (--[ UxBoD ]--)
Date: Wed May  9 14:08:00 2007
Subject: Issue with Blackberry
In-Reply-To: <3123E1B72B666243917E340F3C8FD4A10696E3@privaldc2003.prival.local>
References: <3123E1B72B666243917E340F3C8FD4A10696E3@privaldc2003.prival.local>
Message-ID: <4717144a9438363409909b0a056c183b@62.49.223.244>

Would be useful to see the actual headers, especially the MIME section.

On Wed, 9 May 2007 08:38:05 -0400, "Gerhard Mourani" <gmourani@prival.ca> wrote:
> Hello,
> 
>  
> 
> I'm using MailScanner + Postfix + SpamAssassin on Linux and having strange
> issues with email coming from blackberry servers, here how the received
> email look like:
> 
>  
> 
> Subject: Re: Hand Mixer Trial-Produce Report
> 
>  
> 
> \Ib?HTjy?Z.hm%yXxj?'p?'wJI+{E+.1I?U)?g?g*"(tjdj?6V??6 R w&FR FR&GbV
> v F2fVC 
> ________________________________
> 
> 6wB 6VRB
> 
>  
> 
> &W&o??G2 W&vVB 6RVVFVBf"7[1] FW7Fp??F0?? 
> ________________________________
> 
> V&V6? &GV7B 
> ________________________________
> 
> vW" 
> ________________________________
> 
> 6V6 
> ________________________________
> 
> 2?F&V7B?S 
> ________________________________
> 
> SB 
> ________________________________
> 
> ##r 
> ________________________________
> 
> s3r[1]??&v 
> ________________________________
> 
> W76vR?g&?[1]$FfBVr" 
> ________________________________
> 
> FfBVt VIFVw&W26?FFSGVR 
> ________________________________
> 
> ________________________________
> 
> ________________________________
> 
> # 
> ________________________________
> 
> ________________________________
> 
> r 
> ________________________________
> 
> ##?F&fW&F" 
> ________________________________
> 
> fW&FF?VIFVw&W26&W&2&W&" 
> ________________________________
> 
> W&2 &W&VIFVw&W26?63&FFv"" 
> ________________________________
> 
> FFv$VIFVw&W26%6Tr" 
> ________________________________
> 
> 6Rt 6V626&V&V" 
> ________________________________
> 
> V&V6 6V626'6G&'W&F" 
> ________________________________
> 
> 6G&'W&FVIFVw&W26&VWB" 
> ________________________________
> 
> VWBGW&W6vTVIFVw&W26&VFV" 
> ________________________________
> 
> VFV6 VVIFVw&W266TVIFVw&W26&V'F" 
> ________________________________
> 
> zV'FVIFVw&W26$FR" 
> ________________________________
> 
> zFRWG64VIFVw&W 26&FfBGW&" 
> ________________________________
> 
> FfBGW&VIFVw&W26%F" 
> ________________________________
> 
> FTVIFVw&W26'o R" 
> ________________________________
> 
> oTVIFVw&W26&66r" 
> ________________________________
> 
> ?66tVIFVw&W26&'R" 
> ________________________________
> 
> 'TVIFVw&W26$66R" 
> ________________________________
> 
> 66VF v?v6%6&?R" 
> ________________________________
> 
> F?6$6" 
> ________________________________
> 
> ?6Fv?v6&VfVr" 
> ________________________________
> 
> VfVtF?6?7V&V7C 
> ________________________________
> 
> B 
> ________________________________
> 
> ?W"G& &GV6R&W'@??FV" 
> ________________________________
> 
> fW&FW&2V6R 6VRB?W" G&
> 
>  
> 
> &GV7" &W'B7V7F &W7VB2fVB&W7B &Vv&G2FfBVpVIFR 
> ________________________________
> 
> w&W[1] 
> ________________________________
> 
> 2 
> ________________________________
> 
> 6 
> ________________________________
> 
> ff6P&S 
> ________________________________
> 
> b3 
> ________________________________
> 
> ________________________________
> 
> cs#cV?VIFW2?6 
> ________________________________
> 
> c26? 
> ________________________________
> 
> FVIFW2?6 
> ________________________________
> 
> c26R#FfBVtVIFVw&W26 
> ________________________________
> 
> FFfBVtVIFVw&W26vV'6FS wwrVIFVw&W26 
> ________________________________
> 
> ?GG 
> ________________________________
> 
> wwrVIFVw&W26%F2Vf76?R6F26fFVFf&FFVFVBof" FR W6Rb FR W'6VB&fR 
> ________________________________
> 
> b R&RB FRFVFVB &V6VBb F2Vf76?R" FRVVR"vVB &W76&Rf"FVIfW&rB
> F FRFVFVB &V6VB R&RW&V'FfVB FBF76V?F"6 |*[1]b F2Vf76?\*[1]2
> 7G&7Fo
> 
>  
> 
> &&FVB 
> ________________________________
> 
> b RfR &V6VfVB F2Vf76?RW'&" V6R &WGW& F W2C 
> ________________________________
> 
> sR6RGR 
> ________________________________
> 
> g&W&R 
> ________________________________
> 
> G&R 
> ________________________________
> 
> G&VVV&V2*[1] 
> ________________________________
> 
> 6F 
> ________________________________
> 
> 4" 
> ________________________________
> 
> 5,*[1]'fC 
> ________________________________
> 
> SB? 
> ________________________________
> 
> rS#s " F FR 6VFW"w2VFG&W72F6FVB&fR
> 
>  
> 
> Gerhard,
> 
> 
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> 
> 
>
-- 
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
// Phone: +44 (0) 845 869 2749  SIP: uxbod@sip.splatnix.net


-- 
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.

From gmourani at prival.ca  Wed May  9 14:26:31 2007
From: gmourani at prival.ca (Gerhard Mourani)
Date: Wed May  9 14:27:00 2007
Subject: Issue with Blackberry
In-Reply-To: <4717144a9438363409909b0a056c183b@62.49.223.244>
Message-ID: <3123E1B72B666243917E340F3C8FD4A10696E7@privaldc2003.prival.local>

Here what users sent to me. Also this is what I've in the -> /etc/postfix/header_checks file
/^Received: (.*?) by eliteclassics.com(.*?)/ REJECT
/^Received:/ HOLD

Now the headers:
A problem was found in an Email message you sent.
This Email scanner intercepted it and stopped the entire message
reaching its destination.

The problem was reported to be:

Disallowed breakage found in header name - potential virus


Please contact your IT support personnel with any queries regarding this
policy.


Your message was sent with the following envelope:

MAIL FROM: carla.redman@elitegroupinc.ca
RCPT TO:   joshua.levin@myexchangehosting.net

... and with the following headers:

---
MAILFROM: carla.redman@elitegroupinc.ca
Delivered-To: jwlevinp-joshua.levin@jwlevinpartners.com
Received: (qmail 55802 invoked from network); 4 May 2007 18:37:42 -0000
Received: from unknown (HELO mail.eliteclassics.com) (149.99.191.243)
  by host355.ipowerweb.com with SMTP; 4 May 2007 18:37:42 -0000
Received: from EXECDanny (office.eliteclassics.com [149.99.191.242])
	by mail.eliteclassics.com (Postfix) with ESMTP id CEC964DEC
	for <joshua.levin@jwlevinpartners.com>; Fri,  4 May 2007 14:40:18
-0400 (EDT)
Return-Receipt-To: "Carla Redman" <carla.redman@elitegroupinc.ca>
Reply-To: <carla.redman@elitegroupinc.ca>
From: "Carla Redman" <carla.redman@elitegroupinc.ca>
To: "'Levin, Joshua'" <joshua.levin@jwlevinpartners.com>
References:
<!&!AAAAAAAAAAAYAAAAAAAAAA//HCPUPWlOnwoLNnkLF1/CgAAAEAAAAIJKY+ZCvJhCqwOpsTBc
Ps0BAAAAAA==@elitegroupinc.ca>
<435DF58A933BA74397B42CDEB8145A860B8C4AE3@ex9.hostedexchange.local>
Subject: RE: feb 07  flights  .xls
Date: Fri, 4 May 2007 14:45:04 -0400
Organization: Elite Group
Message-ID:
<!&!AAAAAAAAAAAYAAAAAAAAAA//HCPUPWlOnwoLNnkLF1/CgAAAEAAAADnS5OzqJ1hKjJ6btvlw
nvYBAAAAAA==@elitegroupinc.ca>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_0003_01C78E5A.CD761FE0"
X-Mailer: Microsoft Office Outlook 11
Thread-Index:
AceCyu12JEluHxWIQ7ClFI22mBkHtgAghwiAAA0iz+AAAC8ZAAK8H9XgAAIRniA=
In-Reply-To:
<435DF58A933BA74397B42CDEB8145A860B8C4AE3@ex9.hostedexchange.local>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028
Disposition-Notification-To: "Carla Redman" <carla.redman@elitegroupinc.ca>
X-Elite Group, Inc.-MailScanner: Found to be clean
X-Elite Group, Inc.-MailScanner-From: carla.redman@elitegroupinc.ca
X-Spam-Status: No

Thanks,

-----Original Message-----
From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of --[ UxBoD ]--
Sent: Wednesday, May 09, 2007 9:08 AM
To: MailScanner discussion
Subject: Re: Issue with Blackberry

Would be useful to see the actual headers, especially the MIME section.

On Wed, 9 May 2007 08:38:05 -0400, "Gerhard Mourani" <gmourani@prival.ca> wrote:
> Hello,
> 
>  
> 
> I'm using MailScanner + Postfix + SpamAssassin on Linux and having strange
> issues with email coming from blackberry servers, here how the received
> email look like:
> 
>  
> 
> Subject: Re: Hand Mixer Trial-Produce Report
> 
>  
> 
> \Ib?HTjy?Z.hm%yXxj?'p?'wJI+{E+.1I?U)?g?g*"(tjdj?6V??6 R w&FR FR&GbV
> v F2fVC 
> ________________________________
> 
> 6wB 6VRB
> 
>  
> 
> &W&o??G2 W&vVB 6RVVFVBf"7[1] FW7Fp??F0?? 
> ________________________________
> 
> V&V6? &GV7B 
> ________________________________
> 
> vW" 
> ________________________________
> 
> 6V6 
> ________________________________
> 
> 2?F&V7B?S 
> ________________________________
> 
> SB 
> ________________________________
> 
> ##r 
> ________________________________
> 
> s3r[1]??&v 
> ________________________________
> 
> W76vR?g&?[1]$FfBVr" 
> ________________________________
> 
> FfBVt VIFVw&W26?FFSGVR 
> ________________________________
> 
> ________________________________
> 
> ________________________________
> 
> # 
> ________________________________
> 
> ________________________________
> 
> r 
> ________________________________
> 
> ##?F&fW&F" 
> ________________________________
> 
> fW&FF?VIFVw&W26&W&2&W&" 
> ________________________________
> 
> W&2 &W&VIFVw&W26?63&FFv"" 
> ________________________________
> 
> FFv$VIFVw&W26%6Tr" 
> ________________________________
> 
> 6Rt 6V626&V&V" 
> ________________________________
> 
> V&V6 6V626'6G&'W&F" 
> ________________________________
> 
> 6G&'W&FVIFVw&W26&VWB" 
> ________________________________
> 
> VWBGW&W6vTVIFVw&W26&VFV" 
> ________________________________
> 
> VFV6 VVIFVw&W266TVIFVw&W26&V'F" 
> ________________________________
> 
> zV'FVIFVw&W26$FR" 
> ________________________________
> 
> zFRWG64VIFVw&W 26&FfBGW&" 
> ________________________________
> 
> FfBGW&VIFVw&W26%F" 
> ________________________________
> 
> FTVIFVw&W26'o R" 
> ________________________________
> 
> oTVIFVw&W26&66r" 
> ________________________________
> 
> ?66tVIFVw&W26&'R" 
> ________________________________
> 
> 'TVIFVw&W26$66R" 
> ________________________________
> 
> 66VF v?v6%6&?R" 
> ________________________________
> 
> F?6$6" 
> ________________________________
> 
> ?6Fv?v6&VfVr" 
> ________________________________
> 
> VfVtF?6?7V&V7C 
> ________________________________
> 
> B 
> ________________________________
> 
> ?W"G& &GV6R&W'@??FV" 
> ________________________________
> 
> fW&FW&2V6R 6VRB?W" G&
> 
>  
> 
> &GV7" &W'B7V7F &W7VB2fVB&W7B &Vv&G2FfBVpVIFR 
> ________________________________
> 
> w&W[1] 
> ________________________________
> 
> 2 
> ________________________________
> 
> 6 
> ________________________________
> 
> ff6P&S 
> ________________________________
> 
> b3 
> ________________________________
> 
> ________________________________
> 
> cs#cV?VIFW2?6 
> ________________________________
> 
> c26? 
> ________________________________
> 
> FVIFW2?6 
> ________________________________
> 
> c26R#FfBVtVIFVw&W26 
> ________________________________
> 
> FFfBVtVIFVw&W26vV'6FS wwrVIFVw&W26 
> ________________________________
> 
> ?GG 
> ________________________________
> 
> wwrVIFVw&W26%F2Vf76?R6F26fFVFf&FFVFVBof" FR W6Rb FR W'6VB&fR 
> ________________________________
> 
> b R&RB FRFVFVB &V6VBb F2Vf76?R" FRVVR"vVB &W76&Rf"FVIfW&rB
> F FRFVFVB &V6VB R&RW&V'FfVB FBF76V?F"6 |*[1]b F2Vf76?\*[1]2
> 7G&7Fo
> 
>  
> 
> &&FVB 
> ________________________________
> 
> b RfR &V6VfVB F2Vf76?RW'&" V6R &WGW& F W2C 
> ________________________________
> 
> sR6RGR 
> ________________________________
> 
> g&W&R 
> ________________________________
> 
> G&R 
> ________________________________
> 
> G&VVV&V2*[1] 
> ________________________________
> 
> 6F 
> ________________________________
> 
> 4" 
> ________________________________
> 
> 5,*[1]'fC 
> ________________________________
> 
> SB? 
> ________________________________
> 
> rS#s " F FR 6VFW"w2VFG&W72F6FVB&fR
> 
>  
> 
> Gerhard,
> 
> 
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> 
> 
>
-- 
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
// Phone: +44 (0) 845 869 2749  SIP: uxbod@sip.splatnix.net


-- 
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.

--
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

From uxbod at splatnix.net  Wed May  9 15:02:12 2007
From: uxbod at splatnix.net (--[ UxBoD ]--)
Date: Wed May  9 15:02:22 2007
Subject: Issue with Blackberry
In-Reply-To: <3123E1B72B666243917E340F3C8FD4A10696E7@privaldc2003.prival.local>
References: <3123E1B72B666243917E340F3C8FD4A10696E7@privaldc2003.prival.local>
Message-ID: <2e62294734b80b9df1c58b9ec14d633c@62.49.223.244>

The headers do not look right to me, and I reckon that funny content you are seeing is the .xls attachment.  I know you say that it has been sent via a Blackberry but the headers are for Outlook V11 ?

On Wed, 9 May 2007 09:26:31 -0400, "Gerhard Mourani" <gmourani@prival.ca> wrote:
> Here what users sent to me. Also this is what I've in the ->
> /etc/postfix/header_checks file
> /^Received: (.*?) by eliteclassics.com(.*?)/ REJECT
> /^Received:/ HOLD
> 
> Now the headers:
> A problem was found in an Email message you sent.
> This Email scanner intercepted it and stopped the entire message
> reaching its destination.
> 
> The problem was reported to be:
> 
> Disallowed breakage found in header name - potential virus
> 
> 
> Please contact your IT support personnel with any queries regarding this
> policy.
> 
> 
> Your message was sent with the following envelope:
> 
> MAIL FROM: carla.redman@elitegroupinc.ca
> RCPT TO:   joshua.levin@myexchangehosting.net
> 
> ... and with the following headers:
> 
> ---
> MAILFROM: carla.redman@elitegroupinc.ca
> Delivered-To: jwlevinp-joshua.levin@jwlevinpartners.com
> Received: (qmail 55802 invoked from network); 4 May 2007 18:37:42 -0000
> Received: from unknown (HELO mail.eliteclassics.com) (149.99.191.243)
>   by host355.ipowerweb.com with SMTP; 4 May 2007 18:37:42 -0000
> Received: from EXECDanny (office.eliteclassics.com [149.99.191.242])
> 	by mail.eliteclassics.com (Postfix) with ESMTP id CEC964DEC
> 	for <joshua.levin@jwlevinpartners.com>; Fri,  4 May 2007 14:40:18
> -0400 (EDT)
> Return-Receipt-To: "Carla Redman" <carla.redman@elitegroupinc.ca>
> Reply-To: <carla.redman@elitegroupinc.ca>
> From: "Carla Redman" <carla.redman@elitegroupinc.ca>
> To: "'Levin, Joshua'" <joshua.levin@jwlevinpartners.com>
> References:
> <!&!AAAAAAAAAAAYAAAAAAAAAA//HCPUPWlOnwoLNnkLF1/CgAAAEAAAAIJKY+ZCvJhCqwOpsTBc
> Ps0BAAAAAA==@elitegroupinc.ca>
> <435DF58A933BA74397B42CDEB8145A860B8C4AE3@ex9.hostedexchange.local>
> Subject: RE: feb 07  flights  .xls
> Date: Fri, 4 May 2007 14:45:04 -0400
> Organization: Elite Group
> Message-ID:
> <!&!AAAAAAAAAAAYAAAAAAAAAA//HCPUPWlOnwoLNnkLF1/CgAAAEAAAADnS5OzqJ1hKjJ6btvlw
> nvYBAAAAAA==@elitegroupinc.ca>
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> 	boundary="----=_NextPart_000_0003_01C78E5A.CD761FE0"
> X-Mailer: Microsoft Office Outlook 11
> Thread-Index:
> AceCyu12JEluHxWIQ7ClFI22mBkHtgAghwiAAA0iz+AAAC8ZAAK8H9XgAAIRniA=
> In-Reply-To:
> <435DF58A933BA74397B42CDEB8145A860B8C4AE3@ex9.hostedexchange.local>
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028
> Disposition-Notification-To: "Carla Redman"
> <carla.redman@elitegroupinc.ca>
> X-Elite Group, Inc.-MailScanner: Found to be clean
> X-Elite Group, Inc.-MailScanner-From: carla.redman@elitegroupinc.ca
> X-Spam-Status: No
> 
> Thanks,
> 
> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info
> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of --[ UxBoD
> ]--
> Sent: Wednesday, May 09, 2007 9:08 AM
> To: MailScanner discussion
> Subject: Re: Issue with Blackberry
> 
> Would be useful to see the actual headers, especially the MIME section.
> 
> On Wed, 9 May 2007 08:38:05 -0400, "Gerhard Mourani" <gmourani@prival.ca>
> wrote:
>> Hello,
>> 
>>  
>> 
>> I'm using MailScanner + Postfix + SpamAssassin on Linux and having
> strange
>> issues with email coming from blackberry servers, here how the received
>> email look like:
>> 
>>  
>> 
>> Subject: Re: Hand Mixer Trial-Produce Report
>> 
>>  
>> 
>> \Ib?HTjy?Z.hm%yXxj?'p?'wJI+{E+.1I?U)?g?g*"(tjdj?6V??6 R w&FR
> FR&GbV
>> v F2fVC 
>> ________________________________
>> 
>> 6wB 6VRB
>> 
>>  
>> 
>> &W&o??G2 W&vVB 6RVVFVBf"7[1] FW7Fp??F0?? 
>> ________________________________
>> 
>> V&V6? &GV7B 
>> ________________________________
>> 
>> vW" 
>> ________________________________
>> 
>> 6V6 
>> ________________________________
>> 
>> 2?F&V7B?S 
>> ________________________________
>> 
>> SB 
>> ________________________________
>> 
>> ##r 
>> ________________________________
>> 
>> s3r[1]??&v 
>> ________________________________
>> 
>> W76vR?g&?[1]$FfBVr" 
>> ________________________________
>> 
>> FfBVt VIFVw&W26?FFSGVR 
>> ________________________________
>> 
>> ________________________________
>> 
>> ________________________________
>> 
>> # 
>> ________________________________
>> 
>> ________________________________
>> 
>> r 
>> ________________________________
>> 
>> ##?F&fW&F" 
>> ________________________________
>> 
>> fW&FF?VIFVw&W26&W&2&W&" 
>> ________________________________
>> 
>> W&2 &W&VIFVw&W26?63&FFv"" 
>> ________________________________
>> 
>> FFv$VIFVw&W26%6Tr" 
>> ________________________________
>> 
>> 6Rt 6V626&V&V" 
>> ________________________________
>> 
>> V&V6 6V626'6G&'W&F" 
>> ________________________________
>> 
>> 6G&'W&FVIFVw&W26&VWB" 
>> ________________________________
>> 
>> VWBGW&W6vTVIFVw&W26&VFV" 
>> ________________________________
>> 
>> VFV6 VVIFVw&W266TVIFVw&W26&V'F" 
>> ________________________________
>> 
>> zV'FVIFVw&W26$FR" 
>> ________________________________
>> 
>> zFRWG64VIFVw&W 26&FfBGW&" 
>> ________________________________
>> 
>> FfBGW&VIFVw&W26%F" 
>> ________________________________
>> 
>> FTVIFVw&W26'o R" 
>> ________________________________
>> 
>> oTVIFVw&W26&66r" 
>> ________________________________
>> 
>> ?66tVIFVw&W26&'R" 
>> ________________________________
>> 
>> 'TVIFVw&W26$66R" 
>> ________________________________
>> 
>> 66VF v?v6%6&?R" 
>> ________________________________
>> 
>> F?6$6" 
>> ________________________________
>> 
>> ?6Fv?v6&VfVr" 
>> ________________________________
>> 
>> VfVtF?6?7V&V7C 
>> ________________________________
>> 
>> B 
>> ________________________________
>> 
>> ?W"G& &GV6R&W'@??FV" 
>> ________________________________
>> 
>> fW&FW&2V6R 6VRB?W" G&
>> 
>>  
>> 
>> &GV7" &W'B7V7F &W7VB2fVB&W7B &Vv&G2FfBVpVIFR 
>> ________________________________
>> 
>> w&W[1] 
>> ________________________________
>> 
>> 2 
>> ________________________________
>> 
>> 6 
>> ________________________________
>> 
>> ff6P&S 
>> ________________________________
>> 
>> b3 
>> ________________________________
>> 
>> ________________________________
>> 
>> cs#cV?VIFW2?6 
>> ________________________________
>> 
>> c26? 
>> ________________________________
>> 
>> FVIFW2?6 
>> ________________________________
>> 
>> c26R#FfBVtVIFVw&W26 
>> ________________________________
>> 
>> FFfBVtVIFVw&W26vV'6FS wwrVIFVw&W26 
>> ________________________________
>> 
>> ?GG 
>> ________________________________
>> 
>> wwrVIFVw&W26%F2Vf76?R6F26fFVFf&FFVFVBof" FR W6Rb FR W'6VB&fR
> 
>> ________________________________
>> 
>> b R&RB FRFVFVB &V6VBb F2Vf76?R" FRVVR"vVB
> &W76&Rf"FVIfW&rB
>> F FRFVFVB &V6VB R&RW&V'FfVB FBF76V?F"6 |*[1]b F2Vf76?\*[1]2
>> 7G&7Fo
>> 
>>  
>> 
>> &&FVB 
>> ________________________________
>> 
>> b RfR &V6VfVB F2Vf76?RW'&" V6R &WGW& F W2C 
>> ________________________________
>> 
>> sR6RGR 
>> ________________________________
>> 
>> g&W&R 
>> ________________________________
>> 
>> G&R 
>> ________________________________
>> 
>> G&VVV&V2*[1] 
>> ________________________________
>> 
>> 6F 
>> ________________________________
>> 
>> 4" 
>> ________________________________
>> 
>> 5,*[1]'fC 
>> ________________________________
>> 
>> SB? 
>> ________________________________
>> 
>> rS#s " F FR 6VFW"w2VFG&W72F6FVB&fR
>> 
>>  
>> 
>> Gerhard,
>> 
>> 
>> -- 
>> This message has been scanned for viruses and
>> dangerous content by MailScanner, and is
>> believed to be clean.
>> 
>> 
>>
> -- 
> --[ UxBoD ]--
> // PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
> // Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
> // Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
> // Phone: +44 (0) 845 869 2749  SIP: uxbod@sip.splatnix.net
> 
> 
> -- 
> This message has been scanned for viruses and dangerous content by
> MailScanner, and is
> believed to be clean.
> 
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
> 
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> 
> 
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> 
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
> 
>
-- 
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
// Phone: +44 (0) 845 869 2749  SIP: uxbod@sip.splatnix.net


-- 
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.

From glenn.steen at gmail.com  Wed May  9 15:02:39 2007
From: glenn.steen at gmail.com (Glenn Steen)
Date: Wed May  9 15:02:43 2007
Subject: Issue with Blackberry
In-Reply-To: <3123E1B72B666243917E340F3C8FD4A10696E7@privaldc2003.prival.local>
References: <4717144a9438363409909b0a056c183b@62.49.223.244>
	<3123E1B72B666243917E340F3C8FD4A10696E7@privaldc2003.prival.local>
Message-ID: <223f97700705090702p2eb83a1ak634477c2b1a2caca@mail.gmail.com>

On 09/05/07, Gerhard Mourani <gmourani@prival.ca> wrote:
> Here what users sent to me. Also this is what I've in the -> /etc/postfix/header_checks file
(snip)
> X-Elite Group, Inc.-MailScanner: Found to be clean
> X-Elite Group, Inc.-MailScanner-From: carla.redman@elitegroupinc.ca
Read the comment above where you set your %org-name% and amend it
according to that. whitespace (and some other caracters) are not
allowed in headers (the lval ...), so you cant have that... Set it to
something like EliteGroupInc and you should be fine.

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
From gmourani at prival.ca  Wed May  9 15:09:49 2007
From: gmourani at prival.ca (Gerhard Mourani)
Date: Wed May  9 15:10:12 2007
Subject: Issue with Blackberry
In-Reply-To: <2e62294734b80b9df1c58b9ec14d633c@62.49.223.244>
Message-ID: <3123E1B72B666243917E340F3C8FD4A10696EC@privaldc2003.prival.local>

Yes, sorry I've sent the wrong message, this one is another problem and it's related to remote qmail server saying -> 'Disallowed breakage found in header name - potential virus' when receiving emails from this domain running MailScanner.


-----Original Message-----
From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of --[ UxBoD ]--
Sent: Wednesday, May 09, 2007 10:02 AM
To: MailScanner discussion
Subject: RE: Issue with Blackberry

The headers do not look right to me, and I reckon that funny content you are seeing is the .xls attachment.  I know you say that it has been sent via a Blackberry but the headers are for Outlook V11 ?

On Wed, 9 May 2007 09:26:31 -0400, "Gerhard Mourani" <gmourani@prival.ca> wrote:
> Here what users sent to me. Also this is what I've in the ->
> /etc/postfix/header_checks file
> /^Received: (.*?) by eliteclassics.com(.*?)/ REJECT
> /^Received:/ HOLD
> 
> Now the headers:
> A problem was found in an Email message you sent.
> This Email scanner intercepted it and stopped the entire message
> reaching its destination.
> 
> The problem was reported to be:
> 
> Disallowed breakage found in header name - potential virus
> 
> 
> Please contact your IT support personnel with any queries regarding this
> policy.
> 
> 
> Your message was sent with the following envelope:
> 
> MAIL FROM: carla.redman@elitegroupinc.ca
> RCPT TO:   joshua.levin@myexchangehosting.net
> 
> ... and with the following headers:
> 
> ---
> MAILFROM: carla.redman@elitegroupinc.ca
> Delivered-To: jwlevinp-joshua.levin@jwlevinpartners.com
> Received: (qmail 55802 invoked from network); 4 May 2007 18:37:42 -0000
> Received: from unknown (HELO mail.eliteclassics.com) (149.99.191.243)
>   by host355.ipowerweb.com with SMTP; 4 May 2007 18:37:42 -0000
> Received: from EXECDanny (office.eliteclassics.com [149.99.191.242])
> 	by mail.eliteclassics.com (Postfix) with ESMTP id CEC964DEC
> 	for <joshua.levin@jwlevinpartners.com>; Fri,  4 May 2007 14:40:18
> -0400 (EDT)
> Return-Receipt-To: "Carla Redman" <carla.redman@elitegroupinc.ca>
> Reply-To: <carla.redman@elitegroupinc.ca>
> From: "Carla Redman" <carla.redman@elitegroupinc.ca>
> To: "'Levin, Joshua'" <joshua.levin@jwlevinpartners.com>
> References:
> <!&!AAAAAAAAAAAYAAAAAAAAAA//HCPUPWlOnwoLNnkLF1/CgAAAEAAAAIJKY+ZCvJhCqwOpsTBc
> Ps0BAAAAAA==@elitegroupinc.ca>
> <435DF58A933BA74397B42CDEB8145A860B8C4AE3@ex9.hostedexchange.local>
> Subject: RE: feb 07  flights  .xls
> Date: Fri, 4 May 2007 14:45:04 -0400
> Organization: Elite Group
> Message-ID:
> <!&!AAAAAAAAAAAYAAAAAAAAAA//HCPUPWlOnwoLNnkLF1/CgAAAEAAAADnS5OzqJ1hKjJ6btvlw
> nvYBAAAAAA==@elitegroupinc.ca>
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> 	boundary="----=_NextPart_000_0003_01C78E5A.CD761FE0"
> X-Mailer: Microsoft Office Outlook 11
> Thread-Index:
> AceCyu12JEluHxWIQ7ClFI22mBkHtgAghwiAAA0iz+AAAC8ZAAK8H9XgAAIRniA=
> In-Reply-To:
> <435DF58A933BA74397B42CDEB8145A860B8C4AE3@ex9.hostedexchange.local>
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028
> Disposition-Notification-To: "Carla Redman"
> <carla.redman@elitegroupinc.ca>
> X-Elite Group, Inc.-MailScanner: Found to be clean
> X-Elite Group, Inc.-MailScanner-From: carla.redman@elitegroupinc.ca
> X-Spam-Status: No
> 
> Thanks,
> 
> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info
> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of --[ UxBoD
> ]--
> Sent: Wednesday, May 09, 2007 9:08 AM
> To: MailScanner discussion
> Subject: Re: Issue with Blackberry
> 
> Would be useful to see the actual headers, especially the MIME section.
> 
> On Wed, 9 May 2007 08:38:05 -0400, "Gerhard Mourani" <gmourani@prival.ca>
> wrote:
>> Hello,
>> 
>>  
>> 
>> I'm using MailScanner + Postfix + SpamAssassin on Linux and having
> strange
>> issues with email coming from blackberry servers, here how the received
>> email look like:
>> 
>>  
>> 
>> Subject: Re: Hand Mixer Trial-Produce Report
>> 
>>  
>> 
>> \Ib?HTjy?Z.hm%yXxj?'p?'wJI+{E+.1I?U)?g?g*"(tjdj?6V??6 R w&FR
> FR&GbV
>> v F2fVC 
>> ________________________________
>> 
>> 6wB 6VRB
>> 
>>  
>> 
>> &W&o??G2 W&vVB 6RVVFVBf"7[1] FW7Fp??F0?? 
>> ________________________________
>> 
>> V&V6? &GV7B 
>> ________________________________
>> 
>> vW" 
>> ________________________________
>> 
>> 6V6 
>> ________________________________
>> 
>> 2?F&V7B?S 
>> ________________________________
>> 
>> SB 
>> ________________________________
>> 
>> ##r 
>> ________________________________
>> 
>> s3r[1]??&v 
>> ________________________________
>> 
>> W76vR?g&?[1]$FfBVr" 
>> ________________________________
>> 
>> FfBVt VIFVw&W26?FFSGVR 
>> ________________________________
>> 
>> ________________________________
>> 
>> ________________________________
>> 
>> # 
>> ________________________________
>> 
>> ________________________________
>> 
>> r 
>> ________________________________
>> 
>> ##?F&fW&F" 
>> ________________________________
>> 
>> fW&FF?VIFVw&W26&W&2&W&" 
>> ________________________________
>> 
>> W&2 &W&VIFVw&W26?63&FFv"" 
>> ________________________________
>> 
>> FFv$VIFVw&W26%6Tr" 
>> ________________________________
>> 
>> 6Rt 6V626&V&V" 
>> ________________________________
>> 
>> V&V6 6V626'6G&'W&F" 
>> ________________________________
>> 
>> 6G&'W&FVIFVw&W26&VWB" 
>> ________________________________
>> 
>> VWBGW&W6vTVIFVw&W26&VFV" 
>> ________________________________
>> 
>> VFV6 VVIFVw&W266TVIFVw&W26&V'F" 
>> ________________________________
>> 
>> zV'FVIFVw&W26$FR" 
>> ________________________________
>> 
>> zFRWG64VIFVw&W 26&FfBGW&" 
>> ________________________________
>> 
>> FfBGW&VIFVw&W26%F" 
>> ________________________________
>> 
>> FTVIFVw&W26'o R" 
>> ________________________________
>> 
>> oTVIFVw&W26&66r" 
>> ________________________________
>> 
>> ?66tVIFVw&W26&'R" 
>> ________________________________
>> 
>> 'TVIFVw&W26$66R" 
>> ________________________________
>> 
>> 66VF v?v6%6&?R" 
>> ________________________________
>> 
>> F?6$6" 
>> ________________________________
>> 
>> ?6Fv?v6&VfVr" 
>> ________________________________
>> 
>> VfVtF?6?7V&V7C 
>> ________________________________
>> 
>> B 
>> ________________________________
>> 
>> ?W"G& &GV6R&W'@??FV" 
>> ________________________________
>> 
>> fW&FW&2V6R 6VRB?W" G&
>> 
>>  
>> 
>> &GV7" &W'B7V7F &W7VB2fVB&W7B &Vv&G2FfBVpVIFR 
>> ________________________________
>> 
>> w&W[1] 
>> ________________________________
>> 
>> 2 
>> ________________________________
>> 
>> 6 
>> ________________________________
>> 
>> ff6P&S 
>> ________________________________
>> 
>> b3 
>> ________________________________
>> 
>> ________________________________
>> 
>> cs#cV?VIFW2?6 
>> ________________________________
>> 
>> c26? 
>> ________________________________
>> 
>> FVIFW2?6 
>> ________________________________
>> 
>> c26R#FfBVtVIFVw&W26 
>> ________________________________
>> 
>> FFfBVtVIFVw&W26vV'6FS wwrVIFVw&W26 
>> ________________________________
>> 
>> ?GG 
>> ________________________________
>> 
>> wwrVIFVw&W26%F2Vf76?R6F26fFVFf&FFVFVBof" FR W6Rb FR W'6VB&fR
> 
>> ________________________________
>> 
>> b R&RB FRFVFVB &V6VBb F2Vf76?R" FRVVR"vVB
> &W76&Rf"FVIfW&rB
>> F FRFVFVB &V6VB R&RW&V'FfVB FBF76V?F"6 |*[1]b F2Vf76?\*[1]2
>> 7G&7Fo
>> 
>>  
>> 
>> &&FVB 
>> ________________________________
>> 
>> b RfR &V6VfVB F2Vf76?RW'&" V6R &WGW& F W2C 
>> ________________________________
>> 
>> sR6RGR 
>> ________________________________
>> 
>> g&W&R 
>> ________________________________
>> 
>> G&R 
>> ________________________________
>> 
>> G&VVV&V2*[1] 
>> ________________________________
>> 
>> 6F 
>> ________________________________
>> 
>> 4" 
>> ________________________________
>> 
>> 5,*[1]'fC 
>> ________________________________
>> 
>> SB? 
>> ________________________________
>> 
>> rS#s " F FR 6VFW"w2VFG&W72F6FVB&fR
>> 
>>  
>> 
>> Gerhard,
>> 
>> 
>> -- 
>> This message has been scanned for viruses and
>> dangerous content by MailScanner, and is
>> believed to be clean.
>> 
>> 
>>
> -- 
> --[ UxBoD ]--
> // PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
> // Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
> // Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
> // Phone: +44 (0) 845 869 2749  SIP: uxbod@sip.splatnix.net
> 
> 
> -- 
> This message has been scanned for viruses and dangerous content by
> MailScanner, and is
> believed to be clean.
> 
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
> 
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> 
> 
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> 
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
> 
>
-- 
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
// Phone: +44 (0) 845 869 2749  SIP: uxbod@sip.splatnix.net


-- 
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.

--
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

From gmourani at prival.ca  Wed May  9 15:15:34 2007
From: gmourani at prival.ca (Gerhard Mourani)
Date: Wed May  9 15:16:03 2007
Subject: Issue with Blackberry
In-Reply-To: <223f97700705090702p2eb83a1ak634477c2b1a2caca@mail.gmail.com>
Message-ID: <3123E1B72B666243917E340F3C8FD4A10696ED@privaldc2003.prival.local>

Thanks,

Yes I remember now, never use white space.

Cheers,

-----Original Message-----
From: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Glenn
Steen
Sent: Wednesday, May 09, 2007 10:03 AM
To: MailScanner discussion
Subject: Re: Issue with Blackberry

On 09/05/07, Gerhard Mourani <gmourani@prival.ca> wrote:
> Here what users sent to me. Also this is what I've in the ->
/etc/postfix/header_checks file
(snip)
> X-Elite Group, Inc.-MailScanner: Found to be clean
> X-Elite Group, Inc.-MailScanner-From: carla.redman@elitegroupinc.ca
Read the comment above where you set your %org-name% and amend it
according to that. whitespace (and some other caracters) are not
allowed in headers (the lval ...), so you cant have that... Set it to
something like EliteGroupInc and you should be fine.

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

From Denis.Beauchemin at USherbrooke.ca  Wed May  9 15:43:43 2007
From: Denis.Beauchemin at USherbrooke.ca (Denis Beauchemin)
Date: Wed May  9 15:44:05 2007
Subject: Attachment filename filter rules (sophisticated)
In-Reply-To: <08AD7B42A2698345BA90F9E33A46F2C401AC8394@ULPGCTMVMAI003.EU.COLT>
References: <08AD7B42A2698345BA90F9E33A46F2C401AC8394@ULPGCTMVMAI003.EU.COLT>
Message-ID: <4641DE1F.20108@USherbrooke.ca>

Ohlenmacher, Olaf a ?crit :
> Hello,
> we drop attachments by filenames extentions. Nowerdays attachment filenames are MIME-coded so that Umlauts and other special characters can be handled in a 7-Bit clean way.
>
> My question:
> Are the regular expressions applied to the decoded filenames or are they applied to the encoded filenames.
>   
I just tested it and it was blocked.

Denis

-- 
   _
  ?v?   Denis Beauchemin, analyste
 /(_)\  Universit? de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x62252 F: 819.821.8045


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3595 bytes
Desc: S/MIME Cryptographic Signature
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070509/cfc5d9b7/smime.bin
From alden at engineno9inc.com  Wed May  9 15:49:17 2007
From: alden at engineno9inc.com (Alden Levy)
Date: Wed May  9 15:49:33 2007
Subject: SMPID vs. INPID
Message-ID: <001f01c79249$38dfd6d0$7100000a@AldenLap>

Scott Silva ssilva wrote on Wed May 9 04:40:53 IST 2007
>Alden Levy spake the following on 5/8/2007 7:39 PM:
>>> Scott Silva ssilva wrote on Wed May 9 00:17:19 IST 2007
>>>> Scott Silva ssilva wrote on Tue May 8 21:08:43 IST 2007
>>>>> Alden Levy spake the following on 5/8/2007 12:16 PM:
>>>>>> Hugo van der Kooij wrote on Tue May 8 20:09:32 IST 2007
>>>>>>> On Tue, 8 May 2007, Alden Levy wrote:
>>>>>>>
>>>>>>>> Thanks for this.  Now, I'm really confused; the RedHat init script
is
>>>>>>>> identical to the one I'm using.
>>>>>>>>
>>>>>>>> Does anyone have an idea of where else I should look? (Quick recap:
>>>>>>>> /var/run/sendmail.in.pid is not getting updated, so
>>>>>>>> /etc/init.d/MailScanner
>>>>>>>> status lists incoming sendmail as failed.  sm-client.pid looks
fine,
>>>>>>>> though.)
>>>>>>> If you stop MailScanner the PID file should be gone. If not then you

>>>>>>> should remove it by hand and see if it happens to get recreated at 
>>>>>>> startup.
>>>>>>>
>>>>>>> Hugo.
>>>>>>>
>>>>>>> -- 
>>>>>>> 	hvdkooij at vanderkooij.org	http://hugo.vanderkooij.org/
>>>>>>> 	    This message is using 100% recycled electrons. 
>>>>>> Well, that was a mistake!  Now after removing the file by hand, and
>>>>>> restarting, I run status and get:
>>>>>> Checking MailScanner daemons:
>>>>>>          MailScanner:                                      [  OK  ]
>>>>>>          incoming sendmail: head: cannot open
>> `/var/run/sendmail.in.pid' for
>>>>>> reading: No such file or directory
>>>>>>                                                            [FAILED]
>>>>>>          outgoing sendmail:                                [  OK  ]
>>>>>>
>>>>>>
>>>>>> Any other thoughts?
>>>>>>  Thanks,
>>>>>> Alden
>>>>>
>>>> Your init script could be either damaged, or an old version. 
>>>> But I did a diff on my init script and the RedHat script you sent
earlier 
>>>> today, and there is no difference.  Can it still be corrupted?
>>>>
>>>> I was wondering if I should look elsewhere, or just try to reinstall.
>>>>
>>>> Thanks,
>>>> Alden
>>>>
>>> You do have sendmail disabled, don't you?
>> 
>> Yep.  But I'm going to double check, anyway.  I've done "chkconfig
sendmail
>> off" a few times, but I'll try again.
>> 
>> However, when I start sendmail, I have 3 instances running:
>> # ps aux|grep sendmail
>> root     23940  0.0  0.0  9092 1888 ?        Ss   22:36   0:00 sendmail:
>> accepting connections
>> 
>> smmsp    23944  0.0  0.0  6940 1656 ?        Ss   22:36   0:00 sendmail:
>> Queue runner at 00:15:00 for /var/spool/clientmqueue
>> root     23949  0.0  0.0  8296 1780 ?        Ss   22:36   0:00 sendmail:
>> Queue runner at 00:15:00 for
>> /home/virtual/FILESYSTEMTEMPLATE/services/sendmail/mqueue
>> 
>> The first one doesn't stop when I service MailScanner stop, and I have to
>> issue a service sendmail stop in order to kill it.
>> 
>> Curiouser and curiouser... Is this good/bad/indifferent?  I've been
seeing
>> this for a while, as this was what I had on my old server, but I don't
>> remember what was running when it was working properly.
>> 
>> 
>Look in /etc/sysconfig for a MailScanner.rpmnew. Maybe you have an old
version
>in there.

I've looked, and there is no MailScanner.rpmnew in /etc/sysconfig.  The
original file has a date stamp of Feb 1, which predates my server setup, but
I *believe* is the date of the release of the version I'm using.  

Here's the file contents (with settings for other MTAs removed):
# Put in here all the settings for your particular mail system so that
# MailScanner's init.d script can run it all for you.
#

#
# Are you running Postfix, sendmail, Exim or ZMailer?
#
# Don't set it by hand, we now auto-detect it from MailScanner.conf
# MTA=sendmail
# MTA=postfix
# MTA=exim
# MTA=zmailer
# Extract setting for MTA from MailScanner.conf
MTA=`perl -n -e 'print "$_" if chomp && s/^\s*MTA\s*=\s*([a-zA-Z]+)/$1/ &&
($_=lc($_))' /etc/MailScanner/MailScanner.conf`

#
# Cron job update_virus_scanners settings
#
UPDATEMAXDELAY=600 # Maximum delay before running cron job to avoid server
peaks

#
# Cron job sa-update settings
#
SAUPDATE=/usr/bin/sa-update # Location of sa-update program

#
# MailScanner Settings
#
#WORKDIR=/var/spool/MailScanner/incoming # Where the temp MailScanner files
live
# Extract settings for "Incoming Work Dir" and "Incoming Queue Dir"
WORKDIR=`perl -n -e 'print "$_" if chomp &&
s/^\s*Incoming\s*Work\s*Dir\s*=\s*(\S+)/$1/i'
/etc/MailScanner/MailScanner.conf`
INQDIR=`perl -n -e 'print "$_" if chomp &&
s/^\s*Incoming\s*Queue\s*Dir\s*=\s*(\S+)/$1/i'
/etc/MailScanner/MailScanner.conf`
QUARDIR=`perl -n -e 'print "$_" if chomp &&
s/^\s*Quarantine\s*Dir\s*=\s*(\S+)/$1/i' /etc/MailScanner/MailScanner.conf`
RUNAS=`perl -n -e 'print "$_" if chomp &&
s/^\s*Run\s*As\s*User\s*=\s*(\S+)/$1/i' /etc/MailScanner/MailScanner.conf`
RESTART_DELAY=10 # Pause time between stop and start when restarting

#perl -e 'print "***WORKDIR='$WORKDIR'***\n***INQDIR='$INQDIR'***\n";'

#
# Sendmail Settings
#
SENDMAIL=/usr/sbin/sendmail
QUEUETIME=15m
#INQDIR=/var/spool/mqueue.in
INPID=/var/run/sendmail.in.pid
OUTPID=/var/run/sendmail.out.pid
SMPID=/var/run/sm-client.pid
MSPUSER=smmsp  # User for mail submission queue runner
MSPGROUP=smmsp # Group for mail submission queue runner

Thanks,
Alden

From pravin.rane at gmail.com  Wed May  9 18:28:33 2007
From: pravin.rane at gmail.com (Pravin Rane)
Date: Wed May  9 18:28:36 2007
Subject: MailScanner w/ Qmail / Plesk
In-Reply-To: <C266ADE0.DF1E%cplists@princeservices.com>
References: <C266ADE0.DF1E%cplists@princeservices.com>
Message-ID: <13c021a90705091028p6103e38cw179eb8d4e1660102@mail.gmail.com>

Try to inject mail using /var/qmail/bin/qmail-inject.mailscanner

*/var/qmail/bin/qmail-inject.mailscanner user@mydomain.com < name_of_the_file*

and see whether that mail is getting pushed to /var/qmail/queue directory




On 5/9/07, Cameron B. Prince <cplists@princeservices.com> wrote:
>
> Hey guys,
>
> I have a new dedicated server with Plesk. I originally purchased the
> SpamAssassin and Dr. Web anti-virus plugins but they just don't compare to
> MailScanner w/ MailWatch.
>
> I followed the instructions to setup MailScanner with Qmail here:
>
> http://qms.ausics.net/
>
> I verified all the perl modules and checked the updates to the
> MailScanner.conf file. When I started MailScanner the init script
> complained
> that the MTA was invalid. I started Qmail manually and sent a test
> message.
> When the message hit the SMTP I got a queue error returned to the client.
>
> I ran this command and the queue errors went away:
>
> chmod u+s /var/qmail/bin/qmail-queue
>
> Now a test message produces this in the log:
>
> relaylock: /var/qmail/bin/relaylock: mail from xxx.xxx.xxx.xxx:61451
> (my.domain.com)
> MailScanner[6489]: New Batch: Scanning 1 messages, 668 bytes
> MailScanner[6489]: SpamAssassin cache hit for message 7064403
> MailScanner[6489]: Virus and Content Scanning: Starting
> MailScanner[6489]: Uninfected: Delivered 1 messages
> MailScanner[6489]: Logging message 7064403 to SQL
> MailScanner[6451]: 7064403: Logged to MailWatch SQL
>
> When I checked the other mailbox for the message I found that it was never
> received. I enabled debugging and got this output when I tried another
> test
> message:
>
> /usr/sbin/MailScanner
> In Debugging mode, not forking...
> Ignore errors about failing to find EOCD signature
> format error: file is too short
> at /usr/sbin/MailScanner line 832
> Stopping now as you are debugging me.
> commit ineffective with AutoCommit enabled at
> /usr/lib/MailScanner/MailScanner/CustomFunctions/MailWatch.pm line 93,
> <CLIENT> line 34.
> Commmit ineffective while AutoCommit is on at
> /usr/lib/MailScanner/MailScanner/CustomFunctions/MailWatch.pm line 93,
> <CLIENT> line 34.
>
>
>
> I know this patch for Qmail is pretty old and I wonder if this is the
> cause
> or if it's more likely to be a problem with the Plesk version of Qmail.
> Can
> anyone give me some ideas to troubleshoot this?
>
>
> Thanks,
> Cameron
>
>
>
> PS Here's the output of a lint test:
>
> /usr/sbin/MailScanner --lint
> Read 764 hostnames from the phishing whitelist
> Config: calling custom init function SQLBlacklist
> Config: calling custom init function MailWatchLogging
> Config: calling custom init function SQLWhitelist
> Checking version numbers...
> Version number in MailScanner.conf (4.58.9) is correct.
> MailScanner setting GID to  (2520)
> MailScanner setting UID to  (2520)
>
> Checking for SpamAssassin errors (if you use it)...
> Using SpamAssassin results cache
> Connected to SpamAssassin cache database
> SpamAssassin reported no errors.
> lock.pl sees Config  LockType =  flock
> lock.pl sees have_module =  0
> Using locktype = flock
> MailScanner.conf says "Virus Scanners = f-prot"
> Found these virus scanners installed: f-prot
>
>
>
>
>
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>



-- 
Regards

Pravin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070509/ff157793/attachment.html
From gmourani at prival.ca  Wed May  9 19:27:35 2007
From: gmourani at prival.ca (Gerhard Mourani)
Date: Wed May  9 19:29:25 2007
Subject: Issue with Blackberry
Message-ID: <3123E1B72B666243917E340F3C8FD4A1069703@privaldc2003.prival.local>

Ok, here an emails being sent from a users blackberry.
 
Return-Path: <katie.papoutsis@elitegroupinc.ca>
X-Original-To: todd.savage@elitegroupinc.ca
Delivered-To: todd.savage@elitegroupinc.ca
Received: from smtp04.bis.na.blackberry.com (smtp04.bis.na.blackberry.com [216.9.248.51])
            by mail.eliteclassics.com (Postfix) with ESMTP id 04231C549;
            Wed,  9 May 2007 14:02:10 -0400 (EDT)
Message-ID: <344973756-1178733913-cardhu_blackberry.rim.net-1567301641-@bxe017-cell02.bisx.prod.on.blackberry>
Reply-To: katie.papoutsis@elitegroupinc.ca
Sensitivity: Normal
Importance: Normal
To: "Todd Savage" <todd.savage@elitegroupinc.ca>
Subject: Fw:
From: "=?UTF-8?B?S2F0aWUgUGFwb3V0c2lz?=" <katie.papoutsis@elitegroupinc.ca>
Date: Wed, 9 May 2007 18:05:39 +0000
Content-type: text/plain
MIME-Version: 1.0
X-EliteGroupInc-MailScanner: Found to be clean
X-EliteGroupInc-MailScanner-From: katie.papoutsis@elitegroupinc.ca
X-Spam-Status: No


-----Original Message-----
From: Gerhard Mourani 
Sent: Wednesday, May 09, 2007 9:27 AM
To: 'MailScanner discussion'
Subject: RE: Issue with Blackberry

Here what users sent to me. Also this is what I've in the -> /etc/postfix/header_checks file
/^Received: (.*?) by eliteclassics.com(.*?)/ REJECT
/^Received:/ HOLD

Now the headers:
A problem was found in an Email message you sent.
This Email scanner intercepted it and stopped the entire message
reaching its destination.

The problem was reported to be:

Disallowed breakage found in header name - potential virus


Please contact your IT support personnel with any queries regarding this
policy.


Your message was sent with the following envelope:

MAIL FROM: carla.redman@elitegroupinc.ca
RCPT TO:   joshua.levin@myexchangehosting.net

... and with the following headers:

---
MAILFROM: carla.redman@elitegroupinc.ca
Delivered-To: jwlevinp-joshua.levin@jwlevinpartners.com
Received: (qmail 55802 invoked from network); 4 May 2007 18:37:42 -0000
Received: from unknown (HELO mail.eliteclassics.com) (149.99.191.243)
  by host355.ipowerweb.com with SMTP; 4 May 2007 18:37:42 -0000
Received: from EXECDanny (office.eliteclassics.com [149.99.191.242])
	by mail.eliteclassics.com (Postfix) with ESMTP id CEC964DEC
	for <joshua.levin@jwlevinpartners.com>; Fri,  4 May 2007 14:40:18
-0400 (EDT)
Return-Receipt-To: "Carla Redman" <carla.redman@elitegroupinc.ca>
Reply-To: <carla.redman@elitegroupinc.ca>
From: "Carla Redman" <carla.redman@elitegroupinc.ca>
To: "'Levin, Joshua'" <joshua.levin@jwlevinpartners.com>
References:
<!&!AAAAAAAAAAAYAAAAAAAAAA//HCPUPWlOnwoLNnkLF1/CgAAAEAAAAIJKY+ZCvJhCqwOpsTBc
Ps0BAAAAAA==@elitegroupinc.ca>
<435DF58A933BA74397B42CDEB8145A860B8C4AE3@ex9.hostedexchange.local>
Subject: RE: feb 07  flights  .xls
Date: Fri, 4 May 2007 14:45:04 -0400
Organization: Elite Group
Message-ID:
<!&!AAAAAAAAAAAYAAAAAAAAAA//HCPUPWlOnwoLNnkLF1/CgAAAEAAAADnS5OzqJ1hKjJ6btvlw
nvYBAAAAAA==@elitegroupinc.ca>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_0003_01C78E5A.CD761FE0"
X-Mailer: Microsoft Office Outlook 11
Thread-Index:
AceCyu12JEluHxWIQ7ClFI22mBkHtgAghwiAAA0iz+AAAC8ZAAK8H9XgAAIRniA=
In-Reply-To:
<435DF58A933BA74397B42CDEB8145A860B8C4AE3@ex9.hostedexchange.local>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028
Disposition-Notification-To: "Carla Redman" <carla.redman@elitegroupinc.ca>
X-Elite Group, Inc.-MailScanner: Found to be clean
X-Elite Group, Inc.-MailScanner-From: carla.redman@elitegroupinc.ca
X-Spam-Status: No

Thanks,

-----Original Message-----
From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of --[ UxBoD ]--
Sent: Wednesday, May 09, 2007 9:08 AM
To: MailScanner discussion
Subject: Re: Issue with Blackberry

Would be useful to see the actual headers, especially the MIME section.

On Wed, 9 May 2007 08:38:05 -0400, "Gerhard Mourani" <gmourani@prival.ca> wrote:
> Hello,
> 
>  
> 
> I'm using MailScanner + Postfix + SpamAssassin on Linux and having strange
> issues with email coming from blackberry servers, here how the received
> email look like:
> 
>  
> 
> Subject: Re: Hand Mixer Trial-Produce Report
> 
>  
> 
> \Ib?HTjy?Z.hm%yXxj?'p?'wJI+{E+.1I?U)?g?g*"(tjdj?6V??6 R w&FR FR&GbV
> v F2fVC 
> ________________________________
> 
> 6wB 6VRB
> 
>  
> 
> &W&o??G2 W&vVB 6RVVFVBf"7[1] FW7Fp??F0?? 
> ________________________________
> 
> V&V6? &GV7B 
> ________________________________
> 
> vW" 
> ________________________________
> 
> 6V6 
> ________________________________
> 
> 2?F&V7B?S 
> ________________________________
> 
> SB 
> ________________________________
> 
> ##r 
> ________________________________
> 
> s3r[1]??&v 
> ________________________________
> 
> W76vR?g&?[1]$FfBVr" 
> ________________________________
> 
> FfBVt VIFVw&W26?FFSGVR 
> ________________________________
> 
> ________________________________
> 
> ________________________________
> 
> # 
> ________________________________
> 
> ________________________________
> 
> r 
> ________________________________
> 
> ##?F&fW&F" 
> ________________________________
> 
> fW&FF?VIFVw&W26&W&2&W&" 
> ________________________________
> 
> W&2 &W&VIFVw&W26?63&FFv"" 
> ________________________________
> 
> FFv$VIFVw&W26%6Tr" 
> ________________________________
> 
> 6Rt 6V626&V&V" 
> ________________________________
> 
> V&V6 6V626'6G&'W&F" 
> ________________________________
> 
> 6G&'W&FVIFVw&W26&VWB" 
> ________________________________
> 
> VWBGW&W6vTVIFVw&W26&VFV" 
> ________________________________
> 
> VFV6 VVIFVw&W266TVIFVw&W26&V'F" 
> ________________________________
> 
> zV'FVIFVw&W26$FR" 
> ________________________________
> 
> zFRWG64VIFVw&W 26&FfBGW&" 
> ________________________________
> 
> FfBGW&VIFVw&W26%F" 
> ________________________________
> 
> FTVIFVw&W26'o R" 
> ________________________________
> 
> oTVIFVw&W26&66r" 
> ________________________________
> 
> ?66tVIFVw&W26&'R" 
> ________________________________
> 
> 'TVIFVw&W26$66R" 
> ________________________________
> 
> 66VF v?v6%6&?R" 
> ________________________________
> 
> F?6$6" 
> ________________________________
> 
> ?6Fv?v6&VfVr" 
> ________________________________
> 
> VfVtF?6?7V&V7C 
> ________________________________
> 
> B 
> ________________________________
> 
> ?W"G& &GV6R&W'@??FV" 
> ________________________________
> 
> fW&FW&2V6R 6VRB?W" G&
> 
>  
> 
> &GV7" &W'B7V7F &W7VB2fVB&W7B &Vv&G2FfBVpVIFR 
> ________________________________
> 
> w&W[1] 
> ________________________________
> 
> 2 
> ________________________________
> 
> 6 
> ________________________________
> 
> ff6P&S 
> ________________________________
> 
> b3 
> ________________________________
> 
> ________________________________
> 
> cs#cV?VIFW2?6 
> ________________________________
> 
> c26? 
> ________________________________
> 
> FVIFW2?6 
> ________________________________
> 
> c26R#FfBVtVIFVw&W26 
> ________________________________
> 
> FFfBVtVIFVw&W26vV'6FS wwrVIFVw&W26 
> ________________________________
> 
> ?GG 
> ________________________________
> 
> wwrVIFVw&W26%F2Vf76?R6F26fFVFf&FFVFVBof" FR W6Rb FR W'6VB&fR 
> ________________________________
> 
> b R&RB FRFVFVB &V6VBb F2Vf76?R" FRVVR"vVB &W76&Rf"FVIfW&rB
> F FRFVFVB &V6VB R&RW&V'FfVB FBF76V?F"6 |*[1]b F2Vf76?\*[1]2
> 7G&7Fo
> 
>  
> 
> &&FVB 
> ________________________________
> 
> b RfR &V6VfVB F2Vf76?RW'&" V6R &WGW& F W2C 
> ________________________________
> 
> sR6RGR 
> ________________________________
> 
> g&W&R 
> ________________________________
> 
> G&R 
> ________________________________
> 
> G&VVV&V2*[1] 
> ________________________________
> 
> 6F 
> ________________________________
> 
> 4" 
> ________________________________
> 
> 5,*[1]'fC 
> ________________________________
> 
> SB? 
> ________________________________
> 
> rS#s " F FR 6VFW"w2VFG&W72F6FVB&fR
> 
>  
> 
> Gerhard,
> 
> 
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> 
> 
>
-- 
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
// Phone: +44 (0) 845 869 2749  SIP: uxbod@sip.splatnix.net


-- 
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.

--
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

From cplists at princeservices.com  Wed May  9 19:50:46 2007
From: cplists at princeservices.com (Cameron B. Prince)
Date: Wed May  9 19:50:56 2007
Subject: MailScanner w/ Qmail / Plesk ( format error: file is too short )
In-Reply-To: <13c021a90705091028p6103e38cw179eb8d4e1660102@mail.gmail.com>
Message-ID: <C2678236.DF72%cplists@princeservices.com>

Hi Pravin,

Thanks for your reply... I did some further testing after reading your post.
When I send a message to the Qmail SMTP server a file is created as follows:

maillog: May  9 13:41:38 relaylock: /var/qmail/bin/relaylock: mail from
xxx.xxx.xxx.xxx:62279 (my.domain.com)
path: /var/qmail/queue.in/mess/14
file: -rw-r--r--   1 qmailq nofiles  669 May  9 13:41 7064533


I ran the inject command as you directed and the message is sent and
received in the other mailbox:

command: /var/qmail/bin/qmail-inject.mailscanner cprince@princeinternet.com
< 7064533
maillog:

May  9 13:45:38 qmail: 1178736338.084522 new msg 7064535
May  9 13:45:38 qmail: 1178736338.084561 info msg 7064535: bytes 737 from
<root@my.domain.com> qp 12777 uid 0
May  9 13:45:38 qmail: 1178736338.087267 starting delivery 3: msg 7064535 to
local 1-cprince@domain.com
May  9 13:45:38 qmail: 1178736338.087284 status: local 1/10 remote 0/20
May  9 13:45:38 qmail: 1178736338.091709 delivery 3: success: did_1+0+1/
May  9 13:45:38 qmail: 1178736338.091730 status: local 0/10 remote 0/20
May  9 13:45:38 qmail: 1178736338.091742 end msg 7064535


Once I run MailScanner, it reads the file in the queue but fails with the
same error:

/usr/sbin/MailScanner
In Debugging mode, not forking...
Ignore errors about failing to find EOCD signature
format error: file is too short
 at /usr/sbin/MailScanner line 832
Stopping now as you are debugging me.
commit ineffective with AutoCommit enabled at
/usr/lib/MailScanner/MailScanner/CustomFunctions/MailWatch.pm line 93,
<CLIENT> line 34.
Commmit ineffective while AutoCommit is on at
/usr/lib/MailScanner/MailScanner/CustomFunctions/MailWatch.pm line 93,
<CLIENT> line 34.


Do you have any other thoughts?

Thanks,
Cameron


On 5/9/07 12:28 PM, "Pravin Rane" <pravin.rane@gmail.com> wrote:

> Try to inject mail using /var/qmail/bin/qmail-inject.mailscanner
> /var/qmail/bin/qmail-inject.mailscanner user@mydomain.com < name_of_the_file
> and see whether that mail is getting pushed to /var/qmail/queue directory
>  
> 
> 
>  
> On 5/9/07, Cameron B. Prince <cplists@princeservices.com> wrote:
>> Hey guys,
>> 
>> I have a new dedicated server with Plesk. I originally purchased the
>> SpamAssassin and Dr. Web anti-virus plugins but they just don't compare to
>> MailScanner w/ MailWatch.
>> 
>> I followed the instructions to setup MailScanner with Qmail here:
>> 
>> http://qms.ausics.net/
>> 
>> I verified all the perl modules and checked the updates to the
>> MailScanner.conf file. When I started MailScanner the init script complained
>> that the MTA was invalid. I started Qmail manually and sent a test message.
>> When the message hit the SMTP I got a queue error returned to the client.
>> 
>> I ran this command and the queue errors went away:
>> 
>> chmod u+s /var/qmail/bin/qmail-queue
>> 
>> Now a test message produces this in the log:
>> 
>> relaylock: /var/qmail/bin/relaylock: mail from xxx.xxx.xxx.xxx :61451
>> (my.domain.com <http://my.domain.com> )
>> MailScanner[6489]: New Batch: Scanning 1 messages, 668 bytes
>> MailScanner[6489]: SpamAssassin cache hit for message 7064403
>> MailScanner[6489]: Virus and Content Scanning: Starting
>> MailScanner[6489]: Uninfected: Delivered 1 messages
>> MailScanner[6489]: Logging message 7064403 to SQL
>> MailScanner[6451]: 7064403: Logged to MailWatch SQL
>> 
>> When I checked the other mailbox for the message I found that it was never
>> received. I enabled debugging and got this output when I tried another test
>> message:
>> 
>> /usr/sbin/MailScanner
>> In Debugging mode, not forking...
>> Ignore errors about failing to find EOCD signature
>> format error: file is too short
>> at /usr/sbin/MailScanner line 832
>> Stopping now as you are debugging me.
>> commit ineffective with AutoCommit enabled at
>> /usr/lib/MailScanner/MailScanner/CustomFunctions/MailWatch.pm line 93,
>> <CLIENT> line 34.
>> Commmit ineffective while AutoCommit is on at
>> /usr/lib/MailScanner/MailScanner/CustomFunctions/MailWatch.pm line 93,
>> <CLIENT> line 34.
>> 
>> 
>> 
>> I know this patch for Qmail is pretty old and I wonder if this is the cause
>> or if it's more likely to be a problem with the Plesk version of Qmail. Can
>> anyone give me some ideas to troubleshoot this?
>> 
>> 
>> Thanks,
>> Cameron
>> 
>> 
>> 
>> PS Here's the output of a lint test:
>> 
>> /usr/sbin/MailScanner --lint
>> Read 764 hostnames from the phishing whitelist
>> Config: calling custom init function SQLBlacklist
>> Config: calling custom init function MailWatchLogging
>> Config: calling custom init function SQLWhitelist
>> Checking version numbers...
>> Version number in MailScanner.conf (4.58.9) is correct.
>> MailScanner setting GID to  (2520)
>> MailScanner setting UID to  (2520)
>> 
>> Checking for SpamAssassin errors (if you use it)...
>> Using SpamAssassin results cache
>> Connected to SpamAssassin cache database
>> SpamAssassin reported no errors.
>> lock.pl sees Config  LockType =  flock
>> lock.pl sees have_module =  0
>> Using locktype = flock
>> MailScanner.conf says "Virus Scanners = f-prot"
>> Found these virus scanners installed: f-prot
>> 
>> 
>> 
>> 
>> 
>> --
>> MailScanner mailing list
>> mailscanner@lists.mailscanner.info
>> <mailto:mailscanner@lists.mailscanner.info>
>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>> 
>> Before posting, read http://wiki.mailscanner.info/posting
>> <http://wiki.mailscanner.info/posting>
>> 
>> Support MailScanner development - buy the book off the website!
> 
> 


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070509/3afaea79/attachment.html
From MailScanner at ecs.soton.ac.uk  Wed May  9 20:26:48 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Wed May  9 20:28:17 2007
Subject: Clamav suggestions
In-Reply-To: <20070509105522.y9h0nbimg4kg0oks@luna.eco.unibs.it>
References: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it>
	<20070509105522.y9h0nbimg4kg0oks@luna.eco.unibs.it>
Message-ID: <46422078.6000508@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Fabio Pedretti wrote:
>> 2) I noticed (as well as others:
>> http://lists.mailscanner.info/pipermail/mailscanner/2007-April/072504.html 
>>
>> ) that some phishing mail are not blocked (I am also using
>> the signatures of sanesecurity). If I do a clamscan on the full
>> original mail with headers, clamscan find the virus (I can provide a
>> sample if needed). Seems the problem is that MailScanner extracts the
>> content of the mail (body + attachment) and scans it, but some
>> phishing mail are only detected if the full headers are present (in
>> the clamav DB in the extended signature format, option 4 is for mail
>> files, look at signatures.pdf in clamav source, and are detected only
>> if full mail with headers is scanned).
>> MailScanner should be modified so that all the original mail (with
>> headers and without extracting attachment) should be passed to
>> clamscan/clamd, so all virus can be catched.
>
> To try the problem send a mail with the following text:
> 2.83:9999/webscrr/ind
> on a MailScanner with clamav mail server.
> The mail does not get filtered.
>
> However if you do a clamscan on the received mail, you get:
> test.eml: Email.Phishing.Pay-20 FOUND
>
If you scan a text file containing the magic string above, clamscan 
doesn't find anything wrong. It *only* spots it if the file has email 
headers in it as well. This is a bit disappointing on the part of 
ClamAV. But it is a very effective defence against false alarms. 
MailScanner extracts all the parts of the message and scans them as 
files. As a result this phishing detector in ClamAV won't be triggered.

I can't see any effective good solution to this one. It does not appear 
to affect anything except this phishing trap (and possible a few other 
phishing traps), so I'm not overly concerned about it. There has been no 
evidence whatsoever that anything more important is let through, and 
MailScanner has its own phishing detectors which should be triggered anyway.

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGQiCsEfZZRxQVtlQRAsrCAKDG/2Nv4D6sRQ7b3KmSaoYv+nNZWgCg/iLX
/ZYGBSqmtwJsb8DM2wzwgzA=
=rvWL
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From ajos1 at onion.demon.co.uk  Wed May  9 21:06:37 2007
From: ajos1 at onion.demon.co.uk (ajos1@onion.demon.co.uk)
Date: Wed May  9 21:06:51 2007
Subject: No VirusScan on Local Messages...
Message-ID: <sentwed09may2007210637gmtbstajos1@sonicbadger.com>

-

Matt,

You are my hero... works like a dream...

(Quite embarassing... as it is all explained in the MailScanner.conf at the point you said to check).

-----Original Message-----
From: MailScanner discussion <mailscanner@lists.mailscanner.info>
Subj: Re: No VirusScan on Local Messages...
Date: Tue, 08 May 2007 17:09:52 -0400


Search for "Scan Messages =" in your MailScanner.conf

And put: Scan Messages = %rules-dir%/scan.messages.rules

And in the %rules-dir% create scan.messages.rules with the following:

From:           127.0.0.1       no
FromOrTo:       default         yes



Save, restart MailScanner.


-Matt

==
=====================================================================
=
= "It is obvious the Treasurer is rolling in money," said Wayne
=  Swan, treasury spokesman for the opposition Labor Party. "It has
=  been raining gold bars thanks to the mining boom."
=
=  Need help dealing with Parking Tickets, Bailiffs, Capita or NTL...
=  Call...    +44 8457 90 90 90    http://www.samaritans.org/
=
=====================================================================
From ajos1 at onion.demon.co.uk  Wed May  9 21:19:08 2007
From: ajos1 at onion.demon.co.uk (ajos1@onion.demon.co.uk)
Date: Wed May  9 21:19:28 2007
Subject: OT: Installing Mail-ClamAV-0.20 fails...
Message-ID: <sentwed09may2007211908gmtbstajos1@sonicbadger.com>

-

Anyone have ideas on this one... I have googled the errors... and see alot of mentions of this error and that the original author needs to fix them... but no solutions!

It does the same for Mail-ClamAV-0.13 .

Thanks in advance-o.

My "Inline" version is 0.44 .
Perl is: Perl: 5.008008 (5.8.8)

Installing Perl Module  - Mail-ClamAV-0.20
------------------------------------------

CPAN: File::HomeDir loaded ok (v0.64)
CPAN: Storable loaded ok (v2.16)
Going to read /root/.cpan/Metadata
  Database was generated on Tue, 08 May 2007 05:10:52 GMT
Running install for module 'Mail::ClamAV'
Running make for S/SA/SABECK/Mail-ClamAV-0.20.tar.gz
CPAN: Digest::SHA loaded ok (v5.44)
CPAN: Compress::Zlib loaded ok (v2.004)
Checksum for /root/.cpan/sources/authors/id/S/SA/SABECK/Mail-ClamAV-0.20.tar.gz ok
Mail-ClamAV-0.20/
Mail-ClamAV-0.20/t/
Mail-ClamAV-0.20/t/eicarcom2.zip
Mail-ClamAV-0.20/t/Mail-ClamAV.t
Mail-ClamAV-0.20/t/virus.eml
Mail-ClamAV-0.20/Inline/
Mail-ClamAV-0.20/Inline/MakeMaker.pm
Mail-ClamAV-0.20/META.yml
Mail-ClamAV-0.20/config.pl
Mail-ClamAV-0.20/Changes
Mail-ClamAV-0.20/MANIFEST
Mail-ClamAV-0.20/ClamAV.pm
Mail-ClamAV-0.20/INSTALL
Mail-ClamAV-0.20/Makefile.PL
Mail-ClamAV-0.20/README
CPAN: File::Temp loaded ok (v0.18)

  CPAN.pm: Going to build S/SA/SABECK/Mail-ClamAV-0.20.tar.gz

Checking if your kit is complete...
Looks good
Writing Makefile for Mail::ClamAV
CPAN: YAML loaded ok (v0.62)
cp ClamAV.pm blib/lib/Mail/ClamAV.pm
/usr/bin/perl -Mblib -MInline=NOISY,_INSTALL_ -MMail::ClamAV -e1 0.20 blib/arch
Starting Build Prepocess Stage
Finished Build Prepocess Stage

Starting Build Parse Stage
Finished Build Parse Stage

Starting Build Glue 1 Stage
Finished Build Glue 1 Stage

Starting Build Glue 2 Stage
Finished Build Glue 2 Stage

Starting Build Glue 3 Stage
Finished Build Glue 3 Stage

Starting Build Compile Stage
  Starting "perl Makefile.PL" Stage
Writing Makefile for Mail::ClamAV
  Finished "perl Makefile.PL" Stage

  Starting "make" Stage
make[1]: Entering directory `/root/.cpan/build/Mail-ClamAV-0.20-Cd7OP6/_Inline/build/Mail/ClamAV'
/usr/bin/perl /usr/lib/perl5/5.8.8/ExtUtils/xsubpp  -typemap /usr/lib/perl5/5.8.8/ExtUtils/typemap   ClamAV.xs > ClamAV.xsc && mv ClamAV.xsc ClamAV.c
gcc -c  -I/root/.cpan/build/Mail-ClamAV-0.20-Cd7OP6 -I/usr/local/include -D_REENTRANT -D_GNU_SOURCE -fno-strict-aliasing -pipe -Wdeclaration-after-statement -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m32 -march=i386 -mtune=generic -fasynchronous-unwind-tables   -DVERSION=\"0.20\" -DXS_VERSION=\"0.20\" -fPIC "-I/usr/lib/perl5/5.8.8/i386-linux-thread-multi/CORE"   ClamAV.c
ClamAV.xs: In function 'clamav_perl_new':
ClamAV.xs:53: warning: implicit declaration of function 'cl_loaddbdir'
ClamAV.xs:56: warning: implicit declaration of function 'cl_loaddb'
ClamAV.xs: In function 'clamav_perl__scanfd':
ClamAV.xs:202: warning: unused variable 'items'
ClamAV.xs:197: warning: unused variable 'len'
ClamAV.xs: In function 'clamav_perl__scanfile':
ClamAV.xs:239: warning: unused variable 'items'
ClamAV.xs:233: warning: unused variable 'len'
ClamAV.xs: In function 'clamav_perl_constant':
ClamAV.xs:350: error: 'CL_SCAN_ALGORITHMIC' undeclared (first use in this function)
ClamAV.xs:350: error: (Each undeclared identifier is reported only once
ClamAV.xs:350: error: for each function it appears in.)
make[1]: *** [ClamAV.o] Error 1
make[1]: Leaving directory `/root/.cpan/build/Mail-ClamAV-0.20-Cd7OP6/_Inline/build/Mail/ClamAV'

A problem was encountered while attempting to compile and install your Inline
C code. The command that failed was:
  make

The build directory was:
/root/.cpan/build/Mail-ClamAV-0.20-Cd7OP6/_Inline/build/Mail/ClamAV

To debug the problem, cd to the build directory, and inspect the output files.

 at /root/.cpan/build/Mail-ClamAV-0.20-Cd7OP6/blib/lib/Mail/ClamAV.pm line 178
BEGIN failed--compilation aborted at /root/.cpan/build/Mail-ClamAV-0.20-Cd7OP6/blib/lib/Mail/ClamAV.pm line 542.
Compilation failed in require.
BEGIN failed--compilation aborted.
make: *** [ClamAV.inl] Error 25
  SABECK/Mail-ClamAV-0.20.tar.gz
  /usr/bin/make -- NOT OK
Running make test
  Can't test without successful make
Running make install
  Make had returned bad status, install seems impossible

==
=====================================================================
=
= "It is obvious the Treasurer is rolling in money," said Wayne
=  Swan, treasury spokesman for the opposition Labor Party. "It has
=  been raining gold bars thanks to the mining boom."
=
=  Need help dealing with Parking Tickets, Bailiffs, Capita or NTL...
=  Call...    +44 8457 90 90 90    http://www.samaritans.org/
=
=====================================================================
From gmourani at prival.ca  Wed May  9 21:23:30 2007
From: gmourani at prival.ca (Gerhard Mourani)
Date: Wed May  9 21:24:09 2007
Subject: Issue with Blackberry
Message-ID: <3123E1B72B666243917E340F3C8FD4A1069710@privaldc2003.prival.local>

I found that the message shows up ok on the computer.  It is when it shows on the blackberry that it is a problem. Some one has some idea why this happen on Blackberry?

-----Original Message-----
From: Gerhard Mourani 
Sent: Wednesday, May 09, 2007 2:28 PM
To: Gerhard Mourani; 'MailScanner discussion'
Subject: RE: Issue with Blackberry

Ok, here an emails being sent from a users blackberry.
 
Return-Path: <katie.papoutsis@elitegroupinc.ca>
X-Original-To: todd.savage@elitegroupinc.ca
Delivered-To: todd.savage@elitegroupinc.ca
Received: from smtp04.bis.na.blackberry.com (smtp04.bis.na.blackberry.com [216.9.248.51])
            by mail.eliteclassics.com (Postfix) with ESMTP id 04231C549;
            Wed,  9 May 2007 14:02:10 -0400 (EDT)
Message-ID: <344973756-1178733913-cardhu_blackberry.rim.net-1567301641-@bxe017-cell02.bisx.prod.on.blackberry>
Reply-To: katie.papoutsis@elitegroupinc.ca
Sensitivity: Normal
Importance: Normal
To: "Todd Savage" <todd.savage@elitegroupinc.ca>
Subject: Fw:
From: "=?UTF-8?B?S2F0aWUgUGFwb3V0c2lz?=" <katie.papoutsis@elitegroupinc.ca>
Date: Wed, 9 May 2007 18:05:39 +0000
Content-type: text/plain
MIME-Version: 1.0
X-EliteGroupInc-MailScanner: Found to be clean
X-EliteGroupInc-MailScanner-From: katie.papoutsis@elitegroupinc.ca
X-Spam-Status: No


-----Original Message-----
From: Gerhard Mourani 
Sent: Wednesday, May 09, 2007 9:27 AM
To: 'MailScanner discussion'
Subject: RE: Issue with Blackberry

Here what users sent to me. Also this is what I've in the -> /etc/postfix/header_checks file
/^Received: (.*?) by eliteclassics.com(.*?)/ REJECT
/^Received:/ HOLD

Now the headers:
A problem was found in an Email message you sent.
This Email scanner intercepted it and stopped the entire message
reaching its destination.

The problem was reported to be:

Disallowed breakage found in header name - potential virus


Please contact your IT support personnel with any queries regarding this
policy.


Your message was sent with the following envelope:

MAIL FROM: carla.redman@elitegroupinc.ca
RCPT TO:   joshua.levin@myexchangehosting.net

... and with the following headers:

---
MAILFROM: carla.redman@elitegroupinc.ca
Delivered-To: jwlevinp-joshua.levin@jwlevinpartners.com
Received: (qmail 55802 invoked from network); 4 May 2007 18:37:42 -0000
Received: from unknown (HELO mail.eliteclassics.com) (149.99.191.243)
  by host355.ipowerweb.com with SMTP; 4 May 2007 18:37:42 -0000
Received: from EXECDanny (office.eliteclassics.com [149.99.191.242])
	by mail.eliteclassics.com (Postfix) with ESMTP id CEC964DEC
	for <joshua.levin@jwlevinpartners.com>; Fri,  4 May 2007 14:40:18
-0400 (EDT)
Return-Receipt-To: "Carla Redman" <carla.redman@elitegroupinc.ca>
Reply-To: <carla.redman@elitegroupinc.ca>
From: "Carla Redman" <carla.redman@elitegroupinc.ca>
To: "'Levin, Joshua'" <joshua.levin@jwlevinpartners.com>
References:
<!&!AAAAAAAAAAAYAAAAAAAAAA//HCPUPWlOnwoLNnkLF1/CgAAAEAAAAIJKY+ZCvJhCqwOpsTBc
Ps0BAAAAAA==@elitegroupinc.ca>
<435DF58A933BA74397B42CDEB8145A860B8C4AE3@ex9.hostedexchange.local>
Subject: RE: feb 07  flights  .xls
Date: Fri, 4 May 2007 14:45:04 -0400
Organization: Elite Group
Message-ID:
<!&!AAAAAAAAAAAYAAAAAAAAAA//HCPUPWlOnwoLNnkLF1/CgAAAEAAAADnS5OzqJ1hKjJ6btvlw
nvYBAAAAAA==@elitegroupinc.ca>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_0003_01C78E5A.CD761FE0"
X-Mailer: Microsoft Office Outlook 11
Thread-Index:
AceCyu12JEluHxWIQ7ClFI22mBkHtgAghwiAAA0iz+AAAC8ZAAK8H9XgAAIRniA=
In-Reply-To:
<435DF58A933BA74397B42CDEB8145A860B8C4AE3@ex9.hostedexchange.local>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028
Disposition-Notification-To: "Carla Redman" <carla.redman@elitegroupinc.ca>
X-Elite Group, Inc.-MailScanner: Found to be clean
X-Elite Group, Inc.-MailScanner-From: carla.redman@elitegroupinc.ca
X-Spam-Status: No

Thanks,

-----Original Message-----
From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of --[ UxBoD ]--
Sent: Wednesday, May 09, 2007 9:08 AM
To: MailScanner discussion
Subject: Re: Issue with Blackberry

Would be useful to see the actual headers, especially the MIME section.

On Wed, 9 May 2007 08:38:05 -0400, "Gerhard Mourani" <gmourani@prival.ca> wrote:
> Hello,
> 
>  
> 
> I'm using MailScanner + Postfix + SpamAssassin on Linux and having strange
> issues with email coming from blackberry servers, here how the received
> email look like:
> 
>  
> 
> Subject: Re: Hand Mixer Trial-Produce Report
> 
>  
> 
> \Ib?HTjy?Z.hm%yXxj?'p?'wJI+{E+.1I?U)?g?g*"(tjdj?6V??6 R w&FR FR&GbV
> v F2fVC 
> ________________________________
> 
> 6wB 6VRB
> 
>  
> 
> &W&o??G2 W&vVB 6RVVFVBf"7[1] FW7Fp??F0?? 
> ________________________________
> 
> V&V6? &GV7B 
> ________________________________
> 
> vW" 
> ________________________________
> 
> 6V6 
> ________________________________
> 
> 2?F&V7B?S 
> ________________________________
> 
> SB 
> ________________________________
> 
> ##r 
> ________________________________
> 
> s3r[1]??&v 
> ________________________________
> 
> W76vR?g&?[1]$FfBVr" 
> ________________________________
> 
> FfBVt VIFVw&W26?FFSGVR 
> ________________________________
> 
> ________________________________
> 
> ________________________________
> 
> # 
> ________________________________
> 
> ________________________________
> 
> r 
> ________________________________
> 
> ##?F&fW&F" 
> ________________________________
> 
> fW&FF?VIFVw&W26&W&2&W&" 
> ________________________________
> 
> W&2 &W&VIFVw&W26?63&FFv"" 
> ________________________________
> 
> FFv$VIFVw&W26%6Tr" 
> ________________________________
> 
> 6Rt 6V626&V&V" 
> ________________________________
> 
> V&V6 6V626'6G&'W&F" 
> ________________________________
> 
> 6G&'W&FVIFVw&W26&VWB" 
> ________________________________
> 
> VWBGW&W6vTVIFVw&W26&VFV" 
> ________________________________
> 
> VFV6 VVIFVw&W266TVIFVw&W26&V'F" 
> ________________________________
> 
> zV'FVIFVw&W26$FR" 
> ________________________________
> 
> zFRWG64VIFVw&W 26&FfBGW&" 
> ________________________________
> 
> FfBGW&VIFVw&W26%F" 
> ________________________________
> 
> FTVIFVw&W26'o R" 
> ________________________________
> 
> oTVIFVw&W26&66r" 
> ________________________________
> 
> ?66tVIFVw&W26&'R" 
> ________________________________
> 
> 'TVIFVw&W26$66R" 
> ________________________________
> 
> 66VF v?v6%6&?R" 
> ________________________________
> 
> F?6$6" 
> ________________________________
> 
> ?6Fv?v6&VfVr" 
> ________________________________
> 
> VfVtF?6?7V&V7C 
> ________________________________
> 
> B 
> ________________________________
> 
> ?W"G& &GV6R&W'@??FV" 
> ________________________________
> 
> fW&FW&2V6R 6VRB?W" G&
> 
>  
> 
> &GV7" &W'B7V7F &W7VB2fVB&W7B &Vv&G2FfBVpVIFR 
> ________________________________
> 
> w&W[1] 
> ________________________________
> 
> 2 
> ________________________________
> 
> 6 
> ________________________________
> 
> ff6P&S 
> ________________________________
> 
> b3 
> ________________________________
> 
> ________________________________
> 
> cs#cV?VIFW2?6 
> ________________________________
> 
> c26? 
> ________________________________
> 
> FVIFW2?6 
> ________________________________
> 
> c26R#FfBVtVIFVw&W26 
> ________________________________
> 
> FFfBVtVIFVw&W26vV'6FS wwrVIFVw&W26 
> ________________________________
> 
> ?GG 
> ________________________________
> 
> wwrVIFVw&W26%F2Vf76?R6F26fFVFf&FFVFVBof" FR W6Rb FR W'6VB&fR 
> ________________________________
> 
> b R&RB FRFVFVB &V6VBb F2Vf76?R" FRVVR"vVB &W76&Rf"FVIfW&rB
> F FRFVFVB &V6VB R&RW&V'FfVB FBF76V?F"6 |*[1]b F2Vf76?\*[1]2
> 7G&7Fo
> 
>  
> 
> &&FVB 
> ________________________________
> 
> b RfR &V6VfVB F2Vf76?RW'&" V6R &WGW& F W2C 
> ________________________________
> 
> sR6RGR 
> ________________________________
> 
> g&W&R 
> ________________________________
> 
> G&R 
> ________________________________
> 
> G&VVV&V2*[1] 
> ________________________________
> 
> 6F 
> ________________________________
> 
> 4" 
> ________________________________
> 
> 5,*[1]'fC 
> ________________________________
> 
> SB? 
> ________________________________
> 
> rS#s " F FR 6VFW"w2VFG&W72F6FVB&fR
> 
>  
> 
> Gerhard,
> 
> 
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> 
> 
>
-- 
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
// Phone: +44 (0) 845 869 2749  SIP: uxbod@sip.splatnix.net


-- 
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.

--
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

From mkettler at evi-inc.com  Wed May  9 21:29:51 2007
From: mkettler at evi-inc.com (Matt Kettler)
Date: Wed May  9 21:30:05 2007
Subject: OT: Installing Mail-ClamAV-0.20 fails...
In-Reply-To: <sentwed09may2007211908gmtbstajos1@sonicbadger.com>
References: <sentwed09may2007211908gmtbstajos1@sonicbadger.com>
Message-ID: <46422F3F.4010204@evi-inc.com>

ajos1@onion.demon.co.uk wrote:
> -
> 
> Anyone have ideas on this one... I have googled the errors... and see alot of mentions of this error and that the original author needs to fix them... but no solutions!
> 
> It does the same for Mail-ClamAV-0.13 .
> 
> Thanks in advance-o.

Any chance you installed clamav from a distribution package, instead of source?

Did you install the -devel package?

Based on the messages you got, it looks like the header files for the clamav
libraries (ie: clamav.h) are missing or empty.

From doc at maddoc.net  Wed May  9 21:31:56 2007
From: doc at maddoc.net (Doc Schneider)
Date: Wed May  9 21:32:04 2007
Subject: OT: Installing Mail-ClamAV-0.20 fails...
In-Reply-To: <sentwed09may2007211908gmtbstajos1@sonicbadger.com>
References: <sentwed09may2007211908gmtbstajos1@sonicbadger.com>
Message-ID: <46422FBC.5010902@maddoc.net>

ajos1@onion.demon.co.uk wrote:
> -
> 
> Anyone have ideas on this one... I have googled the errors... and see alot of mentions of this error and that the original author needs to fix them... but no solutions!
> 
> It does the same for Mail-ClamAV-0.13 .
> 
> Thanks in advance-o.
> 
> My "Inline" version is 0.44 .
> Perl is: Perl: 5.008008 (5.8.8)
> 
> Installing Perl Module  - Mail-ClamAV-0.20
> ------------------------------------------
> 
> CPAN: File::HomeDir loaded ok (v0.64)
> CPAN: Storable loaded ok (v2.16)
> Going to read /root/.cpan/Metadata
>   Database was generated on Tue, 08 May 2007 05:10:52 GMT
> Running install for module 'Mail::ClamAV'
> Running make for S/SA/SABECK/Mail-ClamAV-0.20.tar.gz
> CPAN: Digest::SHA loaded ok (v5.44)
> CPAN: Compress::Zlib loaded ok (v2.004)
> Checksum for /root/.cpan/sources/authors/id/S/SA/SABECK/Mail-ClamAV-0.20.tar.gz ok
> Mail-ClamAV-0.20/
> Mail-ClamAV-0.20/t/
> Mail-ClamAV-0.20/t/eicarcom2.zip
> Mail-ClamAV-0.20/t/Mail-ClamAV.t
> Mail-ClamAV-0.20/t/virus.eml
> Mail-ClamAV-0.20/Inline/
> Mail-ClamAV-0.20/Inline/MakeMaker.pm
> Mail-ClamAV-0.20/META.yml
> Mail-ClamAV-0.20/config.pl
> Mail-ClamAV-0.20/Changes
> Mail-ClamAV-0.20/MANIFEST
> Mail-ClamAV-0.20/ClamAV.pm
> Mail-ClamAV-0.20/INSTALL
> Mail-ClamAV-0.20/Makefile.PL
> Mail-ClamAV-0.20/README
> CPAN: File::Temp loaded ok (v0.18)
> 
>   CPAN.pm: Going to build S/SA/SABECK/Mail-ClamAV-0.20.tar.gz
> 
> Checking if your kit is complete...
> Looks good
> Writing Makefile for Mail::ClamAV
> CPAN: YAML loaded ok (v0.62)
> cp ClamAV.pm blib/lib/Mail/ClamAV.pm
> /usr/bin/perl -Mblib -MInline=NOISY,_INSTALL_ -MMail::ClamAV -e1 0.20 blib/arch
> Starting Build Prepocess Stage
> Finished Build Prepocess Stage
> 
> Starting Build Parse Stage
> Finished Build Parse Stage
> 
> Starting Build Glue 1 Stage
> Finished Build Glue 1 Stage
> 
> Starting Build Glue 2 Stage
> Finished Build Glue 2 Stage
> 
> Starting Build Glue 3 Stage
> Finished Build Glue 3 Stage
> 
> Starting Build Compile Stage
>   Starting "perl Makefile.PL" Stage
> Writing Makefile for Mail::ClamAV
>   Finished "perl Makefile.PL" Stage
> 
>   Starting "make" Stage
> make[1]: Entering directory `/root/.cpan/build/Mail-ClamAV-0.20-Cd7OP6/_Inline/build/Mail/ClamAV'
> /usr/bin/perl /usr/lib/perl5/5.8.8/ExtUtils/xsubpp  -typemap /usr/lib/perl5/5.8.8/ExtUtils/typemap   ClamAV.xs > ClamAV.xsc && mv ClamAV.xsc ClamAV.c
> gcc -c  -I/root/.cpan/build/Mail-ClamAV-0.20-Cd7OP6 -I/usr/local/include -D_REENTRANT -D_GNU_SOURCE -fno-strict-aliasing -pipe -Wdeclaration-after-statement -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m32 -march=i386 -mtune=generic -fasynchronous-unwind-tables   -DVERSION=\"0.20\" -DXS_VERSION=\"0.20\" -fPIC "-I/usr/lib/perl5/5.8.8/i386-linux-thread-multi/CORE"   ClamAV.c
> ClamAV.xs: In function 'clamav_perl_new':
> ClamAV.xs:53: warning: implicit declaration of function 'cl_loaddbdir'
> ClamAV.xs:56: warning: implicit declaration of function 'cl_loaddb'
> ClamAV.xs: In function 'clamav_perl__scanfd':
> ClamAV.xs:202: warning: unused variable 'items'
> ClamAV.xs:197: warning: unused variable 'len'
> ClamAV.xs: In function 'clamav_perl__scanfile':
> ClamAV.xs:239: warning: unused variable 'items'
> ClamAV.xs:233: warning: unused variable 'len'
> ClamAV.xs: In function 'clamav_perl_constant':
> ClamAV.xs:350: error: 'CL_SCAN_ALGORITHMIC' undeclared (first use in this function)
> ClamAV.xs:350: error: (Each undeclared identifier is reported only once
> ClamAV.xs:350: error: for each function it appears in.)
> make[1]: *** [ClamAV.o] Error 1
> make[1]: Leaving directory `/root/.cpan/build/Mail-ClamAV-0.20-Cd7OP6/_Inline/build/Mail/ClamAV'
> 
> A problem was encountered while attempting to compile and install your Inline
> C code. The command that failed was:
>   make
> 
> The build directory was:
> /root/.cpan/build/Mail-ClamAV-0.20-Cd7OP6/_Inline/build/Mail/ClamAV
> 
> To debug the problem, cd to the build directory, and inspect the output files.
> 
>  at /root/.cpan/build/Mail-ClamAV-0.20-Cd7OP6/blib/lib/Mail/ClamAV.pm line 178
> BEGIN failed--compilation aborted at /root/.cpan/build/Mail-ClamAV-0.20-Cd7OP6/blib/lib/Mail/ClamAV.pm line 542.
> Compilation failed in require.
> BEGIN failed--compilation aborted.
> make: *** [ClamAV.inl] Error 25
>   SABECK/Mail-ClamAV-0.20.tar.gz
>   /usr/bin/make -- NOT OK
> Running make test
>   Can't test without successful make
> Running make install
>   Make had returned bad status, install seems impossible
> 
> ==
> =====================================================================
> =
> = "It is obvious the Treasurer is rolling in money," said Wayne
> =  Swan, treasury spokesman for the opposition Labor Party. "It has
> =  been raining gold bars thanks to the mining boom."
> =
> =  Need help dealing with Parking Tickets, Bailiffs, Capita or NTL...
> =  Call...    +44 8457 90 90 90    http://www.samaritans.org/
> =
> =====================================================================

After installing Clamav-0.90.2 make sure you check your /etc/ld.so.conf
has the path to the new libraries. then run 'ldconfig'

I ran into this one quite a bit.

-- 
-Doc
Lincoln, NE.
http://www.genealogyforyou.com/
http://www.cairnproductions.com/

From ajos1 at onion.demon.co.uk  Wed May  9 22:02:21 2007
From: ajos1 at onion.demon.co.uk (ajos1@onion.demon.co.uk)
Date: Wed May  9 22:02:36 2007
Subject: OT: Installing Mail-ClamAV-0.20 fails...
Message-ID: <sentwed09may2007220221gmtbstajos1@sonicbadger.com>

-

Thanks   mkettler and doc , you both made me check that my clamav was as upto date as possible... it looks like 90.RC3 had some issues fixed by 90.2 .

I did have the source install of :- clamav-0.90rc3.tar.gz

When I did :-   find / -name clamav.h  it came up with...

/usr/local/include/clamav.h

Installing Mail-ClamAV-0.20 fails...

It was only when I did the correct install of :- clamav-0.90.2.tar.gz that the install of Mail-ClamAV-0.20 worked perfectly...

I promise, if I ask another silly question... I will wear a set of these on my head... in public...

http://www.cafepress.com/mailscanner2,mailscanner.4367945

Ta's a-lot-o.

-----Original Message-----
From: mailscanner@lists.mailscanner.info
Subj: Re: OT: Installing Mail-ClamAV-0.20 fails...
Date: Wed, 09 May 2007 16:29:51 -0400

ajos1@onion.demon.co.uk wrote:
> -
> 
> Anyone have ideas on this one... I have googled the errors... and see alot of mentions of this error and that the original author needs to fix them... but no solutions!
> 
> It does the same for Mail-ClamAV-0.13 .
> 
> Thanks in advance-o.

Any chance you installed clamav from a distribution package, instead of source?

Did you install the -devel package?

Based on the messages you got, it looks like the header files for the clamav
libraries (ie: clamav.h) are missing or empty.

-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 

==
=====================================================================
=
= "It is obvious the Treasurer is rolling in money," said Wayne
=  Swan, treasury spokesman for the opposition Labor Party. "It has
=  been raining gold bars thanks to the mining boom."
=
=  Need help dealing with Parking Tickets, Bailiffs, Capita or NTL...
=  Call...    +44 8457 90 90 90    http://www.samaritans.org/
=
=====================================================================
From res at ausics.net  Wed May  9 23:45:16 2007
From: res at ausics.net (Res)
Date: Wed May  9 23:45:29 2007
Subject: MailScanner w/ Qmail / Plesk ( format error: file is too short )
In-Reply-To: <C2678236.DF72%cplists@princeservices.com>
References: <C2678236.DF72%cplists@princeservices.com>
Message-ID: <Pine.LNX.4.64.0705100837370.4706@ebfjryy.nhfvpf.arg>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Cameron,
The qms stuff has never been tested with mailwatch, as the 
environments in which it was developed and is used in does
not use mailwatch.


On Wed, 9 May 2007, Cameron B. Prince wrote:

> Once I run MailScanner, it reads the file in the queue but fails with the
> same error:
>
> /usr/sbin/MailScanner
> In Debugging mode, not forking...
> Ignore errors about failing to find EOCD signature
> format error: file is too short
> at /usr/sbin/MailScanner line 832
> Stopping now as you are debugging me.
> commit ineffective with AutoCommit enabled at
> /usr/lib/MailScanner/MailScanner/CustomFunctions/MailWatch.pm line 93,
> <CLIENT> line 34.
> Commmit ineffective while AutoCommit is on at
> /usr/lib/MailScanner/MailScanner/CustomFunctions/MailWatch.pm line 93,
> <CLIENT> line 34.


- --
Cheers
Res

Vote for your favourite MTA at  http://polls.ausics.net/v3.php
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGQk7/sWhAmSIQh7MRAs8jAJ9y9hOkrLbtw0aGE91iBCdIqFuzQQCgivqo
v3JS/P86jzML5EmLO2vBE3c=
=J/v3
-----END PGP SIGNATURE-----
From cplists at princeservices.com  Thu May 10 00:50:40 2007
From: cplists at princeservices.com (Cameron B. Prince)
Date: Thu May 10 00:50:46 2007
Subject: MailScanner w/ Qmail / Plesk ( format error: file is too short )
In-Reply-To: <Pine.LNX.4.64.0705100837370.4706@ebfjryy.nhfvpf.arg>
Message-ID: <C267C880.DF9C%cplists@princeservices.com>

Hi Res,

I disabled MailWatch and tested again with the same results:

[root@secure MailScanner]# /usr/sbin/MailScanner
In Debugging mode, not forking...
Ignore errors about failing to find EOCD signature
format error: file is too short
 at /usr/sbin/MailScanner line 832
Stopping now as you are debugging me.

It doesn't look like the problem is related to MailWatch.

Thanks,
Cameron


On 5/9/07 5:45 PM, "Res" <res@ausics.net> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> 
> Cameron,
> The qms stuff has never been tested with mailwatch, as the
> environments in which it was developed and is used in does
> not use mailwatch.
> 
> 
> On Wed, 9 May 2007, Cameron B. Prince wrote:
> 
>> Once I run MailScanner, it reads the file in the queue but fails with the
>> same error:
>> 
>> /usr/sbin/MailScanner
>> In Debugging mode, not forking...
>> Ignore errors about failing to find EOCD signature
>> format error: file is too short
>> at /usr/sbin/MailScanner line 832
>> Stopping now as you are debugging me.
>> commit ineffective with AutoCommit enabled at
>> /usr/lib/MailScanner/MailScanner/CustomFunctions/MailWatch.pm line 93,
>> <CLIENT> line 34.
>> Commmit ineffective while AutoCommit is on at
>> /usr/lib/MailScanner/MailScanner/CustomFunctions/MailWatch.pm line 93,
>> <CLIENT> line 34.
> 
> 
> - --
> Cheers
> Res
> 
> Vote for your favourite MTA at  http://polls.ausics.net/v3.php
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.6 (GNU/Linux)
> 
> iD8DBQFGQk7/sWhAmSIQh7MRAs8jAJ9y9hOkrLbtw0aGE91iBCdIqFuzQQCgivqo
> v3JS/P86jzML5EmLO2vBE3c=
> =J/v3
> -----END PGP SIGNATURE-----


From res at ausics.net  Thu May 10 01:05:59 2007
From: res at ausics.net (Res)
Date: Thu May 10 01:06:10 2007
Subject: MailScanner w/ Qmail / Plesk ( format error: file is too short )
In-Reply-To: <C267C880.DF9C%cplists@princeservices.com>
References: <C267C880.DF9C%cplists@princeservices.com>
Message-ID: <Pine.LNX.4.64.0705101000210.4988@ebfjryy.nhfvpf.arg>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

What version of MailScanner are you using? Current I hope :)
Is your MailScanner languages.conf file OK ?



On Wed, 9 May 2007, Cameron B. Prince wrote:

> Hi Res,
>
> I disabled MailWatch and tested again with the same results:
>
> [root@secure MailScanner]# /usr/sbin/MailScanner
> In Debugging mode, not forking...
> Ignore errors about failing to find EOCD signature
> format error: file is too short
> at /usr/sbin/MailScanner line 832
> Stopping now as you are debugging me.
>
> It doesn't look like the problem is related to MailWatch.
>
> Thanks,
> Cameron
>
>
> On 5/9/07 5:45 PM, "Res" <res@ausics.net> wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>>
>> Cameron,
>> The qms stuff has never been tested with mailwatch, as the
>> environments in which it was developed and is used in does
>> not use mailwatch.
>>
>>
>> On Wed, 9 May 2007, Cameron B. Prince wrote:
>>
>>> Once I run MailScanner, it reads the file in the queue but fails with the
>>> same error:
>>>
>>> /usr/sbin/MailScanner
>>> In Debugging mode, not forking...
>>> Ignore errors about failing to find EOCD signature
>>> format error: file is too short
>>> at /usr/sbin/MailScanner line 832
>>> Stopping now as you are debugging me.
>>> commit ineffective with AutoCommit enabled at
>>> /usr/lib/MailScanner/MailScanner/CustomFunctions/MailWatch.pm line 93,
>>> <CLIENT> line 34.
>>> Commmit ineffective while AutoCommit is on at
>>> /usr/lib/MailScanner/MailScanner/CustomFunctions/MailWatch.pm line 93,
>>> <CLIENT> line 34.
>>
>>
>> - --
>> Cheers
>> Res
>>
>> Vote for your favourite MTA at  http://polls.ausics.net/v3.php
>> -----BEGIN PGP SIGNATURE-----
>> Version: GnuPG v1.4.6 (GNU/Linux)
>>
>> iD8DBQFGQk7/sWhAmSIQh7MRAs8jAJ9y9hOkrLbtw0aGE91iBCdIqFuzQQCgivqo
>> v3JS/P86jzML5EmLO2vBE3c=
>> =J/v3
>> -----END PGP SIGNATURE-----
>
>
>

- -- 

Cheers
Res

Vote for your favourite MTA at  http://polls.ausics.net/v3.php
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGQmHpsWhAmSIQh7MRAqlqAJ9SYJoleoHNaphQjAxIRRz+sI+wJgCcCNeR
TGGsttpM+lLYglZRhyCOFj8=
=coq7
-----END PGP SIGNATURE-----
From cplists at princeservices.com  Thu May 10 04:06:30 2007
From: cplists at princeservices.com (Cameron B. Prince)
Date: Thu May 10 04:06:38 2007
Subject: MailScanner w/ Qmail / Plesk ( format error: file is too short )
In-Reply-To: <Pine.LNX.4.64.0705101000210.4988@ebfjryy.nhfvpf.arg>
Message-ID: <C267F666.DFA6%cplists@princeservices.com>

Hi Res,

Yes, it's current:

Version number in MailScanner.conf (4.58.9) is correct.

I haven't touched the languages.conf file but is there some way to make sure
it's okay?

I did some Googling and it seems the error, "format error: file is too
short", comes from Archive::Zip. I am not sure how this fits in with things
but maybe that will give someone a clue as to what the problem is.

Thanks,
Cameron


On 5/9/07 7:05 PM, "Res" <res@ausics.net> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hi,
> 
> What version of MailScanner are you using? Current I hope :)
> Is your MailScanner languages.conf file OK ?
> 
> 
> 
> On Wed, 9 May 2007, Cameron B. Prince wrote:
> 
>> Hi Res,
>> 
>> I disabled MailWatch and tested again with the same results:
>> 
>> [root@secure MailScanner]# /usr/sbin/MailScanner
>> In Debugging mode, not forking...
>> Ignore errors about failing to find EOCD signature
>> format error: file is too short
>> at /usr/sbin/MailScanner line 832
>> Stopping now as you are debugging me.
>> 
>> It doesn't look like the problem is related to MailWatch.
>> 
>> Thanks,
>> Cameron
>> 
>> 
>> On 5/9/07 5:45 PM, "Res" <res@ausics.net> wrote:
>> 
>>> -----BEGIN PGP SIGNED MESSAGE-----
>>> Hash: SHA1
>>> 
>>> 
>>> Cameron,
>>> The qms stuff has never been tested with mailwatch, as the
>>> environments in which it was developed and is used in does
>>> not use mailwatch.
>>> 
>>> 
>>> On Wed, 9 May 2007, Cameron B. Prince wrote:
>>> 
>>>> Once I run MailScanner, it reads the file in the queue but fails with the
>>>> same error:
>>>> 
>>>> /usr/sbin/MailScanner
>>>> In Debugging mode, not forking...
>>>> Ignore errors about failing to find EOCD signature
>>>> format error: file is too short
>>>> at /usr/sbin/MailScanner line 832
>>>> Stopping now as you are debugging me.
>>>> commit ineffective with AutoCommit enabled at
>>>> /usr/lib/MailScanner/MailScanner/CustomFunctions/MailWatch.pm line 93,
>>>> <CLIENT> line 34.
>>>> Commmit ineffective while AutoCommit is on at
>>>> /usr/lib/MailScanner/MailScanner/CustomFunctions/MailWatch.pm line 93,
>>>> <CLIENT> line 34.
>>> 
>>> 
>>> - --
>>> Cheers
>>> Res
>>> 
>>> Vote for your favourite MTA at  http://polls.ausics.net/v3.php
>>> -----BEGIN PGP SIGNATURE-----
>>> Version: GnuPG v1.4.6 (GNU/Linux)
>>> 
>>> iD8DBQFGQk7/sWhAmSIQh7MRAs8jAJ9y9hOkrLbtw0aGE91iBCdIqFuzQQCgivqo
>>> v3JS/P86jzML5EmLO2vBE3c=
>>> =J/v3
>>> -----END PGP SIGNATURE-----
>> 
>> 
>> 
> 
> - -- 
> 
> Cheers
> Res
> 
> Vote for your favourite MTA at  http://polls.ausics.net/v3.php
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.6 (GNU/Linux)
> 
> iD8DBQFGQmHpsWhAmSIQh7MRAqlqAJ9SYJoleoHNaphQjAxIRRz+sI+wJgCcCNeR
> TGGsttpM+lLYglZRhyCOFj8=
> =coq7
> -----END PGP SIGNATURE-----


From res at ausics.net  Thu May 10 04:25:28 2007
From: res at ausics.net (Res)
Date: Thu May 10 04:25:41 2007
Subject: MailScanner w/ Qmail / Plesk ( format error: file is too short )
In-Reply-To: <C267F666.DFA6%cplists@princeservices.com>
References: <C267F666.DFA6%cplists@princeservices.com>
Message-ID: <Pine.LNX.4.64.0705101324420.5574@ebfjryy.nhfvpf.arg>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

Please disable spamassassin and retest


On Wed, 9 May 2007, Cameron B. Prince wrote:

> Hi Res,
>
> Yes, it's current:
>
> Version number in MailScanner.conf (4.58.9) is correct.
>
> I haven't touched the languages.conf file but is there some way to make sure
> it's okay?
>
> I did some Googling and it seems the error, "format error: file is too
> short", comes from Archive::Zip. I am not sure how this fits in with things
> but maybe that will give someone a clue as to what the problem is.
>
> Thanks,
> Cameron
>
>
> On 5/9/07 7:05 PM, "Res" <res@ausics.net> wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Hi,
>>
>> What version of MailScanner are you using? Current I hope :)
>> Is your MailScanner languages.conf file OK ?
>>
>>
>>
>> On Wed, 9 May 2007, Cameron B. Prince wrote:
>>
>>> Hi Res,
>>>
>>> I disabled MailWatch and tested again with the same results:
>>>
>>> [root@secure MailScanner]# /usr/sbin/MailScanner
>>> In Debugging mode, not forking...
>>> Ignore errors about failing to find EOCD signature
>>> format error: file is too short
>>> at /usr/sbin/MailScanner line 832
>>> Stopping now as you are debugging me.
>>>
>>> It doesn't look like the problem is related to MailWatch.
>>>
>>> Thanks,
>>> Cameron
>>>
>>>
>>> On 5/9/07 5:45 PM, "Res" <res@ausics.net> wrote:
>>>
>>>> -----BEGIN PGP SIGNED MESSAGE-----
>>>> Hash: SHA1
>>>>
>>>>
>>>> Cameron,
>>>> The qms stuff has never been tested with mailwatch, as the
>>>> environments in which it was developed and is used in does
>>>> not use mailwatch.
>>>>
>>>>
>>>> On Wed, 9 May 2007, Cameron B. Prince wrote:
>>>>
>>>>> Once I run MailScanner, it reads the file in the queue but fails with the
>>>>> same error:
>>>>>
>>>>> /usr/sbin/MailScanner
>>>>> In Debugging mode, not forking...
>>>>> Ignore errors about failing to find EOCD signature
>>>>> format error: file is too short
>>>>> at /usr/sbin/MailScanner line 832
>>>>> Stopping now as you are debugging me.
>>>>> commit ineffective with AutoCommit enabled at
>>>>> /usr/lib/MailScanner/MailScanner/CustomFunctions/MailWatch.pm line 93,
>>>>> <CLIENT> line 34.
>>>>> Commmit ineffective while AutoCommit is on at
>>>>> /usr/lib/MailScanner/MailScanner/CustomFunctions/MailWatch.pm line 93,
>>>>> <CLIENT> line 34.
>>>>
>>>>
>>>> - --
>>>> Cheers
>>>> Res
>>>>
>>>> Vote for your favourite MTA at  http://polls.ausics.net/v3.php
>>>> -----BEGIN PGP SIGNATURE-----
>>>> Version: GnuPG v1.4.6 (GNU/Linux)
>>>>
>>>> iD8DBQFGQk7/sWhAmSIQh7MRAs8jAJ9y9hOkrLbtw0aGE91iBCdIqFuzQQCgivqo
>>>> v3JS/P86jzML5EmLO2vBE3c=
>>>> =J/v3
>>>> -----END PGP SIGNATURE-----
>>>
>>>
>>>
>>
>> - --
>>
>> Cheers
>> Res
>>
>> Vote for your favourite MTA at  http://polls.ausics.net/v3.php
>> -----BEGIN PGP SIGNATURE-----
>> Version: GnuPG v1.4.6 (GNU/Linux)
>>
>> iD8DBQFGQmHpsWhAmSIQh7MRAqlqAJ9SYJoleoHNaphQjAxIRRz+sI+wJgCcCNeR
>> TGGsttpM+lLYglZRhyCOFj8=
>> =coq7
>> -----END PGP SIGNATURE-----
>
>
>

- -- 

Cheers
Res

Vote for your favourite MTA at  http://polls.ausics.net/v3.php
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGQpCrsWhAmSIQh7MRAnYYAKCcJe+cWGoFHWrfnVAOW4VMfDhG9gCeNC0J
z9B5TZKHF9EEUR65Q1soguI=
=erk9
-----END PGP SIGNATURE-----
From cplists at princeservices.com  Thu May 10 05:03:12 2007
From: cplists at princeservices.com (Cameron B. Prince)
Date: Thu May 10 05:03:18 2007
Subject: MailScanner w/ Qmail / Plesk ( format error: file is too short )
In-Reply-To: <Pine.LNX.4.64.0705101324420.5574@ebfjryy.nhfvpf.arg>
Message-ID: <C26803B0.DFB0%cplists@princeservices.com>

Hi Res,

I stepped through multiple tests first disabling Spam Checks, then Spam
Assassin, and finally Virus Checks. Still get the same error with all those
set to no.

Here's a --lint test's output:

# /usr/sbin/MailScanner --lint
Read 764 hostnames from the phishing whitelist
Checking version numbers...
Version number in MailScanner.conf (4.58.9) is correct.
MailScanner setting GID to  (2520)
MailScanner setting UID to  (2520)

Checking for SpamAssassin errors (if you use it)...
lock.pl sees Config  LockType =  flock
lock.pl sees have_module =  0
Using locktype = flock
MailScanner.conf says "Virus Scanners = f-prot"
Found these virus scanners installed: f-prot

Is there a way to do an strace or something similar to get more verbose
debugging?

Thanks,
Cameron


On 5/9/07 10:25 PM, "Res" <res@ausics.net> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hi,
> 
> Please disable spamassassin and retest
> 
> 
> On Wed, 9 May 2007, Cameron B. Prince wrote:
> 
>> Hi Res,
>> 
>> Yes, it's current:
>> 
>> Version number in MailScanner.conf (4.58.9) is correct.
>> 
>> I haven't touched the languages.conf file but is there some way to make sure
>> it's okay?
>> 
>> I did some Googling and it seems the error, "format error: file is too
>> short", comes from Archive::Zip. I am not sure how this fits in with things
>> but maybe that will give someone a clue as to what the problem is.
>> 
>> Thanks,
>> Cameron
>> 
>> 
>> On 5/9/07 7:05 PM, "Res" <res@ausics.net> wrote:
>> 
>>> -----BEGIN PGP SIGNED MESSAGE-----
>>> Hash: SHA1
>>> 
>>> Hi,
>>> 
>>> What version of MailScanner are you using? Current I hope :)
>>> Is your MailScanner languages.conf file OK ?
>>> 
>>> 
>>> 
>>> On Wed, 9 May 2007, Cameron B. Prince wrote:
>>> 
>>>> Hi Res,
>>>> 
>>>> I disabled MailWatch and tested again with the same results:
>>>> 
>>>> [root@secure MailScanner]# /usr/sbin/MailScanner
>>>> In Debugging mode, not forking...
>>>> Ignore errors about failing to find EOCD signature
>>>> format error: file is too short
>>>> at /usr/sbin/MailScanner line 832
>>>> Stopping now as you are debugging me.
>>>> 
>>>> It doesn't look like the problem is related to MailWatch.
>>>> 
>>>> Thanks,
>>>> Cameron
>>>> 
>>>> 
>>>> On 5/9/07 5:45 PM, "Res" <res@ausics.net> wrote:
>>>> 
>>>>> -----BEGIN PGP SIGNED MESSAGE-----
>>>>> Hash: SHA1
>>>>> 
>>>>> 
>>>>> Cameron,
>>>>> The qms stuff has never been tested with mailwatch, as the
>>>>> environments in which it was developed and is used in does
>>>>> not use mailwatch.
>>>>> 
>>>>> 
>>>>> On Wed, 9 May 2007, Cameron B. Prince wrote:
>>>>> 
>>>>>> Once I run MailScanner, it reads the file in the queue but fails with the
>>>>>> same error:
>>>>>> 
>>>>>> /usr/sbin/MailScanner
>>>>>> In Debugging mode, not forking...
>>>>>> Ignore errors about failing to find EOCD signature
>>>>>> format error: file is too short
>>>>>> at /usr/sbin/MailScanner line 832
>>>>>> Stopping now as you are debugging me.
>>>>>> commit ineffective with AutoCommit enabled at
>>>>>> /usr/lib/MailScanner/MailScanner/CustomFunctions/MailWatch.pm line 93,
>>>>>> <CLIENT> line 34.
>>>>>> Commmit ineffective while AutoCommit is on at
>>>>>> /usr/lib/MailScanner/MailScanner/CustomFunctions/MailWatch.pm line 93,
>>>>>> <CLIENT> line 34.
>>>>> 
>>>>> 
>>>>> - --
>>>>> Cheers
>>>>> Res
>>>>> 
>>>>> Vote for your favourite MTA at  http://polls.ausics.net/v3.php
>>>>> -----BEGIN PGP SIGNATURE-----
>>>>> Version: GnuPG v1.4.6 (GNU/Linux)
>>>>> 
>>>>> iD8DBQFGQk7/sWhAmSIQh7MRAs8jAJ9y9hOkrLbtw0aGE91iBCdIqFuzQQCgivqo
>>>>> v3JS/P86jzML5EmLO2vBE3c=
>>>>> =J/v3
>>>>> -----END PGP SIGNATURE-----
>>>> 
>>>> 
>>>> 
>>> 
>>> - --
>>> 
>>> Cheers
>>> Res
>>> 
>>> Vote for your favourite MTA at  http://polls.ausics.net/v3.php
>>> -----BEGIN PGP SIGNATURE-----
>>> Version: GnuPG v1.4.6 (GNU/Linux)
>>> 
>>> iD8DBQFGQmHpsWhAmSIQh7MRAqlqAJ9SYJoleoHNaphQjAxIRRz+sI+wJgCcCNeR
>>> TGGsttpM+lLYglZRhyCOFj8=
>>> =coq7
>>> -----END PGP SIGNATURE-----
>> 
>> 
>> 
> 
> - -- 
> 
> Cheers
> Res
> 
> Vote for your favourite MTA at  http://polls.ausics.net/v3.php
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.6 (GNU/Linux)
> 
> iD8DBQFGQpCrsWhAmSIQh7MRAnYYAKCcJe+cWGoFHWrfnVAOW4VMfDhG9gCeNC0J
> z9B5TZKHF9EEUR65Q1soguI=
> =erk9
> -----END PGP SIGNATURE-----


From res at ausics.net  Thu May 10 05:40:24 2007
From: res at ausics.net (Res)
Date: Thu May 10 05:40:36 2007
Subject: MailScanner w/ Qmail / Plesk ( format error: file is too short )
In-Reply-To: <C26803B0.DFB0%cplists@princeservices.com>
References: <C26803B0.DFB0%cplists@princeservices.com>
Message-ID: <Pine.LNX.4.64.0705101416530.5707@ebfjryy.nhfvpf.arg>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

On Wed, 9 May 2007, Cameron B. Prince wrote:

> Version number in MailScanner.conf (4.58.9) is correct.

> MailScanner setting GID to  (2520)
> MailScanner setting UID to  (2520)

This seems strange if you are using qmail. UID and GID should differ,
UID is qmailq, GID is qmail

Make sure qmail can write to your MS working dir

> Is there a way to do an strace or something similar to get more verbose
> debugging?

- --lint --debug

also try this, if you are certain it is to do with archive::zip (i'm not 
convinced myself)

Whats the output of:

perl -MArchive::Zip -le "print Archive::Zip->VERSION";

....Should return 1.18 if lower, upgrade that package, it can't hurt.

grep -i qmail MailScanner.conf

and you should see:

Run As User = qmailq
Run As Group = qmail
Incoming Queue Dir = /var/qmail/queue.in/mess
Outgoing Queue Dir = /var/qmail/queue/mess
MTA = qmail
Sendmail = /var/qmail/bin/qmail-inject.mailscanner
Sendmail2 = /var/qmail/bin/qmail-inject.mailscanner


- -- 

Cheers
Res

Vote for your favourite MTA at  http://polls.ausics.net/v3.php
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGQqI7sWhAmSIQh7MRAn7bAKClQArgk0BmZRsN+BvUJQmDYGCzkACfTpwZ
5NrqAUMlfPYogzWvx4gVh8E=
=4S6f
-----END PGP SIGNATURE-----
From cplists at princeservices.com  Thu May 10 06:22:41 2007
From: cplists at princeservices.com (Cameron B. Prince)
Date: Thu May 10 06:22:46 2007
Subject: MailScanner w/ Qmail / Plesk ( format error: file is too short )
In-Reply-To: <Pine.LNX.4.64.0705101416530.5707@ebfjryy.nhfvpf.arg>
Message-ID: <C2681651.DFB7%cplists@princeservices.com>

Hi Res,

> > Version number in MailScanner.conf (4.58.9) is correct.

> > MailScanner setting GID to  (2520)
> > MailScanner setting UID to  (2520)

> This seems strange if you are using qmail. UID and GID should differ,
> UID is qmailq, GID is qmail

I agree... This is strange, but as you can see from a grep of the config
file, the user and group settings are correct:

Run As User = qmailq
Run As Group = qmail
Incoming Queue Dir = /var/qmail/queue.in/mess
Outgoing Queue Dir = /var/qmail/queue/mess
MTA = Qmail
Sendmail = /var/qmail/bin/qmail-inject.mailscanner
Sendmail2 = /var/qmail/bin/qmail-inject.mailscanner

I noticed the Qmail is lower case in your example... Mine was capitalized by
the setup script. I've read documentation showing it both ways. I left it
capitalized because that matches the MailScanner module name. I switched it
tonight and it made no difference.


> Make sure qmail can write to your MS working dir


Here are the permissions:

drwxr-xr-x  11 qmailq qmail 4096 May  8 22:22 queue
drwxr-xr-x   6 qmailq qmail 4096 May  9 22:54 queue.in



> > Is there a way to do an strace or something similar to get more verbose
> > debugging?

> - --lint --debug

I tried a few variations of this and either got the same output or none.

> also try this, if you are certain it is to do with archive::zip (i'm not
> convinced myself)

> Whats the output of:

> perl -MArchive::Zip -le "print Archive::Zip->VERSION";

> ....Should return 1.18 if lower, upgrade that package, it can't hurt.

I'm by no means convinced... I just saw the same error in a forum post
related to Archive::Zip... I really don't know why that would be called in
this case anyway as the test message has no attachment.

Here's the output:

# perl -MArchive::Zip -le "print Archive::Zip->VERSION";
1.16

I went ahead and upgraded Archive::Zip and noticed that the make test failed
because of missing perquisite File::Which and I thought I was on to
something. I installed both modules and did the test again with the same
results.


The line that generates the error is calling a method called Explode:

$batch->Explode();

I looked over the code in Message.pm and I'm wondering if it could be an
issue with MIME::Parser. What do you think?

Thanks,
Cameron







From res at ausics.net  Thu May 10 06:37:52 2007
From: res at ausics.net (Res)
Date: Thu May 10 06:38:03 2007
Subject: MailScanner w/ Qmail / Plesk ( format error: file is too short )
In-Reply-To: <C2681651.DFB7%cplists@princeservices.com>
References: <C2681651.DFB7%cplists@princeservices.com>
Message-ID: <Pine.LNX.4.64.0705101526290.5946@ebfjryy.nhfvpf.arg>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

On Thu, 10 May 2007, Cameron B. Prince wrote:

>
> I noticed the Qmail is lower case in your example... Mine was capitalized by

Shouldn't matter

>> Make sure qmail can write to your MS working dir
>
> Here are the permissions:
>
> drwxr-xr-x  11 qmailq qmail 4096 May  8 22:22 queue
> drwxr-xr-x   6 qmailq qmail 4096 May  9 22:54 queue.in

Actually I mean your MailScanner temp working dir, like 
/var/spool/MailScanner

chown -R qmailq.qmail /var/spool/MailScanner



the real qmail sources also set permissions diferent than what you have 
above, the queue dir is set 750

do you know what version of qmail plesk installs now days? as in what 
patches? I know it works on plesk from other comments I've had, but I'm 
unsure if those posters are members of this list, I suspectmaybe not? 
since none of them have commented.

Check perms on...

chown qmailq.qmail /var/qmail/bin/qmail-queue
chown root.qmail /var/qmail/bin/qmail-inject.mailscanner
chmod 4755 /var/qmail/bin/qmail-queue
chmod 755 /var/qmail/bin/qmail-inject.mailscanner


>> - --lint --debug
>
> I tried a few variations of this and either got the same output or none.

You'll have to ask Jules on that one.

>
> The line that generates the error is calling a method called Explode:
>
> $batch->Explode();
>
> I looked over the code in Message.pm and I'm wondering if it could be an
> issue with MIME::Parser. What do you think?

I have not looked at that code in a while, I can have alook this evening 
though.

- -- 

Cheers
Res

Vote for your favourite MTA at  http://polls.ausics.net/v3.php
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGQq+ysWhAmSIQh7MRAtMUAKCtG/6mmesYkn9IFfJwhns+WlKumgCePFAW
1D6xPxOCjdH56VhMmefWSM0=
=JB8I
-----END PGP SIGNATURE-----
From steve.freegard at fsl.com  Thu May 10 07:35:45 2007
From: steve.freegard at fsl.com (Steve Freegard)
Date: Thu May 10 07:35:48 2007
Subject: Issue with Blackberry
In-Reply-To: <3123E1B72B666243917E340F3C8FD4A1069703@privaldc2003.prival.local>
References: <3123E1B72B666243917E340F3C8FD4A1069703@privaldc2003.prival.local>
Message-ID: <4642BD41.9070205@fsl.com>

Hi Gehard,

I've seen the problem in the headers that you posted:

> X-Elite Group, Inc.-MailScanner: Found to be clean
> X-Elite Group, Inc.-MailScanner-From: carla.redman@elitegroupinc.ca
                ^^ & ^

On the MailScanner box that processed this message you have a bad 
%org-name% setting.  Quoting MailScanner.conf:

# Note: Some Symantec scanners complain (incorrectly) about "."
# ***** characters appearing in the names of headers.
#       Some other mail servers complain about "_" characters
#       appearing in the names of headers as well.
#       So don't put "." or "_" in this setting.
#
# **** RULE: It must not contain any spaces! ****

Your current %org-name% contains spaces and dots (I personally would 
also avoid commas).  Change it to something like:

%org-name% = Elite-Group-Inc

And it should fix the problem.

Kind regards,
Steve.

--
Steve Freegard
Fort Systems Ltd.
From jan-peter at koopmann.eu  Thu May 10 07:56:14 2007
From: jan-peter at koopmann.eu (Koopmann, Jan-Peter)
Date: Thu May 10 07:56:21 2007
Subject: Clamav suggestions
In-Reply-To: <46422078.6000508@ecs.soton.ac.uk>
References: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it><20070509105522.y9h0nbimg4kg0oks@luna.eco.unibs.it>
	<46422078.6000508@ecs.soton.ac.uk>
Message-ID: <AEF86EFA5497434190F6D57E2666EA7A84EF0E@ERWIN.intern.seceidos.de>

On Wednesday, May 09, 2007 9:27 PM Julian Field wrote:

> I can't see any effective good solution to this one. 

Except for convincing the clamav developers to put in another scan option. When called with this option they would not check for the existance of mail headers. I have no idea how delighted they would be if we proposed this though. Any volunteers? :-)

Kind regards,
  JP
From pedretti at eco.unibs.it  Thu May 10 08:35:15 2007
From: pedretti at eco.unibs.it (Fabio Pedretti)
Date: Thu May 10 08:33:29 2007
Subject: Clamav suggestions
In-Reply-To: <46422078.6000508@ecs.soton.ac.uk>
References: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it>
	<20070509105522.y9h0nbimg4kg0oks@luna.eco.unibs.it>
	<46422078.6000508@ecs.soton.ac.uk>
Message-ID: <20070510093515.sfb5azn34go8s0ww@luna.eco.unibs.it>

Citando Julian Field <MailScanner@ecs.soton.ac.uk>:
>
> Fabio Pedretti wrote:
>>> 2) I noticed (as well as others:
>>> http://lists.mailscanner.info/pipermail/mailscanner/2007-April/072504.html
>>>
>>> ) that some phishing mail are not blocked (I am also using
>>> the signatures of sanesecurity). If I do a clamscan on the full
>>> original mail with headers, clamscan find the virus (I can provide a
>>> sample if needed). Seems the problem is that MailScanner extracts the
>>> content of the mail (body + attachment) and scans it, but some
>>> phishing mail are only detected if the full headers are present (in
>>> the clamav DB in the extended signature format, option 4 is for mail
>>> files, look at signatures.pdf in clamav source, and are detected only
>>> if full mail with headers is scanned).
>>> MailScanner should be modified so that all the original mail (with
>>> headers and without extracting attachment) should be passed to
>>> clamscan/clamd, so all virus can be catched.
>>
>> To try the problem send a mail with the following text:
>> 2.83:9999/webscrr/ind
>> on a MailScanner with clamav mail server.
>> The mail does not get filtered.
>>
>> However if you do a clamscan on the received mail, you get:
>> test.eml: Email.Phishing.Pay-20 FOUND
>>
> If you scan a text file containing the magic string above, clamscan
> doesn't find anything wrong. It *only* spots it if the file has email
> headers in it as well. This is a bit disappointing on the part of
> ClamAV. But it is a very effective defence against false alarms.
> MailScanner extracts all the parts of the message and scans them as
> files. As a result this phishing detector in ClamAV won't be triggered.
>
> I can't see any effective good solution to this one. It does not appear
> to affect anything except this phishing trap (and possible a few other
> phishing traps), so I'm not overly concerned about it. There has been no
> evidence whatsoever that anything more important is let through, and
> MailScanner has its own phishing detectors which should be triggered anyway.

Why not change MailScanner to pass to clamav the full mail with  
headers? Latest clamav does a good job on scanning mail, and has also  
decoder for zip/rar2-3 etc. for decoding compressed attachment.

From pedretti at eco.unibs.it  Thu May 10 08:43:16 2007
From: pedretti at eco.unibs.it (Fabio Pedretti)
Date: Thu May 10 08:41:29 2007
Subject: Clamav suggestions
In-Reply-To: <AEF86EFA5497434190F6D57E2666EA7A84EF0E@ERWIN.intern.seceidos.de>
References: <20070504123613.hz8h28ltwkcko8o8@luna.eco.unibs.it><20070509105522.y9h0nbimg4kg0oks@luna.eco.unibs.it>
	<46422078.6000508@ecs.soton.ac.uk>
	<AEF86EFA5497434190F6D57E2666EA7A84EF0E@ERWIN.intern.seceidos.de>
Message-ID: <20070510094316.ft4nl33mucc88cww@luna.eco.unibs.it>

Citando "Koopmann, Jan-Peter" <jan-peter@koopmann.eu>:

> On Wednesday, May 09, 2007 9:27 PM Julian Field wrote:
>
>> I can't see any effective good solution to this one.
>
> Except for convincing the clamav developers to put in another scan   
> option. When called with this option they would not check for the   
> existance of mail headers. I have no idea how delighted they would   
> be if we proposed this though. Any volunteers? :-)

I don't know if this is a good solution. Clamav check for this strings  
only in mails, as check for macro viruses only in MS files, for unix  
viruses only on ELF files, etc...
I think the problem is in how MailScanner call clamav, giving it all  
separated attachments and not the full mail.

From uxbod at splatnix.net  Thu May 10 09:24:13 2007
From: uxbod at splatnix.net (--[ UxBoD ]--)
Date: Thu May 10 09:24:20 2007
Subject: Clamav suggestions
In-Reply-To: <20070510094316.ft4nl33mucc88cww@luna.eco.unibs.it>
References: <20070510094316.ft4nl33mucc88cww@luna.eco.unibs.it>
Message-ID: <75beaaf4febafe7fbcfebe749e3da29b@62.49.223.244>

Why not just scan the whole file after all the individual scans, but only if it hasn't detected anything in the individual element ones ?

On Thu, 10 May 2007 09:43:16 +0200, Fabio Pedretti <pedretti@eco.unibs.it> wrote:
> Citando "Koopmann, Jan-Peter" <jan-peter@koopmann.eu>:
> 
>> On Wednesday, May 09, 2007 9:27 PM Julian Field wrote:
>>
>>> I can't see any effective good solution to this one.
>>
>> Except for convincing the clamav developers to put in another scan
>> option. When called with this option they would not check for the
>> existance of mail headers. I have no idea how delighted they would
>> be if we proposed this though. Any volunteers? :-)
> 
> I don't know if this is a good solution. Clamav check for this strings
> only in mails, as check for macro viruses only in MS files, for unix
> viruses only on ELF files, etc...
> I think the problem is in how MailScanner call clamav, giving it all
> separated attachments and not the full mail.
> 
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
> 
> --
> This message has been scanned for viruses and dangerous content by
> MailScanner, and is
> believed to be clean.
-- 
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
// Phone: +44 (0) 845 869 2749  SIP: uxbod@sip.splatnix.net


-- 
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.

From MailScanner at ecs.soton.ac.uk  Thu May 10 10:46:21 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Thu May 10 10:47:47 2007
Subject: OT: Installing Mail-ClamAV-0.20 fails...
In-Reply-To: <sentwed09may2007211908gmtbstajos1@sonicbadger.com>
References: <sentwed09may2007211908gmtbstajos1@sonicbadger.com>
Message-ID: <4642E9ED.5070404@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Have you considered installing from my ClamAV+SA package? You can always 
stop it after it installs Mail::ClamAV if you want to.

ajos1@onion.demon.co.uk wrote:
> -
>
> Anyone have ideas on this one... I have googled the errors... and see alot of mentions of this error and that the original author needs to fix them... but no solutions!
>
> It does the same for Mail-ClamAV-0.13 .
>
> Thanks in advance-o.
>
> My "Inline" version is 0.44 .
> Perl is: Perl: 5.008008 (5.8.8)
>
> Installing Perl Module  - Mail-ClamAV-0.20
> ------------------------------------------
>
> CPAN: File::HomeDir loaded ok (v0.64)
> CPAN: Storable loaded ok (v2.16)
> Going to read /root/.cpan/Metadata
>   Database was generated on Tue, 08 May 2007 05:10:52 GMT
> Running install for module 'Mail::ClamAV'
> Running make for S/SA/SABECK/Mail-ClamAV-0.20.tar.gz
> CPAN: Digest::SHA loaded ok (v5.44)
> CPAN: Compress::Zlib loaded ok (v2.004)
> Checksum for /root/.cpan/sources/authors/id/S/SA/SABECK/Mail-ClamAV-0.20.tar.gz ok
> Mail-ClamAV-0.20/
> Mail-ClamAV-0.20/t/
> Mail-ClamAV-0.20/t/eicarcom2.zip
> Mail-ClamAV-0.20/t/Mail-ClamAV.t
> Mail-ClamAV-0.20/t/virus.eml
> Mail-ClamAV-0.20/Inline/
> Mail-ClamAV-0.20/Inline/MakeMaker.pm
> Mail-ClamAV-0.20/META.yml
> Mail-ClamAV-0.20/config.pl
> Mail-ClamAV-0.20/Changes
> Mail-ClamAV-0.20/MANIFEST
> Mail-ClamAV-0.20/ClamAV.pm
> Mail-ClamAV-0.20/INSTALL
> Mail-ClamAV-0.20/Makefile.PL
> Mail-ClamAV-0.20/README
> CPAN: File::Temp loaded ok (v0.18)
>
>   CPAN.pm: Going to build S/SA/SABECK/Mail-ClamAV-0.20.tar.gz
>
> Checking if your kit is complete...
> Looks good
> Writing Makefile for Mail::ClamAV
> CPAN: YAML loaded ok (v0.62)
> cp ClamAV.pm blib/lib/Mail/ClamAV.pm
> /usr/bin/perl -Mblib -MInline=NOISY,_INSTALL_ -MMail::ClamAV -e1 0.20 blib/arch
> Starting Build Prepocess Stage
> Finished Build Prepocess Stage
>
> Starting Build Parse Stage
> Finished Build Parse Stage
>
> Starting Build Glue 1 Stage
> Finished Build Glue 1 Stage
>
> Starting Build Glue 2 Stage
> Finished Build Glue 2 Stage
>
> Starting Build Glue 3 Stage
> Finished Build Glue 3 Stage
>
> Starting Build Compile Stage
>   Starting "perl Makefile.PL" Stage
> Writing Makefile for Mail::ClamAV
>   Finished "perl Makefile.PL" Stage
>
>   Starting "make" Stage
> make[1]: Entering directory `/root/.cpan/build/Mail-ClamAV-0.20-Cd7OP6/_Inline/build/Mail/ClamAV'
> /usr/bin/perl /usr/lib/perl5/5.8.8/ExtUtils/xsubpp  -typemap /usr/lib/perl5/5.8.8/ExtUtils/typemap   ClamAV.xs > ClamAV.xsc && mv ClamAV.xsc ClamAV.c
> gcc -c  -I/root/.cpan/build/Mail-ClamAV-0.20-Cd7OP6 -I/usr/local/include -D_REENTRANT -D_GNU_SOURCE -fno-strict-aliasing -pipe -Wdeclaration-after-statement -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m32 -march=i386 -mtune=generic -fasynchronous-unwind-tables   -DVERSION=\"0.20\" -DXS_VERSION=\"0.20\" -fPIC "-I/usr/lib/perl5/5.8.8/i386-linux-thread-multi/CORE"   ClamAV.c
> ClamAV.xs: In function 'clamav_perl_new':
> ClamAV.xs:53: warning: implicit declaration of function 'cl_loaddbdir'
> ClamAV.xs:56: warning: implicit declaration of function 'cl_loaddb'
> ClamAV.xs: In function 'clamav_perl__scanfd':
> ClamAV.xs:202: warning: unused variable 'items'
> ClamAV.xs:197: warning: unused variable 'len'
> ClamAV.xs: In function 'clamav_perl__scanfile':
> ClamAV.xs:239: warning: unused variable 'items'
> ClamAV.xs:233: warning: unused variable 'len'
> ClamAV.xs: In function 'clamav_perl_constant':
> ClamAV.xs:350: error: 'CL_SCAN_ALGORITHMIC' undeclared (first use in this function)
> ClamAV.xs:350: error: (Each undeclared identifier is reported only once
> ClamAV.xs:350: error: for each function it appears in.)
> make[1]: *** [ClamAV.o] Error 1
> make[1]: Leaving directory `/root/.cpan/build/Mail-ClamAV-0.20-Cd7OP6/_Inline/build/Mail/ClamAV'
>
> A problem was encountered while attempting to compile and install your Inline
> C code. The command that failed was:
>   make
>
> The build directory was:
> /root/.cpan/build/Mail-ClamAV-0.20-Cd7OP6/_Inline/build/Mail/ClamAV
>
> To debug the problem, cd to the build directory, and inspect the output files.
>
>  at /root/.cpan/build/Mail-ClamAV-0.20-Cd7OP6/blib/lib/Mail/ClamAV.pm line 178
> BEGIN failed--compilation aborted at /root/.cpan/build/Mail-ClamAV-0.20-Cd7OP6/blib/lib/Mail/ClamAV.pm line 542.
> Compilation failed in require.
> BEGIN failed--compilation aborted.
> make: *** [ClamAV.inl] Error 25
>   SABECK/Mail-ClamAV-0.20.tar.gz
>   /usr/bin/make -- NOT OK
> Running make test
>   Can't test without successful make
> Running make install
>   Make had returned bad status, install seems impossible
>
> ==
> =====================================================================
> =
> = "It is obvious the Treasurer is rolling in money," said Wayne
> =  Swan, treasury spokesman for the opposition Labor Party. "It has
> =  been raining gold bars thanks to the mining boom."
> =
> =  Need help dealing with Parking Tickets, Bailiffs, Capita or NTL...
> =  Call...    +44 8457 90 90 90    http://www.samaritans.org/
> =
> =====================================================================
>   

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGQuoeEfZZRxQVtlQRAkWhAKD9ybuD2l5vgUYPFEzAQ2zjeirz5gCgqI8q
UxYvqmVWLla2ZMoZmN3fqII=
=1aqU
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From MailScanner at ecs.soton.ac.uk  Thu May 10 10:51:08 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Thu May 10 10:52:42 2007
Subject: Clamav suggestions
In-Reply-To: <75beaaf4febafe7fbcfebe749e3da29b@62.49.223.244>
References: <20070510094316.ft4nl33mucc88cww@luna.eco.unibs.it>
	<75beaaf4febafe7fbcfebe749e3da29b@62.49.223.244>
Message-ID: <4642EB0C.8020304@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

That would slow it down a lot, as it would require another run of the 
command-line scanner(s).

MailScanner always tries to deliver as much of the message as possible. 
So if you had 3 docs attached to an email message, 1 of which had a 
macro virus, scanning the whole message with ClamAV would result in none 
of the attachments getting through. Whereas MailScanner's philosophy is 
that the other 2 docs and the message body text should still get 
delivered as they are not infected. So I don't want to throw the whole 
message at ClamAV either.

- --[ UxBoD ]-- wrote:
> Why not just scan the whole file after all the individual scans, but only if it hasn't detected anything in the individual element ones ?
>
> On Thu, 10 May 2007 09:43:16 +0200, Fabio Pedretti <pedretti@eco.unibs.it> wrote:
>   
>> Citando "Koopmann, Jan-Peter" <jan-peter@koopmann.eu>:
>>
>>     
>>> On Wednesday, May 09, 2007 9:27 PM Julian Field wrote:
>>>
>>>       
>>>> I can't see any effective good solution to this one.
>>>>         
>>> Except for convincing the clamav developers to put in another scan
>>> option. When called with this option they would not check for the
>>> existance of mail headers. I have no idea how delighted they would
>>> be if we proposed this though. Any volunteers? :-)
>>>       
>> I don't know if this is a good solution. Clamav check for this strings
>> only in mails, as check for macro viruses only in MS files, for unix
>> viruses only on ELF files, etc...
>> I think the problem is in how MailScanner call clamav, giving it all
>> separated attachments and not the full mail.
>>
>> --
>> MailScanner mailing list
>> mailscanner@lists.mailscanner.info
>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>> Before posting, read http://wiki.mailscanner.info/posting
>>
>> Support MailScanner development - buy the book off the website!
>>
>> --
>> This message has been scanned for viruses and dangerous content by
>> MailScanner, and is
>> believed to be clean.
>>     

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: UTF-8

wj8DBQFGQutIEfZZRxQVtlQRArzKAJ91LL+CA4vtESEYmlmQl94HwtslAwCg08jC
jjcAgWal0akj1uoq014pszo=
=bk0h
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From jan-peter at koopmann.eu  Thu May 10 11:12:23 2007
From: jan-peter at koopmann.eu (Koopmann, Jan-Peter)
Date: Thu May 10 11:12:30 2007
Subject: feature request: compress attachments
Message-ID: <AEF86EFA5497434190F6D57E2666EA7A84EF1B@ERWIN.intern.seceidos.de>

Hi,
 
I just came across another product that offers automatic attachment compression on mails passing the proxy/gateway. Since many people tend to send their Powerpoint/Word/Excel files uncompressed due to lazyness this might actually be a good contribution. There are several solutions for this available at least for Exchange servers but it should be possible to implement this within MailScanner. So e.g. with a ruleset I could force all incoming mails with not compressed attachments to be zipped and save quite some storage in the Exchange databases.
 
 
Kind regards,
  JP
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070510/b29a98fe/attachment.html
From uxbod at splatnix.net  Thu May 10 11:14:25 2007
From: uxbod at splatnix.net (--[ UxBoD ]--)
Date: Thu May 10 11:14:33 2007
Subject: Clamav suggestions
In-Reply-To: <4642EB0C.8020304@ecs.soton.ac.uk>
References: <4642EB0C.8020304@ecs.soton.ac.uk>
Message-ID: <300007a508e8eb7fe8eab69218d48abc@62.49.223.244>

Yeah that makes sense Jules.

Taking a step back from this and looking at it again.  Does this only happy with the SaneSecurity signatures ?

Apologies, if I have missed a previous thread on this.

On Thu, 10 May 2007 10:51:08 +0100, Julian Field <MailScanner@ecs.soton.ac.uk> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> That would slow it down a lot, as it would require another run of the 
> command-line scanner(s).
> 
> MailScanner always tries to deliver as much of the message as possible. 
> So if you had 3 docs attached to an email message, 1 of which had a 
> macro virus, scanning the whole message with ClamAV would result in none 
> of the attachments getting through. Whereas MailScanner's philosophy is 
> that the other 2 docs and the message body text should still get 
> delivered as they are not infected. So I don't want to throw the whole 
> message at ClamAV either.
> 
> - --[ UxBoD ]-- wrote:
>> Why not just scan the whole file after all the individual scans, but
> only if it hasn't detected anything in the individual element ones ?
>>
>> On Thu, 10 May 2007 09:43:16 +0200, Fabio Pedretti
> <pedretti@eco.unibs.it> wrote:
>>   
>>> Citando "Koopmann, Jan-Peter" <jan-peter@koopmann.eu>:
>>>
>>>     
>>>> On Wednesday, May 09, 2007 9:27 PM Julian Field wrote:
>>>>
>>>>       
>>>>> I can't see any effective good solution to this one.
>>>>>         
>>>> Except for convincing the clamav developers to put in another scan
>>>> option. When called with this option they would not check for the
>>>> existance of mail headers. I have no idea how delighted they would
>>>> be if we proposed this though. Any volunteers? :-)
>>>>       
>>> I don't know if this is a good solution. Clamav check for this strings
>>> only in mails, as check for macro viruses only in MS files, for unix
>>> viruses only on ELF files, etc...
>>> I think the problem is in how MailScanner call clamav, giving it all
>>> separated attachments and not the full mail.
>>>
>>> --
>>> MailScanner mailing list
>>> mailscanner@lists.mailscanner.info
>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>>
>>> Before posting, read http://wiki.mailscanner.info/posting
>>>
>>> Support MailScanner development - buy the book off the website!
>>>
>>> --
>>> This message has been scanned for viruses and dangerous content by
>>> MailScanner, and is
>>> believed to be clean.
>>>     
> 
> Jules
> 
> - -- 
> Julian Field MEng CITP
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> 
> MailScanner customisation, or any advanced system administration help?
> Contact me at Jules@Jules.FM
> 
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> For all your IT requirements visit www.transtec.co.uk
> 
> 
> 
> -----BEGIN PGP SIGNATURE-----
> Version: PGP Desktop 9.6.1 (Build 1012)
> Charset: UTF-8
> 
> wj8DBQFGQutIEfZZRxQVtlQRArzKAJ91LL+CA4vtESEYmlmQl94HwtslAwCg08jC
> jjcAgWal0akj1uoq014pszo=
> =bk0h
> -----END PGP SIGNATURE-----
> 
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> For all your IT requirements visit www.transtec.co.uk
> 
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
> 
>
-- 
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
// Phone: +44 (0) 845 869 2749  SIP: uxbod@sip.splatnix.net


-- 
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.

From martinh at solidstatelogic.com  Thu May 10 11:16:14 2007
From: martinh at solidstatelogic.com (Martin.Hepworth)
Date: Thu May 10 11:16:19 2007
Subject: feature request: compress attachments
In-Reply-To: <AEF86EFA5497434190F6D57E2666EA7A84EF1B@ERWIN.intern.seceidos.de>
Message-ID: <a19f922b8c18f84c962972dd1063900b@solidstatelogic.com>

Would help here as well - for outgoing stuff as well.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> bounces@lists.mailscanner.info] On Behalf Of Koopmann, Jan-Peter
> Sent: 10 May 2007 11:12
> To: mailscanner@lists.mailscanner.info
> Subject: feature request: compress attachments
>
> Hi,
>
> I just came across another product that offers automatic attachment
> compression on mails passing the proxy/gateway. Since many people tend
to
> send their Powerpoint/Word/Excel files uncompressed due to lazyness
this
> might actually be a good contribution. There are several solutions for
> this available at least for Exchange servers but it should be possible
to
> implement this within MailScanner. So e.g. with a ruleset I could
force
> all incoming mails with not compressed attachments to be zipped and
save
> quite some storage in the Exchange databases.
>
>
> Kind regards,
>   JP




**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the 
addressee only and may be confidential. If they come to you in error 
you must take no action based on them, nor must you copy or show them 
to anyone. Please advise the sender by replying to this e-mail 
immediately and then delete the original from your computer.

Opinion : Any opinions expressed in this e-mail are entirely those of 
the author and unless specifically stated to the contrary, are not 
necessarily those of the author's employer.

Security Warning : Internet e-mail is not necessarily a secure 
communications medium and can be subject to data corruption. We advise 
that you consider this fact when e-mailing us. 

Viruses : We have taken steps to ensure that this e-mail and any 
attachments are free from known viruses but in keeping with good 
computing practice, you should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales 
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
United Kingdom
**********************************************************************

From pedretti at eco.unibs.it  Thu May 10 11:41:36 2007
From: pedretti at eco.unibs.it (Fabio Pedretti)
Date: Thu May 10 11:39:49 2007
Subject: Clamav suggestions
In-Reply-To: <300007a508e8eb7fe8eab69218d48abc@62.49.223.244>
References: <4642EB0C.8020304@ecs.soton.ac.uk>
	<300007a508e8eb7fe8eab69218d48abc@62.49.223.244>
Message-ID: <20070510124136.ht3byapm4kgso4cg@luna.eco.unibs.it>

Citando "--[ UxBoD ]--" <uxbod@splatnix.net>:

> Yeah that makes sense Jules.
>
> Taking a step back from this and looking at it again.  Does this   
> only happy with the SaneSecurity signatures ?


No, in fact the string I have posted was taken from clamav signatures  
and not sanesecurity signatures.
The problem is for all signatures that uses the "signature format #4"  
(the signature for checking mail), as specified in signatures.pdf in  
clamav source.

From uxbod at splatnix.net  Thu May 10 14:00:30 2007
From: uxbod at splatnix.net (--[ UxBoD ]--)
Date: Thu May 10 14:00:34 2007
Subject: Preferred Distribution
Message-ID: <f1c3264ded134143385005e9af155254@62.49.223.244>

Hi,

I am having to setup a couple of new mailservers where I am working on contract at the moment, using Dell SC1435 rack mounts.  The problem is that RedHat ES4 kernel is so old does not recognise the SAS RAID card.

Now my question is should I get them to purchase RHES5, or go for either CentOS or Fedora ?

Personally I would use Gentoo or Ubuntu, but they are really *not* happy in using either of them for a corporate system :(
-- 
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
// Phone: +44 (0) 845 869 2749  SIP: uxbod@sip.splatnix.net


-- 
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.

From holger at noefer.org  Thu May 10 14:06:28 2007
From: holger at noefer.org (Holger =?iso-8859-1?b?TvZmZXI=?=)
Date: Thu May 10 14:06:33 2007
Subject: feature request MailScanner with MySQL
Message-ID: <20070510150628.dhu95j13x9k4cgcw@www.noefer.org>

Hi,

I think it is a nice feature to include MySQL in
Mailscanner.

What do you think about to get the /opt/MailScanner/etc/rules files
from a database?
For example postfix can get its mappings, like access, virtual maps and
so on from a MySQL database and has a little cache.

For MailScanner you can create a little cache so that MailScanner
does not need to look into the database for each mail.

The advantage is that it is more flexible und you can create a
gui, web application or whatever to fill the MySQL database.
And you don't need to restart MailScanner for every rule change.

What do you think about it, is it possible?
Does someone else need it?

Best regards,
Holger

From oliver at linux-kernel.at  Thu May 10 14:14:25 2007
From: oliver at linux-kernel.at (Oliver Falk)
Date: Thu May 10 14:14:31 2007
Subject: Preferred Distribution
In-Reply-To: <f1c3264ded134143385005e9af155254@62.49.223.244>
References: <f1c3264ded134143385005e9af155254@62.49.223.244>
Message-ID: <46431AB1.3040803@linux-kernel.at>

On 05/10/2007 03:00 PM, --[ UxBoD ]-- wrote:
> I am having to setup a couple of new mailservers where
 > I am working on contract at the moment, using Dell
 > SC1435 rack mounts.
 > The problem is that RedHat ES4 kernel is so old does
 > not recognise the SAS RAID card.
> 
> Now my question is should I get them to purchase
 > RHES5,

If you don't need support, there's no need for EL5.

 > or go for either CentOS or Fedora ?

Both is fine. Fedora should recognize it AFAIK.

> Personally I would use Gentoo or Ubuntu, but they
 > are really *not* happy in using either of them
 > for a corporate system :(

Ubuntu is not really a server OS. Gentoo; I don't if you can manage a 
couple of servers with Gentoo - Software distribution, Updates, ...

MS and Fedora are playing good together from my experience....

-of
From daniel.maher at ubisoft.com  Thu May 10 14:18:29 2007
From: daniel.maher at ubisoft.com (Daniel Maher)
Date: Thu May 10 14:18:34 2007
Subject: Preferred Distribution
In-Reply-To: <f1c3264ded134143385005e9af155254@62.49.223.244>
Message-ID: <1E293D3FF63A3740B10AD5AAD88535D204E13733@UBIMAIL1.ubisoft.org>

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> bounces@lists.mailscanner.info] On Behalf Of --[ UxBoD ]--
> Sent: May 10, 2007 9:01 AM
> To: mailscanner@lists.mailscanner.info
> Subject: Preferred Distribution
> 
> Hi,
> 
> I am having to setup a couple of new mailservers where I am working on
> contract at the moment, using Dell SC1435 rack mounts.  The problem is
> that RedHat ES4 kernel is so old does not recognise the SAS RAID card.
> 
> Now my question is should I get them to purchase RHES5, or go for either
> CentOS or Fedora ?
> 
> Personally I would use Gentoo or Ubuntu, but they are really *not* happy
> in using either of them for a corporate system :(

At my (reasonably large multi-national) company, we've started using CentOS for all of our new machines, and will likely continue to do so.  We don't need RedHat's telephone support, nor do we care to use up2date, ergo the benefits of using RedHat over CentOS are almost non-existent.  

YMMV, of course - especially if you're at a smaller organisation where phone support might come in handy, or where you don't manage your own software repository.

0.02$


--
  _
 ?v?  Daniel Maher
/(_)\ Administrateur Syst?me Unix
 ^ ^  Unix System Administrator
 
"The most incomprehensible thing about the world is that it is comprehensible." -- Albert Einstein.
From pedretti at eco.unibs.it  Thu May 10 14:23:13 2007
From: pedretti at eco.unibs.it (Fabio Pedretti)
Date: Thu May 10 14:21:24 2007
Subject: Clamav suggestions
In-Reply-To: <4642EB0C.8020304@ecs.soton.ac.uk>
References: <20070510094316.ft4nl33mucc88cww@luna.eco.unibs.it>
	<75beaaf4febafe7fbcfebe749e3da29b@62.49.223.244>
	<4642EB0C.8020304@ecs.soton.ac.uk>
Message-ID: <20070510152313.ul54et2kmoswcccg@luna.eco.unibs.it>

> MailScanner always tries to deliver as much of the message as possible.
> So if you had 3 docs attached to an email message, 1 of which had a
> macro virus, scanning the whole message with ClamAV would result in none
> of the attachments getting through. Whereas MailScanner's philosophy is
> that the other 2 docs and the message body text should still get
> delivered as they are not infected. So I don't want to throw the whole
> message at ClamAV either.

This make sense. However, in my experience:
- most mail (>99%) with viruses are generated by spambots/spammers and  
should be deleted anyway; it's not usually desiderable to give the  
users the cleaned mail if the remaing is only spam;
- if one user send some attachments with viruses it's better that he  
check and repairs immediately his system (and if he can't no more send  
mails he will do), rather than still provide mail with only the clean  
attachments;
- I am using greylisting + MailScanner (with Spamassassin + Clamav +  
Sanesecurity sigs) and, after these, not many spam/phishing mail can  
reach the users; however, almost all of that mail would be detected by  
clamav (especially with sanesecurity sigs), if the scan would be done  
on the full mail.

So it seems to me that the advantages to give clamav all mail with  
headers by default are bigger than to give it separated attachments.  
Or, at least, would be a valuable addition to provide a config option  
to do this.

Fabio

From pete at enitech.com.au  Thu May 10 14:20:50 2007
From: pete at enitech.com.au (Pete Russell)
Date: Thu May 10 14:21:26 2007
Subject: Preferred Distribution
In-Reply-To: <f1c3264ded134143385005e9af155254@62.49.223.244>
References: <f1c3264ded134143385005e9af155254@62.49.223.244>
Message-ID: <46431C32.4030404@enitech.com.au>

Fedora? They do not have support lifecycle suitable for corporate 
clients (espe ones using external linux skills), IMO.

CentOS is the logical choice. Hassle free, you know mailscanner is going 
to work nicely on it - its RHAS...



--[ UxBoD ]-- wrote:
> Hi,
> 
> I am having to setup a couple of new mailservers where I am working on contract at the moment, using Dell SC1435 rack mounts.  The problem is that RedHat ES4 kernel is so old does not recognise the SAS RAID card.
> 
> Now my question is should I get them to purchase RHES5, or go for either CentOS or Fedora ?
> 
> Personally I would use Gentoo or Ubuntu, but they are really *not* happy in using either of them for a corporate system :(
From derek at csolve.net  Thu May 10 14:21:50 2007
From: derek at csolve.net (Derek Buttineau)
Date: Thu May 10 14:22:29 2007
Subject: feature request MailScanner with MySQL
In-Reply-To: <20070510150628.dhu95j13x9k4cgcw@www.noefer.org>
References: <20070510150628.dhu95j13x9k4cgcw@www.noefer.org>
Message-ID: <4C6461BB-270B-452C-8645-2BFC86634915@csolve.net>

On 2007-May-10, at 9:06 AM, Holger N?fer wrote:

> I think it is a nice feature to include MySQL in
> Mailscanner.
>
> What do you think about to get the /opt/MailScanner/etc/rules files
> from a database?
> For example postfix can get its mappings, like access, virtual maps  
> and
> so on from a MySQL database and has a little cache.
>
> For MailScanner you can create a little cache so that MailScanner
> does not need to look into the database for each mail.
>
> The advantage is that it is more flexible und you can create a
> gui, web application or whatever to fill the MySQL database.
> And you don't need to restart MailScanner for every rule change.
>
> What do you think about it, is it possible?
> Does someone else need it?

You can extend MailScanner to include this functionality through the  
use of CustomFunctions.  The function call can then be substituted  
for the rule file in MailScanner.conf.

Personally, we used mysql calls with MailScanner in development years  
ago and while it worked it got fairly slow when dealing with large  
amounts of incoming e-mail.  We currently use the CDB database  
package to provide rulesets to MailScanner, it's incredibly fast.

Anyway, you can pretty much make MailScanner do whatever you want  
through CustomFunctions :)

--
Regards,

Derek Buttineau
Internet Systems Developer
Compu-SOLVE Internet Services
Compu-SOLVE Technologies, Inc

Phone:  705-725-1212 x255
E-Mail:  derek@csolve.net



From pedretti at eco.unibs.it  Thu May 10 14:29:14 2007
From: pedretti at eco.unibs.it (Fabio Pedretti)
Date: Thu May 10 14:27:25 2007
Subject: Preferred Distribution
In-Reply-To: <f1c3264ded134143385005e9af155254@62.49.223.244>
References: <f1c3264ded134143385005e9af155254@62.49.223.244>
Message-ID: <20070510152914.g744m7cf28w88ggg@luna.eco.unibs.it>

Citando "--[ UxBoD ]--" <uxbod@splatnix.net>:

> Hi,
>
> I am having to setup a couple of new mailservers where I am working   
> on contract at the moment, using Dell SC1435 rack mounts.  The   
> problem is that RedHat ES4 kernel is so old does not recognise the   
> SAS RAID card.
>
> Now my question is should I get them to purchase RHES5, or go for   
> either CentOS or Fedora ?

If I recall correct, if you have a RHES4 subscription, you can upgrade  
or downgrade to any other RHES version for free.
I would not go with Fedora, it has short term support, and a lot of  
non bug fix updates, which sometimes break things.

From uxbod at splatnix.net  Thu May 10 14:27:57 2007
From: uxbod at splatnix.net (--[ UxBoD ]--)
Date: Thu May 10 14:28:24 2007
Subject: feature request MailScanner with MySQL
In-Reply-To: <20070510150628.dhu95j13x9k4cgcw@www.noefer.org>
References: <20070510150628.dhu95j13x9k4cgcw@www.noefer.org>
Message-ID: <0350d60387e3004b6716b7b5231e51e2@62.49.223.244>

I give my thumbs up for the feature :)

On Thu, 10 May 2007 15:06:28 +0200, Holger N?fer <holger@noefer.org> wrote:
> Hi,
> 
> I think it is a nice feature to include MySQL in
> Mailscanner.
> 
> What do you think about to get the /opt/MailScanner/etc/rules files
> from a database?
> For example postfix can get its mappings, like access, virtual maps and
> so on from a MySQL database and has a little cache.
> 
> For MailScanner you can create a little cache so that MailScanner
> does not need to look into the database for each mail.
> 
> The advantage is that it is more flexible und you can create a
> gui, web application or whatever to fill the MySQL database.
> And you don't need to restart MailScanner for every rule change.
> 
> What do you think about it, is it possible?
> Does someone else need it?
> 
> Best regards,
> Holger
> 
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
> 
> --
> This message has been scanned for viruses and dangerous content by
> MailScanner, and is
> believed to be clean.
-- 
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
// Phone: +44 (0) 845 869 2749  SIP: uxbod@sip.splatnix.net


-- 
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.

From oliver at linux-kernel.at  Thu May 10 14:34:49 2007
From: oliver at linux-kernel.at (Oliver Falk)
Date: Thu May 10 14:34:54 2007
Subject: Preferred Distribution
In-Reply-To: <1E293D3FF63A3740B10AD5AAD88535D204E13733@UBIMAIL1.ubisoft.org>
References: <1E293D3FF63A3740B10AD5AAD88535D204E13733@UBIMAIL1.ubisoft.org>
Message-ID: <46431F79.6050400@linux-kernel.at>

On 05/10/2007 03:18 PM, Daniel Maher wrote:
>> I am having to setup a couple of new mailservers where I am working on
>> contract at the moment, using Dell SC1435 rack mounts.  The problem is
>> that RedHat ES4 kernel is so old does not recognise the SAS RAID card.
>>
>> Now my question is should I get them to purchase RHES5, or go for either
>> CentOS or Fedora ?
>>
>> Personally I would use Gentoo or Ubuntu, but they are really *not* happy
>> in using either of them for a corporate system :(
> 
> At my (reasonably large multi-national) company, we've started using CentOS for all of our new machines, and will likely continue to do so.  We don't need RedHat's telephone support, nor do we care to use up2date, ergo the benefits of using RedHat over CentOS are almost non-existent.  

And you don't have eg. Oracle running on Linux? :-)

[ ... ]

-of
From jan-peter at koopmann.eu  Thu May 10 14:40:13 2007
From: jan-peter at koopmann.eu (Koopmann, Jan-Peter)
Date: Thu May 10 14:40:25 2007
Subject: clamd problem
Message-ID: <AEF86EFA5497434190F6D57E2666EA7A954061@ERWIN.intern.seceidos.de>

Hi,
 
on some machines I am getting this error message over and over again:
 
May 10 15:35:44 proxy MailScanner[7529]: /var/spool/MailScanner/incoming/7529/.: lstat() failed. ERROR 

I am using clamd-wrapper. Permissions in MailScanner.conf are set as described and clamav user can acutally access the directories. Any bright ideas?
 
Regards,
  JP
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070510/57ab3de0/attachment.html
From Jason at SYO.Com  Thu May 10 14:44:01 2007
From: Jason at SYO.Com (Jason Gottschalk)
Date: Thu May 10 14:44:23 2007
Subject: Approve/Deny outgoing e-mail ?
Message-ID: <1503721294.20070510094401@SYO.Com>


I know mailscanner can scan outgoing mail (when the user uses the host
as his smtp server). Is there any mechanism in mailscanner to hold an
outgoing message until it is reviewed by an administrator who would
approve/deny the message and then release it?

  

-- 

Best regards,

 Jason Gottschalk                         mailto:Jason@SYO.Com
 SYO Computer Engineering Services, Inc.
 SYO - Servicing Your Organization
 586-286-2557

From daniel.maher at ubisoft.com  Thu May 10 14:45:44 2007
From: daniel.maher at ubisoft.com (Daniel Maher)
Date: Thu May 10 14:45:47 2007
Subject: clamd problem
In-Reply-To: <AEF86EFA5497434190F6D57E2666EA7A954061@ERWIN.intern.seceidos.de>
Message-ID: <1E293D3FF63A3740B10AD5AAD88535D204E137B1@UBIMAIL1.ubisoft.org>

Hello,

 

I recently had exactly the same problem.  I had to setgid the incoming directory, so that the sub-directories underneath (i.e. "7529/") were created with the correct group at run-time.

 

--

  _
 ?v?  Daniel Maher
/(_)\ Administrateur Syst?me Unix
 ^ ^  Unix System Administrator

 

"The most incomprehensible thing about the world is that it is comprehensible." -- Albert Einstein.

________________________________

From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Koopmann, Jan-Peter
Sent: May 10, 2007 9:40 AM
To: MailScanner discussion
Subject: clamd problem

 

Hi,

 

on some machines I am getting this error message over and over again:

 

May 10 15:35:44 proxy MailScanner[7529]: /var/spool/MailScanner/incoming/7529/.: lstat() failed. ERROR 

I am using clamd-wrapper. Permissions in MailScanner.conf are set as described and clamav user can acutally access the directories. Any bright ideas?

 

Regards,

  JP

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070510/8b930f95/attachment.html
From martinh at solidstatelogic.com  Thu May 10 14:46:38 2007
From: martinh at solidstatelogic.com (Martin.Hepworth)
Date: Thu May 10 14:46:46 2007
Subject: clamd problem
In-Reply-To: <AEF86EFA5497434190F6D57E2666EA7A954061@ERWIN.intern.seceidos.de>
Message-ID: <d1e571e1449e654589b5432f01558e7b@solidstatelogic.com>

JP
Yeah can the clamd user get to those directories - all the way
down.....not just the bottom remember


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> bounces@lists.mailscanner.info] On Behalf Of Koopmann, Jan-Peter
> Sent: 10 May 2007 14:40
> To: MailScanner discussion
> Subject: clamd problem
>
> Hi,
>
> on some machines I am getting this error message over and over again:
>
> May 10 15:35:44 proxy MailScanner[7529]:
> /var/spool/MailScanner/incoming/7529/.: lstat() failed. ERROR
>
> I am using clamd-wrapper. Permissions in MailScanner.conf are set as
> described and clamav user can acutally access the directories. Any
bright
> ideas?
>
> Regards,
>   JP




**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the 
addressee only and may be confidential. If they come to you in error 
you must take no action based on them, nor must you copy or show them 
to anyone. Please advise the sender by replying to this e-mail 
immediately and then delete the original from your computer.

Opinion : Any opinions expressed in this e-mail are entirely those of 
the author and unless specifically stated to the contrary, are not 
necessarily those of the author's employer.

Security Warning : Internet e-mail is not necessarily a secure 
communications medium and can be subject to data corruption. We advise 
that you consider this fact when e-mailing us. 

Viruses : We have taken steps to ensure that this e-mail and any 
attachments are free from known viruses but in keeping with good 
computing practice, you should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales 
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
United Kingdom
**********************************************************************

From jan-peter at koopmann.eu  Thu May 10 14:53:38 2007
From: jan-peter at koopmann.eu (Koopmann, Jan-Peter)
Date: Thu May 10 14:53:55 2007
Subject: clamd problem
In-Reply-To: <d1e571e1449e654589b5432f01558e7b@solidstatelogic.com>
References: <AEF86EFA5497434190F6D57E2666EA7A954061@ERWIN.intern.seceidos.de>
	<d1e571e1449e654589b5432f01558e7b@solidstatelogic.com>
Message-ID: <AEF86EFA5497434190F6D57E2666EA7A954062@ERWIN.intern.seceidos.de>

On Thursday, May 10, 2007 3:47 PM Martin.Hepworth wrote:

> JP
> Yeah can the clamd user get to those directories - all the way
> down.....not just the bottom remember

Yep it can. It even finds test viruses!!! Thats what is so confusing. On another machine with seemingly the same settings all is well.


From jan-peter at koopmann.eu  Thu May 10 14:54:33 2007
From: jan-peter at koopmann.eu (Koopmann, Jan-Peter)
Date: Thu May 10 14:54:49 2007
Subject: clamd problem
In-Reply-To: <1E293D3FF63A3740B10AD5AAD88535D204E137B1@UBIMAIL1.ubisoft.org>
References: <AEF86EFA5497434190F6D57E2666EA7A954061@ERWIN.intern.seceidos.de>
	<1E293D3FF63A3740B10AD5AAD88535D204E137B1@UBIMAIL1.ubisoft.org>
Message-ID: <AEF86EFA5497434190F6D57E2666EA7A954063@ERWIN.intern.seceidos.de>

Should the "Incoming Work Group" setting not take care of that?
 
 



________________________________

	From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Daniel Maher
	Sent: Thursday, May 10, 2007 3:46 PM
	To: MailScanner discussion
	Subject: RE: clamd problem
	
	

	Hello,

	 

	I recently had exactly the same problem.  I had to setgid the incoming directory, so that the sub-directories underneath (i.e. "7529/") were created with the correct group at run-time.

	 

	 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070510/baa27708/attachment.html
From jan-peter at koopmann.eu  Thu May 10 14:56:49 2007
From: jan-peter at koopmann.eu (Koopmann, Jan-Peter)
Date: Thu May 10 14:57:03 2007
Subject: clamd problem
In-Reply-To: <d1e571e1449e654589b5432f01558e7b@solidstatelogic.com>
References: <AEF86EFA5497434190F6D57E2666EA7A954061@ERWIN.intern.seceidos.de>
	<d1e571e1449e654589b5432f01558e7b@solidstatelogic.com>
Message-ID: <AEF86EFA5497434190F6D57E2666EA7A954064@ERWIN.intern.seceidos.de>

On Thursday, May 10, 2007 3:47 PM Martin.Hepworth wrote:

> JP
> Yeah can the clamd user get to those directories - all the way
> down.....not just the bottom remember

Well in the maillog it finds the EICAR file but it is not reported in MailWatch... On my machine it is, on that second machine it is not. Very strange.
From daniel.maher at ubisoft.com  Thu May 10 15:10:21 2007
From: daniel.maher at ubisoft.com (Daniel Maher)
Date: Thu May 10 15:10:25 2007
Subject: clamd problem
In-Reply-To: <AEF86EFA5497434190F6D57E2666EA7A954063@ERWIN.intern.seceidos.de>
Message-ID: <1E293D3FF63A3740B10AD5AAD88535D204E13818@UBIMAIL1.ubisoft.org>

It should, but in my case, it did not.  Using setgid solved the problem, no questions asked. :-)

 

--

  _
 ?v?  Daniel Maher
/(_)\ Administrateur Syst?me Unix
 ^ ^  Unix System Administrator

 

"The most incomprehensible thing about the world is that it is comprehensible." -- Albert Einstein.

________________________________

From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Koopmann, Jan-Peter
Sent: May 10, 2007 9:55 AM
To: MailScanner discussion
Subject: RE: clamd problem

 

Should the "Incoming Work Group" setting not take care of that?

 

 

	 

	
________________________________


	From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Daniel Maher
	Sent: Thursday, May 10, 2007 3:46 PM
	To: MailScanner discussion
	Subject: RE: clamd problem

	Hello,

	 

	I recently had exactly the same problem.  I had to setgid the incoming directory, so that the sub-directories underneath (i.e. "7529/") were created with the correct group at run-time.

	 

	 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070510/ad063f2b/attachment.html
From dnsadmin at 1bigthink.com  Thu May 10 15:58:48 2007
From: dnsadmin at 1bigthink.com (dnsadmin 1bigthink.com)
Date: Thu May 10 15:59:14 2007
Subject: Preferred Distribution
In-Reply-To: <f1c3264ded134143385005e9af155254@62.49.223.244>
References: <f1c3264ded134143385005e9af155254@62.49.223.244>
Message-ID: <200705101459.l4AEx2Qd024722@mxt.1bigthink.com>

At 09:00 AM 5/10/2007, you wrote:

>Hi,
>
>I am having to setup a couple of new mailservers where I am working 
>on contract at the moment, using Dell SC1435 rack mounts.  The 
>problem is that RedHat ES4 kernel is so old does not recognise the 
>SAS RAID card.
>
>Now my question is should I get them to purchase RHES5, or go for 
>either CentOS or Fedora ?

I am using CentOS 4.4 on Dell 1955 blades. Support for the SAS is 
there. I'd go CentOS. Fedora life-cycle is too short for me, and most 
likely for your current use/need.

Cheers,
Glenn 

From cplists at princeservices.com  Thu May 10 16:59:27 2007
From: cplists at princeservices.com (Cameron B. Prince)
Date: Thu May 10 16:59:35 2007
Subject: MailScanner w/ Qmail / Plesk ( format error: file is too short )
In-Reply-To: <Pine.LNX.4.64.0705101526290.5946@ebfjryy.nhfvpf.arg>
Message-ID: <C268AB8F.DFF4%cplists@princeservices.com>

Hi Res,

> Actually I mean your MailScanner temp working dir, like
> /var/spool/MailScanner
> 
> chown -R qmailq.qmail /var/spool/MailScanner

I checked and reset this.
 
> the real qmail sources also set permissions diferent than what you have
> above, the queue dir is set 750

I went through both the queue and queue.in directories and reset the
permissions.

> do you know what version of qmail plesk installs now days? as in what
> patches? I know it works on plesk from other comments I've had, but I'm
> unsure if those posters are members of this list, I suspectmaybe not?
> since none of them have commented.

This is my first dealings with Qmail as I've historically only worked with
sendmail. Can you tell me how I can find the information to answer your
question?

> Check perms on...
> 
> chown qmailq.qmail /var/qmail/bin/qmail-queue
> chown root.qmail /var/qmail/bin/qmail-inject.mailscanner
> chmod 4755 /var/qmail/bin/qmail-queue
> chmod 755 /var/qmail/bin/qmail-inject.mailscanner

I checked and reset these... More tests result in the same error. I tried
with an attachment also to make the message larger and it also produced the
same error.
 
> I have not looked at that code in a while, I can have alook this evening
> though.

Thank you,

Cameron


From mbneto at gmail.com  Thu May 10 17:09:34 2007
From: mbneto at gmail.com (mbneto)
Date: Thu May 10 17:09:37 2007
Subject: Build only (from rpm.tar.gz)
Message-ID: <5cf776b80705100909t347d505co4c5776278daa559b@mail.gmail.com>

Hi,

I've noticed that when I perform a ./install.sh it generates a lot of rpm
files and later installs.  I could not find, however, the rpm for the
mailscanner itself only the perl, tnef etc.

Since I need to maintain a number of servers that does not have gcc and
other libraries I need to generate the complete set of rpm and add to my yum
repository.

Any idea of how to do that (or to find the mailscanner.rpm generated)?

tks.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070510/dab8cf94/attachment.html
From jan-peter at koopmann.eu  Thu May 10 17:28:28 2007
From: jan-peter at koopmann.eu (Koopmann, Jan-Peter)
Date: Thu May 10 17:28:46 2007
Subject: clamd problem
In-Reply-To: <1E293D3FF63A3740B10AD5AAD88535D204E13818@UBIMAIL1.ubisoft.org>
References: <AEF86EFA5497434190F6D57E2666EA7A954063@ERWIN.intern.seceidos.de>
	<1E293D3FF63A3740B10AD5AAD88535D204E13818@UBIMAIL1.ubisoft.org>
Message-ID: <AEF86EFA5497434190F6D57E2666EA7A95406A@ERWIN.intern.seceidos.de>

Looks like a restart of clamd fixed the problem. One of those "do not ask" problems...
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070510/13dbd304/attachment.html
From gmourani at prival.ca  Thu May 10 19:23:59 2007
From: gmourani at prival.ca (Gerhard Mourani)
Date: Thu May 10 19:24:27 2007
Subject: Issue with Blackberry
In-Reply-To: <4642BD41.9070205@fsl.com>
Message-ID: <3123E1B72B666243917E340F3C8FD4A1069754@privaldc2003.prival.local>

Hi Steve,

Thanks for your help, yes I've fixed this part into the config and also
find other options responsible of this issue with Blackberry devices.
Bellow is the options part causing the problems.

Allow IFrame Tags = 
Allow Form Tags = 
Allow Script Tags = 
Allow WebBugs = 

All of the above should be set to yes for Blackberry to correctly
display mails.

Gerhard

-----Original Message-----
From: Steve Freegard [mailto:steve.freegard@fsl.com] 
Sent: Thursday, May 10, 2007 2:36 AM
To: MailScanner discussion; Gerhard Mourani
Subject: Re: Issue with Blackberry

Hi Gehard,

I've seen the problem in the headers that you posted:

> X-Elite Group, Inc.-MailScanner: Found to be clean
> X-Elite Group, Inc.-MailScanner-From: carla.redman@elitegroupinc.ca
                ^^ & ^

On the MailScanner box that processed this message you have a bad 
%org-name% setting.  Quoting MailScanner.conf:

# Note: Some Symantec scanners complain (incorrectly) about "."
# ***** characters appearing in the names of headers.
#       Some other mail servers complain about "_" characters
#       appearing in the names of headers as well.
#       So don't put "." or "_" in this setting.
#
# **** RULE: It must not contain any spaces! ****

Your current %org-name% contains spaces and dots (I personally would 
also avoid commas).  Change it to something like:

%org-name% = Elite-Group-Inc

And it should fix the problem.

Kind regards,
Steve.

--
Steve Freegard
Fort Systems Ltd.

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

From damon at txmail.marinocrane.com  Thu May 10 19:24:36 2007
From: damon at txmail.marinocrane.com (Damon Lambooy)
Date: Thu May 10 19:25:34 2007
Subject: Preferred Distribution
In-Reply-To: <1E293D3FF63A3740B10AD5AAD88535D204E13733@UBIMAIL1.ubisoft.org>
References: <1E293D3FF63A3740B10AD5AAD88535D204E13733@UBIMAIL1.ubisoft.org>
Message-ID: <46436364.40507@txmail.marinocrane.com>

Daniel Maher wrote:
>> -----Original Message-----
>> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
>> bounces@lists.mailscanner.info] On Behalf Of --[ UxBoD ]--
>> Sent: May 10, 2007 9:01 AM
>> To: mailscanner@lists.mailscanner.info
>> Subject: Preferred Distribution
>>
>> Hi,
>>
>> I am having to setup a couple of new mailservers where I am working on
>> contract at the moment, using Dell SC1435 rack mounts.  The problem is
>> that RedHat ES4 kernel is so old does not recognise the SAS RAID card.
>>
>> Now my question is should I get them to purchase RHES5, or go for either
>> CentOS or Fedora ?
>>
>> Personally I would use Gentoo or Ubuntu, but they are really *not* happy
>> in using either of them for a corporate system :(
>>     
>
> At my (reasonably large multi-national) company, we've started using CentOS for all of our new machines, and will likely continue to do so.  We don't need RedHat's telephone support, nor do we care to use up2date, ergo the benefits of using RedHat over CentOS are almost non-existent.  
>
> YMMV, of course - especially if you're at a smaller organisation where phone support might come in handy, or where you don't manage your own software repository.
>
> 0.02$
>
>
> --
>   _
>  ?v?  Daniel Maher
> /(_)\ Administrateur Syst?me Unix
>  ^ ^  Unix System Administrator
>  
> "The most incomprehensible thing about the world is that it is comprehensible." -- Albert Einstein.
>   
I am tring to install Mailscanner  4.59.4-2 on Fedora 7 test 4 but 
getting strange error about rpms not being installed.

[root@mailex MailScanner-4.59.4-2]# ./install.sh


Good. You have the patch command.

Good, you have /usr/src/redhat in place.

Good, unpackaged files will not break the build process.
Good, far-too-clever Perl requirements will be ignored.

Good, you appear to only have 1 copy of Perl installed.

I think you are running on RedHat Linux, Mandriva Linux or SuSE Linux.
You must have the following RPM packages installed before
you try and do anything else:
       binutils glibc-devel egcs make
You are missing at least 1 of these.
Please install them all
(Read the manuals if you do not know how to do this).
Then come back and run this install.sh script again.

Can anyone point me in the right direction I have installed all but egcs 
which i can't find in a current rpm disto.
has anyone else experienced any similar problems? or should I just wait 
until full version comes around?

TIA
Damon
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070510/cf03339e/attachment-0001.html
From rpoe at plattesheriff.org  Thu May 10 20:19:19 2007
From: rpoe at plattesheriff.org (Rob Poe)
Date: Thu May 10 20:20:15 2007
Subject: Interesting need
In-Reply-To: <463F5C10.7080307@ecs.soton.ac.uk>
References: <463F0518.65ED.00A2.0@plattesheriff.org>
	<463F5C10.7080307@ecs.soton.ac.uk>
Message-ID: <464329EA.65ED.00A2.0@plattesheriff.org>

Perfect!  Thanks, Jules.

How are you feeling?  Getting tired of hearing that?

>>> Julian Field <MailScanner@ecs.soton.ac.uk> 5/7/2007 12:04 PM >>>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dead easy. Put a ruleset on "Archive Mail =".

For example, say "theboss@yourdomain.com" wants all his incoming 
external mail to go to himself and "assistant@yourdomain.com".

In MailScanner.conf, set

Archive Mail = %rules-dir%/archive.mail.rules

Put the ruleset in /etc/MailScanner/rules/archive.mail.rules. In this 
file, put:

FromOrTo: default
To: theboss@yourdomain.com assistant@yourdomain.com 

Then just force a MailScanner configuration reload with

service MailScanner reload


Rob Poe wrote:
> This might not be so much a MailScanner function ... but 
>
> I have a Linux / Sendmail / MailScanner box set up in front of a corporate mail system.  It's doing the domain as relay-domains and mailertable.  One of their users wants all of his EXTERNAL incoming mail to go to both HIM and his assistant.  
>
> I tried with the aliases and virtusertable ... didn't work (just forwarded on to the corp mail system as if nothing was in there).  
>
> Is this something I can do with a MailScanner rule?
>
>
>
>   

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info 
Buy the MailScanner book at www.MailScanner.info/store 

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM 

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk 



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGP1zKEfZZRxQVtlQRAjv8AJ9aKslrMJC6Od0vG1XaNRmQw1JboACbBZ+Z
qWfLcoajUFGC5li684N5+2Q=
=cwWu
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk 

--
MailScanner mailing list
mailscanner@lists.mailscanner.info 
http://lists.mailscanner.info/mailman/listinfo/mailscanner 

Before posting, read http://wiki.mailscanner.info/posting 

Support MailScanner development - buy the book off the website!

From MailScanner at ecs.soton.ac.uk  Thu May 10 20:29:46 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Thu May 10 20:34:49 2007
Subject: Approve/Deny outgoing e-mail ?
In-Reply-To: <1503721294.20070510094401@SYO.Com>
References: <1503721294.20070510094401@SYO.Com>
Message-ID: <464372AA.2090906@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

You could do this with a little ruleset and an external script that 
would show the admin each mail message and move it into the outgoing 
queue if it's 'approved'.
Just use a ruleset that says that mail going to domains other than your 
own should go into /var/spool/mqueue.approval. Mail going to your domain 
goes straight into /var/spool/mqueue.

The script would then show the messages in mqueue.approval to the admin, 
then if they are approved they are moved into mqueue (from where the MTA 
will then deliver them).

Jason Gottschalk wrote:
> I know mailscanner can scan outgoing mail (when the user uses the host
> as his smtp server). Is there any mechanism in mailscanner to hold an
> outgoing message until it is reviewed by an administrator who would
> approve/deny the message and then release it?
>
>   
>
>   

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGQ3OsEfZZRxQVtlQRAhWgAKDRMCFbCSWzncvbV1zsHnoxFN/cGQCdEyVp
IUyhZgOVoITi/cvvX6l7zTw=
=JBJd
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From MailScanner at ecs.soton.ac.uk  Thu May 10 20:33:17 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Thu May 10 20:34:51 2007
Subject: Build only (from rpm.tar.gz)
In-Reply-To: <5cf776b80705100909t347d505co4c5776278daa559b@mail.gmail.com>
References: <5cf776b80705100909t347d505co4c5776278daa559b@mail.gmail.com>
Message-ID: <4643737D.1090500@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

It's there, you must be looking straight through it.

MailScanner-4.59.4-2/mailscanner-4.59.4-2.noarch.rpm
in the rpm.tar.gz file.

mbneto wrote:
> Hi,
>
> I've noticed that when I perform a ./install.sh it generates a lot of 
> rpm files and later installs.  I could not find, however, the rpm for 
> the mailscanner itself only the perl, tnef etc.
>
> Since I need to maintain a number of servers that does not have gcc 
> and other libraries I need to generate the complete set of rpm and add 
> to my yum repository.
>
> Any idea of how to do that (or to find the mailscanner.rpm generated)?
>
> tks.
>
>

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGQ3OuEfZZRxQVtlQRAiQjAJ0ZYBqUBxToowiZxdk3MUZ/QR/7wwCgpcMu
BWwU0ULq/aOZ3DDkLM6gIe0=
=NfMx
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From MailScanner at ecs.soton.ac.uk  Thu May 10 20:39:44 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Thu May 10 20:43:50 2007
Subject: Preferred Distribution
In-Reply-To: <46436364.40507@txmail.marinocrane.com>
References: <1E293D3FF63A3740B10AD5AAD88535D204E13733@UBIMAIL1.ubisoft.org>
	<46436364.40507@txmail.marinocrane.com>
Message-ID: <46437500.7080204@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Damon Lambooy wrote:
> I am tring to install Mailscanner  4.59.4-2 on Fedora 7 test 4 but 
> getting strange error about rpms not being installed.
>
> [root@mailex MailScanner-4.59.4-2]# ./install.sh
>
>
> Good. You have the patch command.
>
> Good, you have /usr/src/redhat in place.
>
> Good, unpackaged files will not break the build process.
> Good, far-too-clever Perl requirements will be ignored.
>
> Good, you appear to only have 1 copy of Perl installed.
>
> I think you are running on RedHat Linux, Mandriva Linux or SuSE Linux.
> You must have the following RPM packages installed before
> you try and do anything else:
>        binutils glibc-devel egcs make
> You are missing at least 1 of these.
> Please install them all
Do you have gcc installed?
Fedora has probably just hit a problem caused by my being short-sighted 
in the install.sh script.

  if [ -f /etc/redhat-release ] && fgrep -q ' 6.' /etc/redhat-release ; then
      # RedHat used egcs in RedHat 6 and not gcc
      GCC=egcs
  fi

So if it finds "6." in the redhat-release file then it won't look for 
gcc, it will look for egcs. What exactly does your /etc/redhat-release 
file say? If you can give me that I can work on the install.sh script 
and produce a new version for you that will work. I can probably just 
abandon the RedHat 6 test altogether now. Anyone still running it 
deserves all they get :-)
Just delete those 4 lines.


Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGQ3XKEfZZRxQVtlQRAoaDAJ9YZ2xgHI0NdNhLB6qEXicWl7gXbwCgsYyZ
8IjfVu8sTTxVSZNM5WOTBdg=
=GAu1
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From ssilva at sgvwater.com  Thu May 10 20:50:23 2007
From: ssilva at sgvwater.com (Scott Silva)
Date: Thu May 10 20:51:00 2007
Subject: Preferred Distribution
In-Reply-To: <46437500.7080204@ecs.soton.ac.uk>
References: <1E293D3FF63A3740B10AD5AAD88535D204E13733@UBIMAIL1.ubisoft.org>	<46436364.40507@txmail.marinocrane.com>
	<46437500.7080204@ecs.soton.ac.uk>
Message-ID: <f1vt1v$vqs$1@sea.gmane.org>

Julian Field spake the following on 5/10/2007 12:39 PM:
> 
> 
> Damon Lambooy wrote:
>> I am tring to install Mailscanner  4.59.4-2 on Fedora 7 test 4 but 
>> getting strange error about rpms not being installed.
> 
>> [root@mailex MailScanner-4.59.4-2]# ./install.sh
> 
> 
>> Good. You have the patch command.
> 
>> Good, you have /usr/src/redhat in place.
> 
>> Good, unpackaged files will not break the build process.
>> Good, far-too-clever Perl requirements will be ignored.
> 
>> Good, you appear to only have 1 copy of Perl installed.
> 
>> I think you are running on RedHat Linux, Mandriva Linux or SuSE Linux.
>> You must have the following RPM packages installed before
>> you try and do anything else:
>>        binutils glibc-devel egcs make
>> You are missing at least 1 of these.
>> Please install them all
> Do you have gcc installed?
> Fedora has probably just hit a problem caused by my being short-sighted 
> in the install.sh script.
> 
>   if [ -f /etc/redhat-release ] && fgrep -q ' 6.' /etc/redhat-release ; then
>       # RedHat used egcs in RedHat 6 and not gcc
>       GCC=egcs
>   fi
> 
> So if it finds "6." in the redhat-release file then it won't look for 
> gcc, it will look for egcs. What exactly does your /etc/redhat-release 
> file say? If you can give me that I can work on the install.sh script 
> and produce a new version for you that will work. I can probably just 
> abandon the RedHat 6 test altogether now. Anyone still running it 
> deserves all they get :-)
> Just delete those 4 lines.
> 
> 
> Jules
> 
People should stop using RedHat 6. It has got to be almost 8 years old!

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

From damon at txmail.marinocrane.com  Thu May 10 21:01:42 2007
From: damon at txmail.marinocrane.com (Damon Lambooy)
Date: Thu May 10 21:02:15 2007
Subject: Preferred Distribution
In-Reply-To: <f1vt1v$vqs$1@sea.gmane.org>
References: <1E293D3FF63A3740B10AD5AAD88535D204E13733@UBIMAIL1.ubisoft.org>	<46436364.40507@txmail.marinocrane.com>	<46437500.7080204@ecs.soton.ac.uk>
	<f1vt1v$vqs$1@sea.gmane.org>
Message-ID: <46437A26.7040901@txmail.marinocrane.com>

Scott Silva wrote:
> Julian Field spake the following on 5/10/2007 12:39 PM:
>   
>> Damon Lambooy wrote:
>>     
>>> I am tring to install Mailscanner  4.59.4-2 on Fedora 7 test 4 but 
>>> getting strange error about rpms not being installed.
>>>       
>>> [root@mailex MailScanner-4.59.4-2]# ./install.sh
>>>       
>>     
>>> Good. You have the patch command.
>>>       
>>> Good, you have /usr/src/redhat in place.
>>>       
>>> Good, unpackaged files will not break the build process.
>>> Good, far-too-clever Perl requirements will be ignored.
>>>       
>>> Good, you appear to only have 1 copy of Perl installed.
>>>       
>>> I think you are running on RedHat Linux, Mandriva Linux or SuSE Linux.
>>> You must have the following RPM packages installed before
>>> you try and do anything else:
>>>        binutils glibc-devel egcs make
>>> You are missing at least 1 of these.
>>> Please install them all
>>>       
>> Do you have gcc installed?
>> Fedora has probably just hit a problem caused by my being short-sighted 
>> in the install.sh script.
>>
>>   if [ -f /etc/redhat-release ] && fgrep -q ' 6.' /etc/redhat-release ; then
>>       # RedHat used egcs in RedHat 6 and not gcc
>>       GCC=egcs
>>   fi
>>
>> So if it finds "6." in the redhat-release file then it won't look for 
>> gcc, it will look for egcs. What exactly does your /etc/redhat-release 
>> file say? If you can give me that I can work on the install.sh script 
>> and produce a new version for you that will work. I can probably just 
>> abandon the RedHat 6 test altogether now. Anyone still running it 
>> deserves all they get :-)
>> Just delete those 4 lines.
>>
>>
>> Jules
>>
>>     
> People should stop using RedHat 6. It has got to be almost 8 years old!
>
>   
Yip, Thanks Jules. That did it.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070510/c9fe1746/attachment.html
From damon at txmail.marinocrane.com  Thu May 10 21:18:31 2007
From: damon at txmail.marinocrane.com (Damon Lambooy)
Date: Thu May 10 21:19:08 2007
Subject: Preferred Distribution
In-Reply-To: <46437A26.7040901@txmail.marinocrane.com>
References: <1E293D3FF63A3740B10AD5AAD88535D204E13733@UBIMAIL1.ubisoft.org>	<46436364.40507@txmail.marinocrane.com>	<46437500.7080204@ecs.soton.ac.uk>	<f1vt1v$vqs$1@sea.gmane.org>
	<46437A26.7040901@txmail.marinocrane.com>
Message-ID: <46437E17.5030309@txmail.marinocrane.com>

Damon Lambooy wrote:
> Scott Silva wrote:
>> Julian Field spake the following on 5/10/2007 12:39 PM:
>>   
>>> Damon Lambooy wrote:
>>>     
>>>> I am tring to install Mailscanner  4.59.4-2 on Fedora 7 test 4 but 
>>>> getting strange error about rpms not being installed.
>>>>       
>>>> [root@mailex MailScanner-4.59.4-2]# ./install.sh
>>>>       
>>>     
>>>> Good. You have the patch command.
>>>>       
>>>> Good, you have /usr/src/redhat in place.
>>>>       
>>>> Good, unpackaged files will not break the build process.
>>>> Good, far-too-clever Perl requirements will be ignored.
>>>>       
>>>> Good, you appear to only have 1 copy of Perl installed.
>>>>       
>>>> I think you are running on RedHat Linux, Mandriva Linux or SuSE Linux.
>>>> You must have the following RPM packages installed before
>>>> you try and do anything else:
>>>>        binutils glibc-devel egcs make
>>>> You are missing at least 1 of these.
>>>> Please install them all
>>>>       
>>> Do you have gcc installed?
>>> Fedora has probably just hit a problem caused by my being short-sighted 
>>> in the install.sh script.
>>>
>>>   if [ -f /etc/redhat-release ] && fgrep -q ' 6.' /etc/redhat-release ; then
>>>       # RedHat used egcs in RedHat 6 and not gcc
>>>       GCC=egcs
>>>   fi
>>>
>>> So if it finds "6." in the redhat-release file then it won't look for 
>>> gcc, it will look for egcs. What exactly does your /etc/redhat-release 
>>> file say? If you can give me that I can work on the install.sh script 
>>> and produce a new version for you that will work. I can probably just 
>>> abandon the RedHat 6 test altogether now. Anyone still running it 
>>> deserves all they get :-)
>>> Just delete those 4 lines.
>>>
>>>
>>> Jules
>>>
>>>     
>> People should stop using RedHat 6. It has got to be almost 8 years old!
>>
>>   
> Yip, Thanks Jules. That did it.
In  /etc/redhat-release file says " Fedora release 6.93 (Rawhide)"  and 
yes commenting out those lines worked for me.
Thanks again.
Damon
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070510/12862f31/attachment.html
From mkettler at evi-inc.com  Thu May 10 21:21:12 2007
From: mkettler at evi-inc.com (Matt Kettler)
Date: Thu May 10 21:21:26 2007
Subject: Preferred Distribution
In-Reply-To: <f1vt1v$vqs$1@sea.gmane.org>
References: <1E293D3FF63A3740B10AD5AAD88535D204E13733@UBIMAIL1.ubisoft.org>	<46436364.40507@txmail.marinocrane.com>	<46437500.7080204@ecs.soton.ac.uk>
	<f1vt1v$vqs$1@sea.gmane.org>
Message-ID: <46437EB8.4050004@evi-inc.com>

Scott Silva wrote:
> People should stop using RedHat 6. It has got to be almost 8 years old!

Yeah, clearly they should be on 6.3 by now :)

Quite frankly, I'd be surprised if modern MailScanner would even run on RedHat
6.x.. Those releases used perl 5.005. It might run, but a lot of add-ons won't.

I know the mailscanner RPM claims it only needs >= 5.005, but I know
SpamAssassin 3.0.0 and higher require perl 5.6 or higher.

As of 3.46 HTML::Parser requires perl 5.6 or higher.

From res at ausics.net  Thu May 10 21:37:03 2007
From: res at ausics.net (Res)
Date: Thu May 10 21:37:15 2007
Subject: Preferred Distribution
In-Reply-To: <f1c3264ded134143385005e9af155254@62.49.223.244>
References: <f1c3264ded134143385005e9af155254@62.49.223.244>
Message-ID: <Pine.LNX.4.64.0705110626570.15842@ebfjryy.nhfvpf.arg>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 10 May 2007, --[ UxBoD ]-- wrote:

> Hi,
>
> I am having to setup a couple of new mailservers where I am working on contract at the moment, using Dell SC1435 rack mounts.  The problem is that RedHat ES4 kernel is so old does not recognise the SAS RAID card.
>
> Now my question is should I get them to purchase RHES5, or go for either CentOS or Fedora ?

Thisa is so far off topic its a joke...but....on servers, Slackware.

Packages are identical or close as identical to the real source releases.
Easy to upgrade between distros with slapt-get (so much so you can skip 
many in-the-middle releases).
Stable, doesnt put out a release every 3 months, but keeps current.
Support, is several years (around 5+, which is the same for RHES)
Never found a bit of hardware that it wont work with yet.
2 CD install of everything, not 5.

If you want GUI... go use winblow$... But slackware does come with KDE if 
you are one of those types that just must have a GUI.



- -- 

Cheers
Res

Vote for your favourite MTA at  http://polls.ausics.net/v3.php
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGQ4JxsWhAmSIQh7MRAjSFAJ4rcvJD/tAwe2ve17i9zoyI9bMprQCfe5f/
KSImnFAVEyMkZxyvlb3VpPo=
=DqoU
-----END PGP SIGNATURE-----
From res at ausics.net  Thu May 10 21:45:25 2007
From: res at ausics.net (Res)
Date: Thu May 10 21:45:35 2007
Subject: MailScanner w/ Qmail / Plesk ( format error: file is too short )
In-Reply-To: <C268AB8F.DFF4%cplists@princeservices.com>
References: <C268AB8F.DFF4%cplists@princeservices.com>
Message-ID: <Pine.LNX.4.64.0705110642510.15842@ebfjryy.nhfvpf.arg>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

Since Qmail is unsupported in MailScanner and Julian hates people 
discussing it more than he does those talikng about postmix I'll contact 
you off-list, this way you can send me a copy of your mailscanner.conf and 
so on, PLEASE NOTE the email you get will be from a sourceforge address as 
you can not reply directly to this one.


On Thu, 10 May 2007, Cameron B. Prince wrote:

> Hi Res,
>
>> Actually I mean your MailScanner temp working dir, like
>> /var/spool/MailScanner
>>
>> chown -R qmailq.qmail /var/spool/MailScanner
>
> I checked and reset this.
>
>> the real qmail sources also set permissions diferent than what you have
>> above, the queue dir is set 750
>
> I went through both the queue and queue.in directories and reset the
> permissions.
>
>> do you know what version of qmail plesk installs now days? as in what
>> patches? I know it works on plesk from other comments I've had, but I'm
>> unsure if those posters are members of this list, I suspectmaybe not?
>> since none of them have commented.
>
> This is my first dealings with Qmail as I've historically only worked with
> sendmail. Can you tell me how I can find the information to answer your
> question?
>
>> Check perms on...
>>
>> chown qmailq.qmail /var/qmail/bin/qmail-queue
>> chown root.qmail /var/qmail/bin/qmail-inject.mailscanner
>> chmod 4755 /var/qmail/bin/qmail-queue
>> chmod 755 /var/qmail/bin/qmail-inject.mailscanner
>
> I checked and reset these... More tests result in the same error. I tried
> with an attachment also to make the message larger and it also produced the
> same error.
>
>> I have not looked at that code in a while, I can have alook this evening
>> though.
>
> Thank you,
>
> Cameron
>
>
>

- -- 

Cheers
Res

Vote for your favourite MTA at  http://polls.ausics.net/v3.php
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGQ4RosWhAmSIQh7MRAiCAAKCrCIAG+5U4T8sW3/D5q6+vHBx0twCfUKA6
ZM/BFRkL2cD3BR1f9msXQHY=
=Rxd1
-----END PGP SIGNATURE-----
From alex at nkpanama.com  Thu May 10 21:59:51 2007
From: alex at nkpanama.com (Alex Neuman van der Hans)
Date: Thu May 10 22:00:35 2007
Subject: Issue with Blackberry
In-Reply-To: <3123E1B72B666243917E340F3C8FD4A1069754@privaldc2003.prival.local>
References: <3123E1B72B666243917E340F3C8FD4A1069754@privaldc2003.prival.local>
Message-ID: <464387C7.8020208@nkpanama.com>

Gerhard Mourani wrote:
> Hi Steve,
> Allow IFrame Tags = 
> Allow Form Tags = 
> Allow Script Tags = 
> Allow WebBugs = 
>
> All of the above should be set to yes for Blackberry to correctly
> display mails.
>   
Why?
From hvdkooij at vanderkooij.org  Thu May 10 22:15:10 2007
From: hvdkooij at vanderkooij.org (Hugo van der Kooij)
Date: Thu May 10 22:15:40 2007
Subject: Preferred Distribution
In-Reply-To: <46431AB1.3040803@linux-kernel.at>
References: <f1c3264ded134143385005e9af155254@62.49.223.244>
	<46431AB1.3040803@linux-kernel.at>
Message-ID: <Pine.LNX.4.64.0705102312550.21154@faramir.hugo.vanderkooij.org>

On Thu, 10 May 2007, Oliver Falk wrote:

> On 05/10/2007 03:00 PM, --[ UxBoD ]-- wrote:
>>  I am having to setup a couple of new mailservers where
>>  I am working on contract at the moment, using Dell
>>  SC1435 rack mounts.
>>  The problem is that RedHat ES4 kernel is so old does
>>  not recognise the SAS RAID card.
>>
>>  Now my question is should I get them to purchase
>>  RHES5,
>
> If you don't need support, there's no need for EL5.
>
>>  or go for either CentOS or Fedora ?
>
> Both is fine. Fedora should recognize it AFAIK.

I do not recommend Fedora in anything even resembling a production 
environment. I hate to install a system which will be out of security 
updates in about a year.

If you just want the system go for Centos 5 and use RHEL 5 if they want to 
spend money on support.

Hugo.

-- 
 	hvdkooij@vanderkooij.org	http://hugo.vanderkooij.org/
 	    This message is using 100% recycled electrons.

 	Some men see computers as they are and say "Windows"
 	I use computers with Linux and say "Why Windows?"
 		(Thanks JFK, for the insight.)
From dave.list at pixelhammer.com  Thu May 10 22:24:09 2007
From: dave.list at pixelhammer.com (DAve)
Date: Thu May 10 22:25:14 2007
Subject: Issue with Blackberry
In-Reply-To: <3123E1B72B666243917E340F3C8FD4A1069754@privaldc2003.prival.local>
References: <3123E1B72B666243917E340F3C8FD4A1069754@privaldc2003.prival.local>
Message-ID: <46438D79.8060107@pixelhammer.com>

Gerhard Mourani wrote:
> Hi Steve,
> 
> Thanks for your help, yes I've fixed this part into the config and also
> find other options responsible of this issue with Blackberry devices.
> Bellow is the options part causing the problems.
> 
> Allow IFrame Tags = 
> Allow Form Tags = 
> Allow Script Tags = 
> Allow WebBugs = 
> 
> All of the above should be set to yes for Blackberry to correctly
> display mails.
> 
> Gerhard

Our Blackberry users report no problems, we do not allow webbugs.
Allow WebBugs = disarm

DAve


-- 
Three years now I've asked Google why they don't have a
logo change for Memorial Day. Why do they choose to do logos
for other non-international holidays, but nothing for
Veterans?

Maybe they forgot who made that choice possible.
From alex at nkpanama.com  Thu May 10 22:31:11 2007
From: alex at nkpanama.com (Alex Neuman van der Hans)
Date: Thu May 10 22:31:54 2007
Subject: Issue with Blackberry
In-Reply-To: <46438D79.8060107@pixelhammer.com>
References: <3123E1B72B666243917E340F3C8FD4A1069754@privaldc2003.prival.local>
	<46438D79.8060107@pixelhammer.com>
Message-ID: <46438F1F.3000904@nkpanama.com>

DAve wrote:
> Our Blackberry users report no problems, we do not allow webbugs.
> Allow WebBugs = disarm
In fact, our blackberry users appreciate when e-mails get html-stripped 
completely.
From mbneto at gmail.com  Thu May 10 22:34:56 2007
From: mbneto at gmail.com (mbneto)
Date: Thu May 10 22:34:58 2007
Subject: Build only (from rpm.tar.gz)
In-Reply-To: <4643737D.1090500@ecs.soton.ac.uk>
References: <5cf776b80705100909t347d505co4c5776278daa559b@mail.gmail.com>
	<4643737D.1090500@ecs.soton.ac.uk>
Message-ID: <5cf776b80705101434t570d9e51r9118faa4d853fdf3@mail.gmail.com>

Thanks Julian,

I was looking at /usr/src/redhat/RPMS/(i386|noarch) where the others rpms
are generated.

Probably there is a reason for this but as a suggestion consider putting the
mailscanner.rpm there too.

regards.

On 5/10/07, Julian Field <MailScanner@ecs.soton.ac.uk> wrote:
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> It's there, you must be looking straight through it.
>
> MailScanner-4.59.4-2/mailscanner-4.59.4-2.noarch.rpm
> in the rpm.tar.gz file.
>
> mbneto wrote:
> > Hi,
> >
> > I've noticed that when I perform a ./install.sh it generates a lot of
> > rpm files and later installs.  I could not find, however, the rpm for
> > the mailscanner itself only the perl, tnef etc.
> >
> > Since I need to maintain a number of servers that does not have gcc
> > and other libraries I need to generate the complete set of rpm and add
> > to my yum repository.
> >
> > Any idea of how to do that (or to find the mailscanner.rpm generated)?
> >
> > tks.
> >
> >
>
> Jules
>
> - --
> Julian Field MEng CITP
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> MailScanner customisation, or any advanced system administration help?
> Contact me at Jules@Jules.FM
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> For all your IT requirements visit www.transtec.co.uk
>
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGP Desktop 9.6.1 (Build 1012)
> Charset: ISO-8859-1
>
> wj8DBQFGQ3OuEfZZRxQVtlQRAiQjAJ0ZYBqUBxToowiZxdk3MUZ/QR/7wwCgpcMu
> BWwU0ULq/aOZ3DDkLM6gIe0=
> =NfMx
> -----END PGP SIGNATURE-----
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> For all your IT requirements visit www.transtec.co.uk
>
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070510/ca75d1c0/attachment.html
From ka at pacific.net  Thu May 10 23:03:22 2007
From: ka at pacific.net (Ken A)
Date: Thu May 10 23:03:26 2007
Subject: Preferred Distribution
In-Reply-To: <Pine.LNX.4.64.0705102312550.21154@faramir.hugo.vanderkooij.org>
References: <f1c3264ded134143385005e9af155254@62.49.223.244>	<46431AB1.3040803@linux-kernel.at>
	<Pine.LNX.4.64.0705102312550.21154@faramir.hugo.vanderkooij.org>
Message-ID: <464396AA.5090005@pacific.net>

Hugo van der Kooij wrote:
> On Thu, 10 May 2007, Oliver Falk wrote:
> 
>> On 05/10/2007 03:00 PM, --[ UxBoD ]-- wrote:
>>>  I am having to setup a couple of new mailservers where
>>>  I am working on contract at the moment, using Dell
>>>  SC1435 rack mounts.
>>>  The problem is that RedHat ES4 kernel is so old does
>>>  not recognise the SAS RAID card.
>>>
>>>  Now my question is should I get them to purchase
>>>  RHES5,
>>
>> If you don't need support, there's no need for EL5.
>>
>>>  or go for either CentOS or Fedora ?
>>
>> Both is fine. Fedora should recognize it AFAIK.
> 
> I do not recommend Fedora in anything even resembling a production 
> environment. I hate to install a system which will be out of security 
> updates in about a year.
> 
> If you just want the system go for Centos 5 and use RHEL 5 if they want 
> to spend money on support.
> 
> Hugo.
> 

FC works fine in production. Whether it's a good choice depends on what 
hardware/software support you want/need, what else the box is doing, how 
well you can lock it down, and of course who you have to please! Busy 
spam-stomping machines can have a short hardware life-cycle too. Next 
year's hardware will be faster.

FC7 will have better virtualization support than Centos5 does. You might 
need that, you might not. It might be buggy. You might not want to deal 
with that, or you might think it's a challenge.

Securing a bare bones MailScanner box doesn't require that your entire 
LAMP install and all binaries be up2date. Of course it's best to have a 
box completely patched, but if vulnerable items are not accessible, it's 
as good as patched, well almost... Some can't sleep with that. Some can. 
Your choice.

-- 
Ken Anderson
Pacific.Net
From amaclach at yahoo.co.uk  Thu May 10 23:36:50 2007
From: amaclach at yahoo.co.uk (Andrew MacLachlan)
Date: Thu May 10 23:36:52 2007
Subject: Preferred Distribution
Message-ID: <668089.55548.qm@web26309.mail.ukl.yahoo.com>

> People should stop using RedHat 6. It has got to be almost 8 years old!

Doesn't stop people using NT4... That was 10 years old in November and just as flaky as ever except the hardware it's running on has now almost turned to dust.

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 



From mkettler at evi-inc.com  Fri May 11 00:39:06 2007
From: mkettler at evi-inc.com (Matt Kettler)
Date: Fri May 11 00:39:19 2007
Subject: Preferred Distribution
In-Reply-To: <668089.55548.qm@web26309.mail.ukl.yahoo.com>
References: <668089.55548.qm@web26309.mail.ukl.yahoo.com>
Message-ID: <4643AD1A.3020706@evi-inc.com>

Andrew MacLachlan wrote:

> Doesn't stop people using NT4... That was 10 years old in November and just as flaky as ever except the hardware it's running on has now almost turned to dust.

Flaky is such a gentle way to put it.... :)
From mikej at rogers.com  Fri May 11 00:49:11 2007
From: mikej at rogers.com (Mike Jakubik)
Date: Fri May 11 00:51:11 2007
Subject: Preferred Distribution
In-Reply-To: <f1c3264ded134143385005e9af155254@62.49.223.244>
References: <f1c3264ded134143385005e9af155254@62.49.223.244>
Message-ID: <4643AF77.5040202@rogers.com>

--[ UxBoD ]-- wrote:
> Hi,
>
> I am having to setup a couple of new mailservers where I am working on contract at the moment, using Dell SC1435 rack mounts.  The problem is that RedHat ES4 kernel is so old does not recognise the SAS RAID card.
>
> Now my question is should I get them to purchase RHES5, or go for either CentOS or Fedora ?
>   

FreeBSD.

From cplists at princeservices.com  Fri May 11 06:12:44 2007
From: cplists at princeservices.com (Cameron B. Prince)
Date: Fri May 11 06:12:53 2007
Subject: MailScanner w/ Qmail / Plesk ( format error: file is too short )
In-Reply-To: <Pine.LNX.4.64.0705110642510.15842@ebfjryy.nhfvpf.arg>
Message-ID: <C269657C.E064%cplists@princeservices.com>

Hi Res,

Just wanted to let you know that I did reply to your message off-list.
Please let me know if my reply didn't make it to you.

Thanks,
Cameron


On 5/10/07 3:45 PM, "Res" <res@ausics.net> wrote:

> Hi,
> 
> Since Qmail is unsupported in MailScanner and Julian hates people
> discussing it more than he does those talikng about postmix I'll contact
> you off-list, this way you can send me a copy of your mailscanner.conf and
> so on, PLEASE NOTE the email you get will be from a sourceforge address as
> you can not reply directly to this one.
> 


From res at ausics.net  Fri May 11 06:39:42 2007
From: res at ausics.net (Res)
Date: Fri May 11 06:39:52 2007
Subject: MailScanner w/ Qmail / Plesk ( format error: file is too short )
In-Reply-To: <C269657C.E064%cplists@princeservices.com>
References: <C269657C.E064%cplists@princeservices.com>
Message-ID: <Pine.LNX.4.64.0705111532360.17333@ebfjryy.nhfvpf.arg>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Fri, 11 May 2007, Cameron B. Prince wrote:

> Hi Res,
>
> Just wanted to let you know that I did reply to your message off-list.
> Please let me know if my reply didn't make it to you.

Got it... Good thing about the sourceforge address is it bypasses RBL's, 
my rather anal access lists, and spamassassin, it needs to cause of the 
devel work I do, SA was forever high scoring a lot of the diffs :)


- -- 

Cheers
Res

Vote for your favourite MTA at  http://polls.ausics.net/v3.php
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGRAGgsWhAmSIQh7MRAsLEAJ9vj9lJEJirw+2t8bpqiXnPt6lnfQCcCsV5
VtPdJd/X3ttw6UXa5E2bhO8=
=NZSY
-----END PGP SIGNATURE-----
From yadu at netmagicsolutions.com  Fri May 11 07:34:25 2007
From: yadu at netmagicsolutions.com (Yadavendra Awasthi)
Date: Fri May 11 07:34:36 2007
Subject: SMTP_AUTH and sender restriction based on local domain using
	Mailscanner
Message-ID: <062c01c79396$6b6929a0$1c01010a@netdom.loc>

Hi List,

I have configured outgoing SMTP server with SMTP_AUTH on postfix. Is it possible to have user based restriction in Mailscanner such that limited authenticated users are allowed to relay mail outside and all authenticated users are allowed to send mails to local domain.

Regards.
Yadavendra Awasthi.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070511/30b5c794/attachment.html
From tgc at statsbiblioteket.dk  Fri May 11 08:09:43 2007
From: tgc at statsbiblioteket.dk (Tom G. Christensen)
Date: Fri May 11 08:09:45 2007
Subject: Preferred Distribution
In-Reply-To: <f1c3264ded134143385005e9af155254@62.49.223.244>
References: <f1c3264ded134143385005e9af155254@62.49.223.244>
Message-ID: <464416B7.6010008@statsbiblioteket.dk>

--[ UxBoD ]-- wrote:
> Hi,
> 
> I am having to setup a couple of new mailservers where I am working
> on contract at the moment, using Dell SC1435 rack mounts.  The
> problem is that RedHat ES4 kernel is so old does not recognise the
> SAS RAID card.
> 
Use the latest RHEL4 update (U5) instead of the first release.

> Now my question is should I get them to purchase RHES5, or go for
> either CentOS or Fedora ?
> 
With a valid server subscription you can use any version of RHEL you 
like. They can all be downloaded from RHN.

> Personally I would use Gentoo or Ubuntu, but they are really *not*
> happy in using either of them for a corporate system :(
> 
Smart people.

-tgc
From uxbod at splatnix.net  Fri May 11 08:58:15 2007
From: uxbod at splatnix.net (--[ UxBoD ]--)
Date: Fri May 11 08:58:19 2007
Subject: Preferred Distribution
In-Reply-To: <46437E17.5030309@txmail.marinocrane.com>
References: <46437E17.5030309@txmail.marinocrane.com>
Message-ID: <b84b6e4e0a9de83274ee2784d7cbf812@62.49.223.244>

I am going to explore the CentOS route. Mainly due to the fact that the service will be email on the server, and not a application server like Oracle. I do appreciate that we would get support with RH, but with such a strong community behind most of the distributions we would be getting that anyway ;)

Thanks all for your input, and yes I was joking when I said Gentoo or Ubuntu.  Unfortunately neither are really ready for enterprise use yet for different reasons.


-- 
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.

From list-mailscanner at linguaphone.com  Fri May 11 09:16:09 2007
From: list-mailscanner at linguaphone.com (Gareth)
Date: Fri May 11 09:16:17 2007
Subject: Preferred Distribution
In-Reply-To: <46437EB8.4050004@evi-inc.com>
References: <1E293D3FF63A3740B10AD5AAD88535D204E13733@UBIMAIL1.ubisoft.org>
	<46436364.40507@txmail.marinocrane.com>	<46437500.7080204@ecs.soton.ac.uk>
	<f1vt1v$vqs$1@sea.gmane.org>  <46437EB8.4050004@evi-inc.com>
Message-ID: <1178871369.6218.4.camel@gblades-suse.linguaphone-intranet.co.uk>

On Thu, 2007-05-10 at 21:21, Matt Kettler wrote:
> Scott Silva wrote:
> > People should stop using RedHat 6. It has got to be almost 8 years old!
> 
> Yeah, clearly they should be on 6.3 by now :)
> 
> Quite frankly, I'd be surprised if modern MailScanner would even run on RedHat
> 6.x.. Those releases used perl 5.005. It might run, but a lot of add-ons won't.
> 
> I know the mailscanner RPM claims it only needs >= 5.005, but I know
> SpamAssassin 3.0.0 and higher require perl 5.6 or higher.
> 
> As of 3.46 HTML::Parser requires perl 5.6 or higher.

I am still using Redhat 9 on my home server. I am running Spamassassin
3.18 fine with Pyzor, Razor, FuzzyOCR etc...

I upgraded Perl to 5.8 and then reinstalled all the modules.
I think one program failed to run afterwards but I just edited the per
to make it point to the old perl.
I had problems getting a couple of modules to install so I think SPF
checks are currently not operational but thats it.

From evanderleun at hal9000.nl  Fri May 11 09:42:06 2007
From: evanderleun at hal9000.nl (Erik van der Leun)
Date: Fri May 11 09:42:15 2007
Subject: Preferred Distribution
In-Reply-To: <f1c3264ded134143385005e9af155254@62.49.223.244>
References: <f1c3264ded134143385005e9af155254@62.49.223.244>
Message-ID: <46442C5E.5010003@hal9000.nl>

--[ UxBoD ]-- wrote:
> Hi,
>
> I am having to setup a couple of new mailservers where I am working on contract at the moment, using Dell SC1435 rack mounts.  The problem is that RedHat ES4 kernel is so old does not recognise the SAS RAID card.
>
> Now my question is should I get them to purchase RHES5, or go for either CentOS or Fedora ?
>
> Personally I would use Gentoo or Ubuntu, but they are really *not* happy in using either of them for a corporate system :(
>   
I'm quite happy with my choice for Gentoo Linux really...
I use the MailScanner tarball and handle the rest gentoo-wise.

I haven't seen much gentoo users on this mailinglist yet though :-)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070511/ea703ed2/attachment.html
From amaclach at yahoo.co.uk  Fri May 11 09:44:41 2007
From: amaclach at yahoo.co.uk (Andrew MacLachlan)
Date: Fri May 11 09:44:44 2007
Subject: Preferred Distribution
Message-ID: <267957.74168.qm@web26313.mail.ukl.yahoo.com>

I've got MailScanner working with postfix 2.4 and SA 3.2.0 on a virtualised Babbage Analytical Engine (I was having trouble getting parts for the original hardware)...

----- Original Message ----
From: Gareth <list-mailscanner@linguaphone.com>
To: MailScanner discussion <mailscanner@lists.mailscanner.info>
Sent: Friday, 11 May, 2007 9:16:09 AM
Subject: Re: Preferred Distribution

On Thu, 2007-05-10 at 21:21, Matt Kettler wrote:
> Scott Silva wrote:
> > People should stop using RedHat 6. It has got to be almost 8 years old!
> 
> Yeah, clearly they should be on 6.3 by now :)
> 
> Quite frankly, I'd be surprised if modern MailScanner would even run on RedHat
> 6.x.. Those releases used perl 5.005. It might run, but a lot of add-ons won't.
> 
> I know the mailscanner RPM claims it only needs >= 5.005, but I know
> SpamAssassin 3.0.0 and higher require perl 5.6 or higher.
> 
> As of 3.46 HTML::Parser requires perl 5.6 or higher.

I am still using Redhat 9 on my home server. I am running Spamassassin
3.18 fine with Pyzor, Razor, FuzzyOCR etc...

I upgraded Perl to 5.8 and then reinstalled all the modules.
I think one program failed to run afterwards but I just edited the per
to make it point to the old perl.
I had problems getting a couple of modules to install so I think SPF
checks are currently not operational but thats it.

-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 



From glenn.steen at gmail.com  Fri May 11 09:46:29 2007
From: glenn.steen at gmail.com (Glenn Steen)
Date: Fri May 11 09:46:32 2007
Subject: Issue with Blackberry
In-Reply-To: <46438F1F.3000904@nkpanama.com>
References: <3123E1B72B666243917E340F3C8FD4A1069754@privaldc2003.prival.local>
	<46438D79.8060107@pixelhammer.com> <46438F1F.3000904@nkpanama.com>
Message-ID: <223f97700705110146k2397cd41n1f6d5d1f66fff994@mail.gmail.com>

On 10/05/07, Alex Neuman van der Hans <alex@nkpanama.com> wrote:
> DAve wrote:
> > Our Blackberry users report no problems, we do not allow webbugs.
> > Allow WebBugs = disarm
> In fact, our blackberry users appreciate when e-mails get html-stripped
> completely.

Yes.... I suspect Gerhad should perhaps look long and hard at his
blackberry server, since that is the one responsible for formatting...
We've seen some discrepancies with mail that is locally generated
(hence never passes through MailScanner) that kind of looks like what
he describes.
Or perhaps it might be the simple fact that MS "edits" messages with
forms and such, resulting in some kind of EOL or character set
problems, which might confuse the blackberry server (if he indeed has
one and is running Ent ed.).

Cheers (well, that was yesterday... Testing Single Malts (all Ila)...:-)
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
From prandal at herefordshire.gov.uk  Fri May 11 09:48:01 2007
From: prandal at herefordshire.gov.uk (Randal, Phil)
Date: Fri May 11 09:48:10 2007
Subject: Preferred Distribution
In-Reply-To: <46431C32.4030404@enitech.com.au>
References: <f1c3264ded134143385005e9af155254@62.49.223.244>
	<46431C32.4030404@enitech.com.au>
Message-ID: <7EF0EE5CB3B263488C8C18823239BEBAB2507E@HC-MBX02.herefordshire.gov.uk>

I'd use CentOS 5 , not 4, if you're planning to use FuzzyOcr.

netpbm is way too old on CentOS /RHEL 4, and you have to mess about with
FuzzyOcr's scansets to get it to work properly.

Cheers,

Phil

--
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK  

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info 
> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf 
> Of Pete Russell
> Sent: 10 May 2007 14:21
> To: MailScanner discussion
> Subject: Re: Preferred Distribution
> 
> Fedora? They do not have support lifecycle suitable for corporate 
> clients (espe ones using external linux skills), IMO.
> 
> CentOS is the logical choice. Hassle free, you know 
> mailscanner is going 
> to work nicely on it - its RHAS...
> 
> 
> 
> --[ UxBoD ]-- wrote:
> > Hi,
> > 
> > I am having to setup a couple of new mailservers where I am 
> working on contract at the moment, using Dell SC1435 rack 
> mounts.  The problem is that RedHat ES4 kernel is so old does 
> not recognise the SAS RAID card.
> > 
> > Now my question is should I get them to purchase RHES5, or 
> go for either CentOS or Fedora ?
> > 
> > Personally I would use Gentoo or Ubuntu, but they are 
> really *not* happy in using either of them for a corporate system :(
> -- 
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website! 
> 
From prandal at herefordshire.gov.uk  Fri May 11 09:54:13 2007
From: prandal at herefordshire.gov.uk (Randal, Phil)
Date: Fri May 11 09:54:20 2007
Subject: Preferred Distribution
In-Reply-To: <1E293D3FF63A3740B10AD5AAD88535D204E13733@UBIMAIL1.ubisoft.org>
References: <f1c3264ded134143385005e9af155254@62.49.223.244>
	<1E293D3FF63A3740B10AD5AAD88535D204E13733@UBIMAIL1.ubisoft.org>
Message-ID: <7EF0EE5CB3B263488C8C18823239BEBAB25080@HC-MBX02.herefordshire.gov.uk>

You can use yum to update CentOS in an analogous manner to RHEL's old up2date.

The rpmforge yum repository has re2c, needed for sa-compile with SA 3.2.0.

CentOS 5 with protectbase plugin for yum plus the rpmforge repository and Jules' handy installers should mean not having to go to CPAN for anything (though there may be some FuzzOCR dependencies still needing the manual use of CPAN - I've yet to check).

Cheers,

Phil

--
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK  

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info 
> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf 
> Of Daniel Maher
> Sent: 10 May 2007 14:18
> To: MailScanner discussion
> Subject: RE: Preferred Distribution
> 
> > -----Original Message-----
> > From: mailscanner-bounces@lists.mailscanner.info 
> [mailto:mailscanner-
> > bounces@lists.mailscanner.info] On Behalf Of --[ UxBoD ]--
> > Sent: May 10, 2007 9:01 AM
> > To: mailscanner@lists.mailscanner.info
> > Subject: Preferred Distribution
> > 
> > Hi,
> > 
> > I am having to setup a couple of new mailservers where I am 
> working on
> > contract at the moment, using Dell SC1435 rack mounts.  The 
> problem is
> > that RedHat ES4 kernel is so old does not recognise the SAS 
> RAID card.
> > 
> > Now my question is should I get them to purchase RHES5, or 
> go for either
> > CentOS or Fedora ?
> > 
> > Personally I would use Gentoo or Ubuntu, but they are 
> really *not* happy
> > in using either of them for a corporate system :(
> 
> At my (reasonably large multi-national) company, we've 
> started using CentOS for all of our new machines, and will 
> likely continue to do so.  We don't need RedHat's telephone 
> support, nor do we care to use up2date, ergo the benefits of 
> using RedHat over CentOS are almost non-existent.  
> 
> YMMV, of course - especially if you're at a smaller 
> organisation where phone support might come in handy, or 
> where you don't manage your own software repository.
> 
> 0.02$
> 
> 
> --
>   _
>  ?v?  Daniel Maher
> /(_)\ Administrateur Syst?me Unix
>  ^ ^  Unix System Administrator
>  
> "The most incomprehensible thing about the world is that it 
> is comprehensible." -- Albert Einstein.
> -- 
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website! 
> 
From john at tradoc.fr  Fri May 11 10:01:13 2007
From: john at tradoc.fr (John Wilcock)
Date: Fri May 11 10:01:23 2007
Subject: Preferred Distribution
In-Reply-To: <46442C5E.5010003@hal9000.nl>
References: <f1c3264ded134143385005e9af155254@62.49.223.244>
	<46442C5E.5010003@hal9000.nl>
Message-ID: <464430D9.8090706@tradoc.fr>

Erik van der Leun wrote:
> I'm quite happy with my choice for
> Gentoo Linux really...
> 
> I use the MailScanner tarball and handle the rest gentoo-wise.
> 
> I haven't seen much gentoo users on this mailinglist yet though :-)

I've recently switched from Redhat to Gentoo at the suggestion of my 
favourite hosting company - I leased a test server for a month and never 
looked back. The build-everything-from-source philosophy appeals to me...

On my production server I'm currently using the slightly-outdated 
version of MailScanner (4.57.6.1) in the sunrise overlay, and I'm 
intending to experiment with generating an updated ebuild soon on a 
spare server.

John.

-- 
-- Over 3000 webcams from ski resorts around the world - www.snoweye.com
-- Translate your technical documents and web pages    - www.tradoc.fr
From uxbod at splatnix.net  Fri May 11 10:14:40 2007
From: uxbod at splatnix.net (--[ UxBoD ]--)
Date: Fri May 11 10:14:43 2007
Subject: Preferred Distribution
In-Reply-To: <7EF0EE5CB3B263488C8C18823239BEBAB2507E@HC-MBX02.herefordshire.gov.uk>
References: <7EF0EE5CB3B263488C8C18823239BEBAB2507E@HC-MBX02.herefordshire.gov.uk>
Message-ID: <1e0f1a74ad87496db2babcfbd1b8271e@62.49.223.244>

To be honest, even on a RHES4 server I recently built, I did not rely on any of the installed packages, and built the whole system including perl etc directly from source.  This meant I knew exactly what perl modules and software were in use.  Plus, was able to stream line a lot of the packages ie. perl and PHP.

On Fri, 11 May 2007 09:48:01 +0100, "Randal, Phil" <prandal@herefordshire.gov.uk> wrote:
> I'd use CentOS 5 , not 4, if you're planning to use FuzzyOcr.
> 
> netpbm is way too old on CentOS /RHEL 4, and you have to mess about with
> FuzzyOcr's scansets to get it to work properly.
> 
> Cheers,
> 
> Phil
> 
> --
> Phil Randal
> Network Engineer
> Herefordshire Council
> Hereford, UK  
> 
>> -----Original Message-----
>> From: mailscanner-bounces@lists.mailscanner.info 
>> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf 
>> Of Pete Russell
>> Sent: 10 May 2007 14:21
>> To: MailScanner discussion
>> Subject: Re: Preferred Distribution
>> 
>> Fedora? They do not have support lifecycle suitable for corporate 
>> clients (espe ones using external linux skills), IMO.
>> 
>> CentOS is the logical choice. Hassle free, you know 
>> mailscanner is going 
>> to work nicely on it - its RHAS...
>> 
>> 
>> 
>> --[ UxBoD ]-- wrote:
>> > Hi,
>> > 
>> > I am having to setup a couple of new mailservers where I am 
>> working on contract at the moment, using Dell SC1435 rack 
>> mounts.  The problem is that RedHat ES4 kernel is so old does 
>> not recognise the SAS RAID card.
>> > 
>> > Now my question is should I get them to purchase RHES5, or 
>> go for either CentOS or Fedora ?
>> > 
>> > Personally I would use Gentoo or Ubuntu, but they are 
>> really *not* happy in using either of them for a corporate system :(
>> -- 
>> MailScanner mailing list
>> mailscanner@lists.mailscanner.info
>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>> 
>> Before posting, read http://wiki.mailscanner.info/posting
>> 
>> Support MailScanner development - buy the book off the website! 
>> 
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
> 
>
-- 
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
// Phone: +44 (0) 845 869 2749  SIP: uxbod@sip.splatnix.net


-- 
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.

From uxbod at splatnix.net  Fri May 11 10:16:10 2007
From: uxbod at splatnix.net (--[ UxBoD ]--)
Date: Fri May 11 10:16:37 2007
Subject: Preferred Distribution
In-Reply-To: <464430D9.8090706@tradoc.fr>
References: <464430D9.8090706@tradoc.fr>
Message-ID: <8656512431664886eb008e7f17b5eaed@62.49.223.244>

My home workstation and server are all on Gentoo.  I love meta-distributions as they are extremely light, especially for a server.  Though as somebody else said on here, if you had 100s of servers to manage it could be quite difficult pushing the package changes out.

On Fri, 11 May 2007 11:01:13 +0200, John Wilcock <john@tradoc.fr> wrote:
> Erik van der Leun wrote:
>> I'm quite happy with my choice for
>> Gentoo Linux really...
>>
>> I use the MailScanner tarball and handle the rest gentoo-wise.
>>
>> I haven't seen much gentoo users on this mailinglist yet though :-)
> 
> I've recently switched from Redhat to Gentoo at the suggestion of my
> favourite hosting company - I leased a test server for a month and never
> looked back. The build-everything-from-source philosophy appeals to me...
> 
> On my production server I'm currently using the slightly-outdated
> version of MailScanner (4.57.6.1) in the sunrise overlay, and I'm
> intending to experiment with generating an updated ebuild soon on a
> spare server.
> 
> John.
> 
> --
> -- Over 3000 webcams from ski resorts around the world - www.snoweye.com
> -- Translate your technical documents and web pages    - www.tradoc.fr
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
> 
> --
> This message has been scanned for viruses and dangerous content by
> MailScanner, and is
> believed to be clean.
-- 
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: 543A E778 7F2D 98F1 3E50 9C1F F190 93E0 E8E8 0CF8
// Keyserver: www.keyserver.net Key-ID: 0xE8E80CF8
// Phone: +44 (0) 845 869 2749  SIP: uxbod@sip.splatnix.net


-- 
This message has been scanned for viruses and dangerous content by MailScanner, and is
believed to be clean.

From jan-peter at koopmann.eu  Fri May 11 11:27:38 2007
From: jan-peter at koopmann.eu (Koopmann, Jan-Peter)
Date: Fri May 11 11:27:50 2007
Subject: Preferred Distribution
In-Reply-To: <4643AF77.5040202@rogers.com>
References: <f1c3264ded134143385005e9af155254@62.49.223.244>
	<4643AF77.5040202@rogers.com>
Message-ID: <AEF86EFA5497434190F6D57E2666EA7A84EF37@ERWIN.intern.seceidos.de>

On Friday, May 11, 2007 1:49 AM Mike Jakubik wrote:

> FreeBSD.

I did not dare to throw that one in but naturally I second that opinion!


Regards,
  JP
From glenn.steen at gmail.com  Fri May 11 12:14:11 2007
From: glenn.steen at gmail.com (Glenn Steen)
Date: Fri May 11 12:14:14 2007
Subject: Build only (from rpm.tar.gz)
In-Reply-To: <5cf776b80705101434t570d9e51r9118faa4d853fdf3@mail.gmail.com>
References: <5cf776b80705100909t347d505co4c5776278daa559b@mail.gmail.com>
	<4643737D.1090500@ecs.soton.ac.uk>
	<5cf776b80705101434t570d9e51r9118faa4d853fdf3@mail.gmail.com>
Message-ID: <223f97700705110414n180e74f6ia3dff7d172db06b5@mail.gmail.com>

On 10/05/07, mbneto <mbneto@gmail.com> wrote:
> Thanks Julian,
>
> I was looking at /usr/src/redhat/RPMS/(i386|noarch) where
> the others rpms are generated.
>
> Probably there is a reason for this but as a suggestion consider putting the
> mailscanner.rpm there too.
>
> regards.

Keyword here is that the other rpms are _generated_ on your system
(the RPMs are rebuilt). This is why they are in the /usr/src/RPM tree.
Since the MailScanner RPM isn't rebuilt, it doesn't end up in that
place, and it shouldn't... So there really is nothing to do here, for
Jules.

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
From ugob at lubik.ca  Fri May 11 12:14:49 2007
From: ugob at lubik.ca (Ugo Bellavance)
Date: Fri May 11 12:14:33 2007
Subject: MCP
Message-ID: <f21j62$ac2$1@sea.gmane.org>

Hi,

	I'm thinking about implementing MCP on my servers, but I have a few 
questions:

1- I know it runs a second copy of SpamAssassin... but what kind of load 
does it add to the system?

2- Is there still an issue regarding no-spam-scanning and MCP like in 
http://permalink.gmane.org/gmane.mail.virus.mailscanner/48773

3- Is the bug related to sa-update fixed (see 
http://thread.gmane.org/gmane.mail.virus.mailscanner/46722)?

Regards,

Ugo

From gmourani at prival.ca  Fri May 11 15:02:19 2007
From: gmourani at prival.ca (Gerhard Mourani)
Date: Fri May 11 15:02:43 2007
Subject: Issue with Blackberry
In-Reply-To: <223f97700705110146k2397cd41n1f6d5d1f66fff994@mail.gmail.com>
Message-ID: <3123E1B72B666243917E340F3C8FD4A106977D@privaldc2003.prival.local>

I don't have any control on this blackberry server and I don't think my
client use their own blackberry server but just receive from around the
word through blackberry network. Also I know that they updated all
blackberry devices to the latest one available from the company and
without saying 'yes' to the option as posted before, then lot users call
and complain about problem not being able to read their email on
Blackberry. This doesn't happen on Outlook for example when they receive
from Blackberry network and again just on the Blackberry device itself.

Gerhard,

-----Original Message-----
From: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Glenn
Steen
Sent: Friday, May 11, 2007 4:46 AM
To: MailScanner discussion
Subject: Re: Issue with Blackberry

On 10/05/07, Alex Neuman van der Hans <alex@nkpanama.com> wrote:
> DAve wrote:
> > Our Blackberry users report no problems, we do not allow webbugs.
> > Allow WebBugs = disarm
> In fact, our blackberry users appreciate when e-mails get
html-stripped
> completely.

Yes.... I suspect Gerhad should perhaps look long and hard at his
blackberry server, since that is the one responsible for formatting...
We've seen some discrepancies with mail that is locally generated
(hence never passes through MailScanner) that kind of looks like what
he describes.
Or perhaps it might be the simple fact that MS "edits" messages with
forms and such, resulting in some kind of EOL or character set
problems, which might confuse the blackberry server (if he indeed has
one and is running Ent ed.).

Cheers (well, that was yesterday... Testing Single Malts (all Ila)...:-)
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

From claude.gagne at multitech.qc.ca  Fri May 11 15:24:02 2007
From: claude.gagne at multitech.qc.ca (=?ISO-8859-1?Q?Claude_Gagn=E9?=)
Date: Fri May 11 15:22:34 2007
Subject: init.d script
Message-ID: <46447C82.90006@multitech.qc.ca>

Hi,

I use the tarball installation of the lastest MailScanner on Ubuntu 
Server but I can't find the /etc/init.d script that everybody seems to 
have. I have searched on the wiki and MS web site but I can't find it.

Any can tell me where can I get it ?

Thanks.

Claude
From mkercher at nfsmith.com  Fri May 11 15:33:15 2007
From: mkercher at nfsmith.com (Mike Kercher)
Date: Fri May 11 15:37:08 2007
Subject: SMTP_AUTH and sender restriction based on local domain
	usingMailscanner
References: <062c01c79396$6b6929a0$1c01010a@netdom.loc>
Message-ID: <6DEF8ABC1767C045B91F42066D36358E920C@HOUPEX01.nfsmith.info>

I wouldn't think so since MailScanner doesn't touch the SMTP
transactions.
 

-Mike 

 

________________________________

From: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of
Yadavendra Awasthi
Sent: Friday, May 11, 2007 1:34 AM
To: mailscanner@lists.mailscanner.info
Subject: SMTP_AUTH and sender restriction based on local domain
usingMailscanner


Hi List,
 
I have configured outgoing SMTP server with SMTP_AUTH on postfix. Is it
possible to have user based restriction in Mailscanner such that limited
authenticated users are allowed to relay mail outside and all
authenticated users are allowed to send mails to local domain.
 
Regards.
Yadavendra Awasthi.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070511/24e38dd1/attachment.html
From res at ausics.net  Fri May 11 15:46:56 2007
From: res at ausics.net (Res)
Date: Fri May 11 15:47:06 2007
Subject: init.d script
In-Reply-To: <46447C82.90006@multitech.qc.ca>
References: <46447C82.90006@multitech.qc.ca>
Message-ID: <Pine.LNX.4.64.0705120046140.19309@ebfjryy.nhfvpf.arg>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This is for RPM versions, tarball install everything under /opt

We don't really need it :)

On Fri, 11 May 2007, Claude Gagn? wrote:

> Hi,
>
> I use the tarball installation of the lastest MailScanner on Ubuntu Server 
> but I can't find the /etc/init.d script that everybody seems to have. I have 
> searched on the wiki and MS web site but I can't find it.
>
> Any can tell me where can I get it ?
>
> Thanks.
>
> Claude
>

- -- 

Cheers
Res

Vote for your favourite MTA at  http://polls.ausics.net/v3.php
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGRIHjsWhAmSIQh7MRAgsYAJ9y88a7iWSzKTcG2uRVl1m9Fx3VZwCcC3/E
7jLaKHO0eGTLI1UYI9w40d4=
=DvZt
-----END PGP SIGNATURE-----
From claude.gagne at multitech.qc.ca  Fri May 11 16:33:17 2007
From: claude.gagne at multitech.qc.ca (=?ISO-8859-1?Q?Claude_Gagn=E9?=)
Date: Fri May 11 16:31:49 2007
Subject: init.d script
In-Reply-To: <Pine.LNX.4.64.0705120046140.19309@ebfjryy.nhfvpf.arg>
References: <46447C82.90006@multitech.qc.ca>
	<Pine.LNX.4.64.0705120046140.19309@ebfjryy.nhfvpf.arg>
Message-ID: <46448CBD.4040609@multitech.qc.ca>

Res a ?crit :
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> This is for RPM versions, tarball install everything under /opt
>
> We don't really need it :)
>
> On Fri, 11 May 2007, Claude Gagn? wrote:
>
>> Hi,
>>
>> I use the tarball installation of the lastest MailScanner on Ubuntu 
>> Server but I can't find the /etc/init.d script that everybody seems 
>> to have. I have searched on the wiki and MS web site but I can't find 
>> it.
>>
>> Any can tell me where can I get it ?
>>
>> Thanks.
>>
>> Claude
>>
>
> - --
> Cheers
> Res
>
> Vote for your favourite MTA at  http://polls.ausics.net/v3.php
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.6 (GNU/Linux)
>
> iD8DBQFGRIHjsWhAmSIQh7MRAgsYAJ9y88a7iWSzKTcG2uRVl1m9Fx3VZwCcC3/E
> 7jLaKHO0eGTLI1UYI9w40d4=
> =DvZt
> -----END PGP SIGNATURE-----
It can be usefull to reload configuration without killing all 
MailScanner process and restart. Or is it other ways to do it ?

Thanks for your help :)

Claude
From ka at pacific.net  Fri May 11 16:34:54 2007
From: ka at pacific.net (Ken A)
Date: Fri May 11 16:34:58 2007
Subject: Preferred Distribution
In-Reply-To: <267957.74168.qm@web26313.mail.ukl.yahoo.com>
References: <267957.74168.qm@web26313.mail.ukl.yahoo.com>
Message-ID: <46448D1E.3010702@pacific.net>

Andrew MacLachlan wrote:
> I've got MailScanner working with postfix 2.4 and SA 3.2.0 on a virtualised Babbage Analytical Engine (I was having trouble getting parts for the original hardware)...

too lazy to turn the crank, huh? figures you are a postfix user! ;-)
Ken

> 
> ----- Original Message ----
> From: Gareth <list-mailscanner@linguaphone.com>
> To: MailScanner discussion <mailscanner@lists.mailscanner.info>
> Sent: Friday, 11 May, 2007 9:16:09 AM
> Subject: Re: Preferred Distribution
> 
> On Thu, 2007-05-10 at 21:21, Matt Kettler wrote:
>> Scott Silva wrote:
>>> People should stop using RedHat 6. It has got to be almost 8 years old!
>> Yeah, clearly they should be on 6.3 by now :)
>>
>> Quite frankly, I'd be surprised if modern MailScanner would even run on RedHat
>> 6.x.. Those releases used perl 5.005. It might run, but a lot of add-ons won't.
>>
>> I know the mailscanner RPM claims it only needs >= 5.005, but I know
>> SpamAssassin 3.0.0 and higher require perl 5.6 or higher.
>>
>> As of 3.46 HTML::Parser requires perl 5.6 or higher.
> 
> I am still using Redhat 9 on my home server. I am running Spamassassin
> 3.18 fine with Pyzor, Razor, FuzzyOCR etc...
> 
> I upgraded Perl to 5.8 and then reinstalled all the modules.
> I think one program failed to run afterwards but I just edited the per
> to make it point to the old perl.
> I had problems getting a couple of modules to install so I think SPF
> checks are currently not operational but thats it.
> 


-- 
Ken Anderson
Pacific.Net
From gmourani at prival.ca  Fri May 11 16:36:59 2007
From: gmourani at prival.ca (Gerhard Mourani)
Date: Fri May 11 16:37:45 2007
Subject: init.d script
In-Reply-To: <46448CBD.4040609@multitech.qc.ca>
Message-ID: <3123E1B72B666243917E340F3C8FD4A1069786@privaldc2003.prival.local>

Claude,

That's the one I use, it's not perfect but a good starting point.

#!/bin/bash
#
# Modified for OpenNA Linux by Gerhard Mourani <gmourani@openna.com>
# This shell script takes care of starting and stopping MailScanner.
#
# chkconfig: 345 80 30
# description: MailScanner is an open-source E-Mail Gateway Virus Scanner.
# processname: MailScanner
# config: /etc/MailScanner/MailScanner.conf
# pidfile: /var/run/MailScanner.pid

# Source function library.
. /etc/init.d/functions

# Source networking configuration.
. /etc/sysconfig/network

# Check that networking is up.
[ ${NETWORKING} = "no" ] && exit 0

[ -f /usr/sbin/check_MailScanner ] || exit 0

RETVAL=0
prog="mailscanner"

start() {
        echo -n "Starting $prog: "
        /usr/sbin/check_MailScanner >/dev/null
        RETVAL=$?
        [ $RETVAL -eq 0 ] && touch /var/lock/subsys/MailScanner
        [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/MailScanner.off
        echo
        return $RETVAL
}

stop() {
        echo -n "Shutting down $prog: "
        killproc MailScanner -15
        RETVAL=$?
        [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/MailScanner
        [ $RETVAL -eq 0 ] && touch /var/lock/subsys/MailScanner.off
        rm -f /var/run/MailScanner.pid
        echo
        return $RETVAL
}

restart() {
        stop
        start
}

reload() {
        pid=`pidofproc MailScanner`
        if [ -z "$pid" ] ; then
          failure
        else
          /bin/kill -HUP -- -$pid
          success
        fi
        echo
}

# See how we were called.
case "$1" in
  start)
        start
        ;;
  stop)
        stop
        ;;
  restart)
        restart
        ;;
  reload)
        reload
        ;;
*)
        echo $"Usage: $0 {start|stop|restart|reload}"
        exit 1
esac
exit $RETVAL

Gerhard,

-----Original Message-----
From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Claude Gagn?
Sent: Friday, May 11, 2007 11:33 AM
To: MailScanner discussion
Subject: Re: init.d script

Res a ?crit :
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> This is for RPM versions, tarball install everything under /opt
>
> We don't really need it :)
>
> On Fri, 11 May 2007, Claude Gagn? wrote:
>
>> Hi,
>>
>> I use the tarball installation of the lastest MailScanner on Ubuntu 
>> Server but I can't find the /etc/init.d script that everybody seems 
>> to have. I have searched on the wiki and MS web site but I can't find 
>> it.
>>
>> Any can tell me where can I get it ?
>>
>> Thanks.
>>
>> Claude
>>
>
> - --
> Cheers
> Res
>
> Vote for your favourite MTA at  http://polls.ausics.net/v3.php
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.6 (GNU/Linux)
>
> iD8DBQFGRIHjsWhAmSIQh7MRAgsYAJ9y88a7iWSzKTcG2uRVl1m9Fx3VZwCcC3/E
> 7jLaKHO0eGTLI1UYI9w40d4=
> =DvZt
> -----END PGP SIGNATURE-----
It can be usefull to reload configuration without killing all 
MailScanner process and restart. Or is it other ways to do it ?

Thanks for your help :)

Claude
-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

From Jason at SYO.Com  Fri May 11 17:22:21 2007
From: Jason at SYO.Com (Jason Gottschalk)
Date: Fri May 11 17:22:41 2007
Subject: Approve/Deny outgoing e-mail ?
In-Reply-To: <464372AA.2090906@ecs.soton.ac.uk>
References: <1503721294.20070510094401@SYO.Com>
	<464372AA.2090906@ecs.soton.ac.uk>
Message-ID: <948967026.20070511122221@SYO.Com>

Hello Julian,

Is /var/spool/mqueue.approval a file or directory?

If it is a file, will mailscanner create it if it is not there? just
by my having created a rulset? and where would I define the ruleset?

Please pardon my questions, but I typically just edit the
archive.rules file and I only just get by doing that!



Thursday, May 10, 2007, 3:29:46 PM, you wrote:
Julian> -----BEGIN PGP SIGNED MESSAGE-----
Julian> Hash: SHA1

Julian> You could do this with a little ruleset and an external script that 
Julian> would show the admin each mail message and move it into the outgoing 
Julian> queue if it's 'approved'.
Julian> Just use a ruleset that says that mail going to domains other than your
Julian> own should go into /var/spool/mqueue.approval. Mail going to your domain
Julian> goes straight into /var/spool/mqueue.

Julian> The script would then show the messages in mqueue.approval to the admin,
Julian> then if they are approved they are moved into mqueue (from where the MTA
Julian> will then deliver them).

Julian> Jason Gottschalk wrote:
>> I know mailscanner can scan outgoing mail (when the user uses the host
>> as his smtp server). Is there any mechanism in mailscanner to hold an
>> outgoing message until it is reviewed by an administrator who would
>> approve/deny the message and then release it?
>>
>>   
>>
>>   

Julian> Jules

Julian> - -- 
Julian> Julian Field MEng CITP
Julian> www.MailScanner.info
Julian> Buy the MailScanner book at www.MailScanner.info/store

Julian> MailScanner customisation, or any advanced system administration help?
Julian> Contact me at Jules@Jules.FM

Julian> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
Julian> For all your IT requirements visit www.transtec.co.uk



Julian> -----BEGIN PGP SIGNATURE-----
Julian> Version: PGP Desktop 9.6.1 (Build 1012)
Julian> Charset: ISO-8859-1

Julian> wj8DBQFGQ3OsEfZZRxQVtlQRAhWgAKDRMCFbCSWzncvbV1zsHnoxFN/cGQCdEyVp
Julian> IUyhZgOVoITi/cvvX6l7zTw=
Julian> =JBJd
Julian> -----END PGP SIGNATURE-----

Julian> -- 
Julian> This message has been scanned for viruses and
Julian> dangerous content by MailScanner, and is
Julian> believed to be clean.
Julian> For all your IT requirements visit www.transtec.co.uk



-- 
Best regards,
 Jason Gottschalk                         mailto:Jason@SYO.Com
 SYO Computer Engineering Services, Inc.
 586-286-2557

From seanos at seanos.net  Fri May 11 17:31:21 2007
From: seanos at seanos.net (=?utf-8?B?U2XDoW4gTyBTdWxsaXZhbg==?=)
Date: Fri May 11 17:31:31 2007
Subject: MailWatch - new release
Message-ID: <41236.160.6.1.47.1178901081.squirrel@webmail.seanos.net>

Since I know a lot here use Mailwatch, new release out.


1.04 released today.
Looks like bug/security fixes mainly.


Regards,

Sean
From res at ausics.net  Fri May 11 18:31:31 2007
From: res at ausics.net (Res)
Date: Fri May 11 18:31:41 2007
Subject: init.d script
In-Reply-To: <46448CBD.4040609@multitech.qc.ca>
References: <46447C82.90006@multitech.qc.ca>
	<Pine.LNX.4.64.0705120046140.19309@ebfjryy.nhfvpf.arg>
	<46448CBD.4040609@multitech.qc.ca>
Message-ID: <Pine.LNX.4.64.0705120329310.19673@ebfjryy.nhfvpf.arg>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Fri, 11 May 2007, Claude Gagn? wrote:

> It can be usefull to reload configuration without killing all MailScanner 
> process and restart. Or is it other ways to do it ?

killall -HUP MailScanner
if you can edit your startup for your MTA add this is a reload segment or 
similar.


- -- 

Cheers
Res

Vote for your favourite MTA at  http://polls.ausics.net/v3.php
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGRKh1sWhAmSIQh7MRAseBAKCmP15DLYxIKHz5Cn4FjlcIXu9MzwCgie7N
saFSd0KR0MTSkJmJ5R7SXnE=
=SkYj
-----END PGP SIGNATURE-----
From ugob at lubik.ca  Fri May 11 20:18:50 2007
From: ugob at lubik.ca (Ugo Bellavance)
Date: Fri May 11 20:19:15 2007
Subject: MCP (test...)
Message-ID: <f22fiq$hbg$1@sea.gmane.org>

Hi,

	I sent a post earlier regarding MCP.  I can see it in the archive, but 
not in gmane... il there a problem between gmane and the list servers?

ugo

From MailScanner at ecs.soton.ac.uk  Fri May 11 20:40:00 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Fri May 11 20:43:37 2007
Subject: Approve/Deny outgoing e-mail ?
In-Reply-To: <948967026.20070511122221@SYO.Com>
References: <1503721294.20070510094401@SYO.Com>	<464372AA.2090906@ecs.soton.ac.uk>
	<948967026.20070511122221@SYO.Com>
Message-ID: <4644C690.6020907@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Jason Gottschalk wrote:
> Hello Julian,
>
> Is /var/spool/mqueue.approval a file or directory?
>   
In my example, it would be a directory.
> If it is a file, will mailscanner create it if it is not there? just
> by my having created a rulset? and where would I define the ruleset?
>   
You will need to create it, or else MailScanner will whine about it.
> Please pardon my questions, but I typically just edit the
> archive.rules file and I only just get by doing that!
>
>
>
> Thursday, May 10, 2007, 3:29:46 PM, you wrote:
> Julian> -----BEGIN PGP SIGNED MESSAGE-----
> Julian> Hash: SHA1
>
> Julian> You could do this with a little ruleset and an external script that 
> Julian> would show the admin each mail message and move it into the outgoing 
> Julian> queue if it's 'approved'.
> Julian> Just use a ruleset that says that mail going to domains other than your
> Julian> own should go into /var/spool/mqueue.approval. Mail going to your domain
> Julian> goes straight into /var/spool/mqueue.
>
> Julian> The script would then show the messages in mqueue.approval to the admin,
> Julian> then if they are approved they are moved into mqueue (from where the MTA
> Julian> will then deliver them).
>
> Julian> Jason Gottschalk wrote:
>   
>>> I know mailscanner can scan outgoing mail (when the user uses the host
>>> as his smtp server). Is there any mechanism in mailscanner to hold an
>>> outgoing message until it is reviewed by an administrator who would
>>> approve/deny the message and then release it?
>>>
>>>   
>>>
>>>   
>>>       
>
> Julian> Jules
>
> Julian> - -- 
> Julian> Julian Field MEng CITP
> Julian> www.MailScanner.info
> Julian> Buy the MailScanner book at www.MailScanner.info/store
>
> Julian> MailScanner customisation, or any advanced system administration help?
> Julian> Contact me at Jules@Jules.FM
>
> Julian> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> Julian> For all your IT requirements visit www.transtec.co.uk
>
>
>
> Julian> -----BEGIN PGP SIGNATURE-----
> Julian> Version: PGP Desktop 9.6.1 (Build 1012)
> Julian> Charset: ISO-8859-1
>
> Julian> wj8DBQFGQ3OsEfZZRxQVtlQRAhWgAKDRMCFbCSWzncvbV1zsHnoxFN/cGQCdEyVp
> Julian> IUyhZgOVoITi/cvvX6l7zTw=
> Julian> =JBJd
> Julian> -----END PGP SIGNATURE-----
>
> Julian> -- 
> Julian> This message has been scanned for viruses and
> Julian> dangerous content by MailScanner, and is
> Julian> believed to be clean.
> Julian> For all your IT requirements visit www.transtec.co.uk
>
>
>
>   

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGRMdCEfZZRxQVtlQRAjE5AKCJoqGzmFpXj9gKMLLjDrHgaZMXMACeMGHE
S7YY21Y2JTeSvY5I///f6Qg=
=kkgS
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From MailScanner at ecs.soton.ac.uk  Fri May 11 20:44:35 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Fri May 11 20:48:42 2007
Subject: SMTP_AUTH and sender restriction based on local domain using
 Mailscanner
In-Reply-To: <062c01c79396$6b6929a0$1c01010a@netdom.loc>
References: <062c01c79396$6b6929a0$1c01010a@netdom.loc>
Message-ID: <4644C7A3.1080909@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

That's the job of your MTA, it's not a MailScanner problem at all.

Yadavendra Awasthi wrote:
> Hi List,
>  
> I have configured outgoing SMTP server with SMTP_AUTH on postfix. Is 
> it possible to have user based restriction in Mailscanner such that 
> limited authenticated users are allowed to relay mail outside and all 
> authenticated users are allowed to send mails to local domain.
>  
> Regards.
> Yadavendra Awasthi.

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGRMhwEfZZRxQVtlQRApJ9AKDroqw8pu8FyfMtJQ1Jw4+pppE2XgCfV6Vc
DSrLcq5n1GZ8inCwgmIdCOA=
=CFAD
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From MailScanner at ecs.soton.ac.uk  Fri May 11 20:43:06 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Fri May 11 20:48:59 2007
Subject: Build only (from rpm.tar.gz)
In-Reply-To: <5cf776b80705101434t570d9e51r9118faa4d853fdf3@mail.gmail.com>
References: <5cf776b80705100909t347d505co4c5776278daa559b@mail.gmail.com>	<4643737D.1090500@ecs.soton.ac.uk>
	<5cf776b80705101434t570d9e51r9118faa4d853fdf3@mail.gmail.com>
Message-ID: <4644C74A.2050007@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

The other RPMs get put there as they are rebuilt by the install.sh. The 
MailScanner script doesn't get rebuilt from src.rpm, just installed, so 
there's no reason to put it there, it belongs just in the main tarball. 
It's not me that puts the other RPMs in /usr/src/redhat...., it is 
rpmbuild that puts them there. I personally wish it wouldn't, as the 
path varies between different distros.

mbneto wrote:
> Thanks Julian,
>
> I was looking at /usr/src/redhat/RPMS/(i386|noarch) where the others 
> rpms are generated.
>
> Probably there is a reason for this but as a suggestion consider 
> putting the mailscanner.rpm there too.
>
> regards.
>
> On 5/10/07, *Julian Field* <MailScanner@ecs.soton.ac.uk 
> <mailto:MailScanner@ecs.soton.ac.uk>> wrote:
>
>     -----BEGIN PGP SIGNED MESSAGE-----
>     Hash: SHA1
>
>     It's there, you must be looking straight through it.
>
>     MailScanner-4.59.4-2/mailscanner-4.59.4-2.noarch.rpm
>     in the rpm.tar.gz file.
>
>     mbneto wrote:
>     > Hi,
>     >
>     > I've noticed that when I perform a ./install.sh it generates a
>     lot of
>     > rpm files and later installs.  I could not find, however, the
>     rpm for
>     > the mailscanner itself only the perl, tnef etc.
>     >
>     > Since I need to maintain a number of servers that does not have gcc
>     > and other libraries I need to generate the complete set of rpm
>     and add
>     > to my yum repository.
>     >
>     > Any idea of how to do that (or to find the mailscanner.rpm
>     generated)?
>     >
>     > tks.
>     >
>     >
>
>     Jules
>
>     - --
>     Julian Field MEng CITP
>     www.MailScanner.info <http://www.MailScanner.info>
>     Buy the MailScanner book at www.MailScanner.info/store
>     <http://www.MailScanner.info/store>
>
>     MailScanner customisation, or any advanced system administration help?
>     Contact me at Jules@Jules.FM <mailto:Jules@Jules.FM>
>
>     PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>     For all your IT requirements visit www.transtec.co.uk
>     <http://www.transtec.co.uk>
>
>
>
>     -----BEGIN PGP SIGNATURE-----
>     Version: PGP Desktop 9.6.1 (Build 1012)
>     Charset: ISO-8859-1
>
>     wj8DBQFGQ3OuEfZZRxQVtlQRAiQjAJ0ZYBqUBxToowiZxdk3MUZ/QR/7wwCgpcMu
>     BWwU0ULq/aOZ3DDkLM6gIe0=
>     =NfMx
>     -----END PGP SIGNATURE-----
>
>     --
>     This message has been scanned for viruses and
>     dangerous content by MailScanner, and is
>     believed to be clean.
>     For all your IT requirements visit www.transtec.co.uk
>     <http://www.transtec.co.uk>
>
>     --
>     MailScanner mailing list
>     mailscanner@lists.mailscanner.info
>     <mailto:mailscanner@lists.mailscanner.info>
>     http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>     Before posting, read http://wiki.mailscanner.info/posting
>
>     Support MailScanner development - buy the book off the website!
>
>

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGRMhuEfZZRxQVtlQRAoHlAKCnoYluAkno9/r2XnqTF74yQqmVQQCgj9h0
ldx3/hRT9tRhRG9ZF1XY42I=
=Ky+/
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From MailScanner at ecs.soton.ac.uk  Fri May 11 20:49:05 2007
From: MailScanner at ecs.soton.ac.uk (Julian Field)
Date: Fri May 11 20:51:54 2007
Subject: MCP
In-Reply-To: <f21j62$ac2$1@sea.gmane.org>
References: <f21j62$ac2$1@sea.gmane.org>
Message-ID: <4644C8B1.5030000@ecs.soton.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Ugo Bellavance wrote:
> Hi,
>
>     I'm thinking about implementing MCP on my servers, but I have a 
> few questions:
>
> 1- I know it runs a second copy of SpamAssassin... but what kind of 
> load does it add to the system?
If Matt Hampton is reading this list at the moment, please can you send 
me your patches to reduce the SpamAssassin load caused by MCP? Matt 
cracked it for me, quite a long time ago, I just never got the patches 
off him for it.

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.1 (Build 1012)
Charset: ISO-8859-1

wj8DBQFGRMk4EfZZRxQVtlQRAuJ4AJ0T6CPq+WY9OWZze1MjvQym9mZbCgCeP7NY
XoPtk3aGl166NHUC0Uu/DbE=
=U62W
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk

From jnalley at fgp.com  Fri May 11 21:29:21 2007
From: jnalley at fgp.com (Jonathan Nalley)
Date: Fri May 11 21:29:44 2007
Subject: postfix dropping SMTP connection when receiving mail
Message-ID: <4644D221.3050403@fgp.com>

Hi, I'm running MailScanner 4.58.9-1 using postfix 2.3.3 on Centos 5.

I've set our M$ Exchange Server 2007 to use our MailScanner/Postfix box as a "smart host" such that all outbound mail would be sent through the MailScanner/postfix box.  The problem is that when the Exchange box is trying to pass along an e-mail to postfix, the connection and SMTP session gets dropped or something really bizarre is going on. 

Below is a snippet of /var/log/maillog (with postfix's debug_peer_level=1000).  For the purposes of these pasted log files. 192.168.0.207 is the exchange box and 192.168.0.208 is the Postfix box.

May 11 09:40:23 mailscanner postfix/smtpd[18829]: match_hostname: exchange.myinternaldomain.com ~? 192.168.0.0/24
May 11 09:40:23 mailscanner postfix/smtpd[18829]: match_hostaddr: 192.168.0.207 ~? 192.168.0.0/24
May 11 09:40:23 mailscanner postfix/smtpd[18829]: > exchange.myinternaldomain.com[192.168.0.207]: 220 mailscanner.myinternaldomain.com ESMTP Postfix
May 11 09:40:23 mailscanner postfix/smtpd[18829]: watchdog_pat: 0x99266a0
May 11 09:40:23 mailscanner postfix/smtpd[18829]: vstream_fflush_some: fd 9 flush 83
May 11 09:40:23 mailscanner postfix/smtpd[18829]: vstream_buf_get_ready: fd 9 got 29
May 11 09:40:23 mailscanner postfix/smtpd[18829]: < exchange.myinternaldomain.com[192.168.0.207]: EHLO exchange.myinternaldomain.com
May 11 09:40:23 mailscanner postfix/smtpd[18829]: > exchange.myinternaldomain.com[192.168.0.207]: 250-mailscanner.myinternaldomain.com
May 11 09:40:23 mailscanner postfix/smtpd[18829]: > exchange.myinternaldomain.com[192.168.0.207]: 250-PIPELINING
May 11 09:40:23 mailscanner postfix/smtpd[18829]: > exchange.myinternaldomain.com[192.168.0.207]: 250-SIZE 10240000
May 11 09:40:23 mailscanner postfix/smtpd[18829]: > exchange.myinternaldomain.com[192.168.0.207]: 250-VRFY
May 11 09:40:23 mailscanner postfix/smtpd[18829]: > exchange.myinternaldomain.com[192.168.0.207]: 250-ETRN
May 11 09:40:23 mailscanner postfix/smtpd[18829]: > exchange.myinternaldomain.com[192.168.0.207]: 250-AUTH LOGIN PLAIN
May 11 09:40:23 mailscanner postfix/smtpd[18829]: match_list_match: exchange.myinternaldomain.com: no match
May 11 09:40:23 mailscanner postfix/smtpd[18829]: match_list_match: 192.168.0.207: no match
May 11 09:40:23 mailscanner postfix/smtpd[18829]: > exchange.myinternaldomain.com[192.168.0.207]: 250-AUTH=LOGIN PLAIN
May 11 09:40:23 mailscanner postfix/smtpd[18829]: > exchange.myinternaldomain.com[192.168.0.207]: 250-ENHANCEDSTATUSCODES
May 11 09:40:23 mailscanner postfix/smtpd[18829]: > exchange.myinternaldomain.com[192.168.0.207]: 250-8BITMIME
May 11 09:40:23 mailscanner postfix/smtpd[18829]: > exchange.myinternaldomain.com[192.168.0.207]: 250 DSN
May 11 09:40:23 mailscanner postfix/smtpd[18829]: watchdog_pat: 0x99266a0
May 11 09:40:23 mailscanner postfix/smtpd[18829]: vstream_fflush_some: fd 9 flush 178
May 11 09:40:23 mailscanner postfix/smtpd[18829]: smtp_get: EOF
May 11 09:40:23 mailscanner postfix/smtpd[18829]: match_hostname: exchange.myinternaldomain.com ~? 192.168.0.0/24
May 11 09:40:23 mailscanner postfix/smtpd[18829]: match_hostaddr: 192.168.0.207 ~? 192.168.0.0/24
May 11 09:40:23 mailscanner postfix/smtpd[18829]: lost connection after EHLO from exchange.myinternaldomain.com[192.168.0.207]
May 11 09:40:23 mailscanner postfix/smtpd[18829]: disconnect from exchange.myinternaldomain.com[192.168.0.207]


When enabling verbose session logging on the M$ Exchange box, below is the relevant SMTP session snippet:

2007-05-11T18:06:53.714Z,PostFixSendConnector,08C9612DB0BAB77B,0,,192.168.0.208:25,*,,attempting to connect
2007-05-11T18:06:53.714Z,PostFixSendConnector,08C9612DB0BAB77B,1,192.168.0.207:11256,192.168.0.208:25,+,,
2007-05-11T18:06:53.714Z,PostFixSendConnector,08C9612DB0BAB77B,2,192.168.0.207:11256,192.168.0.208:25,<,220 postfixbox.myinternaldomain.com ESMTP Postfix,
2007-05-11T18:06:53.714Z,PostFixSendConnector,08C9612DB0BAB77B,3,192.168.0.207:11256,192.168.0.208:25,>,EHLO exchange.myinternaldomain.com,
2007-05-11T18:06:53.714Z,PostFixSendConnector,08C9612DB0BAB77B,4,192.168.0.207:11256,192.168.0.208:25,<,
2007-05-11T18:06:53.714Z,PostFixSendConnector,08C9612DB0BAB77B,5,192.168.0.207:11256,192.168.0.208:25,-,,Local

The second-to-last line actually has 65 spaces and then the closing comma but i couldn't get my mailer to display that in a desirable fashion.

I know it's tempting to say or to think that the problem might be with the M$ Exchange box, but i can tell Exchange to use other Postfix/MailScanner installations (admittedly running MailScanner version 4.46.2-2 and postfix version 2.1.5) as the smart host and everything works smoothly.

I've seen other posts in the mailing list with people having "smtp_get: EOF" in their logs and other similar entries but many were related to TLS, SSL, SASL and authentication and all that stuff but i'm not trying to do any of that here.  Any thoughts, wisdom, insights, fixes, and solutions greatly appreciated. Thanks In Advance.


Below is postconf -n:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
broken_sasl_auth_clients = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
debug_peer_level = 1000
debug_peer_list = 192.168.0.207
header_checks = regexp:/etc/postfix/header_checks
html_directory = no
inet_interfaces = all
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = localhost.$mydomain, localhost, $mydomain
mydomain = myinternaldomain.com
myhostname = mailscanner.myinternaldomain.com
mynetworks = 192.168.0.0/24, 127.0.0.0/8
myorigin = $mydomain
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES
relay_domains = $mydestination
sample_directory = /usr/share/doc/postfix-2.3.3/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtpd_banner = $myhostname ESMTP $mail_name
smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = smtpd
transport_maps = hash:/etc/postfix/transport
unknown_local_recipient_reject_code = 550

From res at ausics.net  Fri May 11 23:55:45 2007
From: res at ausics.net (Res)
Date: Fri May 11 23:55:55 2007
Subject: MCP (test...)
In-Reply-To: <f22fiq$hbg$1@sea.gmane.org>
References: <f22fiq$hbg$1@sea.gmane.org>
Message-ID: <Pine.LNX.4.64.0705120851510.20144@ebfjryy.nhfvpf.arg>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Fri, 11 May 2007, Ugo Bellavance wrote:

> Hi,
>
> 	I sent a post earlier regarding MCP.  I can see it in the archive, 
> but not in gmane... il there a problem between gmane and the list servers?

gmane is hopeless, mail is being delivered hours and hours later, SA 3-6 
hour date in past scores are hitting anything that comes from them, we run 
a new mail-nntp gateways and use SA with that gw, we had to edit those 
scores here a week ago so it wouldnt interfere with it, but in past 2 
days, posts from them to sourceforge lists are also now hitting this 
problem.

gmane should be dumped, use the real list.


- -- 

Cheers
Res

Vote for your favourite MTA at  http://polls.ausics.net/v3.php
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGRPRzsWhAmSIQh7MRAh2LAJ4kH77BTnXNoJhEGiCHEuwSFdg9xQCfbH6b
p2faSMBmR7RVs43gGtZlOD8=
=AeD7
-----END PGP SIGNATURE-----
From raywjohnson at gmail.com  Sat May 12 02:55:40 2007
From: raywjohnson at gmail.com (RayJ)
Date: Sat May 12 03:00:07 2007
Subject: SMPID vs. INPID
References: <002101c78f49$651fdcc0$5a01a8c0@AldenLap>
Message-ID: <loom.20070512T034901-572@post.gmane.org>


Alden Levy <alden <at> engineno9inc.com> writes:

> 
> I had a problem a long time ago on my old server that never got solved;
> unfortunately, it's reared it's ugly head on the new server (I had to copy
> over a file from the old server), and I'd like to put it to bed for good.
> 
> Basically, when I start MS, all works well, but when I check status, I get
> an error 
> # service MailScanner status
> Checking MailScanner daemons:
>          MailScanner:                                      [  OK  ]
>          incoming sendmail:                                [ FAIL ]
>          outgoing sendmail:                                [  OK  ]
> 
> However, it works fine as it is.  In order to get rid of the fail, though,
> I've been updating sendmail.in.pid with the proper pid, and everything
> works.
> --SNIP--
> Any help would be greatly appreciated.
> 
> For the record, I am running MS 4.68.9-1 and SA 3.18 on CentOS 4.4.
> 
> Thanks,
> Alden
> 
 
Hi Alden,
Found this while looking for an answer to the same problem:

This is what fix it!
service MailScanner stop
service sendmail stop <-- Important!

Make sure no PIDs remain:
ls -al /var/run
  MailScanner.pid
  sendmail.out.pid
  sendmail.pid <-- This one seemed to be the problem!
  sm-client.pid

Not sure these had any effect, but tried anyway!
chkconfig --del mailscanner
chkconfig --del sendmail
chkconfig --add sendmail
chkconfig --add mailscanner

service MailScanner start


Hope that helps!

--RayJ




From hvdkooij at vanderkooij.org  Sat May 12 09:00:32 2007
From: hvdkooij at vanderkooij.org (Hugo van der Kooij)
Date: Sat May 12 09:01:06 2007
Subject: SMPID vs. INPID
In-Reply-To: <loom.20070512T034901-572@post.gmane.org>
References: <002101c78f49$651fdcc0$5a01a8c0@AldenLap>
	<loom.20070512T034901-572@post.gmane.org>
Message-ID: <Pine.LNX.4.64.0705120949070.6002@faramir.hugo.vanderkooij.org>

On Sat, 12 May 2007, RayJ wrote:

> This is what fix it!
> service MailScanner stop
> service sendmail stop <-- Important!

These are actions on the running services. If you do nothing they will 
start up again as configured after a reboot or even a change of init 
level.

> Not sure these had any effect, but tried anyway!
> chkconfig --del mailscanner
> chkconfig --del sendmail
> chkconfig --add sendmail
> chkconfig --add mailscanner

These do the other thing. They have an impact on wether or not services 
are started at certain runlevels.

So, If one is to add MailScanner to Centos environment with sendmail 
support and sendmail is active (default Centos MTA) you would need to do:

  1. Install MailScanner (and subsidaries) ((And make sure you configure it
     right but do not activae it now!))
  2. Stop sendmail `service sendmail stop`
  3. Prevent sendmail from starting again `chkconfig sendmail off`
  4. Activate MailScanner `service mailScanner start`
  5. Make sure MailScanner starts at boot time `chkconfig MailScanner on`

At your discretion you can replace sendmail with postfix if that happens 
to be the active MTA of your choice.

For more details on runlevels, and the use of the service and chkconfig 
tools please consult the manual in a document repository near you.

Hugo.

-- 
 	hvdkooij@vanderkooij.org	http://hugo.vanderkooij.org/
 	    This message is using 100% recycled electrons.

 	Some men see computers as they are and say "Windows"
 	I use computers with Linux and say "Why Windows?"
 		(Thanks JFK, for the insight.)
From dhawal at netmagicsolutions.com  Sat May 12 09:23:35 2007
From: dhawal at netmagicsolutions.com (Dhawal Doshy)
Date: Sat May 12 09:23:51 2007
Subject: MCP (test...)
In-Reply-To: <f22fiq$hbg$1@sea.gmane.org>
References: <f22fiq$hbg$1@sea.gmane.org>
Message-ID: <46457987.80705@netmagicsolutions.com>

Ugo Bellavance wrote:
> Hi,
> 
>     I sent a post earlier regarding MCP.  I can see it in the archive, 
> but not in gmane... il there a problem between gmane and the list servers?

i can see it in gmane.. see "Message-ID: <f21j62$ac2$1@sea.gmane.org>"
From smlists at shaw.ca  Sat May 12 16:05:34 2007
From: smlists at shaw.ca (Steve Mason)
Date: Sat May 12 16:05:42 2007
Subject: Preferred Distribution
In-Reply-To: <7EF0EE5CB3B263488C8C18823239BEBAB2507E@HC-MBX02.herefordshire.gov.uk>
Message-ID: <000e01c794a6$fdefed70$2924010a@SMC840>



-----Original Message-----
From: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Randal,
Phil
Sent: Friday, May 11, 2007 2:48 AM
To: MailScanner discussion
Subject: RE: Preferred Distribution


I'd use CentOS 5 , not 4, if you're planning to use FuzzyOcr.

netpbm is way too old on CentOS /RHEL 4, and you have to mess about with
FuzzyOcr's scansets to get it to work properly.

--------------------

Yes, I just gave up trying to solve some dependencies with FuzzyOcr on
Centos 4.4 and upgraded to Centos 5.
FuzzyOcr dropped in with (almost)no problems. My head feels much better now
that I stopped banging it...

From root at doctor.nl2k.ab.ca  Sat May 12 19:40:39 2007
From: root at doctor.nl2k.ab.ca (Dave Shariff Yadallee - System Administrator a.k.a. The Root of the
	Problem)
Date: Sat May 12 19:45:21 2007
Subject: Message-ID
Message-ID: <20070512184038.GC19693@doctor.nl2k.ab.ca>

IS there a way of using Message-ID is identify Spam or Ham?

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

From hvdkooij at vanderkooij.org  Sat May 12 19:58:56 2007
From: hvdkooij at vanderkooij.org (Hugo van der Kooij)
Date: Sat May 12 19:59:37 2007
Subject: Message-ID
In-Reply-To: <20070512184038.GC19693@doctor.nl2k.ab.ca>
References: <20070512184038.GC19693@doctor.nl2k.ab.ca>
Message-ID: <Pine.LNX.4.64.0705122053190.16053@faramir.hugo.vanderkooij.org>

On Sat, 12 May 2007, Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem wrote:

> IS there a way of using Message-ID is identify Spam or Ham?

The Message-ID is to uniquely identify that message. Think of it like as a 
social security number. Do you want to declare a person a cheat becuase 
you do not like his/her social security number?

You can give some point to messages that do not set their own Message-ID. 
That is allready part of spamassassin for ages.

Or are you trying to ask something completely differently?

Hugo.

-- 
 	hvdkooij@vanderkooij.org	http://hugo.vanderkooij.org/
 	    This message is using 100% recycled electrons.

 	Some men see computers as they are and say "Windows"
 	I use computers with Linux and say "Why Windows?"
 		(Thanks JFK, for the insight.)
From root at doctor.nl2k.ab.ca  Sat May 12 21:59:35 2007
From: root at doctor.nl2k.ab.ca (Dave Shariff Yadallee - System Administrator a.k.a. The Root of the
	Problem)
Date: Sat May 12 22:04:22 2007
Subject: {Spam?} Re: Message-ID
In-Reply-To: <Pine.LNX.4.64.0705122053190.16053@faramir.hugo.vanderkooij.org>
References: <20070512184038.GC19693@doctor.nl2k.ab.ca>
	<Pine.LNX.4.64.0705122053190.16053@faramir.hugo.vanderkooij.org>
Message-ID: <20070512205935.GA16507@doctor.nl2k.ab.ca>

On Sat, May 12, 2007 at 08:58:56PM +0200, Hugo van der Kooij wrote:
> On Sat, 12 May 2007, Dave Shariff Yadallee - System Administrator a.k.a. 
> The Root of the Problem wrote:
> 
> >IS there a way of using Message-ID is identify Spam or Ham?
> 
> The Message-ID is to uniquely identify that message. Think of it like as a 
> social security number. Do you want to declare a person a cheat becuase 
> you do not like his/her social security number?
> 
> You can give some point to messages that do not set their own Message-ID. 
> That is allready part of spamassassin for ages.
> 
> Or are you trying to ask something completely differently?
>

Nope on the correct track.  What is then needed is to cross reference
the message-id with the mail logs, trace back the offending
IP and make the spam disappear.

NOw I should open a black hole! 

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

From amaclach at yahoo.co.uk  Sat May 12 22:55:59 2007
From: amaclach at yahoo.co.uk (Andrew MacLachlan)
Date: Sat May 12 22:56:01 2007
Subject: {Spam?} Re: Message-ID
Message-ID: <651459.19860.qm@web26310.mail.ukl.yahoo.com>

I believe that policyd will do just that for you.

----- Original Message ----
From: Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem <root@doctor.nl2k.ab.ca>
To: MailScanner discussion <mailscanner@lists.mailscanner.info>
Sent: Saturday, 12 May, 2007 9:59:35 PM
Subject: Re: {Spam?} Re: Message-ID

On Sat, May 12, 2007 at 08:58:56PM +0200, Hugo van der Kooij wrote:
> On Sat, 12 May 2007, Dave Shariff Yadallee - System Administrator a.k.a. 
> The Root of the Problem wrote:
> 
> >IS there a way of using Message-ID is identify Spam or Ham?
> 
> The Message-ID is to uniquely identify that message. Think of it like as a 
> social security number. Do you want to declare a person a cheat becuase 
> you do not like his/her social security number?
> 
> You can give some point to messages that do not set their own Message-ID. 
> That is allready part of spamassassin for ages.
> 
> Or are you trying to ask something completely differently?
>

Nope on the correct track.  What is then needed is to cross reference
the message-id with the mail logs, trace back the offending
IP and make the spam disappear.

NOw I should open a black hole! 

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

-- 
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 



From glenn.steen at gmail.com  Mon May 14 10:28:28 2007
From: glenn.steen at gmail.com (Glenn Steen)
Date: Mon May 14 10:28:32 2007
Subject: postfix dropping SMTP connection when receiving mail
In-Reply-To: <4644D221.3050403@fgp.com>
References: <4644D221.3050403@fgp.com>
Message-ID: <223f97700705140228l7beefb0dp1640a23cd99478f5@mail.gmail.com>

On 11/05/07, Jonathan Nalley <jnalley@fgp.com> wrote:
> Hi, I'm running MailScanner 4.58.9-1 using postfix 2.3.3 on Centos 5.
>
> I've set our M$ Exchange Server 2007 to use our MailScanner/Postfix box as a "smart host" such that all outbound mail would be sent through the MailScanner/postfix box.  The problem is that when the Exchange box is trying to pass along an e-mail to postfix, the connection and SMTP session gets dropped or something really bizarre is going on.
>
> Below is a snippet of /var/log/maillog (with postfix's debug_peer_level=1000).  For the purposes of these pasted log files. 192.168.0.207 is the exchange box and 192.168.0.208 is the Postfix box.
>
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: match_hostname: exchange.myinternaldomain.com ~? 192.168.0.0/24
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: match_hostaddr: 192.168.0.207 ~? 192.168.0.0/24
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: > exchange.myinternaldomain.com[192.168.0.207]: 220 mailscanner.myinternaldomain.com ESMTP Postfix
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: watchdog_pat: 0x99266a0
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: vstream_fflush_some: fd 9 flush 83
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: vstream_buf_get_ready: fd 9 got 29
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: < exchange.myinternaldomain.com[192.168.0.207]: EHLO exchange.myinternaldomain.com
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: > exchange.myinternaldomain.com[192.168.0.207]: 250-mailscanner.myinternaldomain.com
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: > exchange.myinternaldomain.com[192.168.0.207]: 250-PIPELINING
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: > exchange.myinternaldomain.com[192.168.0.207]: 250-SIZE 10240000
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: > exchange.myinternaldomain.com[192.168.0.207]: 250-VRFY
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: > exchange.myinternaldomain.com[192.168.0.207]: 250-ETRN
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: > exchange.myinternaldomain.com[192.168.0.207]: 250-AUTH LOGIN PLAIN
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: match_list_match: exchange.myinternaldomain.com: no match
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: match_list_match: 192.168.0.207: no match
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: > exchange.myinternaldomain.com[192.168.0.207]: 250-AUTH=LOGIN PLAIN
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: > exchange.myinternaldomain.com[192.168.0.207]: 250-ENHANCEDSTATUSCODES
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: > exchange.myinternaldomain.com[192.168.0.207]: 250-8BITMIME
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: > exchange.myinternaldomain.com[192.168.0.207]: 250 DSN
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: watchdog_pat: 0x99266a0
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: vstream_fflush_some: fd 9 flush 178
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: smtp_get: EOF
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: match_hostname: exchange.myinternaldomain.com ~? 192.168.0.0/24
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: match_hostaddr: 192.168.0.207 ~? 192.168.0.0/24
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: lost connection after EHLO from exchange.myinternaldomain.com[192.168.0.207]
> May 11 09:40:23 mailscanner postfix/smtpd[18829]: disconnect from exchange.myinternaldomain.com[192.168.0.207]
>
>
> When enabling verbose session logging on the M$ Exchange box, below is the relevant SMTP session snippet:
>
> 2007-05-11T18:06:53.714Z,PostFixSendConnector,08C9612DB0BAB77B,0,,192.168.0.208:25,*,,attempting to connect
> 2007-05-11T18:06:53.714Z,PostFixSendConnector,08C9612DB0BAB77B,1,192.168.0.207:11256,192.168.0.208:25,+,,
> 2007-05-11T18:06:53.714Z,PostFixSendConnector,08C9612DB0BAB77B,2,192.168.0.207:11256,192.168.0.208:25,<,220 postfixbox.myinternaldomain.com ESMTP Postfix,
> 2007-05-11T18:06:53.714Z,PostFixSendConnector,08C9612DB0BAB77B,3,192.168.0.207:11256,192.168.0.208:25,>,EHLO exchange.myinternaldomain.com,
> 2007-05-11T18:06:53.714Z,PostFixSendConnector,08C9612DB0BAB77B,4,192.168.0.207:11256,192.168.0.208:25,<,
> 2007-05-11T18:06:53.714Z,PostFixSendConnector,08C9612DB0BAB77B,5,192.168.0.207:11256,192.168.0.208:25,-,,Local
>
> The second-to-last line actually has 65 spaces and then the closing comma but i couldn't get my mailer to display that in a desirable fashion.
>
> I know it's tempting to say or to think that the problem might be with the M$ Exchange box, but i can tell Exchange to use other Postfix/MailScanner installations (admittedly running MailScanner version 4.46.2-2 and postfix version 2.1.5) as the smart host and everything works smoothly.
>
> I've seen other posts in the mailing list with people having "smtp_get: EOF" in their logs and other similar entries but many were related to TLS, SSL, SASL and authentication and all that stuff but i'm not trying to do any of that here.  Any thoughts, wisdom, insights, fixes, and solutions greatly appreciated. Thanks In Advance.
>
>
> Below is postconf -n:
>
> alias_database = hash:/etc/aliases
> alias_maps = hash:/etc/aliases
> broken_sasl_auth_clients = yes
> command_directory = /usr/sbin
> config_directory = /etc/postfix
> daemon_directory = /usr/libexec/postfix
> debug_peer_level = 1000
> debug_peer_list = 192.168.0.207
> header_checks = regexp:/etc/postfix/header_checks
> html_directory = no
> inet_interfaces = all
> mail_owner = postfix
> mailq_path = /usr/bin/mailq.postfix
> manpage_directory = /usr/share/man
> mydestination = localhost.$mydomain, localhost, $mydomain
> mydomain = myinternaldomain.com
> myhostname = mailscanner.myinternaldomain.com
> mynetworks = 192.168.0.0/24, 127.0.0.0/8
> myorigin = $mydomain
> newaliases_path = /usr/bin/newaliases.postfix
> queue_directory = /var/spool/postfix
> readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES
> relay_domains = $mydestination
> sample_directory = /usr/share/doc/postfix-2.3.3/samples
> sendmail_path = /usr/sbin/sendmail.postfix
> setgid_group = postdrop
> smtpd_banner = $myhostname ESMTP $mail_name
> smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination
> smtpd_sasl_auth_enable = yes
> smtpd_sasl_path = smtpd
> transport_maps = hash:/etc/postfix/transport
> unknown_local_recipient_reject_code = 550
>

Not really an MailScanner problem this... If you telnet to it and
"play MTA", does it work then?
If you remove the SASL thing from recipient_restrictions, still the same?

-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
From matt at coders.co.uk  Mon May 14 11:32:11 2007
From: matt at coders.co.uk (Matt Hampton)
Date: Mon May 14 11:29:47 2007
Subject: Does anyone catch this....
Message-ID: <46483AAB.7040800@coders.co.uk>

http://www.coders.co.uk/slipped.through.txt

It has sailed through both a SA3.1.8 and SA3.2.0 (3.2.0-pre2-r512851) 
running on recent versions of MailScanner

cheers

Matt


From martinh at solidstatelogic.com  Mon May 14 11:36:53 2007
From: martinh at solidstatelogic.com (martinh@solidstatelogic.com)
Date: Mon May 14 11:37:21 2007
Subject: Does anyone catch this....
In-Reply-To: <46483AAB.7040800@coders.co.uk>
Message-ID: <1a4d33aefaed9045b83b9d05da8898f6@solidstatelogic.com>


Matt

Content analysis details:   (5.3 points, 5.0 required)

 pts rule name              description
---- ----------------------
--------------------------------------------------
 0.6 REPLY_TO_EMPTY         Reply-To: is empty
 0.1 FORGED_RCVD_HELO       Received: contains a forged HELO
 0.6 J_CHICKENPOX_82        BODY: {8}Letter - punctuation - {2}Letter
 0.0 HTML_MESSAGE           BODY: HTML included in message
 0.0 BAYES_50               BODY: Bayesian spam probability is 40 to 60%
                            [score: 0.4951]
 0.0 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
 4.0 DCC_CHECK              Listed in DCC
(http://rhyolite.com/anti-spam/dcc/)


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: Matt Hampton [mailto:matt@coders.co.uk]
> Sent: 14 May 2007 11:32
> To: mailscanner@lists.mailscanner.info; users@spamassassin.apache.org
> Subject: Does anyone catch this....
>
> http://www.coders.co.uk/slipped.through.txt
>
> It has sailed through both a SA3.1.8 and SA3.2.0 (3.2.0-pre2-r512851)
> running on recent versions of MailScanner
>
> cheers
>
> Matt
>





**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the 
addressee only and may be confidential. If they come to you in error 
you must take no action based on them, nor must you copy or show them 
to anyone. Please advise the sender by replying to this e-mail 
immediately and then delete the original from your computer.

Opinion : Any opinions expressed in this e-mail are entirely those of 
the author and unless specifically stated to the contrary, are not 
necessarily those of the author's employer.

Security Warning : Internet e-mail is not necessarily a secure 
communications medium and can be subject to data corruption. We advise 
that you consider this fact when e-mailing us. 

Viruses : We have taken steps to ensure that this e-mail and any 
attachments are free from known viruses but in keeping with good 
computing practice, you should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales 
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
United Kingdom
**********************************************************************

From list-mailscanner at linguaphone.com  Mon May 14 11:40:16 2007
From: list-mailscanner at linguaphone.com (Gareth)
Date: Mon May 14 11:40:24 2007
Subject: Does anyone catch this....
In-Reply-To: <46483AAB.7040800@coders.co.uk>
References: <46483AAB.7040800@coders.co.uk>
Message-ID: <1179139216.12949.8.camel@gblades-suse.linguaphone-intranet.co.uk>

On Mon, 2007-05-14 at 11:32, Matt Hampton wrote:
> http://www.coders.co.uk/slipped.through.txt
> 
> It has sailed through both a SA3.1.8 and SA3.2.0 (3.2.0-pre2-r512851) 
> running on recent versions of MailScanner
> 
> cheers
> 
> Matt

It would have made it past our spam filter aswell. It looks like a
phishing email so it might have been stopped by clamav's phishing
signatures.

From edward.prendergast at netring.co.uk  Mon May 14 11:41:37 2007
From: edward.prendergast at netring.co.uk (Edward Prendergast)
Date: Mon May 14 11:41:48 2007
Subject: Does anyone catch this....
In-Reply-To: <46483AAB.7040800@coders.co.uk>
Message-ID: <200705141041.l4EAfkEP027689@safir.blacknight.ie>


-----Original Message-----
From: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Matt
Hampton
Sent: 14 May 2007 11:32
To: mailscanner@lists.mailscanner.info; users@spamassassin.apache.org
Subject: Does anyone catch this....

http://www.coders.co.uk/slipped.through.txt

It has sailed through both a SA3.1.8 and SA3.2.0 (3.2.0-pre2-r512851) 
running on recent versions of MailScanner

cheers

Matt
---------------------------

Hi Matt,

It would've slipped through for me too:

pts rule name              description
---- ----------------------
--------------------------------------------------
 1.0 BAYES_60               BODY: Bayesian spam probability is 60 to 80%
                            [score: 0.6832]
 0.0 HTML_MESSAGE           BODY: HTML included in message
 1.5 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
 2.2 DCC_CHECK              Listed in DCC
(http://rhyolite.com/anti-spam/dcc/)


************
The information in this email is confidential and may be legally privileged.
It is intended solely for the addressee. Access to this email by anyone else
is unauthorised. If you are not the intended recipient, any action taken or
omitted to be taken in reliance on it, any form of reproduction,
dissemination, copying, disclosure, modification, distribution and/or
publication of this E-mail message is strictly prohibited and may be
unlawful. If you have received this E-mail message in error, please notify
us immediately. Please also destroy and delete the message from your
computer.
************

From rcooper at dwford.com  Mon May 14 13:11:54 2007
From: rcooper at dwford.com (Rick Cooper)
Date: Mon May 14 13:13:26 2007
Subject: Does anyone catch this....
In-Reply-To: <1179139216.12949.8.camel@gblades-suse.linguaphone-intranet.co.uk>
References: <46483AAB.7040800@coders.co.uk>
	<1179139216.12949.8.camel@gblades-suse.linguaphone-intranet.co.uk>
Message-ID: <04d401c79621$10172d30$0301a8c0@SAHOMELT>

 

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info 
> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf 
> Of Gareth
> Sent: Monday, May 14, 2007 6:40 AM
> To: MailScanner discussion
> Subject: Re: Does anyone catch this....
> 
> On Mon, 2007-05-14 at 11:32, Matt Hampton wrote:
> > http://www.coders.co.uk/slipped.through.txt
> > 
> > It has sailed through both a SA3.1.8 and SA3.2.0 
> (3.2.0-pre2-r512851) 
> > running on recent versions of MailScanner
> > 
> > cheers
> > 
> > Matt
> 
> It would have made it past our spam filter aswell. It looks like a
> phishing email so it might have been stopped by clamav's phishing
> signatures.
> 


Clam says : Html.Phishing.Bank.Sanesecurity.06030604 FOUND so it wouldn't
make it past exim (or to spamd). Of course you would have to be using the
SaneSecurity phishing signatures. 

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


From mogens at fumlersoft.dk  Mon May 14 14:59:48 2007
From: mogens at fumlersoft.dk (Mogens Melander)
Date: Mon May 14 14:59:38 2007
Subject: Does anyone catch this....
In-Reply-To: <1179139216.12949.8.camel@gblades-suse.linguaphone-intranet.co.uk>
References: <46483AAB.7040800@coders.co.uk>
	<1179139216.12949.8.camel@gblades-suse.linguaphone-intranet.co.uk>
Message-ID: <3908.90.184.17.152.1179151188.squirrel@mail.fumlersoft.dk>


On Mon, May 14, 2007 12:40, Gareth wrote:
> On Mon, 2007-05-14 at 11:32, Matt Hampton wrote:
>> http://www.coders.co.uk/slipped.through.txt
>>
>> It has sailed through both a SA3.1.8 and SA3.2.0 (3.2.0-pre2-r512851)
>> running on recent versions of MailScanner
>>
>> cheers
>>
>> Matt
>
> It would have made it past our spam filter aswell. It looks like a
> phishing email so it might have been stopped by clamav's phishing
> signatures.

Well, both original OpenProtect and MS-SA-ClamAV upgraded OpenProtect
catch that one:

MailScanner ./blabla/msg-20986-1.txt: HTML.Phishing.Bank-1077 FOUND

-- 
Later

Mogens Melander
+45 40 85 71 38
+66 870 133 224



-- 
This message has been scanned for viruses and
dangerous content by OpenProtect(http://www.openprotect.com), and is
believed to be clean.

From m.anderlini at database.it  Mon May 14 15:06:35 2007
From: m.anderlini at database.it (Marcello Anderlini)
Date: Mon May 14 15:11:43 2007
Subject: Mqueue.in growing
In-Reply-To: <04d401c79621$10172d30$0301a8c0@SAHOMELT>
References: <46483AAB.7040800@coders.co.uk><1179139216.12949.8.camel@gblades-suse.linguaphone-intranet.co.uk>
	<04d401c79621$10172d30$0301a8c0@SAHOMELT>
Message-ID: <00d401c79631$156716f0$3f01a8c0@dbdomain.database.it>

Hello to all, some time ago I've already post this question, It seemed I've
solved the problem but this morning it compare again.

I'm using centos 4.4 with kernel 2.6.9-42.0.10.Elsmp, mailscanner 4.58.9.1,
spamassassin 3.2.0.1.el4.rf.
Razor, pyzor, dcc and fuzzy_ocr.

Without changing anything on my configuration, suddendly this morning the
mqueue.in start to grow until 4000 msg. I've tried to remove mailscanner rbl
check e and I've set skip_rbl_checks 1 in spam.assassin.pref.conf but
without success.

I've check in /root/.spamassassin folder and I found some lock file so I set
Rebuild Bayes Every = 86400. 

When I try spamassassin -D -lint -p /etc/MailScanner/spam.assassin.prefs.con
I get :
=========
[26122] warn: The -l option has been deprecated and is no longer supported,
ignoring.
[26122] dbg: logger: adding facilities: all
[26122] dbg: logger: logging level is DBG
[26122] dbg: generic: SpamAssassin version 3.2.0
[26122] dbg: config: score set 0 chosen.
[26122] dbg: util: running in taint mode? yes
[26122] dbg: util: taint mode: deleting unsafe environment variables,
resetting PATH
[26122] dbg: util: PATH included '/usr/kerberos/sbin', keeping
[26122] dbg: util: PATH included '/usr/kerberos/bin', keeping
[26122] dbg: util: PATH included '/usr/local/sbin', keeping
[26122] dbg: util: PATH included '/usr/local/bin', keeping
[26122] dbg: util: PATH included '/sbin', keeping
[26122] dbg: util: PATH included '/bin', keeping
[26122] dbg: util: PATH included '/usr/sbin', keeping
[26122] dbg: util: PATH included '/usr/bin', keeping
[26122] dbg: util: PATH included '/usr/X11R6/bin', keeping
[26122] dbg: util: PATH included '/root/bin', which doesn't exist, dropping
[26122] dbg: util: final PATH set to:
/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/b
in:/usr/sbin:/usr/bin:/usr/X11R6/bin
[26122] dbg: dns: no ipv6
[26122] dbg: dns: is Net::DNS::Resolver available? yes
[26122] dbg: dns: Net::DNS version: 0.48
=========

And it seemed to stop, what can be ? Could you help me ?

Thanks a lot


-- 
Messaggio verificato dal servizio antivirus di Database Informatica

From m.anderlini at database.it  Mon May 14 15:12:00 2007
From: m.anderlini at database.it (Marcello Anderlini)
Date: Mon May 14 15:15:05 2007
Subject: R: Mqueue.in growing
References: <46483AAB.7040800@coders.co.uk><1179139216.12949.8.camel@gblades-suse.linguaphone-intranet.co.uk>
	<04d401c79621$10172d30$0301a8c0@SAHOMELT> 
Message-ID: <00d501c79631$d7117d40$3f01a8c0@dbdomain.database.it>

Sorry, I made a mistake writing  spamassassin -D -lint -p
/etc/MailScanner/spam.assassin.prefs.conf, if I write spamassassin -D --lint
-p /etc/MailScanner/spam.assassin.prefs.conf, it continues but I still can
NOT understand why it's so slow.

Please help me :-(

Best regards

-----Messaggio originale-----
Da: Marcello Anderlini [mailto:m.anderlini@database.it] 
Inviato: luned? 14 maggio 2007 16.07
A: 'MailScanner discussion'
Oggetto: Mqueue.in growing

Hello to all, some time ago I've already post this question, It seemed I've
solved the problem but this morning it compare again.

I'm using centos 4.4 with kernel 2.6.9-42.0.10.Elsmp, mailscanner 4.58.9.1,
spamassassin 3.2.0.1.el4.rf.
Razor, pyzor, dcc and fuzzy_ocr.

Without changing anything on my configuration, suddendly this morning the
mqueue.in start to grow until 4000 msg. I've tried to remove mailscanner rbl
check e and I've set skip_rbl_checks 1 in spam.assassin.pref.conf but
without success.

I've check in /root/.spamassassin folder and I found some lock file so I set
Rebuild Bayes Every = 86400. 

When I try spamassassin -D -lint -p
/etc/MailScanner/spam.assassin.prefs.conf I get :
=========
[26122] warn: The -l option has been deprecated and is no longer supported,
ignoring.
[26122] dbg: logger: adding facilities: all [26122] dbg: logger: logging
level is DBG [26122] dbg: generic: SpamAssassin version 3.2.0 [26122] dbg:
config: score set 0 chosen.
[26122] dbg: util: running in taint mode? yes [26122] dbg: util: taint mode:
deleting unsafe environment variables, resetting PATH [26122] dbg: util:
PATH included '/usr/kerberos/sbin', keeping [26122] dbg: util: PATH included
'/usr/kerberos/bin', keeping [26122] dbg: util: PATH included
'/usr/local/sbin', keeping [26122] dbg: util: PATH included
'/usr/local/bin', keeping [26122] dbg: util: PATH included '/sbin', keeping
[26122] dbg: util: PATH included '/bin', keeping [26122] dbg: util: PATH
included '/usr/sbin', keeping [26122] dbg: util: PATH included '/usr/bin',
keeping [26122] dbg: util: PATH included '/usr/X11R6/bin', keeping [26122]
dbg: util: PATH included '/root/bin', which doesn't exist, dropping [26122]
dbg: util: final PATH set to:
/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/b
in:/usr/sbin:/usr/bin:/usr/X11R6/bin
[26122] dbg: dns: no ipv6
[26122] dbg: dns: is Net::DNS::Resolver available? yes [26122] dbg: dns:
Net::DNS version: 0.48 =========

And it seemed to stop, what can be ? Could you help me ?

Thanks a lot


-- 
Messaggio verificato dal servizio antivirus di Database Informatica

From mkercher at nfsmith.com  Mon May 14 15:11:58 2007
From: mkercher at nfsmith.com (Mike Kercher)
Date: Mon May 14 15:15:52 2007
Subject: Mqueue.in growing
References: <46483AAB.7040800@coders.co.uk><1179139216.12949.8.camel@gblades-suse.linguaphone-intranet.co.uk><04d401c79621$10172d30$0301a8c0@SAHOMELT>
	<00d401c79631$156716f0$3f01a8c0@dbdomain.database.it>
Message-ID: <6DEF8ABC1767C045B91F42066D36358E9224@HOUPEX01.nfsmith.info>

Marcello Anderlini <> wrote on Monday, May 14, 2007 9:07 AM:

: Hello to all, some time ago I've already post this question, It
: seemed I've solved the problem but this morning it compare again. 
: 
: I'm using centos 4.4 with kernel 2.6.9-42.0.10.Elsmp, mailscanner
: 4.58.9.1, spamassassin 3.2.0.1.el4.rf. 
: Razor, pyzor, dcc and fuzzy_ocr.
: 
: Without changing anything on my configuration, suddendly this morning
: the mqueue.in start to grow until 4000 msg. I've tried to remove
: mailscanner rbl check e and I've set skip_rbl_checks 1 in
: spam.assassin.pref.conf but without success.   
: 
: I've check in /root/.spamassassin folder and I found some lock file
: so I set Rebuild Bayes Every = 86400. 
: 
: When I try spamassassin -D -lint -p
: /etc/MailScanner/spam.assassin.prefs.con 
: I get :
: =========
: [26122] warn: The -l option has been deprecated and is no longer
: supported, ignoring. [26122] dbg: logger: adding facilities: all
: [26122] dbg: logger: logging level is DBG [26122] dbg: generic:
: SpamAssassin version 3.2.0 [26122] dbg: config: score set 0 chosen.
: [26122] dbg: util: running in taint mode? yes [26122] dbg: util:
: taint mode: deleting unsafe environment variables, resetting PATH
: [26122] dbg: util: PATH included '/usr/kerberos/sbin', keeping
: [26122] dbg: util: PATH included '/usr/kerberos/bin', keeping [26122]
: dbg: util: PATH included '/usr/local/sbin', keeping [26122] dbg:
: util: PATH included '/usr/local/bin', keeping [26122] dbg: util: PATH
: included '/sbin', keeping [26122] dbg: util: PATH included '/bin',
: keeping [26122] dbg: util: PATH included '/usr/sbin', keeping [26122]
: dbg: util: PATH included '/usr/bin', keeping [26122] dbg: util: PATH
: included '/usr/X11R6/bin', keeping [26122] dbg: util: PATH included
: '/root/bin', which doesn't exist, dropping [26122] dbg: util: final
: PATH set to:
:
/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbi
n:/b
: in:/usr/sbin:/usr/bin:/usr/X11R6/bin
: [26122] dbg: dns: no ipv6
: [26122] dbg: dns: is Net::DNS::Resolver available? yes [26122] dbg:
: dns: Net::DNS version: 0.48 ========= 
: 
: And it seemed to stop, what can be ? Could you help me ?
: 
: Thanks a lot
: 
: 
: --
: Messaggio verificato dal servizio antivirus di Database Informatica

Try spamassassin -D --lint (you missed a dash)


-Mike
From mkercher at nfsmith.com  Mon May 14 15:15:27 2007
From: mkercher at nfsmith.com (Mike Kercher)
Date: Mon May 14 15:19:20 2007
Subject: Mqueue.in growing
References: <46483AAB.7040800@coders.co.uk><1179139216.12949.8.camel@gblades-suse.linguaphone-intranet.co.uk><04d401c79621$10172d30$0301a8c0@SAHOMELT>
	<00d501c79631$d7117d40$3f01a8c0@dbdomain.database.it>
Message-ID: <6DEF8ABC1767C045B91F42066D36358E9225@HOUPEX01.nfsmith.info>

Marcello Anderlini <> wrote on Monday, May 14, 2007 9:12 AM:

: Sorry, I made a mistake writing  spamassassin -D -lint -p
: /etc/MailScanner/spam.assassin.prefs.conf, if I write spamassassin -D
: --lint -p /etc/MailScanner/spam.assassin.prefs.conf, it continues but
: I still can NOT understand why it's so slow.   
: 
: Please help me :-(
: 
: Best regards
: 
: -----Messaggio originale-----
: Da: Marcello Anderlini [mailto:m.anderlini@database.it]
: Inviato: luned? 14 maggio 2007 16.07
: A: 'MailScanner discussion'
: Oggetto: Mqueue.in growing
: 
: Hello to all, some time ago I've already post this question, It
: seemed I've solved the problem but this morning it compare again. 
: 
: I'm using centos 4.4 with kernel 2.6.9-42.0.10.Elsmp, mailscanner
: 4.58.9.1, spamassassin 3.2.0.1.el4.rf. 
: Razor, pyzor, dcc and fuzzy_ocr.
: 
: Without changing anything on my configuration, suddendly this morning
: the mqueue.in start to grow until 4000 msg. I've tried to remove
: mailscanner rbl check e and I've set skip_rbl_checks 1 in
: spam.assassin.pref.conf but without success.   
: 
: I've check in /root/.spamassassin folder and I found some lock file
: so I set Rebuild Bayes Every = 86400. 
: 
: When I try spamassassin -D -lint -p
: /etc/MailScanner/spam.assassin.prefs.conf I get :
: =========
: [26122] warn: The -l option has been deprecated and is no longer
: supported, ignoring. [26122] dbg: logger: adding facilities: all
: [26122] dbg: logger: logging level is DBG [26122] dbg: generic:
: SpamAssassin version 3.2.0 [26122] dbg:  
: config: score set 0 chosen.
: [26122] dbg: util: running in taint mode? yes [26122] dbg: util:
: taint mode: 
: deleting unsafe environment variables, resetting PATH [26122] dbg:
: util: 
: PATH included '/usr/kerberos/sbin', keeping [26122] dbg: util: PATH
: included '/usr/kerberos/bin', keeping [26122] dbg: util: PATH
: included '/usr/local/sbin', keeping [26122] dbg: util: PATH included
: '/usr/local/bin', keeping [26122] dbg: util: PATH included '/sbin',
: keeping [26122] dbg: util: PATH included '/bin', keeping [26122] dbg:
: util: PATH included '/usr/sbin', keeping [26122] dbg: util: PATH
: included '/usr/bin', keeping [26122] dbg: util: PATH included
: '/usr/X11R6/bin', keeping [26122] dbg: util: PATH included
: '/root/bin', which doesn't exist, dropping [26122]       
: dbg: util: final PATH set to:
: /usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/b
: in:/usr/sbin:/usr/bin:/usr/X11R6/bin
: [26122] dbg: dns: no ipv6
: [26122] dbg: dns: is Net::DNS::Resolver available? yes [26122] dbg:
: dns: 
: Net::DNS version: 0.48 =========
: 
: And it seemed to stop, what can be ? Could you help me ?
: 
: Thanks a lot
: 
: 
: --

When I run it, I get:

[3262] dbg: dns: no ipv6
[3262] dbg: dns: is Net::DNS::Resolver available? yes
[3262] dbg: dns: Net::DNS version: 0.59

You might try updating your Net::DNS and see if that helps.


-Mike
From martinh at solidstatelogic.com  Mon May 14 15:24:38 2007
From: martinh at solidstatelogic.com (martinh@solidstatelogic.com)
Date: Mon May 14 15:24:42 2007
Subject: Mqueue.in growing
In-Reply-To: <00d401c79631$156716f0$3f01a8c0@dbdomain.database.it>
Message-ID: <615771af0d8da44c85f5994a3e31da5c@solidstatelogic.com>

Marcello

What version of perl. There's an issue with SA 3.2.0 and perl < 5.8.8,
and a workaround....

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> bounces@lists.mailscanner.info] On Behalf Of Marcello Anderlini
> Sent: 14 May 2007 15:07
> To: MailScanner discussion
> Subject: Mqueue.in growing
>
> Hello to all, some time ago I've already post this question, It seemed
> I've
> solved the problem but this morning it compare again.
>
> I'm using centos 4.4 with kernel 2.6.9-42.0.10.Elsmp, mailscanner
> 4.58.9.1,
> spamassassin 3.2.0.1.el4.rf.
> Razor, pyzor, dcc and fuzzy_ocr.
>
> Without changing anything on my configuration, suddendly this morning
the
> mqueue.in start to grow until 4000 msg. I've tried to remove
mailscanner
> rbl
> check e and I've set skip_rbl_checks 1 in spam.assassin.pref.conf but
> without success.
>
> I've check in /root/.spamassassin folder and I found some lock file so
I
> set
> Rebuild Bayes Every = 86400.
>
> When I try spamassassin -D -lint -p
> /etc/MailScanner/spam.assassin.prefs.con
> I get :
> =========
> [26122] warn: The -l option has been deprecated and is no longer
> supported,
> ignoring.
> [26122] dbg: logger: adding facilities: all
> [26122] dbg: logger: logging level is DBG
> [26122] dbg: generic: SpamAssassin version 3.2.0
> [26122] dbg: config: score set 0 chosen.
> [26122] dbg: util: running in taint mode? yes
> [26122] dbg: util: taint mode: deleting unsafe environment variables,
> resetting PATH
> [26122] dbg: util: PATH included '/usr/kerberos/sbin', keeping
> [26122] dbg: util: PATH included '/usr/kerberos/bin', keeping
> [26122] dbg: util: PATH included '/usr/local/sbin', keeping
> [26122] dbg: util: PATH included '/usr/local/bin', keeping
> [26122] dbg: util: PATH included '/sbin', keeping
> [26122] dbg: util: PATH included '/bin', keeping
> [26122] dbg: util: PATH included '/usr/sbin', keeping
> [26122] dbg: util: PATH included '/usr/bin', keeping
> [26122] dbg: util: PATH included '/usr/X11R6/bin', keeping
> [26122] dbg: util: PATH included '/root/bin', which doesn't exist,
> dropping
> [26122] dbg: util: final PATH set to:
>
/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbi
n:
> /b
> in:/usr/sbin:/usr/bin:/usr/X11R6/bin
> [26122] dbg: dns: no ipv6
> [26122] dbg: dns: is Net::DNS::Resolver available? yes
> [26122] dbg: dns: Net::DNS version: 0.48
> =========
>
> And it seemed to stop, what can be ? Could you help me ?
>
> Thanks a lot
>
>
> --
> Messaggio verificato dal servizio antivirus di Database Informatica
>
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!




**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the 
addressee only and may be confidential. If they come to you in error 
you must take no action based on them, nor must you copy or show them 
to anyone. Please advise the sender by replying to this e-mail 
immediately and then delete the original from your computer.

Opinion : Any opinions expressed in this e-mail are entirely those of 
the author and unless specifically stated to the contrary, are not 
necessarily those of the author's employer.

Security Warning : Internet e-mail is not necessarily a secure 
communications medium and can be subject to data corruption. We advise 
that you consider this fact when e-mailing us. 

Viruses : We have taken steps to ensure that this e-mail and any 
attachments are free from known viruses but in keeping with good 
computing practice, you should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales 
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
United Kingdom
**********************************************************************

From mkercher at nfsmith.com  Mon May 14 15:25:11 2007
From: mkercher at nfsmith.com (Mike Kercher)
Date: Mon May 14 15:29:05 2007
Subject: Mqueue.in growing
References: <615771af0d8da44c85f5994a3e31da5c@solidstatelogic.com>
Message-ID: <6DEF8ABC1767C045B91F42066D36358E9227@HOUPEX01.nfsmith.info>

martinh@solidstatelogic.com <> wrote on Monday, May 14, 2007 9:25 AM:

: Marcello
: 
: What version of perl. There's an issue with SA 3.2.0 and perl <
: 5.8.8, and a workaround.... 
: 
: --

This is perl, v5.8.5 built for i386-linux-thread-multi

This is on CentOS 4.4 as well.

-Mike
From mkercher at nfsmith.com  Mon May 14 15:26:13 2007
From: mkercher at nfsmith.com (Mike Kercher)
Date: Mon May 14 15:30:07 2007
Subject: Mqueue.in growing
References: <615771af0d8da44c85f5994a3e31da5c@solidstatelogic.com>
Message-ID: <6DEF8ABC1767C045B91F42066D36358E9228@HOUPEX01.nfsmith.info>

martinh@solidstatelogic.com <> wrote on Monday, May 14, 2007 9:25 AM:

: Marcello
: 
: What version of perl. There's an issue with SA 3.2.0 and perl <
: 5.8.8, and a workaround.... 
: 
: --

Oops...disregard.  Back to the coffee pot!

-Mike
From martinh at solidstatelogic.com  Mon May 14 15:34:28 2007
From: martinh at solidstatelogic.com (martinh@solidstatelogic.com)
Date: Mon May 14 15:34:34 2007
Subject: Mqueue.in growing
In-Reply-To: <6DEF8ABC1767C045B91F42066D36358E9227@HOUPEX01.nfsmith.info>
Message-ID: <b9ec515192ffb8419f7ece5801f7e315@solidstatelogic.com>

Mike

There's a fair chance you've got hit by the use bytes bug in SA 3.2.0.

Find the Message.pm in the perl path for sa 3.2.0

Just below "use warnings;" add a newline...

use bytes;

this should sort the problem as long as your not using the
normalize_charset functionality in SA. If you are you're stuffed and
will have to go back to 3.1.8.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> bounces@lists.mailscanner.info] On Behalf Of Mike Kercher
> Sent: 14 May 2007 15:25
> To: MailScanner discussion
> Subject: RE: Mqueue.in growing
>
> martinh@solidstatelogic.com <> wrote on Monday, May 14, 2007 9:25 AM:
>
> : Marcello
> :
> : What version of perl. There's an issue with SA 3.2.0 and perl <
> : 5.8.8, and a workaround....
> :
> : --
>
> This is perl, v5.8.5 built for i386-linux-thread-multi
>
> This is on CentOS 4.4 as well.
>
> -Mike
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!




**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the 
addressee only and may be confidential. If they come to you in error 
you must take no action based on them, nor must you copy or show them 
to anyone. Please advise the sender by replying to this e-mail 
immediately and then delete the original from your computer.

Opinion : Any opinions expressed in this e-mail are entirely those of 
the author and unless specifically stated to the contrary, are not 
necessarily those of the author's employer.

Security Warning : Internet e-mail is not necessarily a secure 
communications medium and can be subject to data corruption. We advise 
that you consider this fact when e-mailing us. 

Viruses : We have taken steps to ensure that this e-mail and any 
attachments are free from known viruses but in keeping with good 
computing practice, you should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales 
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
United Kingdom
**********************************************************************

From m.anderlini at database.it  Mon May 14 15:39:38 2007
From: m.anderlini at database.it (Marcello Anderlini)
Date: Mon May 14 15:51:00 2007
Subject: R: Mqueue.in growing
In-Reply-To: <615771af0d8da44c85f5994a3e31da5c@solidstatelogic.com>
References: <00d401c79631$156716f0$3f01a8c0@dbdomain.database.it>
	<615771af0d8da44c85f5994a3e31da5c@solidstatelogic.com>
Message-ID: <00d601c79635$b2e8e8f0$3f01a8c0@dbdomain.database.it>

I'm using perl 5.8.5.36.RHEL4
What's the workaround ?

bye
 

-----Messaggio originale-----
Da: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] Per conto di
martinh@solidstatelogic.com
Inviato: luned? 14 maggio 2007 16.25
A: MailScanner discussion
Oggetto: RE: Mqueue.in growing

Marcello

What version of perl. There's an issue with SA 3.2.0 and perl < 5.8.8, and a
workaround....

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- 
> bounces@lists.mailscanner.info] On Behalf Of Marcello Anderlini
> Sent: 14 May 2007 15:07
> To: MailScanner discussion
> Subject: Mqueue.in growing
>
> Hello to all, some time ago I've already post this question, It seemed 
> I've solved the problem but this morning it compare again.
>
> I'm using centos 4.4 with kernel 2.6.9-42.0.10.Elsmp, mailscanner 
> 4.58.9.1, spamassassin 3.2.0.1.el4.rf.
> Razor, pyzor, dcc and fuzzy_ocr.
>
> Without changing anything on my configuration, suddendly this morning
the
> mqueue.in start to grow until 4000 msg. I've tried to remove
mailscanner
> rbl
> check e and I've set skip_rbl_checks 1 in spam.assassin.pref.conf but 
> without success.
>
> I've check in /root/.spamassassin folder and I found some lock file so
I
> set
> Rebuild Bayes Every = 86400.
>
> When I try spamassassin -D -lint -p
> /etc/MailScanner/spam.assassin.prefs.con
> I get :
> =========
> [26122] warn: The -l option has been deprecated and is no longer 
> supported, ignoring.
> [26122] dbg: logger: adding facilities: all [26122] dbg: logger: 
> logging level is DBG [26122] dbg: generic: SpamAssassin version 3.2.0 
> [26122] dbg: config: score set 0 chosen.
> [26122] dbg: util: running in taint mode? yes [26122] dbg: util: taint 
> mode: deleting unsafe environment variables, resetting PATH [26122] 
> dbg: util: PATH included '/usr/kerberos/sbin', keeping [26122] dbg: 
> util: PATH included '/usr/kerberos/bin', keeping [26122] dbg: util: 
> PATH included '/usr/local/sbin', keeping [26122] dbg: util: PATH 
> included '/usr/local/bin', keeping [26122] dbg: util: PATH included 
> '/sbin', keeping [26122] dbg: util: PATH included '/bin', keeping 
> [26122] dbg: util: PATH included '/usr/sbin', keeping [26122] dbg: 
> util: PATH included '/usr/bin', keeping [26122] dbg: util: PATH 
> included '/usr/X11R6/bin', keeping [26122] dbg: util: PATH included 
> '/root/bin', which doesn't exist, dropping [26122] dbg: util: final 
> PATH set to:
>
/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbi
n:
> /b
> in:/usr/sbin:/usr/bin:/usr/X11R6/bin
> [26122] dbg: dns: no ipv6
> [26122] dbg: dns: is Net::DNS::Resolver available? yes [26122] dbg: 
> dns: Net::DNS version: 0.48 =========
>
> And it seemed to stop, what can be ? Could you help me ?
>
> Thanks a lot
>
>
> --
> Messaggio verificato dal servizio antivirus di Database Informatica
>
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!




**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the
addressee only and may be confidential. If they come to you in error you
must take no action based on them, nor must you copy or show them to anyone.
Please advise the sender by replying to this e-mail immediately and then
delete the original from your computer.

Opinion : Any opinions expressed in this e-mail are entirely those of the
author and unless specifically stated to the contrary, are not necessarily
those of the author's employer.

Security Warning : Internet e-mail is not necessarily a secure
communications medium and can be subject to data corruption. We advise that
you consider this fact when e-mailing us. 

Viruses : We have taken steps to ensure that this e-mail and any attachments
are free from known viruses but in keeping with good computing practice, you
should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales (Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, United
Kingdom
**********************************************************************

--
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!

--
Messaggio verificato dal servizio antivirus di Database Informatica


-- 
Messaggio verificato dal servizio antivirus di Database Informatica

From m.anderlini at database.it  Mon May 14 15:47:02 2007
From: m.anderlini at database.it (Marcello Anderlini)
Date: Mon May 14 15:52:39 2007
Subject: R: Mqueue.in growing
In-Reply-To: <6DEF8ABC1767C045B91F42066D36358E9228@HOUPEX01.nfsmith.info>
References: <615771af0d8da44c85f5994a3e31da5c@solidstatelogic.com>
	<6DEF8ABC1767C045B91F42066D36358E9228@HOUPEX01.nfsmith.info>
Message-ID: <00d701c79636$bb9b5c70$3f01a8c0@dbdomain.database.it>

Sorry, I do not understand (My english it's very low).
I've also commented this line in /etc/mail/spamassassin/v310.pre to disable
Pyzor and Razor but nothing the queue is still growing...

# Pyzor - perform Pyzor message checks.
#
#loadplugin Mail::SpamAssassin::Plugin::Pyzor

# Razor2 - perform Razor2 message checks.
#
#loadplugin Mail::SpamAssassin::Plugin::Razor2 

-----Messaggio originale-----
Da: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] Per conto di Mike
Kercher
Inviato: luned? 14 maggio 2007 16.26
A: MailScanner discussion
Oggetto: RE: Mqueue.in growing

martinh@solidstatelogic.com <> wrote on Monday, May 14, 2007 9:25 AM:

: Marcello
: 
: What version of perl. There's an issue with SA 3.2.0 and perl <
: 5.8.8, and a workaround.... 
: 
: --

Oops...disregard.  Back to the coffee pot!

-Mike
--
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!

--
Messaggio verificato dal servizio antivirus di Database Informatica


-- 
Messaggio verificato dal servizio antivirus di Database Informatica

From m.anderlini at database.it  Mon May 14 15:50:15 2007
From: m.anderlini at database.it (Marcello Anderlini)
Date: Mon May 14 15:53:22 2007
Subject: R: Mqueue.in growing
In-Reply-To: <b9ec515192ffb8419f7ece5801f7e315@solidstatelogic.com>
References: <6DEF8ABC1767C045B91F42066D36358E9227@HOUPEX01.nfsmith.info>
	<b9ec515192ffb8419f7ece5801f7e315@solidstatelogic.com>
Message-ID: <00d801c79637$2ed42050$3f01a8c0@dbdomain.database.it>

Sorry again, but this suggestion is for me or just for Mike Kercher ? 

-----Messaggio originale-----
Da: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] Per conto di
martinh@solidstatelogic.com
Inviato: luned? 14 maggio 2007 16.34
A: MailScanner discussion
Oggetto: RE: Mqueue.in growing

Mike

There's a fair chance you've got hit by the use bytes bug in SA 3.2.0.

Find the Message.pm in the perl path for sa 3.2.0

Just below "use warnings;" add a newline...

use bytes;

this should sort the problem as long as your not using the normalize_charset
functionality in SA. If you are you're stuffed and will have to go back to
3.1.8.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- 
> bounces@lists.mailscanner.info] On Behalf Of Mike Kercher
> Sent: 14 May 2007 15:25
> To: MailScanner discussion
> Subject: RE: Mqueue.in growing
>
> martinh@solidstatelogic.com <> wrote on Monday, May 14, 2007 9:25 AM:
>
> : Marcello
> :
> : What version of perl. There's an issue with SA 3.2.0 and perl <
> : 5.8.8, and a workaround....
> :
> : --
>
> This is perl, v5.8.5 built for i386-linux-thread-multi
>
> This is on CentOS 4.4 as well.
>
> -Mike
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!




**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the
addressee only and may be confidential. If they come to you in error you
must take no action based on them, nor must you copy or show them to anyone.
Please advise the sender by replying to this e-mail immediately and then
delete the original from your computer.

Opinion : Any opinions expressed in this e-mail are entirely those of the
author and unless specifically stated to the contrary, are not necessarily
those of the author's employer.

Security Warning : Internet e-mail is not necessarily a secure
communications medium and can be subject to data corruption. We advise that
you consider this fact when e-mailing us. 

Viruses : We have taken steps to ensure that this e-mail and any attachments
are free from known viruses but in keeping with good computing practice, you
should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales (Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, United
Kingdom
**********************************************************************

--
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!

--
Messaggio verificato dal servizio antivirus di Database Informatica


-- 
Messaggio verificato dal servizio antivirus di Database Informatica

From martinh at solidstatelogic.com  Mon May 14 15:56:39 2007
From: martinh at solidstatelogic.com (martinh@solidstatelogic.com)
Date: Mon May 14 15:56:44 2007
Subject: Mqueue.in growing
In-Reply-To: <00d801c79637$2ed42050$3f01a8c0@dbdomain.database.it>
Message-ID: <6e47fac3597ec8419c3cb6dfe92b3a0a@solidstatelogic.com>

Marcello

You - you need to Message.pm for spamassassin 3.2.0 and edit as below

(don't worry about you're English skills - much better than any other
language I use).

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> bounces@lists.mailscanner.info] On Behalf Of Marcello Anderlini
> Sent: 14 May 2007 15:50
> To: MailScanner discussion
> Subject: R: Mqueue.in growing
>
> Sorry again, but this suggestion is for me or just for Mike Kercher ?
>
> -----Messaggio originale-----
> Da: mailscanner-bounces@lists.mailscanner.info
> [mailto:mailscanner-bounces@lists.mailscanner.info] Per conto di
> martinh@solidstatelogic.com
> Inviato: luned? 14 maggio 2007 16.34
> A: MailScanner discussion
> Oggetto: RE: Mqueue.in growing
>
> Mike
>
> There's a fair chance you've got hit by the use bytes bug in SA 3.2.0.
>
> Find the Message.pm in the perl path for sa 3.2.0
>
> Just below "use warnings;" add a newline...
>
> use bytes;
>
> this should sort the problem as long as your not using the
> normalize_charset
> functionality in SA. If you are you're stuffed and will have to go
back to
> 3.1.8.
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
> > -----Original Message-----
> > From: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-
> > bounces@lists.mailscanner.info] On Behalf Of Mike Kercher
> > Sent: 14 May 2007 15:25
> > To: MailScanner discussion
> > Subject: RE: Mqueue.in growing
> >
> > martinh@solidstatelogic.com <> wrote on Monday, May 14, 2007 9:25
AM:
> >
> > : Marcello
> > :
> > : What version of perl. There's an issue with SA 3.2.0 and perl <
> > : 5.8.8, and a workaround....
> > :
> > : --
> >
> > This is perl, v5.8.5 built for i386-linux-thread-multi
> >
> > This is on CentOS 4.4 as well.
> >
> > -Mike
> > --
> > MailScanner mailing list
> > mailscanner@lists.mailscanner.info
> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >
> > Before posting, read http://wiki.mailscanner.info/posting
> >
> > Support MailScanner development - buy the book off the website!
>
>
>
>
> **********************************************************************
> Confidentiality : This e-mail and any attachments are intended for the
> addressee only and may be confidential. If they come to you in error
you
> must take no action based on them, nor must you copy or show them to
> anyone.
> Please advise the sender by replying to this e-mail immediately and
then
> delete the original from your computer.
>
> Opinion : Any opinions expressed in this e-mail are entirely those of
the
> author and unless specifically stated to the contrary, are not
necessarily
> those of the author's employer.
>
> Security Warning : Internet e-mail is not necessarily a secure
> communications medium and can be subject to data corruption. We advise
> that
> you consider this fact when e-mailing us.
>
> Viruses : We have taken steps to ensure that this e-mail and any
> attachments
> are free from known viruses but in keeping with good computing
practice,
> you
> should ensure that they are virus free.
>
> Red Lion 49 Ltd T/A Solid State Logic
> Registered as a limited company in England and Wales (Company
No:5362730)
> Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU,
United
> Kingdom
> **********************************************************************
>
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
> --
> Messaggio verificato dal servizio antivirus di Database Informatica
>
>
> --
> Messaggio verificato dal servizio antivirus di Database Informatica
>
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!




**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the 
addressee only and may be confidential. If they come to you in error 
you must take no action based on them, nor must you copy or show them 
to anyone. Please advise the sender by replying to this e-mail 
immediately and then delete the original from your computer.

Opinion : Any opinions expressed in this e-mail are entirely those of 
the author and unless specifically stated to the contrary, are not 
necessarily those of the author's employer.

Security Warning : Internet e-mail is not necessarily a secure 
communications medium and can be subject to data corruption. We advise 
that you consider this fact when e-mailing us. 

Viruses : We have taken steps to ensure that this e-mail and any 
attachments are free from known viruses but in keeping with good 
computing practice, you should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales 
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
United Kingdom
**********************************************************************

From m.anderlini at database.it  Mon May 14 16:00:16 2007
From: m.anderlini at database.it (Marcello Anderlini)
Date: Mon May 14 16:00:22 2007
Subject: R: Mqueue.in growing
In-Reply-To: <6e47fac3597ec8419c3cb6dfe92b3a0a@solidstatelogic.com>
References: <00d801c79637$2ed42050$3f01a8c0@dbdomain.database.it>
	<6e47fac3597ec8419c3cb6dfe92b3a0a@solidstatelogic.com>
Message-ID: <00e901c79638$952f52b0$3f01a8c0@dbdomain.database.it>

Thanks for all, but where I can found  Message.pm  ? And also why it was
working well until this morning ?

bye

-----Messaggio originale-----
Da: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] Per conto di
martinh@solidstatelogic.com
Inviato: luned? 14 maggio 2007 16.57
A: MailScanner discussion
Oggetto: RE: Mqueue.in growing

Marcello

You - you need to Message.pm for spamassassin 3.2.0 and edit as below

(don't worry about you're English skills - much better than any other
language I use).

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- 
> bounces@lists.mailscanner.info] On Behalf Of Marcello Anderlini
> Sent: 14 May 2007 15:50
> To: MailScanner discussion
> Subject: R: Mqueue.in growing
>
> Sorry again, but this suggestion is for me or just for Mike Kercher ?
>
> -----Messaggio originale-----
> Da: mailscanner-bounces@lists.mailscanner.info
> [mailto:mailscanner-bounces@lists.mailscanner.info] Per conto di 
> martinh@solidstatelogic.com
> Inviato: luned? 14 maggio 2007 16.34
> A: MailScanner discussion
> Oggetto: RE: Mqueue.in growing
>
> Mike
>
> There's a fair chance you've got hit by the use bytes bug in SA 3.2.0.
>
> Find the Message.pm in the perl path for sa 3.2.0
>
> Just below "use warnings;" add a newline...
>
> use bytes;
>
> this should sort the problem as long as your not using the 
> normalize_charset functionality in SA. If you are you're stuffed and 
> will have to go
back to
> 3.1.8.
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
> > -----Original Message-----
> > From: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-
> > bounces@lists.mailscanner.info] On Behalf Of Mike Kercher
> > Sent: 14 May 2007 15:25
> > To: MailScanner discussion
> > Subject: RE: Mqueue.in growing
> >
> > martinh@solidstatelogic.com <> wrote on Monday, May 14, 2007 9:25
AM:
> >
> > : Marcello
> > :
> > : What version of perl. There's an issue with SA 3.2.0 and perl <
> > : 5.8.8, and a workaround....
> > :
> > : --
> >
> > This is perl, v5.8.5 built for i386-linux-thread-multi
> >
> > This is on CentOS 4.4 as well.
> >
> > -Mike
> > --
> > MailScanner mailing list
> > mailscanner@lists.mailscanner.info
> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >
> > Before posting, read http://wiki.mailscanner.info/posting
> >
> > Support MailScanner development - buy the book off the website!
>
>
>
>
> **********************************************************************
> Confidentiality : This e-mail and any attachments are intended for the 
> addressee only and may be confidential. If they come to you in error
you
> must take no action based on them, nor must you copy or show them to 
> anyone.
> Please advise the sender by replying to this e-mail immediately and
then
> delete the original from your computer.
>
> Opinion : Any opinions expressed in this e-mail are entirely those of
the
> author and unless specifically stated to the contrary, are not
necessarily
> those of the author's employer.
>
> Security Warning : Internet e-mail is not necessarily a secure 
> communications medium and can be subject to data corruption. We advise 
> that you consider this fact when e-mailing us.
>
> Viruses : We have taken steps to ensure that this e-mail and any 
> attachments are free from known viruses but in keeping with good 
> computing
practice,
> you
> should ensure that they are virus free.
>
> Red Lion 49 Ltd T/A Solid State Logic
> Registered as a limited company in England and Wales (Company
No:5362730)
> Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU,
United
> Kingdom
> **********************************************************************
>
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
> --
> Messaggio verificato dal servizio antivirus di Database Informatica
>
>
> --
> Messaggio verificato dal servizio antivirus di Database Informatica
>
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!




**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the
addressee only and may be confidential. If they come to you in error you
must take no action based on them, nor must you copy or show them to anyone.
Please advise the sender by replying to this e-mail immediately and then
delete the original from your computer.

Opinion : Any opinions expressed in this e-mail are entirely those of the
author and unless specifically stated to the contrary, are not necessarily
those of the author's employer.

Security Warning : Internet e-mail is not necessarily a secure
communications medium and can be subject to data corruption. We advise that
you consider this fact when e-mailing us. 

Viruses : We have taken steps to ensure that this e-mail and any attachments
are free from known viruses but in keeping with good computing practice, you
should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales (Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, United
Kingdom
**********************************************************************

--
MailScanner mailing list
mailscanner@lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!

--
Messaggio verificato dal servizio antivirus di Database Informatica


-- 
Messaggio verificato dal servizio antivirus di Database Informatica

From martinh at solidstatelogic.com  Mon May 14 16:06:51 2007
From: martinh at solidstatelogic.com (martinh@solidstatelogic.com)
Date: Mon May 14 16:06:56 2007
Subject: Mqueue.in growing
In-Reply-To: <00e901c79638$952f52b0$3f01a8c0@dbdomain.database.it>
Message-ID: <3822a92168130a42b2532496de4ea715@solidstatelogic.com>

"locate Message.pm" will help.....

Mine's at.....

/usr/local/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/Message.pm

The problem is that it's error logging and this slows the whole thing
down. When did you upgrade to 3.2.0? It could be the system was just
coping before and now it's just got that little bit too busy and can't
sope.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-
> bounces@lists.mailscanner.info] On Behalf Of Marcello Anderlini
> Sent: 14 May 2007 16:00
> To: MailScanner discussion
> Subject: R: Mqueue.in growing
>
> Thanks for all, but where I can found  Message.pm  ? And also why it
was
> working well until this morning ?
>
> bye
>
> -----Messaggio originale-----
> Da: mailscanner-bounces@lists.mailscanner.info
> [mailto:mailscanner-bounces@lists.mailscanner.info] Per conto di
> martinh@solidstatelogic.com
> Inviato: luned? 14 maggio 2007 16.57
> A: MailScanner discussion
> Oggetto: RE: Mqueue.in growing
>
> Marcello
>
> You - you need to Message.pm for spamassassin 3.2.0 and edit as below
>
> (don't worry about you're English skills - much better than any other
> language I use).
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
> > -----Original Message-----
> > From: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-
> > bounces@lists.mailscanner.info] On Behalf Of Marcello Anderlini
> > Sent: 14 May 2007 15:50
> > To: MailScanner discussion
> > Subject: R: Mqueue.in growing
> >
> > Sorry again, but this suggestion is for me or just for Mike Kercher
?
> >
> > -----Messaggio originale-----
> > Da: mailscanner-bounces@lists.mailscanner.info
> > [mailto:mailscanner-bounces@lists.mailscanner.info] Per conto di
> > martinh@solidstatelogic.com
> > Inviato: luned? 14 maggio 2007 16.34
> > A: MailScanner discussion
> > Oggetto: RE: Mqueue.in growing
> >
> > Mike
> >
> > There's a fair chance you've got hit by the use bytes bug in SA
3.2.0.
> >
> > Find the Message.pm in the perl path for sa 3.2.0
> >
> > Just below "use warnings;" add a newline...
> >
> > use bytes;
> >
> > this should sort the problem as long as your not using the
> > normalize_charset functionality in SA. If you are you're stuffed and
> > will have to go
> back to
> > 3.1.8.
> >
> > --
> > Martin Hepworth
> > Snr Systems Administrator
> > Solid State Logic
> > Tel: +44 (0)1865 842300
> >
> > > -----Original Message-----
> > > From: mailscanner-bounces@lists.mailscanner.info
> [mailto:mailscanner-
> > > bounces@lists.mailscanner.info] On Behalf Of Mike Kercher
> > > Sent: 14 May 2007 15:25
> > > To: MailScanner discussion
> > > Subject: RE: Mqueue.in growing
> > >
> > > martinh@solidstatelogic.com <> wrote on Monday, May 14, 2007 9:25
> AM:
> > >
> > > : Marcello
> > > :
> > > : What version of perl. There's an issue with SA 3.2.0 and perl <
> > > : 5.8.8, and a workaround....
> > > :
> > > : --
> > >
> > > This is perl, v5.8.5 built for i386-linux-thread-multi
> > >
> > > This is on CentOS 4.4 as well.
> > >
> > > -Mike
> > > --
> > > MailScanner mailing list
> > > mailscanner@lists.mailscanner.info
> > > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> > >
> > > Before posting, read http://wiki.mailscanner.info/posting
> > >
> > > Support MailScanner development - buy the book off the website!
> >
> >
> >
> >
> >
**********************************************************************
> > Confidentiality : This e-mail and any attachments are intended for
the
> > addressee only and may be confidential. If they come to you in error
> you
> > must take no action based on them, nor must you copy or show them to
> > anyone.
> > Please advise the sender by replying to this e-mail immediately and
> then
> > delete the original from your computer.
> >
> > Opinion : Any opinions expressed in this e-mail are entirely those
of
> the
> > author and unless specifically stated to the contrary, are not
> necessarily
> > those of the author's employer.
> >
> > Security Warning : Internet e-mail is not necessarily a secure
> > communications medium and can be subject to data corruption. We
advise
> > that you consider this fact when e-mailing us.
> >
> > Viruses : We have taken steps to ensure that this e-mail and any
> > attachments are free from known viruses but in keeping with good
> > computing
> practice,
> > you
> > should ensure that they are virus free.
> >
> > Red Lion 49 Ltd T/A Solid State Logic
> > Registered as a limited company in England and Wales (Company
> No:5362730)
> > Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU,
> United
> > Kingdom
> >
**********************************************************************
> >
> > --
> > MailScanner mailing list
> > mailscanner@lists.mailscanner.info
> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >
> > Before posting, read http://wiki.mailscanner.info/posting
> >
> > Support MailScanner development - buy the book off the website!
> >
> > --
> > Messaggio verificato dal servizio antivirus di Database Informatica
> >
> >
> > --
> > Messaggio verificato dal servizio antivirus di Database Informatica
> >
> > --
> > MailScanner mailing list
> > mailscanner@lists.mailscanner.info
> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >
> > Before posting, read http://wiki.mailscanner.info/posting
> >
> > Support MailScanner development - buy the book off the website!
>
>
>
>
> **********************************************************************
> Confidentiality : This e-mail and any attachments are intended for the
> addressee only and may be confidential. If they come to you in error
you
> must take no action based on them, nor must you copy or show them to
> anyone.
> Please advise the sender by replying to this e-mail immediately and
then
> delete the original from your computer.
>
> Opinion : Any opinions expressed in this e-mail are entirely those of
the
> author and unless specifically stated to the contrary, are not
necessarily
> those of the author's employer.
>
> Security Warning : Internet e-mail is not necessarily a secure
> communications medium and can be subject to data corruption. We advise
> that
> you consider this fact when e-mailing us.
>
> Viruses : We have taken steps to ensure that this e-mail and any
> attachments
> are free from known viruses but in keeping with good computing
practice,
> you
> should ensure that they are virus free.
>
> Red Lion 49 Ltd T/A Solid State Logic
> Registered as a limited company in England and Wales (Company
No:5362730)
> Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU,
United
> Kingdom
> **********************************************************************
>
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
> --
> Messaggio verificato dal servizio antivirus di Database Informatica
>
>
> --
> Messaggio verificato dal servizio antivirus di Database Informatica
>
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!




**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the 
addressee only and may be confidential. If they come to you in error 
you must take no action based on them, nor must you copy or show them 
to anyone. Please advise the sender by replying to this e-mail 
immediately and then delete the original from your computer.

Opinion : Any opinions expressed in this e-mail are entirely those of 
the author and unless specifically stated to the contrary, are not 
necessarily those of the author's employer.

Security Warning : Internet e-mail is not necessarily a secure 
communications medium and can be subject to data corruption. We advise 
that you consider this fact when e-mailing us. 

Viruses : We have taken steps to ensure that this e-mail and any 
attachments are free from known viruses but in keeping with good 
computing practice, you should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales 
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
United Kingdom
**********************************************************************

From m.anderlini at database.it  Mon May 14 16:14:19 2007
From: m.anderlini at database.it (Marcello Anderlini)
Date: Mon May 14 16:14:37 2007
Subject: R: Mqueue.in growing
In-Reply-To: <3822a92168130a42b2532496de4ea715@solidstatelogic.com>
References: <00e901c79638$952f52b0$3f01a8c0@dbdomain.database.it>
	<3822a92168130a42b2532496de4ea715@solidstatelogic.com>
Message-ID: <00ea01c7963a$8b9b9f90$3f01a8c0@dbdomain.database.it>

I've upgraded to SA 3.2 on 03 May 2007. I really can't believe that it take
so much time because meantime I've restarted mailscanner many times...
Meantime I've cleaned the queue and disabled Pyzor and Razor and it seem
it's going better....

-----Messaggio originale-----
Da: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] Per conto di
martinh@solidstatelogic.com
Inviato: luned? 14 maggio 2007 17.07
A: MailScanner discussion
Oggetto: RE: Mqueue.in growing

"locate Message.pm" will help.....

Mine's at.....

/usr/local/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/Message.pm

The problem is that it's error logging and this slows the whole thing down.
When did you upgrade to 3.2.0? It could be the system was just coping before
and now it's just got that little bit too busy and can't sope.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- 
> bounces@lists.mailscanner.info] On Behalf Of Marcello Anderlini
> Sent: 14 May 2007 16:00
> To: MailScanner discussion
> Subject: R: Mqueue.in growing
>
> Thanks for all, but where I can found  Message.pm  ? And also why it
was
> working well until this morning ?
>
> bye
>
> -----Messaggio originale-----
> Da: mailscanner-bounces@lists.mailscanner.info
> [mailto:mailscanner-bounces@lists.mailscanner.info] Per conto di 
> martinh@solidstatelogic.com
> Inviato: luned? 14 maggio 2007 16.57
> A: MailScanner discussion
> Oggetto: RE: Mqueue.in growing
>
> Marcello
>
> You - you need to Message.pm for spamassassin 3.2.0 and edit as below
>
> (don't worry about you're English skills - much better than any other 
> language I use).
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
> > -----Original Message-----
> > From: mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-
> > bounces@lists.mailscanner.info] On Behalf Of Marcello Anderlini
> > Sent: 14 May 2007 15:50
> > To: MailScanner discussion
> > Subject: R: Mqueue.in growing
> >
> > Sorry again, but this suggestion is for me or just for Mike Kercher
?
> >
> > -----Messaggio originale-----
> > Da: mailscanner-bounces@lists.mailscanner.info
> > [mailto:mailscanner-bounces@lists.mailscanner.info] Per conto di 
> > martinh@solidstatelogic.com
> > Inviato: luned? 14 maggio 2007 16.34
> > A: MailScanner discussion
> > Oggetto: RE: Mqueue.in growing
> >
> > Mike
> >
> > There's a fair chance you've got hit by the use bytes bug in SA
3.2.0.
> >
> > Find the Message.pm in the perl path for sa 3.2.0
> >
> > Just below "use warnings;" add a newline...
> >
> > use bytes;
> >
> > this should sort the problem as long as your not using the 
> > normalize_charset functionality in SA. If you are you're stuffed and 
> > will have to go
> back to
> > 3.1.8.
> >
> > --
> > Martin Hepworth
> > Snr Systems Administrator
> > Solid State Logic
> > Tel: +44 (0)1865 842300
> >
> > > -----Original Message-----
> > > From: mailscanner-bounces@lists.mailscanner.info
> [mailto:mailscanner-
> > > bounces@lists.mailscanner.info] On Behalf Of Mike Kercher
> > > Sent: 14 May 2007 15:25
> > > To: MailScanner discussion
> > > Subject: RE: Mqueue.in growing
> > >
> > > martinh@solidstatelogic.com <> wrote on Monday, May 14, 2007 9:25
> AM:
> > >
> > > : Marcello
> > > :
> > > : What version of perl. There's an issue with SA 3.2.0 and perl <
> > > : 5.8.8, and a workaround....
> > > :
> > > : --
> > >
> > > This is perl, v5.8.5 built for i386-linux-thread-multi
> > >
> > > This is on CentOS 4.4 as well.
> > >
> > > -Mike
> > > --
> > > MailScanner mailing list
> > > mailscanner@lists.mailscanner.info
> > > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> > >
> > > Before posting, read http://wiki.mailscanner.info/posting
> > >
> > > Support MailScanner development - buy the book off the website!
> >
> >
> >
> >
> >
**********************************************************************
> > Confidentiality : This e-mail and any attachments are intended for
the
> > addressee only and may be confidential. If they come to you in error
> you
> > must take no action based on them, nor must you copy or show them to 
> > anyone.
> > Please advise the sender by replying to this e-mail immediately and
> then
> > delete the original from your computer.
> >
> > Opinion : Any opinions expressed in this e-mail are entirely those
of
> the
> > author and unless specifically stated to the contrary, are not
> necessarily
> > those of the author's employer.
> >
> > Security Warning : Internet e-mail is not necessarily a secure 
> > communications medium and can be subject to data corruption. We
advise
> > that you consider this fact when e-mailing us.
> >
> > Viruses : We have taken steps to ensure that this e-mail and any 
> > attachments are free from known viruses but in keeping with good 
> > computing
> practice,
> > you
> > should ensure that they are virus free.
> >
> > Red Lion 49 Ltd T/A Solid State Logic Registered as a limited 
> > company in England and Wales (Company
> No:5362730)
> > Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU,
> United
> > Kingdom
> >
**********************************************************************
> >
> > --
> > MailScanner mailing list
> > mailscanner@lists.mailscanner.info
> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >
> > Before posting, read http://wiki.mailscanner.info/posting
> >
> > Support MailScanner development - buy the book off the website!
> >
> > --
> > Messaggio verificato dal servizio antivirus di Database Informatica
> >
> >
> > --
> > Messaggio verificato dal servizio antivirus di Database Informatica
> >
> > --
> > MailScanner mailing list
> > mailscanner@lists.mailscanner.info
> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >
> > Before posting, read http://wiki.mailscanner.info/posting
> >
> > Support MailScanner development - buy the book off the website!
>
>
>
>
> **********************************************************************
> Confidentiality : This e-mail and any attachments are intended for the 
> addressee only and may be confidential. If they come to you in error
you
> must take no action based on them, nor must you copy or show them to 
> anyone.
> Please advise the sender by replying to this e-mail immediately and
then
> delete the original from your computer.
>
> Opinion : Any opinions expressed in this e-mail are entirely those of
the
> author and unless specifically stated to the contrary, are not
necessarily
> those of the author's employer.
>
> Security Warning : Internet e-mail is not necessarily a secure 
> communications medium and can be subject to data corruption. We advise 
> that you consider this fact when e-mailing us.
>
> Viruses : We have taken steps to ensure that this e-mail and any 
> attachments are free from known viruses but in keeping with good 
> computing
practice,
> you
> should ensure that they are virus free.
>
> Red Lion 49 Ltd T/A Solid State Logic
> Registered as a limited company in England and Wales (Company
No:5362730)
> Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU,
United
> Kingdom
> **********************************************************************
>
> --
> MailScanner mailing list
> mailscanner@lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner developmen