From eddie at emcuk.com Wed Apr 1 09:30:25 2009 From: eddie at emcuk.com (Eddie Hallahan) Date: Wed Apr 1 09:31:05 2009 Subject: clamavmodule or clamd ? In-Reply-To: <49D242F1.8040709@tippingmar.com> References: <49D2173B.6000706@emcuk.com> <49D21AAE.9060101@USherbrooke.ca> <4A2FC27B85A74C0C900C52C3E4752E48@SAHOMELT> <49D221E7.703@emcuk.com> <49D242F1.8040709@tippingmar.com> Message-ID: <49D32621.7050304@emcuk.com> Hi all, I'm now getting the following error; Virus scanner "clamd" not found in virus.scanners.conf file. I thought the clamav setting was what was used? Regards Eddie Hallahan Enterprise Management Consulting www.emcuk.com Enterprise Management Consulting is a company registered in England and Wales with company number 3134544. VAT registration number is 681038440. Mark Nienberg wrote: > Eddie Hallahan wrote: >> Hi all, >> >> I reckon I'll give it a try with a couple of them and see what >> difference it makes - is there a howto for switching from running as >> clamavmodule to clamd anywhere? I assume it will require a bit more >> tinkering than changing the virus Scanners line. >> >> > http://wiki.mailscanner.info/doku.php?id=documentation:anti_virus:clamav:switch_to_rpm_clamd&s=clamd > > > Mark From Howard at harper-adams.ac.uk Wed Apr 1 09:46:02 2009 From: Howard at harper-adams.ac.uk (Howard Robinson) Date: Wed Apr 1 09:46:28 2009 Subject: Problem installing new version of Sophos Message-ID: <49D337DA.20E8.005B.0@harper-adams.ac.uk> Hello I am trying to install the latest Sophos. I am using the same method I have used for a few years and not had problems until this time. (I know MailScanner needs updating as it's a year or so old - it's on a long list of jobs to do!) I have downloaded the linux.intel.libc6.tar.Z file to /tmp and run /usr/sbin/Sophos.install I get the following out put. [root@server tmp]# /usr/sbin/Sophos.install If you are trying to install Sophos version 5, then please expand the tar file with a command like tar xzf sav-linux-5-i386.tgz cd sophos-av Then run me again! Press return to continue, or Ctrl-C to escape. Clearing out old default Sophos installation libraries Uncompressing Sophos distribution Clearing out unpacked distribution Unpacking distribution Installing Sophos for MailScanner Sophos Anti-Virus installation utility [Linux/Intel] Copyright (c) 1998-2008 Sophos Plc, Oxford, England. All rights reserved. Error: This is the wrong version of Sophos Anti-Virus for your version of Linux. Use the Linux on Intel (using libc6) (glibc2.2 and above) version Creating links so Perl-SAVI module compiles Fetching latest IDE virus identities from www.sophos.com Could not calculate Sophos version number, at /usr/lib/MailScanner/sophos-autoupdate line 152. Done. [root@server tmp]# / It is the right version according to the note I have done on previous updates - I tried the glibc version to check and that failed with the same error! Any Pointers on this? I'll have a trawl on the web now but thought someone might be able to point me directly to the correction of problem. Thanks. -- Regards Howard Robinson, (Senior Technical Development Officer), Harper Adams University College, Edgmond, Newport, Shropshire , TF10 8NB. Tel. Direct 01952 815253 Tel. Switch Board 01952 820280 Fax 01952 814783 Email hrobinson@harper-adams.ac.uk Web www.harper-adams.ac.uk From prandal at herefordshire.gov.uk Wed Apr 1 10:04:42 2009 From: prandal at herefordshire.gov.uk (Randal, Phil) Date: Wed Apr 1 10:05:13 2009 Subject: Clamav 0.95 In-Reply-To: <7EF0EE5CB3B263488C8C18823239BEBA065591DE@HC-MBX02.herefordshire.gov.uk> References: <20090329130736.GA7986@doctor.nl2k.ab.ca> <49CF8062.3060006@ecs.soton.ac.uk> <49D22C9E.7000902@emcuk.com><49D249F1.7080502@ecs.soton.ac.uk> <7EF0EE5CB3B263488C8C18823239BEBA065591DE@HC-MBX02.herefordshire.gov.uk> Message-ID: <7EF0EE5CB3B263488C8C18823239BEBA065592A6@HC-MBX02.herefordshire.gov.uk> Over on the clamav-users mailing list, Edwin T?r?k says: "Make sure there is a symlink /usr/lib64/libclamunrar_iface.so -> /usr/lib64/libclamunrar_iface.so.6, run ldconfig again if necessary." It'll be a while before I can test this. Cheers, Phil -- Phil Randal | Networks Engineer Herefordshire Council | Deputy Chief Executive's Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, Hereford, HR2 6JT Tel: 01432 260160 email: prandal@herefordshire.gov.uk Any opinion expressed in this e-mail or any attached files are those of the individual and not necessarily those of Herefordshire Council. This e-mail and any attached files are confidential and intended solely for the use of the addressee. This communication may contain material protected by law from being passed on. If you are not the intended recipient and have received this e-mail in error, you are advised that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender immediately and destroy all copies of it. -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Randal, Phil Sent: 31 March 2009 18:13 To: MailScanner discussion Subject: RE: Clamav 0.95 It looks like Dag's 0.95 packages aren't quite ready for real world use: When I tried it on Centos 5.2 x64, I got: "Starting Clam AntiVirus Daemon: LibClamAV Warning: Cannot dlopen: file not found - unrar support unavailable" Which seems to be https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1476 Cheers, Phil -- Phil Randal | Networks Engineer Herefordshire Council | Deputy Chief Executive's Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, Hereford, HR2 6JT Tel: 01432 260160 email: prandal@herefordshire.gov.uk Any opinion expressed in this e-mail or any attached files are those of the individual and not necessarily those of Herefordshire Council. This e-mail and any attached files are confidential and intended solely for the use of the addressee. This communication may contain material protected by law from being passed on. If you are not the intended recipient and have received this e-mail in error, you are advised that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender immediately and destroy all copies of it. -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Julian Field Sent: 31 March 2009 17:51 To: MailScanner discussion Subject: Re: Clamav 0.95 I have changed the install.sh script to refer you to this repo instead of dag.wieers.com. It's the same one I've been using recently too, and seems to have inherited Dag's work. On 31/3/09 15:45, Eddie Hallahan wrote: > Heyho > > I use this repository > > http://packages.sw.be/clamav/ > > Eddie Hallahan > Enterprise Management Consulting > www.emcuk.com > > Enterprise Management Consulting is a company registered in England and Wales with company number 3134544. VAT registration number is 681038440. > > > > Mike M wrote: > >> Jeff A. Earickson wrote: >> >>> I have been running clamd 0.95 with 4.75.9-2 since the new clam came >>> out, with no problems. >>> >>> Jeff Earickson >>> Colby College >>> >>> >> What is the best way to update clamd?? When you try to install the >> ClamAV+Spamassassin package, it says: >> >> If you want to use MailScanners support for Clamd (virus-scanning >> daemon) then I recommend you cancel this script now (press Ctrl-C) >> and install the RPMs for clamav, clamav-db and clamd from >> http://dag.wieers.com/rpm/packages/clamav >> >> The version of clamd that's there hasn't been updated since .92. >> Where is the best place to get the latest clamd rpm and Should the >> ClamAV+Spamassassin package be updated to say so? If rpm is not an >> option, is there anything special that needs to be done if compiling >> a newer version AFTER an rpm version has already been installed? >> >> Mike >> >> >> Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From glenn.steen at gmail.com Wed Apr 1 11:03:37 2009 From: glenn.steen at gmail.com (Glenn Steen) Date: Wed Apr 1 11:03:47 2009 Subject: clamavmodule or clamd ? In-Reply-To: <49D32621.7050304@emcuk.com> References: <49D2173B.6000706@emcuk.com> <49D21AAE.9060101@USherbrooke.ca> <4A2FC27B85A74C0C900C52C3E4752E48@SAHOMELT> <49D221E7.703@emcuk.com> <49D242F1.8040709@tippingmar.com> <49D32621.7050304@emcuk.com> Message-ID: <223f97700904010303n6ad05a51sae886569126a7bd1@mail.gmail.com> 2009/4/1 Eddie Hallahan : > Hi all, > > I'm now getting the following error; > > ?Virus scanner "clamd" not found in virus.scanners.conf file. > > I thought the clamav setting was what was used? > > Regards > What version of MailScanner? This was added a while back, but if you use the rather mouldy version Debian totes, or hasn't upgraded in a long while... the support just won't be there. > Eddie Hallahan > Enterprise Management Consulting > www.emcuk.com > > Enterprise Management Consulting is a company registered in England and Wales with company number 3134544. VAT registration number is 681038440. > > > > Mark Nienberg wrote: >> Eddie Hallahan wrote: >>> Hi all, >>> >>> I reckon I'll give it a try with a couple of them and see what >>> difference it makes - is there a howto for switching from running as >>> clamavmodule to clamd anywhere? ?I assume it will require a bit more >>> tinkering than changing the virus Scanners line. >>> >>> >> http://wiki.mailscanner.info/doku.php?id=documentation:anti_virus:clamav:switch_to_rpm_clamd&s=clamd >> >> >> Mark > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From Howard at harper-adams.ac.uk Wed Apr 1 12:54:21 2009 From: Howard at harper-adams.ac.uk (Howard Robinson) Date: Wed Apr 1 13:31:03 2009 Subject: Problem installing new version of Sophos In-Reply-To: <49D337DA.20E8.005B.0@harper-adams.ac.uk> References: <49D337DA.20E8.005B.0@harper-adams.ac.uk> Message-ID: <49D363FC.20E8.005B.0@harper-adams.ac.uk> Dear all, I have had a look at the archives and can see only one problem with Sophos install in the last 7 or 8 months. That recommended using Sophos 6 and running /usr/sbin/Sophos.install I tried this and got the following errors. " [root@mailscannerserver tmp]tar xzf sav-linux-6-i386.tgz [root@mailscannerserver tmp]# cd sophos-av/ [root@mailscannerserver sophos-av]# /usr/sbin/Sophos.install If you are trying to install Sophos version 5, then please expand the tar file with a command like tar xzf sav-linux-5-i386.tgz cd sophos-av Then run me again! Press return to continue, or Ctrl-C to escape. Clearing out old default Sophos installation libraries Installing Sophos for MailScanner Invalid command-line option: -v Invalid command-line option: -d Invalid command-line option: -s Invalid command-line option: -ni install.sh: Install Sophos Anti-Virus Usage: ./install.sh [INSTALL-DIRECTORY] [OPTION] ... OPTION: --help Display this help information --automatic Perform an automatic installation, using default or command-line options --acceptlicence Automatically accept the licence --autostart[=False] Start the Sophos Anti-Virus daemons after the installation [Do not start them] --enableOnBoot[=False] Start the Sophos Anti-Virus daemons on system boot [Do not start them] --ignore-existing-installation Ignore any existing installation --SavWebUsername=USERNAME Username for accessing Sophos Anti-Virus GUI --SavWebPassword=PASSWORD Password for accessing Sophos Anti-Virus GUI --update-source-type=TYPE Set the type of updates: TYPE=s Direct from Sophos TYPE=o From your own server TYPE=n Disable auto-updating --update-source-path=ADDRESS Enable auto-updating from specified address --update-source-username=USERNAME Username for accessing update source --update-source-password=PASSWORD Password for accessing update source --update-vendors=VENDORS-LIST Comma-separated list of additional distributions (redhat, suse, turbo) that auto-update must support --update-cache-path=DIRECTORY Directory for local update cache --update-period=HOURS Update interval in hours --update-group=NAME Name for this configuration --update-proxy-address=URL Address for HTTP proxy Creating links so Perl-SAVI module compiles Fetching latest IDE virus identities from www.sophos.com Could not calculate Sophos version number, at /usr/lib/MailScanner/sophos-autoupdate line 152. Done. " Any help appreciated on this. Thanks Howard >>> On 01/04/2009 at 09:46, "Howard Robinson" wrote: | Hello | I am trying to install the latest Sophos. | I am using the same method I have used for a few years and not had problems | until this time. | (I know MailScanner needs updating as it's a year or so old - it's on a long | list of jobs to do!) | | I have downloaded the linux.intel.libc6.tar.Z file to /tmp and run | /usr/sbin/Sophos.install | I get the following out put. | | [root@server tmp]# /usr/sbin/Sophos.install | | If you are trying to install Sophos version 5, | then please expand the tar file with a command like | tar xzf sav-linux-5-i386.tgz | cd sophos-av | Then run me again! | | Press return to continue, or Ctrl-C to escape. | | Clearing out old default Sophos installation libraries | Uncompressing Sophos distribution | Clearing out unpacked distribution | Unpacking distribution | Installing Sophos for MailScanner | Sophos Anti-Virus installation utility [Linux/Intel] | Copyright (c) 1998-2008 Sophos Plc, Oxford, England. All rights reserved. | | Error: This is the wrong version of Sophos Anti-Virus for your version of | Linux. Use the Linux on Intel (using libc6) (glibc2.2 and above) | version | Creating links so Perl-SAVI module compiles | | Fetching latest IDE virus identities from www.sophos.com | Could not calculate Sophos version number, at | /usr/lib/MailScanner/sophos-autoupdate line 152. | Done. | [root@server tmp]# / | It is the right version according to the note I have done on previous | updates - I tried the glibc version to check and that failed with the same | error! | | Any Pointers on this? | I'll have a trawl on the web now but thought someone might be able to point | me directly to the correction of problem. | Thanks. | -- Regards Howard Robinson, (Senior Technical Development Officer), Harper Adams University College, Edgmond, Newport, Shropshire , TF10 8NB. Tel. Direct 01952 815253 Tel. Switch Board 01952 820280 Fax 01952 814783 Email hrobinson@harper-adams.ac.uk Web www.harper-adams.ac.uk From Denis.Beauchemin at USherbrooke.ca Wed Apr 1 14:51:02 2009 From: Denis.Beauchemin at USherbrooke.ca (Denis Beauchemin) Date: Wed Apr 1 14:51:14 2009 Subject: Clamav 0.95 In-Reply-To: <7EF0EE5CB3B263488C8C18823239BEBA065592A6@HC-MBX02.herefordshire.gov.uk> References: <20090329130736.GA7986@doctor.nl2k.ab.ca> <49CF8062.3060006@ecs.soton.ac.uk> <49D22C9E.7000902@emcuk.com><49D249F1.7080502@ecs.soton.ac.uk> <7EF0EE5CB3B263488C8C18823239BEBA065591DE@HC-MBX02.herefordshire.gov.uk> <7EF0EE5CB3B263488C8C18823239BEBA065592A6@HC-MBX02.herefordshire.gov.uk> Message-ID: <49D37146.3050309@USherbrooke.ca> Randal, Phil a ?crit : > Over on the clamav-users mailing list, Edwin T?r?k says: > > "Make sure there is a symlink /usr/lib64/libclamunrar_iface.so -> /usr/lib64/libclamunrar_iface.so.6, run ldconfig again if necessary." > > It'll be a while before I can test this. > > Cheers, > > Phil > > Phil, I tested it on a 32 bit system and it worked. Before the symlink I got: service clamd restart Stopping Clam AntiVirus Daemon: [FAILED] Starting Clam AntiVirus Daemon: LibClamAV Warning: Cannot dlopen: file not found - unrar support unavailable [ OK ] I then did: cd /usr/lib ln -s libclamunrar_iface.so.6 libclamunrar_iface.so service clamd restart Stopping Clam AntiVirus Daemon: [ OK ] Starting Clam AntiVirus Daemon: [ OK ] Thanks! Denis -- _ ?v? Denis Beauchemin, analyste /(_)\ Universit? de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x62252 F: 819.821.8045 From rcooper at dwford.com Wed Apr 1 15:45:23 2009 From: rcooper at dwford.com (Rick Cooper) Date: Wed Apr 1 15:45:37 2009 Subject: Clamav 0.95 In-Reply-To: <49D37146.3050309@USherbrooke.ca> References: <20090329130736.GA7986@doctor.nl2k.ab.ca> <49CF8062.3060006@ecs.soton.ac.uk> <49D22C9E.7000902@emcuk.com><49D249F1.7080502@ecs.soton.ac.uk> <7EF0EE5CB3B263488C8C18823239BEBA065591DE@HC-MBX02.herefordshire.gov.uk><7EF0EE5CB3B263488C8C18823239BEBA065592A6@HC-MBX02.herefordshire.gov.uk> <49D37146.3050309@USherbrooke.ca> Message-ID: <2373DAFDD6E94A9EB27846CAEB9BC830@SAHOMELT> > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf > Of Denis Beauchemin > Sent: Wednesday, April 01, 2009 9:51 AM > To: MailScanner discussion > Subject: Re: Clamav 0.95 > > Randal, Phil a ?crit : > > Over on the clamav-users mailing list, Edwin T?r?k says: > > > > "Make sure there is a symlink > /usr/lib64/libclamunrar_iface.so -> > /usr/lib64/libclamunrar_iface.so.6, run ldconfig again if necessary." > > > > It'll be a while before I can test this. > > > > Cheers, > > > > Phil > > > > > > Phil, > > I tested it on a 32 bit system and it worked. Before the > symlink I got: > service clamd restart > Stopping Clam AntiVirus Daemon: [FAILED] > Starting Clam AntiVirus Daemon: LibClamAV Warning: Cannot > dlopen: file > not found - unrar support unavailable > [ OK ] > > I then did: > cd /usr/lib > ln -s libclamunrar_iface.so.6 libclamunrar_iface.so > service clamd restart > Stopping Clam AntiVirus Daemon: [ OK ] > Starting Clam AntiVirus Daemon: [ OK ] > > Thanks! > > Denis > For some reason (don't remember why) for several versions now, the build scripts for clamav don't run ldconfig properly after install. I have added a call to ldconfig after install and before restarting to address this on my systems (in my own build script). I believe the original post (on the clamav list) concerning the check for the symlink was to check for the link and if it was missing run ldconfig manually and check again to ensure ldconfig created the proper link. You should *not* have to create that link by hand. Rick -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From Denis.Beauchemin at USherbrooke.ca Wed Apr 1 16:04:09 2009 From: Denis.Beauchemin at USherbrooke.ca (Denis Beauchemin) Date: Wed Apr 1 16:04:24 2009 Subject: Clamav 0.95 In-Reply-To: <2373DAFDD6E94A9EB27846CAEB9BC830@SAHOMELT> References: <20090329130736.GA7986@doctor.nl2k.ab.ca> <49CF8062.3060006@ecs.soton.ac.uk> <49D22C9E.7000902@emcuk.com><49D249F1.7080502@ecs.soton.ac.uk> <7EF0EE5CB3B263488C8C18823239BEBA065591DE@HC-MBX02.herefordshire.gov.uk><7EF0EE5CB3B263488C8C18823239BEBA065592A6@HC-MBX02.herefordshire.gov.uk> <49D37146.3050309@USherbrooke.ca> <2373DAFDD6E94A9EB27846CAEB9BC830@SAHOMELT> Message-ID: <49D38269.6040901@USherbrooke.ca> Rick Cooper a ?crit : > > > >> -----Original Message----- >> From: mailscanner-bounces@lists.mailscanner.info >> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf >> Of Denis Beauchemin >> Sent: Wednesday, April 01, 2009 9:51 AM >> To: MailScanner discussion >> Subject: Re: Clamav 0.95 >> >> Randal, Phil a ?crit : >> >>> Over on the clamav-users mailing list, Edwin T?r?k says: >>> >>> "Make sure there is a symlink >>> >> /usr/lib64/libclamunrar_iface.so -> >> /usr/lib64/libclamunrar_iface.so.6, run ldconfig again if necessary." >> >>> It'll be a while before I can test this. >>> >>> Cheers, >>> >>> Phil >>> >>> >>> >> Phil, >> >> I tested it on a 32 bit system and it worked. Before the >> symlink I got: >> service clamd restart >> Stopping Clam AntiVirus Daemon: [FAILED] >> Starting Clam AntiVirus Daemon: LibClamAV Warning: Cannot >> dlopen: file >> not found - unrar support unavailable >> [ OK ] >> >> I then did: >> cd /usr/lib >> ln -s libclamunrar_iface.so.6 libclamunrar_iface.so >> service clamd restart >> Stopping Clam AntiVirus Daemon: [ OK ] >> Starting Clam AntiVirus Daemon: [ OK ] >> >> Thanks! >> >> Denis >> >> > > For some reason (don't remember why) for several versions now, the build > scripts for clamav don't run ldconfig properly after install. I have added a > call to ldconfig after install and before restarting to address this on my > systems (in my own build script). I believe the original post (on the clamav > list) concerning the check for the symlink was to check for the link and if > it was missing run ldconfig manually and check again to ensure ldconfig > created the proper link. You should *not* have to create that link by hand. > > Rick > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > > Rick, Just tried it on my last MS server and it didn't work (RHEL 5.3): # ldconfig # service clamd restart Stopping Clam AntiVirus Daemon: [ OK ] Starting Clam AntiVirus Daemon: LibClamAV Warning: Cannot dlopen: file not found - unrar support unavailable [ OK ] # ln -s /usr/lib/libclamunrar_iface.so.6 /usr/lib/libclamunrar_iface.so # service clamd restart Stopping Clam AntiVirus Daemon: [ OK ] Starting Clam AntiVirus Daemon: [ OK ] Denis -- _ ?v? Denis Beauchemin, analyste /(_)\ Universit? de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x62252 F: 819.821.8045 From ssilva at sgvwater.com Wed Apr 1 16:10:55 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Wed Apr 1 16:11:24 2009 Subject: Different rules for files within archives In-Reply-To: References: <223f97700903311234l2a62753dnacc286fc82deab27@mail.gmail.com> Message-ID: on 3-31-2009 2:37 PM Mark Sapiro spake the following: > Glenn Steen wrote: > >> 2009/3/31 Mark Sapiro : >>> The problem appears to my naive eye to be that between 4.75.9-2 (the >>> version I upgraded from) and 4.76.1-1 an "unpackmicrosoftdocuments" >>> entry disappeared from /usr/lib/MailScanner/MailScanner/ConfigDefs.pl >>> >> And does adding it back in cure the problem? > > > OK. I'm busted :( > > I would have tried adding it back had I known exactly what to add > where, but I've had such good experiences upgrading MailScanner that > I've gotten lazy and didn't back up the previous installed version > before proceeding. I had the previous rpm, but I don't know how to > extract files from an rpm without actually installing it. > > I suppose I could have downloaded the previous non-rpm tarball package, > but Jules posted > > before I thought much further about it. > If you are using rpm, you should have all you need to fix the config files. Just run upgrade_MailScanner_conf and upgrade_languages_conf. Run with no options they will give you instructions on how to fix these. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090401/2b8bcb43/signature.bin From MailScanner at ecs.soton.ac.uk Wed Apr 1 16:23:17 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Wed Apr 1 16:23:41 2009 Subject: Problem installing new version of Sophos In-Reply-To: <49D363FC.20E8.005B.0@harper-adams.ac.uk> References: <49D337DA.20E8.005B.0@harper-adams.ac.uk> <49D363FC.20E8.005B.0@harper-adams.ac.uk> <49D386E5.4080309@ecs.soton.ac.uk> Message-ID: On 1/4/09 12:54, Howard Robinson wrote: > Dear all, > I have had a look at the archives and can see only one problem with Sophos install in the last 7 or 8 months. > That recommended using Sophos 6 and running /usr/sbin/Sophos.install > > I tried this and got the following errors. > " > [root@mailscannerserver tmp]tar xzf sav-linux-6-i386.tgz > [root@mailscannerserver tmp]# cd sophos-av/ > [root@mailscannerserver sophos-av]# /usr/sbin/Sophos.install > > If you are trying to install Sophos version 5, > You have a very old version of Sophos.install. Newer versions (for quite a while now) say "version 5 or 6" and not "version 5". If you use a version that mentions version 6, you will find it works just fine. > then please expand the tar file with a command like > tar xzf sav-linux-5-i386.tgz > cd sophos-av > Then run me again! > > Press return to continue, or Ctrl-C to escape. > > Clearing out old default Sophos installation libraries > Installing Sophos for MailScanner > Invalid command-line option: -v > Invalid command-line option: -d > Invalid command-line option: -s > Invalid command-line option: -ni > install.sh: Install Sophos Anti-Virus > Usage: ./install.sh [INSTALL-DIRECTORY] [OPTION] ... > OPTION: > --help Display this help information > --automatic Perform an automatic installation, using > default or command-line options > --acceptlicence Automatically accept the licence > --autostart[=False] Start the Sophos Anti-Virus daemons > after the installation [Do not start > them] > --enableOnBoot[=False] Start the Sophos Anti-Virus daemons > on system boot [Do not start them] > --ignore-existing-installation Ignore any existing installation > --SavWebUsername=USERNAME Username for accessing Sophos Anti-Virus GUI > --SavWebPassword=PASSWORD Password for accessing Sophos Anti-Virus GUI > --update-source-type=TYPE Set the type of updates: > TYPE=s Direct from Sophos > TYPE=o From your own server > TYPE=n Disable auto-updating > --update-source-path=ADDRESS Enable auto-updating from specified > address > --update-source-username=USERNAME Username for accessing update source > --update-source-password=PASSWORD Password for accessing update source > --update-vendors=VENDORS-LIST Comma-separated list of additional > distributions (redhat, suse, turbo) > that auto-update must support > --update-cache-path=DIRECTORY Directory for local update cache > --update-period=HOURS Update interval in hours > --update-group=NAME Name for this configuration > --update-proxy-address=URL Address for HTTP proxy > Creating links so Perl-SAVI module compiles > > Fetching latest IDE virus identities from www.sophos.com > Could not calculate Sophos version number, at /usr/lib/MailScanner/sophos-autoupdate line 152. > Done. > " > > Any help appreciated on this. > Thanks > Howard > >>>> On 01/04/2009 at 09:46, "Howard Robinson" wrote: >>>> > | Hello > | I am trying to install the latest Sophos. > | I am using the same method I have used for a few years and not had problems > | until this time. > | (I know MailScanner needs updating as it's a year or so old - it's on a long > | list of jobs to do!) > | > | I have downloaded the linux.intel.libc6.tar.Z file to /tmp and run > | /usr/sbin/Sophos.install > | I get the following out put. > | > | [root@server tmp]# /usr/sbin/Sophos.install > | > | If you are trying to install Sophos version 5, > | then please expand the tar file with a command like > | tar xzf sav-linux-5-i386.tgz > | cd sophos-av > | Then run me again! > | > | Press return to continue, or Ctrl-C to escape. > | > | Clearing out old default Sophos installation libraries > | Uncompressing Sophos distribution > | Clearing out unpacked distribution > | Unpacking distribution > | Installing Sophos for MailScanner > | Sophos Anti-Virus installation utility [Linux/Intel] > | Copyright (c) 1998-2008 Sophos Plc, Oxford, England. All rights reserved. > | > | Error: This is the wrong version of Sophos Anti-Virus for your version of > | Linux. Use the Linux on Intel (using libc6) (glibc2.2 and above) > | version > | Creating links so Perl-SAVI module compiles > | > | Fetching latest IDE virus identities from www.sophos.com > | Could not calculate Sophos version number, at > | /usr/lib/MailScanner/sophos-autoupdate line 152. > | Done. > | [root@server tmp]# / > | It is the right version according to the note I have done on previous > | updates - I tried the glibc version to check and that failed with the same > | error! > | > | Any Pointers on this? > | I'll have a trawl on the web now but thought someone might be able to point > | me directly to the correction of problem. > | Thanks. > | > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From rcooper at dwford.com Wed Apr 1 16:29:05 2009 From: rcooper at dwford.com (Rick Cooper) Date: Wed Apr 1 16:29:21 2009 Subject: Clamav 0.95 In-Reply-To: <49D38269.6040901@USherbrooke.ca> References: <20090329130736.GA7986@doctor.nl2k.ab.ca> <49CF8062.3060006@ecs.soton.ac.uk> <49D22C9E.7000902@emcuk.com><49D249F1.7080502@ecs.soton.ac.uk> <7EF0EE5CB3B263488C8C18823239BEBA065591DE@HC-MBX02.herefordshire.gov.uk><7EF0EE5CB3B263488C8C18823239BEBA065592A6@HC-MBX02.herefordshire.gov.uk> <49D37146.3050309@USherbrooke.ca><2373DAFDD6E94A9EB27846CAEB9BC830@SAHOMELT> <49D38269.6040901@USherbrooke.ca> Message-ID: > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf > Of Denis Beauchemin > Sent: Wednesday, April 01, 2009 11:04 AM > To: MailScanner discussion > Subject: Re: Clamav 0.95 > > Rick Cooper a ?crit : > > > > > > > >> -----Original Message----- > >> From: mailscanner-bounces@lists.mailscanner.info > >> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf > >> Of Denis Beauchemin > >> Sent: Wednesday, April 01, 2009 9:51 AM > >> To: MailScanner discussion > >> Subject: Re: Clamav 0.95 > >> > >> Randal, Phil a ?crit : > >> > >>> Over on the clamav-users mailing list, Edwin T?r?k says: > >>> > >>> "Make sure there is a symlink > >>> > >> /usr/lib64/libclamunrar_iface.so -> > >> /usr/lib64/libclamunrar_iface.so.6, run ldconfig again if > necessary." > >> > >>> It'll be a while before I can test this. > >>> > >>> Cheers, > >>> > >>> Phil > >>> > >>> > >>> > >> Phil, > >> > >> I tested it on a 32 bit system and it worked. Before the > >> symlink I got: > >> service clamd restart > >> Stopping Clam AntiVirus Daemon: [FAILED] > >> Starting Clam AntiVirus Daemon: LibClamAV Warning: Cannot > >> dlopen: file > >> not found - unrar support unavailable > >> [ OK ] > >> > >> I then did: > >> cd /usr/lib > >> ln -s libclamunrar_iface.so.6 libclamunrar_iface.so > >> service clamd restart > >> Stopping Clam AntiVirus Daemon: [ OK ] > >> Starting Clam AntiVirus Daemon: [ OK ] > >> > >> Thanks! > >> > >> Denis > >> > >> > > > > For some reason (don't remember why) for several versions > now, the build > > scripts for clamav don't run ldconfig properly after > install. I have added a > > call to ldconfig after install and before restarting to > address this on my > > systems (in my own build script). I believe the original > post (on the clamav > > list) concerning the check for the symlink was to check for > the link and if > > it was missing run ldconfig manually and check again to > ensure ldconfig > > created the proper link. You should *not* have to create > that link by hand. > > > > Rick > > > > > > -- > > This message has been scanned for viruses and > > dangerous content by MailScanner, and is > > believed to be clean. > > > > > > > Rick, > > Just tried it on my last MS server and it didn't work (RHEL 5.3): > # ldconfig > # service clamd restart > Stopping Clam AntiVirus Daemon: [ OK ] > Starting Clam AntiVirus Daemon: LibClamAV Warning: Cannot > dlopen: file > not found - unrar support unavailable > [ OK ] > # ln -s /usr/lib/libclamunrar_iface.so.6 > /usr/lib/libclamunrar_iface.so > # service clamd restart > Stopping Clam AntiVirus Daemon: [ OK ] > Starting Clam AntiVirus Daemon: [ OK ] > > Denis > IIRC one of the people having the issue with the 0.94x to 0.95 upgrade and not having the link built correctly by ldconfig eventually found they had two copies of the lib one in /usr/lib and one in either /usr/local/lib or /lib and ldconfig built the link in the wrong place. Any way you look at it there is a problem as ldconfig should build the link against the most recent lib version. And I think (99.9% sure) the default location for the lib is /usr/local/lib. If you do an ls -lh /usr/local/lib/libclamunrar* /usr/lib/libclamunrar do you find only one copy/version in one place? Rick -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From ssilva at sgvwater.com Wed Apr 1 16:37:43 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Wed Apr 1 16:38:02 2009 Subject: Clamav 0.95 In-Reply-To: References: <20090329130736.GA7986@doctor.nl2k.ab.ca> <49CF8062.3060006@ecs.soton.ac.uk> <49D22C9E.7000902@emcuk.com><49D249F1.7080502@ecs.soton.ac.uk> <7EF0EE5CB3B263488C8C18823239BEBA065591DE@HC-MBX02.herefordshire.gov.uk><7EF0EE5CB3B263488C8C18823239BEBA065592A6@HC-MBX02.herefordshire.gov.uk> <49D37146.3050309@USherbrooke.ca><2373DAFDD6E94A9EB27846CAEB9BC830@SAHOMELT> <49D38269.6040901@USherbrooke.ca> Message-ID: on 4-1-2009 8:29 AM Rick Cooper spake the following: > > >> -----Original Message----- >> From: mailscanner-bounces@lists.mailscanner.info >> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf >> Of Denis Beauchemin >> Sent: Wednesday, April 01, 2009 11:04 AM >> To: MailScanner discussion >> Subject: Re: Clamav 0.95 >> >> Rick Cooper a ?crit : >>> >>> >>> >>>> -----Original Message----- >>>> From: mailscanner-bounces@lists.mailscanner.info >>>> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf >>>> Of Denis Beauchemin >>>> Sent: Wednesday, April 01, 2009 9:51 AM >>>> To: MailScanner discussion >>>> Subject: Re: Clamav 0.95 >>>> >>>> Randal, Phil a ?crit : >>>> >>>>> Over on the clamav-users mailing list, Edwin T?r?k says: >>>>> >>>>> "Make sure there is a symlink >>>>> >>>> /usr/lib64/libclamunrar_iface.so -> >>>> /usr/lib64/libclamunrar_iface.so.6, run ldconfig again if >> necessary." >>>> >>>>> It'll be a while before I can test this. >>>>> >>>>> Cheers, >>>>> >>>>> Phil >>>>> >>>>> >>>>> >>>> Phil, >>>> >>>> I tested it on a 32 bit system and it worked. Before the >>>> symlink I got: >>>> service clamd restart >>>> Stopping Clam AntiVirus Daemon: [FAILED] >>>> Starting Clam AntiVirus Daemon: LibClamAV Warning: Cannot >>>> dlopen: file >>>> not found - unrar support unavailable >>>> [ OK ] >>>> >>>> I then did: >>>> cd /usr/lib >>>> ln -s libclamunrar_iface.so.6 libclamunrar_iface.so >>>> service clamd restart >>>> Stopping Clam AntiVirus Daemon: [ OK ] >>>> Starting Clam AntiVirus Daemon: [ OK ] >>>> >>>> Thanks! >>>> >>>> Denis >>>> >>>> >>> For some reason (don't remember why) for several versions >> now, the build >>> scripts for clamav don't run ldconfig properly after >> install. I have added a >>> call to ldconfig after install and before restarting to >> address this on my >>> systems (in my own build script). I believe the original >> post (on the clamav >>> list) concerning the check for the symlink was to check for >> the link and if >>> it was missing run ldconfig manually and check again to >> ensure ldconfig >>> created the proper link. You should *not* have to create >> that link by hand. >>> Rick >>> >>> >>> -- >>> This message has been scanned for viruses and >>> dangerous content by MailScanner, and is >>> believed to be clean. >>> >>> >>> >> Rick, >> >> Just tried it on my last MS server and it didn't work (RHEL 5.3): >> # ldconfig >> # service clamd restart >> Stopping Clam AntiVirus Daemon: [ OK ] >> Starting Clam AntiVirus Daemon: LibClamAV Warning: Cannot >> dlopen: file >> not found - unrar support unavailable >> [ OK ] >> # ln -s /usr/lib/libclamunrar_iface.so.6 >> /usr/lib/libclamunrar_iface.so >> # service clamd restart >> Stopping Clam AntiVirus Daemon: [ OK ] >> Starting Clam AntiVirus Daemon: [ OK ] >> >> Denis >> > > IIRC one of the people having the issue with the 0.94x to 0.95 upgrade and > not having the link built correctly by ldconfig eventually found they had > two copies of the lib one in /usr/lib and one in either /usr/local/lib or > /lib and ldconfig built the link in the wrong place. Any way you look at it > there is a problem as ldconfig should build the link against the most recent > lib version. And I think (99.9% sure) the default location for the lib is > /usr/local/lib. If you do an ls -lh /usr/local/lib/libclamunrar* > /usr/lib/libclamunrar do you find only one copy/version in one place? > Source installs default to /usr/local/lib, but most rpm distros use /usr/lib. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090401/1d666426/signature.bin From Denis.Beauchemin at USherbrooke.ca Wed Apr 1 16:46:05 2009 From: Denis.Beauchemin at USherbrooke.ca (Denis Beauchemin) Date: Wed Apr 1 16:46:17 2009 Subject: Clamav 0.95 In-Reply-To: References: <20090329130736.GA7986@doctor.nl2k.ab.ca> <49CF8062.3060006@ecs.soton.ac.uk> <49D22C9E.7000902@emcuk.com><49D249F1.7080502@ecs.soton.ac.uk> <7EF0EE5CB3B263488C8C18823239BEBA065591DE@HC-MBX02.herefordshire.gov.uk><7EF0EE5CB3B263488C8C18823239BEBA065592A6@HC-MBX02.herefordshire.gov.uk> <49D37146.3050309@USherbrooke.ca><2373DAFDD6E94A9EB27846CAEB9BC830@SAHOMELT> <49D38269.6040901@USherbrooke.ca> Message-ID: <49D38C3D.2060701@USherbrooke.ca> Rick Cooper a ?crit : > > > >> -----Original Message----- >> From: mailscanner-bounces@lists.mailscanner.info >> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf >> Of Denis Beauchemin >> Sent: Wednesday, April 01, 2009 11:04 AM >> To: MailScanner discussion >> Subject: Re: Clamav 0.95 >> >> Rick Cooper a ?crit : >> >>> >>> >>> >>> >>>> -----Original Message----- >>>> From: mailscanner-bounces@lists.mailscanner.info >>>> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf >>>> Of Denis Beauchemin >>>> Sent: Wednesday, April 01, 2009 9:51 AM >>>> To: MailScanner discussion >>>> Subject: Re: Clamav 0.95 >>>> >>>> Randal, Phil a ?crit : >>>> >>>> >>>>> Over on the clamav-users mailing list, Edwin T?r?k says: >>>>> >>>>> "Make sure there is a symlink >>>>> >>>>> >>>> /usr/lib64/libclamunrar_iface.so -> >>>> /usr/lib64/libclamunrar_iface.so.6, run ldconfig again if >>>> >> necessary." >> >>>> >>>> >>>>> It'll be a while before I can test this. >>>>> >>>>> Cheers, >>>>> >>>>> Phil >>>>> >>>>> >>>>> >>>>> >>>> Phil, >>>> >>>> I tested it on a 32 bit system and it worked. Before the >>>> symlink I got: >>>> service clamd restart >>>> Stopping Clam AntiVirus Daemon: [FAILED] >>>> Starting Clam AntiVirus Daemon: LibClamAV Warning: Cannot >>>> dlopen: file >>>> not found - unrar support unavailable >>>> [ OK ] >>>> >>>> I then did: >>>> cd /usr/lib >>>> ln -s libclamunrar_iface.so.6 libclamunrar_iface.so >>>> service clamd restart >>>> Stopping Clam AntiVirus Daemon: [ OK ] >>>> Starting Clam AntiVirus Daemon: [ OK ] >>>> >>>> Thanks! >>>> >>>> Denis >>>> >>>> >>>> >>> For some reason (don't remember why) for several versions >>> >> now, the build >> >>> scripts for clamav don't run ldconfig properly after >>> >> install. I have added a >> >>> call to ldconfig after install and before restarting to >>> >> address this on my >> >>> systems (in my own build script). I believe the original >>> >> post (on the clamav >> >>> list) concerning the check for the symlink was to check for >>> >> the link and if >> >>> it was missing run ldconfig manually and check again to >>> >> ensure ldconfig >> >>> created the proper link. You should *not* have to create >>> >> that link by hand. >> >>> Rick >>> >>> >>> -- >>> This message has been scanned for viruses and >>> dangerous content by MailScanner, and is >>> believed to be clean. >>> >>> >>> >>> >> Rick, >> >> Just tried it on my last MS server and it didn't work (RHEL 5.3): >> # ldconfig >> # service clamd restart >> Stopping Clam AntiVirus Daemon: [ OK ] >> Starting Clam AntiVirus Daemon: LibClamAV Warning: Cannot >> dlopen: file >> not found - unrar support unavailable >> [ OK ] >> # ln -s /usr/lib/libclamunrar_iface.so.6 >> /usr/lib/libclamunrar_iface.so >> # service clamd restart >> Stopping Clam AntiVirus Daemon: [ OK ] >> Starting Clam AntiVirus Daemon: [ OK ] >> >> Denis >> >> > > IIRC one of the people having the issue with the 0.94x to 0.95 upgrade and > not having the link built correctly by ldconfig eventually found they had > two copies of the lib one in /usr/lib and one in either /usr/local/lib or > /lib and ldconfig built the link in the wrong place. Any way you look at it > there is a problem as ldconfig should build the link against the most recent > lib version. And I think (99.9% sure) the default location for the lib is > /usr/local/lib. If you do an ls -lh /usr/local/lib/libclamunrar* > /usr/lib/libclamunrar do you find only one copy/version in one place? > > Rick > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > > Rick, # updatedb # locate libclamunrar /usr/lib/libclamunrar.so.6 /usr/lib/libclamunrar.so.6.0.2 /usr/lib/libclamunrar_iface.so /usr/lib/libclamunrar_iface.so.6 /usr/lib/libclamunrar_iface.so.6.0.2 Nothing outside /usr/lib... Denis -- _ ?v? Denis Beauchemin, analyste /(_)\ Universit? de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x62252 F: 819.821.8045 From P.G.M.Peters at utwente.nl Wed Apr 1 17:07:59 2009 From: P.G.M.Peters at utwente.nl (Peter Peters) Date: Wed Apr 1 17:08:30 2009 Subject: PDF scanner Message-ID: <49D3915F.6080405@utwente.nl> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, Anybody having any idea about Didier Stevens' PDF scanner? http://blog.didierstevens.com/2009/03/31/pdfid/ Could this be called from MS? - -- Peter Peters, Teamleider Unix/Linux/Storage ICT-Servicecentrum Universiteit Twente, Postbus 217, 7500 AE Enschede Telefoon 053 489 2301, Fax 053 489 2383, P.G.M.Peters@utwente.nl, http://www.utwente.nl/icts -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFJ05FfelLo80lrIdIRAgQnAJ9vuK4iLUMWAiUhiuCp/7X1sSJkJwCeMQgC gO98xEj2ucmmoekpX5VAWyw= =zg9P -----END PGP SIGNATURE----- From ssilva at sgvwater.com Wed Apr 1 17:24:47 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Wed Apr 1 17:25:18 2009 Subject: Clamav 0.95 In-Reply-To: <49D38C3D.2060701@USherbrooke.ca> References: <20090329130736.GA7986@doctor.nl2k.ab.ca> <49CF8062.3060006@ecs.soton.ac.uk> <49D22C9E.7000902@emcuk.com><49D249F1.7080502@ecs.soton.ac.uk> <7EF0EE5CB3B263488C8C18823239BEBA065591DE@HC-MBX02.herefordshire.gov.uk><7EF0EE5CB3B263488C8C18823239BEBA065592A6@HC-MBX02.herefordshire.gov.uk> <49D37146.3050309@USherbrooke.ca><2373DAFDD6E94A9EB27846CAEB9BC830@SAHOMELT> <49D38269.6040901@USherbrooke.ca> <49D38C3D.2060701@USherbrooke.ca> Message-ID: on 4-1-2009 8:46 AM Denis Beauchemin spake the following: > Rick Cooper a ?crit : >> >> >> >>> -----Original Message----- >>> From: mailscanner-bounces@lists.mailscanner.info >>> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of >>> Denis Beauchemin >>> Sent: Wednesday, April 01, 2009 11:04 AM >>> To: MailScanner discussion >>> Subject: Re: Clamav 0.95 >>> >>> Rick Cooper a ?crit : >>> >>>> >>>> >>>> >>>>> -----Original Message----- >>>>> From: mailscanner-bounces@lists.mailscanner.info >>>>> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of >>>>> Denis Beauchemin >>>>> Sent: Wednesday, April 01, 2009 9:51 AM >>>>> To: MailScanner discussion >>>>> Subject: Re: Clamav 0.95 >>>>> >>>>> Randal, Phil a ?crit : >>>>> >>>>>> Over on the clamav-users mailing list, Edwin T?r?k says: >>>>>> >>>>>> "Make sure there is a symlink >>>>> /usr/lib64/libclamunrar_iface.so -> >>>>> /usr/lib64/libclamunrar_iface.so.6, run ldconfig again if >>> necessary." >>> >>>>> >>>>>> It'll be a while before I can test this. >>>>>> >>>>>> Cheers, >>>>>> >>>>>> Phil >>>>>> >>>>> Phil, >>>>> >>>>> I tested it on a 32 bit system and it worked. Before the symlink I >>>>> got: >>>>> service clamd restart >>>>> Stopping Clam AntiVirus Daemon: [FAILED] >>>>> Starting Clam AntiVirus Daemon: LibClamAV Warning: Cannot dlopen: >>>>> file not found - unrar support unavailable >>>>> [ OK ] >>>>> >>>>> I then did: >>>>> cd /usr/lib >>>>> ln -s libclamunrar_iface.so.6 libclamunrar_iface.so >>>>> service clamd restart >>>>> Stopping Clam AntiVirus Daemon: [ OK ] >>>>> Starting Clam AntiVirus Daemon: [ OK ] >>>>> >>>>> Thanks! >>>>> >>>>> Denis >>>>> >>>>> >>>> For some reason (don't remember why) for several versions >>> now, the build >>> >>>> scripts for clamav don't run ldconfig properly after >>> install. I have added a >>> >>>> call to ldconfig after install and before restarting to >>> address this on my >>> >>>> systems (in my own build script). I believe the original >>> post (on the clamav >>> >>>> list) concerning the check for the symlink was to check for >>> the link and if >>> >>>> it was missing run ldconfig manually and check again to >>> ensure ldconfig >>> >>>> created the proper link. You should *not* have to create >>> that link by hand. >>> >>>> Rick >>>> >>>> >>>> -- >>>> This message has been scanned for viruses and >>>> dangerous content by MailScanner, and is >>>> believed to be clean. >>>> >>>> >>>> >>> Rick, >>> >>> Just tried it on my last MS server and it didn't work (RHEL 5.3): >>> # ldconfig >>> # service clamd restart >>> Stopping Clam AntiVirus Daemon: [ OK ] >>> Starting Clam AntiVirus Daemon: LibClamAV Warning: Cannot dlopen: >>> file not found - unrar support unavailable >>> [ OK ] >>> # ln -s /usr/lib/libclamunrar_iface.so.6 /usr/lib/libclamunrar_iface.so >>> # service clamd restart >>> Stopping Clam AntiVirus Daemon: [ OK ] >>> Starting Clam AntiVirus Daemon: [ OK ] >>> >>> Denis >>> >>> >> >> IIRC one of the people having the issue with the 0.94x to 0.95 upgrade >> and >> not having the link built correctly by ldconfig eventually found they >> had >> two copies of the lib one in /usr/lib and one in either /usr/local/lib or >> /lib and ldconfig built the link in the wrong place. Any way you look >> at it >> there is a problem as ldconfig should build the link against the most >> recent >> lib version. And I think (99.9% sure) the default location for the lib is >> /usr/local/lib. If you do an ls -lh /usr/local/lib/libclamunrar* >> /usr/lib/libclamunrar do you find only one copy/version in one place? >> >> Rick >> >> >> -- >> This message has been scanned for viruses and >> dangerous content by MailScanner, and is >> believed to be clean. >> >> >> > Rick, > > # updatedb > # locate libclamunrar > /usr/lib/libclamunrar.so.6 > /usr/lib/libclamunrar.so.6.0.2 > /usr/lib/libclamunrar_iface.so > /usr/lib/libclamunrar_iface.so.6 > /usr/lib/libclamunrar_iface.so.6.0.2 > > Nothing outside /usr/lib... > > Denis > Maybe the %post section of the spec needs to create a symlink. That should be the easiest, if Dag can fix it quick and re-issue a new set of rpm's. PS: And generate yum metadata. ;-P -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090401/b39d2075/signature.bin From ms-list at alexb.ch Wed Apr 1 17:30:00 2009 From: ms-list at alexb.ch (Alex Broens) Date: Wed Apr 1 17:30:08 2009 Subject: PDF scanner In-Reply-To: <49D3915F.6080405@utwente.nl> References: <49D3915F.6080405@utwente.nl> Message-ID: <49D39688.6040609@alexb.ch> On 4/1/2009 6:07 PM, Peter Peters wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi, > > Anybody having any idea about Didier Stevens' PDF scanner? > http://blog.didierstevens.com/2009/03/31/pdfid/ > > Could this be called from MS? could be.... tille then, there's also PDFInfo http://rulesemporium.com/plugins.htm the rules are obviosuly old and probably useless, but they could be easily updated if required. h2h Alex From rcooper at dwford.com Wed Apr 1 17:37:15 2009 From: rcooper at dwford.com (Rick Cooper) Date: Wed Apr 1 17:37:27 2009 Subject: Clamav 0.95 In-Reply-To: <49D38C3D.2060701@USherbrooke.ca> References: <20090329130736.GA7986@doctor.nl2k.ab.ca> <49CF8062.3060006@ecs.soton.ac.uk> <49D22C9E.7000902@emcuk.com><49D249F1.7080502@ecs.soton.ac.uk> <7EF0EE5CB3B263488C8C18823239BEBA065591DE@HC-MBX02.herefordshire.gov.uk><7EF0EE5CB3B263488C8C18823239BEBA065592A6@HC-MBX02.herefordshire.gov.uk> <49D37146.3050309@USherbrooke.ca><2373DAFDD6E94A9EB27846CAEB9BC830@SAHOMELT> <49D38269.6040901@USherbrooke.ca> <49D38C3D.2060701@USherbrooke.ca> Message-ID: <62B4555DBE634F58A6019101E26AD5F0@SAHOMELT> > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf > Of Denis Beauchemin > Sent: Wednesday, April 01, 2009 11:46 AM > To: MailScanner discussion > Subject: Re: Clamav 0.95 > > Rick Cooper a ?crit : > > > > > > > >> -----Original Message----- > >> From: mailscanner-bounces@lists.mailscanner.info > >> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf > >> Of Denis Beauchemin > >> Sent: Wednesday, April 01, 2009 11:04 AM > >> To: MailScanner discussion > >> Subject: Re: Clamav 0.95 > >> > >> Rick Cooper a ?crit : > >> > >>> > >>> > >>> > >>> > >>>> -----Original Message----- > >>>> From: mailscanner-bounces@lists.mailscanner.info > >>>> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf > >>>> Of Denis Beauchemin > >>>> Sent: Wednesday, April 01, 2009 9:51 AM > >>>> To: MailScanner discussion > >>>> Subject: Re: Clamav 0.95 > >>>> > >>>> Randal, Phil a ?crit : > >>>> > >>>> > >>>>> Over on the clamav-users mailing list, Edwin T?r?k says: > >>>>> > >>>>> "Make sure there is a symlink > >>>>> > >>>>> > >>>> /usr/lib64/libclamunrar_iface.so -> > >>>> /usr/lib64/libclamunrar_iface.so.6, run ldconfig again if > >>>> > >> necessary." > >> > >>>> > >>>> > >>>>> It'll be a while before I can test this. > >>>>> > >>>>> Cheers, > >>>>> > >>>>> Phil > >>>>> > >>>>> > >>>>> > >>>>> > >>>> Phil, > >>>> > >>>> I tested it on a 32 bit system and it worked. Before the > >>>> symlink I got: > >>>> service clamd restart > >>>> Stopping Clam AntiVirus Daemon: > [FAILED] > >>>> Starting Clam AntiVirus Daemon: LibClamAV Warning: Cannot > >>>> dlopen: file > >>>> not found - unrar support unavailable > >>>> > [ OK ] > >>>> > >>>> I then did: > >>>> cd /usr/lib > >>>> ln -s libclamunrar_iface.so.6 libclamunrar_iface.so > >>>> service clamd restart > >>>> Stopping Clam AntiVirus Daemon: > [ OK ] > >>>> Starting Clam AntiVirus Daemon: > [ OK ] > >>>> > >>>> Thanks! > >>>> > >>>> Denis > >>>> > >>>> > >>>> > >>> For some reason (don't remember why) for several versions > >>> > >> now, the build > >> > >>> scripts for clamav don't run ldconfig properly after > >>> > >> install. I have added a > >> > >>> call to ldconfig after install and before restarting to > >>> > >> address this on my > >> > >>> systems (in my own build script). I believe the original > >>> > >> post (on the clamav > >> > >>> list) concerning the check for the symlink was to check for > >>> > >> the link and if > >> > >>> it was missing run ldconfig manually and check again to > >>> > >> ensure ldconfig > >> > >>> created the proper link. You should *not* have to create > >>> > >> that link by hand. > >> > >>> Rick > >>> > >>> > >>> -- > >>> This message has been scanned for viruses and > >>> dangerous content by MailScanner, and is > >>> believed to be clean. > >>> > >>> > >>> > >>> > >> Rick, > >> > >> Just tried it on my last MS server and it didn't work (RHEL 5.3): > >> # ldconfig > >> # service clamd restart > >> Stopping Clam AntiVirus Daemon: [ OK ] > >> Starting Clam AntiVirus Daemon: LibClamAV Warning: Cannot > >> dlopen: file > >> not found - unrar support unavailable > >> [ OK ] > >> # ln -s /usr/lib/libclamunrar_iface.so.6 > >> /usr/lib/libclamunrar_iface.so > >> # service clamd restart > >> Stopping Clam AntiVirus Daemon: [ OK ] > >> Starting Clam AntiVirus Daemon: [ OK ] > >> > >> Denis > >> > >> > > > > IIRC one of the people having the issue with the 0.94x to > 0.95 upgrade and > > not having the link built correctly by ldconfig eventually > found they had > > two copies of the lib one in /usr/lib and one in either > /usr/local/lib or > > /lib and ldconfig built the link in the wrong place. Any > way you look at it > > there is a problem as ldconfig should build the link > against the most recent > > lib version. And I think (99.9% sure) the default location > for the lib is > > /usr/local/lib. If you do an ls -lh /usr/local/lib/libclamunrar* > > /usr/lib/libclamunrar do you find only one copy/version in > one place? > > > > Rick > > > > > > -- > > This message has been scanned for viruses and > > dangerous content by MailScanner, and is > > believed to be clean. > > > > > > > Rick, > > # updatedb > # locate libclamunrar > /usr/lib/libclamunrar.so.6 > /usr/lib/libclamunrar.so.6.0.2 > /usr/lib/libclamunrar_iface.so > /usr/lib/libclamunrar_iface.so.6 > /usr/lib/libclamunrar_iface.so.6.0.2 > > Nothing outside /usr/lib... > > Denis > It looks like a bug that may pertain to this was closed today https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1501 I am still kind of curious why it only affects some systems and not others (such as any of mine), although I do not install clamav via rpm on any of my systems. Just for fun I installed the 0.95-1 via rpm on a CENTOS 5.2 box that I don't normaly have clamav on and it worked fine, the correct symlinks were there and the unrar functions tested fine. Hmmmm. Rick -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Wed Apr 1 18:24:10 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Wed Apr 1 18:24:32 2009 Subject: PDF scanner In-Reply-To: <49D3915F.6080405@utwente.nl> References: <49D3915F.6080405@utwente.nl> <49D3A33A.8040407@ecs.soton.ac.uk> Message-ID: You could implement this easily using the "Generic Scanner" functionality already built into MailScanner. You just write a bit of code to call it and generate the right output format, and MailScanner takes care of everything else. To call it, read and edit /usr/lib/MailScanner/generic-wrapper and tweak it to call your own program and process the output from it into the format described in generic-wrapper, and then just add "generic" to the list of "Virus Scanners =" scanner names in MailScanner.conf. It's all very simple. You could do it in a shell script pretty easily. You probably want to look for any numbers in brackets, anything non-zero against "/AA" and anthing non-zero against "/OpenAction". Pay me something suitable, or buy me something nice from my Amazon.co.uk wishlist, and I might even write it all for you. :-) Jules. On 1/4/09 17:07, Peter Peters wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi, > > Anybody having any idea about Didier Stevens' PDF scanner? > http://blog.didierstevens.com/2009/03/31/pdfid/ > > Could this be called from MS? > > - -- > Peter Peters, Teamleider Unix/Linux/Storage > ICT-Servicecentrum > Universiteit Twente, Postbus 217, 7500 AE Enschede > Telefoon 053 489 2301, Fax 053 489 2383, > P.G.M.Peters@utwente.nl, http://www.utwente.nl/icts > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.2 (MingW32) > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org > > iD8DBQFJ05FfelLo80lrIdIRAgQnAJ9vuK4iLUMWAiUhiuCp/7X1sSJkJwCeMQgC > gO98xEj2ucmmoekpX5VAWyw= > =zg9P > -----END PGP SIGNATURE----- > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From Denis.Beauchemin at USherbrooke.ca Wed Apr 1 19:53:46 2009 From: Denis.Beauchemin at USherbrooke.ca (Denis Beauchemin) Date: Wed Apr 1 19:54:03 2009 Subject: Low spam detection Message-ID: <49D3B83A.5010800@USherbrooke.ca> Hello all, I am seeing a significant decrease in spam detection over the last months and I was wondering if anyone else was seeing the same trend on their servers. Here are my stats from the start of 2008: month emails spam virus spam% virus% 2008-01 7 337 089 6 348 633 59 386 86,5% 0,8% 2008-02 6 203 500 5 152 249 123 029 83,1% 2,0% 2008-03 8 118 670 7 010 463 140 891 86,3% 1,7% 2008-04 7 693 698 6 569 030 98 957 85,4% 1,3% 2008-05 7 956 170 6 927 306 81 625 87,1% 1,0% 2008-06 6 342 232 5 380 464 86 449 84,8% 1,4% 2008-07 6 779 005 5 866 915 102 319 86,5% 1,5% 2008-08 7 592 171 6 687 128 123 659 88,1% 1,6% 2008-09 8 947 295 7 779 344 125 637 86,9% 1,4% 2008-10 7 092 938 5 873 751 66 896 82,8% 0,9% 2008-11 5 093 559 3 917 609 73 225 76,9% 1,4% 2008-12 4 602 584 3 519 119 44 382 76,5% 1,0% 2009-01 3 568 832 2 430 698 36 931 68,1% 1,0% 2009-02 3 253 018 2 089 179 52 037 64,2% 1,6% 2009-03 3 341 614 2 050 365 66 486 61,4% 2,0% My servers are quite current: RHEL 5.3, SA 3.2.5-1 with many SARE rules and KAM, DCC, Pyzor and Razor, Clam 0.95 with Sanesecurity and some others, and many RBLs in sendmail. Every email blocked by a RBL is counted as spam (because it probably is). Emails detected by Sanesecurity et al are counted as viruses. Do you have any ideas what could account for such abysmal spam rate detection? I can see the total number of emails received dropping significantly in the last 6 months. Have others seen the same? Would DefenderMX help stop more spam? Thanks everybody! Denis -- _ ?v? Denis Beauchemin, analyste /(_)\ Universit? de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x62252 F: 819.821.8045 From MailScanner at ecs.soton.ac.uk Wed Apr 1 20:44:54 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Wed Apr 1 20:45:31 2009 Subject: Low spam detection In-Reply-To: <49D3B83A.5010800@USherbrooke.ca> References: <49D3B83A.5010800@USherbrooke.ca> <49D3C436.4080604@ecs.soton.ac.uk> Message-ID: On 1/4/09 19:53, Denis Beauchemin wrote: > Hello all, > > I am seeing a significant decrease in spam detection over the last > months and I was wondering if anyone else was seeing the same trend on > their servers. > > Here are my stats from the start of 2008: > month emails spam virus spam% virus% > 2008-01 7 337 089 6 348 633 59 386 86,5% 0,8% > 2008-02 6 203 500 5 152 249 123 029 83,1% 2,0% > 2008-03 8 118 670 7 010 463 140 891 86,3% 1,7% > 2008-04 7 693 698 6 569 030 98 957 85,4% 1,3% > 2008-05 7 956 170 6 927 306 81 625 87,1% 1,0% > 2008-06 6 342 232 5 380 464 86 449 84,8% 1,4% > 2008-07 6 779 005 5 866 915 102 319 86,5% 1,5% > 2008-08 7 592 171 6 687 128 123 659 88,1% 1,6% > 2008-09 8 947 295 7 779 344 125 637 86,9% 1,4% > 2008-10 7 092 938 5 873 751 66 896 82,8% 0,9% > 2008-11 5 093 559 3 917 609 73 225 76,9% 1,4% > 2008-12 4 602 584 3 519 119 44 382 76,5% 1,0% > 2009-01 3 568 832 2 430 698 36 931 68,1% 1,0% > 2009-02 3 253 018 2 089 179 52 037 64,2% 1,6% > 2009-03 3 341 614 2 050 365 66 486 61,4% 2,0% > > My servers are quite current: RHEL 5.3, SA 3.2.5-1 with many SARE > rules and KAM, DCC, Pyzor and Razor, Clam 0.95 with Sanesecurity and > some others, and many RBLs in sendmail. > > Every email blocked by a RBL is counted as spam (because it probably > is). Emails detected by Sanesecurity et al are counted as viruses. > > Do you have any ideas what could account for such abysmal spam rate > detection? I can see the total number of emails received dropping > significantly in the last 6 months. Have others seen the same? > > Would DefenderMX help stop more spam? BarricadeMX probably would. However... Are you actually letting through much more spam than you were? We have seen overall incoming spam rates drop a lot too, but we aren't letting through any more spam than we used to (I see no more spam than I used to, and no-one has commented to me that they are getting much more spam than they were). The graph here: http://users.ecs.soton.ac.uk/jkf/goodtcp-year.png shows the percentage of incoming SMTP connections which turn into mail delivered to someone's inbox, multiplied by 100. So if the number on the vertical axis reached 3600 (the limit of the graph), then that would mean that 36% of SMTP connections resulted in a message arriving in someone's inbox, and hence 64% of connections resulted in the connection being dropped at SMTP time or the message being refused/dropped by MailScanner. As you can see over the past year, the amount of spam reaching us has dropped a lot. Remember that back last November the McColo spamming colo centre was shut down, this resulted in a marked drop in global spam quantities. This is from a sample of about 800,000 incoming SMTP connections per day. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From Denis.Beauchemin at USherbrooke.ca Wed Apr 1 21:13:27 2009 From: Denis.Beauchemin at USherbrooke.ca (Denis Beauchemin) Date: Wed Apr 1 21:13:40 2009 Subject: Low spam detection In-Reply-To: References: <49D3B83A.5010800@USherbrooke.ca> <49D3C436.4080604@ecs.soton.ac.uk> Message-ID: <49D3CAE7.1020306@USherbrooke.ca> Julian Field a ?crit : > > On 1/4/09 19:53, Denis Beauchemin wrote: >> Hello all, >> >> I am seeing a significant decrease in spam detection over the last >> months and I was wondering if anyone else was seeing the same trend >> on their servers. >> >> Here are my stats from the start of 2008: >> month emails spam virus spam% virus% >> 2008-01 7 337 089 6 348 633 59 386 86,5% 0,8% >> 2008-02 6 203 500 5 152 249 123 029 83,1% 2,0% >> 2008-03 8 118 670 7 010 463 140 891 86,3% 1,7% >> 2008-04 7 693 698 6 569 030 98 957 85,4% 1,3% >> 2008-05 7 956 170 6 927 306 81 625 87,1% 1,0% >> 2008-06 6 342 232 5 380 464 86 449 84,8% 1,4% >> 2008-07 6 779 005 5 866 915 102 319 86,5% 1,5% >> 2008-08 7 592 171 6 687 128 123 659 88,1% 1,6% >> 2008-09 8 947 295 7 779 344 125 637 86,9% 1,4% >> 2008-10 7 092 938 5 873 751 66 896 82,8% 0,9% >> 2008-11 5 093 559 3 917 609 73 225 76,9% 1,4% >> 2008-12 4 602 584 3 519 119 44 382 76,5% 1,0% >> 2009-01 3 568 832 2 430 698 36 931 68,1% 1,0% >> 2009-02 3 253 018 2 089 179 52 037 64,2% 1,6% >> 2009-03 3 341 614 2 050 365 66 486 61,4% 2,0% >> >> My servers are quite current: RHEL 5.3, SA 3.2.5-1 with many SARE >> rules and KAM, DCC, Pyzor and Razor, Clam 0.95 with Sanesecurity and >> some others, and many RBLs in sendmail. >> >> Every email blocked by a RBL is counted as spam (because it probably >> is). Emails detected by Sanesecurity et al are counted as viruses. >> >> Do you have any ideas what could account for such abysmal spam rate >> detection? I can see the total number of emails received dropping >> significantly in the last 6 months. Have others seen the same? >> >> Would DefenderMX help stop more spam? > BarricadeMX probably would. However... > > Are you actually letting through much more spam than you were? > We have seen overall incoming spam rates drop a lot too, but we aren't > letting through any more spam than we used to (I see no more spam than > I used to, and no-one has commented to me that they are getting much > more spam than they were). > The graph here: > http://users.ecs.soton.ac.uk/jkf/goodtcp-year.png > shows the percentage of incoming SMTP connections which turn into mail > delivered to someone's inbox, multiplied by 100. > > So if the number on the vertical axis reached 3600 (the limit of the > graph), then that would mean that 36% of SMTP connections resulted in > a message arriving in someone's inbox, and hence 64% of connections > resulted in the connection being dropped at SMTP time or the message > being refused/dropped by MailScanner. > > As you can see over the past year, the amount of spam reaching us has > dropped a lot. Remember that back last November the McColo spamming > colo centre was shut down, this resulted in a marked drop in global > spam quantities. > > This is from a sample of about 800,000 incoming SMTP connections per day. > > Jules > Julian, I've seen more phishing/Nigerian scams slipping through lately and it is starting to annoy other people as well. I don't have the real picture for the progression of undetected spam but my gut feeling tells me it has worsened lately. I've read recent reports (such as http://www.theregister.co.uk/2009/04/01/spam_trends/) that spammers have recovered from the McColo shutdown and spam is now flowing even more than it used to. But my numbers don't agree... I guess I should ask for a trial for BarricadeMX. That would be the best way to see if it would improve that perception. Denis -- _ ?v? Denis Beauchemin, analyste /(_)\ Universit? de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x62252 F: 819.821.8045 From ms-list at alexb.ch Wed Apr 1 21:37:03 2009 From: ms-list at alexb.ch (Alex Broens) Date: Wed Apr 1 21:37:12 2009 Subject: Low spam detection In-Reply-To: <49D3CAE7.1020306@USherbrooke.ca> References: <49D3B83A.5010800@USherbrooke.ca> <49D3C436.4080604@ecs.soton.ac.uk> <49D3CAE7.1020306@USherbrooke.ca> Message-ID: <49D3D06F.3040301@alexb.ch> On 4/1/2009 10:13 PM, Denis Beauchemin wrote: > I've seen more phishing/Nigerian scams slipping through lately and it is > starting to annoy other people as well. I don't have the real picture > for the progression of undetected spam but my gut feeling tells me it > has worsened lately. Are you using the SOUGH and SOUGH_FRAUD rules`? also, the iXhash plugin does well against 419s - definitely worth a try. > I guess I should ask for a trial for BarricadeMX. That would be the best > way to see if it would improve that perception. I doubt that BMX will help against the Nigerians. I think its strength is in preventing bot floods, but there's few tricks against 419s except hashing and content rules. Alex From Denis.Beauchemin at USherbrooke.ca Wed Apr 1 21:57:55 2009 From: Denis.Beauchemin at USherbrooke.ca (Denis Beauchemin) Date: Wed Apr 1 21:58:06 2009 Subject: Low spam detection In-Reply-To: <49D3D06F.3040301@alexb.ch> References: <49D3B83A.5010800@USherbrooke.ca> <49D3C436.4080604@ecs.soton.ac.uk> <49D3CAE7.1020306@USherbrooke.ca> <49D3D06F.3040301@alexb.ch> Message-ID: <49D3D553.7020609@USherbrooke.ca> Alex Broens a ?crit : > On 4/1/2009 10:13 PM, Denis Beauchemin wrote: > >> I've seen more phishing/Nigerian scams slipping through lately and it >> is starting to annoy other people as well. I don't have the real >> picture for the progression of undetected spam but my gut feeling >> tells me it has worsened lately. > > Are you using the SOUGH and SOUGH_FRAUD rules`? > > also, the iXhash plugin does well against 419s - definitely worth a try. > >> I guess I should ask for a trial for BarricadeMX. That would be the >> best way to see if it would improve that perception. > > I doubt that BMX will help against the Nigerians. I think its strength > is in preventing bot floods, but there's few tricks against 419s > except hashing and content rules. > > Alex Alex, Could you provide a pointer to SOUGH and SOUGH_FRAUD rules? I couldn't find anything with a quick Google search. But I found some about iXhash. Thanks! Denis -- _ ?v? Denis Beauchemin, analyste /(_)\ Universit? de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x62252 F: 819.821.8045 -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3306 bytes Desc: S/MIME Cryptographic Signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090401/e71add96/smime.bin From mailbag at partnersolutions.ca Wed Apr 1 22:07:59 2009 From: mailbag at partnersolutions.ca (PSI Mailbag) Date: Wed Apr 1 22:08:12 2009 Subject: Fragmented message bug with malformed emails Message-ID: <120EBC42C8319846842A4A49B3D5566BBDDA04@psims003.pshosting.intranet> Hey Jules (+list), I've got a potentially annoying bug for you.. :-P I have a few client MFD's that do scan to email, which occasionally break up the message into multiple fragments if the scan is too large. Some of these scanners (specifically various Ricoh Aficio models) send badly formatted emails (see attached example) which used to be blocked properly in older versions of MS (4.62.9 as an example), but are not reported properly in the newer releases (4.74.16, etc). The emails basically contain extra spacing, which caused some of the fields to double up (From, To, Content-Type, etc). This issue is only coming up for me now, as I've recently upgraded to a newer release (at the time), so I'm not sure exactly where in the line this functionality broke. Based on the change log, I assume this is from the changes in 4.71.10. When these messages are processed, MS does detect them properly as a fragmented message, but the admin notification contains a blank "Report" section, and the user receives a copy of the entire email as an attachment (including the fragmented MIME content) instead of the warning notification. I assume the code to remove only the partial message section of the email is choking on the bad format. Messages that are sent with proper formatting are detected and reported properly. The "appropriate" fix is for the scanners to format their emails properly, but I have this same issue originating from multiple device models from multiple clients. If you don't mind, could you add it to your todo list? ;-) Cheers -- Joshua Hirsh Technical Specialist Partner Solutions Inc. PGP/GnuPG ID: 0xD12A3B59 -------------- next part -------------- Received: from RNPC22D85 (unknown [10.1.1.99]) by mx5.partnersolutions.ca (Postfix) with SMTP id 63D5D746520 for ; Mon, 30 Mar 2009 14:09:42 -0400 (EDT) Subject: part 1/2 From: "isabelle m" To: "isabelle m" Date: Mon, 30 Mar 2009 14:09:43 -0500 Message-Id: <200903301409412V.DCSML-S001930001.000074C22D85@10.1.223.42> MIME-Version: 1.0 Content-Type: message/partial; id="TAN_U_P<1238440181.000074c22d85>"; number=1; total=2 From: "isabelle m" Subject: To: "isabelle m" Date: Mon, 30 Mar 2009 14:09:43 -0500 Message-Id: <200903301409412V.DCSML-S001930000.000074C22D85@10.1.223.42> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="DC_BOUND_PRE_<1238440181.000074c22d85>" This is a multi-part message in MIME format. --DC_BOUND_PRE_<1238440181.000074c22d85> Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit This E-mail was sent from "RNPC22D85" (Aficio MP C2500). Scan Date: 03.30.2009 14:09:40 (-0500) --DC_BOUND_PRE_<1238440181.000074c22d85> Content-Type: application/pdf; name="20090330140941089.pdf" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="20090330140941089.pdf" JVBERi0xLjQKJRamipIKNCAwIG9iago8PC9UeXBlL1hPYmplY3QKL1N1YnR5cGUvSW1hZ2UK L1dpZHRoIDIyMDAKL0hlaWdodCAxNzAwCi9CaXRzUGVyQ29tcG9uZW50IDgKL0NvbG9yU3Bh Y2UvRGV2aWNlUkdCCi9GaWx0ZXIgL0RDVERlY29kZQovTGVuZ3RoIDI4ODMxOAo+PgpzdHJl YW0K/9j/4AAQSkZJRgABAQEAyADIAAD/2wBDABQODxIPDRQSEBIXFRQYHjIhHhwcHj0sLiQy SUBMS0dARkVQWnNiUFVtVkVGZIhlbXd7gYKBTmCNl4x9lnN+gXz/2wBDARUXFx4aHjshITt8 U0ZTfHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHz/ From mailbag at partnersolutions.ca Wed Apr 1 22:21:36 2009 From: mailbag at partnersolutions.ca (PSI Mailbag) Date: Wed Apr 1 22:21:49 2009 Subject: Clamav 0.95 In-Reply-To: <62B4555DBE634F58A6019101E26AD5F0@SAHOMELT> References: <20090329130736.GA7986@doctor.nl2k.ab.ca> <49CF8062.3060006@ecs.soton.ac.uk> <49D22C9E.7000902@emcuk.com><49D249F1.7080502@ecs.soton.ac.uk> <7EF0EE5CB3B263488C8C18823239BEBA065591DE@HC-MBX02.herefordshire.gov.uk><7EF0EE5CB3B263488C8C18823239BEBA065592A6@HC-MBX02.herefordshire.gov.uk> <49D37146.3050309@USherbrooke.ca><2373DAFDD6E94A9EB27846CAEB9BC830@SAHOMELT> <49D38269.6040901@USherbrooke.ca><49D38C3D.2060701@USherbrooke.ca> <62B4555DBE634F58A6019101E26AD5F0@SAHOMELT> Message-ID: <120EBC42C8319846842A4A49B3D5566BBDDA05@psims003.pshosting.intranet> > I am still kind of curious why it only affects some systems and not others > (such as any of mine), although I do not install clamav via rpm on any of my > systems. Just for fun I installed the 0.95-1 via rpm on a CENTOS 5.2 box > that I don't normaly have clamav on and it worked fine, the correct symlinks > were there and the unrar functions tested fine. Hmmmm. I've run into this problem on every Centos 5.2/5.3 server I've tried. In my case, it's affected both clean and upgraded installs, but they were all done by RPM. The servers were a mix of base installs and some installs including the kitchen sink. Definitely annoying, but at least it's quick to resolve. Cheers, -Joshua From mailbag at partnersolutions.ca Wed Apr 1 22:27:15 2009 From: mailbag at partnersolutions.ca (PSI Mailbag) Date: Wed Apr 1 22:27:27 2009 Subject: Clamav 0.95 In-Reply-To: <120EBC42C8319846842A4A49B3D5566BBDDA05@psims003.pshosting.intranet> References: <20090329130736.GA7986@doctor.nl2k.ab.ca> <49CF8062.3060006@ecs.soton.ac.uk> <49D22C9E.7000902@emcuk.com><49D249F1.7080502@ecs.soton.ac.uk> <7EF0EE5CB3B263488C8C18823239BEBA065591DE@HC-MBX02.herefordshire.gov.uk><7EF0EE5CB3B263488C8C18823239BEBA065592A6@HC-MBX02.herefordshire.gov.uk> <49D37146.3050309@USherbrooke.ca><2373DAFDD6E94A9EB27846CAEB9BC830@SAHOMELT> <49D38269.6040901@USherbrooke.ca><49D38C3D.2060701@USherbrooke.ca><62B4555DBE634F58A6019101E26AD5F0@SAHOMELT> <120EBC42C8319846842A4A49B3D5566BBDDA05@psims003.pshosting.intranet> Message-ID: <120EBC42C8319846842A4A49B3D5566BBDDA06@psims003.pshosting.intranet> And some more fun: [root@liquidity lib]# rm libclamunrar.so.6 libclamunrar_iface.so.6 rm: remove symbolic link `libclamunrar.so.6'? y rm: remove symbolic link `libclamunrar_iface.so.6'? y [root@liquidity lib]# ls -lra libclamunrar* -rwxr-xr-x 1 root root 142039 Mar 27 17:45 libclamunrar.so.6.0.2 -rwxr-xr-x 1 root root 24434 Mar 27 17:45 libclamunrar_iface.so.6.0.2 [root@liquidity lib]# ldconfig -v | grep unrar libclamunrar.so.6 -> libclamunrar.so.6.0.2 (changed) libclamunrar_iface.so.6 -> libclamunrar_iface.so.6.0.2 (changed) [root@liquidity lib]# ls -lra libclamunrar* -rwxr-xr-x 1 root root 142039 Mar 27 17:45 libclamunrar.so.6.0.2 lrwxrwxrwx 1 root root 21 Apr 1 17:24 libclamunrar.so.6 -> libclamunrar.so.6.0.2 -rwxr-xr-x 1 root root 24434 Mar 27 17:45 libclamunrar_iface.so.6.0.2 lrwxrwxrwx 1 root root 27 Apr 1 17:24 libclamunrar_iface.so.6 -> libclamunrar_iface.so.6.0.2 The issue doesn't appear to be isolated to just ClamAV, though. Look in your libs and delete any linked .so file and re-run ldconfig. The .so isn't recreated. [root@liquidity lib]# rm libbeecrypt.so libbeecrypt.so.6 rm: remove symbolic link `libbeecrypt.so'? y rm: remove symbolic link `libbeecrypt.so.6'? y [root@liquidity lib]# ldconfig -v | grep libbeecr libbeecrypt.so.6 -> libbeecrypt.so.6.4.0 (changed) [root@liquidity lib]# ls -lra libbeecrypt* -rwxr-xr-x 1 root root 251704 Jan 6 2007 libbeecrypt.so.6.4.0 lrwxrwxrwx 1 root root 20 Apr 1 17:25 libbeecrypt.so.6 -> libbeecrypt.so.6.4.0 -rwxr-xr-x 1 root root 833 Jan 6 2007 libbeecrypt.la -rw-r--r-- 1 root root 340262 Jan 6 2007 libbeecrypt.a :-P -Joshua From ms-list at alexb.ch Wed Apr 1 22:31:18 2009 From: ms-list at alexb.ch (Alex Broens) Date: Wed Apr 1 22:31:27 2009 Subject: Low spam detection In-Reply-To: <49D3D553.7020609@USherbrooke.ca> References: <49D3B83A.5010800@USherbrooke.ca> <49D3C436.4080604@ecs.soton.ac.uk> <49D3CAE7.1020306@USherbrooke.ca> <49D3D06F.3040301@alexb.ch> <49D3D553.7020609@USherbrooke.ca> Message-ID: <49D3DD26.2080200@alexb.ch> On 4/1/2009 10:57 PM, Denis Beauchemin wrote: > Alex Broens a ?crit : >> On 4/1/2009 10:13 PM, Denis Beauchemin wrote: >> >>> I've seen more phishing/Nigerian scams slipping through lately and it >>> is starting to annoy other people as well. I don't have the real >>> picture for the progression of undetected spam but my gut feeling >>> tells me it has worsened lately. >> >> Are you using the SOUGH and SOUGH_FRAUD rules`? >> >> also, the iXhash plugin does well against 419s - definitely worth a try. >> >>> I guess I should ask for a trial for BarricadeMX. That would be the >>> best way to see if it would improve that perception. >> >> I doubt that BMX will help against the Nigerians. I think its strength >> is in preventing bot floods, but there's few tricks against 419s >> except hashing and content rules. >> >> Alex > Alex, > > Could you provide a pointer to SOUGH and SOUGH_FRAUD rules? I couldn't > find anything with a quick Google search. But I found some about iXhash. pls excuse my (very frequent) typos should read SOUGHT http://wiki.apache.org/spamassassin/SoughtRules If you have problems, the SA list archive is full of knowledge regarding the SOUGHT rules. h2h Alex From rcooper at dwford.com Wed Apr 1 22:40:52 2009 From: rcooper at dwford.com (Rick Cooper) Date: Wed Apr 1 22:41:07 2009 Subject: Clamav 0.95 In-Reply-To: <120EBC42C8319846842A4A49B3D5566BBDDA05@psims003.pshosting.intranet> References: <20090329130736.GA7986@doctor.nl2k.ab.ca> <49CF8062.3060006@ecs.soton.ac.uk> <49D22C9E.7000902@emcuk.com><49D249F1.7080502@ecs.soton.ac.uk> <7EF0EE5CB3B263488C8C18823239BEBA065591DE@HC-MBX02.herefordshire.gov.uk><7EF0EE5CB3B263488C8C18823239BEBA065592A6@HC-MBX02.herefordshire.gov.uk> <49D37146.3050309@USherbrooke.ca><2373DAFDD6E94A9EB27846CAEB9BC830@SAHOMELT> <49D38269.6040901@USherbrooke.ca><49D38C3D.2060701@USherbrooke.ca><62B4555DBE634F58A6019101E26AD5F0@SAHOMELT> <120EBC42C8319846842A4A49B3D5566BBDDA05@psims003.pshosting.intranet> Message-ID: <4DF388D2EC544699B4A62A6505226B1F@SAHOMELT> > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf > Of PSI Mailbag > Sent: Wednesday, April 01, 2009 5:22 PM > To: MailScanner discussion > Subject: RE: Clamav 0.95 > > > I am still kind of curious why it only affects some systems and not > others > > (such as any of mine), although I do not install clamav via > rpm on any > of my > > systems. Just for fun I installed the 0.95-1 via rpm on a CENTOS 5.2 > box > > that I don't normaly have clamav on and it worked fine, the correct > symlinks > > were there and the unrar functions tested fine. Hmmmm. > > I've run into this problem on every Centos 5.2/5.3 server > I've tried. In > my case, it's affected both clean and upgraded installs, but they were > all done by RPM. The servers were a mix of base installs and some > installs including the kitchen sink. > > Definitely annoying, but at least it's quick to resolve. > > Cheers, > -Joshua > That's just it, when I installed via rpm it was still fine. I did not use DAG or CENTOS repos though Rick -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From spamlists at coders.co.uk Wed Apr 1 22:42:40 2009 From: spamlists at coders.co.uk (Matt) Date: Wed Apr 1 22:43:48 2009 Subject: Low spam detection In-Reply-To: <49D3D553.7020609@USherbrooke.ca> References: <49D3B83A.5010800@USherbrooke.ca> <49D3C436.4080604@ecs.soton.ac.uk> <49D3CAE7.1020306@USherbrooke.ca> <49D3D06F.3040301@alexb.ch> <49D3D553.7020609@USherbrooke.ca> Message-ID: <49D3DFD0.6030003@coders.co.uk> > > Could you provide a pointer to SOUGH and SOUGH_FRAUD rules? I couldn't > find anything with a quick Google search. But I found some about iXhash. Typo - it should be SOUGHT http://taint.org/2007/08/15/004348a.html matt From hvdkooij at vanderkooij.org Wed Apr 1 22:48:27 2009 From: hvdkooij at vanderkooij.org (Hugo van der Kooij) Date: Wed Apr 1 22:48:37 2009 Subject: Clamav 0.95 In-Reply-To: <120EBC42C8319846842A4A49B3D5566BBDDA06@psims003.pshosting.intranet> References: <20090329130736.GA7986@doctor.nl2k.ab.ca> <49CF8062.3060006@ecs.soton.ac.uk> <49D22C9E.7000902@emcuk.com><49D249F1.7080502@ecs.soton.ac.uk> <7EF0EE5CB3B263488C8C18823239BEBA065591DE@HC-MBX02.herefordshire.gov.uk><7EF0EE5CB3B263488C8C18823239BEBA065592A6@HC-MBX02.herefordshire.gov.uk> <49D37146.3050309@USherbrooke.ca><2373DAFDD6E94A9EB27846CAEB9BC830@SAHOMELT> <49D38269.6040901@USherbrooke.ca><49D38C3D.2060701@USherbrooke.ca><62B4555DBE634F58A6019101E26AD5F0@SAHOMELT> <120EBC42C8319846842A4A49B3D5566BBDDA05@psims003.pshosting.intranet> <120EBC42C8319846842A4A49B3D5566BBDDA06@psims003.pshosting.intranet> Message-ID: <49D3E12B.1080407@vanderkooij.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PSI Mailbag wrote: > The issue doesn't appear to be isolated to just ClamAV, though. Look in > your libs and delete any linked .so file and re-run ldconfig. The .so > isn't recreated. Did you allready report this possible bug to the Centos team? (Assuming you did this on Centos 5.) Hugo. - -- hvdkooij@vanderkooij.org http://hugo.vanderkooij.org/ PGP/GPG? Use: http://hugo.vanderkooij.org/0x58F19981.asc A: Yes. >Q: Are you sure? >>A: Because it reverses the logical flow of conversation. >>>Q: Why is top posting frowned upon? Bored? Click on http://spamornot.org/ and rate those images. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iEYEARECAAYFAknT4SkACgkQBvzDRVjxmYHvrwCbBibdsMJw2qYdX6p20OFvEHHa nFwAn1f45ipQV1npaC7AQ0P93+LVOKaB =w+eI -----END PGP SIGNATURE----- From lists at designmedia.com Thu Apr 2 01:13:29 2009 From: lists at designmedia.com (Henry Kwan) Date: Thu Apr 2 01:13:49 2009 Subject: Clamav 0.95 References: <20090329130736.GA7986@doctor.nl2k.ab.ca> <49CF8062.3060006@ecs.soton.ac.uk> <49D22C9E.7000902@emcuk.com><49D249F1.7080502@ecs.soton.ac.uk> <7EF0EE5CB3B263488C8C18823239BEBA065591DE@HC-MBX02.herefordshire.gov.uk> <7EF0EE5CB3B263488C8C18823239BEBA065592A6@HC-MBX02.herefordshire.gov.uk> Message-ID: Randal, Phil herefordshire.gov.uk> writes: > > Over on the clamav-users mailing list, Edwin T?r?k says: > > "Make sure there is a symlink /usr/lib64/libclamunrar_iface.so -> > /usr/lib64/libclamunrar_iface.so.6, run ldconfig again if necessary." > > It'll be a while before I can test this. > I saw that response while googling so I tried it and the error message doesn't pop up anymore. But since I'm not running a 64-bit system, it was: /usr/lib/libclamunrar_iface.so -> /usr/lib/libclamunrar_iface.so.6 From mark at msapiro.net Thu Apr 2 01:17:22 2009 From: mark at msapiro.net (Mark Sapiro) Date: Thu Apr 2 01:17:36 2009 Subject: Different rules for files within archives In-Reply-To: References: <223f97700903311234l2a62753dnacc286fc82deab27@mail.gmail.com> Message-ID: <20090402001722.GA524@msapiro> On Wed, Apr 01, 2009 at 08:10:55AM -0700, Scott Silva wrote: > If you are using rpm, you should have all you need to fix the config files. > Just run upgrade_MailScanner_conf and upgrade_languages_conf. Run with no > options they will give you instructions on how to fix these. I think you are missing the point. The problem wasn't with MailScanner.conf or with languages.conf. I always deal with those as required whenever the install process creates a .rpmnew file. The issue in this case was that Jules inadvertently removed things from the file which installs as /usr/lib/MailScanner/MailScanner/ConfigDefs.pl. -- Mark Sapiro mark at msapiro net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From jcputter at centreweb.co.za Thu Apr 2 10:16:46 2009 From: jcputter at centreweb.co.za (JC Putter) Date: Thu Apr 2 10:17:44 2009 Subject: MailScanner Spamassassin Cache Database Message-ID: Hi i am trying to stress test my mailscanner box with smtp-source, the problem is that the testing is not really accurate because of spamassassins cache database, because its the same message scan each time, is there a way to disable the cache database ? to make the tests more reallistic ? __________ Information from ESET NOD32 Antivirus, version of virus signature database 3982 (20090402) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090402/a144a726/attachment.html From maxsec at gmail.com Thu Apr 2 10:28:15 2009 From: maxsec at gmail.com (Martin Hepworth) Date: Thu Apr 2 10:28:24 2009 Subject: MailScanner Spamassassin Cache Database In-Reply-To: References: Message-ID: <72cf361e0904020228i7b9d6a6jfd946d22456b8481@mail.gmail.com> Hi sure, turn the cache off.. http://www.mailscanner.info/MailScanner.conf.index.html#Cache%20SpamAssassin%20Results -- Martin Hepworth Oxford, UK 2009/4/2 JC Putter > Hi > > i am trying to stress test my mailscanner box with smtp-source, the problem > is that the testing is not really accurate because of spamassassins cache > database, because its the same message scan each time, is there a way to > disable the cache database ? to make the tests more reallistic ? > > > __________ Information from ESET NOD32 Antivirus, version of virus > signature database 3982 (20090402) __________ > > The message was checked by ESET NOD32 Antivirus. > > http://www.eset.com > > -- > This message has been scanned for viruses and > dangerous content by *MailScanner* , and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090402/07693cd1/attachment.html From brent.addis at spit.gen.nz Thu Apr 2 10:30:51 2009 From: brent.addis at spit.gen.nz (Brent Addis) Date: Thu Apr 2 10:31:06 2009 Subject: MailScanner Spamassassin Cache Database In-Reply-To: References: Message-ID: <99660f4ce44d84ed504ab8950b352c53@nsp-vhost-01.nsp.net.nz> Try postal. It sends random messages of varying sizes. Or, turn off the cache during testing On Thu, 2 Apr 2009 11:16:46 +0200, "JC Putter" wrote: > Hi > > i am trying to stress test my mailscanner box with smtp-source, the > problem is that the testing is not really accurate because of spamassassins > cache database, because its the same message scan each time, is there a way > to disable the cache database ? to make the tests more reallistic ? > > > __________ Information from ESET NOD32 Antivirus, version of virus > signature database 3982 (20090402) __________ > > The message was checked by ESET NOD32 Antivirus. > > http://www.eset.com > > > From maillists at conactive.com Thu Apr 2 12:31:22 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Thu Apr 2 12:31:36 2009 Subject: Low spam detection In-Reply-To: <49D3B83A.5010800@USherbrooke.ca> References: <49D3B83A.5010800@USherbrooke.ca> Message-ID: Denis Beauchemin wrote on Wed, 01 Apr 2009 14:53:46 -0400: > Do you have any ideas what could account for such abysmal spam rate > detection? Set this in relation to the total messages. Don't you see the drastic drop? Nothign in these figures tells you that there is more spam slipping thru, nothing. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From Denis.Beauchemin at USherbrooke.ca Thu Apr 2 14:16:11 2009 From: Denis.Beauchemin at USherbrooke.ca (Denis Beauchemin) Date: Thu Apr 2 14:16:23 2009 Subject: Low spam detection In-Reply-To: <49D3D06F.3040301@alexb.ch> References: <49D3B83A.5010800@USherbrooke.ca> <49D3C436.4080604@ecs.soton.ac.uk> <49D3CAE7.1020306@USherbrooke.ca> <49D3D06F.3040301@alexb.ch> Message-ID: <49D4BA9B.1030304@USherbrooke.ca> Alex Broens a ?crit : > On 4/1/2009 10:13 PM, Denis Beauchemin wrote: > >> I've seen more phishing/Nigerian scams slipping through lately and it >> is starting to annoy other people as well. I don't have the real >> picture for the progression of undetected spam but my gut feeling >> tells me it has worsened lately. > > Are you using the SOUGH and SOUGH_FRAUD rules`? > > also, the iXhash plugin does well against 419s - definitely worth a try. > >> I guess I should ask for a trial for BarricadeMX. That would be the >> best way to see if it would improve that perception. > > I doubt that BMX will help against the Nigerians. I think its strength > is in preventing bot floods, but there's few tricks against 419s > except hashing and content rules. > > Alex Alex, I just implemented both. Will see how it goes. What score did you give to iXhash? Thanks! Denis -- _ ?v? Denis Beauchemin, analyste /(_)\ Universit? de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x62252 F: 819.821.8045 From ms-list at alexb.ch Thu Apr 2 14:44:16 2009 From: ms-list at alexb.ch (Alex Broens) Date: Thu Apr 2 14:44:25 2009 Subject: Low spam detection In-Reply-To: <49D4BA9B.1030304@USherbrooke.ca> References: <49D3B83A.5010800@USherbrooke.ca> <49D3C436.4080604@ecs.soton.ac.uk> <49D3CAE7.1020306@USherbrooke.ca> <49D3D06F.3040301@alexb.ch> <49D4BA9B.1030304@USherbrooke.ca> Message-ID: <49D4C130.4040707@alexb.ch> On 4/2/2009 3:16 PM, Denis Beauchemin wrote: > Alex Broens a ?crit : >> On 4/1/2009 10:13 PM, Denis Beauchemin wrote: >> >>> I've seen more phishing/Nigerian scams slipping through lately and it >>> is starting to annoy other people as well. I don't have the real >>> picture for the progression of undetected spam but my gut feeling >>> tells me it has worsened lately. >> >> Are you using the SOUGH and SOUGH_FRAUD rules`? >> >> also, the iXhash plugin does well against 419s - definitely worth a try. >> >>> I guess I should ask for a trial for BarricadeMX. That would be the >>> best way to see if it would improve that perception. >> >> I doubt that BMX will help against the Nigerians. I think its strength >> is in preventing bot floods, but there's few tricks against 419s >> except hashing and content rules. >> >> Alex > > Alex, > > I just implemented both. Will see how it goes. What score did you give > to iXhash? Can't really suggest a score. I assume the default are ok, and if you see you can trust them raise (or decrease?) - depends on your FP rate and trust. Alex From jonas at vrt.dk Thu Apr 2 15:26:19 2009 From: jonas at vrt.dk (Jonas Akrouh Larsen) Date: Thu Apr 2 15:26:28 2009 Subject: Low spam detection In-Reply-To: <49D4C130.4040707@alexb.ch> References: <49D3B83A.5010800@USherbrooke.ca> <49D3C436.4080604@ecs.soton.ac.uk> <49D3CAE7.1020306@USherbrooke.ca> <49D3D06F.3040301@alexb.ch> <49D4BA9B.1030304@USherbrooke.ca> <49D4C130.4040707@alexb.ch> Message-ID: <005401c9b39e$fd6f8a40$f84e9ec0$@dk> A simple word of caution from my side. I love sought and cant praise it enough, it almost never has false positives! On the other hand I find iXHash to have A LOT of FP's. Last time I checked there was 4 different ixhash sources, and they each have different FP's rates (in our experience) I don?t score any of them particularly high (highest one is 0.9 I think and lowest is 0.2) ofcourse those scores only have meaning in our system. But to sum up, be carefull assigning scores to ixhash without proper testing first. Just a heads up from Denmark Med venlig hilsen / Best regards Jonas Akrouh Larsen TechBiz ApS Laplandsgade 4, 2. sal 2300 K?benhavn S Office: 7020 0979 Direct: 3336 9974 Mobile: 5120 1096 Fax: 7020 0978 Web: www.techbiz.dk From jcputter at centreweb.co.za Thu Apr 2 15:52:19 2009 From: jcputter at centreweb.co.za (JC Putter) Date: Thu Apr 2 15:58:46 2009 Subject: Performance with postfix Message-ID: <36EE61DE61D14738B9C70899FAAADAA7@numata.local> Hi i am busy testing what load my mailscanner box can handle. i am running an intel 2.4Ghz with 1GB RAM and a normal SATA HDD drive using Postfix as MTA all RBL's are in SA al running on Centos 5.2 i am using smtp-source to test sending 2000 messages at once and i not getting the results i was hoping for it, after 24 min of running there are still 1300 messages in the queue. is the normal or bad, postfix is a fast mta, i also noticed that mailscanner scans messages in batches of 30, and it really takes a long time for the 30 messages to be placed back in the queue. vmstat procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu------ r b swpd free buff cache si so bi bo in cs us sy id wa st 0 0 187204 43488 19036 65140 1 1 7 23 73 7 5 0 94 0 0 again am i asking too much from the hardware or is there something i can do to increase performance? ' i am using a caching dns server and added none /var/spool/MailScanner/incoming tmpfs defaults 0 0 in fstab __________ Information from ESET NOD32 Antivirus, version of virus signature database 3982 (20090402) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090402/cd578cce/attachment.html From list-mailscanner at linguaphone.com Thu Apr 2 16:07:30 2009 From: list-mailscanner at linguaphone.com (Gareth) Date: Thu Apr 2 16:07:46 2009 Subject: Performance with postfix In-Reply-To: <36EE61DE61D14738B9C70899FAAADAA7@numata.local> References: <36EE61DE61D14738B9C70899FAAADAA7@numata.local> Message-ID: <1238684850.18532.31.camel@gblades-suse.linguaphone-intranet.co.uk> 1GB od ram is probably the limiting factor with your current system configuration. Are you using sa-compile to compile the SA rules? How many mailscanner children do you have configured? On Thu, 2009-04-02 at 15:52, JC Putter wrote: > Hi i am busy testing what load my mailscanner box can handle. > > i am running an intel 2.4Ghz with 1GB RAM and a normal SATA HDD drive > using Postfix as MTA all RBL's are in SA al running on Centos 5.2 > > i am using smtp-source to test sending 2000 messages at once and i not > getting the results i was hoping for it, after 24 min of running there > are still 1300 messages in the queue. > > is the normal or bad, postfix is a fast mta, i also noticed that > mailscanner scans messages in batches of 30, and it really takes a > long time for the 30 messages to be placed back in the queue. > > vmstat > procs -----------memory---------- ---swap-- -----io---- --system-- > -----cpu------ > r b swpd free buff cache si so bi bo in cs us > sy id wa st > 0 0 187204 43488 19036 65140 1 1 7 23 73 7 5 > 0 94 0 0 > > again am i asking too much from the hardware or is there something i > can do to increase performance? ' > > i am using a caching dns server and added > > none /var/spool/MailScanner/incoming tmpfs > defaults 0 0 > > in fstab > > __________ Information from ESET NOD32 Antivirus, version of virus > signature database 3982 (20090402) __________ > > The message was checked by ESET NOD32 Antivirus. > > http://www.eset.com > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > ______________________________________________________________________ > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From glenn.steen at gmail.com Thu Apr 2 16:12:45 2009 From: glenn.steen at gmail.com (Glenn Steen) Date: Thu Apr 2 16:12:54 2009 Subject: Performance with postfix In-Reply-To: <36EE61DE61D14738B9C70899FAAADAA7@numata.local> References: <36EE61DE61D14738B9C70899FAAADAA7@numata.local> Message-ID: <223f97700904020812h357082d0p85a0d66dd03d6100@mail.gmail.com> 2009/4/2 JC Putter : > Hi i am busy testing what load my mailscanner box can handle. > > i am running an intel 2.4Ghz with 1GB RAM and a normal SATA HDD drive using > Postfix as MTA all RBL's are in SA al running on Centos 5.2 > > i am using smtp-source to test sending 2000 messages at once and i not > getting the results i was hoping for it, after 24 min of running there are > still 1300 messages in the queue. > > is the normal or bad, postfix is a fast mta, i also noticed that mailscanner > scans messages in batches of 30, and it really takes a long time for the 30 > messages to be placed back in the queue. > > vmstat > procs -----------memory---------- ---swap-- -----io---- --system-- > -----cpu------ > ?r? b?? swpd?? free?? buff? cache?? si?? so??? bi??? bo?? in?? cs us sy id > wa st > ?0? 0 187204? 43488? 19036? 65140??? 1??? 1???? 7??? 23?? 73??? 7? 5? 0 94 > 0? 0 First line of vmstat is pure drivel, run it like "vmstat 2" so that it'll poll every 2 seconds... Pay attention to line 2 and onward (during a "stressful situation", of course:-). The goal is to use as much RAM as possible without swapping (then you are "rightsized:-). > again am i asking too much from the hardware or is there something i can do > to increase performance? ' I think you are low on RAM (at least), and I'm guessing you might see some troubles with network lookups too, although you'd need corroborate that (do some trial runs with MailScanner --debug --debug-sa and see where the time is really spent). > i am using a caching dns server and added > > none /var/spool/MailScanner/incoming??????????? tmpfs??? defaults?????? 0 0 > > in fstab > Which eats at your RAM too... Try reducing the amount of MS children and see if that actually helps... Cheers -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From ms-list at alexb.ch Thu Apr 2 16:13:49 2009 From: ms-list at alexb.ch (Alex Broens) Date: Thu Apr 2 16:13:58 2009 Subject: Performance with postfix In-Reply-To: <36EE61DE61D14738B9C70899FAAADAA7@numata.local> References: <36EE61DE61D14738B9C70899FAAADAA7@numata.local> Message-ID: <49D4D62D.9080106@alexb.ch> On 4/2/2009 4:52 PM, JC Putter wrote: > Hi i am busy testing what load my mailscanner box can handle. > > i am running an intel 2.4Ghz with 1GB RAM and a normal SATA HDD drive using Postfix as MTA all RBL's are in SA al running on Centos 5.2 > > i am using smtp-source to test sending 2000 messages at once and i not getting the results i was hoping for it, after 24 min of running there are still 1300 messages in the queue. > > is the normal or bad, postfix is a fast mta, i also noticed that mailscanner scans messages in batches of 30, and it really takes a long time for the 30 messages to be placed back in the queue. > > vmstat > procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu------ > r b swpd free buff cache si so bi bo in cs us sy id wa st > 0 0 187204 43488 19036 65140 1 1 7 23 73 7 5 0 94 0 0 > > again am i asking too much from the hardware or is there something i can do to increase performance? ' > > i am using a caching dns server and added > > none /var/spool/MailScanner/incoming tmpfs defaults 0 0 > > in fstab If you have little RAM, using tmpfs for MS's work is contraproductive. Your swap usage show that what you could gain using tmpfs you loose by swapping - and swapping on a single disk plus all the queue I/O will hog the box. On a *busy* box, using tmps with 4GB or less will cause it to swap and work against you. Also try using smaller batches and possibly less threads to give the box some extra air. More RAM isn't a large investment and every penny worth. my 2 cents Alex From jcputter at centreweb.co.za Thu Apr 2 16:13:28 2009 From: jcputter at centreweb.co.za (JC Putter) Date: Thu Apr 2 16:14:15 2009 Subject: Performance with postfix In-Reply-To: <1238684850.18532.31.camel@gblades-suse.linguaphone-intranet.co.uk> References: <36EE61DE61D14738B9C70899FAAADAA7@numata.local> <1238684850.18532.31.camel@gblades-suse.linguaphone-intranet.co.uk> Message-ID: <6A76B898FC034993BC70B96881EFB301@numata.local> i am using sa-compile, i have configured 7 childeren ----- Original Message ----- From: "Gareth" To: "MailScanner discussion" Sent: Thursday, April 02, 2009 5:07 PM Subject: Re: Performance with postfix > 1GB od ram is probably the limiting factor with your current system > configuration. > > Are you using sa-compile to compile the SA rules? > > How many mailscanner children do you have configured? > > On Thu, 2009-04-02 at 15:52, JC Putter wrote: >> Hi i am busy testing what load my mailscanner box can handle. >> >> i am running an intel 2.4Ghz with 1GB RAM and a normal SATA HDD drive >> using Postfix as MTA all RBL's are in SA al running on Centos 5.2 >> >> i am using smtp-source to test sending 2000 messages at once and i not >> getting the results i was hoping for it, after 24 min of running there >> are still 1300 messages in the queue. >> >> is the normal or bad, postfix is a fast mta, i also noticed that >> mailscanner scans messages in batches of 30, and it really takes a >> long time for the 30 messages to be placed back in the queue. >> >> vmstat >> procs -----------memory---------- ---swap-- -----io---- --system-- >> -----cpu------ >> r b swpd free buff cache si so bi bo in cs us >> sy id wa st >> 0 0 187204 43488 19036 65140 1 1 7 23 73 7 5 >> 0 94 0 0 >> >> again am i asking too much from the hardware or is there something i >> can do to increase performance? ' >> >> i am using a caching dns server and added >> >> none /var/spool/MailScanner/incoming tmpfs >> defaults 0 0 >> >> in fstab >> >> __________ Information from ESET NOD32 Antivirus, version of virus >> signature database 3982 (20090402) __________ >> >> The message was checked by ESET NOD32 Antivirus. >> >> http://www.eset.com >> >> -- >> This message has been scanned for viruses and >> dangerous content by MailScanner, and is >> believed to be clean. >> >> ______________________________________________________________________ >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > > __________ Information from ESET NOD32 Antivirus, version of virus > signature database 3982 (20090402) __________ > > The message was checked by ESET NOD32 Antivirus. > > http://www.eset.com > > > __________ Information from ESET NOD32 Antivirus, version of virus signature database 3982 (20090402) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From prandal at herefordshire.gov.uk Thu Apr 2 16:15:40 2009 From: prandal at herefordshire.gov.uk (Randal, Phil) Date: Thu Apr 2 16:15:58 2009 Subject: FW: [Full-disclosure] [TZO-05-2009] Clamav 0.94 and below - Evasion/bypass Message-ID: <7EF0EE5CB3B263488C8C18823239BEBA0655986C@HC-MBX02.herefordshire.gov.uk> Now's the time to update your clamav installations, folks (but please see the thread about libclamavunrar_iface.so.6 first). Cheers, Phil -- Phil Randal | Networks Engineer Herefordshire Council | Deputy Chief Executive's Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, Hereford, HR2 6JT Tel: 01432 260160 email: prandal@herefordshire.gov.uk Any opinion expressed in this e-mail or any attached files are those of the individual and not necessarily those of Herefordshire Council. This e-mail and any attached files are confidential and intended solely for the use of the addressee. This communication may contain material protected by law from being passed on. If you are not the intended recipient and have received this e-mail in error, you are advised that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender immediately and destroy all copies of it. -----Original Message----- From: full-disclosure-bounces@lists.grok.org.uk [mailto:full-disclosure-bounces@lists.grok.org.uk] On Behalf Of Thierry Zoller Sent: 02 April 2009 15:28 To: NTBUGTRAQ; bugtraq; full-disclosure; info@circl.etat.lu; vuln@secunia.com; cert@cert.org; nvd@nist.gov; cve@mitre.org Subject: [Full-disclosure] [TZO-05-2009] Clamav 0.94 and below - Evasion/bypass ______________________________________________________________________ From the low-hanging-fruit-department - Generic ClamAV evasion ______________________________________________________________________ Release mode: Coordinated but limited disclosure. Ref : TZO-062009- ClamAV Evasion WWW : http://blog.zoller.lu/2009/04/clamav-094-and-below-evasion-and-bypass.ht ml Vendor : http://www.clamav.net & http://www.sourcefire.com/products/clamav Security notification reaction rating : Good. Disclosure Policy : http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html Affected products : - ClamAV below 0.95 Includes MACOSX server,IBM Secure E-mail Express Solution for System and a lots of mail appliances. http://www.clamav.net/about/who-use-clamav/ About this advisory ------------------- I used to not report bugs publicly where a a vendor - has not reacted to my notifications - silently patched. I also did not publish low hanging fruits as they make you look silly in the eyes of your peers. Over the past years I had the chance to audit and test a lot of critical infrastructures that, amongst other things relied on security products (and on security notifications from vendors) and have witnessed various ways of setting up your defenses that make some bugs critical that you'd consider low at first glance, I came to the conclusion that most bugs deserve disclosure. Please see "Common misconceptions" for more information. I. Background ~~~~~~~~~~~~~ Clam AntiVirus is an open source (GPL) anti-virus toolkit for UNIX, designed especially for e-mail scanning on mail gateways. It provides a number of utilities including a flexible and scalable multi-threaded daemon, a command line scanner and advanced tool for automatic database updates. The core of the package is an anti-virus engine available in a form of shared library. II. Description ~~~~~~~~~~~~~~~ The parsing engine can be bypassed by manipulating RAR archive in a "certain way" that the Clamav engine cannot extract the content but the end user is able to. Details are currently witheld (thanks to IBM). III. Impact ~~~~~~~~~~~ The bug results in denying the engine the possibility to inspect code within the RAR archive. While the impact might be low client- side (as code is inspected upon extraction by the user) the impact for gateways or AV infrastructure where the archive is not extracted is considerable. There is no inspection of the content at all, prior disclosure therefore referred to this class of bugs as Denial of service (you deny the service of the scan engine for that file) however I choose to stick the terms of evasion/bypass, being the primary impact of these types of bugs. PS. I am aware that there are hundreds of ways to bypass, that however doesn't make it less of a problem. I am waiting for the day where the first worm uses these techniques to stay undetected over a longer period of time, as depending on the evasion a kernel update (engine update) is necessary and sig updates do not suffice. Resulting in longer window of exposure - at least for GW solutions. *Must make confiker reference here* IV. Common misconceptions about this "bug class" -------------------------------------------------- - This has the same effect as adding a password to a ZIP file The scanner denotes files that are passworded, an example is an E-mail GW scanner that adds "Attachment not scanned" to the subject line or otherwise indicates that the file was not scanned. This is not the case with bypasses, in most cases the engine has not inspected the content at all or has inspected it in a different way. Additionally passworded archive files are easily filterable by a content policy, allowing or denying them. - This is only an issue with gateway products Every environment where the archive is not actively extracted by the end-user is affected. For example, fileservers, databases etc. pp. Over the years I saw the strangest environments that were affected by this type of "bug". My position is that customers deserve better security than this. - Behavioral analysis will catch this ? No, the content is unreadable to the AV engine as such no inspection whatsoever is possible. - Evasions are the Cross Site scripting of File formats bugs Yes. IV. Disclosure timeline ~~~~~~~~~~~~~~~~~~~~~~~~~ IBM was sent two POC files, an explanation and the disclosure terms (http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html) 09/03/2009 : Send proof of concept, description the terms under which I cooperate and the planned disclosure date (23/03/2009) 13/03/2009 : Clamav responds that the bug is reproducible and will be fixed in 0.95 to be released the 23/03/2009 (IBM take note, it's that easy.) 23/05/2009 : Asked clamav if the release was made and if credit was given 23/05/2009 : Clamav responds that the release was made, and that the credit was given in the changelog. (Tzo note: A post will be probably be made at http://www.clamav.net/category/security/ 02/01/2009 : Release of this limited detail advisory Final comments : I would like to thank Tomasz Kojm (clamav) for the professional reaction and AV-Test GMBH for their support. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ From maxsec at gmail.com Thu Apr 2 16:17:59 2009 From: maxsec at gmail.com (Martin Hepworth) Date: Thu Apr 2 16:18:09 2009 Subject: Performance with postfix In-Reply-To: <36EE61DE61D14738B9C70899FAAADAA7@numata.local> References: <36EE61DE61D14738B9C70899FAAADAA7@numata.local> Message-ID: <72cf361e0904020817h4099763fxe486fa50b4b55d62@mail.gmail.com> http://wiki.mailscanner.info/doku.php#getting_the_best_out_of_spamassassin and http://wiki.mailscanner.info/doku.php#optimization_tips are good places to start 2009/4/2 JC Putter > Hi i am busy testing what load my mailscanner box can handle. > > i am running an intel 2.4Ghz with 1GB RAM and a normal SATA HDD drive using > Postfix as MTA all RBL's are in SA al running on Centos 5.2 > > i am using smtp-source to test sending 2000 messages at once and i not > getting the results i was hoping for it, after 24 min of running there are > still 1300 messages in the queue. > > is the normal or bad, postfix is a fast mta, i also noticed that > mailscanner scans messages in batches of 30, and it really takes a long time > for the 30 messages to be placed back in the queue. > > vmstat > procs -----------memory---------- ---swap-- -----io---- --system-- > -----cpu------ > r b swpd free buff cache si so bi bo in cs us sy id > wa st > 0 0 187204 43488 19036 65140 1 1 7 23 73 7 5 0 94 > 0 0 > again am i asking too much from the hardware or is there something i can do > to increase performance? ' > > i am using a caching dns server and added > > none /var/spool/MailScanner/incoming tmpfs defaults 0 0 > > in fstab > > > __________ Information from ESET NOD32 Antivirus, version of virus > signature database 3982 (20090402) __________ > > The message was checked by ESET NOD32 Antivirus. > > http://www.eset.com > > -- > This message has been scanned for viruses and > dangerous content by *MailScanner* , and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -- Martin Hepworth Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090402/ea4eba66/attachment.html From maxsec at gmail.com Thu Apr 2 16:24:27 2009 From: maxsec at gmail.com (Martin Hepworth) Date: Thu Apr 2 16:24:35 2009 Subject: Performance with postfix In-Reply-To: <6A76B898FC034993BC70B96881EFB301@numata.local> References: <36EE61DE61D14738B9C70899FAAADAA7@numata.local> <1238684850.18532.31.camel@gblades-suse.linguaphone-intranet.co.uk> <6A76B898FC034993BC70B96881EFB301@numata.local> Message-ID: <72cf361e0904020824t2c3c8746v3a7bc7cc125c9667@mail.gmail.com> too many children for 1GB....1 or maybe 2 for that amount. 2009/4/2 JC Putter > i am using sa-compile, i have configured 7 childeren > > ----- Original Message ----- From: "Gareth" < > list-mailscanner@linguaphone.com> > To: "MailScanner discussion" > Sent: Thursday, April 02, 2009 5:07 PM > Subject: Re: Performance with postfix > > > > 1GB od ram is probably the limiting factor with your current system >> configuration. >> >> Are you using sa-compile to compile the SA rules? >> >> How many mailscanner children do you have configured? >> >> On Thu, 2009-04-02 at 15:52, JC Putter wrote: >> >>> Hi i am busy testing what load my mailscanner box can handle. >>> >>> i am running an intel 2.4Ghz with 1GB RAM and a normal SATA HDD drive >>> using Postfix as MTA all RBL's are in SA al running on Centos 5.2 >>> >>> i am using smtp-source to test sending 2000 messages at once and i not >>> getting the results i was hoping for it, after 24 min of running there >>> are still 1300 messages in the queue. >>> >>> is the normal or bad, postfix is a fast mta, i also noticed that >>> mailscanner scans messages in batches of 30, and it really takes a >>> long time for the 30 messages to be placed back in the queue. >>> >>> vmstat >>> procs -----------memory---------- ---swap-- -----io---- --system-- >>> -----cpu------ >>> r b swpd free buff cache si so bi bo in cs us >>> sy id wa st >>> 0 0 187204 43488 19036 65140 1 1 7 23 73 7 5 >>> 0 94 0 0 >>> >>> again am i asking too much from the hardware or is there something i >>> can do to increase performance? ' >>> >>> i am using a caching dns server and added >>> >>> none /var/spool/MailScanner/incoming tmpfs >>> defaults 0 0 >>> >>> in fstab >>> >>> __________ Information from ESET NOD32 Antivirus, version of virus >>> signature database 3982 (20090402) __________ >>> >>> The message was checked by ESET NOD32 Antivirus. >>> >>> http://www.eset.com >>> >>> -- >>> This message has been scanned for viruses and >>> dangerous content by MailScanner, and is >>> believed to be clean. >>> >>> ______________________________________________________________________ >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> -- >> This message has been scanned for viruses and >> dangerous content by MailScanner, and is >> believed to be clean. >> >> >> __________ Information from ESET NOD32 Antivirus, version of virus >> signature database 3982 (20090402) __________ >> >> The message was checked by ESET NOD32 Antivirus. >> >> http://www.eset.com >> >> >> >> > > __________ Information from ESET NOD32 Antivirus, version of virus > signature database 3982 (20090402) __________ > > The message was checked by ESET NOD32 Antivirus. > > http://www.eset.com > > > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- Martin Hepworth Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090402/67706ac0/attachment.html From jaearick at colby.edu Thu Apr 2 19:25:47 2009 From: jaearick at colby.edu (Jeff A. Earickson) Date: Thu Apr 2 19:26:24 2009 Subject: lasso in msgid??? Message-ID: Julian, I just got this strange syslog message from 4.75.9-2: Apr 2 13:33:30 jasper MailScanner[22348]: [ID 702911 mail.info] lasso in n32HX0XB022152 I can send the entrie syslog offline for this message, but what does this mean? Time to round up the mail messages, brand them, have a rodeo??? ----------------------------------- Jeff A. Earickson, Ph.D Senior UNIX Sysadmin Email Administrator Colby Sports Photographer Colby College, 4214 Mayflower Hill, Waterville ME, 04901-8842 207-859-4214 (fax 207-859-4186) Eastern Time Zone, USA ----------------------------------- From rcooper at dwford.com Thu Apr 2 20:37:43 2009 From: rcooper at dwford.com (Rick Cooper) Date: Thu Apr 2 20:37:58 2009 Subject: OT: Question Message-ID: <8A01F5DF5A2D42EF854888F41F5FD1A9@SAHOMELT> Just a query regarding bounces: How many of you actually bounce mail anymore? I ask this question because I noted a huge number of rejects on one of my servers that appear to be valid bounce attempts to an address of info@mydomain.com for the last week or so. I have an ACL that looks at the local part of recipients and if that local part is being used it denies the message (even null sender) with a message stating there is no such user and it's an address currently being joe-jobbed. I see the same ips repeatedly attempting a bounce for days. I decided to do a search for the address in question and found several honey pots listing dictionary attacks by several Ips and when I look at the info I see things like sender : Anna , and of course a bunch of other addresses that are, I am sure, fake as well. Since this has gotten to the point of thousands of attempted bounces a day I added an call to ExiBlock today that will add the addresses to the firewall for 2 days, but I started thinking who actually bounces mail, or for that matter accepts mail for users that are not their own? What really pisses me off is the fact that we sign all our mail and we have SPF records that hard fail any host not actually used for sending mail for our domains. So you hear people say the don't check SPF, it's useless and then I get hammered by back scatter for weeks because they didn't even bother to check the freaking SPF record. Rick Cooper -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From ssilva at sgvwater.com Thu Apr 2 20:54:42 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Thu Apr 2 20:55:08 2009 Subject: OT: Question In-Reply-To: <8A01F5DF5A2D42EF854888F41F5FD1A9@SAHOMELT> References: <8A01F5DF5A2D42EF854888F41F5FD1A9@SAHOMELT> Message-ID: on 4-2-2009 12:37 PM Rick Cooper spake the following: > Just a query regarding bounces: How many of you actually bounce mail > anymore? I ask this question because I noted a huge number of rejects on one > of my servers that appear to be valid bounce attempts to an address of > info@mydomain.com for the last week or so. I have an ACL that looks at the > local part of recipients and if that local part is being used it denies the > message (even null sender) with a message stating there is no such user and > it's an address currently being joe-jobbed. I see the same ips repeatedly > attempting a bounce for days. > > I decided to do a search for the address in question and found several honey > pots listing dictionary attacks by several Ips and when I look at the info I > see things like sender : Anna , and of course a bunch of > other addresses that are, I am sure, fake as well. > > Since this has gotten to the point of thousands of attempted bounces a day I > added an call to ExiBlock today that will add the addresses to the firewall > for 2 days, but I started thinking who actually bounces mail, or for that > matter accepts mail for users that are not their own? > > What really pisses me off is the fact that we sign all our mail and we have > SPF records that hard fail any host not actually used for sending mail for > our domains. So you hear people say the don't check SPF, it's useless and > then I get hammered by back scatter for weeks because they didn't even > bother to check the freaking SPF record. > If I can't reject at the SMTP phase, I just bitbucket them. The only thing I may bounce is rejected content messages. Most spam has invalid sender info, so you are just flooding the system with more junk. If you have an edge system doing your initial scanning, it needs someway of knowing valid addresses and rejecting, not bouncing. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090402/eaff04c9/signature.bin From ka at pacific.net Thu Apr 2 21:41:51 2009 From: ka at pacific.net (Ken A) Date: Thu Apr 2 21:42:11 2009 Subject: OT: Question In-Reply-To: <8A01F5DF5A2D42EF854888F41F5FD1A9@SAHOMELT> References: <8A01F5DF5A2D42EF854888F41F5FD1A9@SAHOMELT> Message-ID: <49D5230F.6070609@pacific.net> Rick Cooper wrote: > Just a query regarding bounces: How many of you actually bounce mail > anymore? I ask this question because I noted a huge number of rejects on one > of my servers that appear to be valid bounce attempts to an address of > info@mydomain.com for the last week or so. I have an ACL that looks at the > local part of recipients and if that local part is being used it denies the > message (even null sender) with a message stating there is no such user and > it's an address currently being joe-jobbed. I see the same ips repeatedly > attempting a bounce for days. I've got one: eqnjahdhx@domain.tld. We host the domain, but of course they don't send the spam. They aren't even aware of it. We are the joe-jobbed victim. We don't accept the bounces, but they are annoying, and it's been going on for well over a year. I tightened up the SPF record, but I don't think that helped much. People who accept, then bounce mail will eventually learn, or be buried, I think. The 550 error on this one now says "Please dont bounce forged spam". That hasn't helped either. It just takes time. Ken > > I decided to do a search for the address in question and found several honey > pots listing dictionary attacks by several Ips and when I look at the info I > see things like sender : Anna , and of course a bunch of > other addresses that are, I am sure, fake as well. > > Since this has gotten to the point of thousands of attempted bounces a day I > added an call to ExiBlock today that will add the addresses to the firewall > for 2 days, but I started thinking who actually bounces mail, or for that > matter accepts mail for users that are not their own? > > What really pisses me off is the fact that we sign all our mail and we have > SPF records that hard fail any host not actually used for sending mail for > our domains. So you hear people say the don't check SPF, it's useless and > then I get hammered by back scatter for weeks because they didn't even > bother to check the freaking SPF record. > > > > > > Rick Cooper > > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- Ken Anderson Pacific Internet - http://www.pacific.net From glenn.steen at gmail.com Thu Apr 2 22:13:28 2009 From: glenn.steen at gmail.com (Glenn Steen) Date: Thu Apr 2 22:13:37 2009 Subject: Performance with postfix In-Reply-To: <72cf361e0904020824t2c3c8746v3a7bc7cc125c9667@mail.gmail.com> References: <36EE61DE61D14738B9C70899FAAADAA7@numata.local> <1238684850.18532.31.camel@gblades-suse.linguaphone-intranet.co.uk> <6A76B898FC034993BC70B96881EFB301@numata.local> <72cf361e0904020824t2c3c8746v3a7bc7cc125c9667@mail.gmail.com> Message-ID: <223f97700904021413x4121616ax6953dc3d963584ca@mail.gmail.com> 2009/4/2 Martin Hepworth : > too many children for 1GB....1 or maybe 2 for that amount. > Indeed. And do as suggested and lose the tmpfs - at least until you have gotten another (three:) GiB into that box. Also, during your lint trials, make sure you don't spend time on something silly like a massive bayes_seen file (making bayes a veritable hog). -- -- Glenn > 2009/4/2 JC Putter >> >> i am using sa-compile, i have configured 7 childeren >> >> ----- Original Message ----- From: "Gareth" >> >> To: "MailScanner discussion" >> Sent: Thursday, April 02, 2009 5:07 PM >> Subject: Re: Performance with postfix >> >> >>> 1GB od ram is probably the limiting factor with your current system >>> configuration. >>> >>> Are you using sa-compile to compile the SA rules? >>> >>> How many mailscanner children do you have configured? >>> >>> On Thu, 2009-04-02 at 15:52, JC Putter wrote: >>>> >>>> Hi i am busy testing what load my mailscanner box can handle. >>>> >>>> i am running an intel 2.4Ghz with 1GB RAM and a normal SATA HDD drive >>>> using Postfix as MTA all RBL's are in SA al running on Centos 5.2 >>>> >>>> i am using smtp-source to test sending 2000 messages at once and i not >>>> getting the results i was hoping for it, after 24 min of running there >>>> are still 1300 messages in the queue. >>>> >>>> is the normal or bad, postfix is a fast mta, i also noticed that >>>> mailscanner scans messages in batches of 30, and it really takes a >>>> long time for the 30 messages to be placed back in the queue. >>>> >>>> vmstat >>>> procs -----------memory---------- ---swap-- -----io---- --system-- >>>> -----cpu------ >>>> ?r ?b ? swpd ? free ? buff ?cache ? si ? so ? ?bi ? ?bo ? in ? cs us >>>> sy id wa st >>>> ?0 ?0 187204 ?43488 ?19036 ?65140 ? ?1 ? ?1 ? ? 7 ? ?23 ? 73 ? ?7 ?5 >>>> 0 94 ?0 ?0 >>>> >>>> again am i asking too much from the hardware or is there something i >>>> can do to increase performance? ' >>>> >>>> i am using a caching dns server and added >>>> >>>> none /var/spool/MailScanner/incoming ? ? ? ? ? ?tmpfs >>>> defaults ? ? ? 0 0 >>>> >>>> in fstab >>>> >>>> __________ Information from ESET NOD32 Antivirus, version of virus >>>> signature database 3982 (20090402) __________ >>>> >>>> The message was checked by ESET NOD32 Antivirus. >>>> >>>> http://www.eset.com >>>> >>>> -- >>>> This message has been scanned for viruses and >>>> dangerous content by MailScanner, and is >>>> believed to be clean. >>>> >>>> ______________________________________________________________________ >>>> -- >>>> MailScanner mailing list >>>> mailscanner@lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >>> -- >>> This message has been scanned for viruses and >>> dangerous content by MailScanner, and is >>> believed to be clean. >>> >>> >>> __________ Information from ESET NOD32 Antivirus, version of virus >>> signature database 3982 (20090402) __________ >>> >>> The message was checked by ESET NOD32 Antivirus. >>> >>> http://www.eset.com >>> >>> >>> >> >> >> __________ Information from ESET NOD32 Antivirus, version of virus >> signature database 3982 (20090402) __________ >> >> The message was checked by ESET NOD32 Antivirus. >> >> http://www.eset.com >> >> >> >> >> -- >> This message has been scanned for viruses and >> dangerous content by MailScanner, and is >> believed to be clean. >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > > > > -- > Martin Hepworth > Oxford, UK > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From carock at epconline.com Thu Apr 2 22:28:05 2009 From: carock at epconline.com (Chuck Rock) Date: Thu Apr 2 22:50:15 2009 Subject: Filter incoming mail from "real name" section of From address. Message-ID: Is there a way to filter the mail based on the "real name" part of the address? I keep getting these stupid MensHealth.com E-mails. The MensHealth.com part is not in the actual E-mail address though. Such as: MensHealth.com [bill@fred.com] I'm not using SpamAssassin, just MailScanner with antivirus. I was hoping for a rule-set or something to tweak for these. Thanks, Chuck From fballuff at atpa.com Thu Apr 2 23:16:17 2009 From: fballuff at atpa.com (Franklin Balluff) Date: Thu Apr 2 23:16:32 2009 Subject: Filename / Filetype Conditions Message-ID: <49D53931.40203@atpa.com> Hello, My company has been using Mailscanner successfully for the last 15 months and I have been able to set conditions in the rulesets which have solved all of our company requirements up to this point. What I have been asked to do is setup a conditional test which, depending on mail address, stripts all message attachments except the intial text 'attachment' which people use for txt, rtf and html cover letters. The reason this is being asked for is there is a concern with certain types of data going through in attachments which legally isn't supposed to be seen by certain parts of the outside world. I can setup filename.rules and filetype.rules which will catch the attachments, but the trouble is, I don't see any option to selectively strip those parts of the message. Allow and deny (with the option to also delete) are the only choices, and they don't strip. They just stop the message in its tracks if any of the conditions are met. This is mailscanner 4.66.5 running on Redhat 4.5 with Sendmail, ClamAv and Spam Assassin. Please help me if you can and make suggestions of what can be done. Thanks, --Franklin Balluff Associated Third Party Administrators Oakland, CA From rcooper at dwford.com Thu Apr 2 23:37:38 2009 From: rcooper at dwford.com (Rick Cooper) Date: Thu Apr 2 23:37:55 2009 Subject: OT: Question In-Reply-To: <49D5230F.6070609@pacific.net> References: <8A01F5DF5A2D42EF854888F41F5FD1A9@SAHOMELT> <49D5230F.6070609@pacific.net> Message-ID: <7217CB2D5DFC460A82A533187E0B1987@SAHOMELT> > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Ken A > Sent: Thursday, April 02, 2009 4:42 PM > To: MailScanner discussion > Subject: Re: OT: Question > > Rick Cooper wrote: > > Just a query regarding bounces: How many of you actually bounce mail > > anymore? I ask this question because I noted a huge number > of rejects on one > > of my servers that appear to be valid bounce attempts to an > address of > > info@mydomain.com for the last week or so. I have an ACL > that looks at the > > local part of recipients and if that local part is being > used it denies the > > message (even null sender) with a message stating there is > no such user and > > it's an address currently being joe-jobbed. I see the same > ips repeatedly > > attempting a bounce for days. > > I've got one: eqnjahdhx@domain.tld. We host the domain, but of course > they don't send the spam. They aren't even aware of it. We are the > joe-jobbed victim. We don't accept the bounces, but they are > annoying, and it's been going on for well over a year. I tightened up > the SPF record, but I don't think that helped much. People > who accept, > then bounce mail will eventually learn, or be buried, I > think. The 550 > error on this one now says "Please dont bounce forged spam". > That hasn't > helped either. It just takes time. > > Ken [...] That is the frustration that I feel. Pick a list having something to do with mail, SA, Exim, pretty much any and you will hear people stating what a waste of time SPF is but when it comes to something like this I would much prefer a DNS txt check over repeatedly trying to send a bounce. And they would be miles ahead because they would have never wasted time taking the mail. I guess nothing works if you don't use it. Rick -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From maillists at conactive.com Fri Apr 3 00:31:16 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Fri Apr 3 00:31:33 2009 Subject: Filter incoming mail from "real name" section of From address. In-Reply-To: References: Message-ID: Chuck Rock wrote on Thu, 2 Apr 2009 21:28:05 +0000 (UTC): > I'm not using SpamAssassin, just MailScanner with antivirus. However, SA is just for that, so use it. Don't abuse other tools for things they were not made for. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From ssilva at sgvwater.com Fri Apr 3 00:32:34 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Fri Apr 3 00:33:07 2009 Subject: OT: Question In-Reply-To: <7217CB2D5DFC460A82A533187E0B1987@SAHOMELT> References: <8A01F5DF5A2D42EF854888F41F5FD1A9@SAHOMELT> <49D5230F.6070609@pacific.net> <7217CB2D5DFC460A82A533187E0B1987@SAHOMELT> Message-ID: on 4-2-2009 3:37 PM Rick Cooper spake the following: > > >> -----Original Message----- >> From: mailscanner-bounces@lists.mailscanner.info >> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Ken A >> Sent: Thursday, April 02, 2009 4:42 PM >> To: MailScanner discussion >> Subject: Re: OT: Question >> >> Rick Cooper wrote: >>> Just a query regarding bounces: How many of you actually bounce mail >>> anymore? I ask this question because I noted a huge number >> of rejects on one >>> of my servers that appear to be valid bounce attempts to an >> address of >>> info@mydomain.com for the last week or so. I have an ACL >> that looks at the >>> local part of recipients and if that local part is being >> used it denies the >>> message (even null sender) with a message stating there is >> no such user and >>> it's an address currently being joe-jobbed. I see the same >> ips repeatedly >>> attempting a bounce for days. >> I've got one: eqnjahdhx@domain.tld. We host the domain, but of course >> they don't send the spam. They aren't even aware of it. We are the >> joe-jobbed victim. We don't accept the bounces, but they are >> annoying, and it's been going on for well over a year. I tightened up >> the SPF record, but I don't think that helped much. People >> who accept, >> then bounce mail will eventually learn, or be buried, I >> think. The 550 >> error on this one now says "Please dont bounce forged spam". >> That hasn't >> helped either. It just takes time. >> >> Ken > > [...] > > That is the frustration that I feel. Pick a list having something to do with > mail, SA, Exim, pretty much any and you will hear people stating what a > waste of time SPF is but when it comes to something like this I would much > prefer a DNS txt check over repeatedly trying to send a bounce. And they > would be miles ahead because they would have never wasted time taking the > mail. > > I guess nothing works if you don't use it. > SPF is only a poor method of anti-spam tool. As a tool to control bounces, it seems to be much better. Another problem with it is many of the server records are set to softfail (~),pass (+), or neutral (?), instead of fail(-) . Even the spf wizard that many people used seems to either set softfail or neutral, and unless you dig in the docs, you wouldn't know any better. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090402/5d9310d3/signature.bin From MailScanner at ecs.soton.ac.uk Fri Apr 3 09:27:00 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Fri Apr 3 09:27:22 2009 Subject: lasso in msgid??? In-Reply-To: References: <49D5C854.4050307@ecs.soton.ac.uk> Message-ID: Not sure what generated that. The MailScanner sources never have contained the word "lasso" as far as I know. On 2/4/09 19:25, Jeff A. Earickson wrote: > Julian, > > I just got this strange syslog message from 4.75.9-2: > > Apr 2 13:33:30 jasper MailScanner[22348]: [ID 702911 mail.info] lasso > in n32HX0XB022152 > > I can send the entrie syslog offline for this message, but what does this > mean? Time to round up the mail messages, brand them, have a rodeo??? > > ----------------------------------- > Jeff A. Earickson, Ph.D > Senior UNIX Sysadmin > Email Administrator > Colby Sports Photographer > Colby College, > 4214 Mayflower Hill, > Waterville ME, 04901-8842 > 207-859-4214 (fax 207-859-4186) > Eastern Time Zone, USA > ----------------------------------- Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Fri Apr 3 09:29:02 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Fri Apr 3 09:29:22 2009 Subject: Filter incoming mail from "real name" section of From address. In-Reply-To: References: <49D5C8CE.8000800@ecs.soton.ac.uk> Message-ID: You can do this in your MTA. Read up on filtering by header content in whatever MTA you're using. I know sendmail can do it, and I'm 99% sure both Postfix and Exim can do it too. On 2/4/09 22:28, Chuck Rock wrote: > Is there a way to filter the mail based on the "real name" part of the address? > > I keep getting these stupid MensHealth.com E-mails. The MensHealth.com part is > not in the actual E-mail address though. > > Such as: MensHealth.com [bill@fred.com] > > I'm not using SpamAssassin, just MailScanner with antivirus. > > I was hoping for a rule-set or something to tweak for these. > > Thanks, > Chuck > > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Fri Apr 3 09:30:39 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Fri Apr 3 09:30:59 2009 Subject: Filename / Filetype Conditions In-Reply-To: <49D53931.40203@atpa.com> References: <49D53931.40203@atpa.com> <49D5C92F.4040604@ecs.soton.ac.uk> Message-ID: I could probably write code for you to do this, but it would have to be a custom job for you, so would cost you some money. If you're still interested once you see a multi-$100 invoice, let me know off-list and I'll see what I can do for you. Jules. On 2/4/09 23:16, Franklin Balluff wrote: > Hello, > > My company has been using Mailscanner successfully for > the last 15 months and I have been able to set > conditions in the rulesets which have solved all of > our company requirements up to this point. > > What I have been asked to do is setup a conditional > test which, depending on mail address, stripts all > message attachments except the intial text > 'attachment' which people use for txt, rtf and html > cover letters. > > The reason this is being asked for is there is a > concern with certain types of data going through > in attachments which legally isn't supposed to be > seen by certain parts of the outside world. > > I can setup filename.rules and filetype.rules which > will catch the attachments, but the trouble is, > I don't see any option to selectively strip those > parts of the message. Allow and deny (with the > option to also delete) are the only choices, and > they don't strip. They just stop the message in > its tracks if any of the conditions are met. > > This is mailscanner 4.66.5 running on Redhat 4.5 > with Sendmail, ClamAv and Spam Assassin. > > Please help me if you can and make suggestions > of what can be done. > > Thanks, > > --Franklin Balluff > Associated Third Party Administrators > Oakland, CA Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From rcooper at dwford.com Fri Apr 3 12:42:14 2009 From: rcooper at dwford.com (Rick Cooper) Date: Fri Apr 3 12:42:30 2009 Subject: OT: Question In-Reply-To: References: <8A01F5DF5A2D42EF854888F41F5FD1A9@SAHOMELT> <49D5230F.6070609@pacific.net><7217CB2D5DFC460A82A533187E0B1987@SAHOMELT> Message-ID: > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf > Of Scott Silva > Sent: Thursday, April 02, 2009 7:33 PM > To: mailscanner@lists.mailscanner.info > Subject: Re: OT: Question > > on 4-2-2009 3:37 PM Rick Cooper spake the following: > > > > > >> -----Original Message----- > >> From: mailscanner-bounces@lists.mailscanner.info > >> [mailto:mailscanner-bounces@lists.mailscanner.info] On > Behalf Of Ken A > >> Sent: Thursday, April 02, 2009 4:42 PM > >> To: MailScanner discussion > >> Subject: Re: OT: Question > >> > >> Rick Cooper wrote: > >>> Just a query regarding bounces: How many of you actually > bounce mail > >>> anymore? I ask this question because I noted a huge number > >> of rejects on one > >>> of my servers that appear to be valid bounce attempts to an > >> address of > >>> info@mydomain.com for the last week or so. I have an ACL > >> that looks at the > >>> local part of recipients and if that local part is being > >> used it denies the > >>> message (even null sender) with a message stating there is > >> no such user and > >>> it's an address currently being joe-jobbed. I see the same > >> ips repeatedly > >>> attempting a bounce for days. > >> I've got one: eqnjahdhx@domain.tld. We host the domain, > but of course > >> they don't send the spam. They aren't even aware of it. We are the > >> joe-jobbed victim. We don't accept the bounces, but they are > >> annoying, and it's been going on for well over a year. I > tightened up > >> the SPF record, but I don't think that helped much. People > >> who accept, > >> then bounce mail will eventually learn, or be buried, I > >> think. The 550 > >> error on this one now says "Please dont bounce forged spam". > >> That hasn't > >> helped either. It just takes time. > >> > >> Ken > > > > [...] > > > > That is the frustration that I feel. Pick a list having > something to do with > > mail, SA, Exim, pretty much any and you will hear people > stating what a > > waste of time SPF is but when it comes to something like > this I would much > > prefer a DNS txt check over repeatedly trying to send a > bounce. And they > > would be miles ahead because they would have never wasted > time taking the > > mail. > > > > I guess nothing works if you don't use it. > > > SPF is only a poor method of anti-spam tool. As a tool to > control bounces, it > seems to be much better. Another problem with it is many of > the server records > are set to softfail (~),pass (+), or neutral (?), instead of > fail(-) . Even > the spf wizard that many people used seems to either set > softfail or neutral, > and unless you dig in the docs, you wouldn't know any better. > I agree, especially since many spammers are publishing SPF records now. But if one just checks and denies outright a hard fail that could help quite a bit. Sites that help you build your records should absolutely make it clear once your setup is tested it should go to -fail. I score ~fail quite high because that is basically a lazy admin. "We are stating the preceding hosts are our only authorized MTAs, but go ahead and accept from everyone else too just in case we haven't done our job". SPF won't stop spam for sure, but if everyone used proper records with a hard fail it could go a long way in eliminating joe-jobs, and forgeries, so why not use it? Same with domain keys, not *the* answer but certainly *A* tool Rick -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From simonmjones at gmail.com Fri Apr 3 14:58:53 2009 From: simonmjones at gmail.com (Simon Jones) Date: Fri Apr 3 14:59:02 2009 Subject: too large Message-ID: <70572c510904030658ka006419hcd7d0265d789886d@mail.gmail.com> Hi Folks, i'm getting a lot of message slipping through mailscanner matching with the spamassassin rule "too large" where is this set and can i edit it? From ka at pacific.net Fri Apr 3 15:13:54 2009 From: ka at pacific.net (Ken A) Date: Fri Apr 3 15:14:14 2009 Subject: OT: Question In-Reply-To: References: <8A01F5DF5A2D42EF854888F41F5FD1A9@SAHOMELT> <49D5230F.6070609@pacific.net><7217CB2D5DFC460A82A533187E0B1987@SAHOMELT> Message-ID: <49D619A2.8080200@pacific.net> Rick Cooper wrote: > > >> -----Original Message----- >> From: mailscanner-bounces@lists.mailscanner.info >> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf >> Of Scott Silva >> Sent: Thursday, April 02, 2009 7:33 PM >> To: mailscanner@lists.mailscanner.info >> Subject: Re: OT: Question >> >> on 4-2-2009 3:37 PM Rick Cooper spake the following: >>> >>> >>>> -----Original Message----- >>>> From: mailscanner-bounces@lists.mailscanner.info >>>> [mailto:mailscanner-bounces@lists.mailscanner.info] On >> Behalf Of Ken A >>>> Sent: Thursday, April 02, 2009 4:42 PM >>>> To: MailScanner discussion >>>> Subject: Re: OT: Question >>>> >>>> Rick Cooper wrote: >>>>> Just a query regarding bounces: How many of you actually >> bounce mail >>>>> anymore? I ask this question because I noted a huge number >>>> of rejects on one >>>>> of my servers that appear to be valid bounce attempts to an >>>> address of >>>>> info@mydomain.com for the last week or so. I have an ACL >>>> that looks at the >>>>> local part of recipients and if that local part is being >>>> used it denies the >>>>> message (even null sender) with a message stating there is >>>> no such user and >>>>> it's an address currently being joe-jobbed. I see the same >>>> ips repeatedly >>>>> attempting a bounce for days. >>>> I've got one: eqnjahdhx@domain.tld. We host the domain, >> but of course >>>> they don't send the spam. They aren't even aware of it. We are the >>>> joe-jobbed victim. We don't accept the bounces, but they are >>>> annoying, and it's been going on for well over a year. I >> tightened up >>>> the SPF record, but I don't think that helped much. People >>>> who accept, >>>> then bounce mail will eventually learn, or be buried, I >>>> think. The 550 >>>> error on this one now says "Please dont bounce forged spam". >>>> That hasn't >>>> helped either. It just takes time. >>>> >>>> Ken >>> [...] >>> >>> That is the frustration that I feel. Pick a list having >> something to do with >>> mail, SA, Exim, pretty much any and you will hear people >> stating what a >>> waste of time SPF is but when it comes to something like >> this I would much >>> prefer a DNS txt check over repeatedly trying to send a >> bounce. And they >>> would be miles ahead because they would have never wasted >> time taking the >>> mail. >>> >>> I guess nothing works if you don't use it. >>> >> SPF is only a poor method of anti-spam tool. As a tool to >> control bounces, it >> seems to be much better. Another problem with it is many of >> the server records >> are set to softfail (~),pass (+), or neutral (?), instead of >> fail(-) . Even >> the spf wizard that many people used seems to either set >> softfail or neutral, >> and unless you dig in the docs, you wouldn't know any better. >> > > > I agree, especially since many spammers are publishing SPF records now. But > if one just checks and denies outright a hard fail that could help quite a > bit. Sites that help you build your records should absolutely make it clear > once your setup is tested it should go to -fail. I score ~fail quite high > because that is basically a lazy admin. "We are stating the preceding hosts > are our only authorized MTAs, but go ahead and accept from everyone else too > just in case we haven't done our job". SPF won't stop spam for sure, but if > everyone used proper records with a hard fail it could go a long way in > eliminating joe-jobs, and forgeries, so why not use it? Same with domain > keys, not *the* answer but certainly *A* tool Why not use it? It's usable only if you understand it, and it can be 'inconvenient' for customers to have to send through a defined list of outgoing servers. ISPs, web hosts, a large number of mail server admins (myself included), cannot set hard fail for most small business domains. Customers expect email to _work_, and they send from a number of locations using a number of systems (work, home, library, college, etc). Setting hard fail will only generate calls to your support desk unless customers understand the implications. Wouldn't it be great if customers read about SPF on the support section of your web site, and were thrilled about it? Reality check... Most customers do not care about SPF, and have no interest in learning about it unless it can benefit them in some immediate way - if their domain is being actively spoofed, for example. In practice, this rarely happens. Ken > > Rick > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- Ken Anderson Pacific Internet - http://www.pacific.net From maxsec at gmail.com Fri Apr 3 16:00:07 2009 From: maxsec at gmail.com (Martin Hepworth) Date: Fri Apr 3 16:00:22 2009 Subject: too large In-Reply-To: <70572c510904030658ka006419hcd7d0265d789886d@mail.gmail.com> References: <70572c510904030658ka006419hcd7d0265d789886d@mail.gmail.com> Message-ID: <72cf361e0904030800u668125cxe5675bc7d0a4be82@mail.gmail.com> Simon more than likely a MailScanner setting.. http://www.mailscanner.info/MailScanner.conf.index.html#MCP%20Max%20SpamAssassin%20Size 2009/4/3 Simon Jones > Hi Folks, > > i'm getting a lot of message slipping through mailscanner matching > with the spamassassin rule "too large" where is this set and can i > edit it? > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- Martin Hepworth Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090403/db91f790/attachment.html From rcooper at dwford.com Fri Apr 3 16:31:33 2009 From: rcooper at dwford.com (Rick Cooper) Date: Fri Apr 3 16:31:50 2009 Subject: OT: Question In-Reply-To: <49D619A2.8080200@pacific.net> References: <8A01F5DF5A2D42EF854888F41F5FD1A9@SAHOMELT> <49D5230F.6070609@pacific.net><7217CB2D5DFC460A82A533187E0B1987@SAHOMELT> <49D619A2.8080200@pacific.net> Message-ID: > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Ken A > Sent: Friday, April 03, 2009 10:14 AM > To: MailScanner discussion > Subject: Re: OT: Question > > Rick Cooper wrote: > > > > > >> -----Original Message----- > >> From: mailscanner-bounces@lists.mailscanner.info > >> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf > >> Of Scott Silva > >> Sent: Thursday, April 02, 2009 7:33 PM > >> To: mailscanner@lists.mailscanner.info > >> Subject: Re: OT: Question > >> > >> on 4-2-2009 3:37 PM Rick Cooper spake the following: > >>> > >>> > >>>> -----Original Message----- > >>>> From: mailscanner-bounces@lists.mailscanner.info > >>>> [mailto:mailscanner-bounces@lists.mailscanner.info] On > >> Behalf Of Ken A > >>>> Sent: Thursday, April 02, 2009 4:42 PM > >>>> To: MailScanner discussion > >>>> Subject: Re: OT: Question > >>>> > >>>> Rick Cooper wrote: > >>>>> Just a query regarding bounces: How many of you actually > >> bounce mail > >>>>> anymore? I ask this question because I noted a huge number > >>>> of rejects on one > >>>>> of my servers that appear to be valid bounce attempts to an > >>>> address of > >>>>> info@mydomain.com for the last week or so. I have an ACL > >>>> that looks at the > >>>>> local part of recipients and if that local part is being > >>>> used it denies the > >>>>> message (even null sender) with a message stating there is > >>>> no such user and > >>>>> it's an address currently being joe-jobbed. I see the same > >>>> ips repeatedly > >>>>> attempting a bounce for days. > >>>> I've got one: eqnjahdhx@domain.tld. We host the domain, > >> but of course > >>>> they don't send the spam. They aren't even aware of it. > We are the > >>>> joe-jobbed victim. We don't accept the bounces, but they are > >>>> annoying, and it's been going on for well over a year. I > >> tightened up > >>>> the SPF record, but I don't think that helped much. People > >>>> who accept, > >>>> then bounce mail will eventually learn, or be buried, I > >>>> think. The 550 > >>>> error on this one now says "Please dont bounce forged spam". > >>>> That hasn't > >>>> helped either. It just takes time. > >>>> > >>>> Ken > >>> [...] > >>> > >>> That is the frustration that I feel. Pick a list having > >> something to do with > >>> mail, SA, Exim, pretty much any and you will hear people > >> stating what a > >>> waste of time SPF is but when it comes to something like > >> this I would much > >>> prefer a DNS txt check over repeatedly trying to send a > >> bounce. And they > >>> would be miles ahead because they would have never wasted > >> time taking the > >>> mail. > >>> > >>> I guess nothing works if you don't use it. > >>> > >> SPF is only a poor method of anti-spam tool. As a tool to > >> control bounces, it > >> seems to be much better. Another problem with it is many of > >> the server records > >> are set to softfail (~),pass (+), or neutral (?), instead of > >> fail(-) . Even > >> the spf wizard that many people used seems to either set > >> softfail or neutral, > >> and unless you dig in the docs, you wouldn't know any better. > >> > > > > > > I agree, especially since many spammers are publishing SPF > records now. But > > if one just checks and denies outright a hard fail that > could help quite a > > bit. Sites that help you build your records should > absolutely make it clear > > once your setup is tested it should go to -fail. I score > ~fail quite high > > because that is basically a lazy admin. "We are stating the > preceding hosts > > are our only authorized MTAs, but go ahead and accept from > everyone else too > > just in case we haven't done our job". SPF won't stop spam > for sure, but if > > everyone used proper records with a hard fail it could go a > long way in > > eliminating joe-jobs, and forgeries, so why not use it? > Same with domain > > keys, not *the* answer but certainly *A* tool > > Why not use it? It's usable only if you understand it, and it can be > 'inconvenient' for customers to have to send through a > defined list of > outgoing servers. > > ISPs, web hosts, a large number of mail server admins (myself > included), > cannot set hard fail for most small business domains. > Customers expect > email to _work_, and they send from a number of locations > using a number > of systems (work, home, library, college, etc). Setting hard > fail will > only generate calls to your support desk unless customers > understand the > implications. > > Wouldn't it be great if customers read about SPF on the > support section > of your web site, and were thrilled about it? Reality check... Most > customers do not care about SPF, and have no interest in > learning about > it unless it can benefit them in some immediate way - if > their domain is > being actively spoofed, for example. In practice, this rarely happens. > > Ken > > > I guess I am doing it wrong then. Our people send from work, home, hotels, etc and nothing that gets sent from one of our addresses passes through any server not listed in our SPF records. People occasionally use poorly written web interfaces that attempt to send email from their (our users's) address but from their (host's) own server and those will be rejected by any SPF enabled MTA. Good... If a email comes from your web form it should be from your domain not mine. Of course as a rule our corporate servers do not do web hosting, as a rule. I do, in fact, have one that hosts for some orgs that our owner is involved in and all the DNS and SPF records are reflective of that. Those people are fully aware that any outbound mails for their domains must be sent through the appropriate host or risk it being rejected by the recipient's MTA. It's a rule, not a recommendation and you have to have those now and then. We also require authentication from our corporate users regardless of where they are sending from (except from one of our webmail services). They are given written instructions as to how to do that with outlook, outlook express, and thunderbird. If they have a problem they call, part of the job. I do not explain domain keys, spf, or any other part of how their mails get from their fingers to the recipient, they wouldn't care anyway. I do explain the rules and expect them to be followed, even by the person who signs my pay check every month. If I were an ISP I would be just as tight. If comcast, Verizon, etc enforced their AUPs our world would be a bit easier. Pretty hard to send spam or perform dictionary attacks from a bot if it can't make port 25, 110, 143 connections outside of the ISPs authorized servers. Of course there would be work involved with maintaining the proper listings, entries reflecting your topology but I would hazard a lot less than there is now trying to keep the bad stuff out of everyone's systems I think one of the basic reason's that malicious mail traffic has never really been addressed is because there are a lot of people out there that seem to get a visceral thrill out of being "spam ninjas". Not me, better things to do. Just my opinion Rick -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From craigwhite at azapple.com Fri Apr 3 16:39:11 2009 From: craigwhite at azapple.com (Craig White) Date: Fri Apr 3 16:39:24 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp Message-ID: <1238773151.2313.159.camel@lin-workstation.azapple.com> # rpm -q mailscanner mailscanner-4.74.16-1 I can't be the only person dealing with this and I'm trying to figure out the best way to handle it. When updating to CentOS 5.3, I ran into conflicts between CentOS perl package and perl-IO & perl-File-Temp packages. so I remove perl-IO & perl-File-Temp packages (and some others, less important) and update moves along. but then I restart MailScanner because of various perl changes and it complains bitterly and won't start... Starting MailScanner daemons: incoming postfix: [ OK ] outgoing postfix: [ OK ] MailScanner: File::Temp version 0.18 required--this is only version 0.16 at /usr/lib/perl5/site_perl/5.8.8/MIME/Tools.pm line 14. BEGIN failed--compilation aborted at /usr/lib/perl5/site_perl/5.8.8/MIME/Tools.pm line 14. Compilation failed in require at /usr/lib/perl5/site_perl/5.8.8/MIME/Parser.pm line 142. BEGIN failed--compilation aborted at /usr/lib/perl5/site_perl/5.8.8/MIME/Parser.pm line 142. Compilation failed in require at /usr/lib/MailScanner/MailScanner/MCPMessage.pm line 41. BEGIN failed--compilation aborted at /usr/lib/MailScanner/MailScanner/MCPMessage.pm line 41. Compilation failed in require at /usr/sbin/MailScanner line 81. BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 81. so I force the installation of perl-IO and perl-File-Temp and things are OK...MailScanner will start. But then CentOS issues another perl update and I have to remove them again to update and force the install again to get MailScanner to run. There has to be a better way than this...this is no way to run a railroad. Craig -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From prandal at herefordshire.gov.uk Fri Apr 3 16:47:12 2009 From: prandal at herefordshire.gov.uk (Randal, Phil) Date: Fri Apr 3 16:47:30 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: <1238773151.2313.159.camel@lin-workstation.azapple.com> References: <1238773151.2313.159.camel@lin-workstation.azapple.com> Message-ID: <7EF0EE5CB3B263488C8C18823239BEBA066264CE@HC-MBX02.herefordshire.gov.uk> I do something like this: service MailScanner stopms rpm -e perl-IO rpm -e perl-Math-BigInt rpm -e perl-Math-BigRat rpm -e perl-bignum rpm -e perl-File-Temp (and any other perl modules it complains about) yum update perl ... Reinstall MailScanner from Julian's install.sh script service MailScanner restart and, to be on the safe side, finish off with a yum update Messy, I know, but it works. Cheers, Phil -- Phil Randal | Networks Engineer Herefordshire Council | Deputy Chief Executive's Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, Hereford, HR2 6JT Tel: 01432 260160 email: prandal@herefordshire.gov.uk Any opinion expressed in this e-mail or any attached files are those of the individual and not necessarily those of Herefordshire Council. This e-mail and any attached files are confidential and intended solely for the use of the addressee. This communication may contain material protected by law from being passed on. If you are not the intended recipient and have received this e-mail in error, you are advised that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender immediately and destroy all copies of it. -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Craig White Sent: 03 April 2009 16:39 To: MailScanner List Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp # rpm -q mailscanner mailscanner-4.74.16-1 I can't be the only person dealing with this and I'm trying to figure out the best way to handle it. When updating to CentOS 5.3, I ran into conflicts between CentOS perl package and perl-IO & perl-File-Temp packages. so I remove perl-IO & perl-File-Temp packages (and some others, less important) and update moves along. but then I restart MailScanner because of various perl changes and it complains bitterly and won't start... Starting MailScanner daemons: incoming postfix: [ OK ] outgoing postfix: [ OK ] MailScanner: File::Temp version 0.18 required--this is only version 0.16 at /usr/lib/perl5/site_perl/5.8.8/MIME/Tools.pm line 14. BEGIN failed--compilation aborted at /usr/lib/perl5/site_perl/5.8.8/MIME/Tools.pm line 14. Compilation failed in require at /usr/lib/perl5/site_perl/5.8.8/MIME/Parser.pm line 142. BEGIN failed--compilation aborted at /usr/lib/perl5/site_perl/5.8.8/MIME/Parser.pm line 142. Compilation failed in require at /usr/lib/MailScanner/MailScanner/MCPMessage.pm line 41. BEGIN failed--compilation aborted at /usr/lib/MailScanner/MailScanner/MCPMessage.pm line 41. Compilation failed in require at /usr/sbin/MailScanner line 81. BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 81. so I force the installation of perl-IO and perl-File-Temp and things are OK...MailScanner will start. But then CentOS issues another perl update and I have to remove them again to update and force the install again to get MailScanner to run. There has to be a better way than this...this is no way to run a railroad. Craig -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Apr 3 16:51:39 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Fri Apr 3 16:51:59 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: <1238773151.2313.159.camel@lin-workstation.azapple.com> References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <49D6308B.7080900@ecs.soton.ac.uk> Message-ID: In a recent version of MailScanner, do a "./install.sh --help". After a few seconds it will print this: Usage: ./install.sh [OPTION]... [VAR=VALUE]... -h, --help display this help and exit nodeps ignore dependencies when installing MailScanner ignore-perl ignore perl versions check fast do not wait for long during installation reinstall force uninstallation of Perl modules before install nomodules do not install required Perl modules Note the "reinstall" option. What you want to do is this. ./install.sh reinstall Then it will uninstall the Perl modules, at which point you "Ctrl-Z" it, run your "yum update" and let your system happily upgrade. Then "fg" to bring the install.sh script back to the foreground and let it complete the install. Net result, a neatly upgraded system without having to fart around manually uninstalling Perl module RPMs. To give you an example, this is what you will see when you run "./install.sh reinstall" after the usual introductory output: ===START=== I think your system will build architecture-dependent modules for x86_64 Deleting all the old versions of your Perl modules, I will re-install them in a minute. Removing perl-Net-CIDR Removing perl-IO-stringy Removing perl-MIME-Base64 Removing perl-TimeDate Removing perl-Pod-Escapes Removing perl-Pod-Simple Removing perl-Test-Simple Removing perl-Test-Pod Removing perl-MailTools Removing perl-IO Removing perl-File-Temp Removing perl-HTML-Tagset Removing perl-HTML-Parser Removing perl-Convert-BinHex Removing perl-MIME-tools Removing perl-Convert-TNEF Removing perl-Compress-Zlib Removing perl-Archive-Zip Removing perl-DBI Removing perl-DBD-SQLite Removing perl-Getopt-Long Removing perl-Time-HiRes Removing perl-Math-BigInt Removing perl-Math-BigRat Removing perl-bignum Removing perl-Net-IP Removing perl-Sys-Hostname-Long Removing perl-Sys-Syslog Removing perl-Digest-SHA1 Removing perl-Net-DNS Removing perl-OLE-Storage_Lite If you want to upgrade your version of Perl, then now is a good time to press Ctrl-Z, upgrade everything, and then continue this script by running the "fg" command. ===END=== Hopefully that's all clear enough that you can see what you need to do. Jules. On 3/4/09 16:39, Craig White wrote: > # rpm -q mailscanner > mailscanner-4.74.16-1 > > I can't be the only person dealing with this and I'm trying to figure > out the best way to handle it. When updating to CentOS 5.3, I ran into > conflicts between CentOS perl package and perl-IO& perl-File-Temp > packages. > > so I remove perl-IO& perl-File-Temp packages (and some others, less > important) and update moves along. > > but then I restart MailScanner because of various perl changes and it > complains bitterly and won't start... > > Starting MailScanner > daemons: > incoming postfix: [ OK ] > outgoing postfix: [ OK ] > MailScanner: File::Temp version 0.18 required--this is > only version 0.16 at /usr/lib/perl5/site_perl/5.8.8/MIME/Tools.pm line > 14. > BEGIN failed--compilation aborted > at /usr/lib/perl5/site_perl/5.8.8/MIME/Tools.pm line 14. > Compilation failed in require > at /usr/lib/perl5/site_perl/5.8.8/MIME/Parser.pm line 142. > BEGIN failed--compilation aborted > at /usr/lib/perl5/site_perl/5.8.8/MIME/Parser.pm line 142. > Compilation failed in require > at /usr/lib/MailScanner/MailScanner/MCPMessage.pm line 41. > BEGIN failed--compilation aborted > at /usr/lib/MailScanner/MailScanner/MCPMessage.pm line 41. > Compilation failed in require at /usr/sbin/MailScanner line 81. > BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 81. > > so I force the installation of perl-IO and perl-File-Temp and things are > OK...MailScanner will start. But then CentOS issues another perl update > and I have to remove them again to update and force the install again to > get MailScanner to run. > > There has to be a better way than this...this is no way to run a > railroad. > > Craig > > > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Fri Apr 3 16:52:26 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Fri Apr 3 16:52:48 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: <7EF0EE5CB3B263488C8C18823239BEBA066264CE@HC-MBX02.herefordshire.gov.uk> References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <7EF0EE5CB3B263488C8C18823239BEBA066264CE@HC-MBX02.herefordshire.gov.uk> <49D630BA.8060804@ecs.soton.ac.uk> Message-ID: On 3/4/09 16:47, Randal, Phil wrote: > Messy, I know, but it works. > Which is why I wrote the "reinstall" option to "./install.sh". Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From craigwhite at azapple.com Fri Apr 3 17:41:58 2009 From: craigwhite at azapple.com (Craig White) Date: Fri Apr 3 17:42:18 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <49D6308B.7080900@ecs.soton.ac.uk> Message-ID: <1238776919.2313.213.camel@lin-workstation.azapple.com> On Fri, 2009-04-03 at 16:51 +0100, Julian Field wrote: > In a recent version of MailScanner, do a "./install.sh --help". > After a few seconds it will print this: > > Usage: ./install.sh [OPTION]... [VAR=VALUE]... > > -h, --help display this help and exit > nodeps ignore dependencies when installing MailScanner > ignore-perl ignore perl versions check > fast do not wait for long during installation > reinstall force uninstallation of Perl modules before install > nomodules do not install required Perl modules > > Note the "reinstall" option. > What you want to do is this. > ./install.sh reinstall > Then it will uninstall the Perl modules, at which point you "Ctrl-Z" it, > run your "yum update" and let your system happily upgrade. Then "fg" to > bring the install.sh script back to the foreground and let it complete > the install. > > Net result, a neatly upgraded system without having to fart around > manually uninstalling Perl module RPMs. > > To give you an example, this is what you will see when you run > "./install.sh reinstall" after the usual introductory output: > > ===START=== > I think your system will build architecture-dependent modules for x86_64 > > Deleting all the old versions of your Perl modules, > I will re-install them in a minute. > > Removing perl-Net-CIDR > Removing perl-IO-stringy > Removing perl-MIME-Base64 > Removing perl-TimeDate > Removing perl-Pod-Escapes > Removing perl-Pod-Simple > Removing perl-Test-Simple > Removing perl-Test-Pod > Removing perl-MailTools > Removing perl-IO > Removing perl-File-Temp > Removing perl-HTML-Tagset > Removing perl-HTML-Parser > Removing perl-Convert-BinHex > Removing perl-MIME-tools > Removing perl-Convert-TNEF > Removing perl-Compress-Zlib > Removing perl-Archive-Zip > Removing perl-DBI > Removing perl-DBD-SQLite > Removing perl-Getopt-Long > Removing perl-Time-HiRes > Removing perl-Math-BigInt > Removing perl-Math-BigRat > Removing perl-bignum > Removing perl-Net-IP > Removing perl-Sys-Hostname-Long > Removing perl-Sys-Syslog > Removing perl-Digest-SHA1 > Removing perl-Net-DNS > Removing perl-OLE-Storage_Lite > > If you want to upgrade your version of Perl, then now is a good time > to press Ctrl-Z, upgrade everything, and then continue this script > by running the "fg" command. > ===END=== > > Hopefully that's all clear enough that you can see what you need to do. > ---- ;-) Seriously Jules...I know you are light years ahead of me on all this but what this means is that I have to shut down MailScanner to update perl, which I have had to do twice this week. When I've got a major update like CentOS 5.3, that's a significant amount of downtime (though I suppose I can break out the perl updates separately, it just adds something else to the hassle factor). and it seems unnecessary to have to rebuild all of the source rpm's when they are already built from the last install process. watching the words "I have to force installation of File-Temp. Sorry." float across the screen is a nice way of saying...deal with it. Craig -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From Kevin_Miller at ci.juneau.ak.us Fri Apr 3 18:58:32 2009 From: Kevin_Miller at ci.juneau.ak.us (Kevin Miller) Date: Fri Apr 3 18:58:51 2009 Subject: OT: Question In-Reply-To: <49D619A2.8080200@pacific.net> References: <8A01F5DF5A2D42EF854888F41F5FD1A9@SAHOMELT> <49D5230F.6070609@pacific.net><7217CB2D5DFC460A82A533187E0B1987@SAHOMELT> <49D619A2.8080200@pacific.net> Message-ID: <4A09477D575C2C4B86497161427DD94C0D10BE2203@CITY-EXCHANGE07.cbj.local> Ken A wrote: > Why not use it? It's usable only if you understand it, and it can be > 'inconvenient' for customers to have to send through a defined list > of outgoing servers. Um, maybe I'm just a lot slower than the rest of you, but I think "It's usable only if you understand it" applies to sendmail/postfix/MailScanner, etc. just as well. That's why we're not being paid minimum wage. This job requires a bit of thinking. If set up right on the back end, there's very little the customer has to do. For a customer to send, they *have* to configure their mail client with an outgoing server. The mail has to be sent somewhere. If they can figure out how to set up their client, what's the problem w/them picking a specific set of email servers? Since most servers are set not to relay, they're limited to a defined set of servers by definition, no? > ISPs, web hosts, a large number of mail server admins (myself > included), cannot set hard fail for most small business domains. > Customers expect email to _work_, and they send from a number of > locations using a number of systems (work, home, library, college, > etc). Setting hard fail will only generate calls to your support desk > unless customers understand the implications. Um, yeah. Not sure what's so hard about that. If I'm off at some remote location I access my email via a web interface. OWA, at work, and my ISP's squirrel mail for home email. Mail sent from there goes out one of my servers and the user neither knows nor cares which. If I needed to send via an interface other than the web I'd configure auth on the mail server. If a user can enter a server name when they configure the client, they can surely enter their username/password in the same configuration dialog. Or am I missing something? > Wouldn't it be great if customers read about SPF on the support > section of your web site, and were thrilled about it? Reality > check... Most customers do not care about SPF, and have no interest > in learning about it unless it can benefit them in some immediate way > - if their domain is being actively spoofed, for example. In > practice, this rarely happens. Users don't need to know about SPF. The mail admin does. When the user gets an account, you give them instructions on setting up their client. In practice, domains are often spoofed. My users are frequently joe-jobbed. I've set SPF to hard fail. None the less, I still see a number of NDRs coming in. One of my users got over 500 of them yesterday. That was an anomaly, but it could have been prevented if the remote servers had just checked my SPF records before accepting and bouncing the mail. Even if people don't publish SPF it is quite easy to check for it, either in spamassassin or a milter. I just don't see what's so impractical about SPF. It's not a cure-all, but it stops a lot of the noise and would stop more with just a little thought and planning. YMMV... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 From MailScanner at ecs.soton.ac.uk Fri Apr 3 19:51:35 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Fri Apr 3 19:52:00 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: <1238776919.2313.213.camel@lin-workstation.azapple.com> References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <49D6308B.7080900@ecs.soton.ac.uk> <1238776919.2313.213.camel@lin-workstation.azapple.com> <49D65AB7.60709@ecs.soton.ac.uk> Message-ID: On 3/4/09 17:41, Craig White wrote: > On Fri, 2009-04-03 at 16:51 +0100, Julian Field wrote: > >> In a recent version of MailScanner, do a "./install.sh --help". >> After a few seconds it will print this: >> >> Usage: ./install.sh [OPTION]... [VAR=VALUE]... >> >> -h, --help display this help and exit >> nodeps ignore dependencies when installing MailScanner >> ignore-perl ignore perl versions check >> fast do not wait for long during installation >> reinstall force uninstallation of Perl modules before install >> nomodules do not install required Perl modules >> >> Note the "reinstall" option. >> What you want to do is this. >> ./install.sh reinstall >> Then it will uninstall the Perl modules, at which point you "Ctrl-Z" it, >> run your "yum update" and let your system happily upgrade. Then "fg" to >> bring the install.sh script back to the foreground and let it complete >> the install. >> >> Net result, a neatly upgraded system without having to fart around >> manually uninstalling Perl module RPMs. >> >> To give you an example, this is what you will see when you run >> "./install.sh reinstall" after the usual introductory output: >> >> ===START=== >> I think your system will build architecture-dependent modules for x86_64 >> >> Deleting all the old versions of your Perl modules, >> I will re-install them in a minute. >> >> Removing perl-Net-CIDR >> Removing perl-IO-stringy >> Removing perl-MIME-Base64 >> Removing perl-TimeDate >> Removing perl-Pod-Escapes >> Removing perl-Pod-Simple >> Removing perl-Test-Simple >> Removing perl-Test-Pod >> Removing perl-MailTools >> Removing perl-IO >> Removing perl-File-Temp >> Removing perl-HTML-Tagset >> Removing perl-HTML-Parser >> Removing perl-Convert-BinHex >> Removing perl-MIME-tools >> Removing perl-Convert-TNEF >> Removing perl-Compress-Zlib >> Removing perl-Archive-Zip >> Removing perl-DBI >> Removing perl-DBD-SQLite >> Removing perl-Getopt-Long >> Removing perl-Time-HiRes >> Removing perl-Math-BigInt >> Removing perl-Math-BigRat >> Removing perl-bignum >> Removing perl-Net-IP >> Removing perl-Sys-Hostname-Long >> Removing perl-Sys-Syslog >> Removing perl-Digest-SHA1 >> Removing perl-Net-DNS >> Removing perl-OLE-Storage_Lite >> >> If you want to upgrade your version of Perl, then now is a good time >> to press Ctrl-Z, upgrade everything, and then continue this script >> by running the "fg" command. >> ===END=== >> >> Hopefully that's all clear enough that you can see what you need to do. >> >> > ---- > ;-) > > Seriously Jules...I know you are light years ahead of me on all this but > what this means is that I have to shut down MailScanner to update perl, > which I have had to do twice this week. You don't *have* to shut down MailScanner in order to do this. There's a fairly small chance it will decide to restart while you do a "./install.sh reinstall fast" which I think you can do. What would you rather I do? You can always subscribe to "MailScanner Gold" available from Fort Systems Ltd at www.fsl.com if you want a smoother upgrade path. It's pretty cheap and avoids these problems. > When I've got a major update > like CentOS 5.3, that's a significant amount of downtime (though I > suppose I can break out the perl updates separately, it just adds > something else to the hassle factor). > I don't upgrade my systems twice in a week :-) > and it seems unnecessary to have to rebuild all of the source rpm's when > they are already built from the last install process. > But if you uninstall them then you have not got the last build, nor can you trust some old files which happen to be lying around. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From ka at pacific.net Fri Apr 3 20:53:10 2009 From: ka at pacific.net (Ken A) Date: Fri Apr 3 20:53:33 2009 Subject: OT: Question In-Reply-To: <4A09477D575C2C4B86497161427DD94C0D10BE2203@CITY-EXCHANGE07.cbj.local> References: <8A01F5DF5A2D42EF854888F41F5FD1A9@SAHOMELT> <49D5230F.6070609@pacific.net><7217CB2D5DFC460A82A533187E0B1987@SAHOMELT> <49D619A2.8080200@pacific.net> <4A09477D575C2C4B86497161427DD94C0D10BE2203@CITY-EXCHANGE07.cbj.local> Message-ID: <49D66926.3080506@pacific.net> Kevin Miller wrote: > Ken A wrote: > >> Why not use it? It's usable only if you understand it, and it can >> be 'inconvenient' for customers to have to send through a defined >> list of outgoing servers. > > Um, maybe I'm just a lot slower than the rest of you, but I think > "It's usable only if you understand it" applies to > sendmail/postfix/MailScanner, etc. just as well. That's why we're > not being paid minimum wage. This job requires a bit of thinking. > If set up right on the back end, there's very little the customer has > to do. For a customer to send, they *have* to configure their mail > client with an outgoing server. The mail has to be sent somewhere. > If they can figure out how to set up their client, what's the problem > w/them picking a specific set of email servers? That is a good question. But I answered it. It's inconvenient. Customers may have more than one ISP, more than one business, more than one domain hosted, parked, here, there, etc. They switch their From: address in their email client depending on many things, but they leave their outgoing server the same. Yes, MUAs could do a better job of tying outgoing mail server to the From: address chosen. Currently, asking customers to _not_ send through some other mail server when they are borrowing a computer, or using their whatever mobile device on some crippled cell network is inconvenient for the customer. ISPs operate on a fairly slim margin these days. Support calls can doom an ISP. If SPF was a silver bullet, it might be worth pushing it on users, but it's not. Ken Since most servers > are set not to relay, they're limited to a defined set of servers by > definition, no? > >> ISPs, web hosts, a large number of mail server admins (myself >> included), cannot set hard fail for most small business domains. >> Customers expect email to _work_, and they send from a number of >> locations using a number of systems (work, home, library, college, >> etc). Setting hard fail will only generate calls to your support >> desk unless customers understand the implications. > > Um, yeah. Not sure what's so hard about that. If I'm off at some > remote location I access my email via a web interface. OWA, at work, > and my ISP's squirrel mail for home email. Mail sent from there goes > out one of my servers and the user neither knows nor cares which. If > I needed to send via an interface other than the web I'd configure > auth on the mail server. If a user can enter a server name when they > configure the client, they can surely enter their username/password > in the same configuration dialog. Or am I missing something? > >> Wouldn't it be great if customers read about SPF on the support >> section of your web site, and were thrilled about it? Reality >> check... Most customers do not care about SPF, and have no interest >> in learning about it unless it can benefit them in some immediate >> way - if their domain is being actively spoofed, for example. In >> practice, this rarely happens. > > Users don't need to know about SPF. The mail admin does. When the > user gets an account, you give them instructions on setting up their > client. > > In practice, domains are often spoofed. My users are frequently > joe-jobbed. I've set SPF to hard fail. None the less, I still see a > number of NDRs coming in. One of my users got over 500 of them > yesterday. That was an anomaly, but it could have been prevented if > the remote servers had just checked my SPF records before accepting > and bouncing the mail. Even if people don't publish SPF it is quite > easy to check for it, either in spamassassin or a milter. > > I just don't see what's so impractical about SPF. It's not a > cure-all, but it stops a lot of the noise and would stop more with > just a little thought and planning. > > YMMV... > > ...Kevin -- Ken Anderson Pacific Internet - http://www.pacific.net From rcooper at dwford.com Fri Apr 3 21:21:52 2009 From: rcooper at dwford.com (Rick Cooper) Date: Fri Apr 3 21:22:11 2009 Subject: OT: Question In-Reply-To: <49D66926.3080506@pacific.net> References: <8A01F5DF5A2D42EF854888F41F5FD1A9@SAHOMELT> <49D5230F.6070609@pacific.net><7217CB2D5DFC460A82A533187E0B1987@SAHOMELT> <49D619A2.8080200@pacific.net><4A09477D575C2C4B86497161427DD94C0D10BE2203@CITY-EXCHANGE07.cbj.local> <49D66926.3080506@pacific.net> Message-ID: > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Ken A > Sent: Friday, April 03, 2009 3:53 PM > To: MailScanner discussion > Subject: Re: OT: Question > > Kevin Miller wrote: > > Ken A wrote: > > > >> Why not use it? It's usable only if you understand it, and it can > >> be 'inconvenient' for customers to have to send through a defined > >> list of outgoing servers. > > > > Um, maybe I'm just a lot slower than the rest of you, but I think > > "It's usable only if you understand it" applies to > > sendmail/postfix/MailScanner, etc. just as well. That's why we're > > not being paid minimum wage. This job requires a bit of thinking. > > If set up right on the back end, there's very little the > customer has > > to do. For a customer to send, they *have* to configure their mail > > client with an outgoing server. The mail has to be sent somewhere. > > If they can figure out how to set up their client, what's > the problem > > w/them picking a specific set of email servers? > > That is a good question. But I answered it. It's > inconvenient. Customers > may have more than one ISP, more than one business, more than > one domain > hosted, parked, here, there, etc. They switch their From: address in > their email client depending on many things, but they leave their > outgoing server the same. Yes, MUAs could do a better job of tying > outgoing mail server to the From: address chosen. > > Currently, asking customers to _not_ send through some other > mail server > when they are borrowing a computer, or using their whatever mobile > device on some crippled cell network is inconvenient for the > customer. > ISPs operate on a fairly slim margin these days. Support > calls can doom > an ISP. If SPF was a silver bullet, it might be worth pushing it on > users, but it's not. > > Ken > [...] Kind of inconvenient to drive sober for some people sometimes too. This is a problem with the open nature of the internet. Don't get me wrong I am not looking for the internet police to appear, but no one wants to do anything about anything. It's inconvenient to pay taxes but I want roads to drive on, bridges that cross rivers, police, fire departments, etc so I have to pay taxes. If every ISP enforced sane security rules within their auspice the net would be a different place today. Every entity that is the authority for a given address space should be responsible to making sure their space is clean. I have no problem with someone running a mail service from their home, their business, etc. But they need to be clean and assigned the privilege by their ISP. If an ISP allows for services to be run they should require the party have a valid domain, a proper DNS (at least symmetrical) and sane server installation. If they get complaints they should shutdown what ever Ips are assigned the given clients until it is demonstrated they have repaired whatever issues they had. I am not saying ask customers to do anything... Make rules and enforce them, people do what is required much more consistantly than what is requested. And, IMHO, any ISP that goes "wild west" and allows "whatever" should not be in business, they are bad for everyone's business. This is normal civil interaction in almost every instance of any community except that of the internet. And BTW, people who sell heroin are just trying to make a buck too... Why should they give a crap what their making a buck does to their communities any more than an ISP who runs a loose ship? Rick > > > Since most servers > > are set not to relay, they're limited to a defined set of servers by > > definition, no? > > > >> ISPs, web hosts, a large number of mail server admins (myself > >> included), cannot set hard fail for most small business domains. > >> Customers expect email to _work_, and they send from a number of > >> locations using a number of systems (work, home, library, college, > >> etc). Setting hard fail will only generate calls to your support > >> desk unless customers understand the implications. > > > > Um, yeah. Not sure what's so hard about that. If I'm off at some > > remote location I access my email via a web interface. > OWA, at work, > > and my ISP's squirrel mail for home email. Mail sent from > there goes > > out one of my servers and the user neither knows nor cares > which. If > > I needed to send via an interface other than the web I'd configure > > auth on the mail server. If a user can enter a server name > when they > > configure the client, they can surely enter their username/password > > in the same configuration dialog. Or am I missing something? > > > >> Wouldn't it be great if customers read about SPF on the support > >> section of your web site, and were thrilled about it? Reality > >> check... Most customers do not care about SPF, and have no interest > >> in learning about it unless it can benefit them in some immediate > >> way - if their domain is being actively spoofed, for example. In > >> practice, this rarely happens. > > > > Users don't need to know about SPF. The mail admin does. When the > > user gets an account, you give them instructions on setting up their > > client. > > > > In practice, domains are often spoofed. My users are frequently > > joe-jobbed. I've set SPF to hard fail. None the less, I > still see a > > number of NDRs coming in. One of my users got over 500 of them > > yesterday. That was an anomaly, but it could have been prevented if > > the remote servers had just checked my SPF records before accepting > > and bouncing the mail. Even if people don't publish SPF it is quite > > easy to check for it, either in spamassassin or a milter. > > > > I just don't see what's so impractical about SPF. It's not a > > cure-all, but it stops a lot of the noise and would stop more with > > just a little thought and planning. > > > > YMMV... > > > > ...Kevin > > > -- > Ken Anderson > Pacific Internet - http://www.pacific.net > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From ka at pacific.net Fri Apr 3 21:58:47 2009 From: ka at pacific.net (Ken A) Date: Fri Apr 3 21:59:10 2009 Subject: OT: Question In-Reply-To: References: <8A01F5DF5A2D42EF854888F41F5FD1A9@SAHOMELT> <49D5230F.6070609@pacific.net><7217CB2D5DFC460A82A533187E0B1987@SAHOMELT> <49D619A2.8080200@pacific.net><4A09477D575C2C4B86497161427DD94C0D10BE2203@CITY-EXCHANGE07.cbj.local> <49D66926.3080506@pacific.net> Message-ID: <49D67887.5000102@pacific.net> Rick Cooper wrote: > > >> -----Original Message----- >> From: mailscanner-bounces@lists.mailscanner.info >> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Ken A >> Sent: Friday, April 03, 2009 3:53 PM >> To: MailScanner discussion >> Subject: Re: OT: Question >> >> Kevin Miller wrote: >>> Ken A wrote: >>> >>>> Why not use it? It's usable only if you understand it, and it can >>>> be 'inconvenient' for customers to have to send through a defined >>>> list of outgoing servers. >>> Um, maybe I'm just a lot slower than the rest of you, but I think >>> "It's usable only if you understand it" applies to >>> sendmail/postfix/MailScanner, etc. just as well. That's why we're >>> not being paid minimum wage. This job requires a bit of thinking. >>> If set up right on the back end, there's very little the >> customer has >>> to do. For a customer to send, they *have* to configure their mail >>> client with an outgoing server. The mail has to be sent somewhere. >>> If they can figure out how to set up their client, what's >> the problem >>> w/them picking a specific set of email servers? >> That is a good question. But I answered it. It's >> inconvenient. Customers >> may have more than one ISP, more than one business, more than >> one domain >> hosted, parked, here, there, etc. They switch their From: address in >> their email client depending on many things, but they leave their >> outgoing server the same. Yes, MUAs could do a better job of tying >> outgoing mail server to the From: address chosen. >> >> Currently, asking customers to _not_ send through some other >> mail server >> when they are borrowing a computer, or using their whatever mobile >> device on some crippled cell network is inconvenient for the >> customer. >> ISPs operate on a fairly slim margin these days. Support >> calls can doom >> an ISP. If SPF was a silver bullet, it might be worth pushing it on >> users, but it's not. >> >> Ken >> > > [...] > > Kind of inconvenient to drive sober for some people sometimes too. This is a > problem with the open nature of the internet. Don't get me wrong I am not > looking for the internet police to appear, but no one wants to do anything > about anything. It's inconvenient to pay taxes but I want roads to drive on, > bridges that cross rivers, police, fire departments, etc so I have to pay > taxes. If every ISP enforced sane security rules within their auspice the > net would be a different place today. Every entity that is the authority for > a given address space should be responsible to making sure their space is > clean. I have no problem with someone running a mail service from their > home, their business, etc. But they need to be clean and assigned the > privilege by their ISP. If an ISP allows for services to be run they should > require the party have a valid domain, a proper DNS (at least symmetrical) > and sane server installation. If they get complaints they should shutdown > what ever Ips are assigned the given clients until it is demonstrated they > have repaired whatever issues they had. Rick, For the record, we do all this and more, as do most ISPs. We walk a line between the net neutrality folks and the DPI guys. Freedom is something with REAL value on the Internet, and it IS in peril. But, ISPs don't have to be draconian to be good netitizens, and it doesn't make them ambivalent if policies don't all line up with your top 10 pet peeves. > > I am not saying ask customers to do anything... Make rules and enforce them, > people do what is required much more consistantly than what is requested. > And, IMHO, any ISP that goes "wild west" and allows "whatever" should not be > in business, they are bad for everyone's business. We are talking about SPF, so I think you are going a little "wild west" with the topic ;-) I hope that my attempt to explain that deficiencies in SPF combined with the inconvenience that is forces on customers is not construed to be a 'whatever' policy. I think we can disagree without that sort of creative extrapolation.. > > This is normal civil interaction in almost every instance of any community > except that of the internet. And BTW, people who sell heroin are just trying > to make a buck too... Why should they give a crap what their making a buck > does to their communities any more than an ISP who runs a loose ship? > Again, we are talking about SPF, which is a bit of a weak attempt at containing a problem that exists due to spammers, not customers. ISPs must choose what to enforce, and what to request of customers based on the /real/ impact. For example, blocking outgoing port 25 traffic from dynamic space is a good thing to do. Blocking 110 and 143, as you suggested earlier is not a good thing to do, at least not for an ISP. The corporate and edu worlds are quite different. Have a nice weekend, Ken > Rick > > >> >> Since most servers >>> are set not to relay, they're limited to a defined set of servers by >>> definition, no? >>> >>>> ISPs, web hosts, a large number of mail server admins (myself >>>> included), cannot set hard fail for most small business domains. >>>> Customers expect email to _work_, and they send from a number of >>>> locations using a number of systems (work, home, library, college, >>>> etc). Setting hard fail will only generate calls to your support >>>> desk unless customers understand the implications. >>> Um, yeah. Not sure what's so hard about that. If I'm off at some >>> remote location I access my email via a web interface. >> OWA, at work, >>> and my ISP's squirrel mail for home email. Mail sent from >> there goes >>> out one of my servers and the user neither knows nor cares >> which. If >>> I needed to send via an interface other than the web I'd configure >>> auth on the mail server. If a user can enter a server name >> when they >>> configure the client, they can surely enter their username/password >>> in the same configuration dialog. Or am I missing something? >>> >>>> Wouldn't it be great if customers read about SPF on the support >>>> section of your web site, and were thrilled about it? Reality >>>> check... Most customers do not care about SPF, and have no interest >>>> in learning about it unless it can benefit them in some immediate >>>> way - if their domain is being actively spoofed, for example. In >>>> practice, this rarely happens. >>> Users don't need to know about SPF. The mail admin does. When the >>> user gets an account, you give them instructions on setting up their >>> client. >>> >>> In practice, domains are often spoofed. My users are frequently >>> joe-jobbed. I've set SPF to hard fail. None the less, I >> still see a >>> number of NDRs coming in. One of my users got over 500 of them >>> yesterday. That was an anomaly, but it could have been prevented if >>> the remote servers had just checked my SPF records before accepting >>> and bouncing the mail. Even if people don't publish SPF it is quite >>> easy to check for it, either in spamassassin or a milter. >>> >>> I just don't see what's so impractical about SPF. It's not a >>> cure-all, but it stops a lot of the noise and would stop more with >>> just a little thought and planning. >>> >>> YMMV... >>> >>> ...Kevin >> >> -- >> Ken Anderson >> Pacific Internet - http://www.pacific.net >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> -- >> This message has been scanned for viruses and >> dangerous content by MailScanner, and is >> believed to be clean. >> >> > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- Ken Anderson Pacific Internet - http://www.pacific.net From maillists at conactive.com Fri Apr 3 22:31:21 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Fri Apr 3 22:31:35 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: <1238773151.2313.159.camel@lin-workstation.azapple.com> References: <1238773151.2313.159.camel@lin-workstation.azapple.com> Message-ID: Craig White wrote on Fri, 03 Apr 2009 08:39:11 -0700: > There has to be a better way than this...this is no way to run a > railroad. Don't install the perl modules in the mailscanner package, you don't need them. The reason for this error is that the MIME-Tools package you installed wants these two rpm packages. The MIME-tools package is not correctly packed for Red Hat/CentOS systems as it requires packages that are part of the installed perl on them (and probably most other distributions, this require should get removed). Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From craigwhite at azapple.com Fri Apr 3 22:37:59 2009 From: craigwhite at azapple.com (Craig White) Date: Fri Apr 3 22:38:13 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: References: <1238773151.2313.159.camel@lin-workstation.azapple.com> Message-ID: <1238794679.2313.252.camel@lin-workstation.azapple.com> On Fri, 2009-04-03 at 23:31 +0200, Kai Schaetzl wrote: > Craig White wrote on Fri, 03 Apr 2009 08:39:11 -0700: > > > There has to be a better way than this...this is no way to run a > > railroad. > > Don't install the perl modules in the mailscanner package, you don't need > them. The reason for this error is that the MIME-Tools package you > installed wants these two rpm packages. The MIME-tools package is not > correctly packed for Red Hat/CentOS systems as it requires packages that > are part of the installed perl on them (and probably most other > distributions, this require should get removed). ---- Thanks...I'll look at that. Jules, comment? Craig -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From craigwhite at azapple.com Fri Apr 3 22:56:52 2009 From: craigwhite at azapple.com (Craig White) Date: Fri Apr 3 22:57:29 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: References: <1238773151.2313.159.camel@lin-workstation.azapple.com> Message-ID: <1238795812.2313.254.camel@lin-workstation.azapple.com> On Fri, 2009-04-03 at 23:31 +0200, Kai Schaetzl wrote: > Craig White wrote on Fri, 03 Apr 2009 08:39:11 -0700: > > > There has to be a better way than this...this is no way to run a > > railroad. > > Don't install the perl modules in the mailscanner package, you don't need > them. The reason for this error is that the MIME-Tools package you > installed wants these two rpm packages. The MIME-tools package is not > correctly packed for Red Hat/CentOS systems as it requires packages that > are part of the installed perl on them (and probably most other > distributions, this require should get removed). ---- that doesn't seem right Kai... # rpm -q --whatrequires perl-MIME-tools mailscanner-4.74.16-1 perl-Convert-TNEF-0.17-2 Craig -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From ssilva at sgvwater.com Fri Apr 3 23:14:14 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Fri Apr 3 23:14:39 2009 Subject: OT: Question In-Reply-To: <49D619A2.8080200@pacific.net> References: <8A01F5DF5A2D42EF854888F41F5FD1A9@SAHOMELT> <49D5230F.6070609@pacific.net><7217CB2D5DFC460A82A533187E0B1987@SAHOMELT> <49D619A2.8080200@pacific.net> Message-ID: on 4-3-2009 7:13 AM Ken A spake the following: > Rick Cooper wrote: >> >> >>> -----Original Message----- >>> From: mailscanner-bounces@lists.mailscanner.info >>> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of >>> Scott Silva >>> Sent: Thursday, April 02, 2009 7:33 PM >>> To: mailscanner@lists.mailscanner.info >>> Subject: Re: OT: Question >>> >>> on 4-2-2009 3:37 PM Rick Cooper spake the following: >>>> >>>> >>>>> -----Original Message----- >>>>> From: mailscanner-bounces@lists.mailscanner.info >>>>> [mailto:mailscanner-bounces@lists.mailscanner.info] On >>> Behalf Of Ken A >>>>> Sent: Thursday, April 02, 2009 4:42 PM >>>>> To: MailScanner discussion >>>>> Subject: Re: OT: Question >>>>> >>>>> Rick Cooper wrote: >>>>>> Just a query regarding bounces: How many of you actually >>> bounce mail >>>>>> anymore? I ask this question because I noted a huge number >>>>> of rejects on one >>>>>> of my servers that appear to be valid bounce attempts to an >>>>> address of >>>>>> info@mydomain.com for the last week or so. I have an ACL >>>>> that looks at the >>>>>> local part of recipients and if that local part is being >>>>> used it denies the >>>>>> message (even null sender) with a message stating there is >>>>> no such user and >>>>>> it's an address currently being joe-jobbed. I see the same >>>>> ips repeatedly >>>>>> attempting a bounce for days. >>>>> I've got one: eqnjahdhx@domain.tld. We host the domain, >>> but of course >>>>> they don't send the spam. They aren't even aware of it. We are the >>>>> joe-jobbed victim. We don't accept the bounces, but they are >>>>> annoying, and it's been going on for well over a year. I >>> tightened up >>>>> the SPF record, but I don't think that helped much. People who >>>>> accept, then bounce mail will eventually learn, or be buried, I >>>>> think. The 550 error on this one now says "Please dont bounce >>>>> forged spam". That hasn't helped either. It just takes time. >>>>> >>>>> Ken >>>> [...] >>>> >>>> That is the frustration that I feel. Pick a list having >>> something to do with >>>> mail, SA, Exim, pretty much any and you will hear people >>> stating what a >>>> waste of time SPF is but when it comes to something like >>> this I would much >>>> prefer a DNS txt check over repeatedly trying to send a >>> bounce. And they >>>> would be miles ahead because they would have never wasted >>> time taking the >>>> mail. >>>> I guess nothing works if you don't use it. >>>> >>> SPF is only a poor method of anti-spam tool. As a tool to control >>> bounces, it >>> seems to be much better. Another problem with it is many of the >>> server records >>> are set to softfail (~),pass (+), or neutral (?), instead of fail(-) >>> . Even >>> the spf wizard that many people used seems to either set softfail or >>> neutral, >>> and unless you dig in the docs, you wouldn't know any better. >>> >> >> >> I agree, especially since many spammers are publishing SPF records >> now. But >> if one just checks and denies outright a hard fail that could help >> quite a >> bit. Sites that help you build your records should absolutely make it >> clear >> once your setup is tested it should go to -fail. I score ~fail quite high >> because that is basically a lazy admin. "We are stating the preceding >> hosts >> are our only authorized MTAs, but go ahead and accept from everyone >> else too >> just in case we haven't done our job". SPF won't stop spam for sure, >> but if >> everyone used proper records with a hard fail it could go a long way in >> eliminating joe-jobs, and forgeries, so why not use it? Same with domain >> keys, not *the* answer but certainly *A* tool > > Why not use it? It's usable only if you understand it, and it can be > 'inconvenient' for customers to have to send through a defined list of > outgoing servers. > > ISPs, web hosts, a large number of mail server admins (myself included), > cannot set hard fail for most small business domains. Customers expect > email to _work_, and they send from a number of locations using a number > of systems (work, home, library, college, etc). Setting hard fail will > only generate calls to your support desk unless customers understand the > implications. > > Wouldn't it be great if customers read about SPF on the support section > of your web site, and were thrilled about it? Reality check... Most > customers do not care about SPF, and have no interest in learning about > it unless it can benefit them in some immediate way - if their domain is > being actively spoofed, for example. In practice, this rarely happens. > Some of my users roam also. But their systems send company mail through company servers. If they have troubles, they vpn into the company network to use the e-mail. Or they use the webmail if they are not on a company PC. Personal mail? Use Yahoo or Gmail or whatever... They don't pay me to get your video joke out to your relatives. So if someone sends a company e-mail with our domain on it, I want it to either go through our servers or fail. There is no grey area here. If it has our domain, but didn't go through our servers, off to the bit bucket to be recycled into useful info. And I have old school executives that think e-mail is point to point like a fax. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090403/378b8119/signature.bin From Kevin_Miller at ci.juneau.ak.us Fri Apr 3 23:38:01 2009 From: Kevin_Miller at ci.juneau.ak.us (Kevin Miller) Date: Fri Apr 3 23:38:18 2009 Subject: OT: Question In-Reply-To: References: <8A01F5DF5A2D42EF854888F41F5FD1A9@SAHOMELT> <49D5230F.6070609@pacific.net><7217CB2D5DFC460A82A533187E0B1987@SAHOMELT> <49D619A2.8080200@pacific.net> Message-ID: <4A09477D575C2C4B86497161427DD94C0D10BE2207@CITY-EXCHANGE07.cbj.local> Scott Silva wrote: > Some of my users roam also. But their systems send company mail > through company servers. If they have troubles, they vpn into the > company network to use the e-mail. Or they use the webmail if they > are not on a company PC. > Personal mail? Use Yahoo or Gmail or whatever... They don't pay me to > get your video joke out to your relatives. > > So if someone sends a company e-mail with our domain on it, I want it > to either go through our servers or fail. There is no grey area here. > If it has our domain, but didn't go through our servers, off to the > bit bucket to be recycled into useful info. And I have old school > executives that think e-mail is point to point like a fax. Yes, exactly. Well said. If it's stamped w/my name you play by my rules. Besides, if a user changes their from address in their client as Ken asserts, I believe it'll fail most of the time unless they hit an open relay, and those are pretty scarce anymore. I'd be really interested to see what these folks are actually doing, and just how many of them would really have a problem. A lot more people are inconvenienced by spam than a few of his customers are by having to specify a valid mail server. But I doubt I'll change his mind... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 From ssilva at sgvwater.com Fri Apr 3 23:58:18 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Fri Apr 3 23:58:38 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: References: <1238773151.2313.159.camel@lin-workstation.azapple.com> Message-ID: on 4-3-2009 2:31 PM Kai Schaetzl spake the following: > Craig White wrote on Fri, 03 Apr 2009 08:39:11 -0700: > >> There has to be a better way than this...this is no way to run a >> railroad. > > Don't install the perl modules in the mailscanner package, you don't need > them. The reason for this error is that the MIME-Tools package you > installed wants these two rpm packages. The MIME-tools package is not > correctly packed for Red Hat/CentOS systems as it requires packages that > are part of the installed perl on them (and probably most other > distributions, this require should get removed). > > Kai > MailScanner complains if perl-IO isn't installed to the proper version. I just ran across that on my test system. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090403/7a66f2b3/signature.bin From ka at pacific.net Sat Apr 4 00:08:53 2009 From: ka at pacific.net (Ken A) Date: Sat Apr 4 00:09:14 2009 Subject: OT: Question In-Reply-To: <4A09477D575C2C4B86497161427DD94C0D10BE2207@CITY-EXCHANGE07.cbj.local> References: <8A01F5DF5A2D42EF854888F41F5FD1A9@SAHOMELT> <49D5230F.6070609@pacific.net><7217CB2D5DFC460A82A533187E0B1987@SAHOMELT> <49D619A2.8080200@pacific.net> <4A09477D575C2C4B86497161427DD94C0D10BE2207@CITY-EXCHANGE07.cbj.local> Message-ID: <49D69705.4020609@pacific.net> Kevin Miller wrote: > Scott Silva wrote: > >> Some of my users roam also. But their systems send company mail >> through company servers. If they have troubles, they vpn into the >> company network to use the e-mail. Or they use the webmail if they >> are not on a company PC. >> Personal mail? Use Yahoo or Gmail or whatever... They don't pay me to >> get your video joke out to your relatives. >> >> So if someone sends a company e-mail with our domain on it, I want it >> to either go through our servers or fail. There is no grey area here. >> If it has our domain, but didn't go through our servers, off to the >> bit bucket to be recycled into useful info. And I have old school >> executives that think e-mail is point to point like a fax. > > Yes, exactly. Well said. If it's stamped w/my name you play by my rules. Besides, if a user changes their from address in their client as Ken asserts, I believe it'll fail most of the time unless they hit an open relay, and those are pretty scarce anymore. I'd be really interested to see what these folks are actually doing, and just how many of them would really have a problem. > > A lot more people are inconvenienced by spam than a few of his customers are by having to specify a valid mail server. But I doubt I'll change his mind... > > ...Kevin Or anyone elses mind about how ISPs should configure spf.. # dig Txt verizon.com _spf.google.com aol.com hotmail.com comcast.net sbcglobal.net directway.com +short "v=spf1 ip4:192.76.80.0/24 ip4:192.76.82.0/24 ip4:192.76.86.0/24 ip4:192.76.84.0/24 ip4:198.23.16.0/24 ip4:199.249.25.0/24 ip4:198.4.8.0/24 ip4:209.241.115.233 ~all" "v=spf1 ip4:216.239.32.0/19 ip4:64.233.160.0/19 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:209.85.128.0/17 ip4:66.102.0.0/20 ip4:74.125.0.0/16 ip4:64.18.0.0/20 ip4:207.126.144.0/20 ?all" "v=spf1 ptr:mx.aol.com ?all" "spf2.0/pra ptr:mx.aol.com ?all" "v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all" "v=spf1 ip4:76.96.28.0/23 ip4:76.96.27.0/24 ip4:76.96.30.0/24 ip4:76.96.59.0/24 ip4:76.96.60.0/23 ip4:76.96.62.0/24 ip4:76.96.68.100 ip4:76.96.68.101 ip4:76.96.68.102 ip4:76.96.68.103 ?all" "v=spf1 include:mx.ovh.com ~all -- Ken Anderson Pacific Internet - http://www.pacific.net From maillists at conactive.com Sat Apr 4 08:31:29 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Sat Apr 4 08:31:43 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: <1238795812.2313.254.camel@lin-workstation.azapple.com> References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <1238795812.2313.254.camel@lin-workstation.azapple.com> Message-ID: Craig White wrote on Fri, 03 Apr 2009 14:56:52 -0700: > that doesn't seem right Kai... sure it does. I didn't say MS doesn't require perl-MIME-tools. I said it doesn't require the perl modules coming with it in the tarball. Everything what is needed can be installed from the CentOS repos and rpmforge. These do not create problems with the base perl package. You installed the perl -MIME-tools from the tarball and that packaging doesn't fit CentOS and requires these packages, although they are already part of the base perl package. The one I have doesn't. d01:~ rpm -q perl-MIME-tools perl-MIME-tools-5.420-2.el5.rf Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From craigwhite at azapple.com Sat Apr 4 16:05:04 2009 From: craigwhite at azapple.com (Craig White) Date: Sat Apr 4 16:05:17 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <1238795812.2313.254.camel@lin-workstation.azapple.com> Message-ID: <1238857504.5411.10.camel@lin-workstation.azapple.com> On Sat, 2009-04-04 at 09:31 +0200, Kai Schaetzl wrote: > Craig White wrote on Fri, 03 Apr 2009 14:56:52 -0700: > > > that doesn't seem right Kai... > > sure it does. I didn't say MS doesn't require perl-MIME-tools. I said it > doesn't require the perl modules coming with it in the tarball. Everything > what is needed can be installed from the CentOS repos and rpmforge. These > do not create problems with the base perl package. You installed the perl > -MIME-tools from the tarball and that packaging doesn't fit CentOS and > requires these packages, although they are already part of the base perl > package. The one I have doesn't. > > d01:~ rpm -q perl-MIME-tools > perl-MIME-tools-5.420-2.el5.rf ---- ah - now it makes sense. I've been struggling with the various perl packages from rpmforge but didn't realize that it was the interaction between rpmforge's packages and the ones installed by mailscanner. I think I finally absorbed the knowledge contained in the clue stick - thanks Craig -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From maillists at conactive.com Sat Apr 4 17:31:52 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Sat Apr 4 17:32:02 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: <1238857504.5411.10.camel@lin-workstation.azapple.com> References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <1238795812.2313.254.camel@lin-workstation.azapple.com> <1238857504.5411.10.camel@lin-workstation.azapple.com> Message-ID: Craig White wrote on Sat, 04 Apr 2009 08:05:04 -0700: > I've been struggling with the various perl packages from rpmforge but > didn't realize that it was the interaction between rpmforge's packages > and the ones installed by mailscanner. I listed all modules that you have to install a few months ago, maybe end of last year. If you search the archives for "yum install" you should probably find the list. After that you just install the mailscanner.rpm and not the install.sh. I see there's now also an option not to install the perl modules. I don't know what extra stuff the install.sh does in that case. I have never found to need it. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From MailScanner at ecs.soton.ac.uk Sat Apr 4 19:51:19 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Sat Apr 4 19:51:38 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: <1238794679.2313.252.camel@lin-workstation.azapple.com> References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <1238794679.2313.252.camel@lin-workstation.azapple.com> <49D7AC27.4060402@ecs.soton.ac.uk> Message-ID: On 3/4/09 22:37, Craig White wrote: > On Fri, 2009-04-03 at 23:31 +0200, Kai Schaetzl wrote: > >> Craig White wrote on Fri, 03 Apr 2009 08:39:11 -0700: >> >> >>> There has to be a better way than this...this is no way to run a >>> railroad. >>> >> Don't install the perl modules in the mailscanner package, you don't need >> them. The reason for this error is that the MIME-Tools package you >> installed wants these two rpm packages. The MIME-tools package is not >> correctly packed for Red Hat/CentOS systems as it requires packages that >> are part of the installed perl on them (and probably most other >> distributions, this require should get removed). >> > ---- > Thanks...I'll look at that. > > Jules, comment? > I always just run the ./install.sh and everything works. If you don't then I can't guarantee what will happen. Feel free to ignore my guidance but don't come running to me if the resulting system doesn't work. :-) Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Sat Apr 4 19:52:56 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Sat Apr 4 19:53:14 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <1238795812.2313.254.camel@lin-workstation.azapple.com> <49D7AC88.6070909@ecs.soton.ac.uk> Message-ID: On 4/4/09 08:31, Kai Schaetzl wrote: > Craig White wrote on Fri, 03 Apr 2009 14:56:52 -0700: > > >> that doesn't seem right Kai... >> > sure it does. I didn't say MS doesn't require perl-MIME-tools. I said it > doesn't require the perl modules coming with it in the tarball. Everything > what is needed can be installed from the CentOS repos and rpmforge. These > do not create problems with the base perl package. You installed the perl > -MIME-tools from the tarball and that packaging doesn't fit CentOS and > requires these packages, although they are already part of the base perl > package. The one I have doesn't. > > d01:~ rpm -q perl-MIME-tools > perl-MIME-tools-5.420-2.el5.rf > That sounds ancient. If you check the ChangeLog on search.cpan.org I think you will find a whole host of bugs fixed since that version. > Kai > > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Sat Apr 4 19:54:30 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Sat Apr 4 19:54:52 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <1238795812.2313.254.camel@lin-workstation.azapple.com> <1238857504.5411.10.camel@lin-workstation.azapple.com> <49D7ACE6.8080908@ecs.soton.ac.uk> Message-ID: On 4/4/09 17:31, Kai Schaetzl wrote: > Craig White wrote on Sat, 04 Apr 2009 08:05:04 -0700: > > >> I've been struggling with the various perl packages from rpmforge but >> didn't realize that it was the interaction between rpmforge's packages >> and the ones installed by mailscanner. >> > I listed all modules that you have to install a few months ago, maybe end > of last year. If you search the archives for "yum install" you should > probably find the list. After that you just install the mailscanner.rpm > and not the install.sh. I see there's now also an option not to install > the perl modules. I don't know what extra stuff the install.sh does in > that case. I have never found to need it. > As I have said before, feel free to ignore my installation script completely. Just don't complain to me when your system doesn't work reliably or you have to do other steps by hand. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From craigwhite at azapple.com Sat Apr 4 20:44:05 2009 From: craigwhite at azapple.com (Craig White) Date: Sat Apr 4 20:44:25 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <1238794679.2313.252.camel@lin-workstation.azapple.com> <49D7AC27.4060402@ecs.soton.ac.uk> Message-ID: <1238874245.5411.88.camel@lin-workstation.azapple.com> On Sat, 2009-04-04 at 19:51 +0100, Julian Field wrote: > > On 3/4/09 22:37, Craig White wrote: > > On Fri, 2009-04-03 at 23:31 +0200, Kai Schaetzl wrote: > > > >> Craig White wrote on Fri, 03 Apr 2009 08:39:11 -0700: > >> > >> > >>> There has to be a better way than this...this is no way to run a > >>> railroad. > >>> > >> Don't install the perl modules in the mailscanner package, you don't need > >> them. The reason for this error is that the MIME-Tools package you > >> installed wants these two rpm packages. The MIME-tools package is not > >> correctly packed for Red Hat/CentOS systems as it requires packages that > >> are part of the installed perl on them (and probably most other > >> distributions, this require should get removed). > >> > > ---- > > Thanks...I'll look at that. > > > > Jules, comment? > > > I always just run the ./install.sh and everything works. If you don't > then I can't guarantee what will happen. Feel free to ignore my guidance > but don't come running to me if the resulting system doesn't work. :-) ---- so have I and it always has. My whining was because CentOS brought out their 5.3 update which included a perl update which we agree causes some issues. So I remove the offending rpm's, update everything, re-install and am functional and then a day later, another perl update came out and the gymnastics had to be repeated. They say that if you want respect for the end result, you never watch how either laws or sausages are made. MailScanner might eventually make the list ;-) Thanks Jules Craig -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From steve.swaney at fsl.com Sat Apr 4 21:44:12 2009 From: steve.swaney at fsl.com (Stephen Swaney) Date: Sat Apr 4 21:44:37 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <1238794679.2313.252.camel@lin-workstation.azapple.com> <49D7AC27.4060402@ecs.soton.ac.uk> Message-ID: <49D7C69C.6030000@fsl.com> Julian Field wrote: > > > On 3/4/09 22:37, Craig White wrote: >> On Fri, 2009-04-03 at 23:31 +0200, Kai Schaetzl wrote: >> >>> Craig White wrote on Fri, 03 Apr 2009 08:39:11 -0700: >>> >>> >>>> There has to be a better way than this...this is no way to run a >>>> railroad. >>>> >>> Don't install the perl modules in the mailscanner package, you don't >>> need >>> them. The reason for this error is that the MIME-Tools package you >>> installed wants these two rpm packages. The MIME-tools package is not >>> correctly packed for Red Hat/CentOS systems as it requires packages >>> that >>> are part of the installed perl on them (and probably most other >>> distributions, this require should get removed). >>> >> ---- >> Thanks...I'll look at that. >> >> Jules, comment? >> > I always just run the ./install.sh and everything works. If you don't > then I can't guarantee what will happen. Feel free to ignore my > guidance but don't come running to me if the resulting system doesn't > work. :-) > > Jules > -------------------------------------- This thread has gone on long enough that I just have to reply. I have used the MailScanner install scripts for more years than I care to remember and can easily count the times I have had a problem with an install or upgrade on less than the number of fingers on one hand. Considering the number of operating systems supported and the complexity of the program, the MailScanner packaging, installation and update scripts are really pretty wizard. Still, MailScanner uses Perl and Perl can be a snarly beast, especially if you have added other applications that loaded other Perl modules or updated the operating system's Perl, or ....... (you get the idea). A lot of things can break Perl module dependencies and there is no way that Julian or any developer can anticipate everything that can happen to your system or guess what you might have added to your system. And let's not even mention the fact that some of us have been known to put an errant shot or two through our own feet :). There are two things you can do to avoid Perl problems. 1. Run a very minimal system. Load nothing that is not absolutely necessary and not required to run a MailScanner email gateway. This will minimize the chances of Perl update problems. And BTW this is just simply a real a good idea for any type of gateway of enterprise infrastructure server. 2. Run MailScanner Gold using our yum repositories. Below is a resend of the MailScanner Gold BETA and Production email That Julian and I sent out a while back. Please close this message now to avoid the commercial or Scroll on to learn more. If you have a spare hour and a VM or spare system you might learn something by trying a MailScanner Gold BETA install. Start with a clean minimal (add NOTHING) install of CentOS / RH 5.x an watch what happens - Steve ------ * What is it? This is a new Yum repository for CentOS 5 i386 and x86_64 only. It will always contain the latest MailScanner beta (4.72.2 at the time of writing) along with SpamAssassin (plus DCC, Razor, DKIM, SPF, IP-Country and Rule2XS plug-ins), ClamAV and all Perl module dependencies. It should be used for beta testing new releases only and should not be used in production. * Why is it different from other repositories? Because it aims to completely eliminate the problem of package conflicts and to make installations and upgrades as simple as possible. These rpms provide an automatic configuration that contains the regular tuning tips that would be unfamiliar to those who do not have in-depth knowledge of MailScanner and it's configuration. This significantly reduces the amount of time it takes to do an installation. From start to finish, the installation and configuration of all packages takes less than five minutes on a reasonably fast network. Package conflicts are avoided by creating a new RPM namespace for all the Perl modules required by MailScanner and SpamAssassin and by installing all Perl modules (except SpamAssassin) in /opt/fsl/lib/perl5. This allows the Perl system libraries to be totally independent so they can be updated by the operating system vendor without the possibility of breaking MailScanner or SpamAssassin. Automatic configuration is achieved by using RPM 'triggers' which allow the installation, upgrade or un-installation of one package trigger to access an action specified by another package. For example - when 're2c' is installed, the fsl-spamassassin package runs a trigger that automatically runs 'sa-update' and 'sa-compile' to get the latest rules and compile them and then automatically enables the 'Rule2XSBody' plug-in in v320.pre, subsequently if 're2c' is uninstalled, then the plug-in is automatically disabled. * Installation procedure Ideally it should be installed onto a server with a fresh minimal installation of CentOS/RHEL 5. This will allow the operating system and all MailScanner related applications to be safely updated by simply running `yum -y update`. If you want the MailScanner package to automatically mount the MailScanner incoming directory on tmpfs then run the following command before starting the installation: export MAILSCANNER_CREATE_TMPFS=1 Then simply run: wget http://yum.fslupdate.com/fsl-beta/fsl-beta.repo -O /etc/yum.repos.d/fsl-beta.repo yum -y groupinstall MailScannerGold export PERL5LIB=/opt/fsl/lib/perl5 Once all the packages are installed, the only configuration required is to MailScanner.conf, Sendmail (/etc/mail/access, /etc/mail/mailertable) and then enable and start them both by running: chkconfig MailScanner on service MailScanner start * Installing over an existing RPM based installation This is no different to the procedure above - except you should back-up your MailScanner and SpamAssassin configuration first as a precaution. The 'stock' MailScanner package has no automatic upgrade procedure you will need to manually run upgrade_MailScanner_conf and/or upgrade_languages_conf if any rpmnew files are created by the new package. * Support Sign-up for the fsl-beta support list at http://listserv.fsl.com/mailman/listinfo/fsl-mailscanner-beta. The use of the repository is entirely unsupported by FSL, so use is at your own risk - however we will be happy to answer and questions about the repository or packages on the fsl-beta list. * MailScannerGold PRODUCTION The MailScannerGold Production yum repository will be available in a few days. We'll post another announcement when it's available for subscription and downloading. Initial pricing for the production version subscription is a monthly fee of $45 / month for the first gateway and $30 / per month for each additional gateway. This should help us to recover our costs for development and maintenance while at the same time costing sites less that the salaries required for administrators to fully maintain and update the MailScanner systems. Support for MailScannerGold PRODUCTION will provided by a subscribers supported and FSL moderated email list. Subscribers to the service will also be able to obtain FSL support services at our standard hourly rates less a 25% discount. These repositories should make installing, running and updating MailScanner a lot easier for both newbes and experienced mail administrators. Jules -- Julian Field MEng CITP CEng Chief Technical Officer Fort Systems Ltd. Steve -- Steve Swaney President Fort Systems Ltd. www.fsl.com -------------- next part -------------- A non-text attachment was scrubbed... Name: steve_swaney.vcf Type: text/x-vcard Size: 305 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090404/a87d7dc2/steve_swaney.vcf From craigwhite at azapple.com Sun Apr 5 00:38:12 2009 From: craigwhite at azapple.com (Craig White) Date: Sun Apr 5 00:38:27 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <1238795812.2313.254.camel@lin-workstation.azapple.com> <1238857504.5411.10.camel@lin-workstation.azapple.com> <49D7ACE6.8080908@ecs.soton.ac.uk> Message-ID: <1238888292.5411.93.camel@lin-workstation.azapple.com> On Sat, 2009-04-04 at 19:54 +0100, Julian Field wrote: > > On 4/4/09 17:31, Kai Schaetzl wrote: > > Craig White wrote on Sat, 04 Apr 2009 08:05:04 -0700: > > > > > >> I've been struggling with the various perl packages from rpmforge but > >> didn't realize that it was the interaction between rpmforge's packages > >> and the ones installed by mailscanner. > >> > > I listed all modules that you have to install a few months ago, maybe end > > of last year. If you search the archives for "yum install" you should > > probably find the list. After that you just install the mailscanner.rpm > > and not the install.sh. I see there's now also an option not to install > > the perl modules. I don't know what extra stuff the install.sh does in > > that case. I have never found to need it. > > > As I have said before, feel free to ignore my installation script > completely. Just don't complain to me when your system doesn't work > reliably or you have to do other steps by hand. ---- OK - for the 1st time I used the 'reinstall' options as you outlined - very slick... thanks Craig -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From jdustin at usm.maine.edu Mon Apr 6 16:47:46 2009 From: jdustin at usm.maine.edu (Jon Dustin) Date: Mon Apr 6 16:48:23 2009 Subject: HTML form scanning? Message-ID: <49D9EBE20200008D0001977D@uct5.uct.usm.maine.edu> Greetings - I have MailScanner v4.74.16-1 running on a few SLES boxes. Hopefully this is "recent enough" for most features. This morning an "interesting" mailfile slipped through MS: http://pastebin.com/mfeceab6 If you care to decode the base64 attachment, it is an HTML form that appears to take much of its content from Visa, with one key change: form name="frm" action="http://vatamu.org/vbv/w.php" method="post" onsubmit="return valFrm()" If I'm not mistaken, this is trying to redirect the user's credit card details to vatamu.org. Should this message have been flagged? Or at least been marked in the HTML-part as "fraud attempt"? Or is the encoded-part throwing off MS? Thanks for any assistance/suggestions you may be able to provide. -- Jon Dustin - Network Specialist University of Southern Maine Portland, ME 207-780-4152 From jimc at laridian.com Mon Apr 6 17:17:39 2009 From: jimc at laridian.com (Jim Coates) Date: Mon Apr 6 17:20:38 2009 Subject: Easiest way to upgrade MailScanner on FreeBSD? Message-ID: <02e101c9b6d3$34e705c0$6501a8c0@zorak> Good morning all.. Please excuse this "beginner" question, but I am in the process of moving one of my mail servers and thought this would be a perfect time to upgrade MailScanner to the latest and greatest. I am running FreeBSD and installed MailScanner originally from ports. I would like to know the best/easiest way to upgrade MailScanner to the latest version. Any advice would be helpful. Thank you much. Jim Coates -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090406/773c5d07/attachment.html From drew.marshall at trunknetworks.com Mon Apr 6 23:19:09 2009 From: drew.marshall at trunknetworks.com (Drew Marshall) Date: Mon Apr 6 23:19:27 2009 Subject: Easiest way to upgrade MailScanner on FreeBSD? In-Reply-To: <20090406162230.F246C17008@out-b.mx.mail-launder.com> References: <20090406162230.F246C17008@out-b.mx.mail-launder.com> Message-ID: <200904062219.n36MJIkn028796@safir.blacknight.ie> On 6 Apr 2009, at 17:17, Jim Coates wrote: > Good morning all.. > > Please excuse this "beginner" question, but I am in the process of > moving one of my mail servers and thought this would be a perfect > time to upgrade MailScanner to the latest and greatest. > > I am running FreeBSD and installed MailScanner originally from ports. > > I would like to know the best/easiest way to upgrade MailScanner to > the latest version. > > Any advice would be helpful. Well if you don't mind the bleeding edge too much, I have attached my own port directory for the latest beta (I run a lot of Macs so need the MIME support in the latest beta). It might not be quite as good the one that Jan-Peter officially puts together but he is so busy at the moment the port is quite old. Just untar the file in /usr/ports/mail and overwrite the mailscanner directory. Once there, proceed as normal. Normal caveats apply but it's working fine on my boxes. Drew -------------- next part -------------- Skipped content of type multipart/mixed From nick at inticon.net.au Tue Apr 7 06:35:11 2009 From: nick at inticon.net.au (Nick Brown) Date: Tue Apr 7 06:35:28 2009 Subject: SpamScore + Custom Functions Message-ID: <49DAE60F.3070707@inticon.net.au> Hi All, Quick question, I'm in the process of building out a new MailScanner MX cluster, and in past lives have always used SQLSpamScores + SQLBlackWhitelist perl files provided by MailWatch to give us a SQL Backend to which we then have our own frontend. The problem is - and you will have to excuse me if this should be to the MailWatch list as oposed to MailScanner - that the DB entries, Ie. High + Low scores are only loaded each time MailScanner is reloaded - we can prove this by enabling MySQL Query Logging and sending an email - there is no lookup made to the Scores table at all. I am sure this was not always the case - however I can't see any reference to it in the changelog. Can someone advise if I am doing something wrong or if I am losing my memory :-) Looking at the Perl files themselves it does appear that they are written to load the list in one big hit, however I can also remember someone getting up me once before for cron'ing a reload every hour, as this really does seem like a poor way to solve the issue. Many thanks in advance. Nick. From J.Ede at birchenallhowden.co.uk Tue Apr 7 07:57:01 2009 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Tue Apr 7 07:57:22 2009 Subject: SpamScore + Custom Functions In-Reply-To: <49DAE60F.3070707@inticon.net.au> References: <49DAE60F.3070707@inticon.net.au> Message-ID: <1213490F1F316842A544A850422BFA961C1528E1@BHLSBS.bhl.local> > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- > bounces@lists.mailscanner.info] On Behalf Of Nick Brown > Sent: 07 April 2009 06:35 > To: mailscanner@lists.mailscanner.info > Subject: SpamScore + Custom Functions > > Hi All, > > Quick question, I'm in the process of building out a new MailScanner MX > cluster, and in past lives have always used SQLSpamScores + > SQLBlackWhitelist perl files provided by MailWatch to give us a SQL > Backend to which we then have our own frontend. > > The problem is - and you will have to excuse me if this should be to > the > MailWatch list as oposed to MailScanner - that the DB entries, Ie. High > + Low scores are only loaded each time MailScanner is reloaded - we can > prove this by enabling MySQL Query Logging and sending an email - there > is no lookup made to the Scores table at all. I am sure this was not > always the case - however I can't see any reference to it in the > changelog. Can someone advise if I am doing something wrong or if I am > losing my memory :-) The lists are loaded at startup, and are then re-loaded periodically as I can see the reloading every so often in my logfile... I can't remember how often, but someone is bound to come along to say how often it is, but I'm almost certain that you can change it in the perl files if you look. Jason > Looking at the Perl files themselves it does appear that they are > written to load the list in one big hit, however I can also remember > someone getting up me once before for cron'ing a reload every hour, as > this really does seem like a poor way to solve the issue. > > Many thanks in advance. > > Nick. > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From jvoorhees1 at gmail.com Tue Apr 7 13:10:08 2009 From: jvoorhees1 at gmail.com (Jose Perez) Date: Tue Apr 7 13:10:18 2009 Subject: MailScanner archive question Message-ID: Hi People: I'm using MailScanner 4.74.16 with Archiving feature like this: Archive Mail = Archive Mail = %rules-dir%/mail.archiving.rules The content of %rules-dir%/mail.archiving.rules is this: To: *@mydomain.com /var/spool/MailScanner/archive/mydomain.com/_TOUSER_/_DATE_/Received From: *@mydomain.com /var/spool/MailScanner/archive/mydomain.com/_FROMUSER_/_DATE_/Sent This is working fine, all mydomain.com users that send and receive e-mail are getting their messages archived but MailScanner it's doing something I believe is wrong. Only when some external user (some user at Internet, outside mydomain.com) sends a message to somebody of mydomain.com with CC (copies) to other people of external domains (i.e hotmail.com, yahoo.com) then MailScanner is creating also a directory under /var/spool/MailScanner/archive/mydomain.com/ with the name (only user part without @domain.com) of those users who received the copies but aren't mydomain.com, so I'm seeing how now exists more directories than users of mydomain.com under /var/spool/MailScanner/archive/mydomain.com/ I mean, if jvoorhees1@gmail.com send a message to admin@mydomain.com with CC to bgates@hotmail.com then MailScanner creates the file Received under the /var/spool/MailScanner/archive/mydomain.com/bgates/20090326/ How can I prevent MailScanner of creating directories of external users? I hope someone can give me some advice, thanks. Bye! From MailScanner at ecs.soton.ac.uk Tue Apr 7 13:33:14 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 7 13:33:37 2009 Subject: MailScanner archive question In-Reply-To: References: <49DB480A.7000208@ecs.soton.ac.uk> Message-ID: "To" and "Cc" users are identical from MailScanner's point of view. MailScanner doesn't use the contents of the "To" or "From" or "Cc" headers at all, it looks at the real recipients and senders of the message, which is all stored in the envelope. So your rules will store the mail in all directories corresponding to every recipient of the messages, not just the ones that happen to be in your domain. The rule will fire if *any* recipient is in your domain, and will cause the message to be stored in the directory for *every* recipient. So if you use To *@mydomain.com /var/spool/MailScanner/archive/_TODOMAIN_/_TO_USER_/_DATE_/Received then it will be stored in a separate directory for each domain. If you are not interested in any except those where _TODOMAIN_ == mydomain.com, then just delete those directories every day on a cron job. On 7/4/09 13:10, Jose Perez wrote: > Hi People: > > I'm using MailScanner 4.74.16 with Archiving feature like this: > > Archive Mail = Archive Mail = %rules-dir%/mail.archiving.rules > > The content of %rules-dir%/mail.archiving.rules is this: > > To: *@mydomain.com > /var/spool/MailScanner/archive/mydomain.com/_TOUSER_/_DATE_/Received > From: *@mydomain.com > /var/spool/MailScanner/archive/mydomain.com/_FROMUSER_/_DATE_/Sent > > This is working fine, all mydomain.com users that send and receive > e-mail are getting their messages archived but MailScanner it's doing > something I believe is wrong. > > Only when some external user (some user at Internet, outside > mydomain.com) sends a message to somebody of mydomain.com with CC > (copies) to other people of external domains (i.e hotmail.com, > yahoo.com) then MailScanner is creating also a directory under > /var/spool/MailScanner/archive/mydomain.com/ with the name (only user > part without @domain.com) of those users who received the copies but > aren't mydomain.com, so I'm seeing how now exists more directories > than users of mydomain.com under > /var/spool/MailScanner/archive/mydomain.com/ > > I mean, if jvoorhees1@gmail.com send a message to admin@mydomain.com > with CC to bgates@hotmail.com then MailScanner creates the file > Received under the > /var/spool/MailScanner/archive/mydomain.com/bgates/20090326/ > > How can I prevent MailScanner of creating directories of external users? > > I hope someone can give me some advice, thanks. Bye! > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From carock at epconline.com Tue Apr 7 15:43:38 2009 From: carock at epconline.com (Chuck Rock) Date: Tue Apr 7 15:44:02 2009 Subject: Filter incoming mail from References: Message-ID: Kai Schaetzl conactive.com> writes: > > Chuck Rock wrote on Thu, 2 Apr 2009 21:28:05 +0000 (UTC): > > > I'm not using SpamAssassin, just MailScanner with antivirus. > > However, SA is just for that, so use it. Don't abuse other tools for > things they were not made for. > > Kai > I can't overload these boxes with extra scanning. MailScanner/Sendmail is maxing out CPU and memory and adding SA will make them backlog mail for scanning until there's no possible way to catch up. They scan about 100 msgs per second and get hit with 1000 messages a second sometimes. These are quad Xeon boxes with 6 Gig RAM running clamd and MailScanner 4.61.7. Running clamscan instead of clamd used too much CPU for them to keep up. I have two identical boxes running with round robin and about once per year, they will get hit so hard I have to take one out of service to catch up over 12 hours or so. I can't realistically add another process to the cpu unless it's going to make up for it somewhere else. Thanks, Chuck p.s. bottom posting sucks From J.Ede at birchenallhowden.co.uk Tue Apr 7 16:18:11 2009 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Tue Apr 7 16:18:32 2009 Subject: Filter incoming mail from In-Reply-To: References: Message-ID: <1213490F1F316842A544A850422BFA961C152941@BHLSBS.bhl.local> > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- > bounces@lists.mailscanner.info] On Behalf Of Chuck Rock > Sent: 07 April 2009 15:44 > To: mailscanner@lists.mailscanner.info > Subject: Re: Filter incoming mail from > > Kai Schaetzl conactive.com> writes: > > > > > > Chuck Rock wrote on Thu, 2 Apr 2009 21:28:05 +0000 (UTC): > > > > > I'm not using SpamAssassin, just MailScanner with antivirus. > > > > However, SA is just for that, so use it. Don't abuse other tools for > > things they were not made for. > > > > Kai > > > I can't overload these boxes with extra scanning. MailScanner/Sendmail > is > maxing out CPU and memory and adding SA will make them backlog mail for > scanning until there's no possible way to catch up. > > They scan about 100 msgs per second and get hit with 1000 messages a > second > sometimes. These are quad Xeon boxes with 6 Gig RAM running clamd and > MailScanner 4.61.7. Running clamscan instead of clamd used too much CPU > for > them to keep up. I have two identical boxes running with round robin > and about > once per year, they will get hit so hard I have to take one out of > service to > catch up over 12 hours or so. I can't realistically add another process > to the > cpu unless it's going to make up for it somewhere else. > > Thanks, > Chuck Have you tried limited the emails that get accepted for scanning by using RBLS such as Spamhaus, Spamcop etc? or using filters such as recipient verification or greylisting to cut down the emails? It makes a massive difference if you don't accept emails for invalid addresses or use greylisting to put off some of the spambots. > p.s. bottom posting sucks > You run the risk of starting a war with comments like that on here.. Jason From maxsec at gmail.com Tue Apr 7 16:22:36 2009 From: maxsec at gmail.com (Martin Hepworth) Date: Tue Apr 7 16:22:45 2009 Subject: Filter incoming mail from In-Reply-To: References: Message-ID: <72cf361e0904070822y5e81b141x1029e534e0bfca@mail.gmail.com> 2009/4/7 Chuck Rock > Kai Schaetzl conactive.com> writes: > > > > > > Chuck Rock wrote on Thu, 2 Apr 2009 21:28:05 +0000 (UTC): > > > > > I'm not using SpamAssassin, just MailScanner with antivirus. > > > > However, SA is just for that, so use it. Don't abuse other tools for > > things they were not made for. > > > > Kai > > > I can't overload these boxes with extra scanning. MailScanner/Sendmail is > maxing out CPU and memory and adding SA will make them backlog mail for > scanning until there's no possible way to catch up. > > They scan about 100 msgs per second and get hit with 1000 messages a second > sometimes. These are quad Xeon boxes with 6 Gig RAM running clamd and > MailScanner 4.61.7. Running clamscan instead of clamd used too much CPU for > them to keep up. I have two identical boxes running with round robin and > about > once per year, they will get hit so hard I have to take one out of service > to > catch up over 12 hours or so. I can't realistically add another process to > the > cpu unless it's going to make up for it somewhere else. > > Thanks, > Chuck > > p.s. bottom posting sucks > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > I'd look at using Barricade MX from those nice folks at FSL to reduce the load on the servers. I'd also think about adding in more boxes - ideally if you loose a box the others should be able to cope with the load and in you're current situation I doubt that is the case. Did I mention upgrading MailScanner also - there's a fair bit of speed up in there, but alot of it is related to SA speed-ups and better clamd support and the watermarking support. How are you spam trapping these emails - just relying on RBLs or don't you bother? -- Martin Hepworth Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090407/d1a10207/attachment.html From maillists at conactive.com Tue Apr 7 16:31:24 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Tue Apr 7 16:31:40 2009 Subject: HTML form scanning? In-Reply-To: <49D9EBE20200008D0001977D@uct5.uct.usm.maine.edu> References: <49D9EBE20200008D0001977D@uct5.uct.usm.maine.edu> Message-ID: Jon Dustin wrote on Mon, 06 Apr 2009 11:47:46 -0400: > If you care to decode the base64 attachment, it is an HTML form that > appears to take much of its content from Visa, with one key change: > > form name="frm" action="http://vatamu.org/vbv/w.php" method="post" onsubmit="return valFrm()" > > If I'm not mistaken, this is trying to redirect the user's credit card details to vatamu.org. Well, not "redirect", this is very "direct" ;-) > > Should this message have been flagged? Or at least been marked in the HTML-part as "fraud attempt"? No. The phishing detection compares the target of links with the content of links (e.g. what is dispalyed to the user). There is nothing that could be compared against this forms action. I personally think that forms don't have anything to do in mail, so one should be able to "disarm" them. I don't know if the disarming functions in MailScanner already do this. Have you actually tried in a mail program to use it? Most recent programs don't show any external content by default, so if that page pulls in images from visa these would normally not show. I don't know if posting the form would be considered "external" (I would), so posting may work or not. > > Or is the encoded-part throwing off MS? I don't think so, but Julian knows for sure. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Tue Apr 7 16:31:24 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Tue Apr 7 16:31:40 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <1238795812.2313.254.camel@lin-workstation.azapple.com> <49D7AC88.6070909@ecs.soton.ac.uk> Message-ID: Julian Field wrote on Sat, 04 Apr 2009 19:52:56 +0100: > That sounds ancient. If you check the ChangeLog on search.cpan.org I > think you will find a whole host of bugs fixed since that version. Who says that the important fixes are not in that version? The point about enterprise distributions is that you keep a reliable system for a long time that also gets security and serious bug fixes over this time. What you are doing with your install script is about the same you did 5 or more years ago. It may have been necessary back then. Nowadays the major distributions are equipped with decent Perl support and with a slew of the most important modules. And most other modules are usually available as rpms from an external repository that specializes in that distribution. Forcing rpms on top of the existing perl installation and included modules is definitely something that one should not do. And it's easily avoidable. > As I have said before, feel free to ignore my installation script > completely. Just don't complain to me when your system doesn't work > reliably or you have to do other steps by hand. I've been using MailScanner now for more than 5 years, Julian. Have you seen any perl or installation related problems posted by me? I'm rarely having any problem. This is due to your superb work and because I'm very careful about what and how I put it on my machines. My MailScanners work fine and my perl works fine, too. Without forcing any newer modules over the ones coming with the distribution. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From glenn at mail.txwes.edu Tue Apr 7 20:21:13 2009 From: glenn at mail.txwes.edu (Glenn) Date: Tue Apr 7 20:22:02 2009 Subject: How to Remove X-headers In-Reply-To: <49BD044D.9090707@ecs.soton.ac.uk> References: <20090311214836.M92789@mail.txwes.edu> <49B84106.6070201@alexb.ch> <49B8CA22.3080202@waversveld.nl> <20090312135558.M65770@mail.txwes.edu> <20090312141015.M36577@mail.txwes.edu> <49B91A8C.2030409@ecs.soton.ac.uk> <49B91EF3.4070709@ecs.soton.ac.uk> <20090312144756.M75784@mail.txwes.edu> <49B927A7.3030105@ecs.soton.ac.uk> <49B92CBC.1000905@ecs.soton.ac.uk> <20090313125948.M75170@mail.txwes.edu> <49BD044D.9090707@ecs.soton.ac.uk> Message-ID: <20090407185014.M46324@mail.txwes.edu> I finally got back to this a few days ago. Took the opportunity to build a new mail gateway using Red Hat EL5, Sendmail, milter-greylist, ClamAV and MailScanner 4.75.9-2. Everything works great, so I'm about ready to try removing some X-headers. Only one question -- would removing all X-headers mess up MailScanner? After all, MailScanner does put some X-headers in, right? We do have a downstream server running MailScanner (unnecessarily now), but I'm mainly concerned with the gateway server itself. I suppose Exchange 2003 might rely on some X-headers coming through. If anyone can think of some, do tell. Thanks. -Glenn. ---------- Original Message ----------- From: Julian Field To: MailScanner discussion Sent: Sun, 15 Mar 2009 13:36:13 +0000 Subject: Re: How to Remove X-headers > I have found and fixed that bug. Missed out a $pos++ in a loop exit > condition. > Please try 4.75.9-2. > > Cheers, > Jules. > > On 13/3/09 13:05, Glenn wrote: > > Julian - Thanks very much for adding this functionality. I tried upgrading > > our Red Hat EL4/Postfix machines, and the new version stopped mail flow > > altogether. I have gone back to the older version (4.73.4-2) until I can > > figure out what went wrong. -Glenn. > > > > > > ---------- Original Message ----------- > > From: Julian Field > > To: MailScanner discussion > > Sent: Thu, 12 Mar 2009 15:39:40 +0000 > > Subject: Re: How to Remove X-headers > > > > > >> -----BEGIN PGP SIGNED MESSAGE----- > >> Hash: SHA1 > >> > >> On the basis that sounds fairly sensible and appears to provide the > >> flexibility people are after, I have written and released it as 4.75.9. > >> > >> There is new text near the start of the description of "Remove These > >> Headers" which says this: > >> > >> # This is a space-separated list of a mixture of any combination of > >> # 1. Names of headers, optionally ending with a ':' > >> # (the ':' will be added if not supplied) > >> # 2. Regular expressions starting and ending with a '/'. > >> # These regular expressions are matched against the entire header line, > >> # not just the name of the header. > >> # **NOTE** The regular expressions must *not* contain spaces, > >> # so use '\s' instead of ' '. > >> > >> It appears to work fine in sendmail, I would be grateful if people > >> using other mailers could also test it for me. > >> > >> Thanks guys, > >> Jules. > >> > >> On 12/3/09 15:17, Julian Field wrote: > >> > >>> * PGP Signed: 03/12/09 at 15:18:00 > >>> > >>> Okay, no problem. > >>> The new functionality will still take a list of header names or > >>> regexps. The regexps mustn't contain spaces or I can't parse them, so > >>> use \s when you mean a space. > >>> Header names can optionally end in a ':', it will be added if not > >>> supplied. > >>> Header names can optionally be of the form /regular-expression/ in > >>> which case this will be applied to the whole header line (including > >>> the name and value of the header of course). The test will be appled > >>> in a case-insensitive manner. > >>> > >>> Is that what people want? > >>> > >>> Jules. > >>> > >>> On 12/3/09 14:58, Glenn wrote: > >>> > >>>> Julian - Yes, I tried X-Mime.* and it does not work. > >>>> > >>>> It seems the X-header limit in Microsoft Exchange is just now > >>>> beginning to > >>>> cause problems. There is already a commercial fix for Exchange 2007 > >>>> (http://www.codeplex.com/HeaderFilterAgent), but of course we are using > >>>> Exchange 2003. So you have at least one "people" who could put this > >>>> functionality to use, and probably others will be looking for it soon. > >>>> Thanks. -Glenn. > >>>> > >>>> > >>>> ---------- Original Message ----------- > >>>> From: Julian Field > >>>> To: MailScanner discussion > >>>> Sent: Thu, 12 Mar 2009 14:40:51 +0000 > >>>> Subject: Re: How to Remove X-headers > >>>> > >>>> > >>>>> -----BEGIN PGP SIGNED MESSAGE----- > >>>>> Hash: SHA1 > >>>>> > >>>>> Have just taken a look at the code. > >>>>> Have you tried something like this in your ruleset > >>>>> > >>>>> From: 10.11.12.13 X-Mime.* > >>>>> > >>>>> as I think that may well indeed work. It won't work in Exim, but may > >>>>> well work in the others. > >>>>> If people want this functionality put in properly so you could do > >>>>> something like > >>>>> From: 10.11.12.13 ^X-Mime.* > >>>>> to anchor it properly, then I could add this. > >>>>> > >>>>> Jules. > >>>>> > >>>>> On 12/3/09 14:22, Julian Field wrote: > >>>>> > >>>>>>> Old Signed: 03/12/09 at 14:22:04 > >>>>>>> > >>>>>> No, you can't use a regular expression to define which headers you > >>>>>> want to remove, just a list of header names. I'm fairly sure the > >>>>>> documentation does not imply that you *can* use regexps here. > >>>>>> > >>>>>> On 12/3/09 14:14, Glenn wrote: > >>>>>> > >>>>>>> Oh, sorry, I did not read Joost's post carefully enough to see the > >>>>>>> difference > >>>>>>> between his expression and mine. However, I just tested his > >>>>>>> expression, /^X- > >>>>>>> Mime.*\:/ , and it doesn't work either. I am wondering if > >>>>>>> MailScanner can > >>>>>>> use Perl expressions in this ruleset? Thanks again. -Glenn. > >>>>>>> > >>>>>>> ---------- Original Message ----------- > >>>>>>> From: "Glenn" > >>>>>>> To: MailScanner discussion > >>>>>>> Sent: Thu, 12 Mar 2009 09:02:37 -0500 > >>>>>>> Subject: Re: How to Remove X-headers > >>>>>>> > >>>>>>> > >>>>>>>> Thanks for all the attention, but I'm afraid I still have the same > >>>>>>>> problem. Regardless of the propriety of doing so, I would like to > >>>>>>>> be able to filter headers using the "Remove These Headers" ruleset, > >>>>>>>> and I can't get it to work with Perl regular expressions. > >>>>>>>> Joost's > >>>>>>>> post seems to confirm that I am using an expression that should > >>>>>>>> remove the X-MimeOLE: header, but it doesn't. Can anyone shed light > >>>>>>>> on this? Thanks. -Glenn. > >>>>>>>> > >>>>>>>> ---------- Original Message ----------- > >>>>>>>> From: Joost Waversveld > >>>>>>>> To: MailScanner discussion > >>>>>>>> Sent: Thu, 12 Mar 2009 09:38:58 +0100 > >>>>>>>> Subject: Re: How to Remove X-headers > >>>>>>>> > >>>>>>>> > >>>>>>>>> /^XMime.*\:/ would match XMime (and not X- > >>>>>>>>> Mime) > >>>>>>>>> > >>>>>>>>> The regular expression should be /^X-Mime.*\:/ > >>>>>>>>> > >>>>>>>>> Best regards, > >>>>>>>>> > >>>>>>>>> Joost Waversveld > >>>>>>>>> > >>>>>>>>> Alex Broens wrote: > >>>>>>>>> > >>>>>>>>>> On 3/11/2009 10:50 PM, Glenn wrote: > >>>>>>>>>> > >>>>>>>>>>> We use MailScanner and Postfix on a mail gateway server and > >>>>>>>>>>> forward > >>>>>>>>>>> mail to an internal Microsoft Exchange 2003 server. Evidently, > >>>>>>>>>>> enough X-headers have accumulated in an Exchange database to > >>>>>>>>>>> cause a > >>>>>>>>>>> problem, so we need to remove X-headers before they are > >>>>>>>>>>> forwarded to > >>>>>>>>>>> the Exchange server. > >>>>>>>>>>> > >>>>>>>>>>> There is a line in MailScanner.conf that allows us to name > >>>>>>>>>>> whatever > >>>>>>>>>>> headers we want to remove ("Remove These Headers"), but this > >>>>>>>>>>> raises > >>>>>>>>>>> some questions. If we just blanket remove all X-headers, > >>>>>>>>>>> won't this > >>>>>>>>>>> defeat features of MailScanner that depend on MailScanner adding > >>>>>>>>>>> headers? > >>>>>>>>>>> > >>>>>>>>>>> According to hints in the MailScanner rules directory, we > >>>>>>>>>>> should be > >>>>>>>>>>> able to use regular Perl expresssions to create a ruleset to > >>>>>>>>>>> exclude > >>>>>>>>>>> certain headers from the delete list. My problem is that I don't > >>>>>>>>>>> have a clue how to write regular Perl expressions. From what > >>>>>>>>>>> I've > >>>>>>>>>>> read online, for example, the lines below should be > >>>>>>>>>>> equivalent, but > >>>>>>>>>>> when I use the Perl expression in the ruleset it doesn't work. > >>>>>>>>>>> > >>>>>>>>>>> From: [ipaddress] X-MimeOLE: ##this removes the X-MimeOLE > >>>>>>>>>>> header > >>>>>>>>>>> > >>>>>>>>>>> From: [ipaddress] /^XMime.*\:/ ##this doesn't > >>>>>>>>>>> > >>>>>>>>>>> I know this isn't a Perl forum, but I'm hoping that someone > >>>>>>>>>>> who has > >>>>>>>>>>> tried this can enlighten me. If I could just get a simple > >>>>>>>>>>> expression > >>>>>>>>>>> to work, I might be able to build what I need. Thanks. - Glenn. > >>>>>>>>>>> > >>>>>>>>>> Before you start breaking MIME headers, who told you this or > >>>>>>>>>> what MS > >>>>>>>>>> KB article covers this? > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>> -- > >>>>>>>>> Joost Waversveld > >>>>>>>>> > >>>>>>>>> -- > >>>>>>>>> MailScanner mailing list > >>>>>>>>> mailscanner@lists.mailscanner.info > >>>>>>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >>>>>>>>> > >>>>>>>>> Before posting, read http://wiki.mailscanner.info/posting > >>>>>>>>> > >>>>>>>>> Support MailScanner development - buy the book off the website! > >>>>>>>>> > >>>>>>>> ------- End of Original Message ------- > >>>>>>>> > >>>>>>>> -- > >>>>>>>> MailScanner mailing list > >>>>>>>> mailscanner@lists.mailscanner.info > >>>>>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >>>>>>>> > >>>>>>>> Before posting, read http://wiki.mailscanner.info/posting > >>>>>>>> > >>>>>>>> Support MailScanner development - buy the book off the website! > >>>>>>>> > >>>>>>> ------- End of Original Message ------- > >>>>>>> > >>>>>>> > >>>>>> Jules > >>>>>> > >>>>>> > >>>>> Jules > >>>>> > >>>>> - -- Julian Field MEng CITP CEng > >>>>> www.MailScanner.info > >>>>> Buy the MailScanner book at www.MailScanner.info/store > >>>>> > >>>>> Need help customising MailScanner? > >>>>> Contact me! > >>>>> Need help fixing or optimising your systems? > >>>>> Contact me! > >>>>> Need help getting you started solving new requirements from your > >>>>> boss? Contact me! > >>>>> > >>>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >>>>> > >>>>> -----BEGIN PGP SIGNATURE----- > >>>>> Version: PGP Desktop 9.9.1 (Build 287) > >>>>> Comment: Use Enigmail to decrypt or check this message is legitimate > >>>>> Charset: ISO-8859-1 > >>>>> > >>>>> wj8DBQFJuR71EfZZRxQVtlQRAjxQAKCWXxHnjDlgWXLyJM+w/5Xa8ljlZwCgiUZt > >>>>> pgTRow7Fqx83C5gTW0Kilco= > >>>>> =Iqy2 > >>>>> -----END PGP SIGNATURE----- > >>>>> > >>>>> -- > >>>>> This message has been scanned for viruses and > >>>>> dangerous content by MailScanner, and is > >>>>> believed to be clean. > >>>>> > >>>>> -- > >>>>> MailScanner mailing list > >>>>> mailscanner@lists.mailscanner.info > >>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >>>>> > >>>>> Before posting, read http://wiki.mailscanner.info/posting > >>>>> > >>>>> Support MailScanner development - buy the book off the website! > >>>>> > >>>> ------- End of Original Message ------- > >>>> > >>>> > >>> Jules > >>> > >>> > >> Jules > >> > >> - -- > >> Julian Field MEng CITP CEng > >> www.MailScanner.info > >> Buy the MailScanner book at www.MailScanner.info/store > >> > >> Need help customising MailScanner? > >> Contact me! > >> Need help fixing or optimising your systems? > >> Contact me! > >> Need help getting you started solving new requirements from your > >> boss? Contact me! > >> > >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >> > >> -----BEGIN PGP SIGNATURE----- > >> Version: PGP Desktop 9.9.1 (Build 287) > >> Comment: Use Enigmail to decrypt or check this message is legitimate > >> Charset: ISO-8859-1 > >> > >> wj8DBQFJuSy8EfZZRxQVtlQRArdmAKC05+diwhk2XuJoQ31gJASOjlX57QCcDcum > >> B2jdj/D1uqVV8JA87+T0kHM= > >> =p4ZI > >> -----END PGP SIGNATURE----- > >> > >> -- > >> This message has been scanned for viruses and > >> dangerous content by MailScanner, and is > >> believed to be clean. > >> > >> -- > >> MailScanner mailing list > >> mailscanner@lists.mailscanner.info > >> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >> > >> Before posting, read http://wiki.mailscanner.info/posting > >> > >> Support MailScanner development - buy the book off the website! > >> > > ------- End of Original Message ------- > > > > > > Jules > > -- > Julian Field MEng CITP CEng > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > MailScanner customisation, or any advanced system administration > help? Contact me at Jules@Jules.FM > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > PGP public key: http://www.jules.fm/julesfm.asc > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! ------- End of Original Message ------- From carock at epconline.com Tue Apr 7 20:43:44 2009 From: carock at epconline.com (Chuck Rock) Date: Tue Apr 7 20:44:06 2009 Subject: Filter incoming mail from References: <72cf361e0904070822y5e81b141x1029e534e0bfca@mail.gmail.com> Message-ID: Martin Hepworth gmail.com> writes: > > I'd look at using Barricade MX from those nice folks at FSL to reduce the load on the servers. > I'd also think about adding in more boxes - ideally if you loose a box the others should be able to cope with the load and in you're current situation I doubt that is the case. > > Did I mention upgrading MailScanner also - there's a fair bit of speed up in there, but alot of it is related to SA speed-ups and better clamd support and the watermarking support. > > How are you spam trapping these emails - just relying on RBLs or don't you bother?-- Martin HepworthOxford, UK > > > Yeah, I'm using a local rbldnsd on each server too and using the RBL list dnsbl-1.uceprotect.net. I like that one because it automatically clears out blocked IP's after 7 days if they don't keep hitting their spam traps. Julian mentioned using Sendmail itself to filter. I just am not that familiar with sendmail, so I have some reading to do. :-) I might setup a new server to test as an upgrade to the existing setup. This way I can use SA and see how it affects the system load and still use the latest and greatest versions. Right now I'm just instructing users how to setup Outlook rules to delete those messages, but that's very tedious. Thanks for all the help. Chuck From prandal at herefordshire.gov.uk Tue Apr 7 20:49:35 2009 From: prandal at herefordshire.gov.uk (Randal, Phil) Date: Tue Apr 7 20:49:56 2009 Subject: How to Remove X-headers In-Reply-To: <20090407185014.M46324@mail.txwes.edu> References: <20090311214836.M92789@mail.txwes.edu> <49B84106.6070201@alexb.ch> <49B8CA22.3080202@waversveld.nl> <20090312135558.M65770@mail.txwes.edu> <20090312141015.M36577@mail.txwes.edu> <49B91A8C.2030409@ecs.soton.ac.uk> <49B91EF3.4070709@ecs.soton.ac.uk> <20090312144756.M75784@mail.txwes.edu> <49B927A7.3030105@ecs.soton.ac.uk> <49B92CBC.1000905@ecs.soton.ac.uk><20090313125948.M75170@mail.txwes.edu><49BD044D.9090707@ecs.soton.ac.uk> <20090407185014.M46324@mail.txwes.edu> Message-ID: <7EF0EE5CB3B263488C8C18823239BEBA03CF9B@HC-MBX02.herefordshire.gov.uk> Microsoft seem to have noticed the problem with their approach too: http://msexchangeteam.com/archive/2009/04/06/451003.aspx They're fixing it in Exchange 2007 and E14. No word (yet) about Exchange 2003. It might be worthwhile having a whitelist/blacklist approach to header removal. A "Retain Headers" which takes precedence over the header removal might be a worthwhile additional feature. Comments, anyone? Cheers, Phil -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Glenn Sent: 07 April 2009 20:21 To: MailScanner discussion Subject: Re: How to Remove X-headers I finally got back to this a few days ago. Took the opportunity to build a new mail gateway using Red Hat EL5, Sendmail, milter-greylist, ClamAV and MailScanner 4.75.9-2. Everything works great, so I'm about ready to try removing some X-headers. Only one question -- would removing all X-headers mess up MailScanner? After all, MailScanner does put some X-headers in, right? We do have a downstream server running MailScanner (unnecessarily now), but I'm mainly concerned with the gateway server itself. I suppose Exchange 2003 might rely on some X-headers coming through. If anyone can think of some, do tell. Thanks. -Glenn. ---------- Original Message ----------- From: Julian Field To: MailScanner discussion Sent: Sun, 15 Mar 2009 13:36:13 +0000 Subject: Re: How to Remove X-headers > I have found and fixed that bug. Missed out a $pos++ in a loop exit > condition. > Please try 4.75.9-2. > > Cheers, > Jules. > > On 13/3/09 13:05, Glenn wrote: > > Julian - Thanks very much for adding this functionality. I tried upgrading > > our Red Hat EL4/Postfix machines, and the new version stopped mail > > flow altogether. I have gone back to the older version (4.73.4-2) until I can > > figure out what went wrong. -Glenn. > > > > > > ---------- Original Message ----------- > > From: Julian Field > > To: MailScanner discussion > > Sent: Thu, 12 Mar 2009 15:39:40 +0000 > > Subject: Re: How to Remove X-headers > > > > > >> -----BEGIN PGP SIGNED MESSAGE----- > >> Hash: SHA1 > >> > >> On the basis that sounds fairly sensible and appears to provide the > >> flexibility people are after, I have written and released it as 4.75.9. > >> > >> There is new text near the start of the description of "Remove > >> These Headers" which says this: > >> > >> # This is a space-separated list of a mixture of any combination of > >> # 1. Names of headers, optionally ending with a ':' > >> # (the ':' will be added if not supplied) > >> # 2. Regular expressions starting and ending with a '/'. > >> # These regular expressions are matched against the entire header line, > >> # not just the name of the header. > >> # **NOTE** The regular expressions must *not* contain spaces, > >> # so use '\s' instead of ' '. > >> > >> It appears to work fine in sendmail, I would be grateful if people > >> using other mailers could also test it for me. > >> > >> Thanks guys, > >> Jules. > >> > >> On 12/3/09 15:17, Julian Field wrote: > >> > >>> * PGP Signed: 03/12/09 at 15:18:00 > >>> > >>> Okay, no problem. > >>> The new functionality will still take a list of header names or > >>> regexps. The regexps mustn't contain spaces or I can't parse them, > >>> so use \s when you mean a space. > >>> Header names can optionally end in a ':', it will be added if not > >>> supplied. > >>> Header names can optionally be of the form /regular-expression/ in > >>> which case this will be applied to the whole header line > >>> (including the name and value of the header of course). The test > >>> will be appled in a case-insensitive manner. > >>> > >>> Is that what people want? > >>> > >>> Jules. > >>> > >>> On 12/3/09 14:58, Glenn wrote: > >>> > >>>> Julian - Yes, I tried X-Mime.* and it does not work. > >>>> > >>>> It seems the X-header limit in Microsoft Exchange is just now > >>>> beginning to cause problems. There is already a commercial fix > >>>> for Exchange 2007 (http://www.codeplex.com/HeaderFilterAgent), > >>>> but of course we are using Exchange 2003. So you have at least > >>>> one "people" who could put this functionality to use, and > >>>> probably others will be looking for it soon. > >>>> Thanks. -Glenn. > >>>> > >>>> > >>>> ---------- Original Message ----------- > >>>> From: Julian Field > >>>> To: MailScanner discussion > >>>> Sent: Thu, 12 Mar 2009 14:40:51 +0000 > >>>> Subject: Re: How to Remove X-headers > >>>> > >>>> > >>>>> -----BEGIN PGP SIGNED MESSAGE----- > >>>>> Hash: SHA1 > >>>>> > >>>>> Have just taken a look at the code. > >>>>> Have you tried something like this in your ruleset > >>>>> > >>>>> From: 10.11.12.13 X-Mime.* > >>>>> > >>>>> as I think that may well indeed work. It won't work in Exim, but > >>>>> may well work in the others. > >>>>> If people want this functionality put in properly so you could > >>>>> do something like > >>>>> From: 10.11.12.13 ^X-Mime.* > >>>>> to anchor it properly, then I could add this. > >>>>> > >>>>> Jules. > >>>>> > >>>>> On 12/3/09 14:22, Julian Field wrote: > >>>>> > >>>>>>> Old Signed: 03/12/09 at 14:22:04 > >>>>>>> > >>>>>> No, you can't use a regular expression to define which headers > >>>>>> you want to remove, just a list of header names. I'm fairly > >>>>>> sure the documentation does not imply that you *can* use regexps here. > >>>>>> > >>>>>> On 12/3/09 14:14, Glenn wrote: > >>>>>> > >>>>>>> Oh, sorry, I did not read Joost's post carefully enough to see > >>>>>>> the difference between his expression and mine. However, I > >>>>>>> just tested his expression, /^X- Mime.*\:/ , and it doesn't > >>>>>>> work either. I am wondering if MailScanner can > >>>>>>> use Perl expressions in this ruleset? Thanks again. -Glenn. > >>>>>>> > >>>>>>> ---------- Original Message ----------- > >>>>>>> From: "Glenn" > >>>>>>> To: MailScanner discussion > >>>>>>> Sent: Thu, 12 Mar 2009 09:02:37 -0500 > >>>>>>> Subject: Re: How to Remove X-headers > >>>>>>> > >>>>>>> > >>>>>>>> Thanks for all the attention, but I'm afraid I still have the > >>>>>>>> same problem. Regardless of the propriety of doing so, I > >>>>>>>> would like to be able to filter headers using the "Remove These Headers" ruleset, > >>>>>>>> and I can't get it to work with Perl regular expressions. > >>>>>>>> Joost's > >>>>>>>> post seems to confirm that I am using an expression that > >>>>>>>> should remove the X-MimeOLE: header, but it doesn't. Can > >>>>>>>> anyone shed light > >>>>>>>> on this? Thanks. -Glenn. > >>>>>>>> > >>>>>>>> ---------- Original Message ----------- > >>>>>>>> From: Joost Waversveld > >>>>>>>> To: MailScanner > >>>>>>>> discussion > >>>>>>>> Sent: Thu, 12 Mar 2009 09:38:58 +0100 > >>>>>>>> Subject: Re: How to Remove X-headers > >>>>>>>> > >>>>>>>> > >>>>>>>>> /^XMime.*\:/ would match XMime (and not X- > >>>>>>>>> Mime) > >>>>>>>>> > >>>>>>>>> The regular expression should be /^X-Mime.*\:/ > >>>>>>>>> > >>>>>>>>> Best regards, > >>>>>>>>> > >>>>>>>>> Joost Waversveld > >>>>>>>>> > >>>>>>>>> Alex Broens wrote: > >>>>>>>>> > >>>>>>>>>> On 3/11/2009 10:50 PM, Glenn wrote: > >>>>>>>>>> > >>>>>>>>>>> We use MailScanner and Postfix on a mail gateway server > >>>>>>>>>>> and forward mail to an internal Microsoft Exchange 2003 > >>>>>>>>>>> server. Evidently, enough X-headers have accumulated in > >>>>>>>>>>> an Exchange database to cause a problem, so we need to > >>>>>>>>>>> remove X-headers before they are forwarded to the Exchange > >>>>>>>>>>> server. > >>>>>>>>>>> > >>>>>>>>>>> There is a line in MailScanner.conf that allows us to name > >>>>>>>>>>> whatever headers we want to remove ("Remove These > >>>>>>>>>>> Headers"), but this raises some questions. If we just > >>>>>>>>>>> blanket remove all X-headers, won't this defeat features > >>>>>>>>>>> of MailScanner that depend on MailScanner adding headers? > >>>>>>>>>>> > >>>>>>>>>>> According to hints in the MailScanner rules directory, we > >>>>>>>>>>> should be able to use regular Perl expresssions to create > >>>>>>>>>>> a ruleset to exclude certain headers from the delete list. > >>>>>>>>>>> My problem is that I don't > >>>>>>>>>>> have a clue how to write regular Perl expressions. From > >>>>>>>>>>> what I've read online, for example, the lines below should > >>>>>>>>>>> be equivalent, but when I use the Perl expression in the > >>>>>>>>>>> ruleset it doesn't work. > >>>>>>>>>>> > >>>>>>>>>>> From: [ipaddress] X-MimeOLE: ##this removes the X-MimeOLE > >>>>>>>>>>> header > >>>>>>>>>>> > >>>>>>>>>>> From: [ipaddress] /^XMime.*\:/ ##this doesn't > >>>>>>>>>>> > >>>>>>>>>>> I know this isn't a Perl forum, but I'm hoping that > >>>>>>>>>>> someone who has tried this can enlighten me. If I could > >>>>>>>>>>> just get a simple expression > >>>>>>>>>>> to work, I might be able to build what I need. Thanks. - Glenn. > >>>>>>>>>>> > >>>>>>>>>> Before you start breaking MIME headers, who told you this > >>>>>>>>>> or what MS KB article covers this? > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>> -- > >>>>>>>>> Joost Waversveld > >>>>>>>>> > >>>>>>>>> -- > >>>>>>>>> MailScanner mailing list > >>>>>>>>> mailscanner@lists.mailscanner.info > >>>>>>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >>>>>>>>> > >>>>>>>>> Before posting, read http://wiki.mailscanner.info/posting > >>>>>>>>> > >>>>>>>>> Support MailScanner development - buy the book off the website! > >>>>>>>>> > >>>>>>>> ------- End of Original Message ------- > >>>>>>>> > >>>>>>>> -- > >>>>>>>> MailScanner mailing list > >>>>>>>> mailscanner@lists.mailscanner.info > >>>>>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >>>>>>>> > >>>>>>>> Before posting, read http://wiki.mailscanner.info/posting > >>>>>>>> > >>>>>>>> Support MailScanner development - buy the book off the website! > >>>>>>>> > >>>>>>> ------- End of Original Message ------- > >>>>>>> > >>>>>>> > >>>>>> Jules > >>>>>> > >>>>>> > >>>>> Jules > >>>>> > >>>>> - -- Julian Field MEng CITP CEng www.MailScanner.info Buy the > >>>>> MailScanner book at www.MailScanner.info/store > >>>>> > >>>>> Need help customising MailScanner? > >>>>> Contact me! > >>>>> Need help fixing or optimising your systems? > >>>>> Contact me! > >>>>> Need help getting you started solving new requirements from your > >>>>> boss? Contact me! > >>>>> > >>>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >>>>> > >>>>> -----BEGIN PGP SIGNATURE----- > >>>>> Version: PGP Desktop 9.9.1 (Build 287) > >>>>> Comment: Use Enigmail to decrypt or check this message is > >>>>> legitimate > >>>>> Charset: ISO-8859-1 > >>>>> > >>>>> wj8DBQFJuR71EfZZRxQVtlQRAjxQAKCWXxHnjDlgWXLyJM+w/5Xa8ljlZwCgiUZt > >>>>> pgTRow7Fqx83C5gTW0Kilco= > >>>>> =Iqy2 > >>>>> -----END PGP SIGNATURE----- > >>>>> > >>>>> -- > >>>>> This message has been scanned for viruses and dangerous content > >>>>> by MailScanner, and is believed to be clean. > >>>>> > >>>>> -- > >>>>> MailScanner mailing list > >>>>> mailscanner@lists.mailscanner.info > >>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >>>>> > >>>>> Before posting, read http://wiki.mailscanner.info/posting > >>>>> > >>>>> Support MailScanner development - buy the book off the website! > >>>>> > >>>> ------- End of Original Message ------- > >>>> > >>>> > >>> Jules > >>> > >>> > >> Jules > >> > >> - -- > >> Julian Field MEng CITP CEng > >> www.MailScanner.info > >> Buy the MailScanner book at www.MailScanner.info/store > >> > >> Need help customising MailScanner? > >> Contact me! > >> Need help fixing or optimising your systems? > >> Contact me! > >> Need help getting you started solving new requirements from your > >> boss? Contact me! > >> > >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >> > >> -----BEGIN PGP SIGNATURE----- > >> Version: PGP Desktop 9.9.1 (Build 287) > >> Comment: Use Enigmail to decrypt or check this message is > >> legitimate > >> Charset: ISO-8859-1 > >> > >> wj8DBQFJuSy8EfZZRxQVtlQRArdmAKC05+diwhk2XuJoQ31gJASOjlX57QCcDcum > >> B2jdj/D1uqVV8JA87+T0kHM= > >> =p4ZI > >> -----END PGP SIGNATURE----- > >> > >> -- > >> This message has been scanned for viruses and dangerous content by > >> MailScanner, and is believed to be clean. > >> > >> -- > >> MailScanner mailing list > >> mailscanner@lists.mailscanner.info > >> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >> > >> Before posting, read http://wiki.mailscanner.info/posting > >> > >> Support MailScanner development - buy the book off the website! > >> > > ------- End of Original Message ------- > > > > > > Jules > > -- > Julian Field MEng CITP CEng > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > MailScanner customisation, or any advanced system administration help? > Contact me at Jules@Jules.FM > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP > public key: http://www.jules.fm/julesfm.asc > > -- > This message has been scanned for viruses and dangerous content by > MailScanner, and is believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! ------- End of Original Message ------- -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Apr 7 22:19:18 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 7 22:19:40 2009 Subject: How to Remove X-headers In-Reply-To: <20090407185014.M46324@mail.txwes.edu> References: <20090311214836.M92789@mail.txwes.edu> <49B84106.6070201@alexb.ch> <49B8CA22.3080202@waversveld.nl> <20090312135558.M65770@mail.txwes.edu> <20090312141015.M36577@mail.txwes.edu> <49B91A8C.2030409@ecs.soton.ac.uk> <49B91EF3.4070709@ecs.soton.ac.uk> <20090312144756.M75784@mail.txwes.edu> <49B927A7.3030105@ecs.soton.ac.uk> <49B92CBC.1000905@ecs.soton.ac.uk> <20090313125948.M75170@mail.txwes.edu> <49BD044D.9090707@ecs.soton.ac.uk> <20090407185014.M46324@mail.txwes.edu> <49DBC356.9020702@ecs.soton.ac.uk> Message-ID: On 4/7/09 8:21 PM, Glenn wrote: > I finally got back to this a few days ago. Took the opportunity to build a > new mail gateway using Red Hat EL5, Sendmail, milter-greylist, ClamAV and > MailScanner 4.75.9-2. Everything works great, so I'm about ready to try > removing some X-headers. Only one question -- would removing all X-headers > mess up MailScanner? After all, MailScanner does put some X-headers in, > right? We do have a downstream server running MailScanner (unnecessarily > now), but I'm mainly concerned with the gateway server itself. > MailScanner adds its own X-headers after the "Remove These Headers" option has been done. MailScanner does not rely on the contents of any X-headers for its operation at all, as anything in the message can be faked by earlier mail gateways or the sender itself. Exchange might use X-headers itself, but it cannot rely on any X-headers being present in mail coming in to itself from the internet at large, as it has no control over what mail is sent to it. In fact, limiting incoming headers to Exchange will help it as it will help protect you from the 32766-different-header-names limit in Exchange mailbox store databases. > I suppose Exchange 2003 might rely on some X-headers coming through. If > anyone can think of some, do tell. Thanks. -Glenn. > > ---------- Original Message ----------- > From: Julian Field > To: MailScanner discussion > Sent: Sun, 15 Mar 2009 13:36:13 +0000 > Subject: Re: How to Remove X-headers > > >> I have found and fixed that bug. Missed out a $pos++ in a loop exit >> condition. >> Please try 4.75.9-2. >> >> Cheers, >> Jules. >> >> On 13/3/09 13:05, Glenn wrote: >> >>> Julian - Thanks very much for adding this functionality. I tried >>> > upgrading > >>> our Red Hat EL4/Postfix machines, and the new version stopped mail flow >>> altogether. I have gone back to the older version (4.73.4-2) until I can >>> figure out what went wrong. -Glenn. >>> >>> >>> ---------- Original Message ----------- >>> From: Julian Field >>> To: MailScanner discussion >>> Sent: Thu, 12 Mar 2009 15:39:40 +0000 >>> Subject: Re: How to Remove X-headers >>> >>> >>> >>>> -----BEGIN PGP SIGNED MESSAGE----- >>>> Hash: SHA1 >>>> >>>> On the basis that sounds fairly sensible and appears to provide the >>>> flexibility people are after, I have written and released it as 4.75.9. >>>> >>>> There is new text near the start of the description of "Remove These >>>> Headers" which says this: >>>> >>>> # This is a space-separated list of a mixture of any combination of >>>> # 1. Names of headers, optionally ending with a ':' >>>> # (the ':' will be added if not supplied) >>>> # 2. Regular expressions starting and ending with a '/'. >>>> # These regular expressions are matched against the entire header >>>> > line, > >>>> # not just the name of the header. >>>> # **NOTE** The regular expressions must *not* contain spaces, >>>> # so use '\s' instead of ' '. >>>> >>>> It appears to work fine in sendmail, I would be grateful if people >>>> using other mailers could also test it for me. >>>> >>>> Thanks guys, >>>> Jules. >>>> >>>> On 12/3/09 15:17, Julian Field wrote: >>>> >>>> >>>>> * PGP Signed: 03/12/09 at 15:18:00 >>>>> >>>>> Okay, no problem. >>>>> The new functionality will still take a list of header names or >>>>> regexps. The regexps mustn't contain spaces or I can't parse them, so >>>>> use \s when you mean a space. >>>>> Header names can optionally end in a ':', it will be added if not >>>>> supplied. >>>>> Header names can optionally be of the form /regular-expression/ in >>>>> which case this will be applied to the whole header line (including >>>>> the name and value of the header of course). The test will be appled >>>>> in a case-insensitive manner. >>>>> >>>>> Is that what people want? >>>>> >>>>> Jules. >>>>> >>>>> On 12/3/09 14:58, Glenn wrote: >>>>> >>>>> >>>>>> Julian - Yes, I tried X-Mime.* and it does not work. >>>>>> >>>>>> It seems the X-header limit in Microsoft Exchange is just now >>>>>> beginning to >>>>>> cause problems. There is already a commercial fix for Exchange 2007 >>>>>> (http://www.codeplex.com/HeaderFilterAgent), but of course we are using >>>>>> Exchange 2003. So you have at least one "people" who could put this >>>>>> functionality to use, and probably others will be looking for it soon. >>>>>> Thanks. -Glenn. >>>>>> >>>>>> >>>>>> ---------- Original Message ----------- >>>>>> From: Julian Field >>>>>> To: MailScanner discussion >>>>>> Sent: Thu, 12 Mar 2009 14:40:51 +0000 >>>>>> Subject: Re: How to Remove X-headers >>>>>> >>>>>> >>>>>> >>>>>>> -----BEGIN PGP SIGNED MESSAGE----- >>>>>>> Hash: SHA1 >>>>>>> >>>>>>> Have just taken a look at the code. >>>>>>> Have you tried something like this in your ruleset >>>>>>> >>>>>>> From: 10.11.12.13 X-Mime.* >>>>>>> >>>>>>> as I think that may well indeed work. It won't work in Exim, but may >>>>>>> well work in the others. >>>>>>> If people want this functionality put in properly so you could do >>>>>>> something like >>>>>>> From: 10.11.12.13 ^X-Mime.* >>>>>>> to anchor it properly, then I could add this. >>>>>>> >>>>>>> Jules. >>>>>>> >>>>>>> On 12/3/09 14:22, Julian Field wrote: >>>>>>> >>>>>>> >>>>>>>>> Old Signed: 03/12/09 at 14:22:04 >>>>>>>>> >>>>>>>>> >>>>>>>> No, you can't use a regular expression to define which headers you >>>>>>>> want to remove, just a list of header names. I'm fairly sure the >>>>>>>> documentation does not imply that you *can* use regexps here. >>>>>>>> >>>>>>>> On 12/3/09 14:14, Glenn wrote: >>>>>>>> >>>>>>>> >>>>>>>>> Oh, sorry, I did not read Joost's post carefully enough to see the >>>>>>>>> difference >>>>>>>>> between his expression and mine. However, I just tested his >>>>>>>>> expression, /^X- >>>>>>>>> Mime.*\:/ , and it doesn't work either. I am wondering if >>>>>>>>> MailScanner can >>>>>>>>> use Perl expressions in this ruleset? Thanks again. -Glenn. >>>>>>>>> >>>>>>>>> ---------- Original Message ----------- >>>>>>>>> From: "Glenn" >>>>>>>>> To: MailScanner discussion >>>>>>>>> Sent: Thu, 12 Mar 2009 09:02:37 -0500 >>>>>>>>> Subject: Re: How to Remove X-headers >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>>> Thanks for all the attention, but I'm afraid I still have the same >>>>>>>>>> problem. Regardless of the propriety of doing so, I would like to >>>>>>>>>> be able to filter headers using the "Remove These Headers" ruleset, >>>>>>>>>> and I can't get it to work with Perl regular expressions. >>>>>>>>>> Joost's >>>>>>>>>> post seems to confirm that I am using an expression that should >>>>>>>>>> remove the X-MimeOLE: header, but it doesn't. Can anyone shed >>>>>>>>>> > light > >>>>>>>>>> on this? Thanks. -Glenn. >>>>>>>>>> >>>>>>>>>> ---------- Original Message ----------- >>>>>>>>>> From: Joost Waversveld >>>>>>>>>> To: MailScanner discussion >>>>>>>>>> Sent: Thu, 12 Mar 2009 09:38:58 +0100 >>>>>>>>>> Subject: Re: How to Remove X-headers >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>> /^XMime.*\:/ would match XMime (and not X- >>>>>>>>>>> Mime) >>>>>>>>>>> >>>>>>>>>>> The regular expression should be /^X-Mime.*\:/ >>>>>>>>>>> >>>>>>>>>>> Best regards, >>>>>>>>>>> >>>>>>>>>>> Joost Waversveld >>>>>>>>>>> >>>>>>>>>>> Alex Broens wrote: >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>>> On 3/11/2009 10:50 PM, Glenn wrote: >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>>> We use MailScanner and Postfix on a mail gateway server and >>>>>>>>>>>>> forward >>>>>>>>>>>>> mail to an internal Microsoft Exchange 2003 server. Evidently, >>>>>>>>>>>>> enough X-headers have accumulated in an Exchange database to >>>>>>>>>>>>> cause a >>>>>>>>>>>>> problem, so we need to remove X-headers before they are >>>>>>>>>>>>> forwarded to >>>>>>>>>>>>> the Exchange server. >>>>>>>>>>>>> >>>>>>>>>>>>> There is a line in MailScanner.conf that allows us to name >>>>>>>>>>>>> whatever >>>>>>>>>>>>> headers we want to remove ("Remove These Headers"), but this >>>>>>>>>>>>> raises >>>>>>>>>>>>> some questions. If we just blanket remove all X-headers, >>>>>>>>>>>>> won't this >>>>>>>>>>>>> defeat features of MailScanner that depend on MailScanner adding >>>>>>>>>>>>> headers? >>>>>>>>>>>>> >>>>>>>>>>>>> According to hints in the MailScanner rules directory, we >>>>>>>>>>>>> should be >>>>>>>>>>>>> able to use regular Perl expresssions to create a ruleset to >>>>>>>>>>>>> exclude >>>>>>>>>>>>> certain headers from the delete list. My problem is that I >>>>>>>>>>>>> > don't > >>>>>>>>>>>>> have a clue how to write regular Perl expressions. From what >>>>>>>>>>>>> I've >>>>>>>>>>>>> read online, for example, the lines below should be >>>>>>>>>>>>> equivalent, but >>>>>>>>>>>>> when I use the Perl expression in the ruleset it doesn't work. >>>>>>>>>>>>> >>>>>>>>>>>>> From: [ipaddress] X-MimeOLE: ##this removes the X-MimeOLE >>>>>>>>>>>>> header >>>>>>>>>>>>> >>>>>>>>>>>>> From: [ipaddress] /^XMime.*\:/ ##this doesn't >>>>>>>>>>>>> >>>>>>>>>>>>> I know this isn't a Perl forum, but I'm hoping that someone >>>>>>>>>>>>> who has >>>>>>>>>>>>> tried this can enlighten me. If I could just get a simple >>>>>>>>>>>>> expression >>>>>>>>>>>>> to work, I might be able to build what I need. Thanks. - >>>>>>>>>>>>> > Glenn. > >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>> Before you start breaking MIME headers, who told you this or >>>>>>>>>>>> what MS >>>>>>>>>>>> KB article covers this? >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>> -- >>>>>>>>>>> Joost Waversveld >>>>>>>>>>> >>>>>>>>>>> -- >>>>>>>>>>> MailScanner mailing list >>>>>>>>>>> mailscanner@lists.mailscanner.info >>>>>>>>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>>>>>>>> >>>>>>>>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>>>>>>>> >>>>>>>>>>> Support MailScanner development - buy the book off the website! >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>> ------- End of Original Message ------- >>>>>>>>>> >>>>>>>>>> -- >>>>>>>>>> MailScanner mailing list >>>>>>>>>> mailscanner@lists.mailscanner.info >>>>>>>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>>>>>>> >>>>>>>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>>>>>>> >>>>>>>>>> Support MailScanner development - buy the book off the website! >>>>>>>>>> >>>>>>>>>> >>>>>>>>> ------- End of Original Message ------- >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>> Jules >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>> Jules >>>>>>> >>>>>>> - -- Julian Field MEng CITP CEng >>>>>>> www.MailScanner.info >>>>>>> Buy the MailScanner book at www.MailScanner.info/store >>>>>>> >>>>>>> Need help customising MailScanner? >>>>>>> Contact me! >>>>>>> Need help fixing or optimising your systems? >>>>>>> Contact me! >>>>>>> Need help getting you started solving new requirements from your >>>>>>> boss? Contact me! >>>>>>> >>>>>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>>>>>> >>>>>>> -----BEGIN PGP SIGNATURE----- >>>>>>> Version: PGP Desktop 9.9.1 (Build 287) >>>>>>> Comment: Use Enigmail to decrypt or check this message is legitimate >>>>>>> Charset: ISO-8859-1 >>>>>>> >>>>>>> wj8DBQFJuR71EfZZRxQVtlQRAjxQAKCWXxHnjDlgWXLyJM+w/5Xa8ljlZwCgiUZt >>>>>>> pgTRow7Fqx83C5gTW0Kilco= >>>>>>> =Iqy2 >>>>>>> -----END PGP SIGNATURE----- >>>>>>> >>>>>>> -- >>>>>>> This message has been scanned for viruses and >>>>>>> dangerous content by MailScanner, and is >>>>>>> believed to be clean. >>>>>>> >>>>>>> -- >>>>>>> MailScanner mailing list >>>>>>> mailscanner@lists.mailscanner.info >>>>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>>>> >>>>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>>>> >>>>>>> Support MailScanner development - buy the book off the website! >>>>>>> >>>>>>> >>>>>> ------- End of Original Message ------- >>>>>> >>>>>> >>>>>> >>>>> Jules >>>>> >>>>> >>>>> >>>> Jules >>>> >>>> - -- >>>> Julian Field MEng CITP CEng >>>> www.MailScanner.info >>>> Buy the MailScanner book at www.MailScanner.info/store >>>> >>>> Need help customising MailScanner? >>>> Contact me! >>>> Need help fixing or optimising your systems? >>>> Contact me! >>>> Need help getting you started solving new requirements from your >>>> boss? Contact me! >>>> >>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>>> >>>> -----BEGIN PGP SIGNATURE----- >>>> Version: PGP Desktop 9.9.1 (Build 287) >>>> Comment: Use Enigmail to decrypt or check this message is legitimate >>>> Charset: ISO-8859-1 >>>> >>>> wj8DBQFJuSy8EfZZRxQVtlQRArdmAKC05+diwhk2XuJoQ31gJASOjlX57QCcDcum >>>> B2jdj/D1uqVV8JA87+T0kHM= >>>> =p4ZI >>>> -----END PGP SIGNATURE----- >>>> >>>> -- >>>> This message has been scanned for viruses and >>>> dangerous content by MailScanner, and is >>>> believed to be clean. >>>> >>>> -- >>>> MailScanner mailing list >>>> mailscanner@lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>> ------- End of Original Message ------- >>> >>> >>> >> Jules >> >> -- >> Julian Field MEng CITP CEng >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> >> MailScanner customisation, or any advanced system administration >> help? Contact me at Jules@Jules.FM >> >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> PGP public key: http://www.jules.fm/julesfm.asc >> >> -- >> This message has been scanned for viruses and >> dangerous content by MailScanner, and is >> believed to be clean. >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> > ------- End of Original Message ------- > > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From ssilva at sgvwater.com Tue Apr 7 22:43:46 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Tue Apr 7 22:44:09 2009 Subject: Filter incoming mail from In-Reply-To: References: <72cf361e0904070822y5e81b141x1029e534e0bfca@mail.gmail.com> Message-ID: on 4-7-2009 12:43 PM Chuck Rock spake the following: > Martin Hepworth gmail.com> writes: > >> I'd look at using Barricade MX from those nice folks at FSL to reduce the > load on the servers. >> I'd also think about adding in more boxes - ideally if you loose a box the > others should be able to cope with the load and in you're current situation I > doubt that is the case. >> Did I mention upgrading MailScanner also - there's a fair bit of speed up in > there, but alot of it is related to SA speed-ups and better clamd support and > the watermarking support. >> How are you spam trapping these emails - just relying on RBLs or don't you > bother?-- Martin HepworthOxford, UK >> >> > > Yeah, I'm using a local rbldnsd on each server too and using the RBL list > dnsbl-1.uceprotect.net. I like that one because it automatically clears out > blocked IP's after 7 days if they don't keep hitting their spam traps. > > Julian mentioned using Sendmail itself to filter. I just am not that familiar > with sendmail, so I have some reading to do. :-) > > I might setup a new server to test as an upgrade to the existing setup. This > way I can use SA and see how it affects the system load and still use the > latest and greatest versions. Right now I'm just instructing users how to > setup Outlook rules to delete those messages, but that's very tedious. > > Thanks for all the help. > > Chuck > > If you like the uceprotect blacklist, you could toss that in the sendmail.mc and rebuild the sendmail.cf. That way if it is in the list, sendmail just drops the mail midstream instead of having to save it then scan it then store it. You could probably also use your local rbl there also. I bet I drop 30% to 50% or more of the initial onslaught at the MTA. At least 1/10th the load there. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090407/2121ba6e/signature.bin From ecasarero at gmail.com Wed Apr 8 19:20:50 2009 From: ecasarero at gmail.com (Eduardo Casarero) Date: Wed Apr 8 19:21:15 2009 Subject: Fwd: [Clamav-announce] announcing ClamAV 0.95.1 In-Reply-To: <20090408181012.GA10766@adsl.nervous.it> References: <20090408181012.GA10766@adsl.nervous.it> Message-ID: <7d9b3cf20904081120r73b0ce80k9def46cfde5e0646@mail.gmail.com> FYI ---------- Forwarded message ---------- From: Luca Gibelli Date: 2009/4/8 Subject: [Clamav-announce] announcing ClamAV 0.95.1 To: clamav-announce@lists.clamav.net Dear ClamAV users, 0.95.1 is a bugfix release, please see the ChangeLog at http://freshmeat.net/urls/7065abfc92b936d016260efff5f9c67f for details. -- The ClamAV team (http://www.clamav.net/team) -- Luca Gibelli (luca _at_ clamav.net) ? ? ? ClamAV, a GPL anti-virus toolkit [Tel] +39 0187 1851862 [Fax] +39 0187 1852252 [IM] nervous/jabber.linux.it PGP key id 5EFC5582 @ any key-server || http://www.clamav.net/gpg/luca.gpg _______________________________________________ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-announce From prandal at herefordshire.gov.uk Thu Apr 9 14:26:28 2009 From: prandal at herefordshire.gov.uk (Randal, Phil) Date: Thu Apr 9 14:26:51 2009 Subject: Beware of RPMForge's clamav-0.95.1 packages Message-ID: <7EF0EE5CB3B263488C8C18823239BEBA06626F22@HC-MBX02.herefordshire.gov.uk> I just updated these, and found that clamd wouldn't restart because of a broken line in /etc/clamd.conf Patch below explains all: # diff -Naur clamd.conf.orig clamd.conf --- clamd.conf.orig 2009-04-08 16:53:18.000000000 +0100 +++ clamd.conf 2009-04-09 14:19:07.000000000 +0100 @@ -11,7 +11,7 @@ # LogFile must be writable for the user running daemon. # A full path is required. # Default: disabled -LogFile unix:/var/log/clamav/clamd.log +LogFile /var/log/clamav/clamd.log # By default the log file is locked for writing - the lock protects against # running clamd multiple times (if want to run another clamd, please That "unix:" bit should not be in there, tut! Cheers, Phil -- Phil Randal | Networks Engineer Herefordshire Council | Deputy Chief Executive's Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, Hereford, HR2 6JT Tel: 01432 260160 email: prandal@herefordshire.gov.uk Any opinion expressed in this e-mail or any attached files are those of the individual and not necessarily those of Herefordshire Council. This e-mail and any attached files are confidential and intended solely for the use of the addressee. This communication may contain material protected by law from being passed on. If you are not the intended recipient and have received this e-mail in error, you are advised that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender immediately and destroy all copies of it. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090409/47fcfe62/attachment.html From mogens at fumlersoft.dk Thu Apr 9 15:24:36 2009 From: mogens at fumlersoft.dk (Mogens Melander) Date: Thu Apr 9 15:24:55 2009 Subject: ClamAV 0.95.1 and Mail::ClamAV-0.22 Message-ID: <1574754d56e769239bebcadcea70d91b.squirrel@mail.fumlersoft.dk> Hi list I'm trying to set up a new mail server, using sendmail, Cyrus-imap and hopefully MailScanner, SpamAssassin and friends, and hopefully, turning this install into a set of zenwalk install packages (netpkg). Before installing MailScanner i want all dependencies to be up to date (latest). When trying to build Mail::ClamAV, i'm having big problems trying to "make" the module from install-Clam-0.95-SA-3.2.5.tar.gz I've tried to install from CPAN too, same result. Google didn't provide any hints. Clues to what i'm missing are more than welcome :) My environment is: Zenwalk 5.4 (slackware) Linux faust 2.6.26 #1 SMP PREEMPT Mon Jul 14 22:56:25 CEST 2008 i686 Pentium III (Katmai) GenuineIntel GNU/Linux gcc version 4.3.3 (GCC) This is perl, v5.10.0 built for i486-linux-thread-multi I believe i got all perl dependencies installed: Module Installed CPAN Digest 1.15 1.15 Text::Balanced 2.0.0 2.000000 Digest::MD5 2.38 2.38 Parse::RecDescent 1.94 1.94 Inline 0.45 0.45 Test::Harness 3.16 3.16 Test::Simple 0.86 0.86 Mail::ClamAV - 0.22 * DB_File 1.820 1.820 Digest::SHA1 2.11 2.11 Net::CIDR::Lite 0.20 0.20 Test::Manifest 1.22 1.22 HTML::Parser 3.60 3.60 Business::ISBN::Data 20081208 20081208 Business::ISBN 2.05 2.05 Sys::Hostname::Long 1.4 1.4 Digest::HMAC 1.01 1.01 Net::IP 1.25 1.25 YAML 0.68 0.68 ExtUtils::CBuilder 0.24 0.24 ExtUtils::ParseXS 2.19 2.19 version 0.76 0.76 Module::Build 0.32 0.32 Net::DNS 0.65 0.65 Net::DNS::Resolver::Programmable v0.003 0.003 Error 0.17015 0.17015 NetAddr::IP 4.026 4.026 URI 1.37 1.37 Mail::SPF::Test v1.001 1.001 Mail::SPF::Query 1.999.1 1.999001 IP::Country 2.26 2.26 IO::Zlib 1.09 1.09 IO::String 1.08 1.08 Archive::Tar 1.46 1.46 Data::Dump 1.14 1.14 Encode::Detect 1.00 1.01 * Mail::SPF v2.006 2.006 Net::Ident 1.20 1.20 IO::Socket::INET6 - 2.56 * IO::Socket::SSL 1.24 1.24 Mail::DomainKeys 1.0 1.0 Mail::DKIM 0.33 0.33 Encode::Detect 1.00 1.01 * Mail::SpamAssassin 3.002005 3.002005 And the errors i get during make: Mail-ClamAV-0.22]# make /usr/bin/perl5.10.0 -Mblib -MInline=NOISY,_INSTALL_ -MMail::ClamAV -e1 0.22 blib/arch Starting Build Preprocess Stage Finished Build Preprocess Stage Starting Build Parse Stage Finished Build Parse Stage Starting Build Glue 1 Stage Finished Build Glue 1 Stage Starting Build Glue 2 Stage Finished Build Glue 2 Stage Starting Build Glue 3 Stage Finished Build Glue 3 Stage Starting Build Compile Stage Starting "perl Makefile.PL" Stage Writing Makefile for Mail::ClamAV Finished "perl Makefile.PL" Stage Starting "make" Stage make[1]: Entering directory `~/install-Clam-0.95-SA-3.2.5/perl-tar/Mail-ClamAV-0.22/_Inline/build/Mail/ClamAV' /usr/bin/perl5.10.0 /usr/lib/perl5/5.10.0/ExtUtils/xsubpp -typemap /usr/lib/perl5/5.10.0/ExtUtils/typemap ClamAV.xs > ClamAV.xsc && mv ClamAV.xsc ClamAV.c cc -c -I~/install-Clam-0.95-SA-3.2.5/perl-tar/Mail-ClamAV-0.22 -I/usr/include -D_REENTRANT -D_GNU_SOURCE -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -march=i486 -mtune=i686 -DVERSION=\"0.22\" -DXS_VERSION=\"0.22\" -fPIC "-I/usr/lib/perl5/5.10.0/i486-linux-thread-multi/CORE" ClamAV.c ClamAV.xs:33: error: field 'limits' has incomplete type ClamAV.xs: In function 'clamav_perl__scanfd': ClamAV.xs:206: error: too many arguments to function 'cl_scandesc' ClamAV.xs: In function 'clamav_perl__scanfile': ClamAV.xs:247: error: too many arguments to function 'cl_scanfile' ClamAV.xs: In function 'clamav_perl_constant': ClamAV.xs:298: error: 'CL_ERAR' undeclared (first use in this function) ClamAV.xs:298: error: (Each undeclared identifier is reported only once ClamAV.xs:298: error: for each function it appears in.) ClamAV.xs:299: error: 'CL_EZIP' undeclared (first use in this function) ClamAV.xs:300: error: 'CL_EGZIP' undeclared (first use in this function) ClamAV.xs:301: error: 'CL_EBZIP' undeclared (first use in this function) ClamAV.xs:302: error: 'CL_EOLE2' undeclared (first use in this function) ClamAV.xs:303: error: 'CL_EMSCOMP' undeclared (first use in this function) ClamAV.xs:304: error: 'CL_EMSCAB' undeclared (first use in this function) ClamAV.xs:311: error: 'CL_EPATSHORT' undeclared (first use in this function) ClamAV.xs:314: error: 'CL_ECVDEXTR' undeclared (first use in this function) ClamAV.xs:315: error: 'CL_EMD5' undeclared (first use in this function) ClamAV.xs:316: error: 'CL_EDSIG' undeclared (first use in this function) ClamAV.xs:317: error: 'CL_EIO' undeclared (first use in this function) ClamAV.xs:319: error: 'CL_ESUPPORT' undeclared (first use in this function) ClamAV.xs:329: error: 'CL_DB_ACONLY' undeclared (first use in this function) ClamAV.xs:354: error: 'CL_RAW' undeclared (first use in this function) ClamAV.xs:355: error: 'CL_ARCHIVE' undeclared (first use in this function) ClamAV.xs:356: error: 'CL_MAIL' undeclared (first use in this function) ClamAV.xs:357: error: 'CL_OLE2' undeclared (first use in this function) ClamAV.xs:358: error: 'CL_ENCRYPTED' undeclared (first use in this function) make[1]: *** [ClamAV.o] Error 1 make[1]: Leaving directory `~/install-Clam-0.95-SA-3.2.5/perl-tar/Mail-ClamAV-0.22/_Inline/build/Mail/ClamAV' A problem was encountered while attempting to compile and install your Inline C code. The command that failed was: make The build directory was: ~/install-Clam-0.95-SA-3.2.5/perl-tar/Mail-ClamAV-0.22/_Inline/build/Mail/ClamAV To debug the problem, cd to the build directory, and inspect the output files. at ~/install-Clam-0.95-SA-3.2.5/perl-tar/Mail-ClamAV-0.22/blib/lib/Mail/ClamAV.pm line 175 BEGIN failed--compilation aborted at ~/install-Clam-0.95-SA-3.2.5/perl-tar/Mail-ClamAV-0.22/blib/lib/Mail/ClamAV.pm line 534. Compilation failed in require. BEGIN failed--compilation aborted. make: *** [ClamAV.inl] Error 25 -- Later Mogens Melander -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From eddie at emcuk.com Thu Apr 9 15:29:26 2009 From: eddie at emcuk.com (Eddie Hallahan) Date: Thu Apr 9 15:30:02 2009 Subject: DomainKeys with postfix and mailscanner Message-ID: <49DE0646.9000200@emcuk.com> Hi guys, given BT/Yahoo blocking anyone who isn't using domainKeys I'm now having to look into implementing DomainKeys on my systems. Is this possible using Mailscanner with postfix as the mta? Regards -- Eddie Hallahan Enterprise Management Consulting www.emcuk.com Enterprise Management Consulting is a company registered in England and Wales with company number 3134544. VAT registration number is 681038440. From jethro.binks at strath.ac.uk Thu Apr 9 15:39:27 2009 From: jethro.binks at strath.ac.uk (Jethro R Binks) Date: Thu Apr 9 15:39:36 2009 Subject: DomainKeys with postfix and mailscanner In-Reply-To: <49DE0646.9000200@emcuk.com> References: <49DE0646.9000200@emcuk.com> Message-ID: On Thu, 9 Apr 2009, Eddie Hallahan wrote: > given BT/Yahoo blocking anyone who isn't using domainKeys Are they? . . . . . . . . . . . . . . . . . . . . . . . . . Jethro R Binks Computing Officer, IT Services, University Of Strathclyde, Glasgow, UK From rcooper at dwford.com Thu Apr 9 15:42:08 2009 From: rcooper at dwford.com (Rick Cooper) Date: Thu Apr 9 15:42:25 2009 Subject: ClamAV 0.95.1 and Mail::ClamAV-0.22 In-Reply-To: <1574754d56e769239bebcadcea70d91b.squirrel@mail.fumlersoft.dk> References: <1574754d56e769239bebcadcea70d91b.squirrel@mail.fumlersoft.dk> Message-ID: <2E2EE2EA502742289DF1CB7B2E40A641@SAHOMELT> Unless Julian patched the module it doesn't support clamav version 0.95x. This is common with the Mail::ClamAV module and you should look at moving to clamd instead for many reasons discussed many times on this list Rick > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf > Of Mogens Melander > Sent: Thursday, April 09, 2009 10:25 AM > To: MailScanner discussion > Subject: ClamAV 0.95.1 and Mail::ClamAV-0.22 > > Hi list > > I'm trying to set up a new mail server, using sendmail, > Cyrus-imap and hopefully > MailScanner, SpamAssassin and friends, and hopefully, turning > this install into > a set of zenwalk install packages (netpkg). > > Before installing MailScanner i want all dependencies to be > up to date (latest). > > When trying to build Mail::ClamAV, i'm having big problems > trying to "make" the > module from install-Clam-0.95-SA-3.2.5.tar.gz > > I've tried to install from CPAN too, same result. > > Google didn't provide any hints. > > Clues to what i'm missing are more than welcome :) > > My environment is: > > Zenwalk 5.4 (slackware) > Linux faust 2.6.26 #1 SMP PREEMPT Mon Jul 14 22:56:25 CEST 2008 > i686 Pentium III (Katmai) GenuineIntel GNU/Linux > > gcc version 4.3.3 (GCC) > This is perl, v5.10.0 built for i486-linux-thread-multi > > I believe i got all perl dependencies installed: > Module Installed CPAN > Digest 1.15 1.15 > Text::Balanced 2.0.0 2.000000 > Digest::MD5 2.38 2.38 > Parse::RecDescent 1.94 1.94 > Inline 0.45 0.45 > Test::Harness 3.16 3.16 > Test::Simple 0.86 0.86 > Mail::ClamAV - 0.22 * > DB_File 1.820 1.820 > Digest::SHA1 2.11 2.11 > Net::CIDR::Lite 0.20 0.20 > Test::Manifest 1.22 1.22 > HTML::Parser 3.60 3.60 > Business::ISBN::Data 20081208 20081208 > Business::ISBN 2.05 2.05 > Sys::Hostname::Long 1.4 1.4 > Digest::HMAC 1.01 1.01 > Net::IP 1.25 1.25 > YAML 0.68 0.68 > ExtUtils::CBuilder 0.24 0.24 > ExtUtils::ParseXS 2.19 2.19 > version 0.76 0.76 > Module::Build 0.32 0.32 > Net::DNS 0.65 0.65 > Net::DNS::Resolver::Programmable v0.003 0.003 > Error 0.17015 0.17015 > NetAddr::IP 4.026 4.026 > URI 1.37 1.37 > Mail::SPF::Test v1.001 1.001 > Mail::SPF::Query 1.999.1 1.999001 > IP::Country 2.26 2.26 > IO::Zlib 1.09 1.09 > IO::String 1.08 1.08 > Archive::Tar 1.46 1.46 > Data::Dump 1.14 1.14 > Encode::Detect 1.00 1.01 * > Mail::SPF v2.006 2.006 > Net::Ident 1.20 1.20 > IO::Socket::INET6 - 2.56 * > IO::Socket::SSL 1.24 1.24 > Mail::DomainKeys 1.0 1.0 > Mail::DKIM 0.33 0.33 > Encode::Detect 1.00 1.01 * > Mail::SpamAssassin 3.002005 3.002005 > > And the errors i get during make: > > Mail-ClamAV-0.22]# make > /usr/bin/perl5.10.0 -Mblib -MInline=NOISY,_INSTALL_ > -MMail::ClamAV -e1 0.22 blib/arch > Starting Build Preprocess Stage > Finished Build Preprocess Stage > > Starting Build Parse Stage > Finished Build Parse Stage > > Starting Build Glue 1 Stage > Finished Build Glue 1 Stage > > Starting Build Glue 2 Stage > Finished Build Glue 2 Stage > > Starting Build Glue 3 Stage > Finished Build Glue 3 Stage > > Starting Build Compile Stage > Starting "perl Makefile.PL" Stage > Writing Makefile for Mail::ClamAV > Finished "perl Makefile.PL" Stage > > Starting "make" Stage > make[1]: Entering directory > `~/install-Clam-0.95-SA-3.2.5/perl-tar/Mail-ClamAV-0.22/_Inlin > e/build/Mail/ClamAV' > /usr/bin/perl5.10.0 /usr/lib/perl5/5.10.0/ExtUtils/xsubpp -typemap > /usr/lib/perl5/5.10.0/ExtUtils/typemap ClamAV.xs > > ClamAV.xsc && mv ClamAV.xsc ClamAV.c > cc -c > -I~/install-Clam-0.95-SA-3.2.5/perl-tar/Mail-ClamAV-0.22 > -I/usr/include -D_REENTRANT > -D_GNU_SOURCE -fno-strict-aliasing -pipe -I/usr/local/include > -D_LARGEFILE_SOURCE > -D_FILE_OFFSET_BITS=64 -O2 -march=i486 -mtune=i686 > -DVERSION=\"0.22\" -DXS_VERSION=\"0.22\" > -fPIC "-I/usr/lib/perl5/5.10.0/i486-linux-thread-multi/CORE" > ClamAV.c > ClamAV.xs:33: error: field 'limits' has incomplete type > ClamAV.xs: In function 'clamav_perl__scanfd': > ClamAV.xs:206: error: too many arguments to function 'cl_scandesc' > ClamAV.xs: In function 'clamav_perl__scanfile': > ClamAV.xs:247: error: too many arguments to function 'cl_scanfile' > ClamAV.xs: In function 'clamav_perl_constant': > ClamAV.xs:298: error: 'CL_ERAR' undeclared (first use in this > function) > ClamAV.xs:298: error: (Each undeclared identifier is reported > only once > ClamAV.xs:298: error: for each function it appears in.) > ClamAV.xs:299: error: 'CL_EZIP' undeclared (first use in this > function) > ClamAV.xs:300: error: 'CL_EGZIP' undeclared (first use in > this function) > ClamAV.xs:301: error: 'CL_EBZIP' undeclared (first use in > this function) > ClamAV.xs:302: error: 'CL_EOLE2' undeclared (first use in > this function) > ClamAV.xs:303: error: 'CL_EMSCOMP' undeclared (first use in > this function) > ClamAV.xs:304: error: 'CL_EMSCAB' undeclared (first use in > this function) > ClamAV.xs:311: error: 'CL_EPATSHORT' undeclared (first use in > this function) > ClamAV.xs:314: error: 'CL_ECVDEXTR' undeclared (first use in > this function) > ClamAV.xs:315: error: 'CL_EMD5' undeclared (first use in this > function) > ClamAV.xs:316: error: 'CL_EDSIG' undeclared (first use in > this function) > ClamAV.xs:317: error: 'CL_EIO' undeclared (first use in this function) > ClamAV.xs:319: error: 'CL_ESUPPORT' undeclared (first use in > this function) > ClamAV.xs:329: error: 'CL_DB_ACONLY' undeclared (first use in > this function) > ClamAV.xs:354: error: 'CL_RAW' undeclared (first use in this function) > ClamAV.xs:355: error: 'CL_ARCHIVE' undeclared (first use in > this function) > ClamAV.xs:356: error: 'CL_MAIL' undeclared (first use in this > function) > ClamAV.xs:357: error: 'CL_OLE2' undeclared (first use in this > function) > ClamAV.xs:358: error: 'CL_ENCRYPTED' undeclared (first use in > this function) > make[1]: *** [ClamAV.o] Error 1 > make[1]: Leaving directory > `~/install-Clam-0.95-SA-3.2.5/perl-tar/Mail-ClamAV-0.22/_Inlin > e/build/Mail/ClamAV' > > A problem was encountered while attempting to compile and > install your Inline > C code. The command that failed was: > make > > The build directory was: > ~/install-Clam-0.95-SA-3.2.5/perl-tar/Mail-ClamAV-0.22/_Inline > /build/Mail/ClamAV > > To debug the problem, cd to the build directory, and inspect > the output files. > > at > ~/install-Clam-0.95-SA-3.2.5/perl-tar/Mail-ClamAV-0.22/blib/li > b/Mail/ClamAV.pm line 175 > BEGIN failed--compilation aborted at > ~/install-Clam-0.95-SA-3.2.5/perl-tar/Mail-ClamAV-0.22/blib/li > b/Mail/ClamAV.pm line 534. > Compilation failed in require. > BEGIN failed--compilation aborted. > make: *** [ClamAV.inl] Error 25 > > > -- > Later > > Mogens Melander > > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > > -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From eddie at emcuk.com Thu Apr 9 15:46:36 2009 From: eddie at emcuk.com (Eddie Hallahan) Date: Thu Apr 9 15:47:11 2009 Subject: DomainKeys with postfix and mailscanner In-Reply-To: References: <49DE0646.9000200@emcuk.com> Message-ID: <49DE0A4C.50608@emcuk.com> An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090409/9d8064bd/attachment.html From prandal at herefordshire.gov.uk Thu Apr 9 15:54:11 2009 From: prandal at herefordshire.gov.uk (Randal, Phil) Date: Thu Apr 9 15:54:30 2009 Subject: DomainKeys with postfix and mailscanner In-Reply-To: <49DE0646.9000200@emcuk.com> References: <49DE0646.9000200@emcuk.com> Message-ID: <7EF0EE5CB3B263488C8C18823239BEBA06626F92@HC-MBX02.herefordshire.gov.uk> Tough, it's them breaking email, not you. Get the non-recipients to complain. Cheers, Phil -- Phil Randal | Networks Engineer Herefordshire Council | Deputy Chief Executive's Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, Hereford, HR2 6JT Tel: 01432 260160 email: prandal@herefordshire.gov.uk Any opinion expressed in this e-mail or any attached files are those of the individual and not necessarily those of Herefordshire Council. This e-mail and any attached files are confidential and intended solely for the use of the addressee. This communication may contain material protected by law from being passed on. If you are not the intended recipient and have received this e-mail in error, you are advised that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender immediately and destroy all copies of it. -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Eddie Hallahan Sent: 09 April 2009 15:29 To: mailscanner@lists.mailscanner.info Subject: DomainKeys with postfix and mailscanner Hi guys, given BT/Yahoo blocking anyone who isn't using domainKeys I'm now having to look into implementing DomainKeys on my systems. Is this possible using Mailscanner with postfix as the mta? Regards -- Eddie Hallahan Enterprise Management Consulting www.emcuk.com Enterprise Management Consulting is a company registered in England and Wales with company number 3134544. VAT registration number is 681038440. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From mogens at fumlersoft.dk Thu Apr 9 16:07:19 2009 From: mogens at fumlersoft.dk (Mogens Melander) Date: Thu Apr 9 16:07:38 2009 Subject: ClamAV 0.95.1 and Mail::ClamAV-0.22 In-Reply-To: <2E2EE2EA502742289DF1CB7B2E40A641@SAHOMELT> References: <1574754d56e769239bebcadcea70d91b.squirrel@mail.fumlersoft.dk> <2E2EE2EA502742289DF1CB7B2E40A641@SAHOMELT> Message-ID: <13cbf4fa8e1d520ee5f5dfa1e01111b6.squirrel@mail.fumlersoft.dk> On Thu, April 9, 2009 16:42, Rick Cooper wrote: > Unless Julian patched the module it doesn't support clamav version 0.95x. > This is common with the Mail::ClamAV module and you should look at moving to > clamd instead for many reasons discussed many times on this list > > Rick I am planning on using clamd and and friends. clamd is installed and running. I tried to install Julian's "easy install" package (install-Clam-0.95-SA-3.2.5.tar.gz), and that claim to patch clamav, so i was relying on it being OK. Anyway, i must be missing something on my system, resulting in those errors, but i have no clue as to what that might be. > >> -----Original Message----- >> From: mailscanner-bounces@lists.mailscanner.info >> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf >> Of Mogens Melander >> Sent: Thursday, April 09, 2009 10:25 AM >> To: MailScanner discussion >> Subject: ClamAV 0.95.1 and Mail::ClamAV-0.22 >> >> Hi list >> >> I'm trying to set up a new mail server, using sendmail, >> Cyrus-imap and hopefully >> MailScanner, SpamAssassin and friends, and hopefully, turning >> this install into >> a set of zenwalk install packages (netpkg). >> >> Before installing MailScanner i want all dependencies to be >> up to date (latest). >> >> When trying to build Mail::ClamAV, i'm having big problems >> trying to "make" the >> module from install-Clam-0.95-SA-3.2.5.tar.gz >> >> I've tried to install from CPAN too, same result. >> >> Google didn't provide any hints. >> >> Clues to what i'm missing are more than welcome :) >> >> My environment is: >> >> Zenwalk 5.4 (slackware) >> Linux faust 2.6.26 #1 SMP PREEMPT Mon Jul 14 22:56:25 CEST 2008 >> i686 Pentium III (Katmai) GenuineIntel GNU/Linux >> >> gcc version 4.3.3 (GCC) >> This is perl, v5.10.0 built for i486-linux-thread-multi >> >> I believe i got all perl dependencies installed: >> Module Installed CPAN >> Digest 1.15 1.15 >> Text::Balanced 2.0.0 2.000000 >> Digest::MD5 2.38 2.38 >> Parse::RecDescent 1.94 1.94 >> Inline 0.45 0.45 >> Test::Harness 3.16 3.16 >> Test::Simple 0.86 0.86 >> Mail::ClamAV - 0.22 * >> DB_File 1.820 1.820 >> Digest::SHA1 2.11 2.11 >> Net::CIDR::Lite 0.20 0.20 >> Test::Manifest 1.22 1.22 >> HTML::Parser 3.60 3.60 >> Business::ISBN::Data 20081208 20081208 >> Business::ISBN 2.05 2.05 >> Sys::Hostname::Long 1.4 1.4 >> Digest::HMAC 1.01 1.01 >> Net::IP 1.25 1.25 >> YAML 0.68 0.68 >> ExtUtils::CBuilder 0.24 0.24 >> ExtUtils::ParseXS 2.19 2.19 >> version 0.76 0.76 >> Module::Build 0.32 0.32 >> Net::DNS 0.65 0.65 >> Net::DNS::Resolver::Programmable v0.003 0.003 >> Error 0.17015 0.17015 >> NetAddr::IP 4.026 4.026 >> URI 1.37 1.37 >> Mail::SPF::Test v1.001 1.001 >> Mail::SPF::Query 1.999.1 1.999001 >> IP::Country 2.26 2.26 >> IO::Zlib 1.09 1.09 >> IO::String 1.08 1.08 >> Archive::Tar 1.46 1.46 >> Data::Dump 1.14 1.14 >> Encode::Detect 1.00 1.01 * >> Mail::SPF v2.006 2.006 >> Net::Ident 1.20 1.20 >> IO::Socket::INET6 - 2.56 * >> IO::Socket::SSL 1.24 1.24 >> Mail::DomainKeys 1.0 1.0 >> Mail::DKIM 0.33 0.33 >> Encode::Detect 1.00 1.01 * >> Mail::SpamAssassin 3.002005 3.002005 >> >> And the errors i get during make: >> >> Mail-ClamAV-0.22]# make >> /usr/bin/perl5.10.0 -Mblib -MInline=NOISY,_INSTALL_ >> -MMail::ClamAV -e1 0.22 blib/arch >> Starting Build Preprocess Stage >> Finished Build Preprocess Stage >> >> Starting Build Parse Stage >> Finished Build Parse Stage >> >> Starting Build Glue 1 Stage >> Finished Build Glue 1 Stage >> >> Starting Build Glue 2 Stage >> Finished Build Glue 2 Stage >> >> Starting Build Glue 3 Stage >> Finished Build Glue 3 Stage >> >> Starting Build Compile Stage >> Starting "perl Makefile.PL" Stage >> Writing Makefile for Mail::ClamAV >> Finished "perl Makefile.PL" Stage >> >> Starting "make" Stage >> make[1]: Entering directory >> `~/install-Clam-0.95-SA-3.2.5/perl-tar/Mail-ClamAV-0.22/_Inlin >> e/build/Mail/ClamAV' >> /usr/bin/perl5.10.0 /usr/lib/perl5/5.10.0/ExtUtils/xsubpp -typemap >> /usr/lib/perl5/5.10.0/ExtUtils/typemap ClamAV.xs > >> ClamAV.xsc && mv ClamAV.xsc ClamAV.c >> cc -c >> -I~/install-Clam-0.95-SA-3.2.5/perl-tar/Mail-ClamAV-0.22 >> -I/usr/include -D_REENTRANT >> -D_GNU_SOURCE -fno-strict-aliasing -pipe -I/usr/local/include >> -D_LARGEFILE_SOURCE >> -D_FILE_OFFSET_BITS=64 -O2 -march=i486 -mtune=i686 >> -DVERSION=\"0.22\" -DXS_VERSION=\"0.22\" >> -fPIC "-I/usr/lib/perl5/5.10.0/i486-linux-thread-multi/CORE" >> ClamAV.c >> ClamAV.xs:33: error: field 'limits' has incomplete type >> ClamAV.xs: In function 'clamav_perl__scanfd': >> ClamAV.xs:206: error: too many arguments to function 'cl_scandesc' >> ClamAV.xs: In function 'clamav_perl__scanfile': >> ClamAV.xs:247: error: too many arguments to function 'cl_scanfile' >> ClamAV.xs: In function 'clamav_perl_constant': >> ClamAV.xs:298: error: 'CL_ERAR' undeclared (first use in this >> function) >> ClamAV.xs:298: error: (Each undeclared identifier is reported >> only once >> ClamAV.xs:298: error: for each function it appears in.) >> ClamAV.xs:299: error: 'CL_EZIP' undeclared (first use in this >> function) >> ClamAV.xs:300: error: 'CL_EGZIP' undeclared (first use in >> this function) >> ClamAV.xs:301: error: 'CL_EBZIP' undeclared (first use in >> this function) >> ClamAV.xs:302: error: 'CL_EOLE2' undeclared (first use in >> this function) >> ClamAV.xs:303: error: 'CL_EMSCOMP' undeclared (first use in >> this function) >> ClamAV.xs:304: error: 'CL_EMSCAB' undeclared (first use in >> this function) >> ClamAV.xs:311: error: 'CL_EPATSHORT' undeclared (first use in >> this function) >> ClamAV.xs:314: error: 'CL_ECVDEXTR' undeclared (first use in >> this function) >> ClamAV.xs:315: error: 'CL_EMD5' undeclared (first use in this >> function) >> ClamAV.xs:316: error: 'CL_EDSIG' undeclared (first use in >> this function) >> ClamAV.xs:317: error: 'CL_EIO' undeclared (first use in this function) >> ClamAV.xs:319: error: 'CL_ESUPPORT' undeclared (first use in >> this function) >> ClamAV.xs:329: error: 'CL_DB_ACONLY' undeclared (first use in >> this function) >> ClamAV.xs:354: error: 'CL_RAW' undeclared (first use in this function) >> ClamAV.xs:355: error: 'CL_ARCHIVE' undeclared (first use in >> this function) >> ClamAV.xs:356: error: 'CL_MAIL' undeclared (first use in this >> function) >> ClamAV.xs:357: error: 'CL_OLE2' undeclared (first use in this >> function) >> ClamAV.xs:358: error: 'CL_ENCRYPTED' undeclared (first use in >> this function) >> make[1]: *** [ClamAV.o] Error 1 >> make[1]: Leaving directory >> `~/install-Clam-0.95-SA-3.2.5/perl-tar/Mail-ClamAV-0.22/_Inlin >> e/build/Mail/ClamAV' >> >> A problem was encountered while attempting to compile and >> install your Inline >> C code. The command that failed was: >> make >> >> The build directory was: >> ~/install-Clam-0.95-SA-3.2.5/perl-tar/Mail-ClamAV-0.22/_Inline >> /build/Mail/ClamAV >> >> To debug the problem, cd to the build directory, and inspect >> the output files. >> >> at >> ~/install-Clam-0.95-SA-3.2.5/perl-tar/Mail-ClamAV-0.22/blib/li >> b/Mail/ClamAV.pm line 175 >> BEGIN failed--compilation aborted at >> ~/install-Clam-0.95-SA-3.2.5/perl-tar/Mail-ClamAV-0.22/blib/li >> b/Mail/ClamAV.pm line 534. >> Compilation failed in require. >> BEGIN failed--compilation aborted. >> make: *** [ClamAV.inl] Error 25 >> >> >> -- >> Later >> >> Mogens Melander >> >> >> >> -- >> This message has been scanned for viruses and >> dangerous content by MailScanner, and is >> believed to be clean. >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> -- >> This message has been scanned for viruses and >> dangerous content by MailScanner, and is >> believed to be clean. >> >> >> > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > -- Later Mogens Melander -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From j.mcneil at alphabasesystems.co.uk Thu Apr 9 16:10:15 2009 From: j.mcneil at alphabasesystems.co.uk (James McNeil) Date: Thu Apr 9 16:10:25 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: <1238888292.5411.93.camel@lin-workstation.azapple.com> References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <1238795812.2313.254.camel@lin-workstation.azapple.com> <1238857504.5411.10.camel@lin-workstation.azapple.com> <49D7ACE6.8080908@ecs.soton.ac.uk> <1238888292.5411.93.camel@lin-workstation.azapple.com> Message-ID: <49DE0FD7.5050404@alphabasesystems.co.uk> Julian Field wrote: > I always just run the ./install.sh and everything works. I've followed the instruction to use the reinstall option and this allowed the Centos 5.3 update to go in okay, however the MailScanner install script errors with complaints such as: Missing file /usr/src/redhat/RPMS/noarch/perl-IO-1.2301-2.noarch.rpm. Maybe it did not build correctly? finishing with the expected error: Failed dependencies: perl-MIME-tools >= 5.412 is needed by mailscanner-4.75.11-1.noarch Anyone else had a similar problem or solution other than installing the perl modules by hand? :) From j.mcneil at alphabasesystems.co.uk Thu Apr 9 16:26:48 2009 From: j.mcneil at alphabasesystems.co.uk (James McNeil) Date: Thu Apr 9 16:26:54 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: <49DE0FD7.5050404@alphabasesystems.co.uk> References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <1238795812.2313.254.camel@lin-workstation.azapple.com> <1238857504.5411.10.camel@lin-workstation.azapple.com> <49D7ACE6.8080908@ecs.soton.ac.uk> <1238888292.5411.93.camel@lin-workstation.azapple.com> <49DE0FD7.5050404@alphabasesystems.co.uk> Message-ID: <49DE13B8.40109@alphabasesystems.co.uk> To answer my own query, it appears there was a strange entry for the rpm build directory in the .rpmmacros file for the user I was tryin got install as, sorry :) James McNeil wrote: > Julian Field wrote: > > > I always just run the ./install.sh and everything works. > > I've followed the instruction to use the reinstall option and this > allowed the Centos 5.3 update to go in okay, however the MailScanner > install script errors with complaints such as: > > Missing file /usr/src/redhat/RPMS/noarch/perl-IO-1.2301-2.noarch.rpm. > Maybe it did not build correctly? > > finishing with the expected > > error: Failed dependencies: > perl-MIME-tools >= 5.412 is needed by mailscanner-4.75.11-1.noarch > > Anyone else had a similar problem or solution other than installing the > perl modules by hand? :) From craigwhite at azapple.com Thu Apr 9 16:28:09 2009 From: craigwhite at azapple.com (Craig White) Date: Thu Apr 9 16:28:27 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: <49DE0FD7.5050404@alphabasesystems.co.uk> References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <1238795812.2313.254.camel@lin-workstation.azapple.com> <1238857504.5411.10.camel@lin-workstation.azapple.com> <49D7ACE6.8080908@ecs.soton.ac.uk> <1238888292.5411.93.camel@lin-workstation.azapple.com> <49DE0FD7.5050404@alphabasesystems.co.uk> Message-ID: <1239290889.869.267.camel@lin-workstation.azapple.com> On Thu, 2009-04-09 at 16:10 +0100, James McNeil wrote: > Julian Field wrote: > > > I always just run the ./install.sh and everything works. > > I've followed the instruction to use the reinstall option and this > allowed the Centos 5.3 update to go in okay, however the MailScanner > install script errors with complaints such as: > > Missing file /usr/src/redhat/RPMS/noarch/perl-IO-1.2301-2.noarch.rpm. > Maybe it did not build correctly? > > finishing with the expected > > error: Failed dependencies: > perl-MIME-tools >= 5.412 is needed by mailscanner-4.75.11-1.noarch > > Anyone else had a similar problem or solution other than installing the > perl modules by hand? :) ---- you really don't want to start mixing hand installed perl modules in with rpm perl modules...that can causes this type of problem. Check the logs from MailScanner. Craig -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From ssilva at sgvwater.com Thu Apr 9 16:28:43 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Thu Apr 9 16:29:08 2009 Subject: DomainKeys with postfix and mailscanner In-Reply-To: <49DE0A4C.50608@emcuk.com> References: <49DE0646.9000200@emcuk.com> <49DE0A4C.50608@emcuk.com> Message-ID: on 4-9-2009 7:46 AM Eddie Hallahan spake the following: > Seems to be that if you send more than x amount of messages from the > same IP they block you unless you are using DK. And they are definitely > blocking our servers. > And you are absolutely sure that they aren't blocking you for content violations and not just domainkeys? I move some mail (but not a lot) in and out of yahoo and don't see any problems. Usually I am blocking stuff FROM them. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090409/0e9f1641/signature.bin From dantian.ap at optusnet.com.au Fri Apr 10 01:39:55 2009 From: dantian.ap at optusnet.com.au (dantian.ap@optusnet.com.au) Date: Fri Apr 10 01:40:13 2009 Subject: Configuration option being overwritten Message-ID: <200904100040.n3A0dtqc018199@mail10.syd.optusnet.com.au> We have problem with Web Bug Replacement option We set it to our intranet but mailscanner replaces it with its setting again, every upgrade! I think is a bug, as if we set to custom it should stay custom like all other custom sets Why I think so? This setting is to prevent third party knowing if message read and privacy, and maybe other reasons. All mailscanner is doing is change the third party to itself, so mailscanner gets see hits and IP's this I feel good for default for those not wanting to set local, but bad, very bad when it replaces custom intranet with itself again every time, defeats most purpose, please I ask for this bug to be fixed. Best, Dantian Apreuvianty From steve.swaney at fsl.com Fri Apr 10 19:46:03 2009 From: steve.swaney at fsl.com (Stephen Swaney) Date: Fri Apr 10 19:46:19 2009 Subject: Spamhaus usage policy In-Reply-To: References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <1238795812.2313.254.camel@lin-workstation.azapple.com> <49D7AC88.6070909@ecs.soton.ac.uk> Message-ID: <046301c9ba0c$99c68d30$cd53a790$@swaney@fsl.com> I'm examining the feasibility of providing Spamhaus and other "for" pay RBL servers / services for our customers. I've had to read the "fine print" in the Usage policies to see who needs to buy the services and I've come across some information I think is worth sharing with the list. Below is a recap of the Spamhaus usage policy but please see: http://www.spamhaus.org/organization/dnsblusage.html for the complete Spamhaus Usage Policy Statement! Spamhaus RBL Usage Policies ---------------------------- The use of the Spamhaus ZEN list via DNS queries to their public DNSBL servers is free of charge if you meet all three of the following criteria: 1. Your use of the Spamhaus DNSBLs is non-commercial*, and 2. Your email traffic is less than 100,000 SMTP connections** per day, and 3. Your DNSBL query volume is less than 300,000 queries per day. *Definition: "non-commercial use" is use for any purpose other than as part or all of a product or service that is resold, or for use of which a fee is charged. For example, using our DNSBLs in a commercial spam filtering appliance that is then sold to others requires a data feed, regardless of use volume. The same is true of commercial spam filtering software and commercial spam filtering services. A company that uses the Spamhaus DNSBLs solely to filter their own email qualifies as a non-commercial user and may use our free public DNSBLs if that company's email volume and DNSBL query volume is below the free use limits. The same is true for any non-profit organization, school, religious organization, or private individual who operates their own mail server. ** (my guess) This would equate to approximately 3,500 mail boxes. ---------------------------------------------------- This means that any site that uses any type of commercial software to scan for spam MUST license the Spamhaus feed to use it. But the converse is also true! If you use only MailScanner and other open Source software and: 2. Your email traffic is less than 100,000 SMTP connections per day, and 3. Your DNSBL query volume is less than 300,000 queries per day. You can use / query Spamhaus at no charge. I have confirmed that this is correct with a Spamhaus re-seller. I just thought that some might find this information useful Steve -- Steve Swaney steve@fsl.com 202 595-7760 ext: 601 www.fsl.com The most accurate and cost effective anti-spam solutions available From MailScanner at ecs.soton.ac.uk Sat Apr 11 01:21:57 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Sat Apr 11 01:22:19 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <1238795812.2313.254.camel@lin-workstation.azapple.com> <49D7AC88.6070909@ecs.soton.ac.uk> <49DFE2A5.5070801@ecs.soton.ac.uk> Message-ID: On 7/4/09 16:31, Kai Schaetzl wrote: > Julian Field wrote on Sat, 04 Apr 2009 19:52:56 +0100: > > >> That sounds ancient. If you check the ChangeLog on search.cpan.org I >> think you will find a whole host of bugs fixed since that version. >> > Who says that the important fixes are not in that version? The point about > enterprise distributions is that you keep a reliable system for a long > time that also gets security and serious bug fixes over this time. > > What you are doing with your install script is about the same you did 5 or > more years ago. It may have been necessary back then. Nowadays the major > distributions are equipped with decent Perl support and with a slew of the > most important modules. And most other modules are usually available as > rpms from an external repository that specializes in that distribution. > Forcing rpms on top of the existing perl installation and included modules > is definitely something that one should not do. And it's easily avoidable. > This is only partially true. Quite a few of the modules do not "force install" on RHEL5 or CentOS 5 systems. One of the big problems is that there are many Perl modules where the Makefile.PL tells it to install in the core tree rather than the vendor or site trees. If the module attempts to install in the core tree, there is no alternative in the RPM built from that to "force install" it. This is true of quite a few different Perl modules. So if you build from CPAN you never see this. What do rpmforge and the like do about this problem? Examples of this are bignum, File-Temp and IO, though there are others too. You can see them in the big table of modules in the MailScanner RPM install.sh script in the last column in the lines. This is the "FORCE5" parameter where a "yes" makes it do a "force install" on RHEL5/CentOS5 systems. > I've been using MailScanner now for more than 5 years, Julian. Have you > seen any perl or installation related problems posted by me? I'm rarely > having any problem. This is due to your superb work and because I'm very > careful about what and how I put it on my machines. My MailScanners work > fine and my perl works fine, too. Without forcing any newer modules over > the ones coming with the distribution. > I would like to see an answer to my question above before saying much more. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Sat Apr 11 01:32:29 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Sat Apr 11 01:32:49 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <1238795812.2313.254.camel@lin-workstation.azapple.com> <49D7AC88.6070909@ecs.soton.ac.uk> <49DFE2A5.5070801@ecs.soton.ac.uk> <49DFE51D.6040409@ecs.soton.ac.uk> Message-ID: On 11/4/09 01:21, Julian Field wrote: > > > On 7/4/09 16:31, Kai Schaetzl wrote: >> Julian Field wrote on Sat, 04 Apr 2009 19:52:56 +0100: >> >>> That sounds ancient. If you check the ChangeLog on search.cpan.org I >>> think you will find a whole host of bugs fixed since that version. >> Who says that the important fixes are not in that version? The point >> about >> enterprise distributions is that you keep a reliable system for a long >> time that also gets security and serious bug fixes over this time. >> >> What you are doing with your install script is about the same you did >> 5 or >> more years ago. It may have been necessary back then. Nowadays the major >> distributions are equipped with decent Perl support and with a slew >> of the >> most important modules. And most other modules are usually available as >> rpms from an external repository that specializes in that distribution. >> Forcing rpms on top of the existing perl installation and included >> modules >> is definitely something that one should not do. And it's easily >> avoidable. > This is only partially true. Quite a few of the modules do not "force > install" on RHEL5 or CentOS 5 systems. One of the big problems is that > there are many Perl modules where the Makefile.PL tells it to install > in the core tree rather than the vendor or site trees. If the module > attempts to install in the core tree, there is no alternative in the > RPM built from that to "force install" it. This is true of quite a few > different Perl modules. So if you build from CPAN you never see this. > What do rpmforge and the like do about this problem? > > Examples of this are bignum, File-Temp and IO, though there are others > too. > > You can see them in the big table of modules in the MailScanner RPM > install.sh script in the last column in the lines. This is the > "FORCE5" parameter where a "yes" makes it do a "force install" on > RHEL5/CentOS5 systems. Okay, I can answer my own question. He builds them with various options to the "Makefile.PL" that I didn't know about, and over-rides the build dirs so they build into the vendor path instead of the core path. How about I pinch his *.spec file for each of the modules where I still "force install" on RHEL5/CentOS5 systems and stop doing the "force install" on those systems? Would you prefer me to do it for all the modules for RHEL4/CentOS4 systems as well, or are you not bothered by that one? Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Sat Apr 11 02:24:28 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Sat Apr 11 02:24:53 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <1238795812.2313.254.camel@lin-workstation.azapple.com> <49D7AC88.6070909@ecs.soton.ac.uk> <49DFE2A5.5070801@ecs.soton.ac.uk> <49DFE51D.6040409@ecs.soton.ac.uk> <49DFF14C.5000708@ecs.soton.ac.uk> Message-ID: On 11/4/09 01:32, Julian Field wrote: > > > On 11/4/09 01:21, Julian Field wrote: >> >> >> On 7/4/09 16:31, Kai Schaetzl wrote: >>> Julian Field wrote on Sat, 04 Apr 2009 19:52:56 +0100: >>> >>>> That sounds ancient. If you check the ChangeLog on search.cpan.org I >>>> think you will find a whole host of bugs fixed since that version. >>> Who says that the important fixes are not in that version? The point >>> about >>> enterprise distributions is that you keep a reliable system for a long >>> time that also gets security and serious bug fixes over this time. The enterprise distributions, in my experience, just upgrade the version of the Perl module used to build the RPM, they don't actually edit the source of the Perl code itself. So these old versions you are seeing really are old versions of the code. Feel free to produce a counter-example, with proof from the RPM file and/or the RedHat changelog. >>> >>> What you are doing with your install script is about the same you >>> did 5 or >>> more years ago. It may have been necessary back then. A lot of people still use old systems running RHEL3 or worse. And then there's all the 5-year old Fedora systems still out there... >>> Nowadays the major >>> distributions are equipped with decent Perl support and with a slew >>> of the >>> most important modules. And most other modules are usually available as >>> rpms from an external repository that specializes in that distribution. >>> Forcing rpms on top of the existing perl installation and included >>> modules >>> is definitely something that one should not do. And it's easily >>> avoidable. >> This is only partially true. Quite a few of the modules do not "force >> install" on RHEL5 or CentOS 5 systems. One of the big problems is >> that there are many Perl modules where the Makefile.PL tells it to >> install in the core tree rather than the vendor or site trees. If the >> module attempts to install in the core tree, there is no alternative >> in the RPM built from that to "force install" it. This is true of >> quite a few different Perl modules. So if you build from CPAN you >> never see this. What do rpmforge and the like do about this problem? >> >> Examples of this are bignum, File-Temp and IO, though there are >> others too. >> >> You can see them in the big table of modules in the MailScanner RPM >> install.sh script in the last column in the lines. This is the >> "FORCE5" parameter where a "yes" makes it do a "force install" on >> RHEL5/CentOS5 systems. > Okay, I can answer my own question. He builds them with various > options to the "Makefile.PL" that I didn't know about, and over-rides > the build dirs so they build into the vendor path instead of the core > path. > > How about I pinch his *.spec file for each of the modules where I > still "force install" on RHEL5/CentOS5 systems and stop doing the > "force install" on those systems? I have done this, and have just released 4.76.4 which should not "force install" any modules at all on a RHEL 5 or CentOS 5 system. Hopefully after you have installed that, you should be able to "yum update perl" on your system without any clashes at all. > Would you prefer me to do it for all the modules for RHEL4/CentOS4 > systems as well, or are you not bothered by that one? That would be a fair bigger bit of work, there are a lot of modules to fix. But I'll do it if you think it is worth it. Your thoughts please... :) Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Sat Apr 11 16:55:53 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Sat Apr 11 16:56:10 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <1238795812.2313.254.camel@lin-workstation.azapple.com> <49D7AC88.6070909@ecs.soton.ac.uk> <49DFE2A5.5070801@ecs.soton.ac.uk> <49DFE51D.6040409@ecs.soton.ac.uk> <49DFF14C.5000708@ecs.soton.ac.uk> <49E0BD89.3060204@ecs.soton.ac.uk> Message-ID: On 11/4/09 02:24, Julian Field wrote: > > > On 11/4/09 01:32, Julian Field wrote: >> >> >> On 11/4/09 01:21, Julian Field wrote: >>> >>> >>> On 7/4/09 16:31, Kai Schaetzl wrote: >>>> Julian Field wrote on Sat, 04 Apr 2009 19:52:56 +0100: >>>> >>>>> That sounds ancient. If you check the ChangeLog on search.cpan.org I >>>>> think you will find a whole host of bugs fixed since that version. >>>> Who says that the important fixes are not in that version? The >>>> point about >>>> enterprise distributions is that you keep a reliable system for a long >>>> time that also gets security and serious bug fixes over this time. > The enterprise distributions, in my experience, just upgrade the > version of the Perl module used to build the RPM, they don't actually > edit the source of the Perl code itself. So these old versions you are > seeing really are old versions of the code. Feel free to produce a > counter-example, with proof from the RPM file and/or the RedHat > changelog. > >>>> >>>> What you are doing with your install script is about the same you >>>> did 5 or >>>> more years ago. It may have been necessary back then. > A lot of people still use old systems running RHEL3 or worse. And then > there's all the 5-year old Fedora systems still out there... > >>>> Nowadays the major >>>> distributions are equipped with decent Perl support and with a slew >>>> of the >>>> most important modules. And most other modules are usually >>>> available as >>>> rpms from an external repository that specializes in that >>>> distribution. >>>> Forcing rpms on top of the existing perl installation and included >>>> modules >>>> is definitely something that one should not do. And it's easily >>>> avoidable. >>> This is only partially true. Quite a few of the modules do not >>> "force install" on RHEL5 or CentOS 5 systems. One of the big >>> problems is that there are many Perl modules where the Makefile.PL >>> tells it to install in the core tree rather than the vendor or site >>> trees. If the module attempts to install in the core tree, there is >>> no alternative in the RPM built from that to "force install" it. >>> This is true of quite a few different Perl modules. So if you build >>> from CPAN you never see this. What do rpmforge and the like do about >>> this problem? >>> >>> Examples of this are bignum, File-Temp and IO, though there are >>> others too. >>> >>> You can see them in the big table of modules in the MailScanner RPM >>> install.sh script in the last column in the lines. This is the >>> "FORCE5" parameter where a "yes" makes it do a "force install" on >>> RHEL5/CentOS5 systems. >> Okay, I can answer my own question. He builds them with various >> options to the "Makefile.PL" that I didn't know about, and over-rides >> the build dirs so they build into the vendor path instead of the core >> path. >> >> How about I pinch his *.spec file for each of the modules where I >> still "force install" on RHEL5/CentOS5 systems and stop doing the >> "force install" on those systems? > I have done this, and have just released 4.76.4 which should not > "force install" any modules at all on a RHEL 5 or CentOS 5 system. > Hopefully after you have installed that, you should be able to "yum > update perl" on your system without any clashes at all. > >> Would you prefer me to do it for all the modules for RHEL4/CentOS4 >> systems as well, or are you not bothered by that one? > That would be a fair bigger bit of work, there are a lot of modules to > fix. But I'll do it if you think it is worth it. > > Your thoughts please... :) > It should now definitely install cleanly on RHEL5 and CentOS 5 without any problems, and without doing a "forced" install of any modules. This is with 4.76.6. It won't force install any modules on any other version either, I just haven't had a chance to test it on these and iron out any problems yet. That's the next job. I'm nearly there :) This is taking a hell of a lot of work on the installer, but will solve all the upgrade problems once and for all. There are interesting things like the fact that RedHat got the module path @INC totally wrong in their release of Perl in RHEL 5, with the result that a lot of modules simply cannot be over-ridden without doing a "forced" install of files to overwrite stuff in their RPM, unless of course you mess with @INC at the start of your Perl program (which is what I have done) so that the vendor and site-specific directories actually get consulted before the core Perl system directories. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From lists at tippingmar.com Sat Apr 11 17:59:16 2009 From: lists at tippingmar.com (Mark Nienberg) Date: Sat Apr 11 17:59:33 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <1238795812.2313.254.camel@lin-workstation.azapple.com> <49D7AC88.6070909@ecs.soton.ac.uk> <49DFE2A5.5070801@ecs.soton.ac.uk> <49DFE51D.6040409@ecs.soton.ac.uk> <49DFF14C.5000708@ecs.soton.ac.uk> <49E0BD89.3060204@ecs.soton.ac.uk> Message-ID: <49E0CC64.1020101@tippingmar.com> Julian Field wrote: > the fact that RedHat got the module path @INC totally wrong in their > release of Perl in RHEL 5, with the result that a lot of modules > simply cannot be over-ridden without doing a "forced" install of files > to overwrite stuff in their RPM, unless of course you mess with @INC > at the start of your Perl program (which is what I have done) so that > the vendor and site-specific directories actually get consulted before > the core Perl system directories. > I think this ordering for @INC has always been the case on RHEL. They see it as a way to force the use of the supported versions of modules instead of unsupported ones the user might have added. https://bugzilla.redhat.com/show_bug.cgi?id=124443 That said, I like what you are doing! What about the perl modules installed with your SA easy installer? Can those eventually be done the same way? Mark Nienberg From MailScanner at ecs.soton.ac.uk Sat Apr 11 18:11:38 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Sat Apr 11 18:11:58 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: <49E0CC64.1020101@tippingmar.com> References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <1238795812.2313.254.camel@lin-workstation.azapple.com> <49D7AC88.6070909@ecs.soton.ac.uk> <49DFE2A5.5070801@ecs.soton.ac.uk> <49DFE51D.6040409@ecs.soton.ac.uk> <49DFF14C.5000708@ecs.soton.ac.uk> <49E0BD89.3060204@ecs.soton.ac.uk> <49E0CC64.1020101@tippingmar.com> <49E0CF4A.6050004@ecs.soton.ac.uk> Message-ID: On 11/4/09 17:59, Mark Nienberg wrote: > Julian Field wrote: >> the fact that RedHat got the module path @INC totally wrong in >> their release of Perl in RHEL 5, with the result that a lot of >> modules simply cannot be over-ridden without doing a "forced" install >> of files to overwrite stuff in their RPM, unless of course you mess >> with @INC at the start of your Perl program (which is what I have >> done) so that the vendor and site-specific directories actually get >> consulted before the core Perl system directories. >> > I think this ordering for @INC has always been the case on RHEL. They > see it as a way to force the use of the supported versions of modules > instead of unsupported ones the user might have added. > https://bugzilla.redhat.com/show_bug.cgi?id=124443 Yuck! It means you can't use more recent versions of Perl modules than the ones they supply, so you have to wait until they choose to upgrade you, if they ever do. Specifically stopping you using more recent stuff if you want to sounds like a particularly bad move to me. But I don't have to take their tech support calls. > > That said, I like what you are doing! What about the perl modules > installed with your SA easy installer? Can those eventually be done > the same way? They aren't done via RPMs, but I guess I could. It would take a while though, and there has never been the demand to in the past. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Sat Apr 11 18:19:46 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Sat Apr 11 18:20:12 2009 Subject: Configuration option being overwritten In-Reply-To: <200904100040.n3A0dtqc018199@mail10.syd.optusnet.com.au> References: <200904100040.n3A0dtqc018199@mail10.syd.optusnet.com.au> <49E0D132.3040409@ecs.soton.ac.uk> Message-ID: The reason I had to do this was that I had to change the location of the default 1x1 pixel image at one point, and so I had to overwrite people's setting of this value even if they already had it set to something. I have never removed this as I still get people using the old value, and I want them to be moved to the new value if they upgrade. I can assure you that there are no cookies tracking you or anything else, but yes, it does mean that I get to see the IP address of anyone viewing a message that has been disarmed by MailScanner. I don't keep that information secret, go to the very bottom of www.mailscanner.info and you will see the clustrmaps generated from the data. I only use the data to see what countries use MailScanner, that's all. I appreciate that your setting will get overwritten on every MailScanner upgrade, but you are I think the first person to ever complain about this. No-one else ever appears to bother changing the default value. Having the image point at my servers mean I have to supply the bandwidth required to serve all these images, and not you, so most people are grateful that I'm taking load off their servers. The image is served up by an "anycast" network, so is extremely powerful and robust. Sorry, but you'll have to continue to override my setting when you upgrade. It's a 1-liner in Perl to change this setting with a script. Jules. On 10/4/09 01:39, dantian.ap@optusnet.com.au wrote: > We have problem with Web Bug Replacement option > We set it to our intranet but mailscanner replaces it with its setting again, every upgrade! > I think is a bug, as if we set to custom it should stay custom like all other custom sets > > Why I think so? > This setting is to prevent third party knowing if message read and privacy, and maybe other reasons. > > All mailscanner is doing is change the third party to itself, so mailscanner gets see hits and IP's this I feel good for default for those not wanting to set local, but bad, very bad when it replaces custom intranet with itself again every time, defeats most purpose, please I ask for this bug to be fixed. > > Best, > Dantian Apreuvianty > > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From devonharding at gmail.com Sun Apr 12 16:43:37 2009 From: devonharding at gmail.com (Devon Harding) Date: Sun Apr 12 16:43:46 2009 Subject: Mailwatch --lint & /usr/lib/perl5/site_perl Message-ID: <2baac6140904120843y77aab4d2iabc31590fd2ad892@mail.gmail.com> I've just upgraded from FC5 to FC10. I was used perl verion 5.8.8 before, now FC10 uses 5.10.0. The problem I'm seeing is that when I run a spamassassin --lint from Mailwatch, it errors out with the folowing: [2404] warn: Subroutine version::qv redefined at /usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi/version.pm line 22. 0.11503 /usr/bin/perl: symbol lookup error: /usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi/auto/NetAddr/IP/Util/Util.so: undefined symbol: Perl_Tstack_sp_ptr 0.11772 *Finish - Total Time* *1.47749* Now what I've figured out is that it's trying to use the old version of perl located at /usr/lib/perl5/site_perl. Unfortunately, the directory 5.10.0 does not exist at this location. doing some googling, I found out that this was changed to /usr/local/lib/perl5/site_perl from here: https://bugzilla.redhat.com/show_bug.cgi?id=457771. Now if I rename /usr/lib/perl/perl5/site_perl to /usr/lib/perl/perl5/site_perl.old, the MailWatch lint works. Adding a symbolic link in that dirctory didin't work either, it still tries to use 5.8.8. I didn't really wan to leave this renamed as I didn't know what it might break. Is this something that can be fixed in MailWatch? Thanks, -Devon -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090412/e70ca4c9/attachment.html From hvdkooij at vanderkooij.org Sun Apr 12 23:17:07 2009 From: hvdkooij at vanderkooij.org (Hugo van der Kooij) Date: Sun Apr 12 23:17:16 2009 Subject: DomainKeys with postfix and mailscanner In-Reply-To: <49DE0646.9000200@emcuk.com> References: <49DE0646.9000200@emcuk.com> Message-ID: <49E26863.5070203@vanderkooij.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Eddie Hallahan wrote: > given BT/Yahoo blocking anyone who isn't using domainKeys I'm now having > to look into implementing DomainKeys on my systems. Is this possible > using Mailscanner with postfix as the mta? Sweet. I get far more spam WITH DomainKeys then without. So maybe I should start blocking email from systems that DO use it. That should be rather easy with postfix. Hugo. - -- hvdkooij@vanderkooij.org http://hugo.vanderkooij.org/ PGP/GPG? Use: http://hugo.vanderkooij.org/0x58F19981.asc A: Yes. >Q: Are you sure? >>A: Because it reverses the logical flow of conversation. >>>Q: Why is top posting frowned upon? Bored? Click on http://spamornot.org/ and rate those images. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iEYEARECAAYFAkniaGEACgkQBvzDRVjxmYHoBwCcDLKm/fc8xqjI/o8JYCQmQJX2 EqUAnjcQTZYqSDfj+LMQ7tFz2fOFvNiF =Q8iA -----END PGP SIGNATURE----- From MailScanner at ecs.soton.ac.uk Mon Apr 13 10:24:23 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Mon Apr 13 10:24:43 2009 Subject: MailScanner installer References: <49E304C7.5060906@ecs.soton.ac.uk> Message-ID: Right, I have just finished a good weekend's work on the installer, and all the Perl modules it installs. Most of the Perl modules have been upgraded for starters. The installer no longer "forces" the install of any Perl module. So you can upgrade Perl independently at any time without it clashing with any of MailScanner's Perl modules. Hopefully this will make quite a few of you happier :-) All modules install cleanly on RedHat Enterprise 4 and 5, CentOS 4 and 5, and Fedora Core 9 and 10. Those are what I have tested it on and ironed out all the problems on. There are several command-line options to the installer that you should know about. "./install.sh --help" will print these. ./install.sh fast ---- Skip all the waiting and pausing in the installation process. ./install.sh reinstall ---- Uninstall all the Perl modules first, before reinstalling them all again. Useful if you think something has got corrupted. ./install.sh nomodules ---- Do not install any of the supporting Perl modules, just install tnef and MailScanner and nothing else. I have done quite a bit of testing on this installer, but please do try it on your individual systems and check that it all works and produces a working system. Cheers, and enjoy the rest of your Easter weekend, those of you in countries (like me) that are lucky enough to have today off work! Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From raymond at prolocation.net Mon Apr 13 11:53:33 2009 From: raymond at prolocation.net (Raymond Dijkxhoorn) Date: Mon Apr 13 11:53:42 2009 Subject: MailScanner installer In-Reply-To: References: <49E304C7.5060906@ecs.soton.ac.uk> Message-ID: Hi Jules, > The installer no longer "forces" the install of any Perl module. So you can > upgrade Perl independently at any time without it clashing with any of > MailScanner's Perl modules. Hopefully this will make quite a few of you > happier :-) > > All modules install cleanly on RedHat Enterprise 4 and 5, CentOS 4 and 5, and > Fedora Core 9 and 10. Those are what I have tested it on and ironed out all > the problems on. > > There are several command-line options to the installer that you should know > about. "./install.sh --help" will print these. > > ./install.sh fast ---- Skip all the waiting and pausing in the installation > process. > ./install.sh reinstall ---- Uninstall all the Perl modules first, before > reinstalling them all again. Useful if you think something has got corrupted. > ./install.sh nomodules ---- Do not install any of the supporting Perl > modules, just install tnef and MailScanner and nothing else. > > I have done quite a bit of testing on this installer, but please do try it on > your individual systems and check that it all works and produces a working > system. > > Cheers, and enjoy the rest of your Easter weekend, those of you in countries > (like me) that are lucky enough to have today off work! Tested and installed just fine on 2 CentOS 5.3 machines. Perhaps you could create the Lock file dir also? Apr 13 12:20:48 server4 MailScanner: Could not read directory /var/spool/MailScanner/incoming/Locks Apr 13 12:20:48 server4 MailScanner: Error in configuration file line 2845, directory /var/spool/MailScanner/incoming/Locks for lockfiledir does not exist (or is not readable) Manually created it and then it was fine, but perhaps just create it? Thanks! Raymond. From MailScanner at ecs.soton.ac.uk Mon Apr 13 14:43:06 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Mon Apr 13 14:43:22 2009 Subject: MailScanner installer In-Reply-To: References: <49E304C7.5060906@ecs.soton.ac.uk> <49E3416A.80108@ecs.soton.ac.uk> Message-ID: On 13/4/09 11:53, Raymond Dijkxhoorn wrote: > Hi Jules, > >> The installer no longer "forces" the install of any Perl module. So >> you can upgrade Perl independently at any time without it clashing >> with any of MailScanner's Perl modules. Hopefully this will make >> quite a few of you happier :-) >> >> All modules install cleanly on RedHat Enterprise 4 and 5, CentOS 4 >> and 5, and Fedora Core 9 and 10. Those are what I have tested it on >> and ironed out all the problems on. >> >> There are several command-line options to the installer that you >> should know about. "./install.sh --help" will print these. >> >> ./install.sh fast ---- Skip all the waiting and pausing in the >> installation process. >> ./install.sh reinstall ---- Uninstall all the Perl modules first, >> before reinstalling them all again. Useful if you think something has >> got corrupted. >> ./install.sh nomodules ---- Do not install any of the supporting Perl >> modules, just install tnef and MailScanner and nothing else. >> >> I have done quite a bit of testing on this installer, but please do >> try it on your individual systems and check that it all works and >> produces a working system. >> >> Cheers, and enjoy the rest of your Easter weekend, those of you in >> countries (like me) that are lucky enough to have today off work! > > Tested and installed just fine on 2 CentOS 5.3 machines. > > Perhaps you could create the Lock file dir also? > > Apr 13 12:20:48 server4 MailScanner: Could not read directory > /var/spool/MailScanner/incoming/Locks > Apr 13 12:20:48 server4 MailScanner: Error in configuration file line > 2845, directory /var/spool/MailScanner/incoming/Locks for lockfiledir > does not exist (or is not readable) > > Manually created it and then it was fine, but perhaps just create it? No problem. Just published 4.76.10-2 which should fix this problem for you. Please remove the Locks dir and upgrade to -2 and you should find it will create it for you now. Sorry about that one. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From mark at msapiro.net Mon Apr 13 16:32:54 2009 From: mark at msapiro.net (Mark Sapiro) Date: Mon Apr 13 16:33:06 2009 Subject: MailScanner installer In-Reply-To: References: <49E304C7.5060906@ecs.soton.ac.uk> Message-ID: <20090413153254.GA3824@msapiro> On Mon, Apr 13, 2009 at 10:24:23AM +0100, Julian Field wrote: > > I have done quite a bit of testing on this installer, but please do try > it on your individual systems and check that it all works and produces a > working system. It seems I was a bit quick, so this report may be moot, but yesterday I ran through the following scenario on CentOS 5. 1) Upgraded from MailScanner 4.76.3-1 to 4.76.7-1 with "./install.sh fast" and restarted MailScanner. This went fine as usual. 2) Attempted "yum upgrage perl" to 5.8.8-18 from some earlier 5.8.8 version. This complained about two file conflicts - /usr/lib/perl5/5.8.8/File/Temp.pm and an associated man page. 3) Ran MailScanner's "./install.sh reinstall fast". After this, ran "find /usr/lib/perl5 -name Temp.pm" and the only one found was /usr/lib/perl5/5.8.8/File/Temp.pm. 4) Attempted "yum upgrade perl" again expecting the results in 2), but to my surprise it succeeded. 5) Attempted to restart Mailscanner and it died complaining about File::Temp being version 0.16. 6) Ran MailScanner's "./install.sh fast". This time it installed Temp.pm version 0.20 in /usr/lib/perl5/vendor_perl/5.8.8/File/Temp.pm and left version 0.16 in /usr/lib/perl5/5.8.8/File/Temp.pm, and MailScanner subsequently started happily. So it seems like there was some glitch getting started, but everything will be OK going forward. Today I will upgrade to 4.76.10-2. -- Mark Sapiro mark at msapiro net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From mailscanner.info at sm.msk.ru Mon Apr 13 17:59:23 2009 From: mailscanner.info at sm.msk.ru (Sergey) Date: Mon Apr 13 17:59:42 2009 Subject: Attachments with long Cyrillic/Russian names get name broken Message-ID: <144979447.20090413205923@sm.msk.ru> Hi all, Got a problem. We are using Mailscanner as a filter of incoming mail. Part of that mail is in Russian and what is worse, it happens to have attachments named in Russian as well. When passing the Mailscanner such names get re-encoded to sometimes like that (`quoted-printable form'?) : ????, ??? ??????? ????????. ?? ???????? ????? =?koi8-r?B?2SDT18/Fyiwg7skg09fFLnJhcg== or =windows-1251Q=C8=F2=E0=EA=2C_=EE=ED=E0_=E7=E2=E0=EB=E0=F1=FC_=D2=E0=F2=FC=FF=ED=EE=E9=2E_=CD=E8 (Yes, first is a KOI-8 and the second CP1251 encoding) Any name gets broken that way if it is longer than 63 characters This seems to be an effect of Mailscanner, as both MS Exchange/Outlook and Sendmail were tested separately and both pass such attachments transparently. The problem is, an end-user receives an attachment without extension and has no clue how to open it. On the other hand, it is common enough to name files by long names among the users. I have not found anything addressing that effect in the archives (Are we first Russian-speaking people who use Mailscanner?) Could please anybody tell where to dig? The packages used are: MailScanner-perl-MIME-Base64-3.05-5 mailscanner-4.74.16-1 Perl is v5.8.8 built for x86_64-linux-thread-multi OS: openSUSE 10.2 (X86-64) Thank you in advance, -- Best regards, Sergey mailto:mailscanner.info@sm.msk.ru From mark at msapiro.net Mon Apr 13 18:31:39 2009 From: mark at msapiro.net (Mark Sapiro) Date: Mon Apr 13 18:32:02 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: Message-ID: Julian Field wrote: > >I'm nearly there :) This is taking a hell of a lot of work on the >installer, but will solve all the upgrade problems once and for all. >There are interesting things like the fact that RedHat got the module >path @INC totally wrong in their release of Perl in RHEL 5, with the >result that a lot of modules simply cannot be over-ridden without doing >a "forced" install of files to overwrite stuff in their RPM, unless of >course you mess with @INC at the start of your Perl program (which is >what I have done) so that the vendor and site-specific directories >actually get consulted before the core Perl system directories. It appears this may no longer be the case with the RedHat rpm. I just did a yum upgrade to perl.i386 4:5.8.8-18.el5_3.1, and I get [mark@sbh16 ~]$ perl -e 'foreach $d ( @INC ) {print $d . "\n";}' /usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.7/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.6/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.5/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.8 /usr/lib/perl5/site_perl/5.8.7 /usr/lib/perl5/site_perl/5.8.6 /usr/lib/perl5/site_perl/5.8.5 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.8.8/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.7/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.6/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.5/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.8 /usr/lib/perl5/vendor_perl/5.8.7 /usr/lib/perl5/vendor_perl/5.8.6 /usr/lib/perl5/vendor_perl/5.8.5 /usr/lib/perl5/vendor_perl /usr/lib/perl5/5.8.8/i386-linux-thread-multi /usr/lib/perl5/5.8.8 . -- Mark Sapiro The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From raymond at prolocation.net Mon Apr 13 19:17:32 2009 From: raymond at prolocation.net (Raymond Dijkxhoorn) Date: Mon Apr 13 19:17:42 2009 Subject: MailScanner installer In-Reply-To: References: <49E304C7.5060906@ecs.soton.ac.uk> <49E3416A.80108@ecs.soton.ac.uk> Message-ID: Hi! >> Apr 13 12:20:48 server4 MailScanner: Could not read directory >> /var/spool/MailScanner/incoming/Locks >> Apr 13 12:20:48 server4 MailScanner: Error in configuration file line 2845, >> directory /var/spool/MailScanner/incoming/Locks for lockfiledir does not >> exist (or is not readable) >> Manually created it and then it was fine, but perhaps just create it? > No problem. Just published 4.76.10-2 which should fix this problem for you. > Please remove the Locks dir and upgrade to -2 and you should find it will > create it for you now. Sorry about that one. I'll upgrade another one ;) Thanks. Raymond. From ssilva at sgvwater.com Mon Apr 13 19:48:03 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Mon Apr 13 19:48:25 2009 Subject: Spamhaus usage policy In-Reply-To: <28246.8991158114$1239389492@news.gmane.org> References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <1238795812.2313.254.camel@lin-workstation.azapple.com> <49D7AC88.6070909@ecs.soton.ac.uk> <28246.8991158114$1239389492@news.gmane.org> Message-ID: on 4-10-2009 11:46 AM Stephen Swaney spake the following: > I'm examining the feasibility of providing Spamhaus and other "for" pay RBL > servers / services for our customers. I've had to read the "fine print" in > the Usage policies to see who needs to buy the services and I've come across > some information I think is worth sharing with the list. > > Below is a recap of the Spamhaus usage policy but please see: > http://www.spamhaus.org/organization/dnsblusage.html for the complete > Spamhaus Usage Policy Statement! > > Spamhaus RBL Usage Policies > ---------------------------- > > The use of the Spamhaus ZEN list via DNS queries to their public DNSBL > servers is free of charge if you meet all three of the following criteria: > 1. Your use of the Spamhaus DNSBLs is non-commercial*, and > 2. Your email traffic is less than 100,000 SMTP connections** per day, > and > 3. Your DNSBL query volume is less than 300,000 queries per day. > > *Definition: "non-commercial use" is use for any purpose other than as part > or all of a product or service that is resold, or for use of which a fee is > charged. For example, using our DNSBLs in a commercial spam filtering > appliance that is then sold to others requires a data feed, regardless of > use volume. The same is true of commercial spam filtering software and > commercial spam filtering services. > > A company that uses the Spamhaus DNSBLs solely to filter their own email > qualifies as a non-commercial user and may use our free public DNSBLs if > that company's email volume and DNSBL query volume is below the free use > limits. The same is true for any non-profit organization, school, religious > organization, or private individual who operates their own mail server. > > ** (my guess) This would equate to approximately 3,500 mail boxes. > ---------------------------------------------------- > > > This means that any site that uses any type of commercial software to scan > for spam MUST license the Spamhaus feed to use it. > > But the converse is also true! > > If you use only MailScanner and other open Source software and: > > 2. Your email traffic is less than 100,000 SMTP connections per day, > and > 3. Your DNSBL query volume is less than 300,000 queries per day. > > You can use / query Spamhaus at no charge. I have confirmed that this is > correct with a Spamhaus re-seller. > > I just thought that some might find this information useful > > Steve > I got blacklisted for MUCH less than half of those amounts. My server doesn't go anywhere near 100,000 connections a day, or 300,000 queries a day. And good luck getting spamhaus to reply to ANY e-mails asking about it. If they decide to blacklist you, it will be arbitrarily below the stated amounts, and you will never get an answer if you ask for how they arrived at it. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090413/6ad391ae/signature.bin From ssilva at sgvwater.com Mon Apr 13 19:53:16 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Mon Apr 13 19:53:35 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: <49E0CC64.1020101@tippingmar.com> References: <1238773151.2313.159.camel@lin-workstation.azapple.com> <1238795812.2313.254.camel@lin-workstation.azapple.com> <49D7AC88.6070909@ecs.soton.ac.uk> <49DFE2A5.5070801@ecs.soton.ac.uk> <49DFE51D.6040409@ecs.soton.ac.uk> <49DFF14C.5000708@ecs.soton.ac.uk> <49E0BD89.3060 204@ecs.soton.ac.uk> <49E0CC64.1020101@tippingmar.com> Message-ID: on 4-11-2009 9:59 AM Mark Nienberg spake the following: > Julian Field wrote: >> the fact that RedHat got the module path @INC totally wrong in their >> release of Perl in RHEL 5, with the result that a lot of modules >> simply cannot be over-ridden without doing a "forced" install of files >> to overwrite stuff in their RPM, unless of course you mess with @INC >> at the start of your Perl program (which is what I have done) so that >> the vendor and site-specific directories actually get consulted before >> the core Perl system directories. >> > I think this ordering for @INC has always been the case on RHEL. They > see it as a way to force the use of the supported versions of modules > instead of unsupported ones the user might have added. > https://bugzilla.redhat.com/show_bug.cgi?id=124443 > > That said, I like what you are doing! What about the perl modules > installed with your SA easy installer? Can those eventually be done the > same way? > > Mark Nienberg There are rpm versions of spamassassin that get updated quickly on most of the alternate repos. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090413/1836159b/signature.bin From ssilva at sgvwater.com Mon Apr 13 19:56:57 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Mon Apr 13 20:05:11 2009 Subject: Mailwatch --lint & /usr/lib/perl5/site_perl In-Reply-To: <2baac6140904120843y77aab4d2iabc31590fd2ad892@mail.gmail.com> References: <2baac6140904120843y77aab4d2iabc31590fd2ad892@mail.gmail.com> Message-ID: on 4-12-2009 8:43 AM Devon Harding spake the following: > I've just upgraded from FC5 to FC10. ?I was used perl verion 5.8.8 > before, now FC10 uses 5.10.0. ?The problem I'm seeing is that when I run > a spamassassin --lint from Mailwatch, it errors out with the folowing: > > [2404] warn: Subroutine version::qv redefined at > /usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi/version.pm > line 22. 0.11503 /usr/bin/perl: symbol lookup error: > /usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi/auto/NetAddr/IP/Util/Util.so: > undefined symbol: Perl_Tstack_sp_ptr 0.11772 *Finish - Total Time*** > *1.47749* > > Now what I've figured out is that it's trying to use the old version of > perl located at?/usr/lib/perl5/site_perl. ?Unfortunately, the directory > 5.10.0 does not exist at this location. ?doing some googling, I found > out that this was changed to?/usr/local/lib/perl5/site_perl?from > here:?https://bugzilla.redhat.com/show_bug.cgi?id=457771. ?Now if I > rename /usr/lib/perl/perl5/site_perl to > /usr/lib/perl/perl5/site_perl.old, the MailWatch lint works. ?Adding a > symbolic link in that dirctory didin't work either, it still tries to > use 5.8.8. > > I didn't really wan to leave this renamed as I didn't know what it might > break. ?Is this something that can be fixed in MailWatch? > > Thanks, > > -Devon > Is this a new install or did you just do an upgrade in place? If you upgraded, you will probably need to re-install MailScanner to get the modules in the proper place. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090413/5c940414/signature.bin From prandal at herefordshire.gov.uk Mon Apr 13 20:24:32 2009 From: prandal at herefordshire.gov.uk (Randal, Phil) Date: Mon Apr 13 20:24:50 2009 Subject: MailScanner-4.76.10-2 can't install Test::Pod Message-ID: <7EF0EE5CB3B263488C8C18823239BEBA03CF9C@HC-MBX02.herefordshire.gov.uk> On CentOS 5.3, 64-bit. ./install.sh ..... + umask 022 + cd /usr/src/redhat/BUILD + LANG=C + export LANG + unset DISPLAY + cd /usr/src/redhat/BUILD + rm -rf Test-Pod-1.26 + /bin/gzip -dc /usr/src/redhat/SOURCES/Test-Pod-1.26.tar.gz + tar -xf - + STATUS=0 + '[' 0 -ne 0 ']' + cd Test-Pod-1.26 ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chown -Rhf root . ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chgrp -Rhf root . + /bin/chmod -Rf a+rX,u+w,g-w,o-w . + exit 0 Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.68510 + umask 022 + cd /usr/src/redhat/BUILD + cd Test-Pod-1.26 + LANG=C + export LANG + unset DISPLAY + CFLAGS='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic' + perl Makefile.PL Checking if your kit is complete... Looks good Warning: prerequisite Test::More 0.62 not found. We have 0.6. Writing Makefile for Test::Pod + make cp Pod.pm blib/lib/Test/Pod.pm Manifying blib/man3/Test::Pod.3pm + make test PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/00-load..............# Testing Test::Pod 1.26, Perl 5.008008, /usr/bin/perl t/00-load..............ok t/all_pod_files........ok t/cut-outside-block....ok 1/2 # Failed test (t/cut-outside-block.t at line 20) t/cut-outside-block....NOK 2# STDERR is: # # Failed test (t/cut-outside-block.t at line 15) # # t/cut-outside-block.pod (5): =cut found outside a pod block. Skipping to next block. # # not: # /#\s+Failed\ test.*?\n?.*?at\ t\/cut\-outside\-block\.t line 15.*\n?/ # # # t/cut-outside-block.pod (5): =cut found outside a pod block. Skipping to next block. # # as expected t/cut-outside-block....FAILED test 2 Failed 1/2 tests, 50.00% okay t/good.................ok t/item-ordering........ok 1/2 # Failed test (t/item-ordering.t at line 19) t/item-ordering........NOK 2# STDERR is: # # Failed test (t/item-ordering.t at line 14) # # t/item-ordering.pod (32): You can't have =items (as at line 36) unless the first thing after the =over is an =item # # not: # /#\s+Failed\ test.*?\n?.*?at\ t\/item\-ordering\.t line 14.*\n?/ # # # t/item-ordering.pod (32): You can't have =items (as at line 36) unless the first thing after the =over is an =item # # as expected t/item-ordering........FAILED test 2 Failed 1/2 tests, 50.00% okay t/load.................ok t/missing-file.........ok 1/3 # Failed test (t/missing-file.t at line 18) t/missing-file.........NOK 2# STDERR is: # # Failed test (t/missing-file.t at line 16) # # t/non-existent.pod does not exist # # not: # /#\s+Failed\ test.*?\n?.*?at\ t\/missing\-file\.t line 16.*\n?/ # # # t/non-existent.pod does not exist # # as expected # Failed test (t/missing-file.t at line 28) t/missing-file.........NOK 3# STDERR is: # # Failed test (t/missing-file.t at line 26) # # t/non-existent.pod does not exist # # not: # /#\s+Failed\ test.*?\n?.*?at\ t\/missing\-file\.t line 26.*\n?/ # # # t/non-existent.pod does not exist # # as expected t/missing-file.........FAILED tests 2-3 Failed 2/3 tests, 33.33% okay t/pod..................ok t/selftest.............ok t/spaced-directives....skipped all skipped: Not written yet t/unknown-directive....ok 1/2 # Failed test (t/unknown-directive.t at line 20) t/unknown-directive....NOK 2# STDERR is: # # Failed test (t/unknown-directive.t at line 16) # # t/unknown-directive.pod (9): Unknown directive: =over4 # # t/unknown-directive.pod (13): Unknown directive: =under # # not: # /#\s+Failed\ test.*?\n?.*?at\ t\/unknown\-directive\.t line 16.*\n?/ # # # t/unknown-directive.pod (9): Unknown directive: =over4 # # # t/unknown-directive.pod (13): Unknown directive: =under # # as expected t/unknown-directive....FAILED test 2 Failed 1/2 tests, 50.00% okay Failed Test Stat Wstat Total Fail Failed List of Failed ------------------------------------------------------------------------ ------- t/cut-outside-block.t 2 1 50.00% 2 t/item-ordering.t 2 1 50.00% 2 t/missing-file.t 3 2 66.67% 2-3 t/unknown-directive.t 2 1 50.00% 2 1 test skipped. Failed 4/11 test scripts, 63.64% okay. 5/19 subtests failed, 73.68% okay. make: *** [test_dynamic] Error 255 error: Bad exit status from /var/tmp/rpm-tmp.68510 (%build) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.68510 (%build) Any ideas? Phil -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090413/1a33cd28/attachment.html From alex at rtpty.com Mon Apr 13 20:41:56 2009 From: alex at rtpty.com (Alex Neuman) Date: Mon Apr 13 20:42:07 2009 Subject: scanctl Message-ID: <24e3d2e40904131241v3d85ff75h5eb4c8fe00bb53cb@mail.gmail.com> I came across the following: http://www.entrophy-free.net/mail/scanctl I tried googling for its name + "Julian Field" and came up with nothing, so I turn to you guys... Has anybody here used/heard/thought about this, ever? Don't remember it being mentioned at all on the list either. -- Alex Neuman van der Hans Reliant Technologies +507 6781-9505 +507 202-1525 alex@rtpty.com Skype: alexneuman -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090413/10233e24/attachment.html From ecasarero at gmail.com Mon Apr 13 22:47:07 2009 From: ecasarero at gmail.com (Eduardo Casarero) Date: Mon Apr 13 22:47:45 2009 Subject: OT: Server puts in zombie mode. Message-ID: <7d9b3cf20904131447t6b8a923chfb50166e9c5af692@mail.gmail.com> Hi, i've a rare situation on some servers, they just get zombie. After all i've researched i think it's a HD hang out or something in storage because i couldnt find any trace in the logs. The failure seems to be random and the server in zombie mode appears to be online answering ping and if you telnet ssh port you get connected but after you connect the connection is lost (as if the servers tries to read something from HD). Also the servers that eventually crash have years of heavy load processing emails (this backups my theory of HD failure). After rebooting the server everything seems to be ok. The SO is slackware and some servers are slackware 10.2 or 12.1 so i think is not a SO bug, also they have different versions of MailScanner/SA/clamd (because they have years working and the upgrade process is not masive. Usually the zombie servers has SATA disk (that also backups my theory) Does anyone have any idea of how can i get a log or something to demostrate this? or any other test to get better/or another conclusion or cause? Any help would be really appreciated. Thanks eduardo. From ChrisSweeney at osubucks.org Mon Apr 13 22:54:40 2009 From: ChrisSweeney at osubucks.org (Christopher Sweeney) Date: Mon Apr 13 22:54:51 2009 Subject: OT: Server puts in zombie mode. Message-ID: <5485D83E8AEA2A4C93D5AEB1F3444564B4CE@IFCINCINNATI01.ifcincinnati.org> Can you connect to them local when they do this? One thing that comes to mind is a DNS problem. Sent from the totaly AWSOME BlackBerry 8900 from T-Mobile. ----- Original Message ----- From: mailscanner-bounces@lists.mailscanner.info To: MailScanner discussion Sent: Mon Apr 13 17:47:07 2009 Subject: OT: Server puts in zombie mode. Hi, i've a rare situation on some servers, they just get zombie. After all i've researched i think it's a HD hang out or something in storage because i couldnt find any trace in the logs. The failure seems to be random and the server in zombie mode appears to be online answering ping and if you telnet ssh port you get connected but after you connect the connection is lost (as if the servers tries to read something from HD). Also the servers that eventually crash have years of heavy load processing emails (this backups my theory of HD failure). After rebooting the server everything seems to be ok. The SO is slackware and some servers are slackware 10.2 or 12.1 so i think is not a SO bug, also they have different versions of MailScanner/SA/clamd (because they have years working and the upgrade process is not masive. Usually the zombie servers has SATA disk (that also backups my theory) Does anyone have any idea of how can i get a log or something to demostrate this? or any other test to get better/or another conclusion or cause? Any help would be really appreciated. Thanks eduardo. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ________________________________ avast! Antivirus : Inbound message clean. Virus Database (VPS): 090413-0, 04/13/2009 Tested on: 4/13/2009 5:50:04 PM avast! - copyright (c) 1988-2009 ALWIL Software. ________________________________ avast! Antivirus : Inbound message clean. Virus Database (VPS): 090413-0, 04/13/2009 Tested on: 4/13/2009 5:50:45 PM avast! - copyright (c) 1988-2009 ALWIL Software. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090413/e0c84dc8/attachment.html From ssilva at sgvwater.com Mon Apr 13 23:00:42 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Mon Apr 13 23:01:03 2009 Subject: OT: Server puts in zombie mode. In-Reply-To: <7d9b3cf20904131447t6b8a923chfb50166e9c5af692@mail.gmail.com> References: <7d9b3cf20904131447t6b8a923chfb50166e9c5af692@mail.gmail.com> Message-ID: on 4-13-2009 2:47 PM Eduardo Casarero spake the following: > Hi, i've a rare situation on some servers, they just get zombie. After > all i've researched i think it's a HD hang out or something in storage > because i couldnt find any trace in the logs. The failure seems to be > random and the server in zombie mode appears to be online answering > ping and if you telnet ssh port you get connected but after you > connect the connection is lost (as if the servers tries to read > something from HD). > > Also the servers that eventually crash have years of heavy load > processing emails (this backups my theory of HD failure). After > rebooting the server everything seems to be ok. > > The SO is slackware and some servers are slackware 10.2 or 12.1 so i > think is not a SO bug, also they have different versions of > MailScanner/SA/clamd (because they have years working and the upgrade > process is not massive. Usually the zombie servers has SATA disk (that > also backups my theory) > > Does anyone have any idea of how can i get a log or something to > demostrate this? or any other test to get better/or another conclusion > or cause? > > Any help would be really appreciated. > > Thanks eduardo. Hang a serial console on the system and watch it or log it. It might get some kernel messages that don't get written to log. Also try a memory test. Memory can also go bad over time, especially on overworked servers that might have collected some dust over the years and overheated. Maybe even just pull and reseat all the cards, memory, and even the processor in case some oxidation is present on the connectors. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090413/03d4ffcb/signature.bin From MailScanner at ecs.soton.ac.uk Mon Apr 13 23:45:30 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Mon Apr 13 23:45:55 2009 Subject: MailScanner-4.76.10-2 can't install Test::Pod In-Reply-To: <7EF0EE5CB3B263488C8C18823239BEBA03CF9C@HC-MBX02.herefordshire.gov.uk> References: <7EF0EE5CB3B263488C8C18823239BEBA03CF9C@HC-MBX02.herefordshire.gov.uk> <49E3C08A.20107@ecs.soton.ac.uk> Message-ID: Did it successfully install Test-Simple just before Test-Pod? That should have been enough. The error message implies that it didn't find your Test-Simple that should have been just installed. So either it didn't install it or it didn't find it when it tried to build Test-Pod. Please can you do find /usr/lib64/perl5 /usr/lib/perl5 -name More.pm -print | xargs grep VERSION (all on one line) and it will tell you the version number of every copy of Test::More you have installed. You don't have $PERL5LIB set to anything do you? Just do an echo $PERL5LIB and be sure you get an empty line. If you don't, then do PERL5LIB= export PERL5LIB ./install.sh On 13/4/09 20:24, Randal, Phil wrote: > On CentOS 5.3, 64-bit. > ./install.sh ..... > + umask 022 > + cd /usr/src/redhat/BUILD > + LANG=C > + export LANG > + unset DISPLAY > + cd /usr/src/redhat/BUILD > + rm -rf Test-Pod-1.26 > + /bin/gzip -dc /usr/src/redhat/SOURCES/Test-Pod-1.26.tar.gz > + tar -xf - > + STATUS=0 > + '[' 0 -ne 0 ']' > + cd Test-Pod-1.26 > ++ /usr/bin/id -u > + '[' 0 = 0 ']' > + /bin/chown -Rhf root . > ++ /usr/bin/id -u > + '[' 0 = 0 ']' > + /bin/chgrp -Rhf root . > + /bin/chmod -Rf a+rX,u+w,g-w,o-w . > + exit 0 > Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.68510 > + umask 022 > + cd /usr/src/redhat/BUILD > + cd Test-Pod-1.26 > + LANG=C > + export LANG > + unset DISPLAY > + CFLAGS='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions > -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic' > + perl Makefile.PL > Checking if your kit is complete... > Looks good > Warning: prerequisite Test::More 0.62 not found. We have 0.6. > Writing Makefile for Test::Pod > + make > cp Pod.pm blib/lib/Test/Pod.pm > Manifying blib/man3/Test::Pod.3pm > + make test > PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" > "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t > t/00-load..............# Testing Test::Pod 1.26, Perl 5.008008, > /usr/bin/perl > t/00-load..............ok > t/all_pod_files........ok > t/cut-outside-block....ok 1/2 > # Failed test (t/cut-outside-block.t at line 20) > t/cut-outside-block....NOK 2# STDERR is: > # # Failed test (t/cut-outside-block.t at line 15) > # # t/cut-outside-block.pod (5): =cut found outside a pod block. > Skipping to next block. > # > # not: > # /#\s+Failed\ test.*?\n?.*?at\ t\/cut\-outside\-block\.t line 15.*\n?/ > # > # # t/cut-outside-block.pod (5): =cut found outside a pod block. > Skipping to next block. > # > # as expected > t/cut-outside-block....FAILED test 2 > Failed 1/2 tests, 50.00% okay > t/good.................ok > t/item-ordering........ok 1/2 > # Failed test (t/item-ordering.t at line 19) > t/item-ordering........NOK 2# STDERR is: > # # Failed test (t/item-ordering.t at line 14) > # # t/item-ordering.pod (32): You can't have =items (as at line 36) > unless the first thing after the =over is an =item > # > # not: > # /#\s+Failed\ test.*?\n?.*?at\ t\/item\-ordering\.t line 14.*\n?/ > # > # # t/item-ordering.pod (32): You can't have =items (as at line 36) > unless the first thing after the =over is an =item > # > # as expected > t/item-ordering........FAILED test 2 > Failed 1/2 tests, 50.00% okay > t/load.................ok > t/missing-file.........ok 1/3 > # Failed test (t/missing-file.t at line 18) > t/missing-file.........NOK 2# STDERR is: > # # Failed test (t/missing-file.t at line 16) > # # t/non-existent.pod does not exist > # > # not: > # /#\s+Failed\ test.*?\n?.*?at\ t\/missing\-file\.t line 16.*\n?/ > # > # # t/non-existent.pod does not exist > # > # as expected > # Failed test (t/missing-file.t at line 28) > t/missing-file.........NOK 3# STDERR is: > # # Failed test (t/missing-file.t at line 26) > # # t/non-existent.pod does not exist > # > # not: > # /#\s+Failed\ test.*?\n?.*?at\ t\/missing\-file\.t line 26.*\n?/ > # > # # t/non-existent.pod does not exist > # > # as expected > t/missing-file.........FAILED tests 2-3 > Failed 2/3 tests, 33.33% okay > t/pod..................ok > t/selftest.............ok > t/spaced-directives....skipped > all skipped: Not written yet > t/unknown-directive....ok 1/2 > # Failed test (t/unknown-directive.t at line 20) > t/unknown-directive....NOK 2# STDERR is: > # # Failed test (t/unknown-directive.t at line 16) > # # t/unknown-directive.pod (9): Unknown directive: =over4 > # # t/unknown-directive.pod (13): Unknown directive: =under > # > # not: > # /#\s+Failed\ test.*?\n?.*?at\ t\/unknown\-directive\.t line 16.*\n?/ > # > # # t/unknown-directive.pod (9): Unknown directive: =over4 > # > # # t/unknown-directive.pod (13): Unknown directive: =under > # > # as expected > t/unknown-directive....FAILED test 2 > Failed 1/2 tests, 50.00% okay > Failed Test Stat Wstat Total Fail Failed List of Failed > ------------------------------------------------------------------------------- > t/cut-outside-block.t 2 1 50.00% 2 > t/item-ordering.t 2 1 50.00% 2 > t/missing-file.t 3 2 66.67% 2-3 > t/unknown-directive.t 2 1 50.00% 2 > 1 test skipped. > Failed 4/11 test scripts, 63.64% okay. 5/19 subtests failed, 73.68% okay. > make: *** [test_dynamic] Error 255 > error: Bad exit status from /var/tmp/rpm-tmp.68510 (%build) > > RPM build errors: > Bad exit status from /var/tmp/rpm-tmp.68510 (%build) > Any ideas? > Phil Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Mon Apr 13 23:47:35 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Mon Apr 13 23:48:01 2009 Subject: MailScanner installer In-Reply-To: <20090413153254.GA3824@msapiro> References: <49E304C7.5060906@ecs.soton.ac.uk> <20090413153254.GA3824@msapiro> <49E3C107.5090606@ecs.soton.ac.uk> Message-ID: On 13/4/09 16:32, Mark Sapiro wrote: > On Mon, Apr 13, 2009 at 10:24:23AM +0100, Julian Field wrote: > >> I have done quite a bit of testing on this installer, but please do try >> it on your individual systems and check that it all works and produces a >> working system. >> > > It seems I was a bit quick, so this report may be moot, but yesterday I > ran through the following scenario on CentOS 5. > > 1) Upgraded from MailScanner 4.76.3-1 to 4.76.7-1 with "./install.sh fast" > and restarted MailScanner. This went fine as usual. > > 2) Attempted "yum upgrage perl" to 5.8.8-18 from some earlier 5.8.8 > version. This complained about two file conflicts - > /usr/lib/perl5/5.8.8/File/Temp.pm and an associated man page. > > 3) Ran MailScanner's "./install.sh reinstall fast". After this, ran > "find /usr/lib/perl5 -name Temp.pm" and the only one found was > /usr/lib/perl5/5.8.8/File/Temp.pm. > That's the important step. It will get rid of all the old Perl modules that MailScanner installed and make it use the new ones instead. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Tue Apr 14 00:36:09 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 14 00:36:36 2009 Subject: MailScanner installer In-Reply-To: References: <49E304C7.5060906@ecs.soton.ac.uk> <20090413153254.GA3824@msapiro> <49E3C107.5090606@ecs.soton.ac.uk> <49E3CC69.40801@ecs.soton.ac.uk> Message-ID: On 13/4/09 23:47, Julian Field wrote: > > > On 13/4/09 16:32, Mark Sapiro wrote: >> On Mon, Apr 13, 2009 at 10:24:23AM +0100, Julian Field wrote: >>> I have done quite a bit of testing on this installer, but please do try >>> it on your individual systems and check that it all works and >>> produces a >>> working system. >> >> It seems I was a bit quick, so this report may be moot, but yesterday I >> ran through the following scenario on CentOS 5. >> >> 1) Upgraded from MailScanner 4.76.3-1 to 4.76.7-1 with "./install.sh >> fast" >> and restarted MailScanner. This went fine as usual. >> >> 2) Attempted "yum upgrage perl" to 5.8.8-18 from some earlier 5.8.8 >> version. This complained about two file conflicts - >> /usr/lib/perl5/5.8.8/File/Temp.pm and an associated man page. >> >> 3) Ran MailScanner's "./install.sh reinstall fast". After this, ran >> "find /usr/lib/perl5 -name Temp.pm" and the only one found was >> /usr/lib/perl5/5.8.8/File/Temp.pm. > That's the important step. It will get rid of all the old Perl modules > that MailScanner installed and make it use the new ones instead. I have added code to the install.sh to do this automatically if needed. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From ssilva at sgvwater.com Tue Apr 14 00:52:36 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Tue Apr 14 00:52:59 2009 Subject: MailScanner installer In-Reply-To: References: <49E304C7.5060906@ecs.soton.ac.uk> <20090413153254.GA3824@msapiro> <49E3C107.5090606@ecs.soton.ac.uk> <49E3CC69.40801@ecs.soton.ac.uk> Message-ID: on 4-13-2009 4:36 PM Julian Field spake the following: > > > On 13/4/09 23:47, Julian Field wrote: >> >> >> On 13/4/09 16:32, Mark Sapiro wrote: >>> On Mon, Apr 13, 2009 at 10:24:23AM +0100, Julian Field wrote: >>>> I have done quite a bit of testing on this installer, but please do try >>>> it on your individual systems and check that it all works and >>>> produces a >>>> working system. >>> >>> It seems I was a bit quick, so this report may be moot, but yesterday I >>> ran through the following scenario on CentOS 5. >>> >>> 1) Upgraded from MailScanner 4.76.3-1 to 4.76.7-1 with "./install.sh >>> fast" >>> and restarted MailScanner. This went fine as usual. >>> >>> 2) Attempted "yum upgrage perl" to 5.8.8-18 from some earlier 5.8.8 >>> version. This complained about two file conflicts - >>> /usr/lib/perl5/5.8.8/File/Temp.pm and an associated man page. >>> >>> 3) Ran MailScanner's "./install.sh reinstall fast". After this, ran >>> "find /usr/lib/perl5 -name Temp.pm" and the only one found was >>> /usr/lib/perl5/5.8.8/File/Temp.pm. >> That's the important step. It will get rid of all the old Perl modules >> that MailScanner installed and make it use the new ones instead. > I have added code to the install.sh to do this automatically if needed. > > Jules > Might be time for me to go back to the installer. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090413/8996e3b4/signature.bin From lists at tippingmar.com Tue Apr 14 04:59:39 2009 From: lists at tippingmar.com (Mark Nienberg) Date: Tue Apr 14 04:59:58 2009 Subject: MailScanner, CentOS 5 and perl-IO & perl-File-Temp In-Reply-To: References: Message-ID: <49E40A2B.509@tippingmar.com> Mark Sapiro wrote: > Julian Field wrote: > >> I'm nearly there :) This is taking a hell of a lot of work on the >> installer, but will solve all the upgrade problems once and for all. >> There are interesting things like the fact that RedHat got the module >> path @INC totally wrong in their release of Perl in RHEL 5, with the >> result that a lot of modules simply cannot be over-ridden without doing >> a "forced" install of files to overwrite stuff in their RPM, unless of >> course you mess with @INC at the start of your Perl program (which is >> what I have done) so that the vendor and site-specific directories >> actually get consulted before the core Perl system directories. >> > > > It appears this may no longer be the case with the RedHat rpm. I just > did a yum upgrade to perl.i386 4:5.8.8-18.el5_3.1, and I get > > [mark@sbh16 ~]$ perl -e 'foreach $d ( @INC ) {print $d . "\n";}' > /usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi > /usr/lib/perl5/site_perl/5.8.7/i386-linux-thread-multi > /usr/lib/perl5/site_perl/5.8.6/i386-linux-thread-multi > /usr/lib/perl5/site_perl/5.8.5/i386-linux-thread-multi > /usr/lib/perl5/site_perl/5.8.8 > /usr/lib/perl5/site_perl/5.8.7 > /usr/lib/perl5/site_perl/5.8.6 > /usr/lib/perl5/site_perl/5.8.5 > /usr/lib/perl5/site_perl > /usr/lib/perl5/vendor_perl/5.8.8/i386-linux-thread-multi > /usr/lib/perl5/vendor_perl/5.8.7/i386-linux-thread-multi > /usr/lib/perl5/vendor_perl/5.8.6/i386-linux-thread-multi > /usr/lib/perl5/vendor_perl/5.8.5/i386-linux-thread-multi > /usr/lib/perl5/vendor_perl/5.8.8 > /usr/lib/perl5/vendor_perl/5.8.7 > /usr/lib/perl5/vendor_perl/5.8.6 > /usr/lib/perl5/vendor_perl/5.8.5 > /usr/lib/perl5/vendor_perl > /usr/lib/perl5/5.8.8/i386-linux-thread-multi > /usr/lib/perl5/5.8.8 > . > > Hmm, I have not yet upgraded perl and I get the similar results. I wonder when it changed and why Julian thinks it hasn't. [mark@tesla ~]$ rpm -q perl perl-5.8.8-15.el5_2.1 [mark@tesla ~]$ perl -V Summary of my perl5 (revision 5 version 8 subversion 8) configuration: -snip- Characteristics of this binary (from libperl): Compile-time options: MULTIPLICITY PERL_IMPLICIT_CONTEXT PERL_MALLOC_WRAP USE_64_BIT_ALL USE_64_BIT_INT USE_ITHREADS USE_LARGE_FILES USE_PERLIO USE_REENTRANT_API Built under linux Compiled at Sep 17 2008 13:37:41 @INC: /usr/lib64/perl5/site_perl/5.8.8/x86_64-linux-thread-multi /usr/lib64/perl5/site_perl/5.8.7/x86_64-linux-thread-multi /usr/lib64/perl5/site_perl/5.8.6/x86_64-linux-thread-multi /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi /usr/lib/perl5/site_perl/5.8.8 /usr/lib/perl5/site_perl/5.8.7 /usr/lib/perl5/site_perl/5.8.6 /usr/lib/perl5/site_perl/5.8.5 /usr/lib/perl5/site_perl /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.7/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.6/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.5/x86_64-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.8 /usr/lib/perl5/vendor_perl/5.8.7 /usr/lib/perl5/vendor_perl/5.8.6 /usr/lib/perl5/vendor_perl/5.8.5 /usr/lib/perl5/vendor_perl /usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi /usr/lib/perl5/5.8.8 . Mark Nienberg From mark at msapiro.net Tue Apr 14 05:24:47 2009 From: mark at msapiro.net (Mark Sapiro) Date: Tue Apr 14 05:24:57 2009 Subject: MailScanner-4.76.10-2 can't install Test::Pod In-Reply-To: <7EF0EE5CB3B263488C8C18823239BEBA03CF9C@HC-MBX02.herefordshire.gov.uk> Message-ID: Randal, Phil wrote: >On CentOS 5.3, 64-bit. > >/install.sh ..... > >+ umask 022 >+ cd /usr/src/redhat/BUILD >+ LANG=C >+ export LANG >+ unset DISPLAY >+ cd /usr/src/redhat/BUILD >+ rm -rf Test-Pod-1.26 >+ /bin/gzip -dc /usr/src/redhat/SOURCES/Test-Pod-1.26.tar.gz >+ tar -xf - >+ STATUS=0 >+ '[' 0 -ne 0 ']' >+ cd Test-Pod-1.26 >++ /usr/bin/id -u >+ '[' 0 = 0 ']' >+ /bin/chown -Rhf root . >++ /usr/bin/id -u >+ '[' 0 = 0 ']' >+ /bin/chgrp -Rhf root . >+ /bin/chmod -Rf a+rX,u+w,g-w,o-w . >+ exit 0 >Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.68510 >+ umask 022 >+ cd /usr/src/redhat/BUILD >+ cd Test-Pod-1.26 >+ LANG=C >+ export LANG >+ unset DISPLAY >+ CFLAGS='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions >-fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic' >+ perl Makefile.PL >Checking if your kit is complete... >Looks good >Warning: prerequisite Test::More 0.62 not found. We have 0.6. This is the problem. The rpm build process is getting /usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi/Test/More.pm which is version 0.60 and which produces slightly different messages from what the tests expect so some fail. I did the following: cd /usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi mv Test Test.dont.want.these.old.ones and that allowed Test::Pod to build and install. -- Mark Sapiro The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From mark at msapiro.net Tue Apr 14 05:32:45 2009 From: mark at msapiro.net (Mark Sapiro) Date: Tue Apr 14 05:32:54 2009 Subject: MailScanner-4.76.10-2 can't install Test::Pod In-Reply-To: Message-ID: Mark Sapiro wrote: >Randal, Phil wrote: > >>On CentOS 5.3, 64-bit. Ooops, missed the 64-bit >>Warning: prerequisite Test::More 0.62 not found. We have 0.6. > > >This is the problem. > >The rpm build process is getting So the paths below are probably not the exact ones in your case, but you get the idea... >/usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi/Test/More.pm >which is version 0.60 and which produces slightly different messages >from what the tests expect so some fail. > >I did the following: > >cd /usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi >mv Test Test.dont.want.these.old.ones > >and that allowed Test::Pod to build and install. -- Mark Sapiro The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From MailScanner at ecs.soton.ac.uk Tue Apr 14 09:05:31 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 14 09:05:49 2009 Subject: MailScanner-4.76.10-2 can't install Test::Pod In-Reply-To: References: <49E443CB.9040902@ecs.soton.ac.uk> Message-ID: On 14/4/09 05:24, Mark Sapiro wrote: > Randal, Phil wrote: > > >> On CentOS 5.3, 64-bit. >> >> /install.sh ..... >> >> + umask 022 >> + cd /usr/src/redhat/BUILD >> + LANG=C >> + export LANG >> + unset DISPLAY >> + cd /usr/src/redhat/BUILD >> + rm -rf Test-Pod-1.26 >> + /bin/gzip -dc /usr/src/redhat/SOURCES/Test-Pod-1.26.tar.gz >> + tar -xf - >> + STATUS=0 >> + '[' 0 -ne 0 ']' >> + cd Test-Pod-1.26 >> ++ /usr/bin/id -u >> + '[' 0 = 0 ']' >> + /bin/chown -Rhf root . >> ++ /usr/bin/id -u >> + '[' 0 = 0 ']' >> + /bin/chgrp -Rhf root . >> + /bin/chmod -Rf a+rX,u+w,g-w,o-w . >> + exit 0 >> Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.68510 >> + umask 022 >> + cd /usr/src/redhat/BUILD >> + cd Test-Pod-1.26 >> + LANG=C >> + export LANG >> + unset DISPLAY >> + CFLAGS='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions >> -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic' >> + perl Makefile.PL >> Checking if your kit is complete... >> Looks good >> Warning: prerequisite Test::More 0.62 not found. We have 0.6. >> > > This is the problem. > > The rpm build process is getting > /usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi/Test/More.pm > which is version 0.60 and which produces slightly different messages > from what the tests expect so some fail. > > I did the following: > > cd /usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi > mv Test Test.dont.want.these.old.ones > > and that allowed Test::Pod to build and install. > > I have just tried an installation on CentOS 5.3 x86_64 and it installs just fine. My modules install in the "vendor" paths, just like the ones in rpmforge, so any troublesome ones in "site" paths will cause problems. It's difficult to do much else, there are too many permutations of all the directories involved to be able to test every variant. But I'll have a think about it, nonetheless. I can't go removing the site version when I install my vendor version, I don't like the whole idea of starting *deleting* files from your system in my installer. So I cannot guarantee that me installing my vendor version will actually change the version that is used by your system. It's a hazard of the whole module-path system. Java hits the same problem with its class-path system, I think. The only thing I can think of is messing with the module-path so that the vendor directories always come before the site directories, but that rather breaks the idea of having a site directory. I'm a vendor, I should be using vendor directories. I shouldn't mess with your site directories, they are there for you to mess with if you need to. Any thoughts? Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Tue Apr 14 09:18:04 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 14 09:18:22 2009 Subject: scanctl In-Reply-To: <24e3d2e40904131241v3d85ff75h5eb4c8fe00bb53cb@mail.gmail.com> References: <24e3d2e40904131241v3d85ff75h5eb4c8fe00bb53cb@mail.gmail.com> <49E446BC.3090201@ecs.soton.ac.uk> Message-ID: On 13/4/09 20:41, Alex Neuman wrote: > I came across the following: > > http://www.entrophy-free.net/mail/scanctl > > I tried googling for its name + "Julian Field" and came up with > nothing, so I turn to you guys... Has anybody here used/heard/thought > about this, ever? Don't remember it being mentioned at all on the list > either. Have just read the documentation included at the above URL, I can't see the point in this script at all. Its main 2 features seem to be 1) Manages multiple incoming mail queues, 2) Restarts MailScanner periodically. If the author had ever read the MailScanner documentation, he would know that 1) MailScanner already supports multiple work queues, in a far simpler and more flexible way than his suggested setup, this is all explained in the "Incoming Queue Dir" setting; 2) MailScanner restarts itself periodically for exactly the reasons he gives for restarting it, this is all explained in the "Restart Every" setting pretty near the top of the MailScanner.conf file. So I don't see any point in this package at all. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Tue Apr 14 09:27:02 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 14 09:27:24 2009 Subject: scanctl In-Reply-To: References: <24e3d2e40904131241v3d85ff75h5eb4c8fe00bb53cb@mail.gmail.com> <49E446BC.3090201@ecs.soton.ac.uk> <49E448D6.2050600@ecs.soton.ac.uk> Message-ID: I just noticed one more thing. He says it applies to version *3* of MailScanner, which has only been around for about 5 years or so. I suspect this page is a little old and no longer relevant. When he wrote it, MailScanner already did the periodic restarts anyway, but it didn't do the multiple queue directories, I didn't introduce that until about 2004. :-) Jules. On 14/4/09 09:18, Julian Field wrote: > > > On 13/4/09 20:41, Alex Neuman wrote: >> I came across the following: >> >> http://www.entrophy-free.net/mail/scanctl >> >> I tried googling for its name + "Julian Field" and came up with >> nothing, so I turn to you guys... Has anybody here used/heard/thought >> about this, ever? Don't remember it being mentioned at all on the >> list either. > Have just read the documentation included at the above URL, I can't > see the point in this script at all. Its main 2 features seem to be > 1) Manages multiple incoming mail queues, > 2) Restarts MailScanner periodically. > > If the author had ever read the MailScanner documentation, he would > know that > 1) MailScanner already supports multiple work queues, in a far simpler > and more flexible way than his suggested setup, this is all explained > in the "Incoming Queue Dir" setting; > 2) MailScanner restarts itself periodically for exactly the reasons he > gives for restarting it, this is all explained in the "Restart Every" > setting pretty near the top of the MailScanner.conf file. > > So I don't see any point in this package at all. > > Jules > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From prandal at herefordshire.gov.uk Tue Apr 14 10:23:55 2009 From: prandal at herefordshire.gov.uk (Randal, Phil) Date: Tue Apr 14 10:24:17 2009 Subject: MailScanner-4.76.10-2 can't install Test::Pod In-Reply-To: References: <7EF0EE5CB3B263488C8C18823239BEBA03CF9C@HC-MBX02.herefordshire.gov.uk><49E3C08A.20107@ecs.soton.ac.uk> Message-ID: <7EF0EE5CB3B263488C8C18823239BEBA066270EE@HC-MBX02.herefordshire.gov.uk> # find /usr/lib64/perl5 /usr/lib/perl5 -name More.pm -print | xargs grep VERSION /usr/lib64/perl5/site_perl/5.8.8/x86_64-linux-thread-multi/Test/More.pm: use vars qw($VERSION @ISA @EXPORT %EXPORT_TAGS $TODO); /usr/lib64/perl5/site_perl/5.8.8/x86_64-linux-thread-multi/Test/More.pm: $VERSION = '0.60'; /usr/lib64/perl5/site_perl/5.8.8/x86_64-linux-thread-multi/Test/More.pm: $VERSION = eval $VERSION; # make the alpha version come out as a number /usr/lib/perl5/vendor_perl/5.8.8/Test/More.pm:our $VERSION = '0.86'; /usr/lib/perl5/vendor_perl/5.8.8/Test/More.pm:$VERSION = eval $VERSION; ## no critic (BuiltinFunctions::ProhibitStringyEval) /usr/lib/perl5/5.8.8/Test/More.pm:use vars qw($VERSION @ISA @EXPORT %EXPORT_TAGS $TODO); /usr/lib/perl5/5.8.8/Test/More.pm:$VERSION = '0.62'; /usr/lib/perl5/5.8.8/Test/More.pm:$VERSION = eval $VERSION; # make the alpha version come out as a number Mark Sapiro's workaround fixes it. Cheers, Phil -- Phil Randal | Networks Engineer Herefordshire Council | Deputy Chief Executive's Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, Hereford, HR2 6JT Tel: 01432 260160 email: prandal@herefordshire.gov.uk Any opinion expressed in this e-mail or any attached files are those of the individual and not necessarily those of Herefordshire Council. This e-mail and any attached files are confidential and intended solely for the use of the addressee. This communication may contain material protected by law from being passed on. If you are not the intended recipient and have received this e-mail in error, you are advised that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender immediately and destroy all copies of it. -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Julian Field Sent: 13 April 2009 23:46 To: MailScanner discussion Subject: Re: MailScanner-4.76.10-2 can't install Test::Pod Did it successfully install Test-Simple just before Test-Pod? That should have been enough. The error message implies that it didn't find your Test-Simple that should have been just installed. So either it didn't install it or it didn't find it when it tried to build Test-Pod. Please can you do find /usr/lib64/perl5 /usr/lib/perl5 -name More.pm -print | xargs grep VERSION (all on one line) and it will tell you the version number of every copy of Test::More you have installed. You don't have $PERL5LIB set to anything do you? Just do an echo $PERL5LIB and be sure you get an empty line. If you don't, then do PERL5LIB= export PERL5LIB ./install.sh On 13/4/09 20:24, Randal, Phil wrote: > On CentOS 5.3, 64-bit. > ./install.sh ..... > + umask 022 > + cd /usr/src/redhat/BUILD > + LANG=C > + export LANG > + unset DISPLAY > + cd /usr/src/redhat/BUILD > + rm -rf Test-Pod-1.26 > + /bin/gzip -dc /usr/src/redhat/SOURCES/Test-Pod-1.26.tar.gz > + tar -xf - > + STATUS=0 > + '[' 0 -ne 0 ']' > + cd Test-Pod-1.26 > ++ /usr/bin/id -u > + '[' 0 = 0 ']' > + /bin/chown -Rhf root . > ++ /usr/bin/id -u > + '[' 0 = 0 ']' > + /bin/chgrp -Rhf root . > + /bin/chmod -Rf a+rX,u+w,g-w,o-w . > + exit 0 > Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.68510 > + umask 022 > + cd /usr/src/redhat/BUILD > + cd Test-Pod-1.26 > + LANG=C > + export LANG > + unset DISPLAY > + CFLAGS='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions > -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic' > + perl Makefile.PL > Checking if your kit is complete... > Looks good > Warning: prerequisite Test::More 0.62 not found. We have 0.6. > Writing Makefile for Test::Pod > + make > cp Pod.pm blib/lib/Test/Pod.pm > Manifying blib/man3/Test::Pod.3pm > + make test > PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" > "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t > t/00-load..............# Testing Test::Pod 1.26, Perl 5.008008, > /usr/bin/perl t/00-load..............ok t/all_pod_files........ok > t/cut-outside-block....ok 1/2 > # Failed test (t/cut-outside-block.t at line 20) > t/cut-outside-block....NOK 2# STDERR is: > # # Failed test (t/cut-outside-block.t at line 15) > # # t/cut-outside-block.pod (5): =cut found outside a pod block. > Skipping to next block. > # > # not: > # /#\s+Failed\ test.*?\n?.*?at\ t\/cut\-outside\-block\.t line > 15.*\n?/ # # # t/cut-outside-block.pod (5): =cut found outside a pod > block. > Skipping to next block. > # > # as expected > t/cut-outside-block....FAILED test 2 > Failed 1/2 tests, 50.00% okay > t/good.................ok > t/item-ordering........ok 1/2 > # Failed test (t/item-ordering.t at line 19) > t/item-ordering........NOK 2# STDERR is: > # # Failed test (t/item-ordering.t at line 14) > # # t/item-ordering.pod (32): You can't have =items (as at line 36) > unless the first thing after the =over is an =item # # not: > # /#\s+Failed\ test.*?\n?.*?at\ t\/item\-ordering\.t line 14.*\n?/ # # > # t/item-ordering.pod (32): You can't have =items (as at line 36) > unless the first thing after the =over is an =item # # as expected > t/item-ordering........FAILED test 2 > Failed 1/2 tests, 50.00% okay > t/load.................ok > t/missing-file.........ok 1/3 > # Failed test (t/missing-file.t at line 18) > t/missing-file.........NOK 2# STDERR is: > # # Failed test (t/missing-file.t at line 16) > # # t/non-existent.pod does not exist > # > # not: > # /#\s+Failed\ test.*?\n?.*?at\ t\/missing\-file\.t line 16.*\n?/ # # > # t/non-existent.pod does not exist # # as expected > # Failed test (t/missing-file.t at line 28) > t/missing-file.........NOK 3# STDERR is: > # # Failed test (t/missing-file.t at line 26) > # # t/non-existent.pod does not exist > # > # not: > # /#\s+Failed\ test.*?\n?.*?at\ t\/missing\-file\.t line 26.*\n?/ # # > # t/non-existent.pod does not exist # # as expected > t/missing-file.........FAILED tests 2-3 > Failed 2/3 tests, 33.33% okay > t/pod..................ok > t/selftest.............ok > t/spaced-directives....skipped > all skipped: Not written yet > t/unknown-directive....ok 1/2 > # Failed test (t/unknown-directive.t at line 20) > t/unknown-directive....NOK 2# STDERR is: > # # Failed test (t/unknown-directive.t at line 16) > # # t/unknown-directive.pod (9): Unknown directive: =over4 # # > t/unknown-directive.pod (13): Unknown directive: =under # # not: > # /#\s+Failed\ test.*?\n?.*?at\ t\/unknown\-directive\.t line 16.*\n?/ > # # # t/unknown-directive.pod (9): Unknown directive: =over4 # # # > t/unknown-directive.pod (13): Unknown directive: =under # # as > expected t/unknown-directive....FAILED test 2 > Failed 1/2 tests, 50.00% okay > Failed Test Stat Wstat Total Fail Failed List of Failed > ------------------------------------------------------------------------ ------- > t/cut-outside-block.t 2 1 50.00% 2 > t/item-ordering.t 2 1 50.00% 2 > t/missing-file.t 3 2 66.67% 2-3 > t/unknown-directive.t 2 1 50.00% 2 > 1 test skipped. > Failed 4/11 test scripts, 63.64% okay. 5/19 subtests failed, 73.68% okay. > make: *** [test_dynamic] Error 255 > error: Bad exit status from /var/tmp/rpm-tmp.68510 (%build) > > RPM build errors: > Bad exit status from /var/tmp/rpm-tmp.68510 (%build) Any ideas? > Phil Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090414/0dc15390/attachment.html From prandal at herefordshire.gov.uk Tue Apr 14 10:23:57 2009 From: prandal at herefordshire.gov.uk (Randal, Phil) Date: Tue Apr 14 10:38:51 2009 Subject: MailScanner-4.76.10-2 can't install Test::Pod In-Reply-To: References: Message-ID: <7EF0EE5CB3B263488C8C18823239BEBA066270EF@HC-MBX02.herefordshire.gov.uk> Thanks Mark, That indeed what was going on. Cheers, Phil -- Phil Randal | Networks Engineer Herefordshire Council | Deputy Chief Executive's Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, Hereford, HR2 6JT Tel: 01432 260160 email: prandal@herefordshire.gov.uk Any opinion expressed in this e-mail or any attached files are those of the individual and not necessarily those of Herefordshire Council. This e-mail and any attached files are confidential and intended solely for the use of the addressee. This communication may contain material protected by law from being passed on. If you are not the intended recipient and have received this e-mail in error, you are advised that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender immediately and destroy all copies of it. -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Mark Sapiro Sent: 14 April 2009 05:33 To: MailScanner List Subject: Re: MailScanner-4.76.10-2 can't install Test::Pod Mark Sapiro wrote: >Randal, Phil wrote: > >>On CentOS 5.3, 64-bit. Ooops, missed the 64-bit >>Warning: prerequisite Test::More 0.62 not found. We have 0.6. > > >This is the problem. > >The rpm build process is getting So the paths below are probably not the exact ones in your case, but you get the idea... >/usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi/Test/More.pm >which is version 0.60 and which produces slightly different messages >from what the tests expect so some fail. > >I did the following: > >cd /usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi >mv Test Test.dont.want.these.old.ones > >and that allowed Test::Pod to build and install. -- Mark Sapiro The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From maillists at conactive.com Tue Apr 14 13:11:43 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Tue Apr 14 13:11:55 2009 Subject: MailScanner-4.76.10-2 can't install Test::Pod In-Reply-To: References: Message-ID: Mark Sapiro wrote on Mon, 13 Apr 2009 21:24:47 -0700: > I did the following: > > cd /usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi > mv Test Test.dont.want.these.old.ones > > and that allowed Test::Pod to build and install. It means your perl is not up-to-date. CentOS 5 with current perl and *no* additional perl-test-* modules or modules installed by MS shows this: 1.26 Test::Pod 0.62 Test::Simple Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Tue Apr 14 13:11:43 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Tue Apr 14 13:11:55 2009 Subject: scanctl In-Reply-To: References: <24e3d2e40904131241v3d85ff75h5eb4c8fe00bb53cb@mail.gmail.com> <49E446BC.3090201@ecs.soton.ac.uk> <49E448D6.2050600@ecs.soton.ac.uk> Message-ID: yes, his tutorial is from about that time ;-) http://www.entrophy-free.net/anti-spam.html Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Tue Apr 14 13:11:43 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Tue Apr 14 13:11:57 2009 Subject: MailScanner-4.76.10-2 can't install Test::Pod In-Reply-To: References: <49E443CB.9040902@ecs.soton.ac.uk> Message-ID: Julian Field wrote on Tue, 14 Apr 2009 09:05:31 +0100: > Any thoughts? Thanks for your "Easter efforts", Jules. It sounds like a good solution. (*) I think you can't do much more. And you certainly shouldn't remove any modules. As I see it the problem that Mark and Phil faced stems from the fact that they did not update their machines. The current perl for CentOS 5 *does* have Test::Pod 1.26. If I understand correctly your install.sh would not build and install 1.26 if it detects that 1.26 is already available, right? I wonder if you could add a switch to just "test run", so that it prints out all the normal informational messages and which of the modules it wants to build and install, but doesn't carry out anythign. (like rpm -- test). (*) I have to admit I won't try that on existing installations as the solution to not install any Perl modules from the MS tarball works great and also is much faster. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From prandal at herefordshire.gov.uk Tue Apr 14 14:04:23 2009 From: prandal at herefordshire.gov.uk (Randal, Phil) Date: Tue Apr 14 14:04:42 2009 Subject: MailScanner-4.76.10-2 can't install Test::Pod In-Reply-To: References: <49E443CB.9040902@ecs.soton.ac.uk> Message-ID: <7EF0EE5CB3B263488C8C18823239BEBA0662720C@HC-MBX02.herefordshire.gov.uk> Kai Schaetzl wrote: > Julian Field wrote on Tue, 14 Apr 2009 09:05:31 +0100: > >> Any thoughts? > > Thanks for your "Easter efforts", Jules. It sounds like a good > solution. (*) I think you can't do much more. And you certainly > shouldn't remove any modules. As I see it the problem that Mark and > Phil faced stems from the fact that they did not update their > machines. The current perl for CentOS 5 *does* have Test::Pod 1.26. > If I understand correctly your install.sh would not build and install > 1.26 if it detects that 1.26 is already available, right? > I wonder if you could add a switch to just "test run", so that it > prints out all the normal informational messages and which of the > modules it wants to build and install, but doesn't carry out > anythign. (like rpm -- test). > > (*) I have to admit I won't try that on existing installations as the > solution to not install any Perl modules from the MS tarball works > great and also is much faster. > > Kai Such a scurrilous smear, Kai! ;-) No, my perl was fully up to date, but there may have been garbage left behind from earlier installations of perl - the boxes started off as CentOS 5.0 installs. Cheers, Phil -- Phil Randal | Networks Engineer Herefordshire Council | Deputy Chief Executive's Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, Hereford, HR2 6JT Tel: 01432 260160 email: prandal@herefordshire.gov.uk Any opinion expressed in this e-mail or any attached files are those of the individual and not necessarily those of Herefordshire Council. This e-mail and any attached files are confidential and intended solely for the use of the addressee. This communication may contain material protected by law from being passed on. If you are not the intended recipient and have received this e-mail in error, you are advised that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender immediately and destroy all copies of it. From maillists at conactive.com Tue Apr 14 15:31:24 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Tue Apr 14 15:31:35 2009 Subject: MailScanner-4.76.10-2 can't install Test::Pod In-Reply-To: <7EF0EE5CB3B263488C8C18823239BEBA0662720C@HC-MBX02.herefordshire.gov.uk> References: <49E443CB.9040902@ecs.soton.ac.uk> <7EF0EE5CB3B263488C8C18823239BEBA0662720C@HC-MBX02.herefordshire.gov.uk> Message-ID: Phil Randal wrote on Tue, 14 Apr 2009 14:04:23 +0100: > No, my perl was fully up to date, but there may have been garbage left > behind from earlier installations of perl - the boxes started off as > CentOS 5.0 installs. 5.2. had Test 1.25 and already Test::More 0.62. I don't know if Test::Pod is part of Test or would be listed separately, at least it isn't listed here. I checked some older MailScanner tarball from last year and it already included Test Pod 1.26. Yes, you both must have installed some Perl modules to /usr/lib/perl5/site_perl/. I'm not having any module there. No connection to a not-upgraded Perl, you are right. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From MailScanner at ecs.soton.ac.uk Tue Apr 14 17:47:22 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 14 17:47:41 2009 Subject: MailScanner-4.76.10-2 can't install Test::Pod In-Reply-To: References: <49E443CB.9040902@ecs.soton.ac.uk> <49E4BE1A.1010900@ecs.soton.ac.uk> Message-ID: On 14/4/09 13:11, Kai Schaetzl wrote: > Julian Field wrote on Tue, 14 Apr 2009 09:05:31 +0100: > > >> Any thoughts? >> > Thanks for your "Easter efforts", Jules. It sounds like a good solution. > (*) I think you can't do much more. And you certainly shouldn't remove any > modules. As I see it the problem that Mark and Phil faced stems from the > fact that they did not update their machines. The current perl for CentOS > 5 *does* have Test::Pod 1.26. If I understand correctly your install.sh > would not build and install 1.26 if it detects that 1.26 is already > available, right? > Correct. > I wonder if you could add a switch to just "test run", so that it prints > out all the normal informational messages and which of the modules it > wants to build and install, but doesn't carry out anythign. (like rpm -- > test). > I could do that, yes. Who would actually use it? > (*) I have to admit I won't try that on existing installations as the > solution to not install any Perl modules from the MS tarball works great > and also is much faster. > Your choice :-) The installer will detect pre-Easter-weekend systems and uninstall all the old Perl module RPMs before installing the post-Easter-weekend stuff. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From mark at msapiro.net Tue Apr 14 17:59:52 2009 From: mark at msapiro.net (Mark Sapiro) Date: Tue Apr 14 18:00:11 2009 Subject: MailScanner-4.76.10-2 can't install Test::Pod In-Reply-To: Message-ID: Kai Schaetzl wrote: >Mark Sapiro wrote on Mon, 13 Apr 2009 21:24:47 -0700: > >> I did the following: >> >> cd /usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi >> mv Test Test.dont.want.these.old.ones >> >> and that allowed Test::Pod to build and install. > >It means your perl is not up-to-date. >CentOS 5 with current perl and *no* additional perl-test-* modules or >modules installed by MS shows this: >1.26 Test::Pod >0.62 Test::Simple I disagree. My perl is up to date and includes versions 0.62 of Test::Simple and Test::More in /usr/lib/perl5/5.8.8/Test/ Test::Pod is not part of perl on Centos 5. It is part of perl-Test-Pod which I had never installed other than with MailScanner, and the reason MailScanner had trouble building Test::Pod was that there was a version 0.60 of Test::More in /usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi/Test which "up to date" perl will find before the one in /usr/lib/perl5/5.8.8/Test/. In fact, the irony here is it was apparently my updating of perl to one with a reordered @INC that caused the MailScanner build of Test::Pod to fail. -- Mark Sapiro The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From ljosnet at gmail.com Tue Apr 14 19:03:26 2009 From: ljosnet at gmail.com (=?ISO-8859-1?Q?Lj=F3snet?=) Date: Tue Apr 14 19:03:36 2009 Subject: Easiest way to upgrade MailScanner on FreeBSD? In-Reply-To: <200904062219.n36MJIkn028796@safir.blacknight.ie> References: <20090406162230.F246C17008@out-b.mx.mail-launder.com> <200904062219.n36MJIkn028796@safir.blacknight.ie> Message-ID: <910ee2ac0904141103v36e760a1s30217d93df6c9cda@mail.gmail.com> Working fine on my box as well. ;) On Mon, Apr 6, 2009 at 10:19 PM, Drew Marshall wrote: > -- > In line with our policy, this message has been scanned for viruses and dangerous > content by our Mail Launder system www.mail-launder.com > Our email policy can be found at www.trunknetworks.com/policy > > Trunk Networks Limited is registered in Scotland with registration number: 351063 > Registered Office 55-57 West High Street Inverurie AB51 3QQ > > > > > On 6 Apr 2009, at 17:17, Jim Coates wrote: > > Good morning all.. > > Please excuse this "beginner" question, but I am in the process of moving one of my mail servers and thought this would be a perfect time to upgrade MailScanner to the latest and greatest. > > I am running FreeBSD and installed MailScanner originally from ports. > > I would like to know the best/easiest way to upgrade MailScanner to the latest version. > > Any advice would be helpful. > > Well if you don't mind the bleeding edge too much, I have attached my own port directory for the latest beta (I run a lot of Macs so need the MIME support in the latest beta). It might not be quite as good the one that Jan-Peter officially puts together but he is so busy at the moment the port is quite old. > Just untar the file in /usr/ports/mail and overwrite the mailscanner directory. Once there, proceed as normal. > Normal caveats apply but it's working fine on my boxes. > Drew > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > From btj at havleik.no Tue Apr 14 19:35:47 2009 From: btj at havleik.no (=?ISO-8859-1?Q?Bj=F8rn?= T Johansen) Date: Tue Apr 14 19:36:47 2009 Subject: HELO_LOCALHOST and SpamAssassin? Message-ID: <20090414203547.7b808126@btj-laptop.asp-as.no> How can I disable this check in SpamAssassin? All the mail from my webmail server gets a score of 4,75 from this test, which means; it's almost marked as spam just for this.... Regards, BTJ -- ----------------------------------------------------------------------------------------------- Bj?rn T Johansen btj@havleik.no ----------------------------------------------------------------------------------------------- Someone wrote: "I understand that if you play a Windows CD backwards you hear strange Satanic messages" To which someone replied: "It's even worse than that; play it forwards and it installs Windows" ----------------------------------------------------------------------------------------------- From MailScanner at ecs.soton.ac.uk Tue Apr 14 20:05:49 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 14 20:06:07 2009 Subject: HELO_LOCALHOST and SpamAssassin? In-Reply-To: <20090414203547.7b808126@btj-laptop.asp-as.no> References: <20090414203547.7b808126@btj-laptop.asp-as.no> <49E4DE8D.4000506@ecs.soton.ac.uk> Message-ID: On 14/4/09 19:35, Bj?rn T Johansen wrote: > How can I disable this check in SpamAssassin? All the mail from my webmail server gets a score of 4,75 from this test, which means; it's almost > marked as spam just for this.... > To disable any SpamAssassin test in MailScanner, you should normally just have to set score TROUBLESOME_RULE_HERE 0.0 in /etc/MailScanner/spam.assasssin.prefs.conf and restart MailScanner. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From maillists at conactive.com Tue Apr 14 20:31:20 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Tue Apr 14 20:31:32 2009 Subject: MailScanner-4.76.10-2 can't install Test::Pod In-Reply-To: References: Message-ID: Mark Sapiro wrote on Tue, 14 Apr 2009 09:59:52 -0700: > Test::Pod is not part of perl on Centos 5. It is part of perl-Test-Pod > which I had never installed other than with MailScanner Right, I installed it from rpmforge here. Still a mystery where you got that 0.60 version from, not from MS I think. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Tue Apr 14 20:31:20 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Tue Apr 14 20:31:32 2009 Subject: MailScanner-4.76.10-2 can't install Test::Pod In-Reply-To: References: <49E443CB.9040902@ecs.soton.ac.uk> <49E4BE1A.1010900@ecs.soton.ac.uk> Message-ID: Julian Field wrote on Tue, 14 Apr 2009 17:47:22 +0100: > I could do that, yes. Who would actually use it? Anyone who wants to see what changes to the system it will do. I would assume it would be used purely for debugging and diagnostic purposes. One could also use it to find out which Perl modules are missing and install them before the MS install. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From btj at havleik.no Tue Apr 14 20:42:17 2009 From: btj at havleik.no (=?ISO-8859-1?Q?Bj=F8rn?= T Johansen) Date: Tue Apr 14 20:43:12 2009 Subject: HELO_LOCALHOST and SpamAssassin? In-Reply-To: References: <20090414203547.7b808126@btj-laptop.asp-as.no> <49E4DE8D.4000506@ecs.soton.ac.uk> Message-ID: <20090414214217.3d86c4b5@btj-laptop.asp-as.no> On Tue, 14 Apr 2009 20:05:49 +0100 Julian Field wrote: > > > On 14/4/09 19:35, Bj?rn T Johansen wrote: > > How can I disable this check in SpamAssassin? All the mail from my webmail server gets a score of 4,75 from this test, which means; it's almost > > marked as spam just for this.... > > > To disable any SpamAssassin test in MailScanner, you should normally > just have to set > score TROUBLESOME_RULE_HERE 0.0 > in /etc/MailScanner/spam.assasssin.prefs.conf and restart MailScanner. > > Jules > ok, so I have added the following rule..: score HELO_LOCALHOST 0.0 but the mail is still scored 4.5 from rule HELO_LOCALHOST ? BTJ From ssilva at sgvwater.com Tue Apr 14 20:52:02 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Tue Apr 14 20:52:32 2009 Subject: HELO_LOCALHOST and SpamAssassin? In-Reply-To: <20090414214217.3d86c4b5@btj-laptop.asp-as.no> References: <20090414203547.7b808126@btj-laptop.asp-as.no> <49E4DE8D.4000506@ecs.soton.ac.uk> <20090414214217.3d86c4b5@btj-laptop.asp-as.no> Message-ID: on 4-14-2009 12:42 PM Bj?rn T Johansen spake the following: > On Tue, 14 Apr 2009 20:05:49 +0100 > Julian Field wrote: > >> >> On 14/4/09 19:35, Bj?rn T Johansen wrote: >>> How can I disable this check in SpamAssassin? All the mail from my webmail server gets a score of 4,75 from this test, which means; it's almost >>> marked as spam just for this.... >>> >> To disable any SpamAssassin test in MailScanner, you should normally >> just have to set >> score TROUBLESOME_RULE_HERE 0.0 >> in /etc/MailScanner/spam.assasssin.prefs.conf and restart MailScanner. >> >> Jules >> > > ok, so I have added the following rule..: > > score HELO_LOCALHOST 0.0 > > > but the mail is still scored 4.5 from rule HELO_LOCALHOST ? > > > BTJ Did you reload? -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090414/ca35ebe5/signature.bin From ms-list at alexb.ch Tue Apr 14 20:58:22 2009 From: ms-list at alexb.ch (Alex Broens) Date: Tue Apr 14 20:58:30 2009 Subject: HELO_LOCALHOST and SpamAssassin? In-Reply-To: References: <20090414203547.7b808126@btj-laptop.asp-as.no> <49E4DE8D.4000506@ecs.soton.ac.uk> <20090414214217.3d86c4b5@btj-laptop.asp-as.no> Message-ID: <49E4EADE.8090801@alexb.ch> On 4/14/2009 9:52 PM, Scott Silva wrote: > on 4-14-2009 12:42 PM Bj?rn T Johansen spake the following: >> On Tue, 14 Apr 2009 20:05:49 +0100 >> Julian Field wrote: >> >>> On 14/4/09 19:35, Bj?rn T Johansen wrote: >>>> How can I disable this check in SpamAssassin? All the mail from my webmail server gets a score of 4,75 from this test, which means; it's almost >>>> marked as spam just for this.... >>>> >>> To disable any SpamAssassin test in MailScanner, you should normally >>> just have to set >>> score TROUBLESOME_RULE_HERE 0.0 >>> in /etc/MailScanner/spam.assasssin.prefs.conf and restart MailScanner. >>> >>> Jules >>> >> ok, so I have added the following rule..: >> >> score HELO_LOCALHOST 0.0 >> >> >> but the mail is still scored 4.5 from rule HELO_LOCALHOST ? >> >> >> BTJ > Did you reload? just wondering if its wiser to disable that rule or to fix whatever is HELOing as localhost and make it HELO with a FQDN, as it should. (HELO localhost could also trigger some filter downstream.....) From steve.swaney at fsl.com Tue Apr 14 21:15:33 2009 From: steve.swaney at fsl.com (Stephen Swaney) Date: Tue Apr 14 21:15:43 2009 Subject: HELO_LOCALHOST and SpamAssassin? In-Reply-To: <20090414214217.3d86c4b5@btj-laptop.asp-as.no> References: <20090414203547.7b808126@btj-laptop.asp-as.no> <49E4DE8D.4000506@ecs.soton.ac.uk> <20090414214217.3d86c4b5@btj-laptop.asp-as.no> Message-ID: <00fb01c9bd3d$c449b7b0$4cdd2710$@swaney@fsl.com> > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- > bounces@lists.mailscanner.info] On Behalf Of Bj?rn T Johansen > Sent: Tuesday, April 14, 2009 3:42 PM > To: mailscanner@lists.mailscanner.info > Subject: Re: HELO_LOCALHOST and SpamAssassin? > > On Tue, 14 Apr 2009 20:05:49 +0100 > Julian Field wrote: > > > > > > > On 14/4/09 19:35, Bj?rn T Johansen wrote: > > > How can I disable this check in SpamAssassin? All the mail from my > webmail server gets a score of 4,75 from this test, which means; it's > almost > > > marked as spam just for this.... > > > > > To disable any SpamAssassin test in MailScanner, you should normally > > just have to set > > score TROUBLESOME_RULE_HERE 0.0 > > in /etc/MailScanner/spam.assasssin.prefs.conf and restart > MailScanner. > > > > Jules > > > > ok, so I have added the following rule..: > > score HELO_LOCALHOST 0.0 > > > but the mail is still scored 4.5 from rule HELO_LOCALHOST ? > > > BTJ > -- Did you reload MailScanner after making the change? Steve -- Steve Swaney steve@fsl.com 202 595-7760 ext: 601 www.fsl.com The most accurate and cost effective anti-spam solutions available From btj at havleik.no Tue Apr 14 21:21:31 2009 From: btj at havleik.no (=?ISO-8859-1?Q?Bj=F8rn?= T Johansen) Date: Tue Apr 14 21:22:26 2009 Subject: HELO_LOCALHOST and SpamAssassin? In-Reply-To: References: <20090414203547.7b808126@btj-laptop.asp-as.no> <49E4DE8D.4000506@ecs.soton.ac.uk> <20090414214217.3d86c4b5@btj-laptop.asp-as.no> Message-ID: <20090414222131.14c7ac46@btj-laptop.asp-as.no> On Tue, 14 Apr 2009 12:52:02 -0700 Scott Silva wrote: > on 4-14-2009 12:42 PM Bj?rn T Johansen spake the following: > > On Tue, 14 Apr 2009 20:05:49 +0100 > > Julian Field wrote: > > > >> > >> On 14/4/09 19:35, Bj?rn T Johansen wrote: > >>> How can I disable this check in SpamAssassin? All the mail from my webmail server gets a score of 4,75 from this test, which means; it's almost > >>> marked as spam just for this.... > >>> > >> To disable any SpamAssassin test in MailScanner, you should normally > >> just have to set > >> score TROUBLESOME_RULE_HERE 0.0 > >> in /etc/MailScanner/spam.assasssin.prefs.conf and restart MailScanner. > >> > >> Jules > >> > > > > ok, so I have added the following rule..: > > > > score HELO_LOCALHOST 0.0 > > > > > > but the mail is still scored 4.5 from rule HELO_LOCALHOST ? > > > > > > BTJ > Did you reload? > > Yes, I did... BTJ From btj at havleik.no Tue Apr 14 21:24:50 2009 From: btj at havleik.no (=?ISO-8859-1?Q?Bj=F8rn?= T Johansen) Date: Tue Apr 14 21:25:34 2009 Subject: HELO_LOCALHOST and SpamAssassin? In-Reply-To: <49E4EADE.8090801@alexb.ch> References: <20090414203547.7b808126@btj-laptop.asp-as.no> <49E4DE8D.4000506@ecs.soton.ac.uk> <20090414214217.3d86c4b5@btj-laptop.asp-as.no> <49E4EADE.8090801@alexb.ch> Message-ID: <20090414222450.50669184@btj-laptop.asp-as.no> On Tue, 14 Apr 2009 21:58:22 +0200 Alex Broens wrote: > On 4/14/2009 9:52 PM, Scott Silva wrote: > > on 4-14-2009 12:42 PM Bj?rn T Johansen spake the following: > >> On Tue, 14 Apr 2009 20:05:49 +0100 > >> Julian Field wrote: > >> > >>> On 14/4/09 19:35, Bj?rn T Johansen wrote: > >>>> How can I disable this check in SpamAssassin? All the mail from my webmail server gets a score of 4,75 from this test, which means; it's almost > >>>> marked as spam just for this.... > >>>> > >>> To disable any SpamAssassin test in MailScanner, you should normally > >>> just have to set > >>> score TROUBLESOME_RULE_HERE 0.0 > >>> in /etc/MailScanner/spam.assasssin.prefs.conf and restart MailScanner. > >>> > >>> Jules > >>> > >> ok, so I have added the following rule..: > >> > >> score HELO_LOCALHOST 0.0 > >> > >> > >> but the mail is still scored 4.5 from rule HELO_LOCALHOST ? > >> > >> > >> BTJ > > Did you reload? > > just wondering if its wiser to disable that rule or to fix whatever is > HELOing as localhost and make it HELO with a FQDN, as it should. > (HELO localhost could also trigger some filter downstream.....) > That may well be... But as far as I can see, I did fix that but for some reason it still triggers this rule... So I just thought I could disable this rule until I get time to look at this more closely... BTJ From ms-list at alexb.ch Tue Apr 14 21:33:07 2009 From: ms-list at alexb.ch (Alex Broens) Date: Tue Apr 14 21:33:17 2009 Subject: HELO_LOCALHOST and SpamAssassin? In-Reply-To: <20090414222450.50669184@btj-laptop.asp-as.no> References: <20090414203547.7b808126@btj-laptop.asp-as.no> <49E4DE8D.4000506@ecs.soton.ac.uk> <20090414214217.3d86c4b5@btj-laptop.asp-as.no> <49E4EADE.8090801@alexb.ch> <20090414222450.50669184@btj-laptop.asp-as.no> Message-ID: <49E4F303.1080602@alexb.ch> On 4/14/2009 10:24 PM, Bj?rn T Johansen wrote: > On Tue, 14 Apr 2009 21:58:22 +0200 > Alex Broens wrote: > >> On 4/14/2009 9:52 PM, Scott Silva wrote: >>> on 4-14-2009 12:42 PM Bj?rn T Johansen spake the following: >>>> On Tue, 14 Apr 2009 20:05:49 +0100 >>>> Julian Field wrote: >>>> >>>>> On 14/4/09 19:35, Bj?rn T Johansen wrote: >>>>>> How can I disable this check in SpamAssassin? All the mail from my webmail server gets a score of 4,75 from this test, which means; it's almost >>>>>> marked as spam just for this.... >>>>>> >>>>> To disable any SpamAssassin test in MailScanner, you should normally >>>>> just have to set >>>>> score TROUBLESOME_RULE_HERE 0.0 >>>>> in /etc/MailScanner/spam.assasssin.prefs.conf and restart MailScanner. >>>>> >>>>> Jules >>>>> >>>> ok, so I have added the following rule..: >>>> >>>> score HELO_LOCALHOST 0.0 >>>> >>>> >>>> but the mail is still scored 4.5 from rule HELO_LOCALHOST ? >>>> >>>> >>>> BTJ >>> Did you reload? >> just wondering if its wiser to disable that rule or to fix whatever is >> HELOing as localhost and make it HELO with a FQDN, as it should. >> (HELO localhost could also trigger some filter downstream.....) >> > > That may well be... But as far as I can see, I did fix that but for some reason it still triggers this rule... > So I just thought I could disable this rule until I get time to look at this more closely... all we can do is guess what you may or not have done. If you ask in the webmail's list/forums, you're seldom the first and only one with the same problem and you'll probably get a quick reply to fix the issue at the source. Alex From hvdkooij at vanderkooij.org Tue Apr 14 21:58:34 2009 From: hvdkooij at vanderkooij.org (Hugo van der Kooij) Date: Tue Apr 14 21:58:44 2009 Subject: scanctl In-Reply-To: References: <24e3d2e40904131241v3d85ff75h5eb4c8fe00bb53cb@mail.gmail.com> <49E446BC.3090201@ecs.soton.ac.uk> <49E448D6.2050600@ecs.soton.ac.uk> Message-ID: <49E4F8FA.1040108@vanderkooij.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Kai Schaetzl wrote: > yes, his tutorial is from about that time ;-) > http://www.entrophy-free.net/anti-spam.html Love endures. Babylon 5 endures. Old website however outlive them all. (I bet they are supernova proof ;-) Hugo. - -- hvdkooij@vanderkooij.org http://hugo.vanderkooij.org/ PGP/GPG? Use: http://hugo.vanderkooij.org/0x58F19981.asc A: Yes. >Q: Are you sure? >>A: Because it reverses the logical flow of conversation. >>>Q: Why is top posting frowned upon? Bored? Click on http://spamornot.org/ and rate those images. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iEUEARECAAYFAknk+PgACgkQBvzDRVjxmYFKdgCWNza8Sg+l8n3KtQdwJxPa5QGi yQCfbXhbTUe5hRoL0VMS5nxn0e71l0o= =Bo4L -----END PGP SIGNATURE----- From mark at msapiro.net Tue Apr 14 22:14:06 2009 From: mark at msapiro.net (Mark Sapiro) Date: Tue Apr 14 22:14:17 2009 Subject: Found nn messages in the processing-messages database Message-ID: Beginning yesterday after I upgraded from MailScanner 4.76.7-1 to 4.76.10-2 and continuing today after upgrading to 4.76.12-1, I am seeing messages like Found nn messages in the processing-messages database every time a child starts. I used to see these in prior versions, but the count was always zero. Beginning with my installation of 4.76.10-2, the count appears (so far) to be a non-decreasing number. Is this correct? -- Mark Sapiro The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From MailScanner at ecs.soton.ac.uk Wed Apr 15 09:16:21 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Wed Apr 15 09:16:43 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49E597D5.3050300@ecs.soton.ac.uk> Message-ID: On 14/4/09 22:14, Mark Sapiro wrote: > Beginning yesterday after I upgraded from MailScanner 4.76.7-1 to > 4.76.10-2 and continuing today after upgrading to 4.76.12-1, I am > seeing messages like > > Found nn messages in the processing-messages database > > every time a child starts. I used to see these in prior versions, but > the count was always zero. Beginning with my installation of > 4.76.10-2, the count appears (so far) to be a non-decreasing number. > > Is this correct? > It tends to imply that some of your MailScanner children are dying unnatural deaths. Run it with --debug a few times and see if you can catch it breaking. Then grab a copy of your mqueue.in so we have the rogue messages to experiment with. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From maillists at conactive.com Wed Apr 15 11:31:12 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Wed Apr 15 11:31:26 2009 Subject: HELO_LOCALHOST and SpamAssassin? In-Reply-To: <20090414222450.50669184@btj-laptop.asp-as.no> References: <20090414203547.7b808126@btj-laptop.asp-as.no> <49E4DE8D.4000506@ecs.soton.ac.uk> <20090414214217.3d86c4b5@btj-laptop.asp-as.no> <49E4EADE.8090801@alexb.ch> <20090414222450.50669184@btj-laptop.asp-as.no> Message-ID: Bj?rn T Johansen wrote on Tue, 14 Apr 2009 22:24:50 +0200: > That may well be... But as far as I can see, I did fix that but for > some reason it still triggers this rule... You want to set your trusted_networks or that other _networks (internal?) option I always forget in SA correctly. Do a bit of research for that on the Spamassassin wiki and if you still can't get a good result post your question to the SA list. It's really better suited there. Also, the documentation is always a good read, it *is* documented there. http://spamassassin.apache.org/full/3.2.x/doc/Mail_SpamAssassin_Conf.html Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Wed Apr 15 11:50:45 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Wed Apr 15 11:50:55 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49E597D5.3050300@ecs.soton.ac.uk> Message-ID: Julian Field wrote on Wed, 15 Apr 2009 09:16:21 +0100: > It tends to imply that some of your MailScanner children are dying > unnatural deaths. I see that my main MailScanner started to show exactly 1 message in the queue on March 30. What is it supposed to do with that message? And where is that message supposed to be lying around (this is postfix)? I rather think this message doesn't exist. A --debug just gets me the first few lines and then it waits for messages. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From MailScanner at ecs.soton.ac.uk Wed Apr 15 11:56:09 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Wed Apr 15 11:56:28 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49E597D5.3050300@ecs.soton.ac.uk> <49E5BD49.1000306@ecs.soton.ac.uk> Message-ID: On 15/4/09 11:50, Kai Schaetzl wrote: > Julian Field wrote on Wed, 15 Apr 2009 09:16:21 +0100: > > >> It tends to imply that some of your MailScanner children are dying >> unnatural deaths. >> > I see that my main MailScanner started to show exactly 1 message in the > queue on March 30. What is it supposed to do with that message? > And where is that message supposed to be lying around (this is postfix)? > I rather think this message doesn't exist. A --debug just gets me the > first few lines and then it waits for messages. > Interesting. Unfortunately unless I can get a reproducible case, there's not a lot I can do. If you dump the contents of the database ("MailScanner --processing"), does it show a message id which appears in your email logs? Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From maillists at conactive.com Wed Apr 15 12:20:42 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Wed Apr 15 12:20:54 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49E597D5.3050300@ecs.soton.ac.uk> <49E5BD49.1000306@ecs.soton.ac.uk> Message-ID: Julian Field wrote on Wed, 15 Apr 2009 11:56:09 +0100: > Interesting. Unfortunately unless I can get a reproducible case, there's > not a lot I can do. If you dump the contents of the database > ("MailScanner --processing"), does it show a message id which appears in > your email logs? No output at all. That it was one message all the time led me to believe it might be one message that stays in there. Of course, it could also be a new message each time. I think that I get the message on each MS reload, as it appears roughly every two hours, but this might be a wrong guess as well. I'm not having any indication that there is some problem, just that message that isn't going away anymore. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From MailScanner at ecs.soton.ac.uk Wed Apr 15 13:51:29 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Wed Apr 15 13:51:54 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49E597D5.3050300@ecs.soton.ac.uk> <49E5BD49.1000306@ecs.soton.ac.uk> <49E5D851.1090209@ecs.soton.ac.uk> Message-ID: On 15/4/09 12:20, Kai Schaetzl wrote: > Julian Field wrote on Wed, 15 Apr 2009 11:56:09 +0100: > > >> Interesting. Unfortunately unless I can get a reproducible case, there's >> not a lot I can do. If you dump the contents of the database >> ("MailScanner --processing"), does it show a message id which appears in >> your email logs? >> > No output at all. > That it was one message all the time led me to believe it might be one > message that stays in there. Of course, it could also be a new message each > time. I think that I get the message on each MS reload, Ah, in that case there is nothing wrong. It's just that the reload happened when it was processing a message. I wouldn't worry about it in that case. > as it appears > roughly every two hours, but this might be a wrong guess as well. > I'm not having any indication that there is some problem, just that message > that isn't going away anymore. > > Kai > > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From keith at 12345678.org Wed Apr 15 15:22:09 2009 From: keith at 12345678.org (keith) Date: Wed Apr 15 15:22:53 2009 Subject: Does MS support Kaspersky version 5.x ? Message-ID: <20090415141004.M62300@12345678.org> Dear All, First to said sorry for my bad english, I have a license for Kaspersky 5.7 rpm version, I can successfully to install to my Centos 5.3, and I change "Virus Scanners = auto" in Mailscanner.conf, after restart server the mailscanner only detect the clamav, no Kaspersky found, I know the virus.scanners.conf is control the anti-virus program location, the new version of Kaspersky is locate to /opt/kaspersky/kav4fs/ , does any expert can tell me how to fix it or make the MS to support the latest version of Kaspersky. Thanks -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From mark at msapiro.net Wed Apr 15 15:37:49 2009 From: mark at msapiro.net (Mark Sapiro) Date: Wed Apr 15 15:38:01 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49E597D5.3050300@ecs.soton.ac.uk> Message-ID: <20090415143749.GA496@msapiro> On Wed, Apr 15, 2009 at 09:16:21AM +0100, Julian Field wrote: > > > On 14/4/09 22:14, Mark Sapiro wrote: > >Beginning yesterday after I upgraded from MailScanner 4.76.7-1 to > >4.76.10-2 and continuing today after upgrading to 4.76.12-1, I am > >seeing messages like > > > >Found nn messages in the processing-messages database > > > >every time a child starts. I used to see these in prior versions, but > >the count was always zero. Beginning with my installation of > >4.76.10-2, the count appears (so far) to be a non-decreasing number. > > > >Is this correct? > > > It tends to imply that some of your MailScanner children are dying > unnatural deaths. Run it with --debug a few times and see if you can > catch it breaking. Then grab a copy of your mqueue.in so we have the > rogue messages to experiment with. I won't have time for a day or two to do further testing, but I don't think children are dying unnaturally. I see sets of log messages like the following when MailScanner is restarted, say by updating spear fishing rules. Apr 15 03:16:02 sbh16 MailScanner[9708]: MailScanner child caught a SIGHUP Apr 15 03:16:09 sbh16 MailScanner[10451]: MailScanner E-Mail Virus Scanner version 4.76.12 starting... Apr 15 03:16:09 sbh16 MailScanner[10451]: Read 854 hostnames from the phishing whitelist Apr 15 03:16:09 sbh16 MailScanner[10451]: Read 4107 hostnames from the phishing blacklist Apr 15 03:16:10 sbh16 MailScanner[10451]: Using SpamAssassin results cache Apr 15 03:16:10 sbh16 MailScanner[10451]: Connected to SpamAssassin cache database Apr 15 03:16:22 sbh16 MailScanner[10451]: Connected to processing-messages database Apr 15 03:16:22 sbh16 MailScanner[10451]: Found 23 messages in the processing-messages database Apr 15 03:16:22 sbh16 MailScanner[10451]: Using locktype = flock Apr 15 03:16:22 sbh16 MailScanner[10451]: New Batch: Scanning 1 messages, 1052 bytes Apr 15 03:16:22 sbh16 MailScanner[10451]: Requeue: 4F3D86900A5.69860 to 548ED6902C5 Apr 15 03:16:22 sbh16 MailScanner[10451]: Unscanned: Delivered 1 messages Apr 15 03:16:22 sbh16 MailScanner[10451]: Virus and Content Scanning: Starting Apr 15 03:16:22 sbh16 MailScanner[10451]: Deleted 1 messages from processing-database And sets like this when a child dies of old age Apr 15 06:40:02 sbh16 MailScanner[14223]: MailScanner child dying of old age Apr 15 06:40:02 sbh16 MailScanner[16013]: MailScanner E-Mail Virus Scanner version 4.76.12 starting... Apr 15 06:40:02 sbh16 MailScanner[16013]: Read 854 hostnames from the phishing whitelist Apr 15 06:40:02 sbh16 MailScanner[16013]: Read 4095 hostnames from the phishing blacklist Apr 15 06:40:02 sbh16 MailScanner[16013]: Using SpamAssassin results cache Apr 15 06:40:02 sbh16 MailScanner[16013]: Connected to SpamAssassin cache database Apr 15 06:40:10 sbh16 MailScanner[16013]: Connected to processing-messages database Apr 15 06:40:10 sbh16 MailScanner[16013]: Found 23 messages in the processing-messages database Apr 15 06:40:10 sbh16 MailScanner[16013]: Using locktype = flock Apr 15 06:49:22 sbh16 MailScanner[16013]: New Batch: Scanning 1 messages, 15107 bytes Apr 15 06:49:26 sbh16 MailScanner[16013]: Virus and Content Scanning: Starting Apr 15 06:49:27 sbh16 MailScanner[16013]: Requeue: B274569036E.4D3D9 to E761F69037A Apr 15 06:49:27 sbh16 MailScanner[16013]: Uninfected: Delivered 1 messages Apr 15 06:49:27 sbh16 MailScanner[16013]: Deleted 1 messages from processing-database I only run with one child, and there are no other deaths/restarts in the log besides "old age" and expected "SIGHUP". Note that the "Found" count doesn't always increase between restarts, but it never decreases. Also, "New Batch: Scanning X messages" in the log are always followed by "Deleted X messages from processing-database" with the same count and over any period, the "Deleted" counts add up to the same total as the "Scanning" counts even where the "Found" count has increased. -- Mark Sapiro mark at msapiro net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From maillists at conactive.com Wed Apr 15 17:32:10 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Wed Apr 15 17:32:23 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: <20090415143749.GA496@msapiro> References: <49E597D5.3050300@ecs.soton.ac.uk> <20090415143749.GA496@msapiro> Message-ID: Mark Sapiro wrote on Wed, 15 Apr 2009 07:37:49 -0700: > Note that the "Found" count doesn't always increase between restarts, but > it never decreases. Yes, there seems to be some bottom, that is carried on forever. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From JBracey at csuchico.edu Wed Apr 15 20:04:11 2009 From: JBracey at csuchico.edu (Bracey, John) Date: Wed Apr 15 20:04:42 2009 Subject: trouble installing mailscanner on freeBSD 6.2 server Message-ID: <9ADE954C5044754C8E0BF406B5A217552DD2AD6E@ESCHE.csuchico.edu> Hello All: I hope this isn't a noob question, my apologies in advance if it is. When I try to install MailScanner I'm getting the following: [root@scooby /usr/ports/mail/mailscanner]# make install clean ===> Installing for MailScanner-4.67.6_4 ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/IO/Stringy.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/mach/File/Spec.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/mach/Bundle/DBI.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/File/Temp.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/mach/MIME/Base64.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/Mail/Header.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/HTML/Tagset.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/mach/HTML/HeadParser.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/MIME/Parser.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/Convert/TNEF.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/Convert/BinHex.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/Net/CIDR.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/Net/Ident.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/Archive/Zip.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/Compress/Zlib.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/mach/DBD/SQLite.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/mach/DBI.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/Getopt/Long.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/mach/Storable.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/mach/Time/HiRes.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/Time/Zone.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/mach/Filesys/Df.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/Sys/Hostname/Long.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/mach/IO/Handle.pm - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/bin/perl5.8.9 - found ===> MailScanner-4.67.6_4 depends on executable: bash - found ===> MailScanner-4.67.6_4 depends on executable: tnef - found ===> MailScanner-4.67.6_4 depends on executable: wget - found ===> MailScanner-4.67.6_4 depends on file: /usr/local/lib/perl5/site_perl/5.8.9/mach/Mail/ClamAV.pm - not found ===> Verifying install for /usr/local/lib/perl5/site_perl/5.8.9/mach/Mail/ClamAV.pm in /usr/ports/mail/p5-Mail-ClamAV ===> p5-Mail-ClamAV-0.20_5 is marked as broken: Doesn't build with clamav 0.95 or later. *** Error code 1 Stop in /usr/ports/mail/p5-Mail-ClamAV. *** Error code 1 Stop in /usr/ports/mail/mailscanner. *** Error code 1 Stop in /usr/ports/mail/mailscanner. Is there any way around this error? I've not been able to find any info googling this so far. Just for back round, this is a reinstall after a Perl upgrade that didn't go well (5.8.8 >> 5.8.9). I think I have that part straight now, but can't get this last app going again. Thanks in advance. -John -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090415/2e4e46e4/attachment.html From MailScanner at ecs.soton.ac.uk Wed Apr 15 20:16:43 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Wed Apr 15 20:16:57 2009 Subject: Does MS support Kaspersky version 5.x ? In-Reply-To: <20090415141004.M62300@12345678.org> References: <20090415141004.M62300@12345678.org> <49E6329B.8030805@ecs.soton.ac.uk> Message-ID: I suggest you try reading the explanatory documentation in MailScanner.conf just above the "Virus Scanners" setting. This will tell you most of what you need, at least. On 15/4/09 15:22, keith wrote: > Dear All, > > First to said sorry for my bad english, I have a license for Kaspersky 5.7 rpm > version, I can successfully to install to my Centos 5.3, and I change "Virus > Scanners = auto" in Mailscanner.conf, after restart server the mailscanner > only detect the clamav, no Kaspersky found, I know the virus.scanners.conf is > control the anti-virus program location, the new version of Kaspersky is > locate to /opt/kaspersky/kav4fs/ , does any expert can tell me how to fix it > or make the MS to support the latest version of Kaspersky. > > Thanks > > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From ssilva at sgvwater.com Wed Apr 15 20:57:24 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Wed Apr 15 20:57:52 2009 Subject: trouble installing mailscanner on freeBSD 6.2 server In-Reply-To: <9ADE954C5044754C8E0BF406B5A217552DD2AD6E@ESCHE.csuchico.edu> References: <9ADE954C5044754C8E0BF406B5A217552DD2AD6E@ESCHE.csuchico.edu> Message-ID: on 4-15-2009 12:04 PM Bracey, John spake the following: > Hello All: > > > > I hope this isn?t a noob question, my apologies in advance if it is. > > > > When I try to install MailScanner I?m getting the following: > > > > [root@scooby /usr/ports/mail/mailscanner]# make install clean > > ===> Installing for MailScanner-4.67.6_4 > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/IO/Stringy.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/File/Spec.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/Bundle/DBI.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/File/Temp.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/MIME/Base64.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Mail/Header.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/HTML/Tagset.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/HTML/HeadParser.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/MIME/Parser.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Convert/TNEF.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Convert/BinHex.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Net/CIDR.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Net/Ident.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Archive/Zip.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Compress/Zlib.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/DBD/SQLite.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/DBI.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Getopt/Long.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/Storable.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/Time/HiRes.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Time/Zone.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/Filesys/Df.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Sys/Hostname/Long.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/IO/Handle.pm - found > > ===> MailScanner-4.67.6_4 depends on file: /usr/local/bin/perl5.8.9 - > found > > ===> MailScanner-4.67.6_4 depends on executable: bash - found > > ===> MailScanner-4.67.6_4 depends on executable: tnef - found > > ===> MailScanner-4.67.6_4 depends on executable: wget - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/Mail/ClamAV.pm - not found > > ===> Verifying install for > /usr/local/lib/perl5/site_perl/5.8.9/mach/Mail/ClamAV.pm in > /usr/ports/mail/p5-Mail-ClamAV > > ===> p5-Mail-ClamAV-0.20_5 is marked as broken: Doesn't build with > clamav 0.95 or later. > > *** Error code 1 > > > > Stop in /usr/ports/mail/p5-Mail-ClamAV. > > *** Error code 1 > > > > Stop in /usr/ports/mail/mailscanner. > > *** Error code 1 > > > > Stop in /usr/ports/mail/mailscanner. > > > > > > Is there any way around this error? I?ve not been able to find any info > googling this so far. > > > > Just for back round, this is a reinstall after a Perl upgrade that > didn?t go well (5.8.8 >> 5.8.9). I think I have that part straight now, > but can?t get this last app going again. > > > > Thanks in advance. > > -John > The ports maintainer seems to require the clam perl module, but it is always too far behind to build reliably anymore. I don't have any experience on modding a freebsd port to tell you how to fix this except trying to force an older clamav version and try again. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090415/f39b26bc/signature.bin From kkobb at skylinecorp.com Wed Apr 15 21:11:28 2009 From: kkobb at skylinecorp.com (Kevin Kobb) Date: Wed Apr 15 21:11:51 2009 Subject: trouble installing mailscanner on freeBSD 6.2 server In-Reply-To: <9ADE954C5044754C8E0BF406B5A217552DD2AD6E@ESCHE.csuchico.edu> References: <9ADE954C5044754C8E0BF406B5A217552DD2AD6E@ESCHE.csuchico.edu> Message-ID: Bracey, John wrote: > Hello All: > > > > I hope this isn?t a noob question, my apologies in advance if it is. > > > > When I try to install MailScanner I?m getting the following: > > > > [root@scooby /usr/ports/mail/mailscanner]# make install clean > > ===> Installing for MailScanner-4.67.6_4 > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/IO/Stringy.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/File/Spec.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/Bundle/DBI.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/File/Temp.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/MIME/Base64.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Mail/Header.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/HTML/Tagset.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/HTML/HeadParser.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/MIME/Parser.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Convert/TNEF.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Convert/BinHex.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Net/CIDR.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Net/Ident.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Archive/Zip.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Compress/Zlib.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/DBD/SQLite.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/DBI.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Getopt/Long.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/Storable.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/Time/HiRes.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Time/Zone.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/Filesys/Df.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Sys/Hostname/Long.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/IO/Handle.pm - found > > ===> MailScanner-4.67.6_4 depends on file: /usr/local/bin/perl5.8.9 - > found > > ===> MailScanner-4.67.6_4 depends on executable: bash - found > > ===> MailScanner-4.67.6_4 depends on executable: tnef - found > > ===> MailScanner-4.67.6_4 depends on executable: wget - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/Mail/ClamAV.pm - not found > > ===> Verifying install for > /usr/local/lib/perl5/site_perl/5.8.9/mach/Mail/ClamAV.pm in > /usr/ports/mail/p5-Mail-ClamAV > > ===> p5-Mail-ClamAV-0.20_5 is marked as broken: Doesn't build with > clamav 0.95 or later. > > *** Error code 1 > > > > Stop in /usr/ports/mail/p5-Mail-ClamAV. > > *** Error code 1 > > > > Stop in /usr/ports/mail/mailscanner. > > *** Error code 1 > > > > Stop in /usr/ports/mail/mailscanner. > > > > > > Is there any way around this error? I?ve not been able to find any info > googling this so far. > > > > Just for back round, this is a reinstall after a Perl upgrade that > didn?t go well (5.8.8 >> 5.8.9). I think I have that part straight now, > but can?t get this last app going again. > > > > Thanks in advance. > > -John > You could install the port without selecting the clamavmodule. Change to the port directory and do: make rmconfig make config make install Should build OK. From JBracey at csuchico.edu Wed Apr 15 22:03:49 2009 From: JBracey at csuchico.edu (Bracey, John) Date: Wed Apr 15 22:06:32 2009 Subject: trouble installing mailscanner on freeBSD 6.2 server In-Reply-To: References: <9ADE954C5044754C8E0BF406B5A217552DD2AD6E@ESCHE.csuchico.edu> Message-ID: <9ADE954C5044754C8E0BF406B5A217552DD2B094@ESCHE.csuchico.edu> Cool! This did the trick. Thanks so much for the help Kevin. -John Bracey -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Kevin Kobb Sent: Wednesday, April 15, 2009 1:11 PM To: mailscanner@lists.mailscanner.info Subject: Re: trouble installing mailscanner on freeBSD 6.2 server Bracey, John wrote: > Hello All: > > > > I hope this isn't a noob question, my apologies in advance if it is. > > > > When I try to install MailScanner I'm getting the following: > > > > [root@scooby /usr/ports/mail/mailscanner]# make install clean > > ===> Installing for MailScanner-4.67.6_4 > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/IO/Stringy.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/File/Spec.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/Bundle/DBI.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/File/Temp.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/MIME/Base64.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Mail/Header.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/HTML/Tagset.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/HTML/HeadParser.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/MIME/Parser.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Convert/TNEF.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Convert/BinHex.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Net/CIDR.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Net/Ident.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Archive/Zip.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Compress/Zlib.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/DBD/SQLite.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/DBI.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Getopt/Long.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/Storable.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/Time/HiRes.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Time/Zone.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/Filesys/Df.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Sys/Hostname/Long.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/IO/Handle.pm - found > > ===> MailScanner-4.67.6_4 depends on file: /usr/local/bin/perl5.8.9 - > found > > ===> MailScanner-4.67.6_4 depends on executable: bash - found > > ===> MailScanner-4.67.6_4 depends on executable: tnef - found > > ===> MailScanner-4.67.6_4 depends on executable: wget - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/Mail/ClamAV.pm - not found > > ===> Verifying install for > /usr/local/lib/perl5/site_perl/5.8.9/mach/Mail/ClamAV.pm in > /usr/ports/mail/p5-Mail-ClamAV > > ===> p5-Mail-ClamAV-0.20_5 is marked as broken: Doesn't build with > clamav 0.95 or later. > > *** Error code 1 > > > > Stop in /usr/ports/mail/p5-Mail-ClamAV. > > *** Error code 1 > > > > Stop in /usr/ports/mail/mailscanner. > > *** Error code 1 > > > > Stop in /usr/ports/mail/mailscanner. > > > > > > Is there any way around this error? I've not been able to find any info > googling this so far. > > > > Just for back round, this is a reinstall after a Perl upgrade that > didn't go well (5.8.8 >> 5.8.9). I think I have that part straight now, > but can't get this last app going again. > > > > Thanks in advance. > > -John > You could install the port without selecting the clamavmodule. Change to the port directory and do: make rmconfig make config make install Should build OK. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From maillists at conactive.com Thu Apr 16 00:11:17 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Thu Apr 16 00:11:32 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49E597D5.3050300@ecs.soton.ac.uk> <49E5BD49.1000306@ecs.soton.ac.uk> <49E5D851.1090209@ecs.soton.ac.uk> ac.uk|090209@ecs.soton.ac.uk> Reply-To: mailscanner@lists.mailscanner.info Julian Field wrote on Wed, 15 Apr 2009 13:51:29 +0100: > Ah, in that case there is nothing wrong. I thought so, but the way it is steadily occuring once it occured and Mark's posting led me to think a second time about it. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From gcle at smcaus.com.au Thu Apr 16 00:32:53 2009 From: gcle at smcaus.com.au (Gerard Cleary) Date: Thu Apr 16 00:33:14 2009 Subject: Does MS support Kaspersky version 5.x ? In-Reply-To: <20090415141004.M62300@12345678.org> References: <20090415141004.M62300@12345678.org> Message-ID: <200904160932.54001.gcle@smcaus.com.au> On Thu, 16 Apr 2009 00:22:09 keith wrote: > First to said sorry for my bad english, I have a license for Kaspersky 5.7 > rpm version, I can successfully to install to my Centos 5.3, and I change > "Virus Scanners = auto" in Mailscanner.conf, after restart server the > mailscanner only detect the clamav, no Kaspersky found, I know the > virus.scanners.conf is control the anti-virus program location, the new > version of Kaspersky is locate to /opt/kaspersky/kav4fs/ , does any expert > can tell me how to fix it or make the MS to support the latest version of > Kaspersky. I use version 5 of Kaspersky. I specified "kaspersky-4.5" according to the instructions in the MailScanner configuration file. I also added a soft link in directory /opt called "kav" and pointing to "/opt/kaspersky/kav4lms". We'll be changing to version 6 of Kaspersky in the next few months. I believe our licence keys work with both version 5 and with version 6. All the best, Gerard. -- Gerard Cleary SMC Systems Administration Ph: +61 2 9354 8222 From gcle at smcaus.com.au Thu Apr 16 00:43:59 2009 From: gcle at smcaus.com.au (Gerard Cleary) Date: Thu Apr 16 00:44:18 2009 Subject: Does MS support Kaspersky version 5.x ? Message-ID: <200904160943.59467.gcle@smcaus.com.au> > I also added a soft link in directory /opt called "kav" and pointing to "/opt/kaspersky/kav4lms". Sorry, I made a typo! If you put in a link, yours will point to "/opt/kaspersky/kav4fs". Gerard. -- Gerard Cleary SMC Systems Administration Ph: +61 2 9354 8222 From MailScanner at ecs.soton.ac.uk Thu Apr 16 09:15:42 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Apr 16 09:16:00 2009 Subject: Does MS support Kaspersky version 5.x ? In-Reply-To: <200904160943.59467.gcle@smcaus.com.au> References: <200904160943.59467.gcle@smcaus.com.au> <49E6E92E.30809@ecs.soton.ac.uk> Message-ID: On 16/4/09 00:43, Gerard Cleary wrote: >> I also added a soft link in directory /opt called "kav" and pointing to "/opt/kaspersky/kav4lms". >> > Sorry, I made a typo! If you put in a link, yours will point to "/opt/kaspersky/kav4fs". > Much better idea to change the location specified in /etc/MailScanner/virus.scanners.conf, rather than adding arbitrary soft-links to your filesystem :-) Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From glenn.steen at gmail.com Thu Apr 16 13:46:46 2009 From: glenn.steen at gmail.com (Glenn Steen) Date: Thu Apr 16 13:46:54 2009 Subject: OT: Server puts in zombie mode. In-Reply-To: References: <7d9b3cf20904131447t6b8a923chfb50166e9c5af692@mail.gmail.com> Message-ID: <223f97700904160546k741c0e29nb1a578ad21a888bd@mail.gmail.com> 2009/4/14 Scott Silva : > on 4-13-2009 2:47 PM Eduardo Casarero spake the following: >> Hi, i've a rare situation on some servers, they just get zombie. After >> all i've researched i think it's a HD hang out or something in storage >> because i couldnt find any trace in the logs. The failure seems to be >> random and the server in zombie mode appears to be online answering >> ping and if you telnet ssh port you get connected but after you >> connect the connection is lost (as if the servers tries to read >> something from HD). >> >> Also the servers that eventually crash have years of heavy load >> processing emails (this backups my theory of HD failure). After >> rebooting the server everything seems to be ok. >> >> The SO is slackware and some servers are slackware 10.2 or 12.1 so i >> think is not a SO bug, also they have different versions of >> MailScanner/SA/clamd (because they have years working and the upgrade >> process is not massive. Usually the zombie servers has SATA disk (that >> also backups my theory) >> >> Does anyone have any idea of how can i get a log or something to >> demostrate this? or any other test to get better/or another conclusion >> or cause? >> >> Any help would be really appreciated. >> >> Thanks eduardo. > Hang a serial console on the system and watch it or log it. It might get some > kernel messages that don't get written to log. Also try a memory test. Memory > can also go bad over time, especially on overworked servers that might have > collected some dust over the years and overheated. Maybe even just pull and > reseat all the cards, memory, and even the processor in case some oxidation is > present on the connectors. > I have to agree with Scott... The gut feeling I get is _not_ HDD-problems (although that might be a possibility as well, just not the "obvious first thing to test for":-)... It might not even be HW, but rather something leaking memory slowly over time... and some more or less unfortunate "memory hog prevention" making your kernel kill things oppotunistically. So set up some monitoring (the sysstat package include sar, which should be enough detail). If it is this, you shouldn't need poll more than every 10-20 minutes to be able to see it (no need to check every few seconds:-). Other than that, Scotts suggestions are good... If you have a console on 'em, and are logged into a textmode console session... you might consider using the "magic sysrq keys" to facilitate a "pre-reboot postmortem"... Cheers -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From glenn.steen at gmail.com Thu Apr 16 14:14:00 2009 From: glenn.steen at gmail.com (Glenn Steen) Date: Thu Apr 16 14:14:09 2009 Subject: scanctl In-Reply-To: References: <24e3d2e40904131241v3d85ff75h5eb4c8fe00bb53cb@mail.gmail.com> <49E446BC.3090201@ecs.soton.ac.uk> <49E448D6.2050600@ecs.soton.ac.uk> Message-ID: <223f97700904160614h4caf31afq56200ba132fc08ab@mail.gmail.com> 2009/4/14 Julian Field : > I just noticed one more thing. He says it applies to version *3* of > MailScanner, which has only been around for about 5 years or so. I suspect > this page is a little old and no longer relevant. When he wrote it, > MailScanner already did the periodic restarts anyway, but it didn't do the > multiple queue directories, I didn't introduce that until about 2004. > :-) I know Jim a bit, if you like I'll try get hold of him and have him at least mark the pages as obsolete:-) -- -- Glenn > Jules. > > On 14/4/09 09:18, Julian Field wrote: >> >> >> On 13/4/09 20:41, Alex Neuman wrote: >>> >>> I came across the following: >>> >>> http://www.entrophy-free.net/mail/scanctl >>> >>> I tried googling for its name + "Julian Field" and came up with nothing, >>> so I turn to you guys... Has anybody here used/heard/thought about this, >>> ever? Don't remember it being mentioned at all on the list either. >> >> Have just read the documentation included at the above URL, I can't see >> the point in this script at all. Its main 2 features seem to be >> 1) Manages multiple incoming mail queues, >> 2) Restarts MailScanner periodically. >> >> If the author had ever read the MailScanner documentation, he would know >> that >> 1) MailScanner already supports multiple work queues, in a far simpler and >> more flexible way than his suggested setup, this is all explained in the >> "Incoming Queue Dir" setting; >> 2) MailScanner restarts itself periodically for exactly the reasons he >> gives for restarting it, this is all explained in the "Restart Every" >> setting pretty near the top of the MailScanner.conf file. >> >> So I don't see any point in this package at all. >> >> Jules >> > > Jules > > -- > Julian Field MEng CITP CEng > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > MailScanner customisation, or any advanced system administration help? > Contact me at Jules@Jules.FM > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > PGP public key: http://www.jules.fm/julesfm.asc > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From bob at immure.com Thu Apr 16 17:18:57 2009 From: bob at immure.com (Bob Willcox) Date: Thu Apr 16 17:19:10 2009 Subject: Problem with MailScanner on FreeBSD 7.2 w/sendmail Message-ID: <20090416161807.GG99178@rancor.immure.com> Hi, I have a 7.2-prelease system that I am trying to get sendmail and MailScanner running on and for some reason sendmail isn't listening on *.smtp, though it is listening on localhost.smtp. If I remove MailScanner from the mix and run sendmail in the conventional way (with sendmail_enable="YES" specified in /etc/rc.conf) then things work as expected (except no MailScanner, of course). I currently have a running 6.4-stable system, that this new 7.2 system is scheduled to replace, that is using the same MailScanner and sendmail configuration files and it is working ok (and has been for a long time). I suspect that I'm simply missing some configuration option here that I've overlooked or that may have changed between 6.4 and 7.2, but don't really know where to look. My FreeBSD version is: FreeBSD boss-nass 7.2-PRERELEASE FreeBSD 7.2-PRERELEASE #0: Wed Apr 15 10:46:32 CDT 2009 amd64 sendmail: Version 8.14.3 Compiled with: DNSMAP LOG MAP_REGEX MATCHGECOS MILTER MIME7TO8 MIME8TO7 NAMED_BIND NETINET NETINET6 NETUNIX NEWDB NIS PIPELINING SASLv2 SCANF STARTTLS TCPWRAPPERS USERDB XDEBUG MailScanner: MailScanner-4.67.6_4 Any help or tips on things to do/check would be greatly appreciated. Thanks, Bob -- Bob Willcox The trouble with doing something right the first bob@immure.com time is that nobody appreciates how difficult it was. Austin, TX -- unknown From maillists at conactive.com Thu Apr 16 17:31:25 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Thu Apr 16 17:31:39 2009 Subject: Beware of RPMForge's clamav-0.95.1 packages In-Reply-To: <7EF0EE5CB3B263488C8C18823239BEBA06626F22@HC-MBX02.herefordshire.gov.uk> References: <7EF0EE5CB3B263488C8C18823239BEBA06626F22@HC-MBX02.herefordshire.gov.uk> Message-ID: Phil Randal wrote on Thu, 9 Apr 2009 14:26:28 +0100: > -LogFile unix:/var/log/clamav/clamd.log > +LogFile /var/log/clamav/clamd.log FYI, this is fixed in the currently available 0.95.1-2.el5.rf. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From mark at msapiro.net Thu Apr 16 20:08:28 2009 From: mark at msapiro.net (Mark Sapiro) Date: Thu Apr 16 20:27:26 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: <20090415143749.GA496@msapiro> References: <49E597D5.3050300@ecs.soton.ac.uk> <20090415143749.GA496@msapiro> Message-ID: <20090416190828.GA2012@msapiro> On Wed, Apr 15, 2009 at 07:37:49AM -0700, Mark Sapiro wrote: > > Note that the "Found" count doesn't always increase between restarts, but > it never decreases. Also, "New Batch: Scanning X messages" in the log are > always followed by "Deleted X messages from processing-database" with the > same count and over any period, the "Deleted" counts add up to the same > total as the "Scanning" counts even where the "Found" count has increased. One more piece of information. As I said, I first saw these increasing counts after upgrading 4.76.7 to 4.76.10 three days ago and continuing after upgrading to 4.76.12 two days ago, but I observe the rate at which the count increases is decreasing. It went from 0 to 16 in the first 24 hours and from 14 to 23 in the next 10 hours, but then it took 14 hours to go from 23 to 24 and it has been at 24 for the last 22 hours. During this time, I have run "MailScanner --processing" a few times, and this always gives no output, so it seems there is some kind of residue accummulating in the processing database that is only counted in the Found count when a child starts. -- Mark Sapiro mark at msapiro net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From mark at msapiro.net Fri Apr 17 03:57:44 2009 From: mark at msapiro.net (Mark Sapiro) Date: Fri Apr 17 03:57:55 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: <20090415143749.GA496@msapiro> References: <49E597D5.3050300@ecs.soton.ac.uk> <20090415143749.GA496@msapiro> Message-ID: <20090417025744.GA3896@msapiro> On Wed, Apr 15, 2009 at 07:37:49AM -0700, Mark Sapiro wrote: > > Note that the "Found" count doesn't always increase between restarts, but > it never decreases. Also, "New Batch: Scanning X messages" in the log are > always followed by "Deleted X messages from processing-database" with the > same count and over any period, the "Deleted" counts add up to the same > total as the "Scanning" counts even where the "Found" count has increased. I've done some additional investigation. The log messages when a child starts are now up to "Found 26 mmessages in the processing-messages database" Here are the 26 database entries: 67650690405.93175|1|1239641743 92295690444.31465|1|1239641635 41537690424.26867|1|1239647420 02842690389.04452|1|1239648522 57067690409.E4302|1|1239648722 16020690433.44254|1|1239648562 17300690390.3E804|1|1239671344 39224690405.41276|1|1239671354 49358690409.95149|1|1239671419 99351690429.04632|1|1239678343 88257690407.10923|1|1239681381 39387690388.E1611|1|1239686821 41693690392.32976|1|1239705347 49903690394.76309|1|1239705280 77828690380.26107|1|1239721588 95835690388.E2978|1|1239721567 00524690436.5E971|1|1239729939 06766690387.55E20|1|1239744929 06950690412.30E45|1|1239744996 87926690445.21751|1|1239747646 35592690431.581E1|1|1239747533 00894690425.97190|1|1239747558 42214690429.67487|1|1239761289 23751690385.34301|1|1239812982 97480690403.80930|1|1239906903 34979690423.56858|1|1239906907 The timestamps appear a bit off from the timestamps in the maillog (perhaps they are "expiration times"), but I can correlate each entry to a message that was processed by Mailscanner. The situation that appears to cause a database entry to be "forgotten" is when Mailman sends a large number of messages. I have scan.messages rules to not scan locally originated mail. Mailman does it's VERP like processing so it sends a separate message to each recipient. There is one MailScanner child. Looking at the last two entries with time stamps of 1239906903 = Thu Apr 16 11:35:03 local time and 1239906907 = Thu Apr 16 11:35:07 local time, I see the following sets of maillog entries for those Postfix queue IDs (addresses sanitized). Apr 16 11:31:31 sbh16 postfix/smtpd[7846]: 97480690403: client=localhost.localdomain[127.0.0.1] Apr 16 11:31:31 sbh16 postfix/cleanup[8793]: 97480690403: hold: header Received: from sbh16.songbird.com (localhost.localdomain [127.0.0.1])??by sbh16.songbird.com (Postfix) with ESMTP id 97480690403??for ; Thu, 16 Apr 2009 11:31:31 -0700 (PDT) from localhost.localdomain[127.0.0.1]; from= to= proto=ESMTP helo= Apr 16 11:31:31 sbh16 postfix/cleanup[8793]: 97480690403: message-id=<8CB8CD89509361E-684-1921@WEBMAIL-MB13.sysops.aol.com> Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 97480690403.80930 to E531F6903BA and Apr 16 11:31:32 sbh16 postfix/smtpd[7846]: 34979690423: client=localhost.localdomain[127.0.0.1] Apr 16 11:31:32 sbh16 postfix/cleanup[8803]: 34979690423: hold: header Received: from sbh16.songbird.com (localhost.localdomain [127.0.0.1])??by sbh16.songbird.com (Postfix) with ESMTP id 34979690423??for ; Thu, 16 Apr 2009 11:31:32 -0700 (PDT) from localhost.localdomain[127.0.0.1]; from= to= proto=ESMTP helo= Apr 16 11:31:32 sbh16 postfix/cleanup[8803]: 34979690423: message-id=<8CB8CD89509361E-684-1921@WEBMAIL-MB13.sysops.aol.com> Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 34979690423.56858 to 1F3606903C6 The entire set of MailScanner messages in maillog starting with the start of the batch containing the first of the two messages and ending with the end of the batch containing the second of the two messages is Apr 16 11:31:36 sbh16 MailScanner[7964]: Virus and Content Scanning: Starting Apr 16 11:31:37 sbh16 MailScanner[7964]: Deleted 30 messages from processing-database Apr 16 11:31:37 sbh16 MailScanner[7964]: New Batch: Found 127 messages waiting Apr 16 11:31:37 sbh16 MailScanner[7964]: New Batch: Scanning 30 messages, 120892 bytes Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 336A36903ED.24583 to D3FD66903AC Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: F11D7690417.9E54F to 65D8D6903AE Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 450B56903F1.D70D6 to 0A0906903B2 Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 6C3AE690430.E51CA to 9642C6903B3 Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 48F2F6903F2.3661F to 763816903B7 Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: B42FD69040A.B5493 to B44DB6903B9 Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 97480690403.80930 to E531F6903BA Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 6666169042F.4E47D to 6D3B26903BB Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: A0781690434.072D5 to 6F9556903BF Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 9B54E690404.C24A1 to DC0DD6903C0 Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: C037F69043C.7D493 to DF5256903C1 Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 105AC6903E7.3368A to CFF456903C2 Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 6CCA96903FA.E31E6 to D42B56903C5 Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: C420769043D.67C45 to EE1286903C6 Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 7BF02690431.56984 to 913556903C7 Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 20FB66903EA.01436 to 3DAE76903C9 Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: CE501690411.94E55 to 443816903CB Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 934F7690402.52087 to 598256903CC Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: B0296690409.48B7D to E8B486903CD Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 0979369041A.F3A1A to B1BDA6903D0 Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: A37CF690406.A02ED to 437206903D1 Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: EB661690447.1DF7F to D1FA66903D2 Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: DCE6F690414.0BCEE to 143F96903D5 Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 877AD690400.9AAE0 to B490D6903D7 Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 588BB6903F6.254CC to 68A556903D9 Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 4726D690427.649C5 to CCEC16903DB Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 28CAA690420.AD4D2 to 339C36903DF Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 64E3C6903F8.658D6 to 407EF6903E1 Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 9FA4A690405.B9B10 to 902AF6903E5 Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: D2577690412.52519 to 4747F6903BC Apr 16 11:31:37 sbh16 MailScanner[7964]: Unscanned: Delivered 30 messages Apr 16 11:31:37 sbh16 MailScanner[7964]: Virus and Content Scanning: Starting Apr 16 11:31:38 sbh16 MailScanner[7964]: Deleted 30 messages from processing-database Apr 16 11:31:38 sbh16 MailScanner[7964]: New Batch: Found 97 messages waiting Apr 16 11:31:38 sbh16 MailScanner[7964]: New Batch: Scanning 30 messages, 121158 bytes Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: BC4D069043B.777A3 to 623046903AA Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 05810690419.33A51 to E218A6903AB Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: B47F8690439.464C1 to C41B46903AC Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 389EA690424.7DCF3 to 4A0556903AD Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 816C3690432.2BE4B to 83A936903B2 Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: ACA46690437.BD2A0 to EEBCC6903B3 Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 4EFFC690429.BD09A to AC4F26903B4 Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: B0971690438.876AB to B09C26903B7 Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: DFCA6690444.79EE7 to 6D3936903B8 Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 24B1469041F.A45EF to C3DD86903B9 Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 40A71690426.66783 to 2F7306903BA Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 52E1969042A.BD93F to 616366903BC Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: EF5F6690448.44D36 to 47D456903C2 Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: E39AD690445.8037C to 36FE26903C5 Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 9706C690433.A3336 to CDD416903C6 Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 30AB7690422.7F6E5 to 004716903C8 Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: CC24969043F.3433C to C6D216903C9 Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 3C9F8690425.4A529 to 591C26903CA Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: A854E690436.D6E4F to 280D56903CB Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 5E94569042D.39B6A to EEB5E6903CE Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: C826E69043E.3B1F7 to 3AECC6903D2 Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: F33BD690449.C869C to BD3F869038D Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 56D6869042B.0F0E1 to 2B4C06903D4 Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 6279669042E.63D5C to 871B36903D7 Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 1559D69041D.13C96 to 02CB06903D8 Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: D3F63690441.21521 to D2D026903D9 Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 2CCD7690421.699BE to 265C96903DA Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 4B044690428.9C9EF to 681466903DC Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: D7E39690442.94286 to 6F22C6903DD Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: A461E690435.80B0E to C1D686903DF Apr 16 11:31:38 sbh16 MailScanner[7964]: Unscanned: Delivered 30 messages Apr 16 11:31:38 sbh16 MailScanner[7964]: Virus and Content Scanning: Starting Apr 16 11:31:38 sbh16 MailScanner[7964]: Deleted 30 messages from processing-database Apr 16 11:31:39 sbh16 MailScanner[7964]: New Batch: Found 67 messages waiting Apr 16 11:31:39 sbh16 MailScanner[7964]: New Batch: Scanning 30 messages, 121168 bytes Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 0B0C769044C.14448 to 2CC006903AA Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 5AAB369042C.94441 to 8D48E6903AE Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 64BFE690461.4313B to B57F96903B0 Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: E7800690446.A0125 to 419646903B1 Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 25F47690453.7561B to 2BF606903B3 Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: E0DB169047F.7F471 to 702156903B4 Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 1E7A9690451.141ED to 664DC6903BA Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: BC1F3690476.8CE9A to 8850E6903BB Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 011A3690418.4F8F3 to E13106903BC Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 0D4E769041B.144E1 to D3F4F6903BD Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: B867569043A.D005A to 548CA6903BF Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: CC76869047A.B63D4 to 74D3C6903C0 Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 743B6690465.580B9 to EF2446903C1 Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 34979690423.56858 to 1F3606903C6 Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 1C40069041E.B9551 to 0E64A6903C7 Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: A46B6690471.0AA1E to F205F6903C8 Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: DBC6E690443.CC0B9 to DE1416903CA Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 440B569045B.0781A to 4A4616903CB Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: D05AF69047B.3A5A2 to 843436903CD Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 29C09690454.99468 to 326F16903CE Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 83DE0690469.ECFA9 to 11F866903D0 Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 9C42F69046F.B95A7 to 864ED6903D1 Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 4C16969045C.35DE5 to 556916903D2 Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 1AA3B690450.8FE7A to EE0636903D3 Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: AAB35690473.92692 to 833A46903D5 Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: EC922690482.B272D to B40A86903D7 Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: C8871690479.E5DEB to EC2CA6903DD Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: D01F9690440.914DD to 3CB086903D8 Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 114DE69041C.7109B to 397796903E1 Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 16DE969044F.1E99E to D16776903E2 Apr 16 11:31:39 sbh16 MailScanner[7964]: Unscanned: Delivered 30 messages Apr 16 11:31:39 sbh16 MailScanner[7964]: Virus and Content Scanning: Starting Apr 16 11:31:39 sbh16 MailScanner[7964]: Deleted 30 messages from processing-database You will see that each batch starts with "New Batch: Scanning 30 messages", Requeues 30 messages and ends with "Unscanned: Delivered 30 messages" and "Deleted 30 messages from processing-database" yet in the first and third batches, one of the messages wasn't deleted from the database. -- Mark Sapiro mark at msapiro net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From JBracey at csuchico.edu Fri Apr 17 04:41:52 2009 From: JBracey at csuchico.edu (Bracey, John) Date: Fri Apr 17 04:42:22 2009 Subject: trouble installing mailscanner on freeBSD 6.2 server In-Reply-To: References: <9ADE954C5044754C8E0BF406B5A217552DD2AD6E@ESCHE.csuchico.edu> Message-ID: <9ADE954C5044754C8E0BF406B5A217552DD97D32@ESCHE.csuchico.edu> Hello, it's me again. I've run into another issue that I hope someone might be able to give me a clue on. After repeated deinstalls and reinstalls where everything installs as it should, MailScanner will start and immediately die. When I run a debug I get this: [root@scooby /usr/local/etc/rc.d]# mailscanner -debug -debug-sa /MailScanner.conf In Debugging mode, not forking... Trying to setlogsock(unix) ***** If 'awk' (with support for the function strftime) was available on your $PATH then all the SpamAssassin debug output would have the current time added to the start of every line, making debugging far easier. ***** SpamAssassin temp dir = /var/spool/MailScanner/incoming/SpamAssassin-Temp Fatal error 'Recurse on a private mutex.' at line 986 in file /usr/src/lib/libpthread/thread/thr_mutex.c (errno = 0) Abort trap: 6 That SpamAssassin directory does exist: d-wxrwxrwx 2 root wheel 1024 Apr 16 17:07 SpamAssassin-Temp here's what is recorded in /var/log/messages when the process dies: Apr 16 20:40:38 scooby kernel: pid 10382 (perl5.8.9), uid 0: exited on signal 6 Any ideas welcome. Thanks in advance. -John Bracey -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Kevin Kobb Sent: Wednesday, April 15, 2009 1:11 PM To: mailscanner@lists.mailscanner.info Subject: Re: trouble installing mailscanner on freeBSD 6.2 server Bracey, John wrote: > Hello All: > > > > I hope this isn't a noob question, my apologies in advance if it is. > > > > When I try to install MailScanner I'm getting the following: > > > > [root@scooby /usr/ports/mail/mailscanner]# make install clean > > ===> Installing for MailScanner-4.67.6_4 > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/IO/Stringy.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/File/Spec.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/Bundle/DBI.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/File/Temp.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/MIME/Base64.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Mail/Header.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/HTML/Tagset.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/HTML/HeadParser.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/MIME/Parser.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Convert/TNEF.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Convert/BinHex.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Net/CIDR.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Net/Ident.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Archive/Zip.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Compress/Zlib.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/DBD/SQLite.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/DBI.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Getopt/Long.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/Storable.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/Time/HiRes.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Time/Zone.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/Filesys/Df.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/Sys/Hostname/Long.pm - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/IO/Handle.pm - found > > ===> MailScanner-4.67.6_4 depends on file: /usr/local/bin/perl5.8.9 - > found > > ===> MailScanner-4.67.6_4 depends on executable: bash - found > > ===> MailScanner-4.67.6_4 depends on executable: tnef - found > > ===> MailScanner-4.67.6_4 depends on executable: wget - found > > ===> MailScanner-4.67.6_4 depends on file: > /usr/local/lib/perl5/site_perl/5.8.9/mach/Mail/ClamAV.pm - not found > > ===> Verifying install for > /usr/local/lib/perl5/site_perl/5.8.9/mach/Mail/ClamAV.pm in > /usr/ports/mail/p5-Mail-ClamAV > > ===> p5-Mail-ClamAV-0.20_5 is marked as broken: Doesn't build with > clamav 0.95 or later. > > *** Error code 1 > > > > Stop in /usr/ports/mail/p5-Mail-ClamAV. > > *** Error code 1 > > > > Stop in /usr/ports/mail/mailscanner. > > *** Error code 1 > > > > Stop in /usr/ports/mail/mailscanner. > > > > > > Is there any way around this error? I've not been able to find any info > googling this so far. > > > > Just for back round, this is a reinstall after a Perl upgrade that > didn't go well (5.8.8 >> 5.8.9). I think I have that part straight now, > but can't get this last app going again. > > > > Thanks in advance. > > -John > You could install the port without selecting the clamavmodule. Change to the port directory and do: make rmconfig make config make install Should build OK. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From drew.marshall at trunknetworks.com Fri Apr 17 06:33:40 2009 From: drew.marshall at trunknetworks.com (Drew Marshall) Date: Fri Apr 17 06:33:55 2009 Subject: trouble installing mailscanner on freeBSD 6.2 server In-Reply-To: <20090417034520.D17261701A@out-b.mx.mail-launder.com> References: <9ADE954C5044754C8E0BF406B5A217552DD2AD6E@ESCHE.csuchico.edu> <20090417034520.D17261701A@out-b.mx.mail-launder.com> Message-ID: <200904170533.n3H5XkxQ001132@safir.blacknight.ie> *This message was transferred with a trial version of CommuniGate(r) Pro* On 17 Apr 2009, at 04:41, Bracey, John wrote: > here's what is recorded in /var/log/messages when the process dies: > > Apr 16 20:40:38 scooby kernel: pid 10382 (perl5.8.9), uid 0: exited on > signal 6 > > Any ideas welcome. Looks like with your to'ings and fro'ings with perl you have your modules in a right mess. If you don't mind being a little more cutting edge, I would pkg_delete perl-5.8 and/or 5.9, then cd /usr/ports/lang/ perl5.10 and install that (It's the future ;-) ). Then (Because I have never been that successful with the perl module move/ upgrade script) cd /var/db/pkg and (Assuming you have portupgrade or similar installed) portupgrade -f p5* pecl* and let it do it's thing for a while. Once that's finished, you should have perl with it's modules all in the same place. Once that's done, install the latest MS beta which works properly with perl 5.10 (I posted my own MS port file a week or so ago that will do it). Drew From Johan at double-l.nl Fri Apr 17 08:09:43 2009 From: Johan at double-l.nl (Johan Hendriks) Date: Fri Apr 17 08:09:53 2009 Subject: Problem with MailScanner on FreeBSD 7.2 w/sendmail References: <20090416161807.GG99178@rancor.immure.com> Message-ID: <57200BF94E69E54880C9BB1AF714BBCB5DE729@w2003s01.double-l.local> Onderwerp: Problem with MailScanner on FreeBSD 7.2 w/sendmail >Hi, >I have a 7.2-prelease system that I am trying to get sendmail and >MailScanner running on and for some reason sendmail isn't listening on >*.smtp, though it is listening on localhost.smtp. >If I remove MailScanner from the mix and run sendmail in the >conventional way (with sendmail_enable="YES" specified in /etc/rc.conf) >then things work as expected (except no MailScanner, of course). > >I currently have a running 6.4-stable system, that this new 7.2 system >is scheduled to replace, that is using the same MailScanner and sendmail >configuration files and it is working ok (and has been for a long time). >I suspect that I'm simply missing some configuration option here that >I've overlooked or that may have changed between 6.4 and 7.2, but don't >really know where to look. >My FreeBSD version is: >FreeBSD boss-nass 7.2-PRERELEASE FreeBSD 7.2-PRERELEASE #0: Wed Apr 15 10:46:32 CDT 2009 amd64 >sendmail: >Version 8.14.3 > Compiled with: DNSMAP LOG MAP_REGEX MATCHGECOS MILTER MIME7TO8 MIME8TO7 NAMED_BIND NETINET NETINET6 NETUNIX NEWDB NIS PIPELINING SASLv2 SCANF STARTTLS TCPWRAPPERS USERDB XDEBUG >MailScanner: >MailScanner-4.67.6_4 >Any help or tips on things to do/check would be greatly appreciated. >Thanks, >Bob Which perl version are you running? I had problems with perl-5.8.9 on several (all is about 10) boxes, reverting back to perl-5.8.8 solved my case. On some boxes i installed perl-5.10.0 and these boxes work ok with the new perl these ar i386 and amd64 machines. These machines are a mix of FreeBSD 7.1, 7.2-Pre and 8.0 See /usr/portsUPDATING how to update your perl-5.8.9 to perl-5.10.0 Regards, Johan Hendriks Double L Automatisering No virus found in this outgoing message. Checked by AVG - www.avg.com Version: 8.5.287 / Virus Database: 270.11.58/2061 - Release Date: 04/15/09 19:52:00 From MailScanner at ecs.soton.ac.uk Fri Apr 17 09:36:28 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Fri Apr 17 09:36:47 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: <20090416190828.GA2012@msapiro> References: <49E597D5.3050300@ecs.soton.ac.uk> <20090415143749.GA496@msapiro> <20090416190828.GA2012@msapiro> <49E83F8C.4060307@ecs.soton.ac.uk> Message-ID: On 16/4/09 20:08, Mark Sapiro wrote: > On Wed, Apr 15, 2009 at 07:37:49AM -0700, Mark Sapiro wrote: > >> Note that the "Found" count doesn't always increase between restarts, but >> it never decreases. Also, "New Batch: Scanning X messages" in the log are >> always followed by "Deleted X messages from processing-database" with the >> same count and over any period, the "Deleted" counts add up to the same >> total as the "Scanning" counts even where the "Found" count has increased. >> > > One more piece of information. As I said, I first saw these increasing > counts after upgrading 4.76.7 to 4.76.10 three days ago and continuing > after upgrading to 4.76.12 two days ago, but I observe the rate at which > the count increases is decreasing. It went from 0 to 16 in the first 24 > hours and from 14 to 23 in the next 10 hours, but then it took 14 hours > to go from 23 to 24 and it has been at 24 for the last 22 hours. > > During this time, I have run "MailScanner --processing" a few times, and > this always gives no output, so it seems there is some kind of residue > accummulating in the processing database that is only counted in the > Found count when a child starts. > "MailScanner --processing" is the same as "MailScanner --processing 1". If you do "MailScanner --processing 0" you should get some output. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Fri Apr 17 10:02:47 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Fri Apr 17 10:03:20 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: <20090417025744.GA3896@msapiro> References: <49E597D5.3050300@ecs.soton.ac.uk> <20090415143749.GA496@msapiro> <20090417025744.GA3896@msapiro> <49E845B7.3010704@ecs.soton.ac.uk> Message-ID: If "MailScanner --processing=1" produces no output, then the records in the database cannot have a count of 1 (the 2nd number in each column in your table of 26 database entries below). So when you do that, the only records in there must have a value of 0, which means they should have been removed. However, when a child starts up, there will be all the messages in the "processing" database table that are currently being processed by other MailScanner children. Are you sure there are no other children running when that child starts? Also, please look at the output of "MailScanner --processing=0" as this will show you all the records in there, which the timestamps converted into something readable, rather than the raw time_t values you have included. That will let us see if they are in the future or way in the past. I cannot find any situation where the records would fail to be deleted, if it says it has deleted them. The only way that can happen is if the message id was blank, and all the records in your "processing" database table you included below all have non-blank message ids, so it isn't that. The code for clearing out the database table is pretty straightforward, please take a look at it yourself and see if you agree with me. It starts at "sub ClearOutProcessedDatabase {" in /usr/lib/MailScanner/MailScanner/MessageBatch.pm. If you can see any bugs or holes in there, please do tell me! Thanks, Jules. On 17/4/09 03:57, Mark Sapiro wrote: > On Wed, Apr 15, 2009 at 07:37:49AM -0700, Mark Sapiro wrote: > >> Note that the "Found" count doesn't always increase between restarts, but >> it never decreases. Also, "New Batch: Scanning X messages" in the log are >> always followed by "Deleted X messages from processing-database" with the >> same count and over any period, the "Deleted" counts add up to the same >> total as the "Scanning" counts even where the "Found" count has increased. >> > > I've done some additional investigation. > > The log messages when a child starts are now up to "Found 26 mmessages > in the processing-messages database" > > Here are the 26 database entries: > > 67650690405.93175|1|1239641743 > 92295690444.31465|1|1239641635 > 41537690424.26867|1|1239647420 > 02842690389.04452|1|1239648522 > 57067690409.E4302|1|1239648722 > 16020690433.44254|1|1239648562 > 17300690390.3E804|1|1239671344 > 39224690405.41276|1|1239671354 > 49358690409.95149|1|1239671419 > 99351690429.04632|1|1239678343 > 88257690407.10923|1|1239681381 > 39387690388.E1611|1|1239686821 > 41693690392.32976|1|1239705347 > 49903690394.76309|1|1239705280 > 77828690380.26107|1|1239721588 > 95835690388.E2978|1|1239721567 > 00524690436.5E971|1|1239729939 > 06766690387.55E20|1|1239744929 > 06950690412.30E45|1|1239744996 > 87926690445.21751|1|1239747646 > 35592690431.581E1|1|1239747533 > 00894690425.97190|1|1239747558 > 42214690429.67487|1|1239761289 > 23751690385.34301|1|1239812982 > 97480690403.80930|1|1239906903 > 34979690423.56858|1|1239906907 > > The timestamps appear a bit off from the timestamps in the maillog > (perhaps they are "expiration times"), but I can correlate each entry > to a message that was processed by Mailscanner. > > The situation that appears to cause a database entry to be "forgotten" > is when Mailman sends a large number of messages. > > I have scan.messages rules to not scan locally originated mail. > Mailman does it's VERP like processing so it sends a separate message > to each recipient. There is one MailScanner child. > > Looking at the last two entries with time stamps of 1239906903 = > Thu Apr 16 11:35:03 local time and 1239906907 = Thu Apr 16 11:35:07 > local time, I see the following sets of maillog entries for those > Postfix queue IDs (addresses sanitized). > > Apr 16 11:31:31 sbh16 postfix/smtpd[7846]: 97480690403: client=localhost.localdomain[127.0.0.1] > Apr 16 11:31:31 sbh16 postfix/cleanup[8793]: 97480690403: hold: header Received: from sbh16.songbird.com (localhost.localdomain [127.0.0.1])??by sbh16.songbird.com (Postfix) with ESMTP id 97480690403??for; Thu, 16 Apr 2009 11:31:31 -0700 (PDT) from localhost.localdomain[127.0.0.1]; from= to= proto=ESMTP helo= > Apr 16 11:31:31 sbh16 postfix/cleanup[8793]: 97480690403: message-id=<8CB8CD89509361E-684-1921@WEBMAIL-MB13.sysops.aol.com> > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 97480690403.80930 to E531F6903BA > > and > > Apr 16 11:31:32 sbh16 postfix/smtpd[7846]: 34979690423: client=localhost.localdomain[127.0.0.1] > Apr 16 11:31:32 sbh16 postfix/cleanup[8803]: 34979690423: hold: header Received: from sbh16.songbird.com (localhost.localdomain [127.0.0.1])??by sbh16.songbird.com (Postfix) with ESMTP id 34979690423??for; Thu, 16 Apr 2009 11:31:32 -0700 (PDT) from localhost.localdomain[127.0.0.1]; from= to= proto=ESMTP helo= > Apr 16 11:31:32 sbh16 postfix/cleanup[8803]: 34979690423: message-id=<8CB8CD89509361E-684-1921@WEBMAIL-MB13.sysops.aol.com> > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 34979690423.56858 to 1F3606903C6 > > The entire set of MailScanner messages in maillog starting with the > start of the batch containing the first of the two messages and ending > with the end of the batch containing the second of the two messages is > > Apr 16 11:31:36 sbh16 MailScanner[7964]: Virus and Content Scanning: Starting > Apr 16 11:31:37 sbh16 MailScanner[7964]: Deleted 30 messages from processing-database > Apr 16 11:31:37 sbh16 MailScanner[7964]: New Batch: Found 127 messages waiting > Apr 16 11:31:37 sbh16 MailScanner[7964]: New Batch: Scanning 30 messages, 120892 bytes > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 336A36903ED.24583 to D3FD66903AC > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: F11D7690417.9E54F to 65D8D6903AE > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 450B56903F1.D70D6 to 0A0906903B2 > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 6C3AE690430.E51CA to 9642C6903B3 > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 48F2F6903F2.3661F to 763816903B7 > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: B42FD69040A.B5493 to B44DB6903B9 > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 97480690403.80930 to E531F6903BA > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 6666169042F.4E47D to 6D3B26903BB > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: A0781690434.072D5 to 6F9556903BF > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 9B54E690404.C24A1 to DC0DD6903C0 > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: C037F69043C.7D493 to DF5256903C1 > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 105AC6903E7.3368A to CFF456903C2 > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 6CCA96903FA.E31E6 to D42B56903C5 > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: C420769043D.67C45 to EE1286903C6 > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 7BF02690431.56984 to 913556903C7 > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 20FB66903EA.01436 to 3DAE76903C9 > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: CE501690411.94E55 to 443816903CB > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 934F7690402.52087 to 598256903CC > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: B0296690409.48B7D to E8B486903CD > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 0979369041A.F3A1A to B1BDA6903D0 > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: A37CF690406.A02ED to 437206903D1 > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: EB661690447.1DF7F to D1FA66903D2 > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: DCE6F690414.0BCEE to 143F96903D5 > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 877AD690400.9AAE0 to B490D6903D7 > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 588BB6903F6.254CC to 68A556903D9 > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 4726D690427.649C5 to CCEC16903DB > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 28CAA690420.AD4D2 to 339C36903DF > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 64E3C6903F8.658D6 to 407EF6903E1 > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: 9FA4A690405.B9B10 to 902AF6903E5 > Apr 16 11:31:37 sbh16 MailScanner[7964]: Requeue: D2577690412.52519 to 4747F6903BC > Apr 16 11:31:37 sbh16 MailScanner[7964]: Unscanned: Delivered 30 messages > Apr 16 11:31:37 sbh16 MailScanner[7964]: Virus and Content Scanning: Starting > Apr 16 11:31:38 sbh16 MailScanner[7964]: Deleted 30 messages from processing-database > Apr 16 11:31:38 sbh16 MailScanner[7964]: New Batch: Found 97 messages waiting > Apr 16 11:31:38 sbh16 MailScanner[7964]: New Batch: Scanning 30 messages, 121158 bytes > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: BC4D069043B.777A3 to 623046903AA > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 05810690419.33A51 to E218A6903AB > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: B47F8690439.464C1 to C41B46903AC > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 389EA690424.7DCF3 to 4A0556903AD > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 816C3690432.2BE4B to 83A936903B2 > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: ACA46690437.BD2A0 to EEBCC6903B3 > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 4EFFC690429.BD09A to AC4F26903B4 > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: B0971690438.876AB to B09C26903B7 > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: DFCA6690444.79EE7 to 6D3936903B8 > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 24B1469041F.A45EF to C3DD86903B9 > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 40A71690426.66783 to 2F7306903BA > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 52E1969042A.BD93F to 616366903BC > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: EF5F6690448.44D36 to 47D456903C2 > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: E39AD690445.8037C to 36FE26903C5 > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 9706C690433.A3336 to CDD416903C6 > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 30AB7690422.7F6E5 to 004716903C8 > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: CC24969043F.3433C to C6D216903C9 > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 3C9F8690425.4A529 to 591C26903CA > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: A854E690436.D6E4F to 280D56903CB > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 5E94569042D.39B6A to EEB5E6903CE > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: C826E69043E.3B1F7 to 3AECC6903D2 > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: F33BD690449.C869C to BD3F869038D > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 56D6869042B.0F0E1 to 2B4C06903D4 > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 6279669042E.63D5C to 871B36903D7 > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 1559D69041D.13C96 to 02CB06903D8 > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: D3F63690441.21521 to D2D026903D9 > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 2CCD7690421.699BE to 265C96903DA > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: 4B044690428.9C9EF to 681466903DC > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: D7E39690442.94286 to 6F22C6903DD > Apr 16 11:31:38 sbh16 MailScanner[7964]: Requeue: A461E690435.80B0E to C1D686903DF > Apr 16 11:31:38 sbh16 MailScanner[7964]: Unscanned: Delivered 30 messages > Apr 16 11:31:38 sbh16 MailScanner[7964]: Virus and Content Scanning: Starting > Apr 16 11:31:38 sbh16 MailScanner[7964]: Deleted 30 messages from processing-database > Apr 16 11:31:39 sbh16 MailScanner[7964]: New Batch: Found 67 messages waiting > Apr 16 11:31:39 sbh16 MailScanner[7964]: New Batch: Scanning 30 messages, 121168 bytes > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 0B0C769044C.14448 to 2CC006903AA > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 5AAB369042C.94441 to 8D48E6903AE > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 64BFE690461.4313B to B57F96903B0 > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: E7800690446.A0125 to 419646903B1 > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 25F47690453.7561B to 2BF606903B3 > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: E0DB169047F.7F471 to 702156903B4 > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 1E7A9690451.141ED to 664DC6903BA > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: BC1F3690476.8CE9A to 8850E6903BB > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 011A3690418.4F8F3 to E13106903BC > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 0D4E769041B.144E1 to D3F4F6903BD > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: B867569043A.D005A to 548CA6903BF > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: CC76869047A.B63D4 to 74D3C6903C0 > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 743B6690465.580B9 to EF2446903C1 > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 34979690423.56858 to 1F3606903C6 > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 1C40069041E.B9551 to 0E64A6903C7 > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: A46B6690471.0AA1E to F205F6903C8 > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: DBC6E690443.CC0B9 to DE1416903CA > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 440B569045B.0781A to 4A4616903CB > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: D05AF69047B.3A5A2 to 843436903CD > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 29C09690454.99468 to 326F16903CE > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 83DE0690469.ECFA9 to 11F866903D0 > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 9C42F69046F.B95A7 to 864ED6903D1 > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 4C16969045C.35DE5 to 556916903D2 > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 1AA3B690450.8FE7A to EE0636903D3 > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: AAB35690473.92692 to 833A46903D5 > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: EC922690482.B272D to B40A86903D7 > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: C8871690479.E5DEB to EC2CA6903DD > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: D01F9690440.914DD to 3CB086903D8 > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 114DE69041C.7109B to 397796903E1 > Apr 16 11:31:39 sbh16 MailScanner[7964]: Requeue: 16DE969044F.1E99E to D16776903E2 > Apr 16 11:31:39 sbh16 MailScanner[7964]: Unscanned: Delivered 30 messages > Apr 16 11:31:39 sbh16 MailScanner[7964]: Virus and Content Scanning: Starting > Apr 16 11:31:39 sbh16 MailScanner[7964]: Deleted 30 messages from processing-database > > You will see that each batch starts with "New Batch: Scanning 30 > messages", Requeues 30 messages and ends with "Unscanned: Delivered 30 > messages" and "Deleted 30 messages from processing-database" yet in the > first and third batches, one of the messages wasn't deleted from the > database. > > > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From maillists at conactive.com Fri Apr 17 13:38:50 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Fri Apr 17 13:39:04 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49E597D5.3050300@ecs.soton.ac.uk> <20090415143749.GA496@msapiro> <20090416190828.GA2012@msapiro> <49E83F8C.4060307@ecs.soton.ac.uk> Message-ID: Julian Field wrote on Fri, 17 Apr 2009 09:36:28 +0100: > If you do "MailScanner --processing 0" you should get some output. Indeed. Currently being processed: Number of messages: 1 Tries Message Next Try At ===== ======= =========== 1 B48BFF9477.51697 Mon Mar 30 04:17:14 2009 Mar 30 04:11:53 d01 MailScanner[879]: Saved archive copies of B48BFF9477.51697 Mar 30 04:12:01 d01 MailScanner[9923]: Saved archive copies of B48BFF9477.D962D 4D299F9478.973F1 Mar 30 04:12:02 d01 MailScanner[9923]: Logging message B48BFF9477.D962D to SQL Mar 30 04:12:02 d01 MailScanner[9925]: B48BFF9477.D962D: Logged to MailWatch SQL The message was spam to one of my spam traps, was processed normally, entered in the mailwatch database and flagged as spam. No high load at that time. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From MailScanner at ecs.soton.ac.uk Fri Apr 17 14:00:16 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Fri Apr 17 14:00:38 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49E597D5.3050300@ecs.soton.ac.uk> <20090415143749.GA496@msapiro> <20090416190828.GA2012@msapiro> <49E83F8C.4060307@ecs.soton.ac.uk> <49E87D60.2040707@ecs.soton.ac.uk> Message-ID: On 17/04/2009 13:38, Kai Schaetzl wrote: > Julian Field wrote on Fri, 17 Apr 2009 09:36:28 +0100: > > >> If you do "MailScanner --processing 0" you should get some output. >> > Indeed. > > Currently being processed: > > Number of messages: 1 > Tries Message Next Try At > ===== ======= =========== > 1 B48BFF9477.51697 Mon Mar 30 04:17:14 2009 > > > Mar 30 04:11:53 d01 MailScanner[879]: Saved archive copies of > B48BFF9477.51697 > Mar 30 04:12:01 d01 MailScanner[9923]: Saved archive copies of > B48BFF9477.D962D 4D299F9478.973F1 > Are there any other mentions of the first one of these? The second one is a different message (note the different random tag number on the end). > Mar 30 04:12:02 d01 MailScanner[9923]: Logging message B48BFF9477.D962D to > SQL > Mar 30 04:12:02 d01 MailScanner[9925]: B48BFF9477.D962D: Logged to > MailWatch SQL > > > The message was spam to one of my spam traps, was processed normally, > entered in the mailwatch database and flagged as spam. No high load at > that time. > The first message or the second one? It does seem slightly odd that the same inode number turned up twice in such quick succession. Are you sure these two messages are actually different messages, or are they the same one, and the first processing of it was abandoned for some reason? It just occurred to me that the processing database won't work well with Postfix at all. Postfix re-uses the message id numbers too fast for them to be considered good ids, which is why I have to add a random number to the end. But I add a new random number to the end every time I pick up the message, so every time it sees the same message it will create different message ids for it. So the processing database idea breaks down :-( Poo :-( Any thoughts? > Kai > > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From maillists at conactive.com Fri Apr 17 15:29:36 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Fri Apr 17 15:29:50 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49E597D5.3050300@ecs.soton.ac.uk> <20090415143749.GA496@msapiro> <20090416190828.GA2012@msapiro> <49E83F8C.4060307@ecs.soton.ac.uk> <49E87D60.2040707@ecs.soton.ac.uk> ailScanner|ecs.soton.ac.uk|040707@ecs.soton.ac.uk> Reply-To: mailscanner@lists.mailscanner.info Julian Field wrote on Fri, 17 Apr 2009 14:00:16 +0100: > Are there any other mentions of the first one of these? The second one > is a different message (note the different random tag number on the end). I think it is the same, that's why I quoted both here. This is from the postfix log: Mar 30 04:11:50 d01 postfix/smtpd[9789]: connect from udp287212uds.hawaiiantel.net[72.253.249.143] Mar 30 04:11:51 d01 postfix/smtpd[9789]: B48BFF9477: client=udp287212uds.hawaiiantel.net[72.253.249.143] Mar 30 04:11:52 d01 postfix/cleanup[9845]: B48BFF9477: hold: header Received: from udp287212uds.hawaiiantel.net (udp287212uds.hawaiiantel.net [72.253.249.143])??by mailer.example.com (Postfix) with ESMTP id B48BFF9477?? for ; Mon, 30 Mar 2009 04: from udp287212uds.hawaiiantel.net[72.253.249.143]; from= to= proto=ESMTP helo= Mar 30 04:11:52 d01 postfix/cleanup[9845]: B48BFF9477: message- id=<000d01c9b0dc$cf4e03e0$6400a8c0@umw> Mar 30 04:11:54 d01 postfix/smtpd[9789]: disconnect from udp287212uds.hawaiiantel.net[72.253.249.143] Mar 30 04:11:54 d01 postfix/postfix-script: refreshing the Postfix mail system Notice the last line. Any chance this triggered it? This is a reload of the configuration and some statistical output. Maybe it also kills childs and loads new ones, don't know. A locking problem, so that MS couldn't process it the first time? > > Mar 30 04:12:02 d01 MailScanner[9923]: Logging message B48BFF9477.D962D to > > SQL > > Mar 30 04:12:02 d01 MailScanner[9925]: B48BFF9477.D962D: Logged to > > MailWatch SQL > The first message or the second one? It does seem slightly odd that the > same inode number turned up twice in such quick succession. Are you sure > these two messages are actually different messages, or are they the same > one, and the first processing of it was abandoned for some reason? I thought it was clear that I think/know it is one message, sorry, if that wasn't clear. Here's the complete sequence from the mailscanner.log. It didn't appear to me that just grepping for the id wouldn't reveal everything ;-) Yes, it seems, the processing got abandoned. But shouldn't it then get removed? Mar 30 04:11:53 d01 MailScanner[879]: New Batch: Scanning 1 messages, 21465 bytes Mar 30 04:11:53 d01 MailScanner[879]: Saved archive copies of B48BFF9477.51697 Mar 30 04:11:53 d01 MailScanner[879]: MailScanner child caught a SIGHUP Mar 30 04:11:53 d01 MailScanner[879]: Config: calling custom end function MailWatchLogging Mar 30 04:11:54 d01 MailScanner[9901]: MailScanner child caught a SIGHUP Mar 30 04:11:54 d01 MailScanner[9901]: Config: calling custom end function MailWatchLogging Mar 30 04:11:56 d01 MailScanner[9923]: MailScanner E-Mail Virus Scanner version 4.75.9 starting... Mar 30 04:12:01 d01 MailScanner[9923]: Connected to processing-messages database Mar 30 04:12:01 d01 MailScanner[9923]: Found 1 messages in the processing- messages database Mar 30 04:12:01 d01 MailScanner[9923]: Using locktype = flock Mar 30 04:12:01 d01 MailScanner[9923]: New Batch: Scanning 2 messages, 51210 bytes Mar 30 04:12:01 d01 MailScanner[9923]: Saved archive copies of B48BFF9477.D962D 4D299F9478.973F1 Mar 30 04:12:02 d01 MailScanner[9923]: Spam Checks: Found 1 spam messages Mar 30 04:12:02 d01 MailScanner[9923]: Requeue: 4D299F9478.973F1 to 141B3F9307 Mar 30 04:12:02 d01 MailScanner[9923]: Unscanned: Delivered 1 messages That second message was cron generated and not scanned as local. Mar 30 04:12:02 d01 MailScanner[9923]: Virus and Content Scanning: Starting Mar 30 04:12:02 d01 MailScanner[9923]: Deleted 2 messages from processing- database Mar 30 04:12:02 d01 MailScanner[9923]: Logging message B48BFF9477.D962D to SQL Mar 30 04:12:02 d01 MailScanner[9923]: Logging message 4D299F9478.973F1 to SQL Mar 30 04:12:02 d01 MailScanner[9925]: B48BFF9477.D962D: Logged to MailWatch SQL Mar 30 04:12:02 d01 MailScanner[9925]: 4D299F9478.973F1: Logged to MailWatch SQL Maybe it grabbed B48BFF9477.51697 from the database and then tried to remove B48BFF9477.D962D ? > > It just occurred to me that the processing database won't work well with > Postfix at all. > Postfix re-uses the message id numbers too fast for them to be > considered good ids, which is why I have to add a random number to the end. > But I add a new random number to the end every time I pick up the > message, so every time it sees the same message it will create different > message ids for it. > So the processing database idea breaks down :-( > Poo :-( But this shouldn't be the case here, right? And I don't see evidence that it reuses these ids "too fast". I can't see a reuse for these ids for the whole month. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From JBracey at csuchico.edu Fri Apr 17 15:38:52 2009 From: JBracey at csuchico.edu (Bracey, John) Date: Fri Apr 17 15:42:05 2009 Subject: trouble installing mailscanner on freeBSD 6.2 server In-Reply-To: <200904170533.n3H5XkxQ001132@safir.blacknight.ie> References: <9ADE954C5044754C8E0BF406B5A217552DD2AD6E@ESCHE.csuchico.edu><20090417034520.D17261701A@out-b.mx.mail-launder.com> <200904170533.n3H5XkxQ001132@safir.blacknight.ie> Message-ID: <9ADE954C5044754C8E0BF406B5A217552DDE75E1@ESCHE.csuchico.edu> Thanks for your reply Drew. I suspect you are correct regarding my Perl mess. I'll give your suggestions a try and let you know how it goes. Thanks again. -John Bracey -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Drew Marshall Sent: Thursday, April 16, 2009 10:34 PM To: MailScanner discussion Subject: Re: trouble installing mailscanner on freeBSD 6.2 server *This message was transferred with a trial version of CommuniGate(r) Pro* On 17 Apr 2009, at 04:41, Bracey, John wrote: > here's what is recorded in /var/log/messages when the process dies: > > Apr 16 20:40:38 scooby kernel: pid 10382 (perl5.8.9), uid 0: exited on > signal 6 > > Any ideas welcome. Looks like with your to'ings and fro'ings with perl you have your modules in a right mess. If you don't mind being a little more cutting edge, I would pkg_delete perl-5.8 and/or 5.9, then cd /usr/ports/lang/ perl5.10 and install that (It's the future ;-) ). Then (Because I have never been that successful with the perl module move/ upgrade script) cd /var/db/pkg and (Assuming you have portupgrade or similar installed) portupgrade -f p5* pecl* and let it do it's thing for a while. Once that's finished, you should have perl with it's modules all in the same place. Once that's done, install the latest MS beta which works properly with perl 5.10 (I posted my own MS port file a week or so ago that will do it). Drew -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Apr 17 15:49:25 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Fri Apr 17 15:49:47 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49E597D5.3050300@ecs.soton.ac.uk> <20090415143749.GA496@msapiro> <20090416190828.GA2012@msapiro> <49E83F8C.4060307@ecs.soton.ac.uk> <49E87D60.2040707@ecs.soton.ac.uk> <49E896F5.9030302@ecs.soton.ac.uk> Message-ID: On 17/04/2009 15:29, Kai Schaetzl wrote: > ailScanner|ecs.soton.ac.uk|040707@ecs.soton.ac.uk> > Reply-To: mailscanner@lists.mailscanner.info > > Julian Field wrote on Fri, 17 Apr 2009 14:00:16 +0100: > > >> Are there any other mentions of the first one of these? The second one >> is a different message (note the different random tag number on the end). >> > I think it is the same, that's why I quoted both here. > > This is from the postfix log: > > Mar 30 04:11:50 d01 postfix/smtpd[9789]: connect from > udp287212uds.hawaiiantel.net[72.253.249.143] > Mar 30 04:11:51 d01 postfix/smtpd[9789]: B48BFF9477: > client=udp287212uds.hawaiiantel.net[72.253.249.143] > Mar 30 04:11:52 d01 postfix/cleanup[9845]: B48BFF9477: hold: header Received: > from udp287212uds.hawaiiantel.net (udp287212uds.hawaiiantel.net > [72.253.249.143])??by mailer.example.com (Postfix) with ESMTP id B48BFF9477?? > for; Mon, 30 Mar 2009 04: from > udp287212uds.hawaiiantel.net[72.253.249.143]; from= > to= proto=ESMTP helo= > Mar 30 04:11:52 d01 postfix/cleanup[9845]: B48BFF9477: message- > id=<000d01c9b0dc$cf4e03e0$6400a8c0@umw> > Mar 30 04:11:54 d01 postfix/smtpd[9789]: disconnect from > udp287212uds.hawaiiantel.net[72.253.249.143] > Mar 30 04:11:54 d01 postfix/postfix-script: refreshing the Postfix mail system > > Notice the last line. Any chance this triggered it? Very likely. I don't know what that line means, but it doesn't sound good does it? > This is a reload of the > configuration and some statistical output. Maybe it also kills childs and > loads new ones, don't know. A locking problem, so that MS couldn't process it > the first time? > Possibly... > >>> Mar 30 04:12:02 d01 MailScanner[9923]: Logging message B48BFF9477.D962D to >>> SQL >>> Mar 30 04:12:02 d01 MailScanner[9925]: B48BFF9477.D962D: Logged to >>> MailWatch SQL >>> > > >> The first message or the second one? It does seem slightly odd that the >> same inode number turned up twice in such quick succession. Are you sure >> these two messages are actually different messages, or are they the same >> one, and the first processing of it was abandoned for some reason? >> > I thought it was clear that I think/know it is one message, sorry, if that > wasn't clear. Here's the complete sequence from the mailscanner.log. It didn't > appear to me that just grepping for the id wouldn't reveal everything ;-) > Yes, it seems, the processing got abandoned. But shouldn't it then get > removed? > Yes, it should. There's an exit condition I have missed somewhere. I will try to find time this weekend to see if I can find it, it is going to be pretty well-buried though as I covered the code fairly hard the first time. (Having said that of course, I'll find it staring me in the face :-) > Mar 30 04:11:53 d01 MailScanner[879]: New Batch: Scanning 1 messages, 21465 > bytes > Mar 30 04:11:53 d01 MailScanner[879]: Saved archive copies of B48BFF9477.51697 > Mar 30 04:11:53 d01 MailScanner[879]: MailScanner child caught a SIGHUP > Mar 30 04:11:53 d01 MailScanner[879]: Config: calling custom end function > MailWatchLogging > Mar 30 04:11:54 d01 MailScanner[9901]: MailScanner child caught a SIGHUP > Mar 30 04:11:54 d01 MailScanner[9901]: Config: calling custom end function > MailWatchLogging > Mar 30 04:11:56 d01 MailScanner[9923]: MailScanner E-Mail Virus Scanner > version 4.75.9 starting... > > Mar 30 04:12:01 d01 MailScanner[9923]: Connected to processing-messages > database > Mar 30 04:12:01 d01 MailScanner[9923]: Found 1 messages in the processing- > messages database > Mar 30 04:12:01 d01 MailScanner[9923]: Using locktype = flock > Mar 30 04:12:01 d01 MailScanner[9923]: New Batch: Scanning 2 messages, 51210 > bytes > Mar 30 04:12:01 d01 MailScanner[9923]: Saved archive copies of > B48BFF9477.D962D 4D299F9478.973F1 > Mar 30 04:12:02 d01 MailScanner[9923]: Spam Checks: Found 1 spam messages > Mar 30 04:12:02 d01 MailScanner[9923]: Requeue: 4D299F9478.973F1 to 141B3F9307 > Mar 30 04:12:02 d01 MailScanner[9923]: Unscanned: Delivered 1 messages > > That second message was cron generated and not scanned as local. > > Mar 30 04:12:02 d01 MailScanner[9923]: Virus and Content Scanning: Starting > Mar 30 04:12:02 d01 MailScanner[9923]: Deleted 2 messages from processing- > database > Mar 30 04:12:02 d01 MailScanner[9923]: Logging message B48BFF9477.D962D to SQL > Mar 30 04:12:02 d01 MailScanner[9923]: Logging message 4D299F9478.973F1 to SQL > Mar 30 04:12:02 d01 MailScanner[9925]: B48BFF9477.D962D: Logged to MailWatch > SQL > Mar 30 04:12:02 d01 MailScanner[9925]: 4D299F9478.973F1: Logged to MailWatch > SQL > > Maybe it grabbed B48BFF9477.51697 from the database and then tried to remove > B48BFF9477.D962D ? > Shouldn't do, know. The 5 characters on the end are added right at the creation of the message in the batch, it's all part of the MailScanner message-id. > >> It just occurred to me that the processing database won't work well with >> Postfix at all. >> Postfix re-uses the message id numbers too fast for them to be >> considered good ids, which is why I have to add a random number to the end. >> But I add a new random number to the end every time I pick up the >> message, so every time it sees the same message it will create different >> message ids for it. >> So the processing database idea breaks down :-( >> Poo :-( >> > But this shouldn't be the case here, right? And I don't see evidence that it > reuses these ids "too fast". I can't see a reuse for these ids for the whole > month. > It certainly used to, that's why I had to add the random characters on the end. I had more messages coming in with the same id in high load environments, so had to produce a better unique key for each message. I don't want to change that, as it was very definitely necessary at the time and so is still necessary on some systems. Maybe ones with small queue filesystems? Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From mark at msapiro.net Fri Apr 17 15:56:55 2009 From: mark at msapiro.net (Mark Sapiro) Date: Fri Apr 17 15:57:08 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49E597D5.3050300@ecs.soton.ac.uk> <20090415143749.GA496@msapiro> <20090417025744.GA3896@msapiro> <49E845B7.3010704@ecs.soton.ac.uk> Message-ID: <20090417145655.GA632@msapiro> On Fri, Apr 17, 2009 at 10:02:47AM +0100, Julian Field wrote: > If "MailScanner --processing=1" produces no output, then the records in > the database cannot have a count of 1 (the 2nd number in each column in > your table of 26 database entries below). So when you do that, the only > records in there must have a value of 0, which means they should have > been removed. [root@sbh16 ~]# MailScanner --processing=0 Currently being processed: Number of messages: 31 Tries Message Next Try At ===== ======= =========== 1 84250690369.89777 Fri Apr 17 05:30:14 2009 1 95234690415.83417 Fri Apr 17 05:29:50 2009 1 53010690431.69741 Fri Apr 17 05:26:55 2009 1 38479690188.83466 Fri Apr 17 05:26:53 2009 1 89182690409.01989 Fri Apr 17 02:40:20 2009 1 34979690423.56858 Thu Apr 16 11:35:07 2009 1 97480690403.80930 Thu Apr 16 11:35:03 2009 1 23751690385.34301 Wed Apr 15 09:29:42 2009 1 42214690429.67487 Tue Apr 14 19:08:09 2009 1 87926690445.21751 Tue Apr 14 15:20:46 2009 1 00894690425.97190 Tue Apr 14 15:19:18 2009 1 35592690431.581E1 Tue Apr 14 15:18:53 2009 1 06950690412.30E45 Tue Apr 14 14:36:36 2009 1 06766690387.55E20 Tue Apr 14 14:35:29 2009 1 00524690436.5E971 Tue Apr 14 10:25:39 2009 1 77828690380.26107 Tue Apr 14 08:06:28 2009 1 95835690388.E2978 Tue Apr 14 08:06:07 2009 1 41693690392.32976 Tue Apr 14 03:35:47 2009 1 49903690394.76309 Tue Apr 14 03:34:40 2009 1 39387690388.E1611 Mon Apr 13 22:27:01 2009 1 88257690407.10923 Mon Apr 13 20:56:21 2009 1 99351690429.04632 Mon Apr 13 20:05:43 2009 1 49358690409.95149 Mon Apr 13 18:10:19 2009 1 39224690405.41276 Mon Apr 13 18:09:14 2009 1 17300690390.3E804 Mon Apr 13 18:09:04 2009 1 57067690409.E4302 Mon Apr 13 11:52:02 2009 1 16020690433.44254 Mon Apr 13 11:49:22 2009 1 02842690389.04452 Mon Apr 13 11:48:42 2009 1 41537690424.26867 Mon Apr 13 11:30:20 2009 1 67650690405.93175 Mon Apr 13 09:55:43 2009 1 92295690444.31465 Mon Apr 13 09:53:55 2009 [root@sbh16 ~]# > However, when a child starts up, there will be all the messages in the > "processing" database table that are currently being processed by other > MailScanner children. Are you sure there are no other children running > when that child starts? Also, please look at the output of "MailScanner > --processing=0" as this will show you all the records in there, which > the timestamps converted into something readable, rather than the raw > time_t values you have included. That will let us see if they are in the > future or way in the past. There are no other children running. I run with Max Children = 1 in part because of an occasional message duplication issue that I would see with multiple children. In the case of the most recent 4 messages in the above list, the messages were processed around 05:24 by a child that started at 04:29 and died of old age at 06:31. There were no other children running and this child logged that it deleted from the database all the messages that it processed. > I cannot find any situation where the records would fail to be deleted, > if it says it has deleted them. The only way that can happen is if the > message id was blank, and all the records in your "processing" database > table you included below all have non-blank message ids, so it isn't that. > > The code for clearing out the database table is pretty straightforward, > please take a look at it yourself and see if you agree with me. It > starts at "sub ClearOutProcessedDatabase {" in > /usr/lib/MailScanner/MailScanner/MessageBatch.pm. If you can see any > bugs or holes in there, please do tell me! I'll take a look. -- Mark Sapiro mark at msapiro net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From maillists at conactive.com Fri Apr 17 16:16:45 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Fri Apr 17 16:16:58 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49E597D5.3050300@ecs.soton.ac.uk> <20090415143749.GA496@msapiro> <20090416190828.GA2012@msapiro> <49E83F8C.4060307@ecs.soton.ac.uk> <49E87D60.2040707@ecs.soton.ac.uk> Message-ID: Julian Field wrote on Fri, 17 Apr 2009 15:49:25 +0100: > Very likely. I don't know what that line means, but it doesn't sound > good does it? This seems to be normal operation. As at the same time the refreshing of the MS children happened I wonder if it wasn't triggered by MS? Anyway, (and without too much knowledge about how the processing of the queue in MS really works) I think the reason is that this message got saved to the processing db before MS refreshed itself and when MS processed it a second time it had a different MS id, so it didn't get removed. So, the problem must be somewhere in the way that the message is kept in the queue and not in the db code. I see that the message got indeed archived with both ids, that seems to be done before any other scanning/processing by MS, that makes sense. Then MS closed down. Do you keep it in incoming? With the full MS id? The message then must have been there either as B48BFF9477.51697 and MS renames it or it must have already been renamed to B48BFF9477.D962D (and this didn't get logged so we can't see it) and thus not found in the db. A simple cure to stop this might be to stop adding the extra stamp. What about an option? At least for my systems that seems to be safe. It might not be safe for other systems, that's why it should be an option. And as the whole thing doesn't indicate any problem, anyway, maybe clean up old entries by yourself and add something to clean it manually (-- processing=clean)? Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Fri Apr 17 16:24:14 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Fri Apr 17 16:24:27 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: <20090417145655.GA632@msapiro> References: <49E597D5.3050300@ecs.soton.ac.uk> <20090415143749.GA496@msapiro> <20090417025744.GA3896@msapiro> <49E845B7.3010704@ecs.soton.ac.uk> <20090417145655.GA632@msapiro> Message-ID: Mark, grep the mailscanner log for the first part of the MS id. If you archive, you may see two hits as I see here. If you don't archive there might not be any trace of the first processing in the log. As I understand, though, it happens for you in the middle of operation and not on MS refresh. Which MTA produces those completely random number-only ids? Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From jase at sensis.com Fri Apr 17 16:19:48 2009 From: jase at sensis.com (Desai, Jason) Date: Fri Apr 17 16:24:40 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49E597D5.3050300@ecs.soton.ac.uk> <20090415143749.GA496@msapiro><20090416190828.GA2012@msapiro> <49E83F8C.4060307@ecs.soton.ac.uk> <49E87D60.2040707@ecs.soton.ac.uk> Message-ID: <1951DC816E1A9F469307B05FA183F438018D0E9C@corpatsmail1.corp.sensis.com> > It just occurred to me that the processing database won't work well > with > Postfix at all. > Postfix re-uses the message id numbers too fast for them to be > considered good ids, which is why I have to add a random number to the > end. > But I add a new random number to the end every time I pick up the > message, so every time it sees the same message it will create > different > message ids for it. > So the processing database idea breaks down :-( > Poo :-( > > Any thoughts? I don't use Postfix, but perhaps instead of adding a random number you could add the unix time stamp, or maybe a hash of the date/time plus the sender and/or recipient address. There still may be id collisions, but hopefully not as many as using just the message id by itself. Jase From rcooper at dwford.com Fri Apr 17 16:25:03 2009 From: rcooper at dwford.com (Rick Cooper) Date: Fri Apr 17 16:25:06 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49E597D5.3050300@ecs.soton.ac.uk> <20090415143749.GA496@msapiro><20090416190828.GA2012@msapiro> <49E83F8C.4060307@ecs.soton.ac.uk> <49E87D60.2040707@ecs.soton.ac.uk> <49E896F5.9030302@ecs.soton.ac.uk> Message-ID: <73AC2818E6DA4313BB2CDD1957D58363@SAHOMELT> > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf > Of Julian Field > Sent: Friday, April 17, 2009 10:49 AM > To: MailScanner discussion > Subject: Re: Found nn messages in the processing-messages database > > > > On 17/04/2009 15:29, Kai Schaetzl wrote: > > ailScanner|ecs.soton.ac.uk|040707@ecs.soton.ac.uk> > > Reply-To: mailscanner@lists.mailscanner.info > > > > Julian Field wrote on Fri, 17 Apr 2009 14:00:16 +0100: > > > > [...] > >> It just occurred to me that the processing database won't > work well with > >> Postfix at all. > >> Postfix re-uses the message id numbers too fast for them to be > >> considered good ids, which is why I have to add a random > number to the end. > >> But I add a new random number to the end every time I pick up the > >> message, so every time it sees the same message it will > create different > >> message ids for it. > >> So the processing database idea breaks down :-( > >> Poo :-( > >> > > But this shouldn't be the case here, right? And I don't see > evidence that it > > reuses these ids "too fast". I can't see a reuse for these > ids for the whole > > month. > > > It certainly used to, that's why I had to add the random > characters on > the end. I had more messages coming in with the same id in high load > environments, so had to produce a better unique key for each > message. I > don't want to change that, as it was very definitely necessary at the > time and so is still necessary on some systems. Maybe ones with small > queue filesystems? > Rather than a random number wouldn't a file checksum or MD5 hash work just as well for randomness relating to the inode reuse issue but still give you the ability to see that it's the same message as a previous message? I mean the chances that you will have a message with the exact same has/checksum attached to the exact same inode has to be infinite I would think. I did some tests using the unix cksum program and the perl String::CRC::Cksum module and the perl module sucks big time. Running both against a 13M file (I know 13M is a bit large for an email but...) the cksum finishes in pretty consistent 0.077 seconds and the perl module about 16.57 seconds (too long). Now if you used the perl Digest::MD5 module against the same file it's about 0.188 seconds to calculate a 32 char checksum like d41d8cd98f00b204e9800998ecf8427e I know you don't really like stepping outside of perl but I *think* cksum is pretty universal in the *nix world and it's pretty damn fast. Could put it in a safepipe function with timeout too. Rick -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From tungocman at gmail.com Fri Apr 17 16:38:11 2009 From: tungocman at gmail.com (=?UTF-8?B?TcOjbiBU4burIE5n4buNYw==?=) Date: Fri Apr 17 16:38:36 2009 Subject: Postfix + MailScanner : Attachment Filename check problem !!!! In-Reply-To: References: Message-ID: Hi everyone! I have setup an email system use: Postfix + MailScanner 4.67.6 (with Perl version 5.008009 (5.8.9)) On FreeBSD 7.1-RELEASE Postfix run as user postfix MailScanner run as user postfix I config my Mailscanner to deny all attachments which have the filename is .exe or .com Then I test it by sending an email include the attachment which have the name is ATF-cleaner.exe, but the MailScanner have problem when check the attachment, MailScanner report that File checker failed with real error, please see the log file below for more information but if i config MailScanner to run as user root then everything is OK, but i really don't want to allow MailScanner to run as user root. I post all my log file results, and all required information to debug below. Please help me! Thanks! ------------------------ in my /etc/passwd: I have user root, postfix, clamav, spamd in my /etc/group: user root is the owner of group wheel user postfix, clamav, spamd are the members of group mail ------------------------- /var/log/mailog -> MailScanner Log result: Apr 17 11:46:40 ngthcm MailScanner[99877]: MailScanner E-Mail Virus Scanner version 4.67.6 starting... Apr 17 11:46:40 ngthcm MailScanner[99877]: Could not read Custom Functions directory Apr 17 11:46:40 ngthcm MailScanner[99877]: Read 814 hostnames from the phishing whitelist Apr 17 11:46:40 ngthcm MailScanner[99877]: Read 5511 hostnames from the phishing blacklist Apr 17 11:46:40 ngthcm MailScanner[99877]: SpamAssassin temporary working directory is /var/spool/MailScanner/incomingwork/SpamAssassin-Temp Apr 17 11:46:40 ngthcm MailScanner[99877]: Using SpamAssassin results cache Apr 17 11:46:40 ngthcm MailScanner[99877]: Connected to SpamAssassin cache database Apr 17 11:46:40 ngthcm MailScanner[99877]: Enabling SpamAssassin auto-whitelist functionality... Apr 17 11:46:43 ngthcm MailScanner[99863]: Using locktype = flock Apr 17 11:46:43 ngthcm MailScanner[99863]: New Batch: Scanning 1 messages, 72921 bytes Apr 17 11:46:43 ngthcm MailScanner[99863]: SpamAssassin cache hit for message AB0264AC26.475FA Apr 17 11:46:43 ngthcm MailScanner[99881]: SafePipe in Message.pm : /usr/local/bin/unrar v -p- '/var/spool/MailScanner/incomingwork/99863/AB0264AC26.475FA/ATF-Cleaner.exe' 2>&1 failed with real error: Insecure dependency in exec while running with -T switch at /usr/local/lib/MailScanner/MailScanner/Message.pm line 2888. Apr 17 11:46:43 ngthcm MailScanner[99881]: Virus and Content Scanning: Starting Apr 17 11:46:44 ngthcm MailScanner[99881]: Filename Checks: (AB0264AC26.475FA ATF-Cleaner.exe) Apr 17 11:46:44 ngthcm MailScanner[99883]: File checker failed with real error: Insecure dependency in exec while running with -T switch at /usr/local/lib/MailScanner/MailScanner/SweepOther.pm line 356. ------------------------ /usr/local/etc/MailScanner/MailScanner.conf : # Configuration directory containing this file %etc-dir% = /usr/local/etc/MailScanner # Set the directory containing all the reports in the required language %report-dir% = /usr/local/etc/MailScanner/reports/en # Rulesets directory containing your ".rules" files %rules-dir% = /usr/local/etc/MailScanner/rules Run As User = postfix Run As Group = mail Queue Scan Interval = 6 Incoming Queue Dir = /var/spool/postfix/hold Outgoing Queue Dir = /var/spool/postfix/incoming Run As User = postfix Run As Group = mail Incoming Work Dir = /var/spool/MailScanner/incomingwork Quarantine Dir = /var/spool/MailScanner/quarantine Incoming Work User = InComing Work Group = Incoming Work Permissions = 0660 Quarantine User = Quarantine Group = Quarantine Permissions = 0660 Allow Filenames = Deny Filenames = Filenames Rules = %etc-dir%/filename.rules.conf ----------- /usr/local/etc/MailScanner/filename.rules.conf # These 2 added by popular demand - Very often used by viruses deny \.com$ Windows/DOS Executable deny \.exe$ Windows/DOS Executable ------------- ngthcm# ls -l /var/spool/ drwxrwxr-x 6 postfix mail 512 Apr 17 12:01 MailScanner drwxrwxr-x 17 root mail 512 Apr 16 16:38 postfix ngthcm# ls -l /var/spool/MailScanner/ -rw------- 1 postfix mail 10240 Apr 17 12:02 SpamAssassin.cache.db drwxrwxr-x 11 postfix mail 512 Apr 17 12:02 incomingwork drwxrwxr-x 2 postfix mail 512 Apr 17 12:02 lockfile-dir drwxrwxr-x 2 postfix mail 512 Apr 13 15:26 quarantine drwxrwxr-x 2 postfix mail 512 Apr 16 12:42 spamassassin ngthcm# ls -l /var/spool/postfix/ drwx------ 2 postfix mail 512 Apr 17 03:01 .spamassassin drwxrwxr-x 2 postfix mail 512 Apr 17 11:23 active drwxrwxr-x 2 postfix mail 512 Apr 17 11:23 bounce drwxrwxr-x 2 postfix mail 512 Feb 18 18:06 corrupt drwxrwxr-x 14 postfix mail 512 Apr 9 23:28 defer drwxrwxr-x 14 postfix mail 512 Apr 9 23:28 deferred drwxrwxr-x 2 postfix mail 512 Feb 18 18:06 flush drwxrwxr-x 2 postfix mail 512 Apr 17 11:25 hold drwxrwxr-x 2 postfix mail 512 Apr 17 11:25 incoming drwxrwxr-x 2 postfix maildrop 512 Apr 17 03:01 maildrop drwxrwxr-x 2 root mail 512 Apr 6 01:14 pid drwxrwxr-x 2 postfix mail 512 Apr 17 11:38 private drwxrwxr-x 2 postfix maildrop 512 Apr 17 11:38 public drwxrwxr-x 2 postfix mail 512 Feb 18 18:06 saved drwxrwxr-x 2 postfix mail 512 Feb 18 18:06 trace ngthcm# ls -la /usr/local/lib/MailScanner/MailScanner drwxrwxr-x 3 root mail 1024 Apr 9 00:04 . drwxrwxr-x 3 root mail 512 Apr 9 00:04 .. -r-xr-xr-x 1 root mail 4357 Apr 9 00:04 BinHex.pm -r-xr-xr-x 1 root mail 104100 Apr 9 00:04 Config.pm -r-xr-xr-x 1 root mail 22104 Apr 9 00:04 ConfigDefs.pl -r-xr-xr-x 1 root mail 56745 Apr 9 00:04 CustomConfig.pm drwxr-xr-x 2 root mail 512 Apr 9 00:04 CustomFunctions -r-xr-xr-x 1 root mail 49221 Apr 9 00:04 Exim.pm -r-xr-xr-x 1 root mail 17799 Apr 9 00:04 EximDiskStore.pm -r-xr-xr-x 1 root mail 7772 Apr 9 00:04 GenericSpam.pm -r-xr-xr-x 1 root mail 12821 Apr 9 00:04 Lock.pm -r-xr-xr-x 1 root mail 5128 Apr 9 00:04 Log.pm -r-xr-xr-x 1 root mail 17369 Apr 9 00:04 MCP.pm -r-xr-xr-x 1 root mail 24524 Apr 9 00:04 MCPMessage.pm -r-xr-xr-x 1 root mail 2992 Apr 9 00:04 Mail.pm -r-xr-xr-x 1 root mail 273077 Apr 17 00:26 Message.pm -r-xr-xr-x 1 root mail 38942 Apr 9 00:04 MessageBatch.pm -r-xr-xr-x 1 root mail 27915 Apr 9 00:04 PFDiskStore.pm -r-xr-xr-x 1 root mail 65287 Apr 9 00:04 Postfix.pm -r-xr-xr-x 1 root mail 14565 Apr 9 00:04 QMDiskStore.pm -r-xr-xr-x 1 root mail 28039 Apr 9 00:04 Qmail.pm -r-xr-xr-x 1 root mail 8201 Apr 9 00:04 Quarantine.pm -r-xr-xr-x 1 root mail 1695 Apr 9 00:04 Queue.pm -r-xr-xr-x 1 root mail 9400 Apr 9 00:04 RBLs.pm -r-xr-xr-x 1 root mail 44737 Apr 9 00:04 SA.pm -r-xr-xr-x 1 root mail 19245 Apr 9 00:04 SMDiskStore.pm -r-xr-xr-x 1 root mail 38114 Apr 9 00:04 Sendmail.pm -r-xr-xr-x 1 root mail 30229 Apr 9 00:04 SweepContent.pm -r-xr-xr-x 1 root mail 27660 Apr 9 00:04 SweepOther.pm -r-xr-xr-x 1 root mail 128436 Apr 9 00:04 SweepViruses.pm -r-xr-xr-x 1 root mail 1446 Apr 9 00:04 SystemDefs.pm -r-xr-xr-x 1 root mail 11895 Apr 9 00:04 TNEF.pm -r-xr-xr-x 1 root mail 9840 Apr 9 00:04 WorkArea.pm -r-xr-xr-x 1 root mail 15231 Apr 9 00:04 ZMDiskStore.pm -r-xr-xr-x 1 root mail 33755 Apr 9 00:04 ZMailer.pm ------------------------------- ngthcm# /usr/local/sbin/mailscanner -v ]Running on FreeBSD ngthcm 7.1-RELEASE FreeBSD 7.1-RELEASE #0: Thu Jan 1 14:37:25 UTC 2009 root@logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386 This is Perl version 5.008009 (5.8.9) This is MailScanner version 4.67.6 Module versions are: 1.00 AnyDBM_File 1.26 Archive::Zip 1.10 Carp 2.015 Compress::Zlib 1.119 Convert::BinHex 2.27 Date::Parse 1.02 DirHandle 1.06 Fcntl 2.77 File::Basename 2.13 File::Copy 2.01 FileHandle 2.07_02 File::Path 0.21 File::Temp 0.92 Filesys::Df 3.60 HTML::Entities 3.60 HTML::Parser 3.57 HTML::TokeParser 1.23 IO 1.14 IO::File 1.13 IO::Pipe 2.04 Mail::Header 1.89 Math::BigInt 3.07 MIME::Base64 5.427 MIME::Decoder 5.427 MIME::Decoder::UU 5.427 MIME::Head 5.427 MIME::Parser 3.07 MIME::QuotedPrint 5.427 MIME::Tools 0.13 Net::CIDR 1.15 POSIX 1.19 Scalar::Util 1.81 Socket 1.4 Sys::Hostname::Long 0.27 Sys::Syslog 1.9719 Time::HiRes 1.02 Time::localtime Optional module versions are: 1.46 Archive::Tar 0.23 bignum missing Business::ISBN missing Business::ISBN::Data missing Data::Dump 1.817 DB_File 1.14 DBD::SQLite 1.607 DBI 1.15 Digest 1.01 Digest::HMAC 2.37 Digest::MD5 2.11 Digest::SHA1 1.01 Encode::Detect 0.17015 Error 0.24 ExtUtils::CBuilder 2.19 ExtUtils::ParseXS 2.37 Getopt::Long missing Inline 1.08 IO::String 1.09 IO::Zlib missing IP::Country missing Mail::ClamAV 3.002005 Mail::SpamAssassin v2.006 Mail::SPF missing Mail::SPF::Query 0.32 Module::Build missing Net::CIDR::Lite 0.65 Net::DNS v0.003 Net::DNS::Resolver::Programmable missing Net::LDAP 4.024 NetAddr::IP missing Parse::RecDescent missing SAVI 2.64 Test::Harness missing Test::Manifest 1.98 Text::Balanced 1.37 URI 0.76 version 0.68 YAML -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090417/8d77d69d/attachment.html From maxsec at gmail.com Fri Apr 17 16:58:02 2009 From: maxsec at gmail.com (Martin Hepworth) Date: Fri Apr 17 16:58:11 2009 Subject: Postfix + MailScanner : Attachment Filename check problem !!!! In-Reply-To: References: Message-ID: <72cf361e0904170858u6059d30nd1f68e9ecd580283@mail.gmail.com> Seems there's problems with perl 5.8.9 on FreeBSD - see earlier posts on installing 5.8.8 from the ports system and using that instead. 2009/4/17 M?n T? Ng?c > Hi everyone! > > I have setup an email system use: Postfix + MailScanner 4.67.6 (with > Perl version 5.008009 (5.8.9)) On FreeBSD 7.1-RELEASE > > Postfix run as user postfix > MailScanner run as user postfix > > I config my Mailscanner to deny all attachments which have the filename > is .exe or .com > > Then I test it by sending an email include the attachment which have the > name is ATF-cleaner.exe, > but the MailScanner have problem when check the attachment, MailScanner > report that File checker failed with real error, > please see the log file below for more information > > but if i config MailScanner to run as user root then everything is OK, > but i really don't want to allow MailScanner to run as user root. > > I post all my log file results, and all required information to debug > below. > > Please help me! > Thanks! > > ------------------------ > in my /etc/passwd: I have user root, postfix, clamav, spamd > in my /etc/group: > user root is the owner of group wheel > user postfix, clamav, spamd are the members of group mail > > ------------------------- > /var/log/mailog -> MailScanner Log result: > > Apr 17 11:46:40 ngthcm MailScanner[99877]: MailScanner E-Mail Virus Scanner > version 4.67.6 starting... > Apr 17 11:46:40 ngthcm MailScanner[99877]: Could not read Custom Functions > directory > Apr 17 11:46:40 ngthcm MailScanner[99877]: Read 814 hostnames from the > phishing whitelist > Apr 17 11:46:40 ngthcm MailScanner[99877]: Read 5511 hostnames from the > phishing blacklist > Apr 17 11:46:40 ngthcm MailScanner[99877]: SpamAssassin temporary working > directory is /var/spool/MailScanner/incomingwork/SpamAssassin-Temp > Apr 17 11:46:40 ngthcm MailScanner[99877]: Using SpamAssassin results cache > Apr 17 11:46:40 ngthcm MailScanner[99877]: Connected to SpamAssassin cache > database > Apr 17 11:46:40 ngthcm MailScanner[99877]: Enabling SpamAssassin > auto-whitelist functionality... > Apr 17 11:46:43 ngthcm MailScanner[99863]: Using locktype = flock > Apr 17 11:46:43 ngthcm MailScanner[99863]: New Batch: Scanning 1 messages, > 72921 bytes > Apr 17 11:46:43 ngthcm MailScanner[99863]: SpamAssassin cache hit for > message AB0264AC26.475FA > Apr 17 11:46:43 ngthcm MailScanner[99881]: SafePipe in Message.pm : > /usr/local/bin/unrar v -p- > '/var/spool/MailScanner/incomingwork/99863/AB0264AC26.475FA/ATF-Cleaner.exe' > 2>&1 failed with real error: Insecure dependency in exec while running with > -T switch at /usr/local/lib/MailScanner/MailScanner/Message.pm line 2888. > Apr 17 11:46:43 ngthcm MailScanner[99881]: Virus and Content Scanning: > Starting > Apr 17 11:46:44 ngthcm MailScanner[99881]: Filename Checks: > (AB0264AC26.475FA ATF-Cleaner.exe) > Apr 17 11:46:44 ngthcm MailScanner[99883]: File checker failed with real > error: Insecure dependency in exec while running with -T switch at > /usr/local/lib/MailScanner/MailScanner/SweepOther.pm line 356. > > > ------------------------ > /usr/local/etc/MailScanner/MailScanner.conf : > > # Configuration directory containing this file > %etc-dir% = /usr/local/etc/MailScanner > > # Set the directory containing all the reports in the required language > %report-dir% = /usr/local/etc/MailScanner/reports/en > > # Rulesets directory containing your ".rules" files > %rules-dir% = /usr/local/etc/MailScanner/rules > > Run As User = postfix > Run As Group = mail > Queue Scan Interval = 6 > Incoming Queue Dir = /var/spool/postfix/hold > Outgoing Queue Dir = /var/spool/postfix/incoming > Run As User = postfix > Run As Group = mail > Incoming Work Dir = /var/spool/MailScanner/incomingwork > Quarantine Dir = /var/spool/MailScanner/quarantine > Incoming Work User = > InComing Work Group = > Incoming Work Permissions = 0660 > Quarantine User = > Quarantine Group = > Quarantine Permissions = 0660 > Allow Filenames = > Deny Filenames = > Filenames Rules = %etc-dir%/filename.rules.conf > > ----------- > /usr/local/etc/MailScanner/filename.rules.conf > > # These 2 added by popular demand - Very often used by viruses > deny \.com$ Windows/DOS Executable > deny \.exe$ Windows/DOS Executable > > ------------- > ngthcm# ls -l /var/spool/ > drwxrwxr-x 6 postfix mail 512 Apr 17 12:01 MailScanner > drwxrwxr-x 17 root mail 512 Apr 16 16:38 postfix > > ngthcm# ls -l /var/spool/MailScanner/ > -rw------- 1 postfix mail 10240 Apr 17 12:02 SpamAssassin.cache.db > drwxrwxr-x 11 postfix mail 512 Apr 17 12:02 incomingwork > drwxrwxr-x 2 postfix mail 512 Apr 17 12:02 lockfile-dir > drwxrwxr-x 2 postfix mail 512 Apr 13 15:26 quarantine > drwxrwxr-x 2 postfix mail 512 Apr 16 12:42 spamassassin > > ngthcm# ls -l /var/spool/postfix/ > drwx------ 2 postfix mail 512 Apr 17 03:01 .spamassassin > drwxrwxr-x 2 postfix mail 512 Apr 17 11:23 active > drwxrwxr-x 2 postfix mail 512 Apr 17 11:23 bounce > drwxrwxr-x 2 postfix mail 512 Feb 18 18:06 corrupt > drwxrwxr-x 14 postfix mail 512 Apr 9 23:28 defer > drwxrwxr-x 14 postfix mail 512 Apr 9 23:28 deferred > drwxrwxr-x 2 postfix mail 512 Feb 18 18:06 flush > drwxrwxr-x 2 postfix mail 512 Apr 17 11:25 hold > drwxrwxr-x 2 postfix mail 512 Apr 17 11:25 incoming > drwxrwxr-x 2 postfix maildrop 512 Apr 17 03:01 maildrop > drwxrwxr-x 2 root mail 512 Apr 6 01:14 pid > drwxrwxr-x 2 postfix mail 512 Apr 17 11:38 private > drwxrwxr-x 2 postfix maildrop 512 Apr 17 11:38 public > drwxrwxr-x 2 postfix mail 512 Feb 18 18:06 saved > drwxrwxr-x 2 postfix mail 512 Feb 18 18:06 trace > > ngthcm# ls -la /usr/local/lib/MailScanner/MailScanner > drwxrwxr-x 3 root mail 1024 Apr 9 00:04 . > drwxrwxr-x 3 root mail 512 Apr 9 00:04 .. > -r-xr-xr-x 1 root mail 4357 Apr 9 00:04 BinHex.pm > -r-xr-xr-x 1 root mail 104100 Apr 9 00:04 Config.pm > -r-xr-xr-x 1 root mail 22104 Apr 9 00:04 ConfigDefs.pl > -r-xr-xr-x 1 root mail 56745 Apr 9 00:04 CustomConfig.pm > drwxr-xr-x 2 root mail 512 Apr 9 00:04 CustomFunctions > -r-xr-xr-x 1 root mail 49221 Apr 9 00:04 Exim.pm > -r-xr-xr-x 1 root mail 17799 Apr 9 00:04 EximDiskStore.pm > -r-xr-xr-x 1 root mail 7772 Apr 9 00:04 GenericSpam.pm > -r-xr-xr-x 1 root mail 12821 Apr 9 00:04 Lock.pm > -r-xr-xr-x 1 root mail 5128 Apr 9 00:04 Log.pm > -r-xr-xr-x 1 root mail 17369 Apr 9 00:04 MCP.pm > -r-xr-xr-x 1 root mail 24524 Apr 9 00:04 MCPMessage.pm > -r-xr-xr-x 1 root mail 2992 Apr 9 00:04 Mail.pm > -r-xr-xr-x 1 root mail 273077 Apr 17 00:26 Message.pm > -r-xr-xr-x 1 root mail 38942 Apr 9 00:04 MessageBatch.pm > -r-xr-xr-x 1 root mail 27915 Apr 9 00:04 PFDiskStore.pm > -r-xr-xr-x 1 root mail 65287 Apr 9 00:04 Postfix.pm > -r-xr-xr-x 1 root mail 14565 Apr 9 00:04 QMDiskStore.pm > -r-xr-xr-x 1 root mail 28039 Apr 9 00:04 Qmail.pm > -r-xr-xr-x 1 root mail 8201 Apr 9 00:04 Quarantine.pm > -r-xr-xr-x 1 root mail 1695 Apr 9 00:04 Queue.pm > -r-xr-xr-x 1 root mail 9400 Apr 9 00:04 RBLs.pm > -r-xr-xr-x 1 root mail 44737 Apr 9 00:04 SA.pm > -r-xr-xr-x 1 root mail 19245 Apr 9 00:04 SMDiskStore.pm > -r-xr-xr-x 1 root mail 38114 Apr 9 00:04 Sendmail.pm > -r-xr-xr-x 1 root mail 30229 Apr 9 00:04 SweepContent.pm > -r-xr-xr-x 1 root mail 27660 Apr 9 00:04 SweepOther.pm > -r-xr-xr-x 1 root mail 128436 Apr 9 00:04 SweepViruses.pm > -r-xr-xr-x 1 root mail 1446 Apr 9 00:04 SystemDefs.pm > -r-xr-xr-x 1 root mail 11895 Apr 9 00:04 TNEF.pm > -r-xr-xr-x 1 root mail 9840 Apr 9 00:04 WorkArea.pm > -r-xr-xr-x 1 root mail 15231 Apr 9 00:04 ZMDiskStore.pm > -r-xr-xr-x 1 root mail 33755 Apr 9 00:04 ZMailer.pm > > ------------------------------- > ngthcm# /usr/local/sbin/mailscanner -v > ]Running on > FreeBSD ngthcm 7.1-RELEASE FreeBSD 7.1-RELEASE #0: Thu Jan 1 14:37:25 UTC > 2009 root@logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386 > This is Perl version 5.008009 (5.8.9) > > This is MailScanner version 4.67.6 > Module versions are: > 1.00 AnyDBM_File > 1.26 Archive::Zip > 1.10 Carp > 2.015 Compress::Zlib > 1.119 Convert::BinHex > 2.27 Date::Parse > 1.02 DirHandle > 1.06 Fcntl > 2.77 File::Basename > 2.13 File::Copy > 2.01 FileHandle > 2.07_02 File::Path > 0.21 File::Temp > 0.92 Filesys::Df > 3.60 HTML::Entities > 3.60 HTML::Parser > 3.57 HTML::TokeParser > 1.23 IO > 1.14 IO::File > 1.13 IO::Pipe > 2.04 Mail::Header > 1.89 Math::BigInt > 3.07 MIME::Base64 > 5.427 MIME::Decoder > 5.427 MIME::Decoder::UU > 5.427 MIME::Head > 5.427 MIME::Parser > 3.07 MIME::QuotedPrint > 5.427 MIME::Tools > 0.13 Net::CIDR > 1.15 POSIX > 1.19 Scalar::Util > 1.81 Socket > 1.4 Sys::Hostname::Long > 0.27 Sys::Syslog > 1.9719 Time::HiRes > 1.02 Time::localtime > > Optional module versions are: > 1.46 Archive::Tar > 0.23 bignum > missing Business::ISBN > missing Business::ISBN::Data > missing Data::Dump > 1.817 DB_File > 1.14 DBD::SQLite > 1.607 DBI > 1.15 Digest > 1.01 Digest::HMAC > 2.37 Digest::MD5 > 2.11 Digest::SHA1 > 1.01 Encode::Detect > 0.17015 Error > 0.24 ExtUtils::CBuilder > 2.19 ExtUtils::ParseXS > 2.37 Getopt::Long > missing Inline > 1.08 IO::String > 1.09 IO::Zlib > missing IP::Country > missing Mail::ClamAV > 3.002005 Mail::SpamAssassin > v2.006 Mail::SPF > missing Mail::SPF::Query > 0.32 Module::Build > missing Net::CIDR::Lite > 0.65 Net::DNS > v0.003 Net::DNS::Resolver::Programmable > missing Net::LDAP > 4.024 NetAddr::IP > missing Parse::RecDescent > missing SAVI > 2.64 Test::Harness > missing Test::Manifest > 1.98 Text::Balanced > 1.37 URI > 0.76 version > 0.68 YAML > > > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -- Martin Hepworth Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090417/a438e120/attachment-0001.html From mark at msapiro.net Fri Apr 17 17:19:51 2009 From: mark at msapiro.net (Mark Sapiro) Date: Fri Apr 17 17:20:02 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49E597D5.3050300@ecs.soton.ac.uk> <20090415143749.GA496@msapiro> <20090417025744.GA3896@msapiro> <49E845B7.3010704@ecs.soton.ac.uk> <20090417145655.GA632@msapiro> Message-ID: <20090417161951.GA284@msapiro> On Fri, Apr 17, 2009 at 05:24:14PM +0200, Kai Schaetzl wrote: > Mark, grep the mailscanner log for the first part of the MS id. If you > archive, you may see two hits as I see here. If you don't archive there > might not be any trace of the first processing in the log. > As I understand, though, it happens for you in the middle of operation and > not on MS refresh. > Which MTA produces those completely random number-only ids? Kai, This is not the same issue as in your case. Here's an example grep (with address sanitized) Apr 17 05:24:19 sbh16 postfix/smtpd[26989]: 84250690369: client=localhost.localdomain[127.0.0.1] Apr 17 05:24:19 sbh16 postfix/cleanup[26993]: 84250690369: hold: header Received: from sbh16.songbird.com (localhost.localdomain [127.0.0.1])??by sbh16.songbird.com (Postfix) with ESMTP id 84250690369??for ; Fri, 17 Apr 2009 05:24:19 -0700 (PDT) from localhost.localdomain[127.0.0.1]; from= to= proto=ESMTP helo= Apr 17 05:24:19 sbh16 postfix/cleanup[26993]: 84250690369: message-id=<1ACE54F6-7ABD-4188-B051-5807DD1B2213@lmi.net> Apr 17 05:24:25 sbh16 MailScanner[26168]: Requeue: 84250690369.89777 to 09D3A69017C These are the only occurrences of 84250690369 in the log. You may have hit on a clue. This is Postfix and all-numeric queue-ids are rare, but every one of the ones left in the processing-messages database is all-numeric. It doesn't happen to every all-numeric id, but it certainly seems significant that all the problem ones are. -- Mark Sapiro mark at msapiro net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From admin at lctn.org Fri Apr 17 17:55:58 2009 From: admin at lctn.org (Raymond Norton) Date: Fri Apr 17 17:56:08 2009 Subject: best way to combat porn email Message-ID: <49E8B49E.7050004@lctn.org> We did a new mailscanner install about 7 or 8 months ago, which has worked very well. Since the first part of the year a lot of porn email is making it through, marked as clean. Is there a more aggressive rule I can include, or something I can change in the config to catch more of this type of email? From alex at rtpty.com Fri Apr 17 18:12:53 2009 From: alex at rtpty.com (Alex Neuman) Date: Fri Apr 17 18:13:04 2009 Subject: best way to combat porn email In-Reply-To: <49E8B49E.7050004@lctn.org> References: <49E8B49E.7050004@lctn.org> Message-ID: <24e3d2e40904171012r7dab66cdo377b43df395b899b@mail.gmail.com> Yes, there is. Can you tell us more about your particular setup? It may take some of the fun out of guessing what to do, but it would save some time. You can use pastebin to send samples of what goes through. On Fri, Apr 17, 2009 at 11:55 AM, Raymond Norton wrote: > We did a new mailscanner install about 7 or 8 months ago, which has worked > very well. Since the first part of the year a lot of porn email is making it > through, marked as clean. Is there a more aggressive rule I can include, or > something I can change in the config to catch more of this type of email? > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- Alex Neuman van der Hans Reliant Technologies +507 6781-9505 +507 202-1525 alex@rtpty.com Skype: alexneuman -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090417/41fd51d3/attachment.html From admin at lctn.org Fri Apr 17 18:22:05 2009 From: admin at lctn.org (Raymond Norton) Date: Fri Apr 17 18:22:15 2009 Subject: best way to combat porn email In-Reply-To: <24e3d2e40904171012r7dab66cdo377b43df395b899b@mail.gmail.com> References: <49E8B49E.7050004@lctn.org> <24e3d2e40904171012r7dab66cdo377b43df395b899b@mail.gmail.com> Message-ID: <49E8BABD.6030109@lctn.org> Alex Neuman wrote: > Yes, there is. Can you tell us more about your particular setup? It > may take some of the fun out of guessing what to do, but it would save > some time. You can use pastebin to send samples of what goes through. > I have been off-list for quite a while. Does mailscanner have a subdomain on pastebin? From maillists at conactive.com Fri Apr 17 19:20:16 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Fri Apr 17 19:20:29 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: <73AC2818E6DA4313BB2CDD1957D58363@SAHOMELT> References: <49E597D5.3050300@ecs.soton.ac.uk> <20090415143749.GA496@msapiro> <20090416190828.GA2012@msapiro> <49E83F8C.4060307@ecs.soton.ac.uk> <49E87D60.2040707@ecs.soton.ac.uk> <49E896F5.9030302@ecs.soton.ac.uk> <73AC2818E6DA4313BB2CDD1957D58363@SAHOMELT> Message-ID: Rick Cooper wrote on Fri, 17 Apr 2009 11:25:03 -0400: > Rather than a random number wouldn't a file checksum or MD5 hash I rather think there is no need for changing the "original" at all. It suffices for sendmail and postfix, why not for MS? Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Fri Apr 17 19:20:16 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Fri Apr 17 19:20:30 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: <20090417161951.GA284@msapiro> References: <49E597D5.3050300@ecs.soton.ac.uk> <20090415143749.GA496@msapiro> <20090417025744.GA3896@msapiro> <49E845B7.3010704@ecs.soton.ac.uk> <20090417145655.GA632@msapiro> <20090417161951.GA284@msapiro> Message-ID: Mark Sapiro wrote on Fri, 17 Apr 2009 09:19:51 -0700: > This is not the same issue as in your case. Yeah, I figured that by the fact that it doesn't occur after an MS reload. But if you are not archiving you won't see that id in the MS log a second time, anyway. Only the archiving seems to reveal to the log that it was already there. > You may have hit on a clue. This is Postfix and all-numeric queue-ids are > rare, but every one of the ones left in the processing-messages database > is all-numeric. It doesn't happen to every all-numeric id, but it certainly > seems significant that all the problem ones are. This is certainly weird, but in a different sense. I have a hard time to find any such "number-only" id on my machines. Maybe they only happen with very high message volumes? Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From ssilva at sgvwater.com Fri Apr 17 19:50:16 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Fri Apr 17 19:50:36 2009 Subject: best way to combat porn email In-Reply-To: <49E8BABD.6030109@lctn.org> References: <49E8B49E.7050004@lctn.org> <24e3d2e40904171012r7dab66cdo377b43df395b899b@mail.gmail.com> <49E8BABD.6030109@lctn.org> Message-ID: on 4-17-2009 10:22 AM Raymond Norton spake the following: > > > Alex Neuman wrote: >> Yes, there is. Can you tell us more about your particular setup? It >> may take some of the fun out of guessing what to do, but it would save >> some time. You can use pastebin to send samples of what goes through. >> > > I have been off-list for quite a while. Does mailscanner have a > subdomain on pastebin? > Just pastebin the examples and post the url's. Some of us will run your samples and give you the results. Make sure they are complete queue files and not forwarded copies. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090417/77e5d66a/signature.bin From mark at msapiro.net Fri Apr 17 21:23:13 2009 From: mark at msapiro.net (Mark Sapiro) Date: Fri Apr 17 21:23:38 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: Message-ID: Julian Field wrote: >If "MailScanner --processing=1" produces no output, then the records in >the database cannot have a count of 1 (the 2nd number in each column in >your table of 26 database entries below). So when you do that, the only >records in there must have a value of 0, which means they should have >been removed. That's not what I'm seeing. Here's an unedited terminal session: [root@sbh16 .software]# sqlite3 /var/spool/MailScanner/incoming/Processing.db SQLite version 3.3.6 Enter ".help" for instructions sqlite> .tables archive processing sqlite> select * from archive; sqlite> select * from processing; 67650690405.93175|1|1239641743 92295690444.31465|1|1239641635 41537690424.26867|1|1239647420 02842690389.04452|1|1239648522 57067690409.E4302|1|1239648722 16020690433.44254|1|1239648562 17300690390.3E804|1|1239671344 39224690405.41276|1|1239671354 49358690409.95149|1|1239671419 99351690429.04632|1|1239678343 88257690407.10923|1|1239681381 39387690388.E1611|1|1239686821 41693690392.32976|1|1239705347 49903690394.76309|1|1239705280 77828690380.26107|1|1239721588 95835690388.E2978|1|1239721567 00524690436.5E971|1|1239729939 06766690387.55E20|1|1239744929 06950690412.30E45|1|1239744996 87926690445.21751|1|1239747646 35592690431.581E1|1|1239747533 00894690425.97190|1|1239747558 42214690429.67487|1|1239761289 23751690385.34301|1|1239812982 97480690403.80930|1|1239906903 34979690423.56858|1|1239906907 89182690409.01989|1|1239961220 84250690369.89777|1|1239971414 38479690188.83466|1|1239971213 95234690415.83417|1|1239971390 53010690431.69741|1|1239971215 94955690401.349E4|1|1239984106 07756690452.6E220|1|1239984011 66147690469.42376|1|1239995322 68981690507.74158|1|1239995261 65431690408.11855|1|1239995452 45558690470.40965|1|1239995427 64862690404.61045|1|1239995847 94893690446.17364|1|1239995778 27233690465.E9522|1|1239995804 61750690410.E1479|1|1239997293 77095690415.72600|1|1239997286 47926690443.39474|1|1239997474 12450690471.4E939|1|1239997440 sqlite> .exit [root@sbh16 .software]# MailScanner --processing=1 [root@sbh16 .software]# MailScanner --processing=0 Currently being processed: Number of messages: 44 Tries Message Next Try At ===== ======= =========== 1 47926690443.39474 Fri Apr 17 12:44:34 2009 1 12450690471.4E939 Fri Apr 17 12:44:00 2009 1 61750690410.E1479 Fri Apr 17 12:41:33 2009 1 77095690415.72600 Fri Apr 17 12:41:26 2009 1 64862690404.61045 Fri Apr 17 12:17:27 2009 1 27233690465.E9522 Fri Apr 17 12:16:44 2009 1 94893690446.17364 Fri Apr 17 12:16:18 2009 1 65431690408.11855 Fri Apr 17 12:10:52 2009 1 45558690470.40965 Fri Apr 17 12:10:27 2009 1 66147690469.42376 Fri Apr 17 12:08:42 2009 1 68981690507.74158 Fri Apr 17 12:07:41 2009 1 94955690401.349E4 Fri Apr 17 09:01:46 2009 1 07756690452.6E220 Fri Apr 17 09:00:11 2009 1 84250690369.89777 Fri Apr 17 05:30:14 2009 1 95234690415.83417 Fri Apr 17 05:29:50 2009 1 53010690431.69741 Fri Apr 17 05:26:55 2009 1 38479690188.83466 Fri Apr 17 05:26:53 2009 1 89182690409.01989 Fri Apr 17 02:40:20 2009 1 34979690423.56858 Thu Apr 16 11:35:07 2009 1 97480690403.80930 Thu Apr 16 11:35:03 2009 1 23751690385.34301 Wed Apr 15 09:29:42 2009 1 42214690429.67487 Tue Apr 14 19:08:09 2009 1 87926690445.21751 Tue Apr 14 15:20:46 2009 1 00894690425.97190 Tue Apr 14 15:19:18 2009 1 35592690431.581E1 Tue Apr 14 15:18:53 2009 1 06950690412.30E45 Tue Apr 14 14:36:36 2009 1 06766690387.55E20 Tue Apr 14 14:35:29 2009 1 00524690436.5E971 Tue Apr 14 10:25:39 2009 1 77828690380.26107 Tue Apr 14 08:06:28 2009 1 95835690388.E2978 Tue Apr 14 08:06:07 2009 1 41693690392.32976 Tue Apr 14 03:35:47 2009 1 49903690394.76309 Tue Apr 14 03:34:40 2009 1 39387690388.E1611 Mon Apr 13 22:27:01 2009 1 88257690407.10923 Mon Apr 13 20:56:21 2009 1 99351690429.04632 Mon Apr 13 20:05:43 2009 1 49358690409.95149 Mon Apr 13 18:10:19 2009 1 39224690405.41276 Mon Apr 13 18:09:14 2009 1 17300690390.3E804 Mon Apr 13 18:09:04 2009 1 57067690409.E4302 Mon Apr 13 11:52:02 2009 1 16020690433.44254 Mon Apr 13 11:49:22 2009 1 02842690389.04452 Mon Apr 13 11:48:42 2009 1 41537690424.26867 Mon Apr 13 11:30:20 2009 1 67650690405.93175 Mon Apr 13 09:55:43 2009 1 92295690444.31465 Mon Apr 13 09:53:55 2009 [root@sbh16 .software]# >I cannot find any situation where the records would fail to be deleted, >if it says it has deleted them. The only way that can happen is if the >message id was blank, and all the records in your "processing" database >table you included below all have non-blank message ids, so it isn't that. > >The code for clearing out the database table is pretty straightforward, >please take a look at it yourself and see if you agree with me. It >starts at "sub ClearOutProcessedDatabase {" in >/usr/lib/MailScanner/MailScanner/MessageBatch.pm. If you can see any >bugs or holes in there, please do tell me! I've looked at the code and I agree provided that there are no duplicate ids. However, I note that this problem started when I upgraded from 4.76.7 to 4.76.10 which also upgraded DBM::SQLite from 1.13 to 1.21. Is it possible that something in this SQLite upgrade, possibly in combination with something in MailScanner/MailScanner/Postfix.pm is putting duplicates into the database? -- Mark Sapiro The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From lhaig at haigmail.com Fri Apr 17 22:45:04 2009 From: lhaig at haigmail.com (Lance Haig) Date: Fri Apr 17 22:47:00 2009 Subject: Error when installing on Debian lenny Message-ID: <49E8F860.3000106@haigmail.com> Hi, I am building a MailScanner on debian lenny. I have when I start it I get this error Cannot create temporary Work Dir /var/spool/MailScanner/incoming/2005. Are the permissions and ownership of /var/spool/MailScanner/incoming correct? I have fixed the unrar error. What am I missing? Thanks Lance Some information scan2:~# MailScanner -lint Trying to setlogsock(unix) Read 848 hostnames from the phishing whitelist Read 4278 hostnames from the phishing blacklist Checking version numbers... Version number in MailScanner.conf (4.74.16) is correct. Unrar is not installed, it should be in /usr/bin/unrar. This is required for RAR archives to be read to check filenames and filetypes. Virus scanning is not affected. Your envelope_sender_header in spam.assassin.prefs.conf is correct. MailScanner setting GID to (109) MailScanner setting UID to (107) Checking for SpamAssassin errors (if you use it)... Using SpamAssassin results cache Connected to SpamAssassin cache database pyzor: check failed: internal error SpamAssassin reported no errors. I have found clamd scanners installed, and will use them all by default. Using locktype = posix MailScanner.conf says "Virus Scanners = auto" Found these virus scanners installed: clamd =========================================================================== Error in tempdir() using MSlintXXXXXX: Parent directory (.) is not writable at /usr/share/MailScanner//MailScanner/MessageBatch.pm line 1170 scan2:~# MailScanner -v Running on Linux scan2.redarmour.co.uk 2.6.18.8-linode16 #1 SMP Mon Jan 12 09:50:18 EST 2009 i686 GNU/Linux This is Perl version 5.010000 (5.10.0) This is MailScanner version 4.74.16 Module versions are: 1.00 AnyDBM_File 1.18 Archive::Zip 0.22 bignum 1.08 Carp 2.012 Compress::Zlib 1.119 Convert::BinHex 0.17 Convert::TNEF 2.121_14 Data::Dumper 2.27 Date::Parse 1.01 DirHandle 1.06 Fcntl 2.76 File::Basename 2.11 File::Copy 2.01 FileHandle 2.04 File::Path 0.18 File::Temp 0.92 Filesys::Df 1.35 HTML::Entities 3.56 HTML::Parser 2.37 HTML::TokeParser 1.23_01 IO 1.14 IO::File 1.13 IO::Pipe 2.03 Mail::Header 1.88 Math::BigInt 0.21 Math::BigRat 3.07_01 MIME::Base64 5.427 MIME::Decoder 5.427 MIME::Decoder::UU 5.427 MIME::Head 5.427 MIME::Parser 3.07 MIME::QuotedPrint 5.427 MIME::Tools 0.11 Net::CIDR 1.25 Net::IP 0.16 OLE::Storage_Lite 1.04 Pod::Escapes 3.05 Pod::Simple 1.13 POSIX 1.19 Scalar::Util 1.80 Socket 2.18 Storable 1.4 Sys::Hostname::Long 0.26 Sys::Syslog missing Test::Pod 0.72 Test::Simple 1.9711 Time::HiRes 1.02 Time::localtime Optional module versions are: 1.38 Archive::Tar 0.22 bignum missing Business::ISBN missing Business::ISBN::Data missing Data::Dump 1.816_1 DB_File 1.14 DBD::SQLite 1.605 DBI 1.15 Digest 1.01 Digest::HMAC 2.36_01 Digest::MD5 2.11 Digest::SHA1 missing Encode::Detect 0.17015 Error 0.21 ExtUtils::CBuilder 2.18_02 ExtUtils::ParseXS 2.37 Getopt::Long missing Inline missing IO::String 1.07 IO::Zlib missing IP::Country missing Mail::ClamAV 3.002005 Mail::SpamAssassin v2.006 Mail::SPF 1.999001 Mail::SPF::Query 0.32 Module::Build 0.20 Net::CIDR::Lite 0.63 Net::DNS v0.003 Net::DNS::Resolver::Programmable missing Net::LDAP 4.026 NetAddr::IP missing Parse::RecDescent missing SAVI 3.16 Test::Harness missing Test::Manifest 2.0.0 Text::Balanced 1.35 URI 0.74 version 0.68 YAML From Kevin_Miller at ci.juneau.ak.us Fri Apr 17 23:52:25 2009 From: Kevin_Miller at ci.juneau.ak.us (Kevin Miller) Date: Fri Apr 17 23:52:42 2009 Subject: Error when installing on Debian lenny In-Reply-To: <49E8F860.3000106@haigmail.com> References: <49E8F860.3000106@haigmail.com> Message-ID: <4A09477D575C2C4B86497161427DD94C0D12E5A358@CITY-EXCHANGE07.cbj.local> Lance Haig wrote: > Hi, > > I am building a MailScanner on debian lenny. > I have > > when I start it I get this error > > Cannot create temporary Work Dir /var/spool/MailScanner/incoming/2005. > Are the permissions and ownership of /var/spool/MailScanner/incoming > correct? The permissions on my SUSE box are: mkm@mxg:/var/spool/MailScanner> l drwxr-xr-x 4 root root 104 2008-01-28 14:55 ./ drwxr-xr-x 15 root root 416 2008-01-28 14:55 ../ drwxrwxrwt 6 root root 140 2009-04-17 14:48 incoming/ drwxrwx--- 33 root www 800 2009-04-17 08:50 quarantine/ And in quarantine: mxg:/var/spool/MailScanner/quarantine # l total 1 drwxrwx--- 33 root www 800 2009-04-17 08:50 ./ drwxr-xr-x 4 root root 104 2008-01-28 14:55 ../ drwxrwx--- 4 root www 96 2009-03-19 00:03 20090319/ ... drwxrwx--- 4 root www 96 2009-04-17 00:02 20090417/ drwxr-xr-x 3 root root 96 2009-04-17 14:19 phishingupdate/ HTH... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 From lnhaig at gmail.com Sat Apr 18 00:45:56 2009 From: lnhaig at gmail.com (Lance Haig) Date: Sat Apr 18 00:47:50 2009 Subject: Error when installing on Debian lenny In-Reply-To: <4A09477D575C2C4B86497161427DD94C0D12E5A358@CITY-EXCHANGE07.cbj.local> References: <49E8F860.3000106@haigmail.com> <4A09477D575C2C4B86497161427DD94C0D12E5A358@CITY-EXCHANGE07.cbj.local> Message-ID: <49E914B4.4020607@gmail.com> Hi Kevin, Thanks for the tip will have a look Regards Lance Kevin Miller wrote: > Lance Haig wrote: > >> Hi, >> >> I am building a MailScanner on debian lenny. >> I have >> >> when I start it I get this error >> >> Cannot create temporary Work Dir /var/spool/MailScanner/incoming/2005. >> Are the permissions and ownership of /var/spool/MailScanner/incoming >> correct? >> > > The permissions on my SUSE box are: > > mkm@mxg:/var/spool/MailScanner> l > drwxr-xr-x 4 root root 104 2008-01-28 14:55 ./ > drwxr-xr-x 15 root root 416 2008-01-28 14:55 ../ > drwxrwxrwt 6 root root 140 2009-04-17 14:48 incoming/ > drwxrwx--- 33 root www 800 2009-04-17 08:50 quarantine/ > > And in quarantine: > mxg:/var/spool/MailScanner/quarantine # l > total 1 > drwxrwx--- 33 root www 800 2009-04-17 08:50 ./ > drwxr-xr-x 4 root root 104 2008-01-28 14:55 ../ > drwxrwx--- 4 root www 96 2009-03-19 00:03 20090319/ > ... > drwxrwx--- 4 root www 96 2009-04-17 00:02 20090417/ > drwxr-xr-x 3 root root 96 2009-04-17 14:19 phishingupdate/ > > > HTH... > > ...Kevin > From alex at rtpty.com Sat Apr 18 00:53:45 2009 From: alex at rtpty.com (Alex Neuman) Date: Sat Apr 18 00:53:56 2009 Subject: best way to combat porn email In-Reply-To: <49E8BABD.6030109@lctn.org> References: <49E8B49E.7050004@lctn.org> <24e3d2e40904171012r7dab66cdo377b43df395b899b@mail.gmail.com> <49E8BABD.6030109@lctn.org> Message-ID: <24e3d2e40904171653w11d7a35vf33998c6f971b251@mail.gmail.com> No, but you can just use anything you want. http://pastebin.com/m5cadad2d On Fri, Apr 17, 2009 at 12:22 PM, Raymond Norton wrote: > > > Alex Neuman wrote: > >> Yes, there is. Can you tell us more about your particular setup? It may >> take some of the fun out of guessing what to do, but it would save some >> time. You can use pastebin to send samples of what goes through. >> >> > I have been off-list for quite a while. Does mailscanner have a subdomain > on pastebin? > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- Alex Neuman van der Hans Reliant Technologies +507 6781-9505 +507 202-1525 alex@rtpty.com Skype: alexneuman -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090417/c5c9fa44/attachment.html From ka at pacific.net Sat Apr 18 01:57:46 2009 From: ka at pacific.net (Ken A) Date: Sat Apr 18 01:58:19 2009 Subject: spam trend - domains that don't exist? Message-ID: <49E9258A.9040208@pacific.net> Curious if others are seeing this trend too. Increasingly we are rejecting a lot of mail with just basic sendmail check_mail "domain does not exist" rule. What is the point of this kind of thing? Is this a new dumb virus? Why doesn't it make up an aol address? Is it about spam, or dns, perhaps. Here's a small sample of the rejected domains: > > tgnemnekyvrd@ip-14.bergon.net > thc@jobs101_314630.cvc.adm.dcccd.edu > tjredstart@jewelsplace.net > tkiac@gtmpze.edu > tmolar@merseymails.com > tnjevdfwpp@DJJSZ6C1.nc.rr.com > tocgpf@toshiba-user.hsd1.fl.comcast.net They are mostly unique, and seem to be bots. Ken -- Ken Anderson Pacific Internet - http://www.pacific.net From mark at msapiro.net Sat Apr 18 04:29:51 2009 From: mark at msapiro.net (Mark Sapiro) Date: Sat Apr 18 04:30:00 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49E597D5.3050300@ecs.soton.ac.uk> <20090415143749.GA496@msapiro> <20090417025744.GA3896@msapiro> <49E845B7.3010704@ecs.soton.ac.uk> <20090417145655.GA632@msapiro> <20090417161951.GA284@msapiro> Message-ID: <20090418032951.GA3624@msapiro> On Sat, Apr 18, 2009 at 02:20:16AM +0000, Kai Schaetzl wrote: > > This is certainly weird, but in a different sense. I have a hard time to find > any such "number-only" id on my machines. Maybe they only happen with very > high message volumes? I don't know why they occur. In my case, looking at the MailScanner Requeue: messages, I have # grep -E "Apr 1[4567].*MailScanner.*Requeue:" /var/log/maillog | wc -l 6012 # grep -E "Apr 1[4567].*MailScanner.*Requeue: [0-9]{11}" /var/log/maillog | wc -l 183 On probability alone (10/16)^11, I would expect only about 34 all-decimal IDs where I see 183. Coincidently, and I'm sure unrelated, in the same period, I have 34 entries left in the processing-messages database. But maybe it's not so strange. In my case, the 6th, 7th and 8th digits of the Postfix ID are *always* 690. In your case they seem to be F94 so if they really are constant or at least constant for long periods, all-decimal is more likely for me and impossible for you. I also notice my Postfix IDs are 11 hex digits and yours seem to be 10. I don't know how much if any of this is significant. -- Mark Sapiro mark at msapiro net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From what.why.how.2009 at gmail.com Sat Apr 18 06:20:17 2009 From: what.why.how.2009 at gmail.com (Man Ngoc) Date: Sat Apr 18 06:20:28 2009 Subject: Postfix + MailScanner : Attachment Filename check problem !!!! In-Reply-To: References: <72cf361e0904170858u6059d30nd1f68e9ecd580283@mail.gmail.com> Message-ID: <13c7d1a60904172220o5b448f47na03262c51f729630@mail.gmail.com> Hi Martin! Thanks for your reply, i will try as your idea, then will post the results to u soon. Again, thanks for help! On Fri, Apr 17, 2009 at 10:58 PM, Martin Hepworth wrote: > >> Seems there's problems with perl 5.8.9 on FreeBSD - see earlier posts on >> installing 5.8.8 from the ports system and using that instead. >> >> 2009/4/17 M?n T? Ng?c >> >>> Hi everyone! >>> >>> I have setup an email system use: Postfix + MailScanner 4.67.6 (with >>> Perl version 5.008009 (5.8.9)) On FreeBSD 7.1-RELEASE >>> >>> Postfix run as user postfix >>> MailScanner run as user postfix >>> >>> I config my Mailscanner to deny all attachments which have the >>> filename is .exe or .com >>> >>> Then I test it by sending an email include the attachment which have >>> the name is ATF-cleaner.exe, >>> but the MailScanner have problem when check the attachment, >>> MailScanner report that File checker failed with real error, >>> please see the log file below for more information >>> >>> but if i config MailScanner to run as user root then everything is OK, >>> but i really don't want to allow MailScanner to run as user root. >>> >>> I post all my log file results, and all required information to debug >>> below. >>> >>> Please help me! >>> Thanks! >>> >>> ------------------------ >>> in my /etc/passwd: I have user root, postfix, clamav, spamd >>> in my /etc/group: >>> user root is the owner of group wheel >>> user postfix, clamav, spamd are the members of group mail >>> >>> ------------------------- >>> /var/log/mailog -> MailScanner Log result: >>> >>> Apr 17 11:46:40 ngthcm MailScanner[99877]: MailScanner E-Mail Virus >>> Scanner version 4.67.6 starting... >>> Apr 17 11:46:40 ngthcm MailScanner[99877]: Could not read Custom >>> Functions directory >>> Apr 17 11:46:40 ngthcm MailScanner[99877]: Read 814 hostnames from the >>> phishing whitelist >>> Apr 17 11:46:40 ngthcm MailScanner[99877]: Read 5511 hostnames from the >>> phishing blacklist >>> Apr 17 11:46:40 ngthcm MailScanner[99877]: SpamAssassin temporary working >>> directory is /var/spool/MailScanner/incomingwork/SpamAssassin-Temp >>> Apr 17 11:46:40 ngthcm MailScanner[99877]: Using SpamAssassin results >>> cache >>> Apr 17 11:46:40 ngthcm MailScanner[99877]: Connected to SpamAssassin >>> cache database >>> Apr 17 11:46:40 ngthcm MailScanner[99877]: Enabling SpamAssassin >>> auto-whitelist functionality... >>> Apr 17 11:46:43 ngthcm MailScanner[99863]: Using locktype = flock >>> Apr 17 11:46:43 ngthcm MailScanner[99863]: New Batch: Scanning 1 >>> messages, 72921 bytes >>> Apr 17 11:46:43 ngthcm MailScanner[99863]: SpamAssassin cache hit for >>> message AB0264AC26.475FA >>> Apr 17 11:46:43 ngthcm MailScanner[99881]: SafePipe in Message.pm : >>> /usr/local/bin/unrar v -p- >>> '/var/spool/MailScanner/incomingwork/99863/AB0264AC26.475FA/ATF-Cleaner.exe' >>> 2>&1 failed with real error: Insecure dependency in exec while running with >>> -T switch at /usr/local/lib/MailScanner/MailScanner/Message.pm line 2888. >>> Apr 17 11:46:43 ngthcm MailScanner[99881]: Virus and Content Scanning: >>> Starting >>> Apr 17 11:46:44 ngthcm MailScanner[99881]: Filename Checks: >>> (AB0264AC26.475FA ATF-Cleaner.exe) >>> Apr 17 11:46:44 ngthcm MailScanner[99883]: File checker failed with real >>> error: Insecure dependency in exec while running with -T switch at >>> /usr/local/lib/MailScanner/MailScanner/SweepOther.pm line 356. >>> >>> >>> ------------------------ >>> /usr/local/etc/MailScanner/MailScanner.conf : >>> >>> # Configuration directory containing this file >>> %etc-dir% = /usr/local/etc/MailScanner >>> >>> # Set the directory containing all the reports in the required language >>> %report-dir% = /usr/local/etc/MailScanner/reports/en >>> >>> # Rulesets directory containing your ".rules" files >>> %rules-dir% = /usr/local/etc/MailScanner/rules >>> >>> Run As User = postfix >>> Run As Group = mail >>> Queue Scan Interval = 6 >>> Incoming Queue Dir = /var/spool/postfix/hold >>> Outgoing Queue Dir = /var/spool/postfix/incoming >>> Run As User = postfix >>> Run As Group = mail >>> Incoming Work Dir = /var/spool/MailScanner/incomingwork >>> Quarantine Dir = /var/spool/MailScanner/quarantine >>> Incoming Work User = >>> InComing Work Group = >>> Incoming Work Permissions = 0660 >>> Quarantine User = >>> Quarantine Group = >>> Quarantine Permissions = 0660 >>> Allow Filenames = >>> Deny Filenames = >>> Filenames Rules = %etc-dir%/filename.rules.conf >>> >>> ----------- >>> /usr/local/etc/MailScanner/filename.rules.conf >>> >>> # These 2 added by popular demand - Very often used by viruses >>> deny \.com$ Windows/DOS Executable >>> deny \.exe$ Windows/DOS Executable >>> >>> ------------- >>> ngthcm# ls -l /var/spool/ >>> drwxrwxr-x 6 postfix mail 512 Apr 17 12:01 MailScanner >>> drwxrwxr-x 17 root mail 512 Apr 16 16:38 postfix >>> >>> ngthcm# ls -l /var/spool/MailScanner/ >>> -rw------- 1 postfix mail 10240 Apr 17 12:02 SpamAssassin.cache.db >>> drwxrwxr-x 11 postfix mail 512 Apr 17 12:02 incomingwork >>> drwxrwxr-x 2 postfix mail 512 Apr 17 12:02 lockfile-dir >>> drwxrwxr-x 2 postfix mail 512 Apr 13 15:26 quarantine >>> drwxrwxr-x 2 postfix mail 512 Apr 16 12:42 spamassassin >>> >>> ngthcm# ls -l /var/spool/postfix/ >>> drwx------ 2 postfix mail 512 Apr 17 03:01 .spamassassin >>> drwxrwxr-x 2 postfix mail 512 Apr 17 11:23 active >>> drwxrwxr-x 2 postfix mail 512 Apr 17 11:23 bounce >>> drwxrwxr-x 2 postfix mail 512 Feb 18 18:06 corrupt >>> drwxrwxr-x 14 postfix mail 512 Apr 9 23:28 defer >>> drwxrwxr-x 14 postfix mail 512 Apr 9 23:28 deferred >>> drwxrwxr-x 2 postfix mail 512 Feb 18 18:06 flush >>> drwxrwxr-x 2 postfix mail 512 Apr 17 11:25 hold >>> drwxrwxr-x 2 postfix mail 512 Apr 17 11:25 incoming >>> drwxrwxr-x 2 postfix maildrop 512 Apr 17 03:01 maildrop >>> drwxrwxr-x 2 root mail 512 Apr 6 01:14 pid >>> drwxrwxr-x 2 postfix mail 512 Apr 17 11:38 private >>> drwxrwxr-x 2 postfix maildrop 512 Apr 17 11:38 public >>> drwxrwxr-x 2 postfix mail 512 Feb 18 18:06 saved >>> drwxrwxr-x 2 postfix mail 512 Feb 18 18:06 trace >>> >>> ngthcm# ls -la /usr/local/lib/MailScanner/MailScanner >>> drwxrwxr-x 3 root mail 1024 Apr 9 00:04 . >>> drwxrwxr-x 3 root mail 512 Apr 9 00:04 .. >>> -r-xr-xr-x 1 root mail 4357 Apr 9 00:04 BinHex.pm >>> -r-xr-xr-x 1 root mail 104100 Apr 9 00:04 Config.pm >>> -r-xr-xr-x 1 root mail 22104 Apr 9 00:04 ConfigDefs.pl >>> -r-xr-xr-x 1 root mail 56745 Apr 9 00:04 CustomConfig.pm >>> drwxr-xr-x 2 root mail 512 Apr 9 00:04 CustomFunctions >>> -r-xr-xr-x 1 root mail 49221 Apr 9 00:04 Exim.pm >>> -r-xr-xr-x 1 root mail 17799 Apr 9 00:04 EximDiskStore.pm >>> -r-xr-xr-x 1 root mail 7772 Apr 9 00:04 GenericSpam.pm >>> -r-xr-xr-x 1 root mail 12821 Apr 9 00:04 Lock.pm >>> -r-xr-xr-x 1 root mail 5128 Apr 9 00:04 Log.pm >>> -r-xr-xr-x 1 root mail 17369 Apr 9 00:04 MCP.pm >>> -r-xr-xr-x 1 root mail 24524 Apr 9 00:04 MCPMessage.pm >>> -r-xr-xr-x 1 root mail 2992 Apr 9 00:04 Mail.pm >>> -r-xr-xr-x 1 root mail 273077 Apr 17 00:26 Message.pm >>> -r-xr-xr-x 1 root mail 38942 Apr 9 00:04 MessageBatch.pm >>> -r-xr-xr-x 1 root mail 27915 Apr 9 00:04 PFDiskStore.pm >>> -r-xr-xr-x 1 root mail 65287 Apr 9 00:04 Postfix.pm >>> -r-xr-xr-x 1 root mail 14565 Apr 9 00:04 QMDiskStore.pm >>> -r-xr-xr-x 1 root mail 28039 Apr 9 00:04 Qmail.pm >>> -r-xr-xr-x 1 root mail 8201 Apr 9 00:04 Quarantine.pm >>> -r-xr-xr-x 1 root mail 1695 Apr 9 00:04 Queue.pm >>> -r-xr-xr-x 1 root mail 9400 Apr 9 00:04 RBLs.pm >>> -r-xr-xr-x 1 root mail 44737 Apr 9 00:04 SA.pm >>> -r-xr-xr-x 1 root mail 19245 Apr 9 00:04 SMDiskStore.pm >>> -r-xr-xr-x 1 root mail 38114 Apr 9 00:04 Sendmail.pm >>> -r-xr-xr-x 1 root mail 30229 Apr 9 00:04 SweepContent.pm >>> -r-xr-xr-x 1 root mail 27660 Apr 9 00:04 SweepOther.pm >>> -r-xr-xr-x 1 root mail 128436 Apr 9 00:04 SweepViruses.pm >>> -r-xr-xr-x 1 root mail 1446 Apr 9 00:04 SystemDefs.pm >>> -r-xr-xr-x 1 root mail 11895 Apr 9 00:04 TNEF.pm >>> -r-xr-xr-x 1 root mail 9840 Apr 9 00:04 WorkArea.pm >>> -r-xr-xr-x 1 root mail 15231 Apr 9 00:04 ZMDiskStore.pm >>> -r-xr-xr-x 1 root mail 33755 Apr 9 00:04 ZMailer.pm >>> >>> ------------------------------- >>> ngthcm# /usr/local/sbin/mailscanner -v >>> ]Running on >>> FreeBSD ngthcm 7.1-RELEASE FreeBSD 7.1-RELEASE #0: Thu Jan 1 14:37:25 >>> UTC 2009 root@logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC >>> i386 >>> This is Perl version 5.008009 (5.8.9) >>> >>> This is MailScanner version 4.67.6 >>> Module versions are: >>> 1.00 AnyDBM_File >>> 1.26 Archive::Zip >>> 1.10 Carp >>> 2.015 Compress::Zlib >>> 1.119 Convert::BinHex >>> 2.27 Date::Parse >>> 1.02 DirHandle >>> 1.06 Fcntl >>> 2.77 File::Basename >>> 2.13 File::Copy >>> 2.01 FileHandle >>> 2.07_02 File::Path >>> 0.21 File::Temp >>> 0.92 Filesys::Df >>> 3.60 HTML::Entities >>> 3.60 HTML::Parser >>> 3.57 HTML::TokeParser >>> 1.23 IO >>> 1.14 IO::File >>> 1.13 IO::Pipe >>> 2.04 Mail::Header >>> 1.89 Math::BigInt >>> 3.07 MIME::Base64 >>> 5.427 MIME::Decoder >>> 5.427 MIME::Decoder::UU >>> 5.427 MIME::Head >>> 5.427 MIME::Parser >>> 3.07 MIME::QuotedPrint >>> 5.427 MIME::Tools >>> 0.13 Net::CIDR >>> 1.15 POSIX >>> 1.19 Scalar::Util >>> 1.81 Socket >>> 1.4 Sys::Hostname::Long >>> 0.27 Sys::Syslog >>> 1.9719 Time::HiRes >>> 1.02 Time::localtime >>> >>> Optional module versions are: >>> 1.46 Archive::Tar >>> 0.23 bignum >>> missing Business::ISBN >>> missing Business::ISBN::Data >>> missing Data::Dump >>> 1.817 DB_File >>> 1.14 DBD::SQLite >>> 1.607 DBI >>> 1.15 Digest >>> 1.01 Digest::HMAC >>> 2.37 Digest::MD5 >>> 2.11 Digest::SHA1 >>> 1.01 Encode::Detect >>> 0.17015 Error >>> 0.24 ExtUtils::CBuilder >>> 2.19 ExtUtils::ParseXS >>> 2.37 Getopt::Long >>> missing Inline >>> 1.08 IO::String >>> 1.09 IO::Zlib >>> missing IP::Country >>> missing Mail::ClamAV >>> 3.002005 Mail::SpamAssassin >>> v2.006 Mail::SPF >>> missing Mail::SPF::Query >>> 0.32 Module::Build >>> missing Net::CIDR::Lite >>> 0.65 Net::DNS >>> v0.003 Net::DNS::Resolver::Programmable >>> missing Net::LDAP >>> 4.024 NetAddr::IP >>> missing Parse::RecDescent >>> missing SAVI >>> 2.64 Test::Harness >>> missing Test::Manifest >>> 1.98 Text::Balanced >>> 1.37 URI >>> 0.76 version >>> 0.68 YAML >>> >>> >>> >>> >>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> >> >> -- >> Martin Hepworth >> Oxford, UK >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090418/6c46d38c/attachment.html From drew.marshall at trunknetworks.com Sat Apr 18 09:58:39 2009 From: drew.marshall at trunknetworks.com (Drew Marshall) Date: Sat Apr 18 09:58:55 2009 Subject: Postfix + MailScanner : Attachment Filename check problem !!!! In-Reply-To: <20090418052458.B676F1701E@out-b.mx.mail-launder.com> References: <72cf361e0904170858u6059d30nd1f68e9ecd580283@mail.gmail.com> <20090418052458.B676F1701E@out-b.mx.mail-launder.com> Message-ID: <200904180858.n3I8wljt027613@safir.blacknight.ie> *This message was transferred with a trial version of CommuniGate(r) Pro* On 18 Apr 2009, at 06:20, Man Ngoc wrote: > > Hi Martin! > Thanks for your reply, i will try as your idea, then will post > the results to u soon. Again, thanks for help! Or indeed go for 5.10.0, which might cause you less upgrade need in the future (It's in the ports tree). Drew From maillists at conactive.com Sat Apr 18 11:31:19 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Sat Apr 18 11:31:32 2009 Subject: spam trend - domains that don't exist? In-Reply-To: <49E9258A.9040208@pacific.net> References: <49E9258A.9040208@pacific.net> Message-ID: Ken A wrote on Fri, 17 Apr 2009 19:57:46 -0500: > Here's a small sample of the rejected domains: They are probably old harvested email addresses, where even the domain or subdomain (noe the many subdomains!) have long been gone. What I find strange is that many bots send non-existing domains in HELO's. Good for us, though. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From steve.freegard at fsl.com Sat Apr 18 11:53:47 2009 From: steve.freegard at fsl.com (Steve Freegard) Date: Sat Apr 18 11:53:58 2009 Subject: spam trend - domains that don't exist? In-Reply-To: References: <49E9258A.9040208@pacific.net> Message-ID: <49E9B13B.4000307@fsl.com> Kai Schaetzl wrote: > Ken A wrote on Fri, 17 Apr 2009 19:57:46 -0500: > >> Here's a small sample of the rejected domains: > > They are probably old harvested email addresses, where even the domain or > subdomain (noe the many subdomains!) have long been gone. Yep - not seeing that many here though: 214-2.0.0 070 mail-require-mx=7050 0.65% So .65% of all MAIL FROM's seen did not have a valid MX record (so the message could not be replied to) so these would be rejected. 214-2.0.0 071 mail-require-mx-error=22359 2.05% Although 2.05% got a DNS lookup error (e.g. dead or broken DNS servers) and these would therefore be tempfailed. > What I find strange is that many bots send non-existing domains in HELO's. You don't have to send a valid domain in a HELO as long as it isn't a bareword or a bare IP address (e.g. not a domain literal). Typically the hostname of the machine is used for the HELO argument, so you'll legitimately see things like 'host.domain.local' and 'host.office.lan' or other stuff due to internal DNS namespaces from Active Directory and the like leaking out via the HELO/EHLO. Top HELO's here: 2997 h="" <--- Hosts HELOing as my own hostname 782 h="localhost" 141 h="dsldevice.lan" 105 h="speedtouch.lan" Obviously all of these are blockable as they aren't legitimate hostnames for a remote mail server (e.g. the hostname is not going to be dsldevice.lan or speedtouch.lan; the bot is just using the domain name supplied by the DHCP service on these devices to evade detection within that network). Regards, Steve. From drew.marshall at trunknetworks.com Sat Apr 18 21:28:10 2009 From: drew.marshall at trunknetworks.com (Drew Marshall) Date: Sat Apr 18 21:28:30 2009 Subject: Mangled MIME Headers in plain text mail Message-ID: <200904182028.n3IKSMns017926@safir.blacknight.ie> *This message was transferred with a trial version of CommuniGate(r) Pro* This one has been causing me loads of grief now for a little while. I have tried all sorts of things such as using blank signatures but the plain text section of a HTML mail 'goes missing'. I thought it might have something to do with the fix that Jules rolled out in the latest beta caused by the Mail application in OS X but I am now running the latest beta and the problem has not gone. To explain more, it seems that plain text only mails are fine, processed, signature added and all is well. Combined HTML and plain text mail the HTML section is fine and as that is the default view of most mail clients, no problem. However, if you then view this mail in plain text such as you might on a blackberry or other mobile type device the actual message is not visible, only the clean mail signature. When I look at the the raw message, it is there but beneath the signature and (I am no expert in MIME formatting) seems to be set with a different structure that the signature and hence not visible to 'simple' clients (If you view the message in a half decent client, the message is visible under the signature). For example this is part of a raw message: ------_=_NextPart_6334_00018467.00000041 Content-Type: text/plain; charset="ISO-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable --=20 This message has been scanned for viruses and dangerous content by=20 the Mail Launder e-mail system. For more information please visit http://www.mail-launder.com=20 ------_=_NextPart_6334_00018467.00000041 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <-- The text from here is not visible in a plain text view --> I can't see any particular commonality in clients although I did originally think it was Thunderbird but Outlook also has been involved in mail that displays this problem. Prior to the current beta being installed, I did have one user who had her out bound mail (From Outlook) sent as plain text attachments with just the signature actually in the message. I haven't heard of any more of these but I guess most people don't get formatting feed back for mail they send :-) Any one else seeing this behaviour? Any ideas how it could be fixed? Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by our Mail Launder system www.mail-launder.com Our email policy can be found at www.trunknetworks.com/policy Trunk Networks Limited is registered in Scotland with registration number: 351063 Registered Office 55-57 West High Street Inverurie AB51 3QQ From maillists at conactive.com Sun Apr 19 01:31:16 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Sun Apr 19 01:31:28 2009 Subject: Mangled MIME Headers in plain text mail In-Reply-To: <200904182028.n3IKSMns017926@safir.blacknight.ie> References: <200904182028.n3IKSMns017926@safir.blacknight.ie> Message-ID: Drew Marshall wrote on Sat, 18 Apr 2009 21:28:10 +0100: > -- Please put a complete original message with all headers up on a pastebin. Please fix your signature divider (the divider is not "--", it's "-- ".) Please consider sparing us the "trail version" announcement in the near future. Thanks. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From JBracey at csuchico.edu Sun Apr 19 05:31:27 2009 From: JBracey at csuchico.edu (Bracey, John) Date: Sun Apr 19 05:32:10 2009 Subject: trouble installing mailscanner on freeBSD 6.2 server In-Reply-To: <200904170533.n3H5XkxQ001132@safir.blacknight.ie> References: <9ADE954C5044754C8E0BF406B5A217552DD2AD6E@ESCHE.csuchico.edu><20090417034520.D17261701A@out-b.mx.mail-launder.com> <200904170533.n3H5XkxQ001132@safir.blacknight.ie> Message-ID: <9ADE954C5044754C8E0BF406B5A217552DDE84A8@ESCHE.csuchico.edu> Alas, no joy. After installing Perl 5.10 and updating the perl modules, and installing the mailscanner-devel port, I get this now: [root@scooby /var/spool/mqueue.in]# mailscanner -debug -debug-sa /usr/local/etc/MailScanner/MailScanner.conf Variable "$FIELD_NAME" is not imported at /usr/local/lib/MailScanner/MailScanner/Message.pm line 6479. Variable "$FIELD_NAME" is not imported at /usr/local/lib/MailScanner/MailScanner/Message.pm line 6482. Global symbol "$FIELD_NAME" requires explicit package name at /usr/local/lib/MailScanner/MailScanner/Message.pm line 6479. Global symbol "$FIELD_NAME" requires explicit package name at /usr/local/lib/MailScanner/MailScanner/Message.pm line 6482. Compilation failed in require at /usr/local/sbin/mailscanner line 79. BEGIN failed--compilation aborted at /usr/local/sbin/mailscanner line 79. [root@scooby /var/spool/mqueue.in]# Any ideas? Or do I have this so screwed up there's no hope? Thanks. -John Bracey -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Drew Marshall Sent: Thursday, April 16, 2009 10:34 PM To: MailScanner discussion Subject: Re: trouble installing mailscanner on freeBSD 6.2 server *This message was transferred with a trial version of CommuniGate(r) Pro* On 17 Apr 2009, at 04:41, Bracey, John wrote: > here's what is recorded in /var/log/messages when the process dies: > > Apr 16 20:40:38 scooby kernel: pid 10382 (perl5.8.9), uid 0: exited on > signal 6 > > Any ideas welcome. Looks like with your to'ings and fro'ings with perl you have your modules in a right mess. If you don't mind being a little more cutting edge, I would pkg_delete perl-5.8 and/or 5.9, then cd /usr/ports/lang/ perl5.10 and install that (It's the future ;-) ). Then (Because I have never been that successful with the perl module move/ upgrade script) cd /var/db/pkg and (Assuming you have portupgrade or similar installed) portupgrade -f p5* pecl* and let it do it's thing for a while. Once that's finished, you should have perl with it's modules all in the same place. Once that's done, install the latest MS beta which works properly with perl 5.10 (I posted my own MS port file a week or so ago that will do it). Drew -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From drew.marshall at trunknetworks.com Sun Apr 19 09:00:50 2009 From: drew.marshall at trunknetworks.com (Drew Marshall) Date: Sun Apr 19 09:01:09 2009 Subject: trouble installing mailscanner on freeBSD 6.2 server In-Reply-To: <20090419043629.482241701E@out-b.mx.mail-launder.com> References: <9ADE954C5044754C8E0BF406B5A217552DD2AD6E@ESCHE.csuchico.edu><20090417034520.D17261701A@out-b.mx.mail-launder.com> <200904170533.n3H5XkxQ001132@safir.blacknight.ie> <20090419043629.482241701E@out-b.mx.mail-launder.com> Message-ID: <200904190801.n3J810Sv031612@safir.blacknight.ie> -- In line with our policy, this message has been scanned for viruses and dangerous content by our Mail Launder system www.mail-launder.com Our email policy can be found at www.trunknetworks.com/policy Trunk Networks Limited is registered in Scotland with registration number: 351063 Registered Office 55-57 West High Street Inverurie AB51 3QQ -------------- next part -------------- On 19 Apr 2009, at 05:31, Bracey, John wrote: > Alas, no joy. After installing Perl 5.10 and updating the perl > modules, and installing the mailscanner-devel port, I get this now: If you are running the stock mailscanner-devel port then it won't work as that is even older than the mail mailscanner port. Try the attached, over write /usr/ports/mailscanner, remove your existing installation and reinstall. Drew -------------- next part -------------- A non-text attachment was scrubbed... Name: mailscanner.tar.gz Type: application/x-gzip Size: 14019 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090419/7096bed0/mailscanner.tar.gz From drew.marshall at trunknetworks.com Sun Apr 19 09:14:15 2009 From: drew.marshall at trunknetworks.com (Drew Marshall) Date: Sun Apr 19 09:14:31 2009 Subject: Mangled MIME Headers in plain text mail In-Reply-To: <20090419003627.7647317008@out-b.mx.mail-launder.com> References: <200904182028.n3IKSMns017926@safir.blacknight.ie> <20090419003627.7647317008@out-b.mx.mail-launder.com> Message-ID: <200904190814.n3J8ENa6032550@safir.blacknight.ie> *This message was transferred with a trial version of CommuniGate(r) Pro* On 19 Apr 2009, at 01:31, Kai Schaetzl wrote: > Please put a complete original message with all headers up on a > pastebin. Im not sure that's going to be necessary, my last post to list came over mangled. Check where my signature lands up. If it's above this text then it's happened again... > Please fix your signature divider (the divider is not "--", it's > "-- ".) Hmm, thought it was. I have checked and recreated, so let see if it makes a difference... > Please consider sparing us the "trail version" announcement in the > near > future. Thanks. How I would love to. They sent me the new licences yesterday but they are wrong so it's not going any where for a couple of days :-( Drew From what.why.how.2009 at gmail.com Sun Apr 19 09:57:55 2009 From: what.why.how.2009 at gmail.com (Man Ngoc) Date: Sun Apr 19 09:58:04 2009 Subject: Postfix + MailScanner : Attachment Filename check problem !!!! In-Reply-To: <13c7d1a60904172220o5b448f47na03262c51f729630@mail.gmail.com> References: <72cf361e0904170858u6059d30nd1f68e9ecd580283@mail.gmail.com> <13c7d1a60904172220o5b448f47na03262c51f729630@mail.gmail.com> Message-ID: <13c7d1a60904190157n5e29f5cfna203983b2ac3ca25@mail.gmail.com> Hi! I deinstall the port perl 5.8.9, and then installed the port perl-5.10.0. Then i also reinstall MailScanner. the installation process is completely successful. Then i run the command: *# /usr/local/sbin/mailscanner --lint* It print out the results as below: *IO::Compress::Base::Common version 2.015 required--this is only version 2.008 at /usr/local/lib/perl5/site_perl/5.10.0/Compress/Zlib.pm line 11. BEGIN failed--compilation aborted at /usr/local/lib/perl5/site_perl/5.10.0/Compress/Zlib.pm line 11. Compilation failed in require at /usr/local/lib/perl5/site_perl/5.10.0/Archive/Zip.pm line 11. BEGIN failed--compilation aborted at /usr/local/lib/perl5/site_perl/5.10.0/Archive/Zip.pm line 11. Compilation failed in require at /usr/local/lib/MailScanner/MailScanner/Message.pm line 48. BEGIN failed--compilation aborted at /usr/local/lib/MailScanner/MailScanner/Message.pm line 48. Compilation failed in require at /usr/local/sbin/mailscanner line 80. BEGIN failed--compilation aborted at /usr/local/sbin/mailscanner line 80.* What is the problem? please help me! Thanks a lot! On Sat, Apr 18, 2009 at 12:20 PM, Man Ngoc wrote: > > Hi Martin! > Thanks for your reply, i will try as your idea, then will post the > results to u soon. Again, thanks for help! > > > On Fri, Apr 17, 2009 at 10:58 PM, Martin Hepworth wrote: >> >>> Seems there's problems with perl 5.8.9 on FreeBSD - see earlier posts on >>> installing 5.8.8 from the ports system and using that instead. >>> >>> 2009/4/17 M?n T? Ng?c >>> >>>> Hi everyone! >>>> >>>> I have setup an email system use: Postfix + MailScanner 4.67.6 (with >>>> Perl version 5.008009 (5.8.9)) On FreeBSD 7.1-RELEASE >>>> >>>> Postfix run as user postfix >>>> MailScanner run as user postfix >>>> >>>> I config my Mailscanner to deny all attachments which have the >>>> filename is .exe or .com >>>> >>>> Then I test it by sending an email include the attachment which have >>>> the name is ATF-cleaner.exe, >>>> but the MailScanner have problem when check the attachment, >>>> MailScanner report that File checker failed with real error, >>>> please see the log file below for more information >>>> >>>> but if i config MailScanner to run as user root then everything is >>>> OK, >>>> but i really don't want to allow MailScanner to run as user root. >>>> >>>> I post all my log file results, and all required information to debug >>>> below. >>>> >>>> Please help me! >>>> Thanks! >>>> >>>> ------------------------ >>>> in my /etc/passwd: I have user root, postfix, clamav, spamd >>>> in my /etc/group: >>>> user root is the owner of group wheel >>>> user postfix, clamav, spamd are the members of group mail >>>> >>>> ------------------------- >>>> /var/log/mailog -> MailScanner Log result: >>>> >>>> Apr 17 11:46:40 ngthcm MailScanner[99877]: MailScanner E-Mail Virus >>>> Scanner version 4.67.6 starting... >>>> Apr 17 11:46:40 ngthcm MailScanner[99877]: Could not read Custom >>>> Functions directory >>>> Apr 17 11:46:40 ngthcm MailScanner[99877]: Read 814 hostnames from the >>>> phishing whitelist >>>> Apr 17 11:46:40 ngthcm MailScanner[99877]: Read 5511 hostnames from the >>>> phishing blacklist >>>> Apr 17 11:46:40 ngthcm MailScanner[99877]: SpamAssassin temporary >>>> working directory is /var/spool/MailScanner/incomingwork/SpamAssassin-Temp >>>> Apr 17 11:46:40 ngthcm MailScanner[99877]: Using SpamAssassin results >>>> cache >>>> Apr 17 11:46:40 ngthcm MailScanner[99877]: Connected to SpamAssassin >>>> cache database >>>> Apr 17 11:46:40 ngthcm MailScanner[99877]: Enabling SpamAssassin >>>> auto-whitelist functionality... >>>> Apr 17 11:46:43 ngthcm MailScanner[99863]: Using locktype = flock >>>> Apr 17 11:46:43 ngthcm MailScanner[99863]: New Batch: Scanning 1 >>>> messages, 72921 bytes >>>> Apr 17 11:46:43 ngthcm MailScanner[99863]: SpamAssassin cache hit for >>>> message AB0264AC26.475FA >>>> Apr 17 11:46:43 ngthcm MailScanner[99881]: SafePipe in Message.pm : >>>> /usr/local/bin/unrar v -p- >>>> '/var/spool/MailScanner/incomingwork/99863/AB0264AC26.475FA/ATF-Cleaner.exe' >>>> 2>&1 failed with real error: Insecure dependency in exec while running with >>>> -T switch at /usr/local/lib/MailScanner/MailScanner/Message.pm line 2888. >>>> Apr 17 11:46:43 ngthcm MailScanner[99881]: Virus and Content Scanning: >>>> Starting >>>> Apr 17 11:46:44 ngthcm MailScanner[99881]: Filename Checks: >>>> (AB0264AC26.475FA ATF-Cleaner.exe) >>>> Apr 17 11:46:44 ngthcm MailScanner[99883]: File checker failed with real >>>> error: Insecure dependency in exec while running with -T switch at >>>> /usr/local/lib/MailScanner/MailScanner/SweepOther.pm line 356. >>>> >>>> >>>> ------------------------ >>>> /usr/local/etc/MailScanner/MailScanner.conf : >>>> >>>> # Configuration directory containing this file >>>> %etc-dir% = /usr/local/etc/MailScanner >>>> >>>> # Set the directory containing all the reports in the required language >>>> %report-dir% = /usr/local/etc/MailScanner/reports/en >>>> >>>> # Rulesets directory containing your ".rules" files >>>> %rules-dir% = /usr/local/etc/MailScanner/rules >>>> >>>> Run As User = postfix >>>> Run As Group = mail >>>> Queue Scan Interval = 6 >>>> Incoming Queue Dir = /var/spool/postfix/hold >>>> Outgoing Queue Dir = /var/spool/postfix/incoming >>>> Run As User = postfix >>>> Run As Group = mail >>>> Incoming Work Dir = /var/spool/MailScanner/incomingwork >>>> Quarantine Dir = /var/spool/MailScanner/quarantine >>>> Incoming Work User = >>>> InComing Work Group = >>>> Incoming Work Permissions = 0660 >>>> Quarantine User = >>>> Quarantine Group = >>>> Quarantine Permissions = 0660 >>>> Allow Filenames = >>>> Deny Filenames = >>>> Filenames Rules = %etc-dir%/filename.rules.conf >>>> >>>> ----------- >>>> /usr/local/etc/MailScanner/filename.rules.conf >>>> >>>> # These 2 added by popular demand - Very often used by viruses >>>> deny \.com$ Windows/DOS Executable >>>> deny \.exe$ Windows/DOS Executable >>>> >>>> ------------- >>>> ngthcm# ls -l /var/spool/ >>>> drwxrwxr-x 6 postfix mail 512 Apr 17 12:01 MailScanner >>>> drwxrwxr-x 17 root mail 512 Apr 16 16:38 postfix >>>> >>>> ngthcm# ls -l /var/spool/MailScanner/ >>>> -rw------- 1 postfix mail 10240 Apr 17 12:02 SpamAssassin.cache.db >>>> drwxrwxr-x 11 postfix mail 512 Apr 17 12:02 incomingwork >>>> drwxrwxr-x 2 postfix mail 512 Apr 17 12:02 lockfile-dir >>>> drwxrwxr-x 2 postfix mail 512 Apr 13 15:26 quarantine >>>> drwxrwxr-x 2 postfix mail 512 Apr 16 12:42 spamassassin >>>> >>>> ngthcm# ls -l /var/spool/postfix/ >>>> drwx------ 2 postfix mail 512 Apr 17 03:01 .spamassassin >>>> drwxrwxr-x 2 postfix mail 512 Apr 17 11:23 active >>>> drwxrwxr-x 2 postfix mail 512 Apr 17 11:23 bounce >>>> drwxrwxr-x 2 postfix mail 512 Feb 18 18:06 corrupt >>>> drwxrwxr-x 14 postfix mail 512 Apr 9 23:28 defer >>>> drwxrwxr-x 14 postfix mail 512 Apr 9 23:28 deferred >>>> drwxrwxr-x 2 postfix mail 512 Feb 18 18:06 flush >>>> drwxrwxr-x 2 postfix mail 512 Apr 17 11:25 hold >>>> drwxrwxr-x 2 postfix mail 512 Apr 17 11:25 incoming >>>> drwxrwxr-x 2 postfix maildrop 512 Apr 17 03:01 maildrop >>>> drwxrwxr-x 2 root mail 512 Apr 6 01:14 pid >>>> drwxrwxr-x 2 postfix mail 512 Apr 17 11:38 private >>>> drwxrwxr-x 2 postfix maildrop 512 Apr 17 11:38 public >>>> drwxrwxr-x 2 postfix mail 512 Feb 18 18:06 saved >>>> drwxrwxr-x 2 postfix mail 512 Feb 18 18:06 trace >>>> >>>> ngthcm# ls -la /usr/local/lib/MailScanner/MailScanner >>>> drwxrwxr-x 3 root mail 1024 Apr 9 00:04 . >>>> drwxrwxr-x 3 root mail 512 Apr 9 00:04 .. >>>> -r-xr-xr-x 1 root mail 4357 Apr 9 00:04 BinHex.pm >>>> -r-xr-xr-x 1 root mail 104100 Apr 9 00:04 Config.pm >>>> -r-xr-xr-x 1 root mail 22104 Apr 9 00:04 ConfigDefs.pl >>>> -r-xr-xr-x 1 root mail 56745 Apr 9 00:04 CustomConfig.pm >>>> drwxr-xr-x 2 root mail 512 Apr 9 00:04 CustomFunctions >>>> -r-xr-xr-x 1 root mail 49221 Apr 9 00:04 Exim.pm >>>> -r-xr-xr-x 1 root mail 17799 Apr 9 00:04 EximDiskStore.pm >>>> -r-xr-xr-x 1 root mail 7772 Apr 9 00:04 GenericSpam.pm >>>> -r-xr-xr-x 1 root mail 12821 Apr 9 00:04 Lock.pm >>>> -r-xr-xr-x 1 root mail 5128 Apr 9 00:04 Log.pm >>>> -r-xr-xr-x 1 root mail 17369 Apr 9 00:04 MCP.pm >>>> -r-xr-xr-x 1 root mail 24524 Apr 9 00:04 MCPMessage.pm >>>> -r-xr-xr-x 1 root mail 2992 Apr 9 00:04 Mail.pm >>>> -r-xr-xr-x 1 root mail 273077 Apr 17 00:26 Message.pm >>>> -r-xr-xr-x 1 root mail 38942 Apr 9 00:04 MessageBatch.pm >>>> -r-xr-xr-x 1 root mail 27915 Apr 9 00:04 PFDiskStore.pm >>>> -r-xr-xr-x 1 root mail 65287 Apr 9 00:04 Postfix.pm >>>> -r-xr-xr-x 1 root mail 14565 Apr 9 00:04 QMDiskStore.pm >>>> -r-xr-xr-x 1 root mail 28039 Apr 9 00:04 Qmail.pm >>>> -r-xr-xr-x 1 root mail 8201 Apr 9 00:04 Quarantine.pm >>>> -r-xr-xr-x 1 root mail 1695 Apr 9 00:04 Queue.pm >>>> -r-xr-xr-x 1 root mail 9400 Apr 9 00:04 RBLs.pm >>>> -r-xr-xr-x 1 root mail 44737 Apr 9 00:04 SA.pm >>>> -r-xr-xr-x 1 root mail 19245 Apr 9 00:04 SMDiskStore.pm >>>> -r-xr-xr-x 1 root mail 38114 Apr 9 00:04 Sendmail.pm >>>> -r-xr-xr-x 1 root mail 30229 Apr 9 00:04 SweepContent.pm >>>> -r-xr-xr-x 1 root mail 27660 Apr 9 00:04 SweepOther.pm >>>> -r-xr-xr-x 1 root mail 128436 Apr 9 00:04 SweepViruses.pm >>>> -r-xr-xr-x 1 root mail 1446 Apr 9 00:04 SystemDefs.pm >>>> -r-xr-xr-x 1 root mail 11895 Apr 9 00:04 TNEF.pm >>>> -r-xr-xr-x 1 root mail 9840 Apr 9 00:04 WorkArea.pm >>>> -r-xr-xr-x 1 root mail 15231 Apr 9 00:04 ZMDiskStore.pm >>>> -r-xr-xr-x 1 root mail 33755 Apr 9 00:04 ZMailer.pm >>>> >>>> ------------------------------- >>>> ngthcm# /usr/local/sbin/mailscanner -v >>>> ]Running on >>>> FreeBSD ngthcm 7.1-RELEASE FreeBSD 7.1-RELEASE #0: Thu Jan 1 14:37:25 >>>> UTC 2009 root@logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC >>>> i386 >>>> This is Perl version 5.008009 (5.8.9) >>>> >>>> This is MailScanner version 4.67.6 >>>> Module versions are: >>>> 1.00 AnyDBM_File >>>> 1.26 Archive::Zip >>>> 1.10 Carp >>>> 2.015 Compress::Zlib >>>> 1.119 Convert::BinHex >>>> 2.27 Date::Parse >>>> 1.02 DirHandle >>>> 1.06 Fcntl >>>> 2.77 File::Basename >>>> 2.13 File::Copy >>>> 2.01 FileHandle >>>> 2.07_02 File::Path >>>> 0.21 File::Temp >>>> 0.92 Filesys::Df >>>> 3.60 HTML::Entities >>>> 3.60 HTML::Parser >>>> 3.57 HTML::TokeParser >>>> 1.23 IO >>>> 1.14 IO::File >>>> 1.13 IO::Pipe >>>> 2.04 Mail::Header >>>> 1.89 Math::BigInt >>>> 3.07 MIME::Base64 >>>> 5.427 MIME::Decoder >>>> 5.427 MIME::Decoder::UU >>>> 5.427 MIME::Head >>>> 5.427 MIME::Parser >>>> 3.07 MIME::QuotedPrint >>>> 5.427 MIME::Tools >>>> 0.13 Net::CIDR >>>> 1.15 POSIX >>>> 1.19 Scalar::Util >>>> 1.81 Socket >>>> 1.4 Sys::Hostname::Long >>>> 0.27 Sys::Syslog >>>> 1.9719 Time::HiRes >>>> 1.02 Time::localtime >>>> >>>> Optional module versions are: >>>> 1.46 Archive::Tar >>>> 0.23 bignum >>>> missing Business::ISBN >>>> missing Business::ISBN::Data >>>> missing Data::Dump >>>> 1.817 DB_File >>>> 1.14 DBD::SQLite >>>> 1.607 DBI >>>> 1.15 Digest >>>> 1.01 Digest::HMAC >>>> 2.37 Digest::MD5 >>>> 2.11 Digest::SHA1 >>>> 1.01 Encode::Detect >>>> 0.17015 Error >>>> 0.24 ExtUtils::CBuilder >>>> 2.19 ExtUtils::ParseXS >>>> 2.37 Getopt::Long >>>> missing Inline >>>> 1.08 IO::String >>>> 1.09 IO::Zlib >>>> missing IP::Country >>>> missing Mail::ClamAV >>>> 3.002005 Mail::SpamAssassin >>>> v2.006 Mail::SPF >>>> missing Mail::SPF::Query >>>> 0.32 Module::Build >>>> missing Net::CIDR::Lite >>>> 0.65 Net::DNS >>>> v0.003 Net::DNS::Resolver::Programmable >>>> missing Net::LDAP >>>> 4.024 NetAddr::IP >>>> missing Parse::RecDescent >>>> missing SAVI >>>> 2.64 Test::Harness >>>> missing Test::Manifest >>>> 1.98 Text::Balanced >>>> 1.37 URI >>>> 0.76 version >>>> 0.68 YAML >>>> >>>> >>>> >>>> >>>> >>>> -- >>>> MailScanner mailing list >>>> mailscanner@lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>> >>> >>> -- >>> Martin Hepworth >>> Oxford, UK >>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >>> > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090419/45b30f67/attachment.html From what.why.how.2009 at gmail.com Sun Apr 19 10:10:40 2009 From: what.why.how.2009 at gmail.com (Man Ngoc) Date: Sun Apr 19 10:10:50 2009 Subject: Postfix + MailScanner : Attachment Filename check problem !!!! In-Reply-To: <13c7d1a60904190157n5e29f5cfna203983b2ac3ca25@mail.gmail.com> References: <72cf361e0904170858u6059d30nd1f68e9ecd580283@mail.gmail.com> <13c7d1a60904172220o5b448f47na03262c51f729630@mail.gmail.com> <13c7d1a60904190157n5e29f5cfna203983b2ac3ca25@mail.gmail.com> Message-ID: <13c7d1a60904190210l4eeb01a9gc2095a22bf576126@mail.gmail.com> Hi! I deinstall the port perl 5.8.9, and then installed the port perl-5.10.0. Then i also reinstall MailScanner. the installation process is completely successful. Then i run the command: *# /usr/local/sbin/mailscanner --lint* It print out the results as below: *IO::Compress::Base::Common version 2.015 required--this is only version 2.008 at /usr/local/lib/perl5/site_perl/5.10.0/Compress/Zlib.pm line 11. BEGIN failed--compilation aborted at /usr/local/lib/perl5/site_perl/5.10.0/Compress/Zlib.pm line 11. Compilation failed in require at /usr/local/lib/perl5/site_perl/5.10.0/Archive/Zip.pm line 11. BEGIN failed--compilation aborted at /usr/local/lib/perl5/site_perl/5.10.0/Archive/Zip.pm line 11. Compilation failed in require at /usr/local/lib/MailScanner/MailScanner/Message.pm line 48. BEGIN failed--compilation aborted at /usr/local/lib/MailScanner/MailScanner/Message.pm line 48. Compilation failed in require at /usr/local/sbin/mailscanner line 80. BEGIN failed--compilation aborted at /usr/local/sbin/mailscanner line 80.* What is the problem? please help me! Thanks a lot! On Sat, Apr 18, 2009 at 12:20 PM, Man Ngoc wrote: > > Hi Martin! > Thanks for your reply, i will try as your idea, then will post the > results to u soon. Again, thanks for help! > > > On Fri, Apr 17, 2009 at 10:58 PM, Martin Hepworth wrote: >> >>> Seems there's problems with perl 5.8.9 on FreeBSD - see earlier posts on >>> installing 5.8.8 from the ports system and using that instead. >>> >>> 2009/4/17 M?n T? Ng?c >>> >>>> Hi everyone! >>>> >>>> I have setup an email system use: Postfix + MailScanner 4.67.6 (with >>>> Perl version 5.008009 (5.8.9)) On FreeBSD 7.1-RELEASE >>>> >>>> Postfix run as user postfix >>>> MailScanner run as user postfix >>>> >>>> I config my Mailscanner to deny all attachments which have the >>>> filename is .exe or .com >>>> >>>> Then I test it by sending an email include the attachment which have >>>> the name is ATF-cleaner.exe, >>>> but the MailScanner have problem when check the attachment, >>>> MailScanner report that File checker failed with real error, >>>> please see the log file below for more information >>>> >>>> but if i config MailScanner to run as user root then everything is >>>> OK, >>>> but i really don't want to allow MailScanner to run as user root. >>>> >>>> I post all my log file results, and all required information to debug >>>> below. >>>> >>>> Please help me! >>>> Thanks! >>>> >>>> ------------------------ >>>> in my /etc/passwd: I have user root, postfix, clamav, spamd >>>> in my /etc/group: >>>> user root is the owner of group wheel >>>> user postfix, clamav, spamd are the members of group mail >>>> >>>> ------------------------- >>>> /var/log/mailog -> MailScanner Log result: >>>> >>>> Apr 17 11:46:40 ngthcm MailScanner[99877]: MailScanner E-Mail Virus >>>> Scanner version 4.67.6 starting... >>>> Apr 17 11:46:40 ngthcm MailScanner[99877]: Could not read Custom >>>> Functions directory >>>> Apr 17 11:46:40 ngthcm MailScanner[99877]: Read 814 hostnames from the >>>> phishing whitelist >>>> Apr 17 11:46:40 ngthcm MailScanner[99877]: Read 5511 hostnames from the >>>> phishing blacklist >>>> Apr 17 11:46:40 ngthcm MailScanner[99877]: SpamAssassin temporary >>>> working directory is /var/spool/MailScanner/incomingwork/SpamAssassin-Temp >>>> Apr 17 11:46:40 ngthcm MailScanner[99877]: Using SpamAssassin results >>>> cache >>>> Apr 17 11:46:40 ngthcm MailScanner[99877]: Connected to SpamAssassin >>>> cache database >>>> Apr 17 11:46:40 ngthcm MailScanner[99877]: Enabling SpamAssassin >>>> auto-whitelist functionality... >>>> Apr 17 11:46:43 ngthcm MailScanner[99863]: Using locktype = flock >>>> Apr 17 11:46:43 ngthcm MailScanner[99863]: New Batch: Scanning 1 >>>> messages, 72921 bytes >>>> Apr 17 11:46:43 ngthcm MailScanner[99863]: SpamAssassin cache hit for >>>> message AB0264AC26.475FA >>>> Apr 17 11:46:43 ngthcm MailScanner[99881]: SafePipe in Message.pm : >>>> /usr/local/bin/unrar v -p- >>>> '/var/spool/MailScanner/incomingwork/99863/AB0264AC26.475FA/ATF-Cleaner.exe' >>>> 2>&1 failed with real error: Insecure dependency in exec while running with >>>> -T switch at /usr/local/lib/MailScanner/MailScanner/Message.pm line 2888. >>>> Apr 17 11:46:43 ngthcm MailScanner[99881]: Virus and Content Scanning: >>>> Starting >>>> Apr 17 11:46:44 ngthcm MailScanner[99881]: Filename Checks: >>>> (AB0264AC26.475FA ATF-Cleaner.exe) >>>> Apr 17 11:46:44 ngthcm MailScanner[99883]: File checker failed with real >>>> error: Insecure dependency in exec while running with -T switch at >>>> /usr/local/lib/MailScanner/MailScanner/SweepOther.pm line 356. >>>> >>>> >>>> ------------------------ >>>> /usr/local/etc/MailScanner/MailScanner.conf : >>>> >>>> # Configuration directory containing this file >>>> %etc-dir% = /usr/local/etc/MailScanner >>>> >>>> # Set the directory containing all the reports in the required language >>>> %report-dir% = /usr/local/etc/MailScanner/reports/en >>>> >>>> # Rulesets directory containing your ".rules" files >>>> %rules-dir% = /usr/local/etc/MailScanner/rules >>>> >>>> Run As User = postfix >>>> Run As Group = mail >>>> Queue Scan Interval = 6 >>>> Incoming Queue Dir = /var/spool/postfix/hold >>>> Outgoing Queue Dir = /var/spool/postfix/incoming >>>> Run As User = postfix >>>> Run As Group = mail >>>> Incoming Work Dir = /var/spool/MailScanner/incomingwork >>>> Quarantine Dir = /var/spool/MailScanner/quarantine >>>> Incoming Work User = >>>> InComing Work Group = >>>> Incoming Work Permissions = 0660 >>>> Quarantine User = >>>> Quarantine Group = >>>> Quarantine Permissions = 0660 >>>> Allow Filenames = >>>> Deny Filenames = >>>> Filenames Rules = %etc-dir%/filename.rules.conf >>>> >>>> ----------- >>>> /usr/local/etc/MailScanner/filename.rules.conf >>>> >>>> # These 2 added by popular demand - Very often used by viruses >>>> deny \.com$ Windows/DOS Executable >>>> deny \.exe$ Windows/DOS Executable >>>> >>>> ------------- >>>> ngthcm# ls -l /var/spool/ >>>> drwxrwxr-x 6 postfix mail 512 Apr 17 12:01 MailScanner >>>> drwxrwxr-x 17 root mail 512 Apr 16 16:38 postfix >>>> >>>> ngthcm# ls -l /var/spool/MailScanner/ >>>> -rw------- 1 postfix mail 10240 Apr 17 12:02 SpamAssassin.cache.db >>>> drwxrwxr-x 11 postfix mail 512 Apr 17 12:02 incomingwork >>>> drwxrwxr-x 2 postfix mail 512 Apr 17 12:02 lockfile-dir >>>> drwxrwxr-x 2 postfix mail 512 Apr 13 15:26 quarantine >>>> drwxrwxr-x 2 postfix mail 512 Apr 16 12:42 spamassassin >>>> >>>> ngthcm# ls -l /var/spool/postfix/ >>>> drwx------ 2 postfix mail 512 Apr 17 03:01 .spamassassin >>>> drwxrwxr-x 2 postfix mail 512 Apr 17 11:23 active >>>> drwxrwxr-x 2 postfix mail 512 Apr 17 11:23 bounce >>>> drwxrwxr-x 2 postfix mail 512 Feb 18 18:06 corrupt >>>> drwxrwxr-x 14 postfix mail 512 Apr 9 23:28 defer >>>> drwxrwxr-x 14 postfix mail 512 Apr 9 23:28 deferred >>>> drwxrwxr-x 2 postfix mail 512 Feb 18 18:06 flush >>>> drwxrwxr-x 2 postfix mail 512 Apr 17 11:25 hold >>>> drwxrwxr-x 2 postfix mail 512 Apr 17 11:25 incoming >>>> drwxrwxr-x 2 postfix maildrop 512 Apr 17 03:01 maildrop >>>> drwxrwxr-x 2 root mail 512 Apr 6 01:14 pid >>>> drwxrwxr-x 2 postfix mail 512 Apr 17 11:38 private >>>> drwxrwxr-x 2 postfix maildrop 512 Apr 17 11:38 public >>>> drwxrwxr-x 2 postfix mail 512 Feb 18 18:06 saved >>>> drwxrwxr-x 2 postfix mail 512 Feb 18 18:06 trace >>>> >>>> ngthcm# ls -la /usr/local/lib/MailScanner/MailScanner >>>> drwxrwxr-x 3 root mail 1024 Apr 9 00:04 . >>>> drwxrwxr-x 3 root mail 512 Apr 9 00:04 .. >>>> -r-xr-xr-x 1 root mail 4357 Apr 9 00:04 BinHex.pm >>>> -r-xr-xr-x 1 root mail 104100 Apr 9 00:04 Config.pm >>>> -r-xr-xr-x 1 root mail 22104 Apr 9 00:04 ConfigDefs.pl >>>> -r-xr-xr-x 1 root mail 56745 Apr 9 00:04 CustomConfig.pm >>>> drwxr-xr-x 2 root mail 512 Apr 9 00:04 CustomFunctions >>>> -r-xr-xr-x 1 root mail 49221 Apr 9 00:04 Exim.pm >>>> -r-xr-xr-x 1 root mail 17799 Apr 9 00:04 EximDiskStore.pm >>>> -r-xr-xr-x 1 root mail 7772 Apr 9 00:04 GenericSpam.pm >>>> -r-xr-xr-x 1 root mail 12821 Apr 9 00:04 Lock.pm >>>> -r-xr-xr-x 1 root mail 5128 Apr 9 00:04 Log.pm >>>> -r-xr-xr-x 1 root mail 17369 Apr 9 00:04 MCP.pm >>>> -r-xr-xr-x 1 root mail 24524 Apr 9 00:04 MCPMessage.pm >>>> -r-xr-xr-x 1 root mail 2992 Apr 9 00:04 Mail.pm >>>> -r-xr-xr-x 1 root mail 273077 Apr 17 00:26 Message.pm >>>> -r-xr-xr-x 1 root mail 38942 Apr 9 00:04 MessageBatch.pm >>>> -r-xr-xr-x 1 root mail 27915 Apr 9 00:04 PFDiskStore.pm >>>> -r-xr-xr-x 1 root mail 65287 Apr 9 00:04 Postfix.pm >>>> -r-xr-xr-x 1 root mail 14565 Apr 9 00:04 QMDiskStore.pm >>>> -r-xr-xr-x 1 root mail 28039 Apr 9 00:04 Qmail.pm >>>> -r-xr-xr-x 1 root mail 8201 Apr 9 00:04 Quarantine.pm >>>> -r-xr-xr-x 1 root mail 1695 Apr 9 00:04 Queue.pm >>>> -r-xr-xr-x 1 root mail 9400 Apr 9 00:04 RBLs.pm >>>> -r-xr-xr-x 1 root mail 44737 Apr 9 00:04 SA.pm >>>> -r-xr-xr-x 1 root mail 19245 Apr 9 00:04 SMDiskStore.pm >>>> -r-xr-xr-x 1 root mail 38114 Apr 9 00:04 Sendmail.pm >>>> -r-xr-xr-x 1 root mail 30229 Apr 9 00:04 SweepContent.pm >>>> -r-xr-xr-x 1 root mail 27660 Apr 9 00:04 SweepOther.pm >>>> -r-xr-xr-x 1 root mail 128436 Apr 9 00:04 SweepViruses.pm >>>> -r-xr-xr-x 1 root mail 1446 Apr 9 00:04 SystemDefs.pm >>>> -r-xr-xr-x 1 root mail 11895 Apr 9 00:04 TNEF.pm >>>> -r-xr-xr-x 1 root mail 9840 Apr 9 00:04 WorkArea.pm >>>> -r-xr-xr-x 1 root mail 15231 Apr 9 00:04 ZMDiskStore.pm >>>> -r-xr-xr-x 1 root mail 33755 Apr 9 00:04 ZMailer.pm >>>> >>>> ------------------------------- >>>> ngthcm# /usr/local/sbin/mailscanner -v >>>> ]Running on >>>> FreeBSD ngthcm 7.1-RELEASE FreeBSD 7.1-RELEASE #0: Thu Jan 1 14:37:25 >>>> UTC 2009 root@logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC >>>> i386 >>>> This is Perl version 5.008009 (5.8.9) >>>> >>>> This is MailScanner version 4.67.6 >>>> Module versions are: >>>> 1.00 AnyDBM_File >>>> 1.26 Archive::Zip >>>> 1.10 Carp >>>> 2.015 Compress::Zlib >>>> 1.119 Convert::BinHex >>>> 2.27 Date::Parse >>>> 1.02 DirHandle >>>> 1.06 Fcntl >>>> 2.77 File::Basename >>>> 2.13 File::Copy >>>> 2.01 FileHandle >>>> 2.07_02 File::Path >>>> 0.21 File::Temp >>>> 0.92 Filesys::Df >>>> 3.60 HTML::Entities >>>> 3.60 HTML::Parser >>>> 3.57 HTML::TokeParser >>>> 1.23 IO >>>> 1.14 IO::File >>>> 1.13 IO::Pipe >>>> 2.04 Mail::Header >>>> 1.89 Math::BigInt >>>> 3.07 MIME::Base64 >>>> 5.427 MIME::Decoder >>>> 5.427 MIME::Decoder::UU >>>> 5.427 MIME::Head >>>> 5.427 MIME::Parser >>>> 3.07 MIME::QuotedPrint >>>> 5.427 MIME::Tools >>>> 0.13 Net::CIDR >>>> 1.15 POSIX >>>> 1.19 Scalar::Util >>>> 1.81 Socket >>>> 1.4 Sys::Hostname::Long >>>> 0.27 Sys::Syslog >>>> 1.9719 Time::HiRes >>>> 1.02 Time::localtime >>>> >>>> Optional module versions are: >>>> 1.46 Archive::Tar >>>> 0.23 bignum >>>> missing Business::ISBN >>>> missing Business::ISBN::Data >>>> missing Data::Dump >>>> 1.817 DB_File >>>> 1.14 DBD::SQLite >>>> 1.607 DBI >>>> 1.15 Digest >>>> 1.01 Digest::HMAC >>>> 2.37 Digest::MD5 >>>> 2.11 Digest::SHA1 >>>> 1.01 Encode::Detect >>>> 0.17015 Error >>>> 0.24 ExtUtils::CBuilder >>>> 2.19 ExtUtils::ParseXS >>>> 2.37 Getopt::Long >>>> missing Inline >>>> 1.08 IO::String >>>> 1.09 IO::Zlib >>>> missing IP::Country >>>> missing Mail::ClamAV >>>> 3.002005 Mail::SpamAssassin >>>> v2.006 Mail::SPF >>>> missing Mail::SPF::Query >>>> 0.32 Module::Build >>>> missing Net::CIDR::Lite >>>> 0.65 Net::DNS >>>> v0.003 Net::DNS::Resolver::Programmable >>>> missing Net::LDAP >>>> 4.024 NetAddr::IP >>>> missing Parse::RecDescent >>>> missing SAVI >>>> 2.64 Test::Harness >>>> missing Test::Manifest >>>> 1.98 Text::Balanced >>>> 1.37 URI >>>> 0.76 version >>>> 0.68 YAML >>>> >>>> >>>> >>>> >>>> >>>> -- >>>> MailScanner mailing list >>>> mailscanner@lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>> >>> >>> -- >>> Martin Hepworth >>> Oxford, UK >>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >>> > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090419/46c6f934/attachment-0001.html From drew.marshall at trunknetworks.com Sun Apr 19 11:35:58 2009 From: drew.marshall at trunknetworks.com (Drew Marshall) Date: Sun Apr 19 11:36:21 2009 Subject: Postfix + MailScanner : Attachment Filename check problem !!!! In-Reply-To: <20090419090054.5354B17008@out-b.mx.mail-launder.com> References: <72cf361e0904170858u6059d30nd1f68e9ecd580283@mail.gmail.com> <13c7d1a60904172220o5b448f47na03262c51f729630@mail.gmail.com> <20090419090054.5354B17008@out-b.mx.mail-launder.com> Message-ID: <200904191036.n3JAaC7c005679@safir.blacknight.ie> -- In line with our policy, this message has been scanned for viruses and dangerous content by our Mail Launder system www.mail-launder.com Our email policy can be found at www.trunknetworks.com/policy Trunk Networks Limited is registered in Scotland with registration number: 351063 Registered Office 55-57 West High Street Inverurie AB51 3QQ -------------- next part -------------- On 19 Apr 2009, at 09:57, Man Ngoc wrote: > Hi! > I deinstall the port perl 5.8.9, and then installed the port > perl-5.10.0. Then i also reinstall MailScanner. the installation > process is completely successful. Then i run the command: > # /usr/local/sbin/mailscanner --lint > It print out the results as below: > > IO::Compress::Base::Common version 2.015 required--this is only > version 2.008 at /usr/local/lib/perl5/site_perl/5.10.0/Compress/ > Zlib.pm line 11. > BEGIN failed--compilation aborted at /usr/local/lib/perl5/site_perl/ > 5.10.0/Compress/Zlib.pm line 11. > Compilation failed in require at /usr/local/lib/perl5/site_perl/ > 5.10.0/Archive/Zip.pm line 11. > BEGIN failed--compilation aborted at /usr/local/lib/perl5/site_perl/ > 5.10.0/Archive/Zip.pm line 11. > Compilation failed in require at /usr/local/lib/MailScanner/ > MailScanner/Message.pm line 48. > BEGIN failed--compilation aborted at /usr/local/lib/MailScanner/ > MailScanner/Message.pm line 48. > Compilation failed in require at /usr/local/sbin/mailscanner line 80. > BEGIN failed--compilation aborted at /usr/local/sbin/mailscanner > line 80. > > What is the problem? please help me! > > Thanks a lot! Have you installed Compress-Zlib from ports? If so, your ports tree is out of date. Upgrade it and your modules (See portupgrade) and that should bring that up to date. Drew -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090419/31eb1256/attachment.html From maillists at conactive.com Sun Apr 19 13:31:20 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Sun Apr 19 13:31:31 2009 Subject: Mangled MIME Headers in plain text mail In-Reply-To: <200904190814.n3J8ENa6032550@safir.blacknight.ie> References: <200904182028.n3IKSMns017926@safir.blacknight.ie> <20090419003627.7647317008@out-b.mx.mail-launder.com> <200904190814.n3J8ENa6032550@safir.blacknight.ie> Message-ID: Drew Marshall wrote on Sun, 19 Apr 2009 09:14:15 +0100: > Im not sure that's going to be necessary, my last post to list came > over mangled. Check where my signature lands up. If it's above this > text then it's happened again... There is no signature. But there is still that "trial version" "signature". I remember some mail from you in the past and I think it was at the end then. This "signature" is not added by MS, but by Communigate. It might well interfere with the insertion of your "real" signature as well. And your last message didn't show any similar structure to what you explained. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From admin at lctn.org Sun Apr 19 14:20:20 2009 From: admin at lctn.org (Raymond Norton) Date: Sun Apr 19 14:21:11 2009 Subject: best way to combat porn email In-Reply-To: <3128903.01240147211609.JavaMail.root@mail.lctn.org> Message-ID: <20506215.21240147220830.JavaMail.root@mail.lctn.org> ----- "Alex Neuman" wrote: No, but you can just use anything you want. > > http://pastebin.com/m5cadad2d > I apologize for posting this much info, but I keep tripping the pastebin spam filter when pasting my info. I have included the mailscanner info, and matching headers. 93.196.6.57 p5DC40639.dip0.t-ipconnect.de (GeoIP Lookup Failed) [ ] [ ] [ ] [ ] ID: 6BC1328230.296B4 Message Headers: X-Greylist: delayed 00:05:12 by SQLgrey-1.7.5 Received: from pnxzqv.t-ipconnect.de (p5DC40639.dip0.t-ipconnect.de [93.196.6.57]) by mailscanner-1.domain.com(Postfix) with SMTP id 6BC1328230 for ; Fri, 17 Apr 2009 22:39:52 -0500 (CDT) Message-ID: <49E9497C.1740654@ifaromania.ro> Date: Sat, 18 Apr 2009 03:40:23 +0000 From: Kant User-Agent: Thunderbird 2.0.0.21 (Windows/20090302) MIME-Version: 1.0 To: sheree@domain.com Subject: Seduction Tips For Shy Men Only - How to Get Beautiful Women to Seduce You Content-Type: multipart/alternative; boundary="------------014218640063437569379224" From: aerobically@ifaromania.ro [Add to Whitelist | Add to Blacklist] To: sheree@domain.com Subject: Seduction Tips For Shy Men Only - How to Get Beautiful Women to Seduce You Size: 3.2Kb Anti-Virus/Dangerous Content Protection Virus: N Blocked File: N Other Infection: N SpamAssassin Spam: N Action(s): store, deliver, header, "X-Spam-Status:, No" High Scoring Spam: N SpamAssassin Spam: N Listed in RBL: N Spam Whitelisted: N Spam Blacklisted: N SpamAssassin Autolearn: N SpamAssassin Score: -6.99 Spam Report: Score Matching Rule Descriptioncached not score=-6.999 3 required -9.00 BAYES_00 Bayesian spam probability is 0 to 1% 0.00 HTML_MESSAGE HTML included in message 2.00 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) ######################################################################### Header info: Return-Path: Received: from mailscanner-1.domain.com ([10.10.0.9]) by mail.domain.com (8.13.1/8.13.1) with ESMTP id n3I3cYOg017641 for ; Fri, 17 Apr 2009 22:38:34 -0500 X-Greylist: delayed 00:05:12 by SQLgrey-1.7.5 Received: from pnxzqv.t-ipconnect.de (p5DC40639.dip0.t-ipconnect.de [93.196.6.57]) by mailscanner-1.domain.com (Postfix) with SMTP id 6BC1328230 for ; Fri, 17 Apr 2009 22:39:52 -0500 (CDT) Message-ID: <49E9497C.1740654@ifaromania.ro> Date: Sat, 18 Apr 2009 03:40:23 +0000 From: Kant User-Agent: Thunderbird 2.0.0.21 (Windows/20090302) MIME-Version: 1.0 To: sheree@domain.com Subject: Seduction Tips For Shy Men Only - How to Get Beautiful Women to Seduce You Content-Type: multipart/alternative; boundary="------------014218640063437569379224" X-Word_Of_Life-MailScanner-ESVA-Information: Please contact the ISP for more information X-Word_Of_Life-MailScanner-ESVA: Found to be clean X-Word_Of_Life-MailScanner-ESVA-From: aerobically@ifaromania.ro X-Spam-Status: No, No X-domain.com-MailScanner-Information: Please contact the ISP for more information X-domain.com-MailScanner: Found to be clean X-domain.com-MailScanner-From: aerobically@ifaromania.ro Status: RO X-UID: 27824937 Content-Length: 2456 X-Keywords: -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090419/d6f5b863/attachment.html From steve.freegard at fsl.com Sun Apr 19 16:30:08 2009 From: steve.freegard at fsl.com (Steve Freegard) Date: Sun Apr 19 16:30:20 2009 Subject: best way to combat porn email In-Reply-To: <20506215.21240147220830.JavaMail.root@mail.lctn.org> References: <3128903.01240147211609.JavaMail.root@mail.lctn.org> <20506215.21240147220830.JavaMail.root@mail.lctn.org> Message-ID: <49EB4380.7000808@fsl.com> Raymond Norton wrote: > > I apologize for posting this much info, but I keep tripping the pastebin > spam filter when pasting my info. I have included the mailscanner info, > and matching headers. Two things I immediately noticed: > 93.196.6.57 p5DC40639.dip0.t-ipconnect.de smf@laptop-smf:~$ host 57.6.196.93.zen.spamhaus.org 57.6.196.93.zen.spamhaus.org has address 127.0.0.11 Consider using the Spamhaus Zen RBL at the MTA level - both of these spam messages were delivered to your MTA by consumer DSL lines which this will prevent. It will also mean that you machine have less mail to scan. > -9.00 BAYES_00 Bayesian spam probability is 0 to 1% The default score for BAYES_00 is not -9; and that coupled with autolearning has likely compounded your problem. Hitting BAYES_00 on this message means that your bayes database is garbage and has learnt messages incorrectly. You might as well nuke it and start over (sa-learn --clear). I ran just the headers you posted into a well trained bayes database here with simply 'Test' in the message body and it scored BAYES_60. Regards, Steve. From mark at msapiro.net Sun Apr 19 16:37:13 2009 From: mark at msapiro.net (Mark Sapiro) Date: Sun Apr 19 16:37:21 2009 Subject: Mangled MIME Headers in plain text mail In-Reply-To: <200904182028.n3IKSMns017926@safir.blacknight.ie> References: <200904182028.n3IKSMns017926@safir.blacknight.ie> Message-ID: <20090419153713.GA1508@msapiro> On Sat, Apr 18, 2009 at 09:28:10PM +0100, Drew Marshall wrote: > > To explain more, it seems that plain text only mails are fine, > processed, signature added and all is well. Combined HTML and plain > text mail the HTML section is fine and as that is the default view of > most mail clients, no problem. However, if you then view this mail in > plain text such as you might on a blackberry or other mobile type > device the actual message is not visible, only the clean mail > signature. When I look at the the raw message, it is there but beneath > the signature and (I am no expert in MIME formatting) seems to be set > with a different structure that the signature and hence not visible to > 'simple' clients (If you view the message in a half decent client, the > message is visible under the signature). > > For example this is part of a raw message: > > ------_=_NextPart_6334_00018467.00000041 > Content-Type: text/plain; charset="ISO-8859-1" > Content-Disposition: inline > Content-Transfer-Encoding: quoted-printable > > --=20 > This message has been scanned for viruses and dangerous content by=20 > the Mail Launder e-mail system. > For more information please visit http://www.mail-launder.com=20 > > > > > ------_=_NextPart_6334_00018467.00000041 > Content-Type: text/plain; > charset="us-ascii" > Content-Transfer-Encoding: quoted-printable > > <-- The text from here is not visible in a plain text view --> > > I can't see any particular commonality in clients although I did > originally think it was Thunderbird but Outlook also has been involved > in mail that displays this problem. Prior to the current beta being > installed, I did have one user who had her out bound mail (From > Outlook) sent as plain text attachments with just the signature > actually in the message. I haven't heard of any more of these but I > guess most people don't get formatting feed back for mail they send :-) The original message is multipart/alternative. Since it is multipart, the MailScanner signature is added to the beginning of the message as a separate MIME text/plain part. The resultant message structure is something like multipart/mixed text/plain (the signature) multipart/alternative (the original message) text/plain (the original plain text body) text/html (the original rich text body) Or, in the case of the message you refer to in a followup, the original is apparently multipart/mixed text/plain (your text) application/x-gzip (your attachment) And with the MailScanner signature multipart/mixed text/plain (the signature) text/plain (your text) application/x-gzip (your attachment) The Blackberry and some other MUAs think the first text/plain part is the message and everything else is an attachment. For a discussion of this issue in a different context and the reasons why the signature can't just be 'inserted' into the body, see . -- Mark Sapiro mark at msapiro net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From drew.marshall at trunknetworks.com Sun Apr 19 17:31:23 2009 From: drew.marshall at trunknetworks.com (Drew Marshall) Date: Sun Apr 19 17:31:40 2009 Subject: Mangled MIME Headers in plain text mail In-Reply-To: <20090419123638.E100D17082@out-b.mx.mail-launder.com> References: <200904182028.n3IKSMns017926@safir.blacknight.ie> <20090419003627.7647317008@out-b.mx.mail-launder.com> <200904190814.n3J8ENa6032550@safir.blacknight.ie> <20090419123638.E100D17082@out-b.mx.mail-launder.com> Message-ID: <200904191631.n3JGVWNa020325@safir.blacknight.ie> *This message was transferred with a trial version of CommuniGate(r) Pro* On 19 Apr 2009, at 13:31, Kai Schaetzl wrote: > Drew Marshall wrote on Sun, 19 Apr 2009 09:14:15 +0100: > >> Im not sure that's going to be necessary, my last post to list came >> over mangled. Check where my signature lands up. If it's above this >> text then it's happened again... > > There is no signature. But there is still that "trial version" > "signature". I remember some mail from you in the past and I think > it was > at the end then. This "signature" is not added by MS, but by > Communigate. > It might well interfere with the insertion of your "real" signature as > well. And your last message didn't show any similar structure to > what you > explained. There should be both. The trial version bit is because I have exceeded my licences on the CGP platform and the new ones are wrong so can't be added to remove the tag. I hope that will be resolved Monday/ Tuesday. There should be my usual disclaimer email, which for some reason is being stripped by the list (But never used to). Hugo however, has seen it in a reply in another thread, demonstrating the problem. Drew From maillists at conactive.com Sun Apr 19 19:31:20 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Sun Apr 19 19:31:30 2009 Subject: Mangled MIME Headers in plain text mail In-Reply-To: <200904191631.n3JGVWNa020325@safir.blacknight.ie> References: <200904182028.n3IKSMns017926@safir.blacknight.ie> <20090419003627.7647317008@out-b.mx.mail-launder.com> <200904190814.n3J8ENa6032550@safir.blacknight.ie> <20090419123638.E100D17082@out-b.mx.mail-launder.com> <200904191631.n3JGVWNa020325@safir.blacknight.ie> Message-ID: As I said, and if you don't want to accept Mark's explanation, it's so much easier to see the full message in a pastebin ... Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From admin at lctn.org Sun Apr 19 22:04:29 2009 From: admin at lctn.org (Raymond Norton) Date: Sun Apr 19 22:04:39 2009 Subject: best way to combat porn email In-Reply-To: <49EB4380.7000808@fsl.com> References: <3128903.01240147211609.JavaMail.root@mail.lctn.org> <20506215.21240147220830.JavaMail.root@mail.lctn.org> <49EB4380.7000808@fsl.com> Message-ID: <49EB91DD.4030309@lctn.org> I sent the info from the wrong box:( We run a mailscanner, and forward it to our mail server. Here is the offending message from the first mailscanner: 17/04/09 22:40:06 Received by: mailscanner-1.domain.com Received from: 93.196.6.57 [Add to Whitelist | Add to Blacklist] Received Via: IP Address Hostname Country RBL Spam Virus All 93.196.6.57 p5DC40639.dip0.t-ipconnect.de (GeoIP Lookup Failed) [ ] [ ] [ ] [ ] ID: 6BC1328230.296B4 Message Headers: X-Greylist: delayed 00:05:12 by SQLgrey-1.7.5 Received: from pnxzqv.t-ipconnect.de (p5DC40639.dip0.t-ipconnect.de [93.196.6.57]) by mailscanner-1.domain.com (Postfix) with SMTP id 6BC1328230 for ; Fri, 17 Apr 2009 22:39:52 -0500 (CDT) Message-ID: <49E9497C.1740654@ifaromania.ro> Date: Sat, 18 Apr 2009 03:40:23 +0000 From: Kant User-Agent: Thunderbird 2.0.0.21 (Windows/20090302) MIME-Version: 1.0 To: sheree@domain.com Subject: Seduction Tips For Shy Men Only - How to Get Beautiful Women to Seduce You Content-Type: multipart/alternative; boundary="------------014218640063437569379224" From: aerobically@ifaromania.ro [Add to Whitelist | Add to Blacklist] To: sheree@domain.com Subject: Seduction Tips For Shy Men Only - How to Get Beautiful Women to Seduce You Size: 3.2Kb Anti-Virus/Dangerous Content Protection Virus: N Blocked File: N Other Infection: N SpamAssassin Spam: N Action(s): store, deliver, header, "X-Spam-Status:, No" High Scoring Spam: N SpamAssassin Spam: N Listed in RBL: N Spam Whitelisted: N Spam Blacklisted: N SpamAssassin Autolearn: N SpamAssassin Score: -6.99 Spam Report: Score Matching Rule Descriptioncached not score=-6.999 3 required -9.00 BAYES_00 Bayesian spam probability is 0 to 1% 0.00 HTML_MESSAGE HTML included in message 2.00 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) ############################################################# I also have the following in main.cf of postfix, so not sure why it got through in the first place: smtpd_client_restrictions = reject_rbl_client sbl-xbl.spamhaus.org, reject_rbl_client list.dsbl.org I cleared bayes just a few minutes ago. From patrick at vande-walle.eu Mon Apr 20 06:42:17 2009 From: patrick at vande-walle.eu (Patrick Vande Walle) Date: Mon Apr 20 06:42:31 2009 Subject: Patch to Postfix.pm to fix IPv6 address parsing Message-ID: <6baf20818849360785ca9a2f7173e971@localhost> Hi Julian, This is with MS 4.75-11 on Linux CentOS 5 with Postfix. The Postfix.pm routine that extracts $message->{clientip} will not correctly handle IPv6 addresses on Linux, because the latter adds "IPv6:" in front of the address. An example header is: Received: from mail.ietf.org (mail.ietf.org [IPv6:2001:1890:1112:1::20]) by whatever.host.name (Postfix) with ESMTP id 1FE959C07A for ; Mon, 20 Apr 2009 05:16:42 +0200 (CEST) I searched quit some a bit to find the right regexp. Actually, the simplest way is to use the regexp from the same routine in Sendmail.pm. It handles both IPv4 and IPv6 addresses, thus ultimately simplifying the code. Diff below. It has been running fine for 3 days here, with no side effects as far as I can see. It now returns the right clientip value to MailWatch. As an aside, MailWatch has its own issues with IPv6, for which I have submitted a patch on Sourceforge. I do not post often to this list, I think I actually never did. So let me take this opportunity to thank you all for your dedication and helpfulness. All the best, Patrick Vande Walle --- Postfix.pm.orig 2009-04-18 16:16:07.000000000 +0200 +++ Postfix.pm 2009-04-18 16:16:48.000000000 +0200 @@ -544,16 +544,8 @@ $InSubject = 0; } } - if ($recdata =~ /^Received: .+\[(\d+\.\d+\.\d+\.\d+)\]/i) { - unless ($read1strcvd) { - $ipfromheader = $1; - $read1strcvd = 1; - } - unless ($IPFound) { - $message->{clientip} = $1; - $IPFound = 1; - } - } elsif ($recdata =~ /^Received: .+\[([\dabcdef.:]+)\]/i) { +# Linux adds "IPv6:" on the front of the IPv6 address, so remove it + if ($recdata =~ /^Received: .+\[(?:IPv6:)?([\dabcdef.:]+)\]/i) { unless ($read1strcvd) { $ipfromheader = $1; $read1strcvd = 1; From MailScanner at ecs.soton.ac.uk Mon Apr 20 08:31:35 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Mon Apr 20 08:31:52 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49E597D5.3050300@ecs.soton.ac.uk> <20090415143749.GA496@msapiro> <20090416190828.GA2012@msapiro> <49E83F8C.4060307@ecs.soton.ac.uk> <49E87D60.2040707@ecs.soton.ac.uk> <49EC24D7.2000502@ecs.soton.ac.uk> Message-ID: On 17/4/09 16:16, Kai Schaetzl wrote: > Julian Field wrote on Fri, 17 Apr 2009 15:49:25 +0100: > > >> Very likely. I don't know what that line means, but it doesn't sound >> good does it? >> > This seems to be normal operation. As at the same time the refreshing of > the MS children happened I wonder if it wasn't triggered by MS? > > Anyway, (and without too much knowledge about how the processing of the > queue in MS really works) I think the reason is that this message got > saved to the processing db before MS refreshed itself and when MS > processed it a second time it had a different MS id, so it didn't get > removed. > So, the problem must be somewhere in the way that the message is kept in > the queue and not in the db code. I see that the message got indeed > archived with both ids, that seems to be done before any other > scanning/processing by MS, that makes sense. Then MS closed down. Do you > keep it in incoming? With the full MS id? The message then must have been > there either as B48BFF9477.51697 and MS renames it or it must have already > been renamed to B48BFF9477.D962D (and this didn't get logged so we can't > see it) and thus not found in the db. > > A simple cure to stop this might be to stop adding the extra stamp. What > about an option? At least for my systems that seems to be safe. It might > not be safe for other systems, that's why it should be an option. > And as the whole thing doesn't indicate any problem, anyway, maybe clean > up old entries by yourself and add something to clean it manually (-- > processing=clean)? > I want to keep the extra number on the end, as it is certainly needed on some systems to identify messages. But what I am thinking is to not put the extra number in the processing database, as messages should normally enter and exit that database very quickly. That would be easy to implement, I'll try to get it done today. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From steve.freegard at fsl.com Mon Apr 20 08:46:16 2009 From: steve.freegard at fsl.com (Steve Freegard) Date: Mon Apr 20 08:46:28 2009 Subject: best way to combat porn email In-Reply-To: <49EB91DD.4030309@lctn.org> References: <3128903.01240147211609.JavaMail.root@mail.lctn.org> <20506215.21240147220830.JavaMail.root@mail.lctn.org> <49EB4380.7000808@fsl.com> <49EB91DD.4030309@lctn.org> Message-ID: <49EC2848.4080601@fsl.com> Raymond Norton wrote: > > I also have the following in main.cf of postfix, so not sure why it got > through in the first place: > smtpd_client_restrictions = > reject_rbl_client sbl-xbl.spamhaus.org, Change that to zen.spamhaus.org... > reject_rbl_client list.dsbl.org Remove this; it's been dead for months and is now pointing at dead nameservers to time-out all queries. > > I cleared bayes just a few minutes ago. > Ok - be sure to train it on anything that is misclassified and you can help it along by training the first 200 messages (e.g. 100 spams and 100 ham). Regards, Steve. From MailScanner at ecs.soton.ac.uk Mon Apr 20 09:26:48 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Mon Apr 20 09:27:10 2009 Subject: Patch to Postfix.pm to fix IPv6 address parsing In-Reply-To: <6baf20818849360785ca9a2f7173e971@localhost> References: <6baf20818849360785ca9a2f7173e971@localhost> <49EC31C8.2080009@ecs.soton.ac.uk> Message-ID: On 20/04/2009 06:42, Patrick Vande Walle wrote: > Hi Julian, > > This is with MS 4.75-11 on Linux CentOS 5 with Postfix. > > The Postfix.pm routine that extracts $message->{clientip} will not > correctly handle IPv6 addresses on Linux, because the latter adds "IPv6:" > in front of the address. An example header is: > > Received: from mail.ietf.org (mail.ietf.org [IPv6:2001:1890:1112:1::20]) > by whatever.host.name (Postfix) with ESMTP id 1FE959C07A > for; Mon, 20 Apr 2009 05:16:42 +0200 (CEST) > > I searched quit some a bit to find the right regexp. Actually, the simplest > way is to use the regexp from the same routine in Sendmail.pm. It handles > both IPv4 and IPv6 addresses, thus ultimately simplifying the code. Diff > below. > > It has been running fine for 3 days here, with no side effects as far as I > can see. It now returns the right clientip value to MailWatch. As an > aside, MailWatch has its own issues with IPv6, for which I have submitted a > patch on Sourceforge. > > I do not post often to this list, I think I actually never did. So let me > take this opportunity to thank you all for your dedication and > helpfulness. > > All the best, > > Patrick Vande Walle > > > > --- Postfix.pm.orig 2009-04-18 16:16:07.000000000 +0200 > +++ Postfix.pm 2009-04-18 16:16:48.000000000 +0200 > @@ -544,16 +544,8 @@ > $InSubject = 0; > } > } > - if ($recdata =~ /^Received: .+\[(\d+\.\d+\.\d+\.\d+)\]/i) { > - unless ($read1strcvd) { > - $ipfromheader = $1; > - $read1strcvd = 1; > - } > - unless ($IPFound) { > - $message->{clientip} = $1; > - $IPFound = 1; > - } > - } elsif ($recdata =~ /^Received: .+\[([\dabcdef.:]+)\]/i) { > +# Linux adds "IPv6:" on the front of the IPv6 address, so remove it > + if ($recdata =~ /^Received: .+\[(?:IPv6:)?([\dabcdef.:]+)\]/i) { > unless ($read1strcvd) { > $ipfromheader = $1; > Are you sure you meant $1 and not $2 here? > $read1strcvd = 1; > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Mon Apr 20 09:27:46 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Mon Apr 20 09:28:10 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49E597D5.3050300@ecs.soton.ac.uk> <20090415143749.GA496@msapiro> <20090416190828.GA2012@msapiro> <49E83F8C.4060307@ecs.soton.ac.uk> <49E87D60.2040707@ecs.soton.ac.uk> <49EC24D7.2000502@ecs.soton.ac.uk> <49EC3202.5040805@ecs.soton.ac.uk> Message-ID: On 20/04/2009 08:31, Julian Field wrote: > > > On 17/4/09 16:16, Kai Schaetzl wrote: >> Julian Field wrote on Fri, 17 Apr 2009 15:49:25 +0100: >> >>> Very likely. I don't know what that line means, but it doesn't sound >>> good does it? >> This seems to be normal operation. As at the same time the refreshing of >> the MS children happened I wonder if it wasn't triggered by MS? >> >> Anyway, (and without too much knowledge about how the processing of the >> queue in MS really works) I think the reason is that this message got >> saved to the processing db before MS refreshed itself and when MS >> processed it a second time it had a different MS id, so it didn't get >> removed. >> So, the problem must be somewhere in the way that the message is kept in >> the queue and not in the db code. I see that the message got indeed >> archived with both ids, that seems to be done before any other >> scanning/processing by MS, that makes sense. Then MS closed down. Do you >> keep it in incoming? With the full MS id? The message then must have >> been >> there either as B48BFF9477.51697 and MS renames it or it must have >> already >> been renamed to B48BFF9477.D962D (and this didn't get logged so we can't >> see it) and thus not found in the db. >> >> A simple cure to stop this might be to stop adding the extra stamp. What >> about an option? At least for my systems that seems to be safe. It might >> not be safe for other systems, that's why it should be an option. >> And as the whole thing doesn't indicate any problem, anyway, maybe clean >> up old entries by yourself and add something to clean it manually (-- >> processing=clean)? > I want to keep the extra number on the end, as it is certainly needed > on some systems to identify messages. But what I am thinking is to not > put the extra number in the processing database, as messages should > normally enter and exit that database very quickly. > > That would be easy to implement, I'll try to get it done today. I'm going to use a very quick and easy checksum on the start of the file. I'm certainly not going to cksum or MD5 it, that's *way* slower than I need. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From glenn.steen at gmail.com Mon Apr 20 09:48:49 2009 From: glenn.steen at gmail.com (Glenn Steen) Date: Mon Apr 20 09:48:58 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49E87D60.2040707@ecs.soton.ac.uk> <49EC24D7.2000502@ecs.soton.ac.uk> <49EC3202.5040805@ecs.soton.ac.uk> Message-ID: <223f97700904200148o773b513due9361af7c59163b8@mail.gmail.com> 2009/4/20 Julian Field : > > > On 20/04/2009 08:31, Julian Field wrote: >> >> >> On 17/4/09 16:16, Kai Schaetzl wrote: >>> >>> Julian Field wrote on Fri, 17 Apr 2009 15:49:25 +0100: >>> >>>> Very likely. I don't know what that line means, but it doesn't sound >>>> good does it? >>> >>> This seems to be normal operation. As at the same time the refreshing of >>> the MS children happened I wonder if it wasn't triggered by MS? >>> >>> Anyway, (and without too much knowledge about how the processing of the >>> queue in MS really works) I think the reason is that this message got >>> saved to the processing db before MS refreshed itself and when MS >>> processed it a second time it had a different MS id, so it didn't get >>> removed. >>> So, the problem must be somewhere in the way that the message is kept in >>> the queue and not in the db code. I see that the message got indeed >>> archived with both ids, that seems to be done before any other >>> scanning/processing by MS, that makes sense. Then MS closed down. Do you >>> keep it in incoming? With the full MS id? The message then must have been >>> there either as B48BFF9477.51697 and MS renames it or it must have >>> already >>> been renamed to B48BFF9477.D962D (and this didn't get logged so we can't >>> see it) and thus not found in the db. >>> >>> A simple cure to stop this might be to stop adding the extra stamp. What >>> about an option? At least for my systems that seems to be safe. It might >>> not be safe for other systems, that's why it should be an option. >>> And as the whole thing doesn't indicate any problem, anyway, maybe clean >>> up old entries by yourself and add something to clean it manually (-- >>> processing=clean)? >> >> I want to keep the extra number on the end, as it is certainly needed on >> some systems to identify messages. But what I am thinking is to not put the >> extra number in the processing database, as messages should normally enter >> and exit that database very quickly. >> >> That would be easy to implement, I'll try to get it done today. > > I'm going to use a very quick and easy checksum on the start of the file. > I'm certainly not going to cksum or MD5 it, that's *way* slower than I need. > > Jules > And only for the processing DB, right? Cheers -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From MailScanner at ecs.soton.ac.uk Mon Apr 20 10:08:05 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Mon Apr 20 10:08:32 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: <223f97700904200148o773b513due9361af7c59163b8@mail.gmail.com> References: <49E87D60.2040707@ecs.soton.ac.uk> <49EC24D7.2000502@ecs.soton.ac.uk> <49EC3202.5040805@ecs.soton.ac.uk> <223f97700904200148o773b513due9361af7c59163b8@mail.gmail.com> <49EC3B75.2020107@ecs.soton.ac.uk> Message-ID: On 20/04/2009 09:48, Glenn Steen wrote: > 2009/4/20 Julian Field: > >> >> On 20/04/2009 08:31, Julian Field wrote: >> >>> >>> On 17/4/09 16:16, Kai Schaetzl wrote: >>> >>>> Julian Field wrote on Fri, 17 Apr 2009 15:49:25 +0100: >>>> >>>> >>>>> Very likely. I don't know what that line means, but it doesn't sound >>>>> good does it? >>>>> >>>> This seems to be normal operation. As at the same time the refreshing of >>>> the MS children happened I wonder if it wasn't triggered by MS? >>>> >>>> Anyway, (and without too much knowledge about how the processing of the >>>> queue in MS really works) I think the reason is that this message got >>>> saved to the processing db before MS refreshed itself and when MS >>>> processed it a second time it had a different MS id, so it didn't get >>>> removed. >>>> So, the problem must be somewhere in the way that the message is kept in >>>> the queue and not in the db code. I see that the message got indeed >>>> archived with both ids, that seems to be done before any other >>>> scanning/processing by MS, that makes sense. Then MS closed down. Do you >>>> keep it in incoming? With the full MS id? The message then must have been >>>> there either as B48BFF9477.51697 and MS renames it or it must have >>>> already >>>> been renamed to B48BFF9477.D962D (and this didn't get logged so we can't >>>> see it) and thus not found in the db. >>>> >>>> A simple cure to stop this might be to stop adding the extra stamp. What >>>> about an option? At least for my systems that seems to be safe. It might >>>> not be safe for other systems, that's why it should be an option. >>>> And as the whole thing doesn't indicate any problem, anyway, maybe clean >>>> up old entries by yourself and add something to clean it manually (-- >>>> processing=clean)? >>>> >>> I want to keep the extra number on the end, as it is certainly needed on >>> some systems to identify messages. But what I am thinking is to not put the >>> extra number in the processing database, as messages should normally enter >>> and exit that database very quickly. >>> >>> That would be easy to implement, I'll try to get it done today. >>> >> I'm going to use a very quick and easy checksum on the start of the file. >> I'm certainly not going to cksum or MD5 it, that's *way* slower than I need. >> >> Jules >> >> > And only for the processing DB, right? > No, for everything with Postfix. It will just mean a change in algorithm to produce the 5-digit key, no change in logging, data stored or anything else. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From patrick at vande-walle.eu Mon Apr 20 10:16:03 2009 From: patrick at vande-walle.eu (Patrick Vande Walle) Date: Mon Apr 20 10:16:22 2009 Subject: Patch to Postfix.pm to fix IPv6 address parsing In-Reply-To: References: <6baf20818849360785ca9a2f7173e971@localhost> <49EC31C8.2080009@ecs.soton.ac.uk> Message-ID: On Mon, 20 Apr 2009 09:26:48 +0100, Julian Field wrote: >> - } elsif ($recdata =~ /^Received: .+\[([\dabcdef.:]+)\]/i) { >> +# Linux adds "IPv6:" on the front of the IPv6 address, so remove it >> + if ($recdata =~ /^Received: .+\[(?:IPv6:)?([\dabcdef.:]+)\]/i) { >> unless ($read1strcvd) { >> $ipfromheader = $1; >> > Are you sure you meant $1 and not $2 here? >> $read1strcvd = 1; >> > > Jules I did not change that part of the code. It is consistent with the code in Sendmail.pm and earlier code in Postfix.pm, too. I tested with $2 and it returns nothing. So yes, $1 is OK. Patrick Vande Walle From glenn.steen at gmail.com Mon Apr 20 10:46:43 2009 From: glenn.steen at gmail.com (Glenn Steen) Date: Mon Apr 20 10:46:52 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49EC24D7.2000502@ecs.soton.ac.uk> <49EC3202.5040805@ecs.soton.ac.uk> <49EC3B75.2020107@ecs.soton.ac.uk> <223f97700904200148o773b513due9361af7c59163b8@mail.gmail.com> Message-ID: <223f97700904200246w118b4077vf69f1c633c98a268@mail.gmail.com> 2009/4/20 Julian Field : > > > On 20/04/2009 09:48, Glenn Steen wrote: >> >> 2009/4/20 Julian Field: >> >>> >>> On 20/04/2009 08:31, Julian Field wrote: >>> >>>> >>>> On 17/4/09 16:16, Kai Schaetzl wrote: >>>> >>>>> >>>>> Julian Field wrote on Fri, 17 Apr 2009 15:49:25 +0100: >>>>> >>>>> >>>>>> >>>>>> Very likely. I don't know what that line means, but it doesn't sound >>>>>> good does it? >>>>>> >>>>> >>>>> This seems to be normal operation. As at the same time the refreshing >>>>> of >>>>> the MS children happened I wonder if it wasn't triggered by MS? >>>>> >>>>> Anyway, (and without too much knowledge about how the processing of the >>>>> queue in MS really works) I think the reason is that this message got >>>>> saved to the processing db before MS refreshed itself and when MS >>>>> processed it a second time it had a different MS id, so it didn't get >>>>> removed. >>>>> So, the problem must be somewhere in the way that the message is kept >>>>> in >>>>> the queue and not in the db code. I see that the message got indeed >>>>> archived with both ids, that seems to be done before any other >>>>> scanning/processing by MS, that makes sense. Then MS closed down. Do >>>>> you >>>>> keep it in incoming? With the full MS id? The message then must have >>>>> been >>>>> there either as B48BFF9477.51697 and MS renames it or it must have >>>>> already >>>>> been renamed to B48BFF9477.D962D (and this didn't get logged so we >>>>> can't >>>>> see it) and thus not found in the db. >>>>> >>>>> A simple cure to stop this might be to stop adding the extra stamp. >>>>> What >>>>> about an option? At least for my systems that seems to be safe. It >>>>> might >>>>> not be safe for other systems, that's why it should be an option. >>>>> And as the whole thing doesn't indicate any problem, anyway, maybe >>>>> clean >>>>> up old entries by yourself and add something to clean it manually (-- >>>>> processing=clean)? >>>>> >>>> >>>> I want to keep the extra number on the end, as it is certainly needed on >>>> some systems to identify messages. But what I am thinking is to not put >>>> the >>>> extra number in the processing database, as messages should normally >>>> enter >>>> and exit that database very quickly. >>>> >>>> That would be easy to implement, I'll try to get it done today. >>>> >>> >>> I'm going to use a very quick and easy checksum on the start of the file. >>> I'm certainly not going to cksum or MD5 it, that's *way* slower than I >>> need. >>> >>> Jules >>> >>> >> >> And only for the processing DB, right? >> > > No, for everything with Postfix. It will just mean a change in algorithm to > produce the 5-digit key, no change in logging, data stored or anything else. > > Jules > Ok. Beta soonish? -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From maillists at conactive.com Mon Apr 20 11:31:20 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Mon Apr 20 11:31:30 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49E87D60.2040707@ecs.soton.ac.uk> <49EC24D7.2000502@ecs.soton.ac.uk> <49EC3202.5040805@ecs.soton.ac.uk> <223f97700904200148o773b513due9361af7c59163b8@mail.gmail.com> <49EC3B75.2020107@ecs.soton.ac.uk> Message-ID: Julian Field wrote on Mon, 20 Apr 2009 10:08:05 +0100: > No, for everything with Postfix. It will just mean a change in algorithm > to produce the 5-digit key, no change in logging, data stored or > anything else. Julian, I would be grateful if you could provide the direct use of the postfix ids as an option. I'm not seeing any reason to use them on my setups, they do not repeat over a long time. Where are those setups that "need" it? In mailing list postings from 5 years ago? I'm still waiting that someone raises his hand and says "yes, it repeats for us at least daily". And I don't see how changing the algorithm for the five-letter-word would solve the problem with the processing database. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From glenn.steen at gmail.com Mon Apr 20 11:44:14 2009 From: glenn.steen at gmail.com (Glenn Steen) Date: Mon Apr 20 11:44:23 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49EC24D7.2000502@ecs.soton.ac.uk> <49EC3202.5040805@ecs.soton.ac.uk> <223f97700904200148o773b513due9361af7c59163b8@mail.gmail.com> <49EC3B75.2020107@ecs.soton.ac.uk> Message-ID: <223f97700904200344o41fe70ecm39d4b2ca513fc8e0@mail.gmail.com> 2009/4/20 Kai Schaetzl : > Julian Field wrote on Mon, 20 Apr 2009 10:08:05 +0100: > >> No, for everything with Postfix. It will just mean a change in algorithm >> to produce the 5-digit key, no change in logging, data stored or >> anything else. > > Julian, I would be grateful if you could provide the direct use of the > postfix ids as an option. I'm not seeing any reason to use them on my > setups, they do not repeat over a long time. Where are those setups that > "need" it? In mailing list postings from 5 years ago? I'm still waiting > that someone raises his hand and says "yes, it repeats for us at least > daily". > Well, then you haven't got a particularly large/lengthy SQL log (like for MailWatch), have you? If you had, you'd see the problem. Also depends on fs, of course. > And I don't see how changing the algorithm for the five-letter-word would > solve the problem with the processing database. > If you go from totally random to deterministic/file, you'd still get the needed uniqueness as well as the same key for the same queue file (in the processing DB)... Which seems to be the problem needing to be solved...? > Kai > Cheers -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From steve.freegard at fsl.com Mon Apr 20 12:03:56 2009 From: steve.freegard at fsl.com (Steve Freegard) Date: Mon Apr 20 12:04:06 2009 Subject: Patch to Postfix.pm to fix IPv6 address parsing In-Reply-To: References: <6baf20818849360785ca9a2f7173e971@localhost> <49EC31C8.2080009@ecs.soton.ac.uk> Message-ID: <49EC569C.8060408@fsl.com> Patrick Vande Walle wrote: > On Mon, 20 Apr 2009 09:26:48 +0100, Julian Field > wrote: > >>> - } elsif ($recdata =~ /^Received: .+\[([\dabcdef.:]+)\]/i) { >>> +# Linux adds "IPv6:" on the front of the IPv6 address, so remove it >>> + if ($recdata =~ /^Received: .+\[(?:IPv6:)?([\dabcdef.:]+)\]/i) { >>> unless ($read1strcvd) { >>> $ipfromheader = $1; >>> >> Are you sure you meant $1 and not $2 here? (?:) is non-capturing, so $1 is correct. From MailScanner at ecs.soton.ac.uk Mon Apr 20 12:25:12 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Mon Apr 20 12:25:35 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: <223f97700904200344o41fe70ecm39d4b2ca513fc8e0@mail.gmail.com> References: <49EC24D7.2000502@ecs.soton.ac.uk> <49EC3202.5040805@ecs.soton.ac.uk> <223f97700904200148o773b513due9361af7c59163b8@mail.gmail.com> <49EC3B75.2020107@ecs.soton.ac.uk> <223f97700904200344o41fe70ecm39d4b2ca513fc8e0@mail.gmail.com> <49EC5B98.6000304@ecs.soton.ac.uk> Message-ID: Thanks Glenn, you took the words right out of my mouth. 4.76-13 will be out in 2 minutes. On 20/04/2009 11:44, Glenn Steen wrote: > 2009/4/20 Kai Schaetzl: > >> Julian Field wrote on Mon, 20 Apr 2009 10:08:05 +0100: >> >> >>> No, for everything with Postfix. It will just mean a change in algorithm >>> to produce the 5-digit key, no change in logging, data stored or >>> anything else. >>> >> Julian, I would be grateful if you could provide the direct use of the >> postfix ids as an option. I'm not seeing any reason to use them on my >> setups, they do not repeat over a long time. Where are those setups that >> "need" it? In mailing list postings from 5 years ago? I'm still waiting >> that someone raises his hand and says "yes, it repeats for us at least >> daily". >> >> > Well, then you haven't got a particularly large/lengthy SQL log (like > for MailWatch), have you? If you had, you'd see the problem. Also > depends on fs, of course. > > >> And I don't see how changing the algorithm for the five-letter-word would >> solve the problem with the processing database. >> >> > If you go from totally random to deterministic/file, you'd still get > the needed uniqueness as well as the same key for the same queue file > (in the processing DB)... Which seems to be the problem needing to be > solved...? > > >> Kai >> >> > Cheers > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From maillists at conactive.com Mon Apr 20 12:31:19 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Mon Apr 20 12:31:33 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: <223f97700904200344o41fe70ecm39d4b2ca513fc8e0@mail.gmail.com> References: <49EC24D7.2000502@ecs.soton.ac.uk> <49EC3202.5040805@ecs.soton.ac.uk> <223f97700904200148o773b513due9361af7c59163b8@mail.gmail.com> <49EC3B75.2020107@ecs.soton.ac.uk> <223f97700904200344o41fe70ecm39d4b2ca513fc8e0@mail.gmail.com> Message-ID: Glenn Steen wrote on Mon, 20 Apr 2009 12:44:14 +0200: > Well, then you haven't got a particularly large/lengthy SQL log (like > for MailWatch), have you? I regularly purge. The log I'm looking at has about 60.000 messages. How many do you need on a day for getting duplicates? If you had, you'd see the problem. Also > depends on fs, of course. Is there some some documentation at postfix.org on this? > > > And I don't see how changing the algorithm for the five-letter-word would > > solve the problem with the processing database. > > > If you go from totally random to deterministic/file, you'd still get > the needed uniqueness as well as the same key for the same queue file > (in the processing DB)... Which seems to be the problem needing to be > solved...? Oh, if you use the file itself, yes ... I was thinking of something, uhm, well, I don't know. Anyway, the point is, that many of us will simply don't need this. It's just some more milliseconds added to processing. In the recent past people have already complained several times about performance. Why hamper performance where it is not necessary? Btw, Julian, you wanted me to remind you that the processing db option should be set to off by default! :-) Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From jaearick at colby.edu Mon Apr 20 13:09:12 2009 From: jaearick at colby.edu (Jeff A. Earickson) Date: Mon Apr 20 13:09:29 2009 Subject: Potential issue with docx format and Clam Message-ID: Julian, I'm forwarding along a note from our support desk people, who seem to have uncovered an issue with Office 2007/2008 docx file formats and the ClamAV recursion level. In my case, I am running MS 4.75.9-2 with ClamAVmodule Maximum Recursion Level = 8 Adam's detective work below suggests that this setting may be too low for Office 2007/2008 docx attachments. Anybody else seen this? (Time for me to upgrade to the latest stable version, or the latest beta). Jeff Earickson Colby College ---------- Forwarded message ---------- I did some experimenting with this situation [rejections of email with "Report: MailScanner: Message contained archive nested too deeply" messages] and here is what I found: - As you may or may not know the new Office 2007/2008 file format is really just a renamed .zip file containing other files and folders that make up the document. - If you insert an object into a .docx that is, for instance, a PowerPoint slide it is inserted as a .pptx (again, just a .zip with a different extension). - If that slide contains an inserted Excel table, it is inserted as a .xlsx (.zip). - So if you add all those up you have the original .docx, which contains a folder called "embedded", in that folder is a .pptx file, inside that is a folder called "embedded", in that folder is a .xlsx file, inside that is a series of files and folders. So all that added up is 7 layers. I was able to duplicate Todd's error with my own .docx, .pptx and .xlsx, but I noticed that it had to be all three. If I tried to email a .docx with just a PowerPoint slide embedded it went fine. And if I tried to email a .pptx with an embedded Excel Table that went fine too. So it seems as though we may need to adjust some settings on MailScanner to allow for this type of file to pass because as we convert more and more people to Office 2007/2008 we are going to be more likely to run into these types of situations. ------------ Adam Nielsen Faculty and Staff Support Center x4222 From glenn.steen at gmail.com Mon Apr 20 13:40:40 2009 From: glenn.steen at gmail.com (Glenn Steen) Date: Mon Apr 20 13:40:50 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49EC3202.5040805@ecs.soton.ac.uk> <223f97700904200148o773b513due9361af7c59163b8@mail.gmail.com> <49EC3B75.2020107@ecs.soton.ac.uk> <223f97700904200344o41fe70ecm39d4b2ca513fc8e0@mail.gmail.com> Message-ID: <223f97700904200540r3c4206d4wc69209c1bc487694@mail.gmail.com> 2009/4/20 Kai Schaetzl : > Glenn Steen wrote on Mon, 20 Apr 2009 12:44:14 +0200: > >> Well, then you haven't got a particularly large/lengthy SQL log (like >> for MailWatch), have you? > > I regularly purge. The log I'm looking at has about 60.000 messages. How many > do you need on a day for getting duplicates? > Well, as said ... it depends a bit on how you layout your filesystems too... The key here is inode reuse... and vou need have a bit of volume, so that the reuse issue becomes an issue, since the the queue ID will depend on the microsecond and the inode number:-). But there truly is an issue that need this solution, however small it might seem to you. > If you had, you'd see the problem. Also >> depends on fs, of course. > > Is there some some documentation at postfix.org on this? > The code? This isn't an issue for normal PF use, since the queue ID only need be unique as long as the queue file actually exists... But is you do SQL logging (as we tend to do:-), it becomes an issue... This is also why no effort will ever be forthcoming from the PF devs... It's simply not their problem. >> >> > And I don't see how changing the algorithm for the five-letter-word would >> > solve the problem with the processing database. >> > >> If you go from totally random to deterministic/file, you'd still get >> the needed uniqueness as well as the same key for the same queue file >> (in the processing DB)... Which seems to be the problem needing to be >> solved...? > > Oh, if you use the file itself, yes ... I was thinking of something, uhm, > well, I don't know. > :-) > Anyway, the point is, that many of us will simply don't need this. It's just > some more milliseconds added to processing. In the recent past people have > already complained several times about performance. Why hamper performance > where it is not necessary? > I think Jules is aiming at microseconds...:-). And as such, well spent;) Who knows, perhaps one should do it as an option ... Like: if you use the processing DB, then you get deterministic "entropy" added to the queue file name, else you get the regular entropy as we have had for quite some time now. > Btw, Julian, you wanted me to remind you that the processing db option should > be set to off by default! :-) > > Kai > Cheers -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From maxsec at gmail.com Mon Apr 20 13:47:23 2009 From: maxsec at gmail.com (Martin Hepworth) Date: Mon Apr 20 13:47:32 2009 Subject: Potential issue with docx format and Clam In-Reply-To: References: Message-ID: <72cf361e0904200547o9ccc57dy7dee11d20213ea47@mail.gmail.com> Jeff what happens if you use Clamd rather than the module so you can update quicker (no reliance on module maintainers releasing a new version) and MS children are smaller and startup faster? -- Martin Hepworth Oxford, UK 2009/4/20 Jeff A. Earickson > Julian, > > I'm forwarding along a note from our support desk people, who seem to > have uncovered an issue with Office 2007/2008 docx file formats and > the ClamAV recursion level. In my case, I am running MS 4.75.9-2 with > > ClamAVmodule Maximum Recursion Level = 8 > > Adam's detective work below suggests that this setting may be too low > for Office 2007/2008 docx attachments. Anybody else seen this? > > (Time for me to upgrade to the latest stable version, or the latest beta). > > Jeff Earickson > Colby College > > ---------- Forwarded message ---------- > > I did some experimenting with this situation [rejections of email with > "Report: MailScanner: Message contained archive nested too deeply" messages] > and here is what I found: > > - As you may or may not know the new Office 2007/2008 file format is really > just a renamed .zip file containing other files and folders that make up > the > document. > > - If you insert an object into a .docx that is, for instance, a PowerPoint > slide it is inserted as a .pptx (again, just a .zip with a different > extension). > > - If that slide contains an inserted Excel table, it is inserted as a .xlsx > (.zip). > > - So if you add all those up you have the original .docx, which contains a > folder called "embedded", in that folder is a .pptx file, inside that is a > folder called "embedded", in that folder is a .xlsx file, inside that is a > series of files and folders. So all that added up is 7 layers. > > I was able to duplicate Todd's error with my own .docx, .pptx and .xlsx, > but > I noticed that it had to be all three. If I tried to email a .docx with > just a PowerPoint slide embedded it went fine. And if I tried to email a > .pptx with an embedded Excel Table that went fine too. So it seems as > though we may need to adjust some settings on MailScanner to allow for this > type of file to pass because as we convert more and more people to Office > 2007/2008 we are going to be more likely to run into these types of > situations. > > ------------ > Adam Nielsen > Faculty and Staff Support Center > x4222 > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090420/6f2504cf/attachment.html From maxsec at gmail.com Mon Apr 20 13:49:12 2009 From: maxsec at gmail.com (Martin Hepworth) Date: Mon Apr 20 13:49:21 2009 Subject: OT: SUN no more.. Message-ID: <72cf361e0904200549o5389e054weabf7e0665ccc23d@mail.gmail.com> In case you ain't heard already.. http://news.bbc.co.uk/1/hi/business/8008246.stm -- Martin Hepworth Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090420/116ac2ad/attachment.html From admin at lctn.org Mon Apr 20 14:13:31 2009 From: admin at lctn.org (Raymond Norton) Date: Mon Apr 20 14:13:40 2009 Subject: best way to combat porn email In-Reply-To: <49EC2848.4080601@fsl.com> References: <3128903.01240147211609.JavaMail.root@mail.lctn.org> <20506215.21240147220830.JavaMail.root@mail.lctn.org> <49EB4380.7000808@fsl.com> <49EB91DD.4030309@lctn.org> <49EC2848.4080601@fsl.com> Message-ID: <49EC74FB.5030906@lctn.org> Steve Freegard wrote: > Raymond Norton wrote: > >> I also have the following in main.cf of postfix, so not sure why it got >> through in the first place: >> smtpd_client_restrictions = >> reject_rbl_client sbl-xbl.spamhaus.org, >> > > Change that to zen.spamhaus.org... > > >> reject_rbl_client list.dsbl.org >> > > Remove this; it's been dead for months and is now pointing at dead > nameservers to time-out all queries. > > I found that out yesterday, and made the change. I am back on my main mailscanner this morning, and am seeing email like the following come through. It seems bayes is fine. What can I add or change to catch this type of garbage: 79.48.183.69 host69-183-static.48-79-b.business.telecomitalia.it Italy [ ] [ ] [ ] [ ] ID: A435A136D54.B555F Message Headers: Received: from qlpa.telecomitalia.it (host69-183-static.48-79-b.business.telecomitalia.it [79.48.183.69]) by relay-4.lctn.org (Postfix) with SMTP id A435A136D54 for ; Mon, 20 Apr 2009 08:09:40 -0500 (CDT) Message-ID: <49EC739F.3391675@vkb.com> Date: Mon, 20 Apr 2009 13:09:41 +0000 From: Divine User-Agent: Thunderbird 2.0.0.21 (Windows/20090302) MIME-Version: 1.0 To: jmetcalf@gsl.k12.mn.us Subject: Muultiple Orgasms - How to Give Her Multiple Miracles Every Time Content-Type: multipart/alternative; boundary="------------203835226114440204389968" From: saner@vkb.com [Add to Whitelist | Add to Blacklist] To: jmetcalf@gsl.k12.mn.us Subject: Muultiple Orgasms - How to Give Her Multiple Miracles Every Time Size: 3.5Kb Anti-Virus/Dangerous Content Protection Virus: N Blocked File: N Other Infection: N SpamAssassin Spam: N Action(s): deliver, header, "X-Spam-Status:, No" High Scoring Spam: N SpamAssassin Spam: N Listed in RBL: N Spam Whitelisted: N Spam Blacklisted: N SpamAssassin Autolearn: N SpamAssassin Score: 2.32 Spam Report: Score Matching Rule Descriptioncached not score=2.316 3 required -0.18 BAYES_40 Bayesian spam probability is 20 to 40% 0.00 HTML_MESSAGE HTML included in message 0.50 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% 1.50 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level above 50% 0.50 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) From jaearick at colby.edu Mon Apr 20 14:25:31 2009 From: jaearick at colby.edu (Jeff A. Earickson) Date: Mon Apr 20 14:25:54 2009 Subject: Potential issue with docx format and Clam In-Reply-To: <72cf361e0904200547o9ccc57dy7dee11d20213ea47@mail.gmail.com> References: <72cf361e0904200547o9ccc57dy7dee11d20213ea47@mail.gmail.com> Message-ID: Martin, I do run clamd, so maybe this entry in MailScanner.conf has nothing to do with my problem. Time to look at my clamd.conf file... Thanks for the whack on the head. As for Oracle buying Sun, NOOOOO.... Say it ain't so. We use a calendaring software originally put out by Steltor in Canada. Oracle bought them out and turned it into Oracle Calendar. It is the exact same product under the covers, but Oracle buried it under tons of code gook that makes it impossible to patch or reinstall. They took a 100 MB install and bloated it to 4+ GB. And their support structure is the most opaque and unfriendly of any tech company that I have ever dealt with. I can't imagine what they will do to Solaris. Jeff Earickson Colby College On Mon, 20 Apr 2009, Martin Hepworth wrote: > Date: Mon, 20 Apr 2009 13:47:23 +0100 > From: Martin Hepworth > Reply-To: MailScanner discussion > To: MailScanner discussion > Subject: Re: Potential issue with docx format and Clam > > Jeff > what happens if you use Clamd rather than the module so you can update > quicker (no reliance on module maintainers releasing a new version) and MS > children are smaller and startup faster? > > -- > Martin Hepworth > Oxford, UK > > 2009/4/20 Jeff A. Earickson > >> Julian, >> >> I'm forwarding along a note from our support desk people, who seem to >> have uncovered an issue with Office 2007/2008 docx file formats and >> the ClamAV recursion level. In my case, I am running MS 4.75.9-2 with >> >> ClamAVmodule Maximum Recursion Level = 8 >> >> Adam's detective work below suggests that this setting may be too low >> for Office 2007/2008 docx attachments. Anybody else seen this? >> >> (Time for me to upgrade to the latest stable version, or the latest beta). >> >> Jeff Earickson >> Colby College >> >> ---------- Forwarded message ---------- >> >> I did some experimenting with this situation [rejections of email with >> "Report: MailScanner: Message contained archive nested too deeply" messages] >> and here is what I found: >> >> - As you may or may not know the new Office 2007/2008 file format is really >> just a renamed .zip file containing other files and folders that make up >> the >> document. >> >> - If you insert an object into a .docx that is, for instance, a PowerPoint >> slide it is inserted as a .pptx (again, just a .zip with a different >> extension). >> >> - If that slide contains an inserted Excel table, it is inserted as a .xlsx >> (.zip). >> >> - So if you add all those up you have the original .docx, which contains a >> folder called "embedded", in that folder is a .pptx file, inside that is a >> folder called "embedded", in that folder is a .xlsx file, inside that is a >> series of files and folders. So all that added up is 7 layers. >> >> I was able to duplicate Todd's error with my own .docx, .pptx and .xlsx, >> but >> I noticed that it had to be all three. If I tried to email a .docx with >> just a PowerPoint slide embedded it went fine. And if I tried to email a >> .pptx with an embedded Excel Table that went fine too. So it seems as >> though we may need to adjust some settings on MailScanner to allow for this >> type of file to pass because as we convert more and more people to Office >> 2007/2008 we are going to be more likely to run into these types of >> situations. >> >> ------------ >> Adam Nielsen >> Faculty and Staff Support Center >> x4222 >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> > From admin at lctn.org Mon Apr 20 14:27:17 2009 From: admin at lctn.org (Raymond Norton) Date: Mon Apr 20 14:27:25 2009 Subject: increasing country code score Message-ID: <49EC7835.60504@lctn.org> On a previous mailscanner install I increased the score on all foreign countries. I am drawing a blank on how I did that, and have not found the answer googling around. I'm sure its simple:) From prandal at herefordshire.gov.uk Mon Apr 20 14:29:09 2009 From: prandal at herefordshire.gov.uk (Randal, Phil) Date: Mon Apr 20 14:29:35 2009 Subject: best way to combat porn email In-Reply-To: <49EC74FB.5030906@lctn.org> References: <3128903.01240147211609.JavaMail.root@mail.lctn.org> <20506215.21240147220830.JavaMail.root@mail.lctn.org> <49EB4380.7000808@fsl.com> <49EB91DD.4030309@lctn.org><49EC2848.4080601@fsl.com> <49EC74FB.5030906@lctn.org> Message-ID: <7EF0EE5CB3B263488C8C18823239BEBA0676148C@HC-MBX02.herefordshire.gov.uk> All these emails contain links to websites hosted on ..interia.pl, so a high-scoring spamassassin uri rule can easily catch these. uri MY_INTERIA /^http:\/\/.{1,30}\.interia\.pl/i describe MY_INTERIA Suspicious interia.pl links score MY_INTERIA 5 They also all claim to be sent via Thunderbird ("User-Agent: Thunderbird 2.0.0.21 (Windows/20090302)"), so you could create a meta rule cobining both those factors. Cheers, Phil -- Phil Randal | Networks Engineer Herefordshire Council | Deputy Chief Executive's Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, Hereford, HR2 6JT Tel: 01432 260160 email: prandal@herefordshire.gov.uk Any opinion expressed in this e-mail or any attached files are those of the individual and not necessarily those of Herefordshire Council. This e-mail and any attached files are confidential and intended solely for the use of the addressee. This communication may contain material protected by law from being passed on. If you are not the intended recipient and have received this e-mail in error, you are advised that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender immediately and destroy all copies of it. -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Raymond Norton Sent: 20 April 2009 14:14 To: MailScanner discussion Subject: Re: best way to combat porn email Steve Freegard wrote: > Raymond Norton wrote: > >> I also have the following in main.cf of postfix, so not sure why it >> got through in the first place: >> smtpd_client_restrictions = >> reject_rbl_client sbl-xbl.spamhaus.org, >> > > Change that to zen.spamhaus.org... > > >> reject_rbl_client list.dsbl.org >> > > Remove this; it's been dead for months and is now pointing at dead > nameservers to time-out all queries. > > I found that out yesterday, and made the change. I am back on my main mailscanner this morning, and am seeing email like the following come through. It seems bayes is fine. What can I add or change to catch this type of garbage: 79.48.183.69 host69-183-static.48-79-b.business.telecomitalia.it Italy [ ] [ ] [ ] [ ] ID: A435A136D54.B555F Message Headers: Received: from qlpa.telecomitalia.it (host69-183-static.48-79-b.business.telecomitalia.it [79.48.183.69]) by relay-4.lctn.org (Postfix) with SMTP id A435A136D54 for ; Mon, 20 Apr 2009 08:09:40 -0500 (CDT) Message-ID: <49EC739F.3391675@vkb.com> Date: Mon, 20 Apr 2009 13:09:41 +0000 From: Divine User-Agent: Thunderbird 2.0.0.21 (Windows/20090302) MIME-Version: 1.0 To: jmetcalf@gsl.k12.mn.us Subject: Muultiple Orgasms - How to Give Her Multiple Miracles Every Time Content-Type: multipart/alternative; boundary="------------203835226114440204389968" From: saner@vkb.com [Add to Whitelist | Add to Blacklist] To: jmetcalf@gsl.k12.mn.us Subject: Muultiple Orgasms - How to Give Her Multiple Miracles Every Time Size: 3.5Kb Anti-Virus/Dangerous Content Protection Virus: N Blocked File: N Other Infection: N SpamAssassin Spam: N Action(s): deliver, header, "X-Spam-Status:, No" High Scoring Spam: N SpamAssassin Spam: N Listed in RBL: N Spam Whitelisted: N Spam Blacklisted: N SpamAssassin Autolearn: N SpamAssassin Score: 2.32 Spam Report: Score Matching Rule Descriptioncached not score=2.316 3 required -0.18 BAYES_40 Bayesian spam probability is 20 to 40% 0.00 HTML_MESSAGE HTML included in message 0.50 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% 1.50 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level above 50% 0.50 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From support-lists at petdoctors.co.uk Mon Apr 20 14:34:29 2009 From: support-lists at petdoctors.co.uk (Nigel Kendrick) Date: Mon Apr 20 14:34:25 2009 Subject: best way to combat porn email In-Reply-To: <49EC74FB.5030906@lctn.org> References: <3128903.01240147211609.JavaMail.root@mail.lctn.org> <20506215.21240147220830.JavaMail.root@mail.lctn.org> <49EB4380.7000808@fsl.com> <49EB91DD.4030309@lctn.org><49EC2848.4080601@fsl.com> <49EC74FB.5030906@lctn.org> Message-ID: Have you -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Raymond Norton Sent: Monday, April 20, 2009 2:14 PM To: MailScanner discussion Subject: Re: best way to combat porn email Steve Freegard wrote: > Raymond Norton wrote: > >> I also have the following in main.cf of postfix, so not sure why it got >> through in the first place: >> smtpd_client_restrictions = >> reject_rbl_client sbl-xbl.spamhaus.org, >> > > Change that to zen.spamhaus.org... > > >> reject_rbl_client list.dsbl.org >> > > Remove this; it's been dead for months and is now pointing at dead > nameservers to time-out all queries. > > I found that out yesterday, and made the change. I am back on my main mailscanner this morning, and am seeing email like the following come through. It seems bayes is fine. What can I add or change to catch this type of garbage: 79.48.183.69 host69-183-static.48-79-b.business.telecomitalia.it Italy [ ] [ ] [ ] [ ] ID: A435A136D54.B555F Message Headers: Received: from qlpa.telecomitalia.it (host69-183-static.48-79-b.business.telecomitalia.it [79.48.183.69]) by relay-4.lctn.org (Postfix) with SMTP id A435A136D54 for ; Mon, 20 Apr 2009 08:09:40 -0500 (CDT) Message-ID: <49EC739F.3391675@vkb.com> Date: Mon, 20 Apr 2009 13:09:41 +0000 From: Divine User-Agent: Thunderbird 2.0.0.21 (Windows/20090302) MIME-Version: 1.0 To: jmetcalf@gsl.k12.mn.us Subject: Muultiple Orgasms - How to Give Her Multiple Miracles Every Time Content-Type: multipart/alternative; boundary="------------203835226114440204389968" From: saner@vkb.com [Add to Whitelist | Add to Blacklist] To: jmetcalf@gsl.k12.mn.us Subject: Muultiple Orgasms - How to Give Her Multiple Miracles Every Time Size: 3.5Kb Anti-Virus/Dangerous Content Protection Virus: N Blocked File: N Other Infection: N SpamAssassin Spam: N Action(s): deliver, header, "X-Spam-Status:, No" High Scoring Spam: N SpamAssassin Spam: N Listed in RBL: N Spam Whitelisted: N Spam Blacklisted: N SpamAssassin Autolearn: N SpamAssassin Score: 2.32 Spam Report: Score Matching Rule Descriptioncached not score=2.316 3 required -0.18 BAYES_40 Bayesian spam probability is 20 to 40% 0.00 HTML_MESSAGE HTML included in message 0.50 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% 1.50 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level above 50% 0.50 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From jaearick at colby.edu Mon Apr 20 14:56:59 2009 From: jaearick at colby.edu (Jeff A. Earickson) Date: Mon Apr 20 14:57:19 2009 Subject: Potential issue with docx format and Clam In-Reply-To: <72cf361e0904200547o9ccc57dy7dee11d20213ea47@mail.gmail.com> References: <72cf361e0904200547o9ccc57dy7dee11d20213ea47@mail.gmail.com> Message-ID: Found this one... The setting I needed was: Maximum Archive Depth = 3 I changed this to 8 and things started working for the Office 2007 crowd. Jeff Earickson Colby College On Mon, 20 Apr 2009, Martin Hepworth wrote: > Date: Mon, 20 Apr 2009 13:47:23 +0100 > From: Martin Hepworth > Reply-To: MailScanner discussion > To: MailScanner discussion > Subject: Re: Potential issue with docx format and Clam > > Jeff > what happens if you use Clamd rather than the module so you can update > quicker (no reliance on module maintainers releasing a new version) and MS > children are smaller and startup faster? > > -- > Martin Hepworth > Oxford, UK > > 2009/4/20 Jeff A. Earickson > >> Julian, >> >> I'm forwarding along a note from our support desk people, who seem to >> have uncovered an issue with Office 2007/2008 docx file formats and >> the ClamAV recursion level. In my case, I am running MS 4.75.9-2 with >> >> ClamAVmodule Maximum Recursion Level = 8 >> >> Adam's detective work below suggests that this setting may be too low >> for Office 2007/2008 docx attachments. Anybody else seen this? >> >> (Time for me to upgrade to the latest stable version, or the latest beta). >> >> Jeff Earickson >> Colby College >> >> ---------- Forwarded message ---------- >> >> I did some experimenting with this situation [rejections of email with >> "Report: MailScanner: Message contained archive nested too deeply" messages] >> and here is what I found: >> >> - As you may or may not know the new Office 2007/2008 file format is really >> just a renamed .zip file containing other files and folders that make up >> the >> document. >> >> - If you insert an object into a .docx that is, for instance, a PowerPoint >> slide it is inserted as a .pptx (again, just a .zip with a different >> extension). >> >> - If that slide contains an inserted Excel table, it is inserted as a .xlsx >> (.zip). >> >> - So if you add all those up you have the original .docx, which contains a >> folder called "embedded", in that folder is a .pptx file, inside that is a >> folder called "embedded", in that folder is a .xlsx file, inside that is a >> series of files and folders. So all that added up is 7 layers. >> >> I was able to duplicate Todd's error with my own .docx, .pptx and .xlsx, >> but >> I noticed that it had to be all three. If I tried to email a .docx with >> just a PowerPoint slide embedded it went fine. And if I tried to email a >> .pptx with an embedded Excel Table that went fine too. So it seems as >> though we may need to adjust some settings on MailScanner to allow for this >> type of file to pass because as we convert more and more people to Office >> 2007/2008 we are going to be more likely to run into these types of >> situations. >> >> ------------ >> Adam Nielsen >> Faculty and Staff Support Center >> x4222 >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> > From admin at lctn.org Mon Apr 20 15:01:01 2009 From: admin at lctn.org (Raymond Norton) Date: Mon Apr 20 15:01:13 2009 Subject: best way to combat porn email In-Reply-To: <7EF0EE5CB3B263488C8C18823239BEBA0676148C@HC-MBX02.herefordshire.gov.uk> References: <3128903.01240147211609.JavaMail.root@mail.lctn.org> <20506215.21240147220830.JavaMail.root@mail.lctn.org> <49EB4380.7000808@fsl.com> <49EB91DD.4030309@lctn.org><49EC2848.4080601@fsl.com> <49EC74FB.5030906@lctn.org> <7EF0EE5CB3B263488C8C18823239BEBA0676148C@HC-MBX02.herefordshire.gov.uk> Message-ID: <49EC801D.8020708@lctn.org> Randal, Phil wrote: > All these emails contain links to websites hosted on name>..interia.pl, so a high-scoring spamassassin uri rule can > easily catch these. > > uri MY_INTERIA /^http:\/\/.{1,30}\.interia\.pl/i > describe MY_INTERIA Suspicious interia.pl links > score MY_INTERIA 5 > > They also all claim to be sent via Thunderbird ("User-Agent: Thunderbird > 2.0.0.21 (Windows/20090302)"), so you could create a meta rule cobining > both those factors. > > I will give that a try. I have never written a custom rule. Is local.cf the best place for it, or is a different location recommended. From MailScanner at ecs.soton.ac.uk Mon Apr 20 15:02:40 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Mon Apr 20 15:02:58 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: <223f97700904200540r3c4206d4wc69209c1bc487694@mail.gmail.com> References: <49EC3202.5040805@ecs.soton.ac.uk> <223f97700904200148o773b513due9361af7c59163b8@mail.gmail.com> <49EC3B75.2020107@ecs.soton.ac.uk> <223f97700904200344o41fe70ecm39d4b2ca513fc8e0@mail.gmail.com> <223f97700904200540r3c4206d4wc69209c1bc487694@mail.gmail.com> <49EC8080.1040201@ecs.soton.ac.uk> Message-ID: On 20/04/2009 13:40, Glenn Steen wrote: > 2009/4/20 Kai Schaetzl: > >> Anyway, the point is, that many of us will simply don't need this. It's just >> some more milliseconds added to processing. In the recent past people have >> already complained several times about performance. Why hamper performance >> where it is not necessary? >> >> > I think Jules is aiming at microseconds...:-). And as such, well spent;) > Who knows, perhaps one should do it as an option ... Like: if you use > the processing DB, then you get deterministic "entropy" added to the > queue file name, else you get the regular entropy as we have had for > quite some time now. > I don't intend adding a configuration option for something as small as this. The overall effect on speed will be tiny, it just has to read 256 bytes out of a file that it will be about to read into memory anyway, so the cost does not involve a single disk read, it will be in memory buffers anyway. I would be interested to see if you can actually make the load difference measurable on a real system. I deliberately and carefully chose a checksum algorithm that would work as fast as possible while providing the necessary resilience that it's there for. It is far faster than a CRC check, let alone something crazy like MD5. If you read the code, you can work out the number of add and mask operations that are used in its implementation. It doesn't involve a single multiply or divide operation, just bit-masking and adding. And furthermore, 99.99% of users would never change the option as they wouldn't understand it, and I try to avoid having tweaks that only 1 user will ever change. And don't forget that it costs time to evaluate a configuration option, they aren't free. You have the source. If you don't like it, supply your own PostfixKey subroutine in Postfix.pm. > >> Btw, Julian, you wanted me to remind you that the processing db option should >> be set to off by default! :-) >> Thank you for the reminder. In the next stable release I do intend to make it off by default, I fully intended to leave it on in the betas so it would be tested. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Mon Apr 20 15:03:39 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Mon Apr 20 15:03:58 2009 Subject: Potential issue with docx format and Clam In-Reply-To: References: <72cf361e0904200547o9ccc57dy7dee11d20213ea47@mail.gmail.com> <49EC80BB.204@ecs.soton.ac.uk> Message-ID: I have just changed the default to 8. Thanks for letting me know about this one. On 20/04/2009 14:56, Jeff A. Earickson wrote: > Found this one... The setting I needed was: > > Maximum Archive Depth = 3 > > I changed this to 8 and things started working for the Office 2007 crowd. > > Jeff Earickson > Colby College > > On Mon, 20 Apr 2009, Martin Hepworth wrote: > >> Date: Mon, 20 Apr 2009 13:47:23 +0100 >> From: Martin Hepworth >> Reply-To: MailScanner discussion >> To: MailScanner discussion >> Subject: Re: Potential issue with docx format and Clam >> >> Jeff >> what happens if you use Clamd rather than the module so you can update >> quicker (no reliance on module maintainers releasing a new version) >> and MS >> children are smaller and startup faster? >> >> -- >> Martin Hepworth >> Oxford, UK >> >> 2009/4/20 Jeff A. Earickson >> >>> Julian, >>> >>> I'm forwarding along a note from our support desk people, who seem to >>> have uncovered an issue with Office 2007/2008 docx file formats and >>> the ClamAV recursion level. In my case, I am running MS 4.75.9-2 with >>> >>> ClamAVmodule Maximum Recursion Level = 8 >>> >>> Adam's detective work below suggests that this setting may be too low >>> for Office 2007/2008 docx attachments. Anybody else seen this? >>> >>> (Time for me to upgrade to the latest stable version, or the latest >>> beta). >>> >>> Jeff Earickson >>> Colby College >>> >>> ---------- Forwarded message ---------- >>> >>> I did some experimenting with this situation [rejections of email with >>> "Report: MailScanner: Message contained archive nested too deeply" >>> messages] >>> and here is what I found: >>> >>> - As you may or may not know the new Office 2007/2008 file format is >>> really >>> just a renamed .zip file containing other files and folders that >>> make up >>> the >>> document. >>> >>> - If you insert an object into a .docx that is, for instance, a >>> PowerPoint >>> slide it is inserted as a .pptx (again, just a .zip with a different >>> extension). >>> >>> - If that slide contains an inserted Excel table, it is inserted as >>> a .xlsx >>> (.zip). >>> >>> - So if you add all those up you have the original .docx, which >>> contains a >>> folder called "embedded", in that folder is a .pptx file, inside >>> that is a >>> folder called "embedded", in that folder is a .xlsx file, inside >>> that is a >>> series of files and folders. So all that added up is 7 layers. >>> >>> I was able to duplicate Todd's error with my own .docx, .pptx and >>> .xlsx, >>> but >>> I noticed that it had to be all three. If I tried to email a .docx >>> with >>> just a PowerPoint slide embedded it went fine. And if I tried to >>> email a >>> .pptx with an embedded Excel Table that went fine too. So it seems as >>> though we may need to adjust some settings on MailScanner to allow >>> for this >>> type of file to pass because as we convert more and more people to >>> Office >>> 2007/2008 we are going to be more likely to run into these types of >>> situations. >>> >>> ------------ >>> Adam Nielsen >>> Faculty and Staff Support Center >>> x4222 >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >> Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From support-lists at petdoctors.co.uk Mon Apr 20 15:13:25 2009 From: support-lists at petdoctors.co.uk (Nigel Kendrick) Date: Mon Apr 20 15:13:52 2009 Subject: best way to combat porn email In-Reply-To: <49EC801D.8020708@lctn.org> References: <3128903.01240147211609.JavaMail.root@mail.lctn.org> <20506215.21240147220830.JavaMail.root@mail.lctn.org> <49EB4380.7000808@fsl.com> <49EB91DD.4030309@lctn.org><49EC2848.4080601@fsl.com> <49EC74FB.5030906@lctn.org><7EF0EE5CB3B263488C8C18823239BEBA0676148C@HC-MBX02.herefordshire.gov.uk> <49EC801D.8020708@lctn.org> Message-ID: Duh - let me try that again without pressing send before I have finished.. Have you considered adding the Sanesecurity spamassassin rules? Nigel -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Raymond Norton Sent: Monday, April 20, 2009 3:01 PM To: MailScanner discussion Subject: Re: best way to combat porn email Randal, Phil wrote: > All these emails contain links to websites hosted on name>..interia.pl, so a high-scoring spamassassin uri rule can > easily catch these. > > uri MY_INTERIA /^http:\/\/.{1,30}\.interia\.pl/i > describe MY_INTERIA Suspicious interia.pl links > score MY_INTERIA 5 > > They also all claim to be sent via Thunderbird ("User-Agent: Thunderbird > 2.0.0.21 (Windows/20090302)"), so you could create a meta rule cobining > both those factors. > > I will give that a try. I have never written a custom rule. Is local.cf the best place for it, or is a different location recommended. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From admin at lctn.org Mon Apr 20 15:20:35 2009 From: admin at lctn.org (Raymond Norton) Date: Mon Apr 20 15:20:45 2009 Subject: best way to combat porn email In-Reply-To: References: <3128903.01240147211609.JavaMail.root@mail.lctn.org> <20506215.21240147220830.JavaMail.root@mail.lctn.org> <49EB4380.7000808@fsl.com> <49EB91DD.4030309@lctn.org><49EC2848.4080601@fsl.com> <49EC74FB.5030906@lctn.org><7EF0EE5CB3B263488C8C18823239BEBA0676148C@HC-MBX02.herefordshire.gov.uk> <49EC801D.8020708@lctn.org> Message-ID: <49EC84B3.6040601@lctn.org> Nigel Kendrick wrote: > Duh - let me try that again without pressing send before I have finished.. > > Have you considered adding the Sanesecurity spamassassin rules? > > > I am game to add anything that will not cause a big hit on performance. Do you have a good doc link to a howto? From JBracey at csuchico.edu Mon Apr 20 15:21:10 2009 From: JBracey at csuchico.edu (Bracey, John) Date: Mon Apr 20 15:22:05 2009 Subject: trouble installing mailscanner on freeBSD 6.2 server In-Reply-To: <200904190801.n3J810Sv031612@safir.blacknight.ie> References: <9ADE954C5044754C8E0BF406B5A217552DD2AD6E@ESCHE.csuchico.edu><20090417034520.D17261701A@out-b.mx.mail-launder.com><200904170533.n3H5XkxQ001132@safir.blacknight.ie><20090419043629.482241701E@out-b.mx.mail-launder.com> <200904190801.n3J810Sv031612@safir.blacknight.ie> Message-ID: <9ADE954C5044754C8E0BF406B5A217552DDE8563@ESCHE.csuchico.edu> Drew: Thanks again for the assistance. I was able to get the version you forwarded me installed after deinstalling the other version. However I'm running into the same issues again: [root@scooby ~]# mailscanner -debug -debug-sa /usr/local/etc/MailScanner/MailScanner.conf In Debugging mode, not forking... Trying to setlogsock(unix) ***** If 'awk' (with support for the function strftime) was available on your $PATH then all the SpamAssassin debug output would have the current time added to the start of every line, making debugging far easier. ***** Fatal error 'Recurse on a private mutex.' at line 986 in file /usr/src/lib/libpthread/thread/thr_mutex.c (errno = 0) Abort trap: 6 Sorry to be such a pain. But I do appreciate the help. -John Bracey -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Drew Marshall Sent: Sunday, April 19, 2009 1:01 AM To: MailScanner discussion Subject: Re: trouble installing mailscanner on freeBSD 6.2 server -- In line with our policy, this message has been scanned for viruses and dangerous content by our Mail Launder system www.mail-launder.com Our email policy can be found at www.trunknetworks.com/policy Trunk Networks Limited is registered in Scotland with registration number: 351063 Registered Office 55-57 West High Street Inverurie AB51 3QQ From J.Ede at birchenallhowden.co.uk Mon Apr 20 15:28:11 2009 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Mon Apr 20 15:28:29 2009 Subject: best way to combat porn email In-Reply-To: <49EC84B3.6040601@lctn.org> References: <3128903.01240147211609.JavaMail.root@mail.lctn.org> <20506215.21240147220830.JavaMail.root@mail.lctn.org> <49EB4380.7000808@fsl.com> <49EB91DD.4030309@lctn.org><49EC2848.4080601@fsl.com> <49EC74FB.5030906@lctn.org><7EF0EE5CB3B263488C8C18823239BEBA0676148C@HC-MBX02.herefordshire.gov.uk> <49EC801D.8020708@lctn.org> <49EC84B3.6040601@lctn.org> Message-ID: <1213490F1F316842A544A850422BFA96239CFC27@BHLSBS.bhl.local> I still get quite a few hits using the SARE_ADULT ruleset and KAM.sh (see one of Jule's posts from last year about that) seems to get a lot of the adult stuff. Jason -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Raymond Norton Sent: 20 April 2009 15:21 To: MailScanner discussion Subject: Re: best way to combat porn email Nigel Kendrick wrote: > Duh - let me try that again without pressing send before I have finished.. > > Have you considered adding the Sanesecurity spamassassin rules? > > > I am game to add anything that will not cause a big hit on performance. Do you have a good doc link to a howto? -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From glenn.steen at gmail.com Mon Apr 20 15:35:36 2009 From: glenn.steen at gmail.com (Glenn Steen) Date: Mon Apr 20 15:35:45 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <223f97700904200148o773b513due9361af7c59163b8@mail.gmail.com> <49EC3B75.2020107@ecs.soton.ac.uk> <223f97700904200344o41fe70ecm39d4b2ca513fc8e0@mail.gmail.com> <49EC8080.1040201@ecs.soton.ac.uk> <223f97700904200540r3c4206d4wc69209c1bc487694@mail.gmail.com> Message-ID: <223f97700904200735l4342870ftbfab08d58cd7e8de@mail.gmail.com> 2009/4/20 Julian Field : > > > On 20/04/2009 13:40, Glenn Steen wrote: >> >> 2009/4/20 Kai Schaetzl: >> >>> >>> Anyway, the point is, that many of us will simply don't need this. It's >>> just >>> some more milliseconds added to processing. In the recent past people >>> have >>> already complained several times about performance. Why hamper >>> performance >>> where it is not necessary? >>> >>> >> >> I think Jules is aiming at microseconds...:-). And as such, well spent;) >> Who knows, perhaps one should do it as an option ... Like: if you use >> the processing DB, then you get deterministic "entropy" added to the >> queue file name, else you get the regular entropy as we have had for >> quite some time now. >> > > I don't intend adding a configuration option for something as small as this. > The overall effect on speed will be tiny, it just has to read 256 bytes out > of a file that it will be about to read into memory anyway, so the cost does > not involve a single disk read, it will be in memory buffers anyway. I would > be interested to see if you can actually make the load difference measurable > on a real system. > > I deliberately and carefully chose a checksum algorithm that would work as > fast as possible while providing the necessary resilience that it's there > for. It is far faster than a CRC check, let alone something crazy like MD5. > If you read the code, you can work out the number of add and mask operations > that are used in its implementation. It doesn't involve a single multiply or > divide operation, just bit-masking and adding. > > And furthermore, 99.99% of users would never change the option as they > wouldn't understand it, and I try to avoid having tweaks that only 1 user > will ever change. And don't forget that it costs time to evaluate a > configuration option, they aren't free. > > You have the source. If you don't like it, supply your own PostfixKey > subroutine in Postfix.pm. Hm. Ok. I meant that the already present option could be used;-). No matter. One sleek implementation will fit my needs perfectly. Cheers -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From mark at msapiro.net Mon Apr 20 15:48:21 2009 From: mark at msapiro.net (Mark Sapiro) Date: Mon Apr 20 15:48:30 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: <223f97700904200344o41fe70ecm39d4b2ca513fc8e0@mail.gmail.com> References: <49EC24D7.2000502@ecs.soton.ac.uk> <49EC3202.5040805@ecs.soton.ac.uk> <223f97700904200148o773b513due9361af7c59163b8@mail.gmail.com> <49EC3B75.2020107@ecs.soton.ac.uk> <223f97700904200344o41fe70ecm39d4b2ca513fc8e0@mail.gmail.com> Message-ID: <20090420144821.GA3020@msapiro> On Mon, Apr 20, 2009 at 12:44:14PM +0200, Glenn Steen wrote: > If you go from totally random to deterministic/file, you'd still get > the needed uniqueness as well as the same key for the same queue file > (in the processing DB)... Which seems to be the problem needing to be > solved...? Yes, this appears to be the problem needing to be solved in Kai's case, but it is not the problem in my case. See my post at . Note that the Postfix log entries quoted in that post come from a grep of the ID only without the .entropy fragment and are the only entries found in the entire log. Also see the post at for additional information. I will install 4.76.13-1 and remove the current processing database and see if that makes a difference, but I won't have time to do this before tomorrow. -- Mark Sapiro mark at msapiro net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From support-lists at petdoctors.co.uk Mon Apr 20 15:52:38 2009 From: support-lists at petdoctors.co.uk (Nigel Kendrick) Date: Mon Apr 20 15:53:18 2009 Subject: best way to combat porn email In-Reply-To: <49EC84B3.6040601@lctn.org> References: <3128903.01240147211609.JavaMail.root@mail.lctn.org> <20506215.21240147220830.JavaMail.root@mail.lctn.org> <49EB4380.7000808@fsl.com> <49EB91DD.4030309@lctn.org><49EC2848.4080601@fsl.com> <49EC74FB.5030906@lctn.org><7EF0EE5CB3B263488C8C18823239BEBA0676148C@HC-MBX02.herefordshire.gov.uk> <49EC801D.8020708@lctn.org> <49EC84B3.6040601@lctn.org> Message-ID: Sure - Have a look here: http://www.sanesecurity.com/usage.htm I am using "script "2 which requires a small amount of (easy) configuration. To get the KAM.cf file (mentioned by Jason Ede), I have the following in a script in cron.daily: *************************** #!/bin/bash #NK Set this to 1 to have no delay (for testing) SKIPDELAY=0 #NK Set by script to 1 if MailScanner parameters need a reload RELOAD=0 # Insert a random delay up to this value, to spread virus updates round # the clock. 1800 seconds = 30 minutes. UPDATEMAXDELAY=600 if [ -f /etc/sysconfig/MailScanner ] ; then . /etc/sysconfig/MailScanner fi export UPDATEMAXDELAY if [ "x$SKIPDELAY" = "x1" ]; then echo "Skipping update delay. Please re-enable the delay when you have done testing" else logger -p mail.info -t KAM.cf.sh Delaying cron job up to $UPDATEMAXDELAY seconds perl -e "sleep int(rand($UPDATEMAXDELAY));" fi # JKF Fetch KAM.cf echo Fetching KAM.cf... cd /etc/mail/spamassassin # NK Keep a temp copy if [ -f ./KAM.cf.tmp ]; then rm -f KAM.cf.tmp fi if [ -f ./KAM.cf ]; then cp KAM.cf KAM.cf.tmp fi /usr/bin/wget -N http://www.peregrinehw.com/downloads/SpamAssassin/contrib/KAM.cf if [ "$?" = "0" ]; then if ( tail -10 KAM.cf | grep -q '^#.*EOF' ); then mv -f KAM.cf.tmp KAM.cf.backup echo "Update completed" RELOAD=1 else echo "ERROR: Could not find EOF marker" cp -f KAM.cf.tmp KAM.cf fi else cp -f KAM.cf.tmp KAM.cf fi if [ -f ./KAM.cf.tmp ]; then rm -f KAM.cf.tmp fi if [ "x$RELOAD" = "x1" ]; then echo Reloading MailScanner and SpamAssassin configuration rules /etc/init.d/MailScanner reload fi *************************** -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Raymond Norton Sent: Monday, April 20, 2009 3:21 PM To: MailScanner discussion Subject: Re: best way to combat porn email Nigel Kendrick wrote: > Duh - let me try that again without pressing send before I have finished.. > > Have you considered adding the Sanesecurity spamassassin rules? > > > I am game to add anything that will not cause a big hit on performance. Do you have a good doc link to a howto? -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Apr 20 16:35:10 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Mon Apr 20 16:35:27 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: <20090420144821.GA3020@msapiro> References: <49EC24D7.2000502@ecs.soton.ac.uk> <49EC3202.5040805@ecs.soton.ac.uk> <223f97700904200148o773b513due9361af7c59163b8@mail.gmail.com> <49EC3B75.2020107@ecs.soton.ac.uk> <223f97700904200344o41fe70ecm39d4b2ca513fc8e0@mail.gmail.com> <20090420144821.GA3020@msapiro> <49EC962E.3060506@ecs.soton.ac.uk> Message-ID: On 20/4/09 15:48, Mark Sapiro wrote: > On Mon, Apr 20, 2009 at 12:44:14PM +0200, Glenn Steen wrote: > > >> If you go from totally random to deterministic/file, you'd still get >> the needed uniqueness as well as the same key for the same queue file >> (in the processing DB)... Which seems to be the problem needing to be >> solved...? >> > > Yes, this appears to be the problem needing to be solved in Kai's case, > but it is not the problem in my case. See my post at > . > > Note that the Postfix log entries quoted in that post come from a grep > of the ID only without the .entropy fragment and are the only entries > found in the entire log. > Do you ever see any log entries containing "New Batch: Found invalid queue files:" when your mail source sends a large lump of messages? Also, please try the latest beta 4.76.14. This may help with this problem. I have worked out why it would end up with messages in there when it shouldn't, but I can't see where it actually does it. It shouldn't be able to happen. So I have added some more clauses to cause it to ignore partially-delivered messages, which are what must be causing the problem. Jules. > Also see the post at > > for additional information. > > I will install 4.76.13-1 and remove the current processing database and > see if that makes a difference, but I won't have time to do this before > tomorrow. > > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From maxsec at gmail.com Mon Apr 20 18:53:05 2009 From: maxsec at gmail.com (Martin Hepworth) Date: Mon Apr 20 18:53:15 2009 Subject: increasing country code score In-Reply-To: <49EC7835.60504@lctn.org> References: <49EC7835.60504@lctn.org> Message-ID: <72cf361e0904201053g648836cdva1e44273599d545@mail.gmail.com> It's a spamassassin rule 2009/4/20 Raymond Norton > On a previous mailscanner install I increased the score on all foreign > countries. I am drawing a blank on how I did that, and have not found the > answer googling around. I'm sure its simple:) > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- Martin Hepworth Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090420/84e575f9/attachment.html From admin at lctn.org Mon Apr 20 20:22:53 2009 From: admin at lctn.org (Raymond Norton) Date: Mon Apr 20 20:23:04 2009 Subject: rulesjudour question Message-ID: <49ECCB8D.2000401@lctn.org> I am looking at the docs for rulesjudour, and see the recommended location for the SA_DIR is /etc/mail/spamassassin. Is that the right path when using MailScanner? Raymond From ms-list at alexb.ch Mon Apr 20 20:38:05 2009 From: ms-list at alexb.ch (Alex Broens) Date: Mon Apr 20 20:38:15 2009 Subject: rulesjudour question In-Reply-To: <49ECCB8D.2000401@lctn.org> References: <49ECCB8D.2000401@lctn.org> Message-ID: <49ECCF1D.7090105@alexb.ch> On 4/20/2009 9:22 PM, Raymond Norton wrote: > I am looking at the docs for rulesjudour, and see the recommended > location for the SA_DIR is /etc/mail/spamassassin. Is that the right > path when using MailScanner? rulesjudour is obsolete, SARE rules are not being updated. Use sa-update instead. From admin at lctn.org Mon Apr 20 20:47:51 2009 From: admin at lctn.org (Raymond Norton) Date: Mon Apr 20 20:48:00 2009 Subject: rulesjudour question In-Reply-To: <49ECCF1D.7090105@alexb.ch> References: <49ECCB8D.2000401@lctn.org> <49ECCF1D.7090105@alexb.ch> Message-ID: <49ECD167.2020207@lctn.org> > > > rulesjudour is obsolete, SARE rules are not being updated. > > Use sa-update instead. I saw that as I scrolled down to the comments section. I was looking for info on the SARE_ADULT rule. What rule can I incorporate that would replace the sare rule? From ssilva at sgvwater.com Mon Apr 20 20:52:36 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Mon Apr 20 20:53:04 2009 Subject: trouble installing mailscanner on freeBSD 6.2 server In-Reply-To: <9ADE954C5044754C8E0BF406B5A217552DDE8563@ESCHE.csuchico.edu> References: <9ADE954C5044754C8E0BF406B5A217552DD2AD6E@ESCHE.csuchico.edu><20090417034520.D17261701A@out-b.mx.mail-launder.com><200904170533.n3H5XkxQ001132@safir.blacknight.ie><20090419043629.482241701E@out-b.mx.mail-launder.com> <200904190801.n3J810Sv031612@safir.blacknight.ie> <9ADE954C5044754C8E0BF406B5A217552DDE8563@ESCHE.csuchico.edu> Message-ID: on 4-20-2009 7:21 AM Bracey, John spake the following: > Drew: > > Thanks again for the assistance. I was able to get the version you > forwarded me installed after deinstalling the other version. However > I'm running into the same issues again: > > [root@scooby ~]# mailscanner -debug -debug-sa > /usr/local/etc/MailScanner/MailScanner.conf > In Debugging mode, not forking... > Trying to setlogsock(unix) > > > ***** > If 'awk' (with support for the function strftime) was > available on your $PATH then all the SpamAssassin debug > output would have the current time added to the start of > every line, making debugging far easier. > ***** > > Fatal error 'Recurse on a private mutex.' at line 986 in file > /usr/src/lib/libpthread/thread/thr_mutex.c (errno = 0) > Abort trap: 6 > I saw this.. http://www.cpanforum.com/posts/7792 You might give it a try. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090420/8b97ed9c/signature.bin From ssilva at sgvwater.com Mon Apr 20 20:57:35 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Mon Apr 20 21:00:13 2009 Subject: best way to combat porn email In-Reply-To: <20506215.21240147220830.JavaMail.root@mail.lctn.org> References: <3128903.01240147211609.JavaMail.root@mail.lctn.org> <20506215.21240147220830.JavaMail.root@mail.lctn.org> Message-ID: on 4-19-2009 6:20 AM Raymond Norton spake the following: > > ----- "Alex Neuman" wrote: > No, but you can just use anything you want. >> >> http://pastebin.com/m5cadad2d >> > > > I apologize for posting this much info, but I keep tripping the pastebin > spam filter when pasting my info. I have included the mailscanner info, > and matching headers. > You really get better results by posting the original queue file which you easily can have by quarantining everything, at least for a short time. You are posting from the received message at the MUA, which will be somewhat molested already. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090420/b656ffc9/signature.bin From admin at lctn.org Mon Apr 20 21:03:43 2009 From: admin at lctn.org (Raymond Norton) Date: Mon Apr 20 21:03:52 2009 Subject: best way to combat porn email In-Reply-To: References: <3128903.01240147211609.JavaMail.root@mail.lctn.org> <20506215.21240147220830.JavaMail.root@mail.lctn.org> Message-ID: <49ECD51F.6000704@lctn.org> > You really get better results by posting the original queue file which you > easily can have by quarantining everything, at least for a short time. > > You are posting from the received message at the MUA, which will be somewhat > molested already. > > OK. I can do that for a while From Kevin_Miller at ci.juneau.ak.us Mon Apr 20 21:13:48 2009 From: Kevin_Miller at ci.juneau.ak.us (Kevin Miller) Date: Mon Apr 20 21:14:01 2009 Subject: rulesjudour question In-Reply-To: <49ECD167.2020207@lctn.org> References: <49ECCB8D.2000401@lctn.org> <49ECCF1D.7090105@alexb.ch> <49ECD167.2020207@lctn.org> Message-ID: <4A09477D575C2C4B86497161427DD94C0D153E2A04@city-exchange07> Raymond Norton wrote: >> rulesjudour is obsolete, SARE rules are not being updated. >> >> Use sa-update instead. > > I saw that as I scrolled down to the comments section. I was looking > for info on the SARE_ADULT rule. What rule can I incorporate that > would replace the sare rule? You can still pull down the SARE rules - you just do it via sa-update now. But if they're no longer changing you really only need to drop the rule (or any other SARE rules) in the /etc/mail/spamassassin directory and it'll get read. ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 From lists at rheel.co.nz Mon Apr 20 21:57:49 2009 From: lists at rheel.co.nz (Lists) Date: Mon Apr 20 21:56:16 2009 Subject: help with understanding line in log Message-ID: <49ECE1CD.5080801@rheel.co.nz> Hi, I was wondering if the following meant that the email and attachment(FILE01.zip) got blocked or not. Banned Filename Report: (Total Seen = ) Password-protected archive (FILE01.zip): 1 Time(s) Regards, Kate From mailbag at partnersolutions.ca Mon Apr 20 22:06:35 2009 From: mailbag at partnersolutions.ca (PSI Mailbag) Date: Mon Apr 20 22:06:48 2009 Subject: help with understanding line in log In-Reply-To: <49ECE1CD.5080801@rheel.co.nz> References: <49ECE1CD.5080801@rheel.co.nz> Message-ID: <120EBC42C8319846842A4A49B3D5566BBDDAEE@psims003.pshosting.intranet> > I was wondering if the following meant that the email and > attachment(FILE01.zip) got blocked or not. > > Banned Filename Report: (Total Seen = ) > Password-protected archive (FILE01.zip): 1 Time(s) Based on the fact that this is a "banned filename report", the attachment should have been removed. However, you can search your logs for the message ID from the report and you'll be able to tell for sure. Typically the relevant log entry is along the lines of "Cleaned: Delivered # cleaned messages", which will be recorded immediately after your re-queued message entry. This will tell you if the message was delivered, if the attachment was removed, or if nothing was done. Cheers, -Joshua From ssilva at sgvwater.com Mon Apr 20 22:07:17 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Mon Apr 20 22:07:39 2009 Subject: best way to combat porn email In-Reply-To: <49ECD51F.6000704@lctn.org> References: <3128903.01240147211609.JavaMail.root@mail.lctn.org> <20506215.21240147220830.JavaMail.root@mail.lctn.org> <49ECD51F.6000704@lctn.org> Message-ID: on 4-20-2009 1:03 PM Raymond Norton spake the following: > >> You really get better results by posting the original queue file which >> you >> easily can have by quarantining everything, at least for a short time. >> >> You are posting from the received message at the MUA, which will be >> somewhat >> molested already. >> >> > > > OK. I can do that for a while I meant you get better results by pastebin-ing raw queue files. We can save them local and spamassassin < queuefile them and show what rules we hit it with. There are some of the sare rules that still hit, but they don't post any new stuff anymore except on the spamassassin list. I guess they got tired of either all the work, or being a target of every ddos that came along. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090420/ab63d1ae/signature.bin From ssilva at sgvwater.com Mon Apr 20 22:09:08 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Mon Apr 20 22:10:11 2009 Subject: help with understanding line in log In-Reply-To: <49ECE1CD.5080801@rheel.co.nz> References: <49ECE1CD.5080801@rheel.co.nz> Message-ID: on 4-20-2009 1:57 PM Lists spake the following: > Hi, > > I was wondering if the following meant that the email and > attachment(FILE01.zip) got blocked or not. > > Banned Filename Report: (Total Seen = ) > Password-protected archive (FILE01.zip): 1 Time(s) > > Regards, > Kate > The message was most likely passed on with the attachment removed and a text part added that explained that fact. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090420/d0bc3e63/signature.bin From lists at rheel.co.nz Mon Apr 20 22:24:17 2009 From: lists at rheel.co.nz (Lists) Date: Mon Apr 20 22:22:59 2009 Subject: help with understanding line in log In-Reply-To: References: <49ECE1CD.5080801@rheel.co.nz> Message-ID: <49ECE801.8000806@rheel.co.nz> Scott Silva wrote: > on 4-20-2009 1:57 PM Lists spake the following: > >> Hi, >> >> I was wondering if the following meant that the email and >> attachment(FILE01.zip) got blocked or not. >> >> Banned Filename Report: (Total Seen = ) >> Password-protected archive (FILE01.zip): 1 Time(s) >> >> Regards, >> Kate >> >> > The message was most likely passed on with the attachment removed and a text > part added that explained that fact. > Excellent, thanks From lists at rheel.co.nz Mon Apr 20 22:24:56 2009 From: lists at rheel.co.nz (Lists) Date: Mon Apr 20 22:22:59 2009 Subject: help with understanding line in log In-Reply-To: <120EBC42C8319846842A4A49B3D5566BBDDAEE@psims003.pshosting.intranet> References: <49ECE1CD.5080801@rheel.co.nz> <120EBC42C8319846842A4A49B3D5566BBDDAEE@psims003.pshosting.intranet> Message-ID: <49ECE828.6020600@rheel.co.nz> PSI Mailbag wrote: >> I was wondering if the following meant that the email and >> attachment(FILE01.zip) got blocked or not. >> >> Banned Filename Report: (Total Seen = ) >> Password-protected archive (FILE01.zip): 1 Time(s) >> > > > Based on the fact that this is a "banned filename report", the > attachment should have been removed. However, you can search your logs > for the message ID from the report and you'll be able to tell for sure. > Typically the relevant log entry is along the lines of "Cleaned: > Delivered # cleaned messages", which will be recorded immediately after > your re-queued message entry. This will tell you if the message was > delivered, if the attachment was removed, or if nothing was done. > > Cheers, > -Joshua > Thanks for the help From mark at msapiro.net Tue Apr 21 03:41:34 2009 From: mark at msapiro.net (Mark Sapiro) Date: Tue Apr 21 03:41:45 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: Message-ID: Julian Field wrote: > >On 20/4/09 15:48, Mark Sapiro wrote: >> On Mon, Apr 20, 2009 at 12:44:14PM +0200, Glenn Steen wrote: >> >> >>> If you go from totally random to deterministic/file, you'd still get >>> the needed uniqueness as well as the same key for the same queue file >>> (in the processing DB)... Which seems to be the problem needing to be >>> solved...? >>> >> >> Yes, this appears to be the problem needing to be solved in Kai's case, >> but it is not the problem in my case. See my post at >> . >> >> Note that the Postfix log entries quoted in that post come from a grep >> of the ID only without the .entropy fragment and are the only entries >> found in the entire log. >> >Do you ever see any log entries containing >"New Batch: Found invalid queue files:" >when your mail source sends a large lump of messages? No. I don't have any messages like that in the log. >Also, please try the latest beta 4.76.14. This may help with this >problem. I have worked out why it would end up with messages in there >when it shouldn't, but I can't see where it actually does it. It >shouldn't be able to happen. So I have added some more clauses to cause >it to ignore partially-delivered messages, which are what must be >causing the problem. OK. I have installed 4.76.14 and I removed the Processing.db file and let MailScanner recreate it when I restarted following the 4.76.14 installation. I will report what I see after it runs for a while. -- Mark Sapiro The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From drew.marshall at trunknetworks.com Tue Apr 21 09:39:26 2009 From: drew.marshall at trunknetworks.com (Drew Marshall) Date: Tue Apr 21 09:39:59 2009 Subject: Mangled MIME Headers in plain text mail In-Reply-To: <20090419183749.E4CA81701E@out-b.mx.mail-launder.com> References: <200904182028.n3IKSMns017926@safir.blacknight.ie> <20090419003627.7647317008@out-b.mx.mail-launder.com> <200904190814.n3J8ENa6032550@safir.blacknight.ie> <20090419123638.E100D17082@out-b.mx.mail-launder.com> <200904191631.n3JGVWNa020325@safir.blacknight.ie> <20090419183749.E4CA81701E@out-b.mx.mail-launder.com> Message-ID: <200904210839.n3L8doVr012647@safir.blacknight.ie> *This message was transferred with a trial version of CommuniGate(r) Pro* On 19 Apr 2009, at 19:31, Kai Schaetzl wrote: > *This message was transferred with a trial version of CommuniGate(r) > Pro* > As I said, and if you don't want to accept Mark's explanation, it's so > much easier to see the full message in a pastebin ... Sorry Kai took a while to get another one in. It's fairly intermittent. So here it is http://pastebin.com/m28c03d06 I am sure I could find more examples. Drew From support-lists at petdoctors.co.uk Tue Apr 21 09:51:43 2009 From: support-lists at petdoctors.co.uk (Nigel Kendrick) Date: Tue Apr 21 09:52:18 2009 Subject: Any issues with the SPAM ACTIONS rule? Message-ID: <84E6067148EE47E081DDC31DC9D84B51@SUPPORT01V> I have just set up the following line on our mail server to see what kind of spam we are getting but nothing is turning up in the 'spam' mail account: Spam Actions = delete forward spam@localhost In the logs I am getting: Apr 21 09:39:24 petdoctors MailScanner[21591]: Spam Actions: message 798681F1815E.1CD99 actions are spam@localhost,forward,delete This has worked in the past and the only major changes of late are better implementation of Sanesecurity using a new script and an update to MailScanner 4.75.11-1 from 4.74.something I can, however, send general emails to spam@ Ideas? Thanks Nigel Kendrick IT Associate Pet Doctors Ltd -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090421/362b8356/attachment.html From mark at msapiro.net Tue Apr 21 16:45:14 2009 From: mark at msapiro.net (Mark Sapiro) Date: Tue Apr 21 16:45:24 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: Message-ID: <20090421154514.GA3888@msapiro> On Mon, Apr 20, 2009 at 07:41:34PM -0700, Mark Sapiro wrote: > Julian Field wrote: > > >Also, please try the latest beta 4.76.14. This may help with this > >problem. I have worked out why it would end up with messages in there > >when it shouldn't, but I can't see where it actually does it. It > >shouldn't be able to happen. So I have added some more clauses to cause > >it to ignore partially-delivered messages, which are what must be > >causing the problem. > > > OK. I have installed 4.76.14 and I removed the Processing.db file and > let MailScanner recreate it when I restarted following the 4.76.14 > installation. > > I will report what I see after it runs for a while. There is essentially no change in what I'm seeing. I have attached MailScanner_log.txt which is the result of grepping the maillog for MailScanner and then keeping only those records beginning with the restart following installation of 4.76.17 through the child dying of old age and the new child finding 4 messages in the database. Also, here are the results of asking MailScanner to display the database and inspecting it with sqlite. [root@sbh16 ~]# MailScanner --processing=0 Currently being processed: Number of messages: 6 Tries Message Next Try At ===== ======= =========== 1 45449690408.056E4 Tue Apr 21 03:36:12 2009 1 41105690407.04696 Tue Apr 21 03:35:27 2009 1 18870690467.09282 Mon Apr 20 20:59:01 2009 1 60362690438.064E1 Mon Apr 20 20:56:06 2009 1 10663690435.057E8 Mon Apr 20 20:47:51 2009 1 48118690444.05809 Mon Apr 20 20:46:20 2009 [root@sbh16 ~]# MailScanner --processing=1 [root@sbh16 ~]# sqlite3 /var/spool/MailScanner/incoming/Processing.db SQLite version 3.3.6 Enter ".help" for instructions sqlite> .tables archive processing sqlite> select * from archive; sqlite> select * from processing; 10663690435.057E8|1|1240285671 48118690444.05809|1|1240285580 60362690438.064E1|1|1240286166 18870690467.09282|1|1240286341 45449690408.056E4|1|1240310172 41105690407.04696|1|1240310127 sqlite> .exit [root@sbh16 ~]# Also, it is curious and possibly significant that all the queue ids remaining in the database are all-decimal when in general, most are not. -- Mark Sapiro mark at msapiro net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan -------------- next part -------------- Apr 20 19:27:00 sbh16 MailScanner[10169]: MailScanner child caught a SIGHUP Apr 20 19:27:07 sbh16 MailScanner[10351]: MailScanner E-Mail Virus Scanner version 4.76.14 starting... Apr 20 19:27:07 sbh16 MailScanner[10351]: Read 855 hostnames from the phishing whitelist Apr 20 19:27:08 sbh16 MailScanner[10351]: Read 5134 hostnames from the phishing blacklist Apr 20 19:27:08 sbh16 MailScanner[10351]: Using SpamAssassin results cache Apr 20 19:27:08 sbh16 MailScanner[10351]: Connected to SpamAssassin cache database Apr 20 19:27:14 sbh16 MailScanner[10351]: Connected to processing-messages database Apr 20 19:27:14 sbh16 MailScanner[10351]: Found 0 messages in the processing-messages database Apr 20 19:27:14 sbh16 MailScanner[10351]: Using locktype = flock Apr 20 19:29:44 sbh16 MailScanner[10351]: New Batch: Scanning 1 messages, 5933 bytes Apr 20 19:29:46 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 19:29:46 sbh16 MailScanner[10351]: Requeue: 8B52069017B.0BC26 to 6861A69017C Apr 20 19:29:46 sbh16 MailScanner[10351]: Uninfected: Delivered 1 messages Apr 20 19:29:46 sbh16 MailScanner[10351]: Deleted 1 messages from processing-database Apr 20 19:30:25 sbh16 postfix/cleanup[10364]: CA2A669017B: message-id= Apr 20 19:30:28 sbh16 MailScanner[10351]: New Batch: Scanning 1 messages, 4135 bytes Apr 20 19:30:32 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 19:30:32 sbh16 MailScanner[10351]: Requeue: CA2A669017B.01C46 to 4103269017C Apr 20 19:30:32 sbh16 MailScanner[10351]: Uninfected: Delivered 1 messages Apr 20 19:30:32 sbh16 MailScanner[10351]: Deleted 1 messages from processing-database Apr 20 19:56:57 sbh16 MailScanner[10351]: New Batch: Scanning 1 messages, 22638 bytes Apr 20 19:56:57 sbh16 MailScanner[10351]: Expired 13 records from the SpamAssassin cache Apr 20 19:57:07 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 19:57:07 sbh16 MailScanner[10351]: Requeue: AD18969017B.0605A to C808769017C Apr 20 19:57:07 sbh16 MailScanner[10351]: Uninfected: Delivered 1 messages Apr 20 19:57:07 sbh16 MailScanner[10351]: Deleted 1 messages from processing-database Apr 20 20:07:19 sbh16 MailScanner[10351]: New Batch: Scanning 1 messages, 6275 bytes Apr 20 20:07:19 sbh16 MailScanner[10351]: Expired 2 records from the SpamAssassin cache Apr 20 20:07:21 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:07:21 sbh16 MailScanner[10351]: Requeue: 84AB069017B.07AB6 to 9F01669017C Apr 20 20:07:21 sbh16 MailScanner[10351]: Uninfected: Delivered 1 messages Apr 20 20:07:21 sbh16 MailScanner[10351]: Deleted 1 messages from processing-database Apr 20 20:34:46 sbh16 MailScanner[10351]: New Batch: Scanning 1 messages, 2816 bytes Apr 20 20:34:46 sbh16 MailScanner[10351]: Expired 3 records from the SpamAssassin cache Apr 20 20:34:52 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:34:52 sbh16 MailScanner[10351]: Requeue: 235EA69017B.0143E to 998E369017C Apr 20 20:34:52 sbh16 MailScanner[10351]: Uninfected: Delivered 1 messages Apr 20 20:34:52 sbh16 MailScanner[10351]: Deleted 1 messages from processing-database Apr 20 20:36:11 sbh16 MailScanner[10351]: New Batch: Scanning 1 messages, 1025 bytes Apr 20 20:36:11 sbh16 MailScanner[10351]: Requeue: 071E169017C.037FE to B459169017B Apr 20 20:36:11 sbh16 MailScanner[10351]: Unscanned: Delivered 1 messages Apr 20 20:36:11 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:36:11 sbh16 MailScanner[10351]: Deleted 1 messages from processing-database Apr 20 20:37:05 sbh16 MailScanner[10351]: New Batch: Scanning 1 messages, 5142 bytes Apr 20 20:37:05 sbh16 MailScanner[10351]: Requeue: ED39269017C.06032 to 724DF69017B Apr 20 20:37:05 sbh16 MailScanner[10351]: Unscanned: Delivered 1 messages Apr 20 20:37:05 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:37:05 sbh16 MailScanner[10351]: Deleted 1 messages from processing-database Apr 20 20:38:36 sbh16 MailScanner[10351]: New Batch: Scanning 1 messages, 1048 bytes Apr 20 20:38:36 sbh16 MailScanner[10351]: Requeue: DFFDE69017C.07D06 to 0849969017B Apr 20 20:38:36 sbh16 MailScanner[10351]: Unscanned: Delivered 1 messages Apr 20 20:38:36 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:38:36 sbh16 MailScanner[10351]: Deleted 1 messages from processing-database Apr 20 20:42:24 sbh16 MailScanner[10351]: New Batch: Scanning 1 messages, 3512 bytes Apr 20 20:42:24 sbh16 MailScanner[10351]: Requeue: 15D0D69017B.086C0 to 26B7169017E Apr 20 20:42:24 sbh16 MailScanner[10351]: Unscanned: Delivered 1 messages Apr 20 20:42:24 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:42:24 sbh16 MailScanner[10351]: Deleted 1 messages from processing-database Apr 20 20:42:30 sbh16 MailScanner[10351]: New Batch: Found 220 messages waiting Apr 20 20:42:30 sbh16 MailScanner[10351]: New Batch: Scanning 30 messages, 136871 bytes Apr 20 20:42:32 sbh16 MailScanner[10351]: Spam Checks: Found 1 spam messages Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: DB6DB6903AE.072F3 to 63A7C690480 Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: AC28C69017B.08E44 to C94536903AE Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: C7DA56903AA.06FBF to C525669017B Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: B5DB569033E.07227 to 2E2A86903AA Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: BDC046903E5.07A08 to A0EF069033E Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: 53E376903CA.0446C to 5DB3E6903E5 Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: B647B6903E3.05D5F to 56CD86903CA Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: AFDCC690188.050B2 to EDBA06903E3 Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: F31416903B3.05435 to 9669D690188 Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: BD26869036A.047D3 to D5F576903B3 Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: D7C9B6903AD.07FD4 to 1BDC569036A Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: 2F4996903BF.090FD to A02BF6903AD Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: EBFE06903B1.04677 to 359C36903BF Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: B9774690369.06C34 to 9987C6903B1 Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: CF30E6903AC.0992E to 19AC6690369 Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: 1EAA16903BB.05E0F to 066606903AC Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: 369BA6903C1.03FF4 to 3F66B6903BB Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: DED3F6903AF.0513F to 254406903C1 Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: CBA876903AB.0377E to 401336903AF Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: CC3956903E9.05C30 to D98136903AB Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: E863C6903B0.075DA to E01AA6903E9 Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: 0C5446903B6.0A372 to 013E46903B0 Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: C47786903A9.00DF7 to 4AA3B6903B6 Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: C0C6F69038D.058D4 to 816406903A9 Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: D456969017E.06DBC to E014269038D Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: 1B0306903BA.087E1 to 6E48B69017E Apr 20 20:42:32 sbh16 MailScanner[10351]: Requeue: 226826903BC.099BD to 14BC76903BA Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: EFA376903B2.02975 to F3E4C6903BC Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: 175F56903B9.09CB4 to B9D6A6903B2 Apr 20 20:42:33 sbh16 MailScanner[10351]: Unscanned: Delivered 29 messages Apr 20 20:42:33 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: D000B69017C.08784 to A96D56903B9 Apr 20 20:42:33 sbh16 MailScanner[10351]: Uninfected: Delivered 1 messages Apr 20 20:42:33 sbh16 MailScanner[10351]: Deleted 30 messages from processing-database Apr 20 20:42:33 sbh16 MailScanner[10351]: New Batch: Found 190 messages waiting Apr 20 20:42:33 sbh16 MailScanner[10351]: New Batch: Scanning 30 messages, 139042 bytes Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: 3A4496903C2.04F91 to B090269017C Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: 13B736903B8.06163 to 0E1ED6903B9 Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: 8C8306903D9.0705B to B8B606903B8 Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: 2BA236903BE.07996 to B369C6903C2 Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: AC49D6903E1.03DF5 to 710AB6903BE Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: 88E7B6903D8.0576C to DBADE6903D9 Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: 6B9066903D0.06663 to E53476903D8 Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: 5CF666903CC.06532 to C29D16903D0 Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: D3A496903EB.05E1E to C7CED6903CC Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: C89D46903E8.0D9AD to 4833C6903E1 Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: 9B2D06903DD.0624F to 0D7636903E8 Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: 72E9D6903D2.04D85 to A87226903DD Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: 978526903DC.085E5 to A27A56903D2 Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: 7DA526903D5.0758D to 0F6E36903DC Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: E5D536903F0.05CC8 to 843EC6903D5 Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: A4AFA6903DF.057A0 to 187106903EB Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: 02DDC6903B4.04FCB to DBDE66903DF Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: 6F6826903D1.00D9C to D0DF86903B4 Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: 5042A6903C9.0E409 to B9F826903D1 Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: A11C16903DE.040CE to C07A46903C9 Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: DE97B6903EE.05C99 to E14826903DE Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: 48E946903C7.0854B to B09296903EE Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: 454246903C6.075B5 to 8FCEA6903C7 Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: AFF086903E2.07752 to C28E86903C6 Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: B9E696903E4.027FE to 932616903E2 Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: 5961A6903CB.03ED4 to 4B4E76903E4 Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: 4C9706903C8.04EE9 to AA85C6903CB Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: 0FD3B6903B7.06A2D to 3D6D46903C8 Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: 32F4D6903C0.04FCF to A916E6903B7 Apr 20 20:42:33 sbh16 MailScanner[10351]: Requeue: C4E7F6903E7.03763 to D1CA66903C0 Apr 20 20:42:33 sbh16 MailScanner[10351]: Unscanned: Delivered 30 messages Apr 20 20:42:33 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:42:34 sbh16 MailScanner[10351]: Deleted 30 messages from processing-database Apr 20 20:42:34 sbh16 MailScanner[10351]: New Batch: Found 160 messages waiting Apr 20 20:42:34 sbh16 MailScanner[10351]: New Batch: Scanning 30 messages, 139155 bytes Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: 27EB36903BD.07718 to B69A96903B3 Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: E22FA6903EF.0714A to 342FB6903BB Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: 2CD95690400.054CC to D683F6903BD Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: 644446903CE.043E5 to EFC896903E7 Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: 3E03A6903C3.06B25 to 510166903CE Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: 509EA690408.04E75 to 9A6DF6903C3 Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: 07B266903F6.06402 to 5A6296903EF Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: 259946903FE.0454E to AD9CC6903F0 Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: D73C86903EC.05C1E to CA1A86903F6 Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: 814756903D6.088F0 to 9DFEB6903EC Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: ED85A6903F2.0B1FE to 67E956903D6 Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: 419A26903C5.08550 to E155F6903F2 Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: D349A690428.09B93 to 330666903C5 Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: 768BF6903D3.04B4F to 7960A6903FE Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: E9D046903F1.06444 to 52E3769033E Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: 902CF6903DA.05F7D to 5A6F06903AE Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: 93DA76903DB.07ADB to ED90E6903D3 Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: 608F46903CD.03F03 to 621FF6903DA Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: 67EC66903CF.09828 to 827976903CD Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: CFE906903EA.066A8 to 3597E6903CF Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: 08A606903B5.0B5FE to C74246903DB Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: D73DF690429.0794F to 51C566903B5 Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: F10C66903F3.08ED8 to 9BC236903E9 Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: 57FBE69040A.07E80 to 16E436903EA Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: 7A2F26903D4.08EE9 to 9EDDC6903F1 Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: AD302690420.062D5 to 0F57F6903D4 Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: C13E96903E6.045CD to D152B6903F3 Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: DADCC6903ED.085C2 to 88EF06903E6 Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: A861A6903E0.0730F to 7F07E6903ED Apr 20 20:42:34 sbh16 MailScanner[10351]: Requeue: 850386903D7.0844E to 9FDA06903E0 Apr 20 20:42:34 sbh16 MailScanner[10351]: Unscanned: Delivered 30 messages Apr 20 20:42:34 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:42:34 sbh16 MailScanner[10351]: Deleted 30 messages from processing-database Apr 20 20:42:35 sbh16 MailScanner[10351]: New Batch: Found 130 messages waiting Apr 20 20:42:35 sbh16 MailScanner[10351]: New Batch: Scanning 30 messages, 139183 bytes Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: C466A690424.0B025 to 6D62F690369 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 88FBD690417.0320E to C600E69038D Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: A238C69041D.0106F to 48E5F6903AC Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: CBB49690426.066A8 to 9FC6E6903B0 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 9747969041A.0398A to 1DBF76903BA Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 218B96903FD.02D9F to 4CBFA6903C1 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 71D36690412.0F0E6 to 3C85B69036A Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 5451D690409.05BE8 to B5F1F6903CA Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: ED13B69042F.0DDD9 to 2910E6903D7 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 4CF6E690407.063E1 to C474B6903B6 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: BFFAB690423.04946 to 309226903C2 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: B6694690421.00ABF to D32316903E5 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 1DF0B6903FC.08D56 to E03746903FD Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: DB1AD69042A.016FE to 23E6D6903FC Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: CF730690427.07968 to B0C3F690400 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 3429A690402.0BC64 to 53B7D690407 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 9E89469041C.08BD7 to 9C546690402 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 1A49A6903FB.0590D to 15808690408 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 6333369040D.088A4 to 4ED4A6903FB Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 938DA690419.05354 to 085896903CC Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 37BF4690403.0A276 to 7FEFB690409 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: F0BDF690430.05A92 to 05A64690403 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 66EE069040F.05B04 to 4109069040A Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 45DCC690405.04BD8 to 90CF669040D Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 0F1A86903F8.0AFEA to 9C327690405 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 8F260690418.03487 to 10E0C6903F8 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 0B5626903F7.08FDA to 6F5AF69040F Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 9ADC469041B.015F7 to C6F1D6903F7 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: A99EB69041F.0235D to 90549690412 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: DEADE69042B.03627 to 6B832690417 Apr 20 20:42:35 sbh16 MailScanner[10351]: Unscanned: Delivered 30 messages Apr 20 20:42:35 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:42:35 sbh16 MailScanner[10351]: Deleted 30 messages from processing-database Apr 20 20:42:35 sbh16 MailScanner[10351]: New Batch: Found 100 messages waiting Apr 20 20:42:35 sbh16 MailScanner[10351]: New Batch: Scanning 30 messages, 139039 bytes Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 3213F69043E.0ACA8 to B4EF76903A9 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 6A8F3690410.0C875 to EB66D6903AD Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: C8092690425.06259 to 89D596903B2 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 164E36903FA.084AC to C5A846903AB Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: E222269042C.05EF7 to 404CF6903BC Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 2932B6903FF.06ABE to 928346903C6 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: E974869042E.05846 to 1AF026903D9 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 83A7D690416.05EF8 to 29E886903DF Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 5FA0A69040C.0639C to 3CC386903E3 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 6CE3569044C.07A70 to 904046903E4 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: A1DB7690458.07F65 to F05F56903EB Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 040956903F5.05EC6 to 79E846903AA Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 12A966903F9.093AB to 4C7E56903F5 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: A5D8F69041E.0A946 to 682536903F9 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 78D09690413.04FB7 to 815F26903FA Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 005506903F4.0003A to EF0B06903FF Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 80066690415.07EB7 to 6C72C6903F4 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 306F1690401.035A6 to 8B5A969040C Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 5BEBB69040B.09089 to C0F33690401 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 6E4AC690411.04DF2 to 52CB469040B Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 96F0D690455.0420B to 8459F690410 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: BA6F4690422.0460A to A821D690411 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: E5DB269042D.08A2B to DF079690413 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 00439690431.0618A to D0943690415 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 7C5F4690414.058C9 to 443FA690416 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 3B6DD690404.094DC to 4320C690414 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: C7372690461.0AAFE to 71459690404 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 4973E690406.08D61 to B1690690418 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: 2E6B169043D.04D97 to 31E59690406 Apr 20 20:42:35 sbh16 MailScanner[10351]: Requeue: A7ADE690459.04BFB to 4A854690419 Apr 20 20:42:35 sbh16 MailScanner[10351]: Unscanned: Delivered 30 messages Apr 20 20:42:36 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:42:36 sbh16 MailScanner[10351]: Deleted 30 messages from processing-database Apr 20 20:42:36 sbh16 MailScanner[10351]: New Batch: Found 70 messages waiting Apr 20 20:42:36 sbh16 MailScanner[10351]: New Batch: Scanning 30 messages, 139155 bytes Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: 70A2969044D.03F8C to EB79969017C Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: B8BFB69045D.0F186 to 4620469017E Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: 445DE690443.0E7AB to ABDDF690188 Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: 48118690444.05809 to 09FE869033E Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: CAF40690462.0F2AC to 95C1B6903B0 Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: EC0EE69046A.059E4 to F34CA6903B3 Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: 39616690440.046B4 to 3129D6903B4 Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: 693A369044B.05F4C to B67DF6903B5 Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: BFE3969045F.07798 to 5EBD06903B7 Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: 5E72E690448.088B5 to 13B0F6903B8 Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: 237FD69043A.04CDF to AC7FE6903B9 Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: 0CE46690434.0CCFD to 76EB76903BB Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: 071E6690433.02ACD to 6EB4E6903BE Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: 7459569044E.0659C to 8E2A96903C0 Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: 35BC969043F.07141 to C1F136903C7 Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: 848C0690452.06746 to B8EB56903C9 Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: 80FAA690451.066FB to 7E46A6903CC Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: AB26B69045A.06B3B to 475E96903CF Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: B268469045C.077E9 to 163576903D1 Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: 52D2A690447.023B3 to A3CE26903D2 Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: 7B8A5690450.02239 to 9CE576903D4 Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: CE81C690463.07EC6 to 1822D6903D5 Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: D6811690465.047FC to 71EBD6903D6 Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: 40B46690442.07FAB to BADFD6903D8 Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: 9E326690457.04ADF to 229F76903DB Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: 77DF769044F.02A75 to 4B82B6903DC Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: DA068690466.0AC5A to 04C976903C8 Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: 9A858690456.05775 to B1D9D6903DA Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: D22F5690464.064FA to 01DD56903DD Apr 20 20:42:36 sbh16 MailScanner[10351]: Requeue: 10663690435.057E8 to 56D256903DE Apr 20 20:42:36 sbh16 MailScanner[10351]: Unscanned: Delivered 30 messages Apr 20 20:42:37 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:42:37 sbh16 MailScanner[10351]: Deleted 30 messages from processing-database Apr 20 20:42:37 sbh16 MailScanner[10351]: New Batch: Found 40 messages waiting Apr 20 20:42:37 sbh16 MailScanner[10351]: New Batch: Scanning 30 messages, 138990 bytes Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: C389A690460.084E8 to 5241D69017B Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: 03AC2690432.0F02F to AA68C69017C Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: 3309869047B.0966B to 8363A69017E Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: 3D245690441.06727 to 2373D690188 Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: 0F9FD690470.02166 to D6E7269033E Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: F32D369046C.0417D to A7C7A69036A Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: EFBAA69046B.08B3E to 7289A69038D Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: 61F5A690449.03FBE to 770456903A9 Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: BC3B869045E.052F8 to 350CD6903AA Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: 1B5EA690438.04BD4 to 4FE836903AB Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: 4F1F8690446.00F12 to 7F3966903AC Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: 6593869044A.04C24 to E691E6903AE Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: 210F6690476.0393C to 82DF76903AF Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: DFC2D690467.065D3 to 28F736903B2 Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: 13135690471.06E2C to 8F0FD6903B3 Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: 140D6690436.0C3DB to CD04F6903B4 Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: 88474690453.09AD1 to 4F7886903B5 Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: 17B8B690437.06806 to 4AA116903B6 Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: 9358A690454.0DEDF to 278686903B7 Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: 2714569043B.05347 to 797D66903B8 Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: 416F869047F.073E5 to 05F736903B9 Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: 02CF769046D.0A7B2 to 8E9A26903BA Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: 2ABD069043C.07D57 to 2FE836903BB Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: 2F51A69047A.0824D to B76E96903BC Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: 2BF90690479.07BC2 to 0DFF36903BD Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: 4B770690445.0AFA2 to 3EF596903BE Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: AEE8B69045B.012AB to AC0166903BF Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: E876F690469.050B2 to E16826903C0 Apr 20 20:42:39 sbh16 MailScanner[10351]: Requeue: 1FCCD690439.026CB to 6CE916903C1 Apr 20 20:42:39 sbh16 MailScanner[10351]: Unscanned: Delivered 29 messages Apr 20 20:42:39 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:42:40 sbh16 MailScanner[10351]: Requeue: E4C96690468.04E8B to 6F5C969038D Apr 20 20:42:40 sbh16 MailScanner[10351]: Uninfected: Delivered 1 messages Apr 20 20:42:40 sbh16 MailScanner[10351]: Deleted 30 messages from processing-database Apr 20 20:42:40 sbh16 MailScanner[10351]: New Batch: Scanning 10 messages, 46399 bytes Apr 20 20:42:40 sbh16 MailScanner[10351]: Requeue: 0C22269046F.02F03 to A8C9569038D Apr 20 20:42:40 sbh16 MailScanner[10351]: Requeue: 083E769046E.09792 to 82C5469017E Apr 20 20:42:40 sbh16 MailScanner[10351]: Requeue: 3DBBD69047E.047C9 to 046C56903A9 Apr 20 20:42:40 sbh16 MailScanner[10351]: Requeue: 1D53E690475.03A10 to B07DD6903AE Apr 20 20:42:40 sbh16 MailScanner[10351]: Requeue: 283FD690478.08C1E to 2DBF36903B1 Apr 20 20:42:40 sbh16 MailScanner[10351]: Requeue: 3A2A169047D.00A5E to 00FF9690188 Apr 20 20:42:40 sbh16 MailScanner[10351]: Requeue: 19E61690474.05D07 to 0B1F56903B4 Apr 20 20:42:40 sbh16 MailScanner[10351]: Requeue: 366B669047C.071C9 to 2BD646903B8 Apr 20 20:42:40 sbh16 MailScanner[10351]: Requeue: 24B87690477.09814 to F19046903C2 Apr 20 20:42:40 sbh16 MailScanner[10351]: Requeue: 16726690473.09B90 to 923FF6903C5 Apr 20 20:42:40 sbh16 MailScanner[10351]: Unscanned: Delivered 10 messages Apr 20 20:42:40 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:42:40 sbh16 MailScanner[10351]: Deleted 10 messages from processing-database Apr 20 20:43:16 sbh16 MailScanner[10351]: New Batch: Scanning 1 messages, 14497 bytes Apr 20 20:43:20 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:43:20 sbh16 MailScanner[10351]: Requeue: 2C0F869017B.0718D to 4C06C69017C Apr 20 20:43:20 sbh16 MailScanner[10351]: Uninfected: Delivered 1 messages Apr 20 20:43:20 sbh16 MailScanner[10351]: Deleted 1 messages from processing-database Apr 20 20:53:08 sbh16 MailScanner[10351]: New Batch: Scanning 1 messages, 1761 bytes Apr 20 20:53:08 sbh16 MailScanner[10351]: Expired 3 records from the SpamAssassin cache Apr 20 20:53:08 sbh16 MailScanner[10351]: Requeue: A4BDB69017B.0883D to 7BF8269017C Apr 20 20:53:08 sbh16 MailScanner[10351]: Unscanned: Delivered 1 messages Apr 20 20:53:08 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:53:09 sbh16 MailScanner[10351]: Deleted 1 messages from processing-database Apr 20 20:53:15 sbh16 MailScanner[10351]: New Batch: Found 219 messages waiting Apr 20 20:53:15 sbh16 MailScanner[10351]: New Batch: Scanning 30 messages, 88978 bytes Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: 6ACD26903AB.064FA to 3B3E869047F Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: 98B206903B9.09152 to E56ED6903AB Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: 4F5B1690188.06F9B to 646C26903B9 Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: BD8016903C5.08B62 to 71069690188 Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: 9BD586903BA.074B4 to 3452E6903C5 Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: B31226903C1.05B53 to ACBAA6903BA Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: 8529B6903B3.0268E to 1E6606903C1 Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: 4169069017B.0A263 to 3FF9A6903B3 Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: DD8CF6903CE.0A700 to 530D569017B Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: 4842869017C.05644 to D2DF86903CE Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: 52A0B69033E.0551B to 0718C69017C Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: BA2F46903C3.08CAD to 540DD69033E Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: F10086903D4.0946C to 4CE7F6903C3 Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: A93F56903BE.0AB0C to DE2466903D4 Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: 7BAE56903B0.053A3 to DB15C6903BE Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: 6108B69038D.073F5 to 9C1DE6903B0 Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: C3D806903C7.05E76 to D5B8069038D Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: 8BAF26903B5.073CD to 5F6DE6903C7 Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: 9F07A6903BB.0994F to EBBF16903B5 Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: C707F6903C8.0FB54 to 0BB7B6903BB Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: A5EC96903BD.08DE2 to EF2356903C8 Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: D6E2E6903CC.05ED2 to DACFE6903BD Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: 5600C690369.056D3 to 6B6DF6903CC Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: CD62A6903CA.0384D to 86CD1690369 Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: 644436903A9.06705 to C8DF96903CA Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: 679DF6903AA.098D9 to 23E4B6903A9 Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: CA2C96903C9.0633A to 752B46903AA Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: E40B86903D0.0228B to C63FF6903C9 Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: C0AEB6903C6.09117 to 0B0976903D0 Apr 20 20:53:15 sbh16 MailScanner[10351]: Requeue: EDD456903D3.097A1 to A78C66903C6 Apr 20 20:53:15 sbh16 MailScanner[10351]: Unscanned: Delivered 30 messages Apr 20 20:53:15 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:53:15 sbh16 MailScanner[10351]: Deleted 30 messages from processing-database Apr 20 20:53:16 sbh16 MailScanner[10351]: New Batch: Found 189 messages waiting Apr 20 20:53:16 sbh16 MailScanner[10351]: New Batch: Scanning 30 messages, 88880 bytes Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 81F426903B2.05DFB to AAF34690369 Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 6E5EE6903F5.079B8 to D71EF6903B2 Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: B6B486903C2.07A07 to 36C996903C6 Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: E8E15690419.02AF1 to E4F3D6903C2 Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 592F569036A.01745 to 1F8CD6903D3 Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 6DFA36903AC.08C6D to EF4E569036A Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 745436903AE.067BC to 38E2B6903AC Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: AC7166903BF.05AE8 to 1E0D56903AE Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 7EC186903B1.03E2F to 210736903BF Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 4BD5269017E.08326 to 5B98A6903B1 Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: D3C2E6903CB.07401 to 5CE7869017E Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 785B86903AF.083DF to 707C46903CB Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 600596903F1.09CC1 to 62B5E6903AF Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 897386903FD.07FA2 to A76236903F1 Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 9A850690402.0AB2A to AD3DE6903F5 Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: A267E6903BC.0922B to B998B6903FD Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 9535B6903B8.08431 to 0F2076903BC Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: E0E3A6903CF.0718B to 37F7A6903B8 Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: E75866903D1.0563E to 9C2276903CF Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: C502969040F.05CCC to 29CAA6903D1 Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: DA1266903CD.05FA9 to 2892B690402 Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 8EF316903B6.04701 to 2A5276903CD Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 711CF6903AD.077A8 to B52456903B6 Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: ADC91690407.06E6A to DEC2A6903AD Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: EAA466903D2.06405 to 06162690407 Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: AF96E6903C0.05964 to BE0FC6903D2 Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: BB3C869040B.0A51E to 1E8766903C0 Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 8889F6903B4.0A2AB to 7FAE569040B Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: DF190690416.04349 to 8C7C36903B4 Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 9215E6903B7.04445 to 53E0069040F Apr 20 20:53:16 sbh16 MailScanner[10351]: Unscanned: Delivered 30 messages Apr 20 20:53:16 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:53:16 sbh16 MailScanner[10351]: Deleted 30 messages from processing-database Apr 20 20:53:16 sbh16 MailScanner[10351]: New Batch: Found 159 messages waiting Apr 20 20:53:16 sbh16 MailScanner[10351]: New Batch: Scanning 30 messages, 89018 bytes Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 400496903E8.07244 to 336F269017B Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: C1D4769040D.0DA6A to 9E5A869033E Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 97564690401.0B461 to 042C169038D Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: E2533690417.06B5C to C5C666903A9 Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 2E2D66903E3.08CC1 to 92C3C6903AA Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: A76F7690405.08369 to 4D5336903AB Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 81E706903FB.04699 to D3DA96903AE Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 8C9B46903FE.06D79 to 5A02B6903AF Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: CB536690411.05F21 to 75D456903B7 Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 4DA636903EC.076BF to 3B59C6903BA Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 642676903F2.06587 to 1F5536903BB Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 16FB06903DC.0ABA9 to 59C076903BE Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: CE84A690412.076DD to 20B2C6903C3 Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: DBF29690415.04E1E to A99E46903C7 Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: F2A6269041C.0B0AD to B245C6903C8 Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 90DCC6903FF.03DAE to 61FA76903C9 Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 0D7726903D9.09ED7 to 123966903CA Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 4A5546903EB.082FA to 4CFE96903CC Apr 20 20:53:16 sbh16 MailScanner[10351]: Requeue: 540316903EE.06251 to 44A6C6903CE Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 675926903F3.03D61 to 32F166903D0 Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 7EBC66903FA.0A304 to C25A16903D9 Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 9DB48690403.04AC0 to 00FC16903DC Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 1DF446903DE.06EED to 8EF586903E3 Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 2AFA06903E2.033A5 to 5267F6903DE Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: BE80C69040C.07626 to C4B0B6903E2 Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: EC2DA69041A.090DF to 1C5406903E8 Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 860FE6903FC.05A48 to 6124E6903EB Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 384116903E6.0EAB4 to 55CFA6903EC Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 315426903E4.04E3F to DEBC6690369 Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 43ADC6903E9.06E6E to 98FA96903E4 Apr 20 20:53:17 sbh16 MailScanner[10351]: Unscanned: Delivered 30 messages Apr 20 20:53:17 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:53:17 sbh16 MailScanner[10351]: Deleted 30 messages from processing-database Apr 20 20:53:17 sbh16 MailScanner[10351]: New Batch: Found 129 messages waiting Apr 20 20:53:17 sbh16 MailScanner[10351]: New Batch: Scanning 30 messages, 88749 bytes Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 782F66903F8.05073 to 9E11469017C Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 0A24A6903D8.09FED to 43CB469036A Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: E5AD1690418.0579D to 1FE6D6903AD Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 7B89D6903F9.07365 to 96DF76903B0 Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 1A2866903DD.041CE to A93756903B1 Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: EF80669041B.02B8B to BE8AF6903B2 Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 13CFA6903DB.0D650 to 459BC6903B3 Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 10A4F6903DA.0B430 to 526F16903B5 Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 50D026903ED.0860D to 846766903B6 Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 0332C6903D6.0BE1A to BC3BC6903BB Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: B0F9F690408.08BEE to C2AA06903C0 Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: D8C07690414.07B6A to 102F46903BF Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 471336903EA.07344 to D203B6903C6 Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: A2995690404.0991A to 0C2196903CB Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 7193B6903F6.09CBF to 665016903CD Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: B750C69040A.075BA to CFC0A6903D0 Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 349696903E5.047AA to 5659A6903D1 Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 942E4690400.0DB29 to 034096903D2 Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 214536903DF.04FF5 to D3CBB6903D3 Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 27D916903E1.06CFD to 286456903D4 Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 595116903EF.0655A to 132CC6903D6 Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 74F096903F7.07EF0 to 39DD26903D8 Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 6B3A46903F4.05A02 to 28FDE6903DA Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: B42D0690409.09D03 to 14BAE6903DB Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 3CCB86903E7.074F4 to 4A12B6903DD Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: AAA8B690406.06430 to DF0516903DE Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 24A326903E0.08857 to 185686903DF Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 066AB6903D7.0A1AB to 57B3D6903E0 Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: C82D5690410.009DE to 9CB796903D7 Apr 20 20:53:17 sbh16 MailScanner[10351]: Requeue: 5CA346903F0.0C0A2 to 3AC1D6903E1 Apr 20 20:53:17 sbh16 MailScanner[10351]: Unscanned: Delivered 30 messages Apr 20 20:53:17 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:53:18 sbh16 MailScanner[10351]: Deleted 30 messages from processing-database Apr 20 20:53:18 sbh16 MailScanner[10351]: New Batch: Found 99 messages waiting Apr 20 20:53:18 sbh16 MailScanner[10351]: New Batch: Scanning 30 messages, 88806 bytes Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: 9EA3B69044A.07078 to ACCFE69017B Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: CCEAA690457.093F0 to F03B169033E Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: E849969045E.07B2B to 105DA690369 Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: A53FC69044C.059F3 to 7D70C69036A Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: 66C9569043A.08ED8 to 2569C69038D Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: C5B03690455.06A06 to 8041A6903AA Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: 5CFC9690437.044E9 to A78E76903AE Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: D1CA3690413.096BF to 57D7E6903B1 Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: EEA94690460.0B6D2 to 6DC646903AD Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: AF07169044E.031B1 to 9EAAF6903B4 Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: 28F4F690429.04680 to 539D76903B5 Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: 4973D690433.035E5 to 8CF8E6903B8 Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: 01B0869041D.09ED8 to 9AA426903BA Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: 7A1DC69043F.0632F to 190D06903BC Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: 81B9D690441.0818E to B24816903C8 Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: 0803269041F.04347 to 5B44D6903C9 Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: 6D50969043C.0C19E to 6AD056903CA Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: D358D690459.077E2 to E212A6903CC Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: 1B8C4690425.07802 to C43566903CD Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: 84F6E690442.0F40A to 097F56903CE Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: 9844F690448.05F34 to E02EE6903D0 Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: 0B48F690420.09D47 to 11C416903AB Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: 228A2690427.07BF8 to DFEDE6903D6 Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: 46469690432.0ACEF to 00A876903B3 Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: B268B69044F.028F9 to 12B306903D9 Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: F1D3B690461.017EA to 663AD6903DC Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: F423A6903D5.0A4AB to C6E386903DB Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: A8A3269044D.08922 to 3C5316903D5 Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: A20E569044B.08997 to 0C3E96903DF Apr 20 20:53:18 sbh16 MailScanner[10351]: Requeue: 7080269043D.08325 to 3D2916903E2 Apr 20 20:53:18 sbh16 MailScanner[10351]: Unscanned: Delivered 30 messages Apr 20 20:53:18 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:53:19 sbh16 MailScanner[10351]: Deleted 30 messages from processing-database Apr 20 20:53:19 sbh16 MailScanner[10351]: New Batch: Found 69 messages waiting Apr 20 20:53:19 sbh16 MailScanner[10351]: New Batch: Scanning 30 messages, 89185 bytes Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: 25D05690428.02278 to D676C69017C Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: 7E653690440.07AAA to C9E2469017E Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: 11D00690422.0B84F to 881B6690369 Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: 6A20D69043B.044F5 to DD7E869036A Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: 9B6B2690449.05BF6 to 5DFBD6903A9 Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: 59C35690436.0648B to 5ED846903AA Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: B58EB690450.075C7 to 703516903AB Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: 04DC269041E.0ADAF to 175FF6903AC Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: 536BA690434.08ABC to BC28B6903AD Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: D0253690458.04C2D to 205766903AF Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: C9756690456.05A50 to 260ED6903B0 Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: 2F5DC69042B.0982C to 0C0316903B2 Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: 73F0D69043E.050DA to 3982B6903B4 Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: E045C69045C.0F682 to C1DAF6903B5 Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: C2505690454.061D6 to 0E0CD6903B6 Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: B8B9D690451.0787B to 742C06903B8 Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: 91AD5690446.0302F to B529C6903BA Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: 60362690438.064E1 to DB3446903BB Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: 3601F69042D.0DF87 to 646996903BE Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: 8B59A690444.0C23C to E63696903BF Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: 8E86E690445.01A3B to 6DFEE6903C0 Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: 8823C690443.05DFE to 4EC156903C2 Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: 0E9EA690421.095AD to 4B13B6903C3 Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: DCEFC69045B.08091 to 445A46903C5 Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: E36EE69045D.05DE7 to 315796903C6 Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: BBE8B690452.0AAAA to F2F576903C7 Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: 63913690439.05FF7 to 528BC6903C8 Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: D987869045A.02C12 to 476796903C9 Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: 394EA69042E.06199 to 02BEB6903CA Apr 20 20:53:19 sbh16 MailScanner[10351]: Requeue: 186B5690424.07A2D to C6B776903CB Apr 20 20:53:19 sbh16 MailScanner[10351]: Unscanned: Delivered 30 messages Apr 20 20:53:19 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:53:19 sbh16 MailScanner[10351]: Deleted 30 messages from processing-database Apr 20 20:53:20 sbh16 MailScanner[10351]: New Batch: Found 39 messages waiting Apr 20 20:53:20 sbh16 MailScanner[10351]: New Batch: Scanning 30 messages, 89161 bytes Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 6977B69047D.0599D to 5329D69017B Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 150A5690423.0A531 to 80EC969017C Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 2B49D69046B.03F75 to E111269017E Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 4312B690431.007E2 to 2F2B0690188 Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 08493690462.0CB3C to 5B48269036A Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 36D7369046E.01457 to 96CB76903A9 Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: EB81D69045F.0881E to 6C5A96903AA Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 3C84669042F.061E3 to BBDAE6903AB Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 1BE76690468.06198 to BD17B6903AC Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 47EE3690474.049E6 to 333826903AD Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 94F76690447.096CD to 1B7216903AE Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 32C6769042C.06014 to 2BBDB6903AF Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 2C22C69042A.07216 to 27F8C6903B0 Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 56A6A690435.03FB8 to EE1396903B1 Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 3FA95690430.0D7AE to 53DD36903B2 Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: BF157690453.0F0D0 to 836D96903B3 Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 305A669046C.05365 to 38B906903B4 Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 59AE0690479.09A45 to 1558E6903B5 Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 214FE690469.05AE1 to E83606903B6 Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 51B29690477.08FBA to 6446D6903B7 Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 6C83969047E.06D5A to 947756903B8 Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 6029069047B.080AA to 67BB46903B9 Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 155F0690466.09A26 to 1AE746903BA Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 1EB55690426.0A052 to 652916903BB Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 0BADB690463.097B4 to D8DD86903BC Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 6622469047C.00DF1 to 8EA526903BD Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 12393690465.0BB29 to 75F2A6903BF Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 0F08A690464.076DE to 1EEC76903C0 Apr 20 20:53:21 sbh16 MailScanner[10351]: Requeue: 33AA069046D.06A40 to 55B256903C1 Apr 20 20:53:21 sbh16 MailScanner[10351]: Unscanned: Delivered 29 messages Apr 20 20:53:21 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:53:22 sbh16 MailScanner[10351]: Requeue: 18870690467.09282 to DC3A469038D Apr 20 20:53:22 sbh16 MailScanner[10351]: Uninfected: Delivered 1 messages Apr 20 20:53:22 sbh16 MailScanner[10351]: Deleted 30 messages from processing-database Apr 20 20:53:22 sbh16 MailScanner[10351]: New Batch: Scanning 9 messages, 26699 bytes Apr 20 20:53:22 sbh16 MailScanner[10351]: Requeue: 4E6CE690476.0AD00 to 4ED8369017B Apr 20 20:53:22 sbh16 MailScanner[10351]: Requeue: 3E701690470.0438E to 45E8C69038D Apr 20 20:53:22 sbh16 MailScanner[10351]: Requeue: 44BBB690473.069D1 to A752A6903AC Apr 20 20:53:22 sbh16 MailScanner[10351]: Requeue: 3B24A69046F.0FE98 to 60AFC6903B6 Apr 20 20:53:22 sbh16 MailScanner[10351]: Requeue: 4B200690475.04B18 to 5773F6903B7 Apr 20 20:53:22 sbh16 MailScanner[10351]: Requeue: 41936690471.07A91 to 6DDE26903BE Apr 20 20:53:22 sbh16 MailScanner[10351]: Requeue: 26C2C69046A.09C90 to 3CE326903C2 Apr 20 20:53:22 sbh16 MailScanner[10351]: Requeue: 54E57690478.08F3D to A91DA6903C3 Apr 20 20:53:22 sbh16 MailScanner[10351]: Requeue: 5CE9469047A.0A90D to 9BC4D6903C5 Apr 20 20:53:22 sbh16 MailScanner[10351]: Unscanned: Delivered 9 messages Apr 20 20:53:22 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:53:22 sbh16 MailScanner[10351]: Deleted 9 messages from processing-database Apr 20 20:53:34 sbh16 MailScanner[10351]: New Batch: Scanning 1 messages, 3070 bytes Apr 20 20:53:36 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:53:36 sbh16 MailScanner[10351]: Requeue: 40FBC69017B.013B9 to 7C26069017C Apr 20 20:53:36 sbh16 MailScanner[10351]: Uninfected: Delivered 1 messages Apr 20 20:53:36 sbh16 MailScanner[10351]: Deleted 1 messages from processing-database Apr 20 20:59:18 sbh16 MailScanner[10351]: New Batch: Scanning 2 messages, 3759 bytes Apr 20 20:59:20 sbh16 MailScanner[10351]: SpamAssassin cache hit for message 20B8369017C.02893 Apr 20 20:59:20 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 20:59:20 sbh16 MailScanner[10351]: Requeue: 14FED69017B.020D6 to 0CD4269017E Apr 20 20:59:20 sbh16 MailScanner[10351]: Requeue: 20B8369017C.02893 to 752AA69017B Apr 20 20:59:20 sbh16 MailScanner[10351]: Uninfected: Delivered 2 messages Apr 20 20:59:20 sbh16 MailScanner[10351]: Deleted 2 messages from processing-database Apr 20 21:03:26 sbh16 MailScanner[10351]: New Batch: Scanning 1 messages, 4837 bytes Apr 20 21:03:32 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 21:03:32 sbh16 MailScanner[10351]: Requeue: 51F0169017B.0D27F to 51BD069017C Apr 20 21:03:32 sbh16 MailScanner[10351]: Uninfected: Delivered 1 messages Apr 20 21:03:32 sbh16 MailScanner[10351]: Deleted 1 messages from processing-database Apr 20 21:08:27 sbh16 MailScanner[10351]: New Batch: Scanning 1 messages, 11109 bytes Apr 20 21:08:29 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 21:08:30 sbh16 MailScanner[10351]: Content Checks: Detected and have disarmed web bug tags in HTML message in F193E69017B.040C9 from costcob2c_e65618afe2507c838c8649bf3c55ef6755d4898bccc40632@online.costco.com Apr 20 21:08:30 sbh16 MailScanner[10351]: Requeue: F193E69017B.040C9 to A393969017C Apr 20 21:08:30 sbh16 MailScanner[10351]: Uninfected: Delivered 1 messages Apr 20 21:08:30 sbh16 MailScanner[10351]: Deleted 1 messages from processing-database Apr 20 21:26:54 sbh16 MailScanner[10351]: New Batch: Scanning 1 messages, 1967 bytes Apr 20 21:26:54 sbh16 MailScanner[10351]: Expired 5 records from the SpamAssassin cache Apr 20 21:27:05 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 21:27:05 sbh16 MailScanner[10351]: Requeue: D292169017B.0E943 to 57EB169017C Apr 20 21:27:05 sbh16 MailScanner[10351]: Uninfected: Delivered 1 messages Apr 20 21:27:05 sbh16 MailScanner[10351]: Deleted 1 messages from processing-database Apr 20 21:30:23 sbh16 MailScanner[10351]: New Batch: Scanning 1 messages, 6656 bytes Apr 20 21:30:25 sbh16 MailScanner[10351]: Spam Checks: Found 1 spam messages Apr 20 21:30:25 sbh16 MailScanner[10351]: Virus and Content Scanning: Starting Apr 20 21:30:26 sbh16 MailScanner[10351]: Requeue: C5C7869017B.0CB1C to 1B9DE69017C Apr 20 21:30:26 sbh16 MailScanner[10351]: Uninfected: Delivered 1 messages Apr 20 21:30:26 sbh16 MailScanner[10351]: Deleted 1 messages from processing-database Apr 20 21:30:26 sbh16 MailScanner[10351]: MailScanner child dying of old age Apr 20 21:30:26 sbh16 MailScanner[12476]: MailScanner E-Mail Virus Scanner version 4.76.14 starting... Apr 20 21:30:26 sbh16 MailScanner[12476]: Read 855 hostnames from the phishing whitelist Apr 20 21:30:26 sbh16 MailScanner[12476]: Read 5137 hostnames from the phishing blacklist Apr 20 21:30:26 sbh16 MailScanner[12476]: Using SpamAssassin results cache Apr 20 21:30:26 sbh16 MailScanner[12476]: Connected to SpamAssassin cache database Apr 20 21:30:26 sbh16 MailScanner[12476]: Expired 1 records from the SpamAssassin cache Apr 20 21:30:32 sbh16 MailScanner[12476]: Connected to processing-messages database Apr 20 21:30:32 sbh16 MailScanner[12476]: Found 4 messages in the processing-messages database Apr 20 21:30:32 sbh16 MailScanner[12476]: Using locktype = flock From mark at msapiro.net Tue Apr 21 17:05:54 2009 From: mark at msapiro.net (Mark Sapiro) Date: Tue Apr 21 17:06:02 2009 Subject: Mangled MIME Headers in plain text mail In-Reply-To: <200904210839.n3L8doVr012647@safir.blacknight.ie> References: <200904182028.n3IKSMns017926@safir.blacknight.ie> <20090419003627.7647317008@out-b.mx.mail-launder.com> <200904190814.n3J8ENa6032550@safir.blacknight.ie> <20090419123638.E100D17082@out-b.mx.mail-launder.com> <200904191631.n3JGVWNa020325@safir.blacknight.ie> <20090419183749.E4CA81701E@out-b.mx.mail-launder.com> <200904210839.n3L8doVr012647@safir.blacknight.ie> Message-ID: <20090421160554.GB3888@msapiro> On Tue, Apr 21, 2009 at 09:39:26AM +0100, Drew Marshall wrote: > > Sorry Kai took a while to get another one in. It's fairly > intermittent. So here it is > > http://pastebin.com/m28c03d06 > > I am sure I could find more examples. The message at the above link is defective. It appears that MailScanner is in fact doing the wrong thing. Jules will have to look at it and confirm, but here's what I see. It appears that the original message had MIME structure multipart/related multipart/alternative text/plain (the plain text alternative) text/html (the rich text alternative) image/jpeg (an image referenced by the HTML part) Then the MailScanner signature is added as follows: multipart/related multipart/alternative text/plain (the MailScanner signature) text/plain (the plain text alternative) text/html (the rich text alternative) image/jpeg (an image referenced by the HTML part) This is clearly wrong. There are a couple of ways the signature could be added. One would be to insert it in the already multipart message. multipart/related text/plain ((the MailScanner signature) multipart/alternative text/plain (the plain text alternative) text/html (the rich text alternative) image/jpeg (an image referenced by the HTML part) Another would be to recast the message as multipart mixed with the first part being the signature and the second part being the original message. multipart/mixed text/plain (the MailScanner signature) multipart/related multipart/alternative text/plain (the plain text alternative) text/html (the rich text alternative) image/jpeg (an image referenced by the HTML part) In any case, inserting the signature as another alternative within the multipart/alternative part is clearly wrong. -- Mark Sapiro mark at msapiro net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From MailScanner at ecs.soton.ac.uk Tue Apr 21 17:44:56 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 21 17:45:11 2009 Subject: Mangled MIME Headers in plain text mail In-Reply-To: <20090421160554.GB3888@msapiro> References: <200904182028.n3IKSMns017926@safir.blacknight.ie> <20090419003627.7647317008@out-b.mx.mail-launder.com> <200904190814.n3J8ENa6032550@safir.blacknight.ie> <20090419123638.E100D17082@out-b.mx.mail-launder.com> <200904191631.n3JGVWNa020325@safir.blacknight.ie> <20090419183749.E4CA81701E@out-b.mx.mail-launder.com> <200904210839.n3L8doVr012647@safir.blacknight.ie> <20090421160554.GB3888@msapiro> <49EDF808.4090708@ecs.soton.ac.uk> Message-ID: I've just tested your message against my copy of MailScanner, the latest released version. It puts the plain-text signature at the end of the first plain-text bit of text, and it puts the HTML signature at the end of the HTML bit of text, just as I intended. It doesn't create any new MIME parts for the signature at all, as I didn't think it would. So I don't know where those signatures are coming from, but I sure cannot reproduce this. MailScanner doesn't create new message MIME parts when it adds signatures, feel free to read the code. Jules. On 21/4/09 17:05, Mark Sapiro wrote: > On Tue, Apr 21, 2009 at 09:39:26AM +0100, Drew Marshall wrote: > >> Sorry Kai took a while to get another one in. It's fairly >> intermittent. So here it is >> >> http://pastebin.com/m28c03d06 >> >> I am sure I could find more examples. >> > > The message at the above link is defective. It appears that MailScanner > is in fact doing the wrong thing. Jules will have to look at it and > confirm, but here's what I see. > > It appears that the original message had MIME structure > > multipart/related > multipart/alternative > text/plain (the plain text alternative) > text/html (the rich text alternative) > image/jpeg (an image referenced by the HTML part) > > Then the MailScanner signature is added as follows: > > multipart/related > multipart/alternative > text/plain (the MailScanner signature) > text/plain (the plain text alternative) > text/html (the rich text alternative) > image/jpeg (an image referenced by the HTML part) > > This is clearly wrong. There are a couple of ways the signature could be > added. One would be to insert it in the already multipart message. > > multipart/related > text/plain ((the MailScanner signature) > multipart/alternative > text/plain (the plain text alternative) > text/html (the rich text alternative) > image/jpeg (an image referenced by the HTML part) > > Another would be to recast the message as multipart mixed with the first > part being the signature and the second part being the original message. > > multipart/mixed > text/plain (the MailScanner signature) > multipart/related > multipart/alternative > text/plain (the plain text alternative) > text/html (the rich text alternative) > image/jpeg (an image referenced by the HTML part) > > In any case, inserting the signature as another alternative within the > multipart/alternative part is clearly wrong. > > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Tue Apr 21 18:04:53 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 21 18:05:07 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: <20090421154514.GA3888@msapiro> References: <20090421154514.GA3888@msapiro> <49EDFCB5.9060506@ecs.soton.ac.uk> Message-ID: In /usr/lib/MailScanner/MailScanner/Message.pm, around line 1243, you will find a line that says next if $message->{abandoned}; Please try commenting out that line by putting a '#' at the start of it. Then restart MailScanner, and let me know if that solves the problem. Thanks for your patience in helping me resolve this issue! Jules. On 21/4/09 16:45, Mark Sapiro wrote: > On Mon, Apr 20, 2009 at 07:41:34PM -0700, Mark Sapiro wrote: > >> Julian Field wrote: >> >> >>> Also, please try the latest beta 4.76.14. This may help with this >>> problem. I have worked out why it would end up with messages in there >>> when it shouldn't, but I can't see where it actually does it. It >>> shouldn't be able to happen. So I have added some more clauses to cause >>> it to ignore partially-delivered messages, which are what must be >>> causing the problem. >>> >> >> OK. I have installed 4.76.14 and I removed the Processing.db file and >> let MailScanner recreate it when I restarted following the 4.76.14 >> installation. >> >> I will report what I see after it runs for a while. >> > > There is essentially no change in what I'm seeing. I have attached > MailScanner_log.txt which is the result of grepping the maillog for > MailScanner and then keeping only those records beginning with the > restart following installation of 4.76.17 through the child dying > of old age and the new child finding 4 messages in the database. > > Also, here are the results of asking MailScanner to display the > database and inspecting it with sqlite. > > [root@sbh16 ~]# MailScanner --processing=0 > Currently being processed: > > Number of messages: 6 > Tries Message Next Try At > ===== ======= =========== > 1 45449690408.056E4 Tue Apr 21 03:36:12 2009 > 1 41105690407.04696 Tue Apr 21 03:35:27 2009 > 1 18870690467.09282 Mon Apr 20 20:59:01 2009 > 1 60362690438.064E1 Mon Apr 20 20:56:06 2009 > 1 10663690435.057E8 Mon Apr 20 20:47:51 2009 > 1 48118690444.05809 Mon Apr 20 20:46:20 2009 > [root@sbh16 ~]# MailScanner --processing=1 > [root@sbh16 ~]# sqlite3 /var/spool/MailScanner/incoming/Processing.db > SQLite version 3.3.6 > Enter ".help" for instructions > sqlite> .tables > archive processing > sqlite> select * from archive; > sqlite> select * from processing; > 10663690435.057E8|1|1240285671 > 48118690444.05809|1|1240285580 > 60362690438.064E1|1|1240286166 > 18870690467.09282|1|1240286341 > 45449690408.056E4|1|1240310172 > 41105690407.04696|1|1240310127 > sqlite> .exit > [root@sbh16 ~]# > > > Also, it is curious and possibly significant that all the queue ids > remaining in the database are all-decimal when in general, most are not. > > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From campbell at cnpapers.com Tue Apr 21 18:15:26 2009 From: campbell at cnpapers.com (Steve Campbell) Date: Tue Apr 21 18:15:43 2009 Subject: Differences in logwatch report using newest version Message-ID: <49EDFF2E.3090805@cnpapers.com> It may not be broken, but I now notice that my logwatch report shows a difference in mail reportedly scanned by MailScanner and mail reportedly logged by MailWatch. The lines in particular from the report: 10325 messages Scanned by MailScanner 10323 Messages logged to MailWatch database If I'm not mistaken, these always used to equal the same amount of messages. I just installed MailScanner version 4.75.11 when I noticed the difference. Has logging changed or did I miss a config option? Steve Campbell From campbell at cnpapers.com Tue Apr 21 18:18:29 2009 From: campbell at cnpapers.com (Steve Campbell) Date: Tue Apr 21 18:19:02 2009 Subject: Differences in logwatch report using newest version In-Reply-To: <49EDFF2E.3090805@cnpapers.com> References: <49EDFF2E.3090805@cnpapers.com> Message-ID: <49EDFFE5.90607@cnpapers.com> Never mind. I went farther back in my reports and found the same differences. Seems it happens more often now than before, and I just never noticed it. steve Steve Campbell wrote: > It may not be broken, but I now notice that my logwatch report shows a > difference in mail reportedly scanned by MailScanner and mail > reportedly logged by MailWatch. > > The lines in particular from the report: > > 10325 messages Scanned by MailScanner > 10323 Messages logged to MailWatch database > > If I'm not mistaken, these always used to equal the same amount of > messages. I just installed MailScanner version 4.75.11 when I noticed > the difference. Has logging changed or did I miss a config option? > > Steve Campbell > > > From MailScanner at ecs.soton.ac.uk Tue Apr 21 18:58:30 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 21 18:58:54 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <20090421154514.GA3888@msapiro> <49EDFCB5.9060506@ecs.soton.ac.uk> <49EE0946.6030301@ecs.soton.ac.uk> Message-ID: Please also try MailScanner 4.76.15 and let me know how you get on. I have neatened up the code quite a bit. Jules. On 21/4/09 18:04, Julian Field wrote: > In /usr/lib/MailScanner/MailScanner/Message.pm, around line 1243, you > will find a line that says > next if $message->{abandoned}; > Please try commenting out that line by putting a '#' at the start of it. > > Then restart MailScanner, and let me know if that solves the problem. > > Thanks for your patience in helping me resolve this issue! > > Jules. > > On 21/4/09 16:45, Mark Sapiro wrote: >> On Mon, Apr 20, 2009 at 07:41:34PM -0700, Mark Sapiro wrote: >>> Julian Field wrote: >>> >>>> Also, please try the latest beta 4.76.14. This may help with this >>>> problem. I have worked out why it would end up with messages in there >>>> when it shouldn't, but I can't see where it actually does it. It >>>> shouldn't be able to happen. So I have added some more clauses to >>>> cause >>>> it to ignore partially-delivered messages, which are what must be >>>> causing the problem. >>> >>> OK. I have installed 4.76.14 and I removed the Processing.db file and >>> let MailScanner recreate it when I restarted following the 4.76.14 >>> installation. >>> >>> I will report what I see after it runs for a while. >> >> There is essentially no change in what I'm seeing. I have attached >> MailScanner_log.txt which is the result of grepping the maillog for >> MailScanner and then keeping only those records beginning with the >> restart following installation of 4.76.17 through the child dying >> of old age and the new child finding 4 messages in the database. >> >> Also, here are the results of asking MailScanner to display the >> database and inspecting it with sqlite. >> >> [root@sbh16 ~]# MailScanner --processing=0 >> Currently being processed: >> >> Number of messages: 6 >> Tries Message Next Try At >> ===== ======= =========== >> 1 45449690408.056E4 Tue Apr 21 03:36:12 2009 >> 1 41105690407.04696 Tue Apr 21 03:35:27 2009 >> 1 18870690467.09282 Mon Apr 20 20:59:01 2009 >> 1 60362690438.064E1 Mon Apr 20 20:56:06 2009 >> 1 10663690435.057E8 Mon Apr 20 20:47:51 2009 >> 1 48118690444.05809 Mon Apr 20 20:46:20 2009 >> [root@sbh16 ~]# MailScanner --processing=1 >> [root@sbh16 ~]# sqlite3 /var/spool/MailScanner/incoming/Processing.db >> SQLite version 3.3.6 >> Enter ".help" for instructions >> sqlite> .tables >> archive processing >> sqlite> select * from archive; >> sqlite> select * from processing; >> 10663690435.057E8|1|1240285671 >> 48118690444.05809|1|1240285580 >> 60362690438.064E1|1|1240286166 >> 18870690467.09282|1|1240286341 >> 45449690408.056E4|1|1240310172 >> 41105690407.04696|1|1240310127 >> sqlite> .exit >> [root@sbh16 ~]# >> >> >> Also, it is curious and possibly significant that all the queue ids >> remaining in the database are all-decimal when in general, most are not. >> > > Jules > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From Carl.Andrews at crackerbarrel.com Tue Apr 21 19:44:48 2009 From: Carl.Andrews at crackerbarrel.com (Andrews Carl 448) Date: Tue Apr 21 19:45:00 2009 Subject: Spam Assassin - Rules Question Message-ID: <73BF1D6676C4E04E9675A08BA0C9825A01804C37@exchsrvr01.CBOCS.com> I recently got to update a very out of date installation of MS and I have been trying to find better or more spamassassin rules. I was using rules_du_jour but that is obviously out of date. Now I am using the spamassassin channels updates.spamassassin.org and the sare channels from dostech.net. I also have KAM by Kevin McGrail. Would anyone be willing to point me to more if you know of any? I have tried searching but searching for "spamassassin rules/channels" is not doing too much for me. I know I found out about the KAM rule from this newsgroup a while back so I though I would check with you. According to MailWatch my clean email percentage is not 38%, it was 70% on the old version of MS, but I have a lot of messages that should be marked spam but are not. Thanks for your time! Carl -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090421/a49c18ea/attachment.html From MailScanner at ecs.soton.ac.uk Tue Apr 21 20:05:45 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 21 20:06:05 2009 Subject: Spam Assassin - Rules Question In-Reply-To: <73BF1D6676C4E04E9675A08BA0C9825A01804C37@exchsrvr01.CBOCS.com> References: <73BF1D6676C4E04E9675A08BA0C9825A01804C37@exchsrvr01.CBOCS.com> <49EE1909.1030002@ecs.soton.ac.uk> Message-ID: Also try out the sought.rules.yerp.org rules that Justin Mason (author SA) runs. http://taint.org/2007/08/15/004348a.html On 21/4/09 19:44, Andrews Carl 448 wrote: > I recently got to update a very out of date installation of MS and I > have been trying to find better or more spamassassin rules. I was > using rules_du_jour but that is obviously out of date. Now I am using > the spamassassin channels updates.spamassassin.org and the sare > channels from dostech.net. I also have KAM by Kevin McGrail. Would > anyone be willing to point me to more if you know of any? I have tried > searching but searching for "spamassassin rules/channels" is not doing > too much for me. I know I found out about the KAM rule from this > newsgroup a while back so I though I would check with you. > According to MailWatch my clean email percentage is not 38%, it was > 70% on the old version of MS, but I have a lot of messages that should > be marked spam but are not. > Thanks for your time! > Carl Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From Carl.Andrews at crackerbarrel.com Tue Apr 21 20:14:04 2009 From: Carl.Andrews at crackerbarrel.com (Andrews Carl 448) Date: Tue Apr 21 20:14:15 2009 Subject: Spam Assassin - Rules Question In-Reply-To: Message-ID: <73BF1D6676C4E04E9675A08BA0C9825A01804C3A@exchsrvr01.CBOCS.com> Thanks! -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Julian Field Sent: Tuesday, April 21, 2009 2:06 PM To: MailScanner discussion Subject: Re: Spam Assassin - Rules Question Also try out the sought.rules.yerp.org rules that Justin Mason (author SA) runs. http://taint.org/2007/08/15/004348a.html On 21/4/09 19:44, Andrews Carl 448 wrote: > I recently got to update a very out of date installation of MS and I > have been trying to find better or more spamassassin rules. I was > using rules_du_jour but that is obviously out of date. Now I am using > the spamassassin channels updates.spamassassin.org and the sare > channels from dostech.net. I also have KAM by Kevin McGrail. Would > anyone be willing to point me to more if you know of any? I have tried > searching but searching for "spamassassin rules/channels" is not doing > too much for me. I know I found out about the KAM rule from this > newsgroup a while back so I though I would check with you. > According to MailWatch my clean email percentage is not 38%, it was > 70% on the old version of MS, but I have a lot of messages that should > be marked spam but are not. > Thanks for your time! > Carl Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From maillists at conactive.com Tue Apr 21 20:31:50 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Tue Apr 21 20:32:07 2009 Subject: Any issues with the SPAM ACTIONS rule? In-Reply-To: <84E6067148EE47E081DDC31DC9D84B51@SUPPORT01V> References: <84E6067148EE47E081DDC31DC9D84B51@SUPPORT01V> Message-ID: Nigel Kendrick wrote on Tue, 21 Apr 2009 09:51:43 +0100: > I can, however, send general emails to spam@ and to spam@localhost on that machine as well? Use a fully qualified address. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From drew.marshall at trunknetworks.com Tue Apr 21 20:53:52 2009 From: drew.marshall at trunknetworks.com (Drew Marshall) Date: Tue Apr 21 20:54:23 2009 Subject: Mangled MIME Headers in plain text mail In-Reply-To: <20090421164726.AACBE1702C@out-b.mx.mail-launder.com> References: <200904182028.n3IKSMns017926@safir.blacknight.ie> <20090419003627.7647317008@out-b.mx.mail-launder.com> <200904190814.n3J8ENa6032550@safir.blacknight.ie> <20090419123638.E100D17082@out-b.mx.mail-launder.com> <200904191631.n3JGVWNa020325@safir.blacknight.ie> <20090419183749.E4CA81701E@out-b.mx.mail-launder.com> <200904210839.n3L8doVr012647@safir.blacknight.ie> <20090421160554.GB3888@msapiro> <49EDF808.4090708@ecs.soton.ac.uk> <20090421164726.AACBE1702C@out-b.mx.mail-launder.com> Message-ID: <200904211954.n3LJsE2J010052@safir.blacknight.ie> On 21 Apr 2009, at 17:44, Julian Field wrote: > I've just tested your message against my copy of MailScanner, the > latest released version. > It puts the plain-text signature at the end of the first plain-text > bit of text, and it puts the HTML signature at the end of the HTML > bit of text, just as I intended. > > It doesn't create any new MIME parts for the signature at all, as I > didn't think it would. > > So I don't know where those signatures are coming from, but I sure > cannot reproduce this. MailScanner doesn't create new message MIME > parts when it adds signatures, feel free to read the code. So where on Earth or perhaps more the point, what on Earth is making it do this? MailScanner lints just fine and for maybe 85 - 90% of all mail has no problems but every so often something throws a new MIME part and 'breaks' the message. Where can/ should I start looking Jules? Drew From mark at msapiro.net Tue Apr 21 21:02:05 2009 From: mark at msapiro.net (Mark Sapiro) Date: Tue Apr 21 21:02:13 2009 Subject: Mangled MIME Headers in plain text mail In-Reply-To: References: <200904182028.n3IKSMns017926@safir.blacknight.ie> <20090419003627.7647317008@out-b.mx.mail-launder.com> <200904190814.n3J8ENa6032550@safir.blacknight.ie> <20090419123638.E100D17082@out-b.mx.mail-launder.com> <200904191631.n3JGVWNa020325@safir.blacknight.ie> <20090419183749.E4CA81701E@out-b.mx.mail-launder.com> <200904210839.n3L8doVr012647@safir.blacknight.ie> <20090421160554.GB3888@msapiro> <49EDF808.4090708@ecs.soton.ac.uk> Message-ID: <20090421200205.GA3804@msapiro> On Tue, Apr 21, 2009 at 05:44:56PM +0100, Julian Field wrote: > I've just tested your message against my copy of MailScanner, the latest > released version. > It puts the plain-text signature at the end of the first plain-text bit > of text, and it puts the HTML signature at the end of the HTML bit of > text, just as I intended. > > It doesn't create any new MIME parts for the signature at all, as I > didn't think it would. > > So I don't know where those signatures are coming from, but I sure > cannot reproduce this. MailScanner doesn't create new message MIME parts > when it adds signatures, feel free to read the code. Perhaps the defect with the "extra" text/plain alternative was in the original message. Jules, If the original message were multipart/related Multipart/alternative text/plain (empty) text/plain (plain alternative) text/html (html alternative) image/jpeg would Mailscanner add the plain signature to both text/plain parts? > > Jules. > > On 21/4/09 17:05, Mark Sapiro wrote: > >On Tue, Apr 21, 2009 at 09:39:26AM +0100, Drew Marshall wrote: > > > >>Sorry Kai took a while to get another one in. It's fairly > >>intermittent. So here it is > >> > >>http://pastebin.com/m28c03d06 > >> > >>I am sure I could find more examples. > >> > > > >The message at the above link is defective. It appears that MailScanner > >is in fact doing the wrong thing. Jules will have to look at it and > >confirm, but here's what I see. > > > >It appears that the original message had MIME structure > > > >multipart/related > > multipart/alternative > > text/plain (the plain text alternative) > > text/html (the rich text alternative) > > image/jpeg (an image referenced by the HTML part) > > > >Then the MailScanner signature is added as follows: > > > >multipart/related > > multipart/alternative > > text/plain (the MailScanner signature) > > text/plain (the plain text alternative) > > text/html (the rich text alternative) > > image/jpeg (an image referenced by the HTML part) > > > >This is clearly wrong. There are a couple of ways the signature could be > >added. One would be to insert it in the already multipart message. > > > >multipart/related > > text/plain ((the MailScanner signature) > > multipart/alternative > > text/plain (the plain text alternative) > > text/html (the rich text alternative) > > image/jpeg (an image referenced by the HTML part) > > > >Another would be to recast the message as multipart mixed with the first > >part being the signature and the second part being the original message. > > > >multipart/mixed > > text/plain (the MailScanner signature) > > multipart/related > > multipart/alternative > > text/plain (the plain text alternative) > > text/html (the rich text alternative) > > image/jpeg (an image referenced by the HTML part) > > > >In any case, inserting the signature as another alternative within the > >multipart/alternative part is clearly wrong. > > > > > > Jules > > -- > Julian Field MEng CITP CEng > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > MailScanner customisation, or any advanced system administration help? > Contact me at Jules@Jules.FM > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > PGP public key: http://www.jules.fm/julesfm.asc > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- Mark Sapiro mark at msapiro net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From MailScanner at ecs.soton.ac.uk Tue Apr 21 21:02:45 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 21 21:03:04 2009 Subject: Mangled MIME Headers in plain text mail In-Reply-To: <200904211954.n3LJsE2J010052@safir.blacknight.ie> References: <200904182028.n3IKSMns017926@safir.blacknight.ie> <20090419003627.7647317008@out-b.mx.mail-launder.com> <200904190814.n3J8ENa6032550@safir.blacknight.ie> <20090419123638.E100D17082@out-b.mx.mail-launder.com> <200904191631.n3JGVWNa020325@safir.blacknight.ie> <20090419183749.E4CA81701E@out-b.mx.mail-launder.com> <200904210839.n3L8doVr012647@safir.blacknight.ie> <20090421160554.GB3888@msapiro> <49EDF808.4090708@ecs.soton.ac.uk> <20090421164726.AACBE1702C@out-b.mx.mail-launder.com> <200904211954.n3LJsE2J010052@safir.blacknight.ie> <49EE2665.1020503@ecs.soton.ac.uk> Message-ID: On 21/4/09 20:53, Drew Marshall wrote: > > On 21 Apr 2009, at 17:44, Julian Field wrote: > >> I've just tested your message against my copy of MailScanner, the >> latest released version. >> It puts the plain-text signature at the end of the first plain-text >> bit of text, and it puts the HTML signature at the end of the HTML >> bit of text, just as I intended. >> >> It doesn't create any new MIME parts for the signature at all, as I >> didn't think it would. >> >> So I don't know where those signatures are coming from, but I sure >> cannot reproduce this. MailScanner doesn't create new message MIME >> parts when it adds signatures, feel free to read the code. > > So where on Earth or perhaps more the point, what on Earth is making > it do this? MailScanner lints just fine and for maybe 85 - 90% of all > mail has no problems but every so often something throws a new MIME > part and 'breaks' the message. > > Where can/ should I start looking Jules? Archive all the mail coming in ("Archive Mail =" will do the job just fine), and when you find a message that has been broken, send me (off list) a compressed version of the original mail before MailScanner got its mitts on it, so I can try to reproduce it given the original raw message. If it's only working correctly for 90% of mail, it won't take you long to find a good simpe example of one it breaks. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Tue Apr 21 21:09:50 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 21 21:10:12 2009 Subject: Mangled MIME Headers in plain text mail In-Reply-To: <20090421200205.GA3804@msapiro> References: <200904182028.n3IKSMns017926@safir.blacknight.ie> <20090419003627.7647317008@out-b.mx.mail-launder.com> <200904190814.n3J8ENa6032550@safir.blacknight.ie> <20090419123638.E100D17082@out-b.mx.mail-launder.com> <200904191631.n3JGVWNa020325@safir.blacknight.ie> <20090419183749.E4CA81701E@out-b.mx.mail-launder.com> <200904210839.n3L8doVr012647@safir.blacknight.ie> <20090421160554.GB3888@msapiro> <49EDF808.4090708@ecs.soton.ac.uk> <20090421200205.GA3804@msapiro> <49EE280E.5090308@ecs.soton.ac.uk> Message-ID: On 21/4/09 21:02, Mark Sapiro wrote: > On Tue, Apr 21, 2009 at 05:44:56PM +0100, Julian Field wrote: > >> I've just tested your message against my copy of MailScanner, the latest >> released version. >> It puts the plain-text signature at the end of the first plain-text bit >> of text, and it puts the HTML signature at the end of the HTML bit of >> text, just as I intended. >> >> It doesn't create any new MIME parts for the signature at all, as I >> didn't think it would. >> >> So I don't know where those signatures are coming from, but I sure >> cannot reproduce this. MailScanner doesn't create new message MIME parts >> when it adds signatures, feel free to read the code. >> > > Perhaps the defect with the "extra" text/plain alternative was in the > original message. > > Jules, > > If the original message were > > multipart/related > Multipart/alternative > text/plain (empty) > text/plain (plain alternative) > text/html (html alternative) > image/jpeg > > would Mailscanner add the plain signature to both text/plain parts? > No, only the first one. But a message with an empty text/plain alternative part could well display as a totally blank message. > > >> Jules. >> >> On 21/4/09 17:05, Mark Sapiro wrote: >> >>> On Tue, Apr 21, 2009 at 09:39:26AM +0100, Drew Marshall wrote: >>> >>> >>>> Sorry Kai took a while to get another one in. It's fairly >>>> intermittent. So here it is >>>> >>>> http://pastebin.com/m28c03d06 >>>> >>>> I am sure I could find more examples. >>>> >>>> >>> The message at the above link is defective. It appears that MailScanner >>> is in fact doing the wrong thing. Jules will have to look at it and >>> confirm, but here's what I see. >>> >>> It appears that the original message had MIME structure >>> >>> multipart/related >>> multipart/alternative >>> text/plain (the plain text alternative) >>> text/html (the rich text alternative) >>> image/jpeg (an image referenced by the HTML part) >>> >>> Then the MailScanner signature is added as follows: >>> >>> multipart/related >>> multipart/alternative >>> text/plain (the MailScanner signature) >>> text/plain (the plain text alternative) >>> text/html (the rich text alternative) >>> image/jpeg (an image referenced by the HTML part) >>> >>> This is clearly wrong. There are a couple of ways the signature could be >>> added. One would be to insert it in the already multipart message. >>> >>> multipart/related >>> text/plain ((the MailScanner signature) >>> multipart/alternative >>> text/plain (the plain text alternative) >>> text/html (the rich text alternative) >>> image/jpeg (an image referenced by the HTML part) >>> >>> Another would be to recast the message as multipart mixed with the first >>> part being the signature and the second part being the original message. >>> >>> multipart/mixed >>> text/plain (the MailScanner signature) >>> multipart/related >>> multipart/alternative >>> text/plain (the plain text alternative) >>> text/html (the rich text alternative) >>> image/jpeg (an image referenced by the HTML part) >>> >>> In any case, inserting the signature as another alternative within the >>> multipart/alternative part is clearly wrong. >>> >>> >>> >> Jules >> >> -- >> Julian Field MEng CITP CEng >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> >> MailScanner customisation, or any advanced system administration help? >> Contact me at Jules@Jules.FM >> >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> PGP public key: http://www.jules.fm/julesfm.asc >> >> >> -- >> This message has been scanned for viruses and >> dangerous content by MailScanner, and is >> believed to be clean. >> >> >> > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From mark at msapiro.net Tue Apr 21 21:11:14 2009 From: mark at msapiro.net (Mark Sapiro) Date: Tue Apr 21 21:11:21 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <20090421154514.GA3888@msapiro> <49EDFCB5.9060506@ecs.soton.ac.uk> <49EE0946.6030301@ecs.soton.ac.uk> Message-ID: <20090421201114.GB3804@msapiro> On Tue, Apr 21, 2009 at 06:58:30PM +0100, Julian Field wrote: > > Please also try MailScanner 4.76.15 and let me know how you get on. I > have neatened up the code quite a bit. > > Jules. > > On 21/4/09 18:04, Julian Field wrote: > >In /usr/lib/MailScanner/MailScanner/Message.pm, around line 1243, you > >will find a line that says > >next if $message->{abandoned}; > >Please try commenting out that line by putting a '#' at the start of it. > > > >Then restart MailScanner, and let me know if that solves the problem. > > > >Thanks for your patience in helping me resolve this issue! I installed 4.76.15. Am I also supposed to comment the above line in 4.76.15 or was that just for 4.76.14? I did not comment the line, and I am still seeing messages left in the database. -- Mark Sapiro mark at msapiro net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From mailbag at partnersolutions.ca Tue Apr 21 21:43:52 2009 From: mailbag at partnersolutions.ca (PSI Mailbag) Date: Tue Apr 21 21:44:06 2009 Subject: Permission errors with extracted TNEF data Message-ID: <120EBC42C8319846842A4A49B3D5566BBDDAF9@psims003.pshosting.intranet> Hey Julian (+list), Did you correct some permission errors with the extracted TNEF data in your latest beta? I noticed in the 4.75.11 release (and prior), all extracted TNEF data (either by the perl module or via the external parser (1.4.5) was being saved to the incoming work directory with bad permissions, which was causing Clamd to complain. It only affected the TNEF exported data, which didn't appear to be using the proper "Incoming Work Permissions" or "Incoming Work Group" settings, depending on which parser you used. If you used the external parser, the clamd errors were not logged to MS, only to the clamd.log file (ex: Tue Apr 21 14:42:03 2009 -> WARNING: lstat() failed on: /var/spool/MailScanner/incoming/15901/227A5746A0B.85B2D/tnef.15901). I don't have the problem anymore in the latest beta (4.76.15) with Convert::TNEF, but the issue still exists with the external parser, which is ignoring the "Incoming Work Group" settings. I didn't see anything specifically mentioned in the changelog about the Perl TNEF fix, so I figured I'd ask. I did a dump of the file permissions of the work folders in this pastebin: http://pastebin.com/m66f3b2db This server is using Postfix with the following configs: Run As User = postfix / Run As Group = postfix Incoming Work Group = clamav / Incoming Work Permissions = 0640 Cheers, -Joshua From MailScanner at ecs.soton.ac.uk Tue Apr 21 21:44:02 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 21 21:44:24 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: <20090421201114.GB3804@msapiro> References: <20090421154514.GA3888@msapiro> <49EDFCB5.9060506@ecs.soton.ac.uk> <49EE0946.6030301@ecs.soton.ac.uk> <20090421201114.GB3804@msapiro> <49EE3012.2030808@ecs.soton.ac.uk> Message-ID: On 21/4/09 21:11, Mark Sapiro wrote: > On Tue, Apr 21, 2009 at 06:58:30PM +0100, Julian Field wrote: > >> Please also try MailScanner 4.76.15 and let me know how you get on. I >> have neatened up the code quite a bit. >> >> Jules. >> >> On 21/4/09 18:04, Julian Field wrote: >> >>> In /usr/lib/MailScanner/MailScanner/Message.pm, around line 1243, you >>> will find a line that says >>> next if $message->{abandoned}; >>> Please try commenting out that line by putting a '#' at the start of it. >>> >>> Then restart MailScanner, and let me know if that solves the problem. >>> >>> Thanks for your patience in helping me resolve this issue! >>> > > I installed 4.76.15. Am I also supposed to comment the above line in > 4.76.15 or was that just for 4.76.14? I did not comment the line, and > I am still seeing messages left in the database. > It was just for .14. I am really running out of ideas here. There is no way the thing would fail unless the DELETE was failing. If it doesn't manage to find the complete message, it doesn't add it to the database. I made extra doubly sure of that in .15, so I really can't see how it is getting left in there. If it was doubly added to the database, it would still get deleted, unless the delete itself was failing. I wonder if the DBI parameter substitution is handling the parameter string incorrectly if it's all decimal digits, thinking it's a number and not a string? Here's a patch for 4.76.15 for you to try that will test this hypothesis. ---PATCH START--- --- MessageBatch.pm.old 2009-04-21 21:33:37.000000000 +0100 +++ MessageBatch.pm 2009-04-21 21:35:03.000000000 +0100 @@ -1259,7 +1259,8 @@ foreach $id (keys %gotridof) { next unless $id; - $sth->execute($id); + #$sth->execute($id); + $MailScanner::ProcDBH->do("DELETE FROM processing WHERE (id='$id')"); } $sth->finish; ---PATCH END--- As you can see, it's a simple one-liner. Please let me know if it makes any difference. Thanks! Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Tue Apr 21 22:48:45 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 21 22:49:18 2009 Subject: Permission errors with extracted TNEF data In-Reply-To: <120EBC42C8319846842A4A49B3D5566BBDDAF9@psims003.pshosting.intranet> References: <120EBC42C8319846842A4A49B3D5566BBDDAF9@psims003.pshosting.intranet> <49EE3F3D.8030509@ecs.soton.ac.uk> Message-ID: You were using an old version of MailScanner (probably just not the very latest betas), but yes, I have done quite a lot of work on the TNEF handling, and had forgotten in the latest revision to set all the permissions and ownerships. I have now fixed all of that, and it should now work as intended. It will be in the next release. On 21/4/09 21:43, PSI Mailbag wrote: > Hey Julian (+list), > > Did you correct some permission errors with the extracted TNEF data in > your latest beta? I noticed in the 4.75.11 release (and prior), all > extracted TNEF data (either by the perl module or via the external > parser (1.4.5) was being saved to the incoming work directory with bad > permissions, which was causing Clamd to complain. It only affected the > TNEF exported data, which didn't appear to be using the proper "Incoming > Work Permissions" or "Incoming Work Group" settings, depending on which > parser you used. If you used the external parser, the clamd errors were > not logged to MS, only to the clamd.log file (ex: Tue Apr 21 14:42:03 > 2009 -> WARNING: lstat() failed on: > /var/spool/MailScanner/incoming/15901/227A5746A0B.85B2D/tnef.15901). > > I don't have the problem anymore in the latest beta (4.76.15) with > Convert::TNEF, but the issue still exists with the external parser, > which is ignoring the "Incoming Work Group" settings. I didn't see > anything specifically mentioned in the changelog about the Perl TNEF > fix, so I figured I'd ask. > > I did a dump of the file permissions of the work folders in this > pastebin: http://pastebin.com/m66f3b2db > > This server is using Postfix with the following configs: > Run As User = postfix / Run As Group = postfix > Incoming Work Group = clamav / Incoming Work Permissions = 0640 > > > Cheers, > -Joshua > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From mark at msapiro.net Wed Apr 22 00:43:47 2009 From: mark at msapiro.net (Mark Sapiro) Date: Wed Apr 22 00:44:00 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: Message-ID: Julian Fieldwrote: > >On 21/4/09 21:11, Mark Sapiro wrote: >> On Tue, Apr 21, 2009 at 06:58:30PM +0100, Julian Field wrote: >> >>> Please also try MailScanner 4.76.15 and let me know how you get on. I >>> have neatened up the code quite a bit. >>> >>> Jules. >>> >>> On 21/4/09 18:04, Julian Field wrote: >>> >>>> In /usr/lib/MailScanner/MailScanner/Message.pm, around line 1243, you >>>> will find a line that says >>>> next if $message->{abandoned}; >>>> Please try commenting out that line by putting a '#' at the start of it. >>>> >>>> Then restart MailScanner, and let me know if that solves the problem. >>>> >>>> Thanks for your patience in helping me resolve this issue! >>>> >> >> I installed 4.76.15. Am I also supposed to comment the above line in >> 4.76.15 or was that just for 4.76.14? I did not comment the line, and >> I am still seeing messages left in the database. >> >It was just for .14. I am really running out of ideas here. There is no >way the thing would fail unless the DELETE was failing. >If it doesn't manage to find the complete message, it doesn't add it to >the database. I made extra doubly sure of that in .15, so I really can't >see how it is getting left in there. If it was doubly added to the >database, it would still get deleted, unless the delete itself was >failing. I wonder if the DBI parameter substitution is handling the >parameter string incorrectly if it's all decimal digits, thinking it's a >number and not a string? > >Here's a patch for 4.76.15 for you to try that will test this hypothesis. > >---PATCH START--- >--- MessageBatch.pm.old 2009-04-21 21:33:37.000000000 +0100 >+++ MessageBatch.pm 2009-04-21 21:35:03.000000000 +0100 >@@ -1259,7 +1259,8 @@ > > foreach $id (keys %gotridof) { > next unless $id; >- $sth->execute($id); >+ #$sth->execute($id); >+ $MailScanner::ProcDBH->do("DELETE FROM processing WHERE (id='$id')"); > } > $sth->finish; > >---PATCH END--- > >As you can see, it's a simple one-liner. Please let me know if it makes >any difference. I have installed the patch and it is encouraging so far. While it is too soon to say for sure that there won't be any residual entries in the database, I've been running for over 2 hours and processed at least one large batch of outgoing messages, and don't have any yet. -- Mark Sapiro The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From t.d.lee at durham.ac.uk Wed Apr 22 10:56:30 2009 From: t.d.lee at durham.ac.uk (David Lee) Date: Wed Apr 22 10:57:12 2009 Subject: MailScanner installer In-Reply-To: References: <49E304C7.5060906@ecs.soton.ac.uk> Message-ID: On Mon, 13 Apr 2009, Julian Field wrote: > Right, I have just finished a good weekend's work on the installer, and all > the Perl modules it installs. > Most of the Perl modules have been upgraded for starters. > > The installer no longer "forces" the install of any Perl module. So you can > upgrade Perl independently at any time without it clashing with any of > MailScanner's Perl modules. Hopefully this will make quite a few of you > happier :-) > > All modules install cleanly on RedHat Enterprise 4 and 5, CentOS 4 and 5, and > Fedora Core 9 and 10. Those are what I have tested it on and ironed out all > the problems on. > > There are several command-line options to the installer that you should know > about. "./install.sh --help" will print these. Julian: This is a great improvement. Many, many thanks. I've just been trying it on a CentOS 5.3 (actually 5.2 upgraded to 5.3) with MS 4.76.14 (yesterday) and 4.76.15 (today). It seems to be working almost flawlessly. That is, on a repeated MS "./install.sh fast" almost all modules give: Oh good, module File-Spec version 0.82 is already installed. etc. Almost. But TimeDate is being recalcitrant. It is consistently re-installing: Attempting to build and install perl-TimeDate-1.16-4 Installing perl-TimeDate-1.16-4.src.rpm [... lots of build info ...] Preparing... ################################################## package perl-TimeDate-1.16-5.el5.noarch (which is newer than perl-TimeDate-1.16-4.noarch) is already installed The OS already has "perl-TimeDate-1.16-5.el5" (note the "-5"), but MS seems to want to try to install its own (and earlier) "-4". If I remove that OS-derived module, and re-run MS "install.sh" twice, it behaves nicely: the first run installs it (perl-TimeDate-1.16-4), and the second run finds it and skips it (with "Oh good, ..."). The "quick fix for now" might simply be to upgrade ths MS version to TimeDate to "-5". But I suspect there is a deeper structural issue at play, in that your re-working of the installer seems to have missed a detail somewhere that is affecting the TimeDate module. Just to re-iterate: this re-working is a massive improvement! All I'm reporting here is a small, suboptimal detail. Is there something here I can assist debugging? -- : David Lee I.T. Service : : Senior Systems Programmer Computer Centre : : UNIX Team Leader Durham University : : South Road : : http://www.dur.ac.uk/t.d.lee/ Durham DH1 3LE : : Phone: +44 191 334 2752 U.K. : From MailScanner at ecs.soton.ac.uk Wed Apr 22 11:24:17 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Wed Apr 22 11:24:34 2009 Subject: MailScanner installer In-Reply-To: References: <49E304C7.5060906@ecs.soton.ac.uk> <49EEF051.6000508@ecs.soton.ac.uk> Message-ID: On 22/4/09 10:56, David Lee wrote: > On Mon, 13 Apr 2009, Julian Field wrote: > >> Right, I have just finished a good weekend's work on the installer, >> and all the Perl modules it installs. >> Most of the Perl modules have been upgraded for starters. >> >> The installer no longer "forces" the install of any Perl module. So >> you can upgrade Perl independently at any time without it clashing >> with any of MailScanner's Perl modules. Hopefully this will make >> quite a few of you happier :-) >> >> All modules install cleanly on RedHat Enterprise 4 and 5, CentOS 4 >> and 5, and Fedora Core 9 and 10. Those are what I have tested it on >> and ironed out all the problems on. >> >> There are several command-line options to the installer that you >> should know about. "./install.sh --help" will print these. > > Julian: This is a great improvement. Many, many thanks. Glad to hear you like it. You were quite right that it needed some work, I hadn't done anything to it in too long. It was just a rather big job and I needed a long uninterrupted stretch of time to work on it. Which I finally found by taking 6 days off work and going and seeing my folks in Wales :-) I wasn't supposed to be working, but MailScanner doesn't really count, does it? ;-) > > I've just been trying it on a CentOS 5.3 (actually 5.2 upgraded to > 5.3) with MS 4.76.14 (yesterday) and 4.76.15 (today). > > It seems to be working almost flawlessly. That is, on a repeated MS > "./install.sh fast" almost all modules give: > Oh good, module File-Spec version 0.82 is already installed. > etc. > > Almost. But TimeDate is being recalcitrant. It is consistently > re-installing: > Attempting to build and install perl-TimeDate-1.16-4 > Installing perl-TimeDate-1.16-4.src.rpm > [... lots of build info ...] > Preparing... > ################################################## > package perl-TimeDate-1.16-5.el5.noarch (which is newer > than perl-TimeDate-1.16-4.noarch) is already installed > > > The OS already has "perl-TimeDate-1.16-5.el5" (note the "-5"), but MS > seems to want to try to install its own (and earlier) "-4". The snag is that the TimeDate is a "bundle" and not a single module. So there aren't any version numbers you can check, so it has to retry it. And the RPM version check won't work because it is someone else's version numbering system. If you can find a way of automatically determining that "1.16-5.el5.noarch" is higher than "1.16-4.noarch" then I would be all ears, unfortunately I can't find one. The version checking code in RPM is too complex to reproduce in a simple fashion in a shell script. You can't do a simple alphabetical check as "10" must be greater than "9" which it isn't if you sort alphabetically. So unfortunately, TimeDate is the one case I was unable to resolve perfectly. I effectively need to be able to ask RPM "if I were to build 1.16-5, would you install it?" and there doesn't appear to be any way of asking it that. I have to build it and try it. Simply upping the "-4" to "-6" is cheating, and doesn't solve the general problem which will surely rear its head again in the future. > > > If I remove that OS-derived module, and re-run MS "install.sh" twice, > it behaves nicely: the first run installs it (perl-TimeDate-1.16-4), > and the second run finds it and skips it (with "Oh good, ..."). If you re-ran it once with "reinstall" on the command-line, or else just ran it once from a pre-4.76 version of MailScanner, it will remove the perl-TimeDate module that is installed and install its own. It does do a version number check to see whether you have a pre-Easter system installed or not, and it uninstalls all the Perl modules if it's a pre-Easter system, before installing them again. So normal users of MailScanner with earlier versions installed won't see this, only people installing for the first time. I guess I could just remove the perl-TimeDate rpm if there isn't a version of MailScanner already installed? That would be a quick hack that would solve the problem. What do you think of me doing that? > > The "quick fix for now" might simply be to upgrade ths MS version to > TimeDate to "-5". But I suspect there is a deeper structural issue at > play, in that your re-working of the installer seems to have missed a > detail somewhere that is affecting the TimeDate module. See above. > > > Just to re-iterate: this re-working is a massive improvement! All I'm > reporting here is a small, suboptimal detail. Understood, and thanks. > > Is there something here I can assist debugging? If you can get RPM to answer the question, it would sure help. Otherwise I can't find a solution. The general version number is made up of -[- ...] where consists of number.number[.number...]. I don't want to have to write the general parser and comparator for that little problem :-( Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From support-lists at petdoctors.co.uk Wed Apr 22 11:37:14 2009 From: support-lists at petdoctors.co.uk (Nigel Kendrick) Date: Wed Apr 22 11:37:39 2009 Subject: Any issues with the SPAM ACTIONS rule? In-Reply-To: References: <84E6067148EE47E081DDC31DC9D84B51@SUPPORT01V> Message-ID: <019393A5745348CA91D75ADC768F6DB9@SUPPORT01V> -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Kai Schaetzl Sent: Tuesday, April 21, 2009 8:32 PM To: mailscanner@lists.mailscanner.info Subject: Re: Any issues with the SPAM ACTIONS rule? Nigel Kendrick wrote on Tue, 21 Apr 2009 09:51:43 +0100: > I can, however, send general emails to spam@ and to spam@localhost on that machine as well? Use a fully qualified address. Kai Thanks for the reply - yes, I had a brainwave yesterday and changed it to spam@localhost and that worked! Nigel From maillists at conactive.com Wed Apr 22 12:31:34 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Wed Apr 22 12:31:50 2009 Subject: MailScanner installer In-Reply-To: References: <49E304C7.5060906@ecs.soton.ac.uk> <49EEF051.6000508@ecs.soton.ac.uk> Message-ID: Julian Field wrote on Wed, 22 Apr 2009 11:24:17 +0100: > The snag is that the TimeDate is a "bundle" and not a single module. So > there aren't any version numbers you can check, so it has to retry it. > And the RPM version check won't work because it is someone else's > version numbering system. If you can find a way of automatically > determining that "1.16-5.el5.noarch" is higher than "1.16-4.noarch" then > I would be all ears, unfortunately I can't find one. The version > checking code in RPM is too complex to reproduce in a simple fashion in > a shell script. You can't do a simple alphabetical check as "10" must be > greater than "9" which it isn't if you sort alphabetically. Shouldn't this be helpful? (This could also be utilized right in the mailscanner*.rpm.) rpm -q --provides perl-TimeDate perl(Date::Format) = 2.22 perl(Date::Format::Generic) perl(Date::Language) = 1.10 perl(Date::Language::Afar) = 0.99 perl(Date::Language::Amharic) = 1.00 perl(Date::Language::Austrian) = 1.01 perl(Date::Language::Brazilian) = 1.01 perl(Date::Language::Chinese_GB) = 1.01 perl(Date::Language::Czech) = 1.01 perl(Date::Language::Danish) = 1.01 perl(Date::Language::Dutch) = 1.02 perl(Date::Language::English) = 1.01 perl(Date::Language::Finnish) = 1.01 perl(Date::Language::French) = 1.04 perl(Date::Language::Gedeo) = 0.99 perl(Date::Language::German) = 1.02 perl(Date::Language::Greek) = 1.00 perl(Date::Language::Italian) = 1.01 perl(Date::Language::Norwegian) = 1.01 perl(Date::Language::Oromo) = 0.99 perl(Date::Language::Sidama) = 0.99 perl(Date::Language::Somali) = 0.99 perl(Date::Language::Swedish) = 1.01 perl(Date::Language::Tigrinya) = 1.00 perl(Date::Language::TigrinyaEritrean) = 1.00 perl(Date::Language::TigrinyaEthiopian) = 1.00 perl(Date::Parse) = 2.27 perl(Time::Zone) = 2.22 perl-TimeDate = 1:1.16-5.el5 Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From MailScanner at ecs.soton.ac.uk Wed Apr 22 14:08:30 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Wed Apr 22 14:08:49 2009 Subject: MailScanner installer In-Reply-To: References: <49E304C7.5060906@ecs.soton.ac.uk> <49EF16CE.4020607@ecs.soton.ac.uk> Message-ID: On 22/4/09 10:56, David Lee wrote: > On Mon, 13 Apr 2009, Julian Field wrote: > >> Right, I have just finished a good weekend's work on the installer, >> and all the Perl modules it installs. >> Most of the Perl modules have been upgraded for starters. >> >> The installer no longer "forces" the install of any Perl module. So >> you can upgrade Perl independently at any time without it clashing >> with any of MailScanner's Perl modules. Hopefully this will make >> quite a few of you happier :-) >> >> All modules install cleanly on RedHat Enterprise 4 and 5, CentOS 4 >> and 5, and Fedora Core 9 and 10. Those are what I have tested it on >> and ironed out all the problems on. >> >> There are several command-line options to the installer that you >> should know about. "./install.sh --help" will print these. > > Julian: This is a great improvement. Many, many thanks. > > I've just been trying it on a CentOS 5.3 (actually 5.2 upgraded to > 5.3) with MS 4.76.14 (yesterday) and 4.76.15 (today). > > It seems to be working almost flawlessly. That is, on a repeated MS > "./install.sh fast" almost all modules give: > Oh good, module File-Spec version 0.82 is already installed. > etc. > > Almost. But TimeDate is being recalcitrant. It is consistently > re-installing: > Attempting to build and install perl-TimeDate-1.16-4 > Installing perl-TimeDate-1.16-4.src.rpm > [... lots of build info ...] > Preparing... > ################################################## > package perl-TimeDate-1.16-5.el5.noarch (which is newer > than perl-TimeDate-1.16-4.noarch) is already installed I have found a very simple solution to this. On a system without MailScanner installed, it just automatically does a './install.sh reinstall' which solves the problem very easily. This will be in the next release so you can try it. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Wed Apr 22 14:11:01 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Wed Apr 22 14:11:25 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49EF1765.3010600@ecs.soton.ac.uk> Message-ID: On 22/4/09 00:43, Mark Sapiro wrote: > Julian Fieldwrote: > >> On 21/4/09 21:11, Mark Sapiro wrote: >> >>> On Tue, Apr 21, 2009 at 06:58:30PM +0100, Julian Field wrote: >>> >>> >>>> Please also try MailScanner 4.76.15 and let me know how you get on. I >>>> have neatened up the code quite a bit. >>>> >>>> Jules. >>>> >>>> On 21/4/09 18:04, Julian Field wrote: >>>> >>>> >>>>> In /usr/lib/MailScanner/MailScanner/Message.pm, around line 1243, you >>>>> will find a line that says >>>>> next if $message->{abandoned}; >>>>> Please try commenting out that line by putting a '#' at the start of it. >>>>> >>>>> Then restart MailScanner, and let me know if that solves the problem. >>>>> >>>>> Thanks for your patience in helping me resolve this issue! >>>>> >>>>> >>> I installed 4.76.15. Am I also supposed to comment the above line in >>> 4.76.15 or was that just for 4.76.14? I did not comment the line, and >>> I am still seeing messages left in the database. >>> >>> >> It was just for .14. I am really running out of ideas here. There is no >> way the thing would fail unless the DELETE was failing. >> If it doesn't manage to find the complete message, it doesn't add it to >> the database. I made extra doubly sure of that in .15, so I really can't >> see how it is getting left in there. If it was doubly added to the >> database, it would still get deleted, unless the delete itself was >> failing. I wonder if the DBI parameter substitution is handling the >> parameter string incorrectly if it's all decimal digits, thinking it's a >> number and not a string? >> >> Here's a patch for 4.76.15 for you to try that will test this hypothesis. >> >> ---PATCH START--- >> --- MessageBatch.pm.old 2009-04-21 21:33:37.000000000 +0100 >> +++ MessageBatch.pm 2009-04-21 21:35:03.000000000 +0100 >> @@ -1259,7 +1259,8 @@ >> >> foreach $id (keys %gotridof) { >> next unless $id; >> - $sth->execute($id); >> + #$sth->execute($id); >> + $MailScanner::ProcDBH->do("DELETE FROM processing WHERE (id='$id')"); >> } >> $sth->finish; >> >> ---PATCH END--- >> >> As you can see, it's a simple one-liner. Please let me know if it makes >> any difference. >> > > I have installed the patch and it is encouraging so far. While it is > too soon to say for sure that there won't be any residual entries in > the database, I've been running for over 2 hours and processed at > least one large batch of outgoing messages, and don't have any yet. > > If it proves that solves the problem, I have another alternative I would like you to try as it will be faster, if it works around the Perl bug. Instead of $MailScanner::ProcDBH->do("DELETE FROM processing WHERE (id='$id')"); make the line say $sth->execute("$id"); and give that a go. Notice it is *almost* the same as the line was before, but with quotes around the $id. That may be enough to circumvent this bug. Thanks! Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From mark at msapiro.net Wed Apr 22 15:55:42 2009 From: mark at msapiro.net (Mark Sapiro) Date: Wed Apr 22 15:55:56 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: Message-ID: Julian Field wrote: > >On 22/4/09 00:43, Mark Sapiro wrote: >> Julian Fieldwrote: >> >>> On 21/4/09 21:11, Mark Sapiro wrote: >>> >>>> On Tue, Apr 21, 2009 at 06:58:30PM +0100, Julian Field wrote: >>>> >>>> >>>>> Please also try MailScanner 4.76.15 and let me know how you get on. I >>>>> have neatened up the code quite a bit. >>>>> >>>>> Jules. >>>>> >>>>> On 21/4/09 18:04, Julian Field wrote: >>>>> >>>>> >>>>>> In /usr/lib/MailScanner/MailScanner/Message.pm, around line 1243, you >>>>>> will find a line that says >>>>>> next if $message->{abandoned}; >>>>>> Please try commenting out that line by putting a '#' at the start of it. >>>>>> >>>>>> Then restart MailScanner, and let me know if that solves the problem. >>>>>> >>>>>> Thanks for your patience in helping me resolve this issue! >>>>>> >>>>>> >>>> I installed 4.76.15. Am I also supposed to comment the above line in >>>> 4.76.15 or was that just for 4.76.14? I did not comment the line, and >>>> I am still seeing messages left in the database. >>>> >>>> >>> It was just for .14. I am really running out of ideas here. There is no >>> way the thing would fail unless the DELETE was failing. >>> If it doesn't manage to find the complete message, it doesn't add it to >>> the database. I made extra doubly sure of that in .15, so I really can't >>> see how it is getting left in there. If it was doubly added to the >>> database, it would still get deleted, unless the delete itself was >>> failing. I wonder if the DBI parameter substitution is handling the >>> parameter string incorrectly if it's all decimal digits, thinking it's a >>> number and not a string? >>> >>> Here's a patch for 4.76.15 for you to try that will test this hypothesis. >>> >>> ---PATCH START--- >>> --- MessageBatch.pm.old 2009-04-21 21:33:37.000000000 +0100 >>> +++ MessageBatch.pm 2009-04-21 21:35:03.000000000 +0100 >>> @@ -1259,7 +1259,8 @@ >>> >>> foreach $id (keys %gotridof) { >>> next unless $id; >>> - $sth->execute($id); >>> + #$sth->execute($id); >>> + $MailScanner::ProcDBH->do("DELETE FROM processing WHERE (id='$id')"); >>> } >>> $sth->finish; >>> >>> ---PATCH END--- >>> >>> As you can see, it's a simple one-liner. Please let me know if it makes >>> any difference. >>> >> >> I have installed the patch and it is encouraging so far. While it is >> too soon to say for sure that there won't be any residual entries in >> the database, I've been running for over 2 hours and processed at >> least one large batch of outgoing messages, and don't have any yet. >> >> >If it proves that solves the problem, I have another alternative I would >like you to try as it will be faster, if it works around the Perl bug. >Instead of > $MailScanner::ProcDBH->do("DELETE FROM processing WHERE (id='$id')"); >make the line say > $sth->execute("$id"); >and give that a go. Notice it is *almost* the same as the line was >before, but with quotes around the $id. That may be enough to circumvent >this bug. I am certain the first patch fixed the problem. I am now trying the alternative. I will report back this evening (my time - tomorrow UTC). -- Mark Sapiro The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From MailScanner at ecs.soton.ac.uk Wed Apr 22 16:05:52 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Wed Apr 22 16:06:13 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49EF3250.6040100@ecs.soton.ac.uk> Message-ID: On 22/4/09 15:55, Mark Sapiro wrote: > Julian Field wrote: > >> On 22/4/09 00:43, Mark Sapiro wrote: >> >>> Julian Fieldwrote: >>> >>> >>>> On 21/4/09 21:11, Mark Sapiro wrote: >>>> >>>> >>>>> On Tue, Apr 21, 2009 at 06:58:30PM +0100, Julian Field wrote: >>>>> >>>>> >>>>> >>>>>> Please also try MailScanner 4.76.15 and let me know how you get on. I >>>>>> have neatened up the code quite a bit. >>>>>> >>>>>> Jules. >>>>>> >>>>>> On 21/4/09 18:04, Julian Field wrote: >>>>>> >>>>>> >>>>>> >>>>>>> In /usr/lib/MailScanner/MailScanner/Message.pm, around line 1243, you >>>>>>> will find a line that says >>>>>>> next if $message->{abandoned}; >>>>>>> Please try commenting out that line by putting a '#' at the start of it. >>>>>>> >>>>>>> Then restart MailScanner, and let me know if that solves the problem. >>>>>>> >>>>>>> Thanks for your patience in helping me resolve this issue! >>>>>>> >>>>>>> >>>>>>> >>>>> I installed 4.76.15. Am I also supposed to comment the above line in >>>>> 4.76.15 or was that just for 4.76.14? I did not comment the line, and >>>>> I am still seeing messages left in the database. >>>>> >>>>> >>>>> >>>> It was just for .14. I am really running out of ideas here. There is no >>>> way the thing would fail unless the DELETE was failing. >>>> If it doesn't manage to find the complete message, it doesn't add it to >>>> the database. I made extra doubly sure of that in .15, so I really can't >>>> see how it is getting left in there. If it was doubly added to the >>>> database, it would still get deleted, unless the delete itself was >>>> failing. I wonder if the DBI parameter substitution is handling the >>>> parameter string incorrectly if it's all decimal digits, thinking it's a >>>> number and not a string? >>>> >>>> Here's a patch for 4.76.15 for you to try that will test this hypothesis. >>>> >>>> ---PATCH START--- >>>> --- MessageBatch.pm.old 2009-04-21 21:33:37.000000000 +0100 >>>> +++ MessageBatch.pm 2009-04-21 21:35:03.000000000 +0100 >>>> @@ -1259,7 +1259,8 @@ >>>> >>>> foreach $id (keys %gotridof) { >>>> next unless $id; >>>> - $sth->execute($id); >>>> + #$sth->execute($id); >>>> + $MailScanner::ProcDBH->do("DELETE FROM processing WHERE (id='$id')"); >>>> } >>>> $sth->finish; >>>> >>>> ---PATCH END--- >>>> >>>> As you can see, it's a simple one-liner. Please let me know if it makes >>>> any difference. >>>> >>>> >>> I have installed the patch and it is encouraging so far. While it is >>> too soon to say for sure that there won't be any residual entries in >>> the database, I've been running for over 2 hours and processed at >>> least one large batch of outgoing messages, and don't have any yet. >>> >>> >>> >> If it proves that solves the problem, I have another alternative I would >> like you to try as it will be faster, if it works around the Perl bug. >> Instead of >> $MailScanner::ProcDBH->do("DELETE FROM processing WHERE (id='$id')"); >> make the line say >> $sth->execute("$id"); >> and give that a go. Notice it is *almost* the same as the line was >> before, but with quotes around the $id. That may be enough to circumvent >> this bug. >> > > I am certain the first patch fixed the problem. Wonderful! In that case, a big "Well done" to whomever noticed that all the messages stuck in the database were all numeric before the decimal point, as that's what finally alerted me to the possibility of this being a Perl bug. > I am now trying the > alternative. I will report back this evening (my time - tomorrow UTC). > Thanks. If the alternative works, it will be faster. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From Carl.Andrews at crackerbarrel.com Wed Apr 22 23:43:45 2009 From: Carl.Andrews at crackerbarrel.com (Andrews Carl 448) Date: Wed Apr 22 23:44:01 2009 Subject: Please help - Not catching these spam - LOTS of them Message-ID: <73BF1D6676C4E04E9675A08BA0C9825A01804C97@exchsrvr01.CBOCS.com> Skipped content of type multipart/alternative-------------- next part -------------- A non-text attachment was scrubbed... Name: n3MLbjv9022858 Type: application/octet-stream Size: 19669 bytes Desc: n3MLbjv9022858 Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090422/8f9a931d/n3MLbjv9022858.obj From mark at msapiro.net Thu Apr 23 02:28:11 2009 From: mark at msapiro.net (Mark Sapiro) Date: Thu Apr 23 02:28:31 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: Message-ID: Julian Field wrote: > >On 22/4/09 15:55, Mark Sapiro wrote: >> Julian Field wrote: >> >>> On 22/4/09 00:43, Mark Sapiro wrote: >>> >>>> Julian Fieldwrote: >>>> >>>> >>>>> On 21/4/09 21:11, Mark Sapiro wrote: >>>>> >>>>> >>>>>> On Tue, Apr 21, 2009 at 06:58:30PM +0100, Julian Field wrote: >>>>>> >>>>>> >>>>>> >>>>>>> Please also try MailScanner 4.76.15 and let me know how you get on. I >>>>>>> have neatened up the code quite a bit. >>>>>>> >>>>>>> Jules. >>>>>>> >>>>>>> On 21/4/09 18:04, Julian Field wrote: >>>>>>> >>>>>>> >>>>>>> >>>>>>>> In /usr/lib/MailScanner/MailScanner/Message.pm, around line 1243, you >>>>>>>> will find a line that says >>>>>>>> next if $message->{abandoned}; >>>>>>>> Please try commenting out that line by putting a '#' at the start of it. >>>>>>>> >>>>>>>> Then restart MailScanner, and let me know if that solves the problem. >>>>>>>> >>>>>>>> Thanks for your patience in helping me resolve this issue! >>>>>>>> >>>>>>>> >>>>>>>> >>>>>> I installed 4.76.15. Am I also supposed to comment the above line in >>>>>> 4.76.15 or was that just for 4.76.14? I did not comment the line, and >>>>>> I am still seeing messages left in the database. >>>>>> >>>>>> >>>>>> >>>>> It was just for .14. I am really running out of ideas here. There is no >>>>> way the thing would fail unless the DELETE was failing. >>>>> If it doesn't manage to find the complete message, it doesn't add it to >>>>> the database. I made extra doubly sure of that in .15, so I really can't >>>>> see how it is getting left in there. If it was doubly added to the >>>>> database, it would still get deleted, unless the delete itself was >>>>> failing. I wonder if the DBI parameter substitution is handling the >>>>> parameter string incorrectly if it's all decimal digits, thinking it's a >>>>> number and not a string? >>>>> >>>>> Here's a patch for 4.76.15 for you to try that will test this hypothesis. >>>>> >>>>> ---PATCH START--- >>>>> --- MessageBatch.pm.old 2009-04-21 21:33:37.000000000 +0100 >>>>> +++ MessageBatch.pm 2009-04-21 21:35:03.000000000 +0100 >>>>> @@ -1259,7 +1259,8 @@ >>>>> >>>>> foreach $id (keys %gotridof) { >>>>> next unless $id; >>>>> - $sth->execute($id); >>>>> + #$sth->execute($id); >>>>> + $MailScanner::ProcDBH->do("DELETE FROM processing WHERE (id='$id')"); >>>>> } >>>>> $sth->finish; >>>>> >>>>> ---PATCH END--- >>>>> >>>>> As you can see, it's a simple one-liner. Please let me know if it makes >>>>> any difference. >>>>> >>>>> >>>> I have installed the patch and it is encouraging so far. While it is >>>> too soon to say for sure that there won't be any residual entries in >>>> the database, I've been running for over 2 hours and processed at >>>> least one large batch of outgoing messages, and don't have any yet. >>>> >>>> >>>> >>> If it proves that solves the problem, I have another alternative I would >>> like you to try as it will be faster, if it works around the Perl bug. >>> Instead of >>> $MailScanner::ProcDBH->do("DELETE FROM processing WHERE (id='$id')"); >>> make the line say >>> $sth->execute("$id"); >>> and give that a go. Notice it is *almost* the same as the line was >>> before, but with quotes around the $id. That may be enough to circumvent >>> this bug. >>> >> >> I am certain the first patch fixed the problem. >Wonderful! >In that case, a big "Well done" to whomever noticed that all the >messages stuck in the database were all numeric before the decimal >point, as that's what finally alerted me to the possibility of this >being a Perl bug. > >> I am now trying the >> alternative. I will report back this evening (my time - tomorrow UTC). >> >Thanks. If the alternative works, it will be faster. Unfortunately, the $sth->execute("$id"); patch does not solve the problem, so I have reverted to the $MailScanner::ProcDBH->do("DELETE FROM processing WHERE id='$id')"); patch which does. -- Mark Sapiro The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From mark at msapiro.net Thu Apr 23 02:57:32 2009 From: mark at msapiro.net (Mark Sapiro) Date: Thu Apr 23 02:57:50 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: Message-ID: Mark Sapiro wrote: >Julian Field wrote: >> >>On 22/4/09 15:55, Mark Sapiro wrote: >>> Julian Field wrote: >>> >>>> On 22/4/09 00:43, Mark Sapiro wrote: >>>> >>>>> Julian Fieldwrote: >>>>> >>>>> >>>>>> On 21/4/09 21:11, Mark Sapiro wrote: >>>>>> >>>>>> >>>>>>> On Tue, Apr 21, 2009 at 06:58:30PM +0100, Julian Field wrote: >>>>>>> >>>>>>> >>>>>>> >>>>>>>> Please also try MailScanner 4.76.15 and let me know how you get on. I >>>>>>>> have neatened up the code quite a bit. >>>>>>>> >>>>>>>> Jules. >>>>>>>> >>>>>>>> On 21/4/09 18:04, Julian Field wrote: >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>> In /usr/lib/MailScanner/MailScanner/Message.pm, around line 1243, you >>>>>>>>> will find a line that says >>>>>>>>> next if $message->{abandoned}; >>>>>>>>> Please try commenting out that line by putting a '#' at the start of it. >>>>>>>>> >>>>>>>>> Then restart MailScanner, and let me know if that solves the problem. >>>>>>>>> >>>>>>>>> Thanks for your patience in helping me resolve this issue! >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>> I installed 4.76.15. Am I also supposed to comment the above line in >>>>>>> 4.76.15 or was that just for 4.76.14? I did not comment the line, and >>>>>>> I am still seeing messages left in the database. >>>>>>> >>>>>>> >>>>>>> >>>>>> It was just for .14. I am really running out of ideas here. There is no >>>>>> way the thing would fail unless the DELETE was failing. >>>>>> If it doesn't manage to find the complete message, it doesn't add it to >>>>>> the database. I made extra doubly sure of that in .15, so I really can't >>>>>> see how it is getting left in there. If it was doubly added to the >>>>>> database, it would still get deleted, unless the delete itself was >>>>>> failing. I wonder if the DBI parameter substitution is handling the >>>>>> parameter string incorrectly if it's all decimal digits, thinking it's a >>>>>> number and not a string? >>>>>> >>>>>> Here's a patch for 4.76.15 for you to try that will test this hypothesis. >>>>>> >>>>>> ---PATCH START--- >>>>>> --- MessageBatch.pm.old 2009-04-21 21:33:37.000000000 +0100 >>>>>> +++ MessageBatch.pm 2009-04-21 21:35:03.000000000 +0100 >>>>>> @@ -1259,7 +1259,8 @@ >>>>>> >>>>>> foreach $id (keys %gotridof) { >>>>>> next unless $id; >>>>>> - $sth->execute($id); >>>>>> + #$sth->execute($id); >>>>>> + $MailScanner::ProcDBH->do("DELETE FROM processing WHERE (id='$id')"); >>>>>> } >>>>>> $sth->finish; >>>>>> >>>>>> ---PATCH END--- >>>>>> >>>>>> As you can see, it's a simple one-liner. Please let me know if it makes >>>>>> any difference. >>>>>> >>>>>> >>>>> I have installed the patch and it is encouraging so far. While it is >>>>> too soon to say for sure that there won't be any residual entries in >>>>> the database, I've been running for over 2 hours and processed at >>>>> least one large batch of outgoing messages, and don't have any yet. >>>>> >>>>> >>>>> >>>> If it proves that solves the problem, I have another alternative I would >>>> like you to try as it will be faster, if it works around the Perl bug. >>>> Instead of >>>> $MailScanner::ProcDBH->do("DELETE FROM processing WHERE (id='$id')"); >>>> make the line say >>>> $sth->execute("$id"); >>>> and give that a go. Notice it is *almost* the same as the line was >>>> before, but with quotes around the $id. That may be enough to circumvent >>>> this bug. >>>> >>> >>> I am certain the first patch fixed the problem. >>Wonderful! >>In that case, a big "Well done" to whomever noticed that all the >>messages stuck in the database were all numeric before the decimal >>point, as that's what finally alerted me to the possibility of this >>being a Perl bug. It was Kai Schaetzl who first remarked on this. Thanks Kai. I have looked a bit more clusely at the messages that were left in the database. and it is not only that the id is all-decimal; the entropy fragment must also be all-decimal or contain only a single 'E', so in every case, they are being interpred as a floating point number rather than a string. E.g., the latest list from running for a while with the $sth->execute("$id"); patch is 74221690410.052E4 36888690435.06105 73061690441.05915 15461690460.09210 all of which are valid floating point number representations. If you look at the lists in the messages I previously posted such as at , you will see that those too are all decimal to the left of the period and all decimal or contain at most one 'E' to the right of the period so they are all valid floating point number representations, and were apparently treated as floating point numbers when passed to the statement handler method with perl-DBD-SQLite-1.21, but apparently not with the prior perl-DBD-SQLite-1.13. -- Mark Sapiro The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From ms-list at alexb.ch Thu Apr 23 06:27:14 2009 From: ms-list at alexb.ch (Alex Broens) Date: Thu Apr 23 06:27:23 2009 Subject: Please help - Not catching these spam - LOTS of them In-Reply-To: <73BF1D6676C4E04E9675A08BA0C9825A01804C97@exchsrvr01.CBOCS.com> References: <73BF1D6676C4E04E9675A08BA0C9825A01804C97@exchsrvr01.CBOCS.com> Message-ID: <49EFFC32.40406@alexb.ch> On 4/23/2009 12:43 AM, Andrews Carl 448 wrote: > All of them have an attachment named DSL####.png where the #### is a > four digit number. I have tried to write a spamassassin rule but I do > not know what I am doing because when I run the attached file through > 'spamassassin -t' I get a report of 1.0 requires 5.0 and it states the > message is spam. which is confusting since I am getting an overall score > of 1.0 and need a 5.0 to be spam. > Don't post spam samples to the list Use pastebin or a web server. I'm not going to open your attachment but I assume its one of the guys you can catch with mimeheader BLAH Content-Type =~ /name\=\"DSL[0-9]{4}\.png\"/ From MailScanner at ecs.soton.ac.uk Thu Apr 23 09:31:45 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Apr 23 09:32:05 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49F02771.2040800@ecs.soton.ac.uk> Message-ID: On 23/04/2009 02:57, Mark Sapiro wrote: > Mark Sapiro wrote: > > >> Julian Field wrote: >> >>> On 22/4/09 15:55, Mark Sapiro wrote: >>> >>>> Julian Field wrote: >>>> >>>> >>>>> On 22/4/09 00:43, Mark Sapiro wrote: >>>>> >>>>> >>>>>> Julian Fieldwrote: >>>>>> >>>>>> >>>>>> >>>>>>> On 21/4/09 21:11, Mark Sapiro wrote: >>>>>>> >>>>>>> >>>>>>> >>>>>>>> On Tue, Apr 21, 2009 at 06:58:30PM +0100, Julian Field wrote: >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>> Please also try MailScanner 4.76.15 and let me know how you get on. I >>>>>>>>> have neatened up the code quite a bit. >>>>>>>>> >>>>>>>>> Jules. >>>>>>>>> >>>>>>>>> On 21/4/09 18:04, Julian Field wrote: >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>>> In /usr/lib/MailScanner/MailScanner/Message.pm, around line 1243, you >>>>>>>>>> will find a line that says >>>>>>>>>> next if $message->{abandoned}; >>>>>>>>>> Please try commenting out that line by putting a '#' at the start of it. >>>>>>>>>> >>>>>>>>>> Then restart MailScanner, and let me know if that solves the problem. >>>>>>>>>> >>>>>>>>>> Thanks for your patience in helping me resolve this issue! >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>> I installed 4.76.15. Am I also supposed to comment the above line in >>>>>>>> 4.76.15 or was that just for 4.76.14? I did not comment the line, and >>>>>>>> I am still seeing messages left in the database. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>> It was just for .14. I am really running out of ideas here. There is no >>>>>>> way the thing would fail unless the DELETE was failing. >>>>>>> If it doesn't manage to find the complete message, it doesn't add it to >>>>>>> the database. I made extra doubly sure of that in .15, so I really can't >>>>>>> see how it is getting left in there. If it was doubly added to the >>>>>>> database, it would still get deleted, unless the delete itself was >>>>>>> failing. I wonder if the DBI parameter substitution is handling the >>>>>>> parameter string incorrectly if it's all decimal digits, thinking it's a >>>>>>> number and not a string? >>>>>>> >>>>>>> Here's a patch for 4.76.15 for you to try that will test this hypothesis. >>>>>>> >>>>>>> ---PATCH START--- >>>>>>> --- MessageBatch.pm.old 2009-04-21 21:33:37.000000000 +0100 >>>>>>> +++ MessageBatch.pm 2009-04-21 21:35:03.000000000 +0100 >>>>>>> @@ -1259,7 +1259,8 @@ >>>>>>> >>>>>>> foreach $id (keys %gotridof) { >>>>>>> next unless $id; >>>>>>> - $sth->execute($id); >>>>>>> + #$sth->execute($id); >>>>>>> + $MailScanner::ProcDBH->do("DELETE FROM processing WHERE (id='$id')"); >>>>>>> } >>>>>>> $sth->finish; >>>>>>> >>>>>>> ---PATCH END--- >>>>>>> >>>>>>> As you can see, it's a simple one-liner. Please let me know if it makes >>>>>>> any difference. >>>>>>> >>>>>>> >>>>>>> >>>>>> I have installed the patch and it is encouraging so far. While it is >>>>>> too soon to say for sure that there won't be any residual entries in >>>>>> the database, I've been running for over 2 hours and processed at >>>>>> least one large batch of outgoing messages, and don't have any yet. >>>>>> >>>>>> >>>>>> >>>>>> >>>>> If it proves that solves the problem, I have another alternative I would >>>>> like you to try as it will be faster, if it works around the Perl bug. >>>>> Instead of >>>>> $MailScanner::ProcDBH->do("DELETE FROM processing WHERE (id='$id')"); >>>>> make the line say >>>>> $sth->execute("$id"); >>>>> and give that a go. Notice it is *almost* the same as the line was >>>>> before, but with quotes around the $id. That may be enough to circumvent >>>>> this bug. >>>>> >>>>> >>>> I am certain the first patch fixed the problem. >>>> >>> Wonderful! >>> In that case, a big "Well done" to whomever noticed that all the >>> messages stuck in the database were all numeric before the decimal >>> point, as that's what finally alerted me to the possibility of this >>> being a Perl bug. >>> > > It was Kai Schaetzl who first remarked on this. Thanks Kai. > > I have looked a bit more clusely at the messages that were left in the > database. and it is not only that the id is all-decimal; the entropy > fragment must also be all-decimal or contain only a single 'E', so in > every case, they are being interpred as a floating point number rather > than a string. > Which is a Perl bug. Perl should carry them around as both a number and a string, and the final destination type is a string (that's the type of the field in the SQL query), so someone is squashing it to just a number before checking the destination type. That's either a bug in Perl or in the implementation of DBD::SQLite. > E.g., the latest list from running for a while with the > > $sth->execute("$id"); > > patch is > > 74221690410.052E4 > 36888690435.06105 > 73061690441.05915 > 15461690460.09210 > > all of which are valid floating point number representations. If you > look at the lists in the messages I previously posted such as at > , > you will see that those too are all decimal to the left of the period > and all decimal or contain at most one 'E' to the right of the period > so they are all valid floating point number representations, and were > apparently treated as floating point numbers when passed to the > statement handler method with perl-DBD-SQLite-1.21, but apparently not > with the prior perl-DBD-SQLite-1.13. > Well diagnosed, sir :-) So an alternative solution would be to put a "P" (for Postfix, but is arbitrary) on the front of the message id. Would you like me to do that, or just live with the slight inefficiency in the database deletion? Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Thu Apr 23 09:59:55 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Apr 23 10:00:14 2009 Subject: New beta 4.76.16 References: <49F02E0B.8090502@ecs.soton.ac.uk> Message-ID: There have been a few changes recently, including the Postfix processing-messages database fix and changes to the installer. So I have just released a new beta for you to try, which should solve all the outstanding issues. It's 4.76.16 and you can download it from www.mailscanner.info as usual. Please give it a try! Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From J.Ede at birchenallhowden.co.uk Thu Apr 23 11:46:57 2009 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Thu Apr 23 11:47:16 2009 Subject: Signatures... Message-ID: <1213490F1F316842A544A850422BFA96239CFDB6@BHLSBS.bhl.local> I suspect this will not be an easy if at all viable idea, but here goes... We currently use the sign clean messages option on our outbound emails to attach our corporate signature and image and this is appended to the bottom of all outbound emails. This works for the first message we send out, but if we reply to an inbound message then our personal signature (i.e. name and position) from within outlook is put at the bottom of our part of the email, and then the inline sig is added at the end of the email after the original email. Is it possible to insert the inline sig into the email at a preset point by putting some form of tag into our signatures i.e. after my name on a blank line I put <> and the inline sig is inserted at that point within the email and if its not present then just append at end as normal? I know this will not work at all for signed messages, so if it can be done must be an option and I'm guessing it could add extra processing load to MailScanner? Jason -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090423/2762d58f/attachment.html From MailScanner at ecs.soton.ac.uk Thu Apr 23 12:25:11 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Apr 23 12:25:33 2009 Subject: Signatures... In-Reply-To: <1213490F1F316842A544A850422BFA96239CFDB6@BHLSBS.bhl.local> References: <1213490F1F316842A544A850422BFA96239CFDB6@BHLSBS.bhl.local> <49F05017.9010707@ecs.soton.ac.uk> Message-ID: See 4.76.17. You put in the magic token _SIGNATURE_ and it will replace it with the inline HTML or text signature, as appropriate. All done, Jules. On 23/04/2009 11:46, Jason Ede wrote: > > I suspect this will not be an easy if at all viable idea, but here goes... > > We currently use the sign clean messages option on our outbound emails > to attach our corporate signature and image and this is appended to > the bottom of all outbound emails. > > This works for the first message we send out, but if we reply to an > inbound message then our personal signature (i.e. name and position) > from within outlook is put at the bottom of our part of the email, and > then the inline sig is added at the end of the email after the > original email. Is it possible to insert the inline sig into the email > at a preset point by putting some form of tag into our signatures i.e. > after my name on a blank line I put <> and the inline sig > is inserted at that point within the email and if its not present then > just append at end as normal? > > I know this will not work at all for signed messages, so if it can be > done must be an option and I?m guessing it could add extra processing > load to MailScanner? > > Jason > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From gmachin at techconcepts.co.za Thu Apr 23 13:12:00 2009 From: gmachin at techconcepts.co.za (Gregory Machin) Date: Thu Apr 23 13:14:34 2009 Subject: where is razor reading it's config from ? Message-ID: Skipped content of type multipart/alternative-------------- next part -------------- A non-text attachment was scrubbed... Name: image001.jpg Type: image/jpeg Size: 8862 bytes Desc: image001.jpg Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090423/bce9589a/image001.jpg -------------- next part -------------- A non-text attachment was scrubbed... Name: image002.gif Type: image/gif Size: 5018 bytes Desc: image002.gif Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090423/bce9589a/image002.gif -------------- next part -------------- A non-text attachment was scrubbed... Name: image003.gif Type: image/gif Size: 6927 bytes Desc: image003.gif Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090423/bce9589a/image003.gif From J.Ede at birchenallhowden.co.uk Thu Apr 23 14:51:29 2009 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Thu Apr 23 14:51:46 2009 Subject: Signatures... In-Reply-To: References: <1213490F1F316842A544A850422BFA96239CFDB6@BHLSBS.bhl.local> <49F05017.9010707@ecs.soton.ac.uk> Message-ID: <1213490F1F316842A544A850422BFA96239CFDC9@BHLSBS.bhl.local> I'll test that ASAP. Thanks a lot! Thought it would be complicated to do. Jason > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- > bounces@lists.mailscanner.info] On Behalf Of Julian Field > Sent: 23 April 2009 12:25 > To: MailScanner discussion > Subject: Re: Signatures... > > See 4.76.17. You put in the magic token _SIGNATURE_ and it will replace > it with the inline HTML or text signature, as appropriate. > > All done, > Jules. > > On 23/04/2009 11:46, Jason Ede wrote: > > > > I suspect this will not be an easy if at all viable idea, but here > goes... > > > > We currently use the sign clean messages option on our outbound > emails > > to attach our corporate signature and image and this is appended to > > the bottom of all outbound emails. > > > > This works for the first message we send out, but if we reply to an > > inbound message then our personal signature (i.e. name and position) > > from within outlook is put at the bottom of our part of the email, > and > > then the inline sig is added at the end of the email after the > > original email. Is it possible to insert the inline sig into the > email > > at a preset point by putting some form of tag into our signatures > i.e. > > after my name on a blank line I put <> and the inline sig > > is inserted at that point within the email and if its not present > then > > just append at end as normal? > > > > I know this will not work at all for signed messages, so if it can be > > done must be an option and I'm guessing it could add extra processing > > load to MailScanner? > > > > Jason > > > > Jules > > -- > Julian Field MEng CITP CEng > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > Need help customising MailScanner? > Contact me! > Need help fixing or optimising your systems? > Contact me! > Need help getting you started solving new requirements from your boss? > Contact me! > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > Follow me at twitter.com/JulesFM > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From mark at msapiro.net Thu Apr 23 15:12:42 2009 From: mark at msapiro.net (Mark Sapiro) Date: Thu Apr 23 15:12:54 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49F02771.2040800@ecs.soton.ac.uk> Message-ID: <20090423141242.GA3696@msapiro> On Thu, Apr 23, 2009 at 09:31:45AM +0100, Julian Field wrote: > > > On 23/04/2009 02:57, Mark Sapiro wrote: > > > >I have looked a bit more clusely at the messages that were left in the > >database. and it is not only that the id is all-decimal; the entropy > >fragment must also be all-decimal or contain only a single 'E', so in > >every case, they are being interpred as a floating point number rather > >than a string. > > > Which is a Perl bug. Perl should carry them around as both a number and > a string, and the final destination type is a string (that's the type of > the field in the SQL query), so someone is squashing it to just a number > before checking the destination type. That's either a bug in Perl or in > the implementation of DBD::SQLite. > >E.g., the latest list from running for a while with the > > > > $sth->execute("$id"); > > > >patch is > > > >74221690410.052E4 > >36888690435.06105 > >73061690441.05915 > >15461690460.09210 > > > >all of which are valid floating point number representations. If you > >look at the lists in the messages I previously posted such as at > >, > >you will see that those too are all decimal to the left of the period > >and all decimal or contain at most one 'E' to the right of the period > >so they are all valid floating point number representations, and were > >apparently treated as floating point numbers when passed to the > >statement handler method with perl-DBD-SQLite-1.21, but apparently not > >with the prior perl-DBD-SQLite-1.13. > > > Well diagnosed, sir :-) > So an alternative solution would be to put a "P" (for Postfix, but is > arbitrary) on the front of the message id. > Would you like me to do that, or just live with the slight inefficiency > in the database deletion? I had an idea, and I am trying $sth->execute("\'$id\'"); I will also take a look at 4.76.16. I'll let you know what I find. -- Mark Sapiro mark at msapiro net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From ipcopper.ph at gmail.com Thu Apr 23 15:17:37 2009 From: ipcopper.ph at gmail.com (jan gestre) Date: Thu Apr 23 15:17:46 2009 Subject: Mails released from spam quarantine ends up back in quarantine Message-ID: Hi Guys, I'm trying to release some emails that MailScanner mistakenly tagged as SPAM but after releasing it ends up back in the quarantine. I have "Quarantine Whole Messages As Queue Files = no" and Spam Action set to "store forward email@address" in MailScanner.conf, BTW I can't change the Spam Action as deliver because of the enormous amount of spam in user's inboxes and I'm getting a mouthful if I revert to that, any ideas? TIA Jan From ecasarero at gmail.com Thu Apr 23 15:19:46 2009 From: ecasarero at gmail.com (Eduardo Casarero) Date: Thu Apr 23 15:20:21 2009 Subject: Mails released from spam quarantine ends up back in quarantine In-Reply-To: References: Message-ID: <7d9b3cf20904230719k6bbc76favc88dc2b75bb01f9b@mail.gmail.com> 2009/4/23 jan gestre : > Hi Guys, > > I'm trying to release some emails that MailScanner mistakenly tagged > as SPAM but after releasing it ends up back in the quarantine. I have > "Quarantine Whole Messages As Queue Files = no" and Spam Action set to > "store forward email@address" in MailScanner.conf, BTW I can't change > the Spam Action as deliver because of the enormous amount of spam in > user's inboxes and I'm getting a mouthful if I revert to that, any > ideas? > Do you have "localhost (127.0.0.1)" in whitelist? so all releases are never spam? > TIA > > Jan > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > From ipcopper.ph at gmail.com Thu Apr 23 15:58:48 2009 From: ipcopper.ph at gmail.com (jan gestre) Date: Thu Apr 23 15:58:59 2009 Subject: Mails released from spam quarantine ends up back in quarantine In-Reply-To: <7d9b3cf20904230719k6bbc76favc88dc2b75bb01f9b@mail.gmail.com> References: <7d9b3cf20904230719k6bbc76favc88dc2b75bb01f9b@mail.gmail.com> Message-ID: On Thu, Apr 23, 2009 at 10:19 PM, Eduardo Casarero wrote: > 2009/4/23 jan gestre : >> Hi Guys, >> >> I'm trying to release some emails that MailScanner mistakenly tagged >> as SPAM but after releasing it ends up back in the quarantine. I have >> "Quarantine Whole Messages As Queue Files = no" and Spam Action set to >> "store forward email@address" in MailScanner.conf, BTW I can't change >> the Spam Action as deliver because of the enormous amount of spam in >> user's inboxes and I'm getting a mouthful if I revert to that, any >> ideas? >> > > Do you have "localhost (127.0.0.1)" in whitelist? so all releases are > never spam? > No, I don't have localhost in whitelist, should I add this? I've read in the documentation that adding your own domain is a no-no, I have no idea if they are the same. From ecasarero at gmail.com Thu Apr 23 16:03:36 2009 From: ecasarero at gmail.com (Eduardo Casarero) Date: Thu Apr 23 16:04:05 2009 Subject: Mails released from spam quarantine ends up back in quarantine In-Reply-To: References: <7d9b3cf20904230719k6bbc76favc88dc2b75bb01f9b@mail.gmail.com> Message-ID: <7d9b3cf20904230803u415d2811i87e37297a39cd236@mail.gmail.com> 2009/4/23 jan gestre : > On Thu, Apr 23, 2009 at 10:19 PM, Eduardo Casarero wrote: >> 2009/4/23 jan gestre : >>> Hi Guys, >>> >>> I'm trying to release some emails that MailScanner mistakenly tagged >>> as SPAM but after releasing it ends up back in the quarantine. I have >>> "Quarantine Whole Messages As Queue Files = no" and Spam Action set to >>> "store forward email@address" in MailScanner.conf, BTW I can't change >>> the Spam Action as deliver because of the enormous amount of spam in >>> user's inboxes and I'm getting a mouthful if I revert to that, any >>> ideas? >>> >> >> Do you have "localhost (127.0.0.1)" in whitelist? so all releases are >> never spam? >> > > No, I don't have localhost in whitelist, should I add this? I've read > in the documentation that adding your own domain is a no-no, I have no > idea if they are the same. what i say is that all traffic orginated in localhost (the mailscanner server) should be whitelisted (not the domain, just 127.0.0.1, because you never send spam from localhost (i assume). > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > From Carl.Andrews at crackerbarrel.com Thu Apr 23 16:21:53 2009 From: Carl.Andrews at crackerbarrel.com (Andrews Carl 448) Date: Thu Apr 23 16:22:09 2009 Subject: Please help - Not catching these spam - LOTS of them In-Reply-To: <49EFFC32.40406@alexb.ch> Message-ID: <73BF1D6676C4E04E9675A08BA0C9825A01804C9F@exchsrvr01.CBOCS.com> Yep, that's it. Thanks! -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Alex Broens Sent: Thursday, April 23, 2009 12:27 AM To: MailScanner discussion Subject: Re: Please help - Not catching these spam - LOTS of them On 4/23/2009 12:43 AM, Andrews Carl 448 wrote: > All of them have an attachment named DSL####.png where the #### is a > four digit number. I have tried to write a spamassassin rule but I do > not know what I am doing because when I run the attached file through > 'spamassassin -t' I get a report of 1.0 requires 5.0 and it states > the message is spam. which is confusting since I am getting an overall > score of 1.0 and need a 5.0 to be spam. > Don't post spam samples to the list Use pastebin or a web server. I'm not going to open your attachment but I assume its one of the guys you can catch with mimeheader BLAH Content-Type =~ /name\=\"DSL[0-9]{4}\.png\"/ -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From mailbag at partnersolutions.ca Thu Apr 23 16:57:16 2009 From: mailbag at partnersolutions.ca (PSI Mailbag) Date: Thu Apr 23 16:57:28 2009 Subject: where is razor reading it's config from ? In-Reply-To: References: Message-ID: <120EBC42C8319846842A4A49B3D5566BBDDB1A@psims003.pshosting.intranet> > I have installed MailScanner and razor . MailScanner is working fine. > Razor on the other hand is putting it's log in postfix's hold > directory. I have defined the path to the configuration for razor in > /etc/MailScanner/spam.assassin.prefs.conf "razor_config > /etc/MailScanner/razor/razor-agent.conf" . In the razor-agent.conf I > have specified log "logfile = /var/log/razor-agent.log". So my > question is why is it putting the log file in postfix's hold directory. > And do I get it to read the configuration I have specified Since you're using a folder other than one of Razor's defaults (/etc/razor or ~/.razor), try adding a setting for "razorhome" in your razor-agent.conf. I leave my razor configs in /etc/razor by default (owned by postfix) and it works properly for me with a logfile in /var/log. Cheers, -Joshua From Carl.Andrews at crackerbarrel.com Thu Apr 23 17:23:37 2009 From: Carl.Andrews at crackerbarrel.com (Andrews Carl 448) Date: Thu Apr 23 17:23:49 2009 Subject: Please help - Not catching these spam - LOTS of them In-Reply-To: <49EFFC32.40406@alexb.ch> Message-ID: <73BF1D6676C4E04E9675A08BA0C9825A01804CA9@exchsrvr01.CBOCS.com> That works fantastic! Thanks, Carl -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Alex Broens Sent: Thursday, April 23, 2009 12:27 AM To: MailScanner discussion Subject: Re: Please help - Not catching these spam - LOTS of them On 4/23/2009 12:43 AM, Andrews Carl 448 wrote: > All of them have an attachment named DSL####.png where the #### is a > four digit number. I have tried to write a spamassassin rule but I do > not know what I am doing because when I run the attached file through > 'spamassassin -t' I get a report of 1.0 requires 5.0 and it states > the message is spam. which is confusting since I am getting an overall > score of 1.0 and need a 5.0 to be spam. > Don't post spam samples to the list Use pastebin or a web server. I'm not going to open your attachment but I assume its one of the guys you can catch with mimeheader BLAH Content-Type =~ /name\=\"DSL[0-9]{4}\.png\"/ -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Apr 23 18:02:37 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Apr 23 18:02:52 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: <20090423141242.GA3696@msapiro> References: <49F02771.2040800@ecs.soton.ac.uk> <20090423141242.GA3696@msapiro> <49F09F2D.6010402@ecs.soton.ac.uk> Message-ID: On 23/04/2009 15:12, Mark Sapiro wrote: > On Thu, Apr 23, 2009 at 09:31:45AM +0100, Julian Field wrote: > >> >> On 23/04/2009 02:57, Mark Sapiro wrote: >> >>> I have looked a bit more clusely at the messages that were left in the >>> database. and it is not only that the id is all-decimal; the entropy >>> fragment must also be all-decimal or contain only a single 'E', so in >>> every case, they are being interpred as a floating point number rather >>> than a string. >>> >>> >> Which is a Perl bug. Perl should carry them around as both a number and >> a string, and the final destination type is a string (that's the type of >> the field in the SQL query), so someone is squashing it to just a number >> before checking the destination type. That's either a bug in Perl or in >> the implementation of DBD::SQLite. >> >>> E.g., the latest list from running for a while with the >>> >>> $sth->execute("$id"); >>> >>> patch is >>> >>> 74221690410.052E4 >>> 36888690435.06105 >>> 73061690441.05915 >>> 15461690460.09210 >>> >>> all of which are valid floating point number representations. If you >>> look at the lists in the messages I previously posted such as at >>> , >>> you will see that those too are all decimal to the left of the period >>> and all decimal or contain at most one 'E' to the right of the period >>> so they are all valid floating point number representations, and were >>> apparently treated as floating point numbers when passed to the >>> statement handler method with perl-DBD-SQLite-1.21, but apparently not >>> with the prior perl-DBD-SQLite-1.13. >>> >>> >> Well diagnosed, sir :-) >> So an alternative solution would be to put a "P" (for Postfix, but is >> arbitrary) on the front of the message id. >> Would you like me to do that, or just live with the slight inefficiency >> in the database deletion? >> > > I had an idea, and I am trying > > $sth->execute("\'$id\'"); > That shouldn't work, as you are trying to delete the message id, not the message id with quotes around it. > I will also take a look at 4.76.16. I'll let you know what I find. > > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From mark at msapiro.net Thu Apr 23 19:29:15 2009 From: mark at msapiro.net (Mark Sapiro) Date: Thu Apr 23 19:29:38 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: Message-ID: Julian Field wrote: > >On 23/04/2009 15:12, Mark Sapiro wrote: >> On Thu, Apr 23, 2009 at 09:31:45AM +0100, Julian Field wrote: >> >>> >>> On 23/04/2009 02:57, Mark Sapiro wrote: >>> >>>> I have looked a bit more clusely at the messages that were left in the >>>> database. and it is not only that the id is all-decimal; the entropy >>>> fragment must also be all-decimal or contain only a single 'E', so in >>>> every case, they are being interpred as a floating point number rather >>>> than a string. >>>> >>>> >>> Which is a Perl bug. Perl should carry them around as both a number and >>> a string, and the final destination type is a string (that's the type of >>> the field in the SQL query), so someone is squashing it to just a number >>> before checking the destination type. That's either a bug in Perl or in >>> the implementation of DBD::SQLite. >>> >>>> E.g., the latest list from running for a while with the >>>> >>>> $sth->execute("$id"); >>>> >>>> patch is >>>> >>>> 74221690410.052E4 >>>> 36888690435.06105 >>>> 73061690441.05915 >>>> 15461690460.09210 >>>> >>>> all of which are valid floating point number representations. If you >>>> look at the lists in the messages I previously posted such as at >>>> , >>>> you will see that those too are all decimal to the left of the period >>>> and all decimal or contain at most one 'E' to the right of the period >>>> so they are all valid floating point number representations, and were >>>> apparently treated as floating point numbers when passed to the >>>> statement handler method with perl-DBD-SQLite-1.21, but apparently not >>>> with the prior perl-DBD-SQLite-1.13. >>>> >>>> >>> Well diagnosed, sir :-) >>> So an alternative solution would be to put a "P" (for Postfix, but is >>> arbitrary) on the front of the message id. >>> Would you like me to do that, or just live with the slight inefficiency >>> in the database deletion? >>> >> >> I had an idea, and I am trying >> >> $sth->execute("\'$id\'"); >> >That shouldn't work, as you are trying to delete the message id, not the >message id with quotes around it. You are correct. That doesn't work at all. I then tried installing MailScanner 4.76.17-1, but that seems to have some other problem in that it is not picking up new messages from Postfix at all. Postfix receives messages and puts them in the Hold queue, and they just stay there. MailScanner doesn't pick them up and doesn't log anything. So I have reverted to 4.76.15-1 with the additional replacement of $sth->execute($id); with $MailScanner::ProcDBH->do("DELETE FROM processing WHERE (id='$id')"); -- Mark Sapiro The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From rcooper at dwford.com Thu Apr 23 20:57:41 2009 From: rcooper at dwford.com (Rick Cooper) Date: Thu Apr 23 20:57:53 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: Message-ID: > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf > Of Mark Sapiro > Sent: Thursday, April 23, 2009 2:29 PM > To: MailScanner List > Subject: Re: Found nn messages in the processing-messages database > > Julian Field wrote: > > > >On 23/04/2009 15:12, Mark Sapiro wrote: > >> On Thu, Apr 23, 2009 at 09:31:45AM +0100, Julian Field wrote: > >> > >>> > >>> On 23/04/2009 02:57, Mark Sapiro wrote: > >>> > >>>> I have looked a bit more clusely at the messages that > were left in the > >>>> database. and it is not only that the id is all-decimal; > the entropy > >>>> fragment must also be all-decimal or contain only a > single 'E', so in > >>>> every case, they are being interpred as a floating point > number rather > >>>> than a string. > >>>> > >>>> > >>> Which is a Perl bug. Perl should carry them around as > both a number and > >>> a string, and the final destination type is a string > (that's the type of > >>> the field in the SQL query), so someone is squashing it > to just a number > >>> before checking the destination type. That's either a bug > in Perl or in > >>> the implementation of DBD::SQLite. > >>> > >>>> E.g., the latest list from running for a while with the > >>>> > >>>> $sth->execute("$id"); > >>>> > >>>> patch is > >>>> > >>>> 74221690410.052E4 > >>>> 36888690435.06105 > >>>> 73061690441.05915 > >>>> 15461690460.09210 > >>>> > >>>> all of which are valid floating point number > representations. If you > >>>> look at the lists in the messages I previously posted such as at > >>>> > l/091022.html>, > >>>> you will see that those too are all decimal to the left > of the period > >>>> and all decimal or contain at most one 'E' to the right > of the period > >>>> so they are all valid floating point number > representations, and were > >>>> apparently treated as floating point numbers when passed to the > >>>> statement handler method with perl-DBD-SQLite-1.21, but > apparently not > >>>> with the prior perl-DBD-SQLite-1.13. > >>>> > >>>> > >>> Well diagnosed, sir :-) > >>> So an alternative solution would be to put a "P" (for > Postfix, but is > >>> arbitrary) on the front of the message id. > >>> Would you like me to do that, or just live with the > slight inefficiency > >>> in the database deletion? > >>> > >> > >> I had an idea, and I am trying > >> > >> $sth->execute("\'$id\'"); > >> > >That shouldn't work, as you are trying to delete the message > id, not the > >message id with quotes around it. > > > You are correct. That doesn't work at all. > > I then tried installing MailScanner 4.76.17-1, but that seems to have > some other problem in that it is not picking up new messages from > Postfix at all. Postfix receives messages and puts them in the Hold > queue, and they just stay there. MailScanner doesn't pick them up and > doesn't log anything. > > So I have reverted to 4.76.15-1 with the additional replacement of > > $sth->execute($id); > > with > > $MailScanner::ProcDBH->do("DELETE FROM processing WHERE > (id='$id')"); > Wouldn't my $sth = $MailScanner::ProcDBH->prepare(q{DELETE FROM processing WHERE (id='?')}); Then $sth->execute($id); Work? Rick -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From mark at msapiro.net Thu Apr 23 22:07:56 2009 From: mark at msapiro.net (Mark Sapiro) Date: Thu Apr 23 22:13:20 2009 Subject: Problem with Postfix and 4.76.1[67] - was Re: Found nn messages in the processing-messages database In-Reply-To: Message-ID: Mark Sapiro wrote: > >I then tried installing MailScanner 4.76.17-1, but that seems to have >some other problem in that it is not picking up new messages from >Postfix at all. Postfix receives messages and puts them in the Hold >queue, and they just stay there. MailScanner doesn't pick them up and >doesn't log anything. I don't know enough about the whole process to come up with a patch, but it looks like there are two issues with Postfix.pm in sub new, $this->{HDFileRegexp} = '^([\\dA-F]+)$'; doesn't allow for the leading 'P'. in sub HDFileName $id =~ s/\.[^.]+$//; needs I think to be something like $id =~ s/P([^.]+)\.[^.]+$/\1/; Either that, or just add the 'P' to the beginning of the entropy fragment (after the '.') instead of to the beginning of the id. I think I'll try this latter change: my $id = 'P' . $idtemp . '.' . PostfixKey($file); becomes instead my $id = $idtemp . '.' . 'P' . PostfixKey($file); -- Mark Sapiro The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From mark at msapiro.net Fri Apr 24 01:21:08 2009 From: mark at msapiro.net (Mark Sapiro) Date: Fri Apr 24 01:21:35 2009 Subject: Question about ordering in rulesets Message-ID: In MailScanner.conf, I have: Scan Messages = %rules-dir%/scan.messages.rules In %rules-dir%/scan.messages.rules I have: 1 # Rules to scan or skip MailScanner altogether. 2 # 3 # Exempt locally generated mail 4 # 5 # localhost 6 From: 127.0.0.1 no 7 # sbh16.songbird.com 8 From: 72.52.113.16 no 9 # ms2.msapiro.net sbh34.songbird.com 10 From: 72.52.113.34 no 11 # grizz.org, etc. sbh35.songbird.com 12 From: 72.52.113.35 no 13 # abriz.org, etc. sbh36.songbird.com 14 From: 72.52.113.36 no 15 # sbh37.songbird.com 16 From: 72.52.113.37 no 17 # sbh38.songbird.com 18 From: 72.52.113.38 no 19 # 20 # Rules to not scan messages to abuse or postmaster 21 # 22 # but first scan all abriz mail 23 # 24 To: /[@.]abriz.(org|net)$/ yes 25 # 26 To: /^(abuse|postmaster)[+@]/ no 26 # 28 # Don't scan messages to membership from paypal.com as we break domain keys 29 # signatures and at least if the recipient is sbcglobal/yahoo/prodigy, they 30 # call it spam 31 # 32 # from *.den.paypal.com 33 To: /^membership@grizz[^.]*\.org$/ and From: 216.113.188.0/24 no 34 # from *.phx.paypal.com 35 To: /^membership@grizz[^.]*\.org$/ and From: 66.211.168.0/24 no 36 # 37 # Finally 38 # 39 FromOrTo: default yes The idea is I want to scan mail by default, but I have several rules to not scan and one specific rule to scan at line 24. It was my assumption that these rules would be checked in order and the first one to hit would be the one that determined yes or no. In particular, the rule at line 26 is intended to not scan mail to abuse or postmaster, but the rule at line 24 is intended to scan all mail to the abriz.org and abriz.net domains including mail to abuse and postmaster as it comes before line 26. I had a situation today that makes me question my ordering assumption. A message arrived from IP 72.52.113.36 [1] which had four recipients, one of whom was in the abriz.net domain. The message was scanned by MailScanner and an attachment removed because of a filename rule [2], in spite of the fact that it matched the From: 72.52.113.36 no rule at line 14, I would have thought, before matching the To: /[@.]abriz.(org|net)$/ yes rule at line 24. So is my assumption about ordering wrong? If so, is there a way to accomplish what I thought I was accomplishing with this ordering? [1] The message arrived via an ssh tunnel from a remote machine to IP 72.52.113.36, but Postfix saw it as coming from IP 72.52.113.36. Apr 23 12:08:48 sbh16 postfix/smtpd[17061]: connect from abriz.net[72.52.113.36] Apr 23 12:08:49 sbh16 postfix/smtpd[17061]: 18C1E6900A5: client=abriz.net[72.52.113.36] Apr 23 12:08:49 sbh16 postfix/cleanup[17770]: 18C1E6900A5: hold: header Received: from chaos.abriz.net (abriz.net [72.52.113.36])??(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))??(No client certificate requested)??by sbh16.songbird.com (Postfix) with ESMTP id 18C from abriz.net[72.52.113.36]; from= to= proto=ESMTP helo= Apr 23 12:08:49 sbh16 postfix/cleanup[17770]: 18C1E6900A5: message-id=<20090423190848.GA17095@abriz.net> Apr 23 12:08:49 sbh16 postfix/smtpd[17061]: disconnect from abriz.net[72.52.113.36] [2] Apr 23 12:08:49 sbh16 MailScanner[16883]: New Batch: Scanning 1 messages, 9291 bytes Apr 23 12:08:51 sbh16 MailScanner[16883]: Filename Checks: Possible malicious batch file script (18C1E6900A5.0258A azs.bat) Apr 23 12:08:51 sbh16 MailScanner[16883]: Other Checks: Found 1 problems Apr 23 12:08:51 sbh16 MailScanner[16883]: Virus and Content Scanning: Starting Apr 23 12:08:51 sbh16 MailScanner[16883]: Saved infected "azs.bat" to /var/spool/MailScanner/quarantine/20090423/18C1E6900A5.0258A Apr 23 12:08:51 sbh16 MailScanner[16883]: Saved infected "sp500-zsj.zip" to /var/spool/MailScanner/quarantine/20090423/18C1E6900A5.0258A Apr 23 12:08:51 sbh16 MailScanner[16883]: Requeue: 18C1E6900A5.0258A to 3D47E690188 Apr 23 12:08:51 sbh16 MailScanner[16883]: Cleaned: Delivered 1 cleaned messages -- Mark Sapiro The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From ipcopper.ph at gmail.com Fri Apr 24 02:18:56 2009 From: ipcopper.ph at gmail.com (jan gestre) Date: Fri Apr 24 02:19:06 2009 Subject: Mails released from spam quarantine ends up back in quarantine In-Reply-To: <7d9b3cf20904230803u415d2811i87e37297a39cd236@mail.gmail.com> References: <7d9b3cf20904230719k6bbc76favc88dc2b75bb01f9b@mail.gmail.com> <7d9b3cf20904230803u415d2811i87e37297a39cd236@mail.gmail.com> Message-ID: On Thu, Apr 23, 2009 at 11:03 PM, Eduardo Casarero wrote: > 2009/4/23 jan gestre : >> On Thu, Apr 23, 2009 at 10:19 PM, Eduardo Casarero wrote: >>> 2009/4/23 jan gestre : >>>> Hi Guys, >>>> >>>> I'm trying to release some emails that MailScanner mistakenly tagged >>>> as SPAM but after releasing it ends up back in the quarantine. I have >>>> "Quarantine Whole Messages As Queue Files = no" and Spam Action set to >>>> "store forward email@address" in MailScanner.conf, BTW I can't change >>>> the Spam Action as deliver because of the enormous amount of spam in >>>> user's inboxes and I'm getting a mouthful if I revert to that, any >>>> ideas? >>>> >>> >>> Do you have "localhost (127.0.0.1)" in whitelist? so all releases are >>> never spam? >>> >> >> No, I don't have localhost in whitelist, should I add this? I've read >> in the documentation that adding your own domain is a no-no, I have no >> idea if they are the same. > > what i say is that all traffic orginated in localhost (the mailscanner > server) should be whitelisted (not the domain, just 127.0.0.1, because > you never send spam from localhost (i assume). > should I used the network address instead because the server is virtually hosted using a MySQL backend? From ecasarero at gmail.com Fri Apr 24 04:27:09 2009 From: ecasarero at gmail.com (Eduardo Casarero) Date: Fri Apr 24 04:27:38 2009 Subject: Mails released from spam quarantine ends up back in quarantine In-Reply-To: References: <7d9b3cf20904230719k6bbc76favc88dc2b75bb01f9b@mail.gmail.com> <7d9b3cf20904230803u415d2811i87e37297a39cd236@mail.gmail.com> Message-ID: <7d9b3cf20904232027v6e385c4eu9c14f68857bb2767@mail.gmail.com> 2009/4/23 jan gestre : > On Thu, Apr 23, 2009 at 11:03 PM, Eduardo Casarero wrote: >> 2009/4/23 jan gestre : >>> On Thu, Apr 23, 2009 at 10:19 PM, Eduardo Casarero wrote: >>>> 2009/4/23 jan gestre : >>>>> Hi Guys, >>>>> >>>>> I'm trying to release some emails that MailScanner mistakenly tagged >>>>> as SPAM but after releasing it ends up back in the quarantine. I have >>>>> "Quarantine Whole Messages As Queue Files = no" and Spam Action set to >>>>> "store forward email@address" in MailScanner.conf, BTW I can't change >>>>> the Spam Action as deliver because of the enormous amount of spam in >>>>> user's inboxes and I'm getting a mouthful if I revert to that, any >>>>> ideas? >>>>> >>>> >>>> Do you have "localhost (127.0.0.1)" in whitelist? so all releases are >>>> never spam? >>>> >>> >>> No, I don't have localhost in whitelist, should I add this? I've read >>> in the documentation that adding your own domain is a no-no, I have no >>> idea if they are the same. >> >> what i say is that all traffic orginated in localhost (the mailscanner >> server) should be whitelisted (not the domain, just 127.0.0.1, because >> you never send spam from localhost (i assume). >> when you release the email, what is the ip of orgin? localhost or server ip? (check headers in quarantine) if running mailwatch should be 127.0.0.1 using the php release rpc. > > should I used the network address instead because the server is > virtually hosted using a MySQL backend? > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > From MailScanner at ecs.soton.ac.uk Fri Apr 24 09:40:36 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Fri Apr 24 09:40:58 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49F17B04.2040702@ecs.soton.ac.uk> Message-ID: On 23/04/2009 20:57, Rick Cooper wrote: > > > >> -----Original Message----- >> From: mailscanner-bounces@lists.mailscanner.info >> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf >> Of Mark Sapiro >> Sent: Thursday, April 23, 2009 2:29 PM >> To: MailScanner List >> Subject: Re: Found nn messages in the processing-messages database >> >> Julian Field wrote: >> >>> On 23/04/2009 15:12, Mark Sapiro wrote: >>> >>>> On Thu, Apr 23, 2009 at 09:31:45AM +0100, Julian Field wrote: >>>> >>>> >>>>> On 23/04/2009 02:57, Mark Sapiro wrote: >>>>> >>>>> >>>>>> I have looked a bit more clusely at the messages that >>>>>> >> were left in the >> >>>>>> database. and it is not only that the id is all-decimal; >>>>>> >> the entropy >> >>>>>> fragment must also be all-decimal or contain only a >>>>>> >> single 'E', so in >> >>>>>> every case, they are being interpred as a floating point >>>>>> >> number rather >> >>>>>> than a string. >>>>>> >>>>>> >>>>>> >>>>> Which is a Perl bug. Perl should carry them around as >>>>> >> both a number and >> >>>>> a string, and the final destination type is a string >>>>> >> (that's the type of >> >>>>> the field in the SQL query), so someone is squashing it >>>>> >> to just a number >> >>>>> before checking the destination type. That's either a bug >>>>> >> in Perl or in >> >>>>> the implementation of DBD::SQLite. >>>>> >>>>> >>>>>> E.g., the latest list from running for a while with the >>>>>> >>>>>> $sth->execute("$id"); >>>>>> >>>>>> patch is >>>>>> >>>>>> 74221690410.052E4 >>>>>> 36888690435.06105 >>>>>> 73061690441.05915 >>>>>> 15461690460.09210 >>>>>> >>>>>> all of which are valid floating point number >>>>>> >> representations. If you >> >>>>>> look at the lists in the messages I previously posted such as at >>>>>> >>>>>> >> > l/091022.html>, >> >>>>>> you will see that those too are all decimal to the left >>>>>> >> of the period >> >>>>>> and all decimal or contain at most one 'E' to the right >>>>>> >> of the period >> >>>>>> so they are all valid floating point number >>>>>> >> representations, and were >> >>>>>> apparently treated as floating point numbers when passed to the >>>>>> statement handler method with perl-DBD-SQLite-1.21, but >>>>>> >> apparently not >> >>>>>> with the prior perl-DBD-SQLite-1.13. >>>>>> >>>>>> >>>>>> >>>>> Well diagnosed, sir :-) >>>>> So an alternative solution would be to put a "P" (for >>>>> >> Postfix, but is >> >>>>> arbitrary) on the front of the message id. >>>>> Would you like me to do that, or just live with the >>>>> >> slight inefficiency >> >>>>> in the database deletion? >>>>> >>>>> >>>> I had an idea, and I am trying >>>> >>>> $sth->execute("\'$id\'"); >>>> >>>> >>> That shouldn't work, as you are trying to delete the message >>> >> id, not the >> >>> message id with quotes around it. >>> >> >> You are correct. That doesn't work at all. >> >> I then tried installing MailScanner 4.76.17-1, but that seems to have >> some other problem in that it is not picking up new messages from >> Postfix at all. Postfix receives messages and puts them in the Hold >> queue, and they just stay there. MailScanner doesn't pick them up and >> doesn't log anything. >> >> So I have reverted to 4.76.15-1 with the additional replacement of >> >> $sth->execute($id); >> >> with >> >> $MailScanner::ProcDBH->do("DELETE FROM processing WHERE >> (id='$id')"); >> >> > > Wouldn't > > my $sth = $MailScanner::ProcDBH->prepare(q{DELETE FROM processing > WHERE (id='?')}); > Then > $sth->execute($id); > > Work? > Yes, but it's slower as you aren't taking advantage of pre-preparing the statement and using placeholders to bind values to it. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Fri Apr 24 09:42:25 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Fri Apr 24 09:42:46 2009 Subject: Problem with Postfix and 4.76.1[67] - was Re: Found nn messages in the processing-messages database In-Reply-To: References: <49F17B71.7000303@ecs.soton.ac.uk> Message-ID: On 23/04/2009 22:07, Mark Sapiro wrote: > Mark Sapiro wrote: > > >> I then tried installing MailScanner 4.76.17-1, but that seems to have >> some other problem in that it is not picking up new messages from >> Postfix at all. Postfix receives messages and puts them in the Hold >> queue, and they just stay there. MailScanner doesn't pick them up and >> doesn't log anything. >> > > I don't know enough about the whole process to come up with a patch, > but it looks like there are two issues with Postfix.pm > > in sub new, > > $this->{HDFileRegexp} = '^([\\dA-F]+)$'; > > doesn't allow for the leading 'P'. > > in sub HDFileName > > $id =~ s/\.[^.]+$//; > > needs I think to be something like > > $id =~ s/P([^.]+)\.[^.]+$/\1/; > > Either that, or just add the 'P' to the beginning of the entropy > fragment (after the '.') instead of to the beginning of the id. > > I think I'll try this latter change: > > my $id = 'P' . $idtemp . '.' . PostfixKey($file); > > becomes instead > > my $id = $idtemp . '.' . 'P' . PostfixKey($file); > Damn, knew I would screw it up somewhere. Good thing it was a beta. I have gone for adding it in the middle as per your 2nd suggestion. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From steve.freegard at fsl.com Fri Apr 24 09:42:54 2009 From: steve.freegard at fsl.com (Steve Freegard) Date: Fri Apr 24 09:43:05 2009 Subject: Question about ordering in rulesets In-Reply-To: References: Message-ID: <49F17B8E.1060900@fsl.com> Mark, See http://www.mailscanner.info/MailScanner.conf.index.html#Scan%20Messages Ruleset Type for this option is "All Match": "All Match" rulesets work through every recipient, concatenating all the results. "All Match" rulesets are usually used when you want to check if any of the recipient addresses match. For example, when evaluating a "Yes/No" option with an "All Matches" ruleset, the result is taken as a "Yes" if any of the addresses match at all. Regards, Steve. Mark Sapiro wrote: > In MailScanner.conf, I have: > > Scan Messages = %rules-dir%/scan.messages.rules > > In %rules-dir%/scan.messages.rules I have: > > 1 # Rules to scan or skip MailScanner altogether. > 2 # > 3 # Exempt locally generated mail > 4 # > 5 # localhost > 6 From: 127.0.0.1 no > 7 # sbh16.songbird.com > 8 From: 72.52.113.16 no > 9 # ms2.msapiro.net sbh34.songbird.com > 10 From: 72.52.113.34 no > 11 # grizz.org, etc. sbh35.songbird.com > 12 From: 72.52.113.35 no > 13 # abriz.org, etc. sbh36.songbird.com > 14 From: 72.52.113.36 no > 15 # sbh37.songbird.com > 16 From: 72.52.113.37 no > 17 # sbh38.songbird.com > 18 From: 72.52.113.38 no > 19 # > 20 # Rules to not scan messages to abuse or postmaster > 21 # > 22 # but first scan all abriz mail > 23 # > 24 To: /[@.]abriz.(org|net)$/ yes > 25 # > 26 To: /^(abuse|postmaster)[+@]/ no > 26 # > 28 # Don't scan messages to membership from paypal.com as we break > domain keys > 29 # signatures and at least if the recipient is > sbcglobal/yahoo/prodigy, they > 30 # call it spam > 31 # > 32 # from *.den.paypal.com > 33 To: /^membership@grizz[^.]*\.org$/ and From: 216.113.188.0/24 no > 34 # from *.phx.paypal.com > 35 To: /^membership@grizz[^.]*\.org$/ and From: 66.211.168.0/24 no > 36 # > 37 # Finally > 38 # > 39 FromOrTo: default yes > > > The idea is I want to scan mail by default, but I have several rules to > not scan and one specific rule to scan at line 24. > > It was my assumption that these rules would be checked in order and the > first one to hit would be the one that determined yes or no. In > particular, the rule at line 26 is intended to not scan mail to abuse > or postmaster, but the rule at line 24 is intended to scan all mail to > the abriz.org and abriz.net domains including mail to abuse and > postmaster as it comes before line 26. > > I had a situation today that makes me question my ordering assumption. > > A message arrived from IP 72.52.113.36 [1] which had four recipients, > one of whom was in the abriz.net domain. The message was scanned by > MailScanner and an attachment removed because of a filename rule [2], > in spite of the fact that it matched the > > From: 72.52.113.36 no > > rule at line 14, I would have thought, before matching the > > To: /[@.]abriz.(org|net)$/ yes > > rule at line 24. > > So is my assumption about ordering wrong? If so, is there a way to > accomplish what I thought I was accomplishing with this ordering? > > [1] > The message arrived via an ssh tunnel from a remote machine to IP > 72.52.113.36, but Postfix saw it as coming from IP 72.52.113.36. > > Apr 23 12:08:48 sbh16 postfix/smtpd[17061]: connect from > abriz.net[72.52.113.36] > Apr 23 12:08:49 sbh16 postfix/smtpd[17061]: 18C1E6900A5: > client=abriz.net[72.52.113.36] > Apr 23 12:08:49 sbh16 postfix/cleanup[17770]: 18C1E6900A5: hold: header > Received: from chaos.abriz.net (abriz.net [72.52.113.36])??(using > TLSv1 with cipher ADH-AES256-SHA (256/256 bits))??(No client > certificate requested)??by sbh16.songbird.com (Postfix) with ESMTP id > 18C from abriz.net[72.52.113.36]; from= > to= proto=ESMTP helo= > Apr 23 12:08:49 sbh16 postfix/cleanup[17770]: 18C1E6900A5: > message-id=<20090423190848.GA17095@abriz.net> > Apr 23 12:08:49 sbh16 postfix/smtpd[17061]: disconnect from > abriz.net[72.52.113.36] > > > [2] > Apr 23 12:08:49 sbh16 MailScanner[16883]: New Batch: Scanning 1 > messages, 9291 bytes > Apr 23 12:08:51 sbh16 MailScanner[16883]: Filename Checks: Possible > malicious batch file script (18C1E6900A5.0258A azs.bat) > Apr 23 12:08:51 sbh16 MailScanner[16883]: Other Checks: Found 1 problems > Apr 23 12:08:51 sbh16 MailScanner[16883]: Virus and Content Scanning: > Starting > Apr 23 12:08:51 sbh16 MailScanner[16883]: Saved infected "azs.bat" to > /var/spool/MailScanner/quarantine/20090423/18C1E6900A5.0258A > Apr 23 12:08:51 sbh16 MailScanner[16883]: Saved infected > "sp500-zsj.zip" to > /var/spool/MailScanner/quarantine/20090423/18C1E6900A5.0258A > Apr 23 12:08:51 sbh16 MailScanner[16883]: Requeue: 18C1E6900A5.0258A to > 3D47E690188 > Apr 23 12:08:51 sbh16 MailScanner[16883]: Cleaned: Delivered 1 cleaned > messages > From rcooper at dwford.com Fri Apr 24 12:13:06 2009 From: rcooper at dwford.com (Rick Cooper) Date: Fri Apr 24 12:13:21 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49F17B04.2040702@ecs.soton.ac.uk> Message-ID: <9DBAD9F18D3049EE88792A9560BEAE38@SAHOMELT> > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf > Of Julian Field > Sent: Friday, April 24, 2009 4:41 AM > To: MailScanner discussion > Subject: Re: Found nn messages in the processing-messages database > > > > On 23/04/2009 20:57, Rick Cooper wrote: > > > > > > > >> -----Original Message----- > >> From: mailscanner-bounces@lists.mailscanner.info > >> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf > >> Of Mark Sapiro > >> Sent: Thursday, April 23, 2009 2:29 PM > >> To: MailScanner List > >> Subject: Re: Found nn messages in the processing-messages database > >> > >> Julian Field wrote: > >> > >>> On 23/04/2009 15:12, Mark Sapiro wrote: > >>> > >>>> On Thu, Apr 23, 2009 at 09:31:45AM +0100, Julian Field wrote: > >>>> > >>>> > >>>>> On 23/04/2009 02:57, Mark Sapiro wrote: > >>>>> > >>>>> > >>>>>> I have looked a bit more clusely at the messages that > >>>>>> > >> were left in the > >> > >>>>>> database. and it is not only that the id is all-decimal; > >>>>>> > >> the entropy > >> > >>>>>> fragment must also be all-decimal or contain only a > >>>>>> > >> single 'E', so in > >> > >>>>>> every case, they are being interpred as a floating point > >>>>>> > >> number rather > >> > >>>>>> than a string. > >>>>>> > >>>>>> > >>>>>> > >>>>> Which is a Perl bug. Perl should carry them around as > >>>>> > >> both a number and > >> > >>>>> a string, and the final destination type is a string > >>>>> > >> (that's the type of > >> > >>>>> the field in the SQL query), so someone is squashing it > >>>>> > >> to just a number > >> > >>>>> before checking the destination type. That's either a bug > >>>>> > >> in Perl or in > >> > >>>>> the implementation of DBD::SQLite. > >>>>> > >>>>> > >>>>>> E.g., the latest list from running for a while with the > >>>>>> > >>>>>> $sth->execute("$id"); > >>>>>> > >>>>>> patch is > >>>>>> > >>>>>> 74221690410.052E4 > >>>>>> 36888690435.06105 > >>>>>> 73061690441.05915 > >>>>>> 15461690460.09210 > >>>>>> > >>>>>> all of which are valid floating point number > >>>>>> > >> representations. If you > >> > >>>>>> look at the lists in the messages I previously posted > such as at > >>>>>> > >>>>>> > >> >> l/091022.html>, > >> > >>>>>> you will see that those too are all decimal to the left > >>>>>> > >> of the period > >> > >>>>>> and all decimal or contain at most one 'E' to the right > >>>>>> > >> of the period > >> > >>>>>> so they are all valid floating point number > >>>>>> > >> representations, and were > >> > >>>>>> apparently treated as floating point numbers when passed to the > >>>>>> statement handler method with perl-DBD-SQLite-1.21, but > >>>>>> > >> apparently not > >> > >>>>>> with the prior perl-DBD-SQLite-1.13. > >>>>>> > >>>>>> > >>>>>> > >>>>> Well diagnosed, sir :-) > >>>>> So an alternative solution would be to put a "P" (for > >>>>> > >> Postfix, but is > >> > >>>>> arbitrary) on the front of the message id. > >>>>> Would you like me to do that, or just live with the > >>>>> > >> slight inefficiency > >> > >>>>> in the database deletion? > >>>>> > >>>>> > >>>> I had an idea, and I am trying > >>>> > >>>> $sth->execute("\'$id\'"); > >>>> > >>>> > >>> That shouldn't work, as you are trying to delete the message > >>> > >> id, not the > >> > >>> message id with quotes around it. > >>> > >> > >> You are correct. That doesn't work at all. > >> > >> I then tried installing MailScanner 4.76.17-1, but that > seems to have > >> some other problem in that it is not picking up new messages from > >> Postfix at all. Postfix receives messages and puts them in the Hold > >> queue, and they just stay there. MailScanner doesn't pick > them up and > >> doesn't log anything. > >> > >> So I have reverted to 4.76.15-1 with the additional replacement of > >> > >> $sth->execute($id); > >> > >> with > >> > >> $MailScanner::ProcDBH->do("DELETE FROM processing WHERE > >> (id='$id')"); > >> > >> > > > > Wouldn't > > > > my $sth = $MailScanner::ProcDBH->prepare(q{DELETE FROM > processing > > WHERE (id='?')}); > > Then > > $sth->execute($id); > > > > Work? > > > Yes, but it's slower as you aren't taking advantage of > pre-preparing the > statement and using placeholders to bind values to it. > No, you misunderstand, you do the prepare in the same spot as now but change that line to my $sth = $MailScanner::ProcDBH->prepare(q{DELETE FROM processing WHERE (id='?')}); You use the q{...} around the complete statement and change $id=? To $id='?' (this is actually talked about in the module documentation) So your sql will have single quotes around the value of $id as part of the sql (which would the proper way to do it, generally speaking) Then $sth->execute($id); ought to work as intended. Of course you could always use CAST in the prepare and there would be no doubt that it would be interrprested as the type you cast the data as ( ex: id = CAST( ?, CHAR) ) Rick -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From J.Ede at birchenallhowden.co.uk Fri Apr 24 12:18:01 2009 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Fri Apr 24 12:18:23 2009 Subject: Signatures... In-Reply-To: References: <1213490F1F316842A544A850422BFA96239CFDB6@BHLSBS.bhl.local> <49F05017.9010707@ecs.soton.ac.uk> Message-ID: <1213490F1F316842A544A850422BFA96239CFE45@BHLSBS.bhl.local> I'm trying this beta on a CentOS 5.3 box (just updated from 5.2 to 5.3 and had a working 4.75 ver of MailScanner on it). The install fails. That attached log is from the second time of running it... By jiggling the order of the modules in install.sh round I can get it to install, but when I try a --lint it hangs just after Virus Scanning: Clamd found 2 infections for a good couple of minutes. It didn't do this with 4.75. [root@smtp ~]# MailScanner --lint Trying to setlogsock(unix) Read 852 hostnames from the phishing whitelist Read 5616 hostnames from the phishing blacklist Checking version numbers... Version installed (4.76.17) does not match version stated in MailScanner.conf file (4.75.11), you may want to run upgrade_MailScanner_conf to ensure your MailScanner.conf file contains all the latest settings. Unrar is not installed, it should be in /usr/local/bin/unrar. This is required for RAR archives to be read to check filenames and filetypes. Virus scanning is not affected. Your envelope_sender_header in spam.assassin.prefs.conf is correct. MailScanner setting GID to (89) MailScanner setting UID to (89) Checking for SpamAssassin errors (if you use it)... Using SpamAssassin results cache Connected to SpamAssassin cache database SpamAssassin reported no errors. Using locktype = posix MailScanner.conf says "Virus Scanners = clamd mcafee" Found these virus scanners installed: clamd, mcafee =========================================================================== Filename Checks: Windows/DOS Executable (1 eicar.com) Other Checks: Found 1 problems Virus and Content Scanning: Starting Clamd::INFECTED:: Eicar-Test-Signature :: ./1/ Clamd::INFECTED:: Eicar-Test-Signature :: ./1/eicar.com Virus Scanning: Clamd found 2 infections ------------ /1/eicar.com Found: EICAR test file NOT a virus. /1.message/icar.com Found: EICAR test file NOT a virus. Virus Scanning: McAfee found 2 infections Infected message 1 came from 10.1.1.1 Virus Scanning: Found 4 viruses =========================================================================== If any of your virus scanners (clamd,mcafee) are not listed there, you should check that they are installed correctly and that MailScanner is finding them correctly via its virus.scanners.conf. I'm guessing this is a centos issue since the other box I upgraded to 5.3 is now processing slower than it was before and takes an age to start up. I've looked at the thread MailScanner, CentOS 5 and perl-IO & perl-File-Temp which I guess is related. If I then start MailScanner and put an email into the queue nothing happened. I think something is timing out, but don't know where to look. MailScanner -V (output below) takes ages to produce the output below. Jason MailScanner -V Running on Linux smtp.birchenallhowden.com 2.6.18-128.1.6.el5 #1 SMP Wed Apr 1 09:10:25 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux This is CentOS release 5.3 (Final) This is Perl version 5.008008 (5.8.8) This is MailScanner version 4.76.17 Module versions are: 1.00 AnyDBM_File 1.16 Archive::Zip 0.23 bignum 1.04 Carp 1.41 Compress::Zlib 1.119 Convert::BinHex 0.17 Convert::TNEF 2.121_08 Data::Dumper 2.27 Date::Parse 1.00 DirHandle 1.05 Fcntl 2.74 File::Basename 2.09 File::Copy 2.01 FileHandle 1.08 File::Path 0.20 File::Temp 0.90 Filesys::Df 1.35 HTML::Entities 3.56 HTML::Parser 2.37 HTML::TokeParser 1.23 IO 1.14 IO::File 1.13 IO::Pipe 2.04 Mail::Header 1.89 Math::BigInt 0.22 Math::BigRat 3.07 MIME::Base64 5.427 MIME::Decoder 5.427 MIME::Decoder::UU 5.427 MIME::Head 5.427 MIME::Parser 3.07 MIME::QuotedPrint 5.427 MIME::Tools 0.13 Net::CIDR 1.25 Net::IP 0.16 OLE::Storage_Lite 1.04 Pod::Escapes 3.05 Pod::Simple 1.09 POSIX 1.19 Scalar::Util 1.78 Socket 2.16 Storable 1.4 Sys::Hostname::Long 0.27 Sys::Syslog 1.26 Test::Pod 0.86 Test::Simple 1.9715 Time::HiRes 1.02 Time::localtime Optional module versions are: 1.30 Archive::Tar 0.23 bignum missing Business::ISBN missing Business::ISBN::Data missing Data::Dump 1.814 DB_File 1.21 DBD::SQLite 1.607 DBI 1.14 Digest 1.01 Digest::HMAC 2.36 Digest::MD5 2.11 Digest::SHA1 missing Encode::Detect 0.17011 Error missing ExtUtils::CBuilder missing ExtUtils::ParseXS 2.38 Getopt::Long missing Inline missing IO::String 1.04 IO::Zlib missing IP::Country missing Mail::ClamAV 3.002004 Mail::SpamAssassin v2.005 Mail::SPF 1.999001 Mail::SPF::Query 0.2808 Module::Build 0.20 Net::CIDR::Lite 0.65 Net::DNS v0.003 Net::DNS::Resolver::Programmable missing Net::LDAP 4.007 NetAddr::IP missing Parse::RecDescent missing SAVI 2.64 Test::Harness missing Test::Manifest 1.95 Text::Balanced 1.35 URI 0.74 version missing YAML > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- > bounces@lists.mailscanner.info] On Behalf Of Julian Field > Sent: 23 April 2009 12:25 > To: MailScanner discussion > Subject: Re: Signatures... > > See 4.76.17. You put in the magic token _SIGNATURE_ and it will replace > it with the inline HTML or text signature, as appropriate. > > All done, > Jules. > > On 23/04/2009 11:46, Jason Ede wrote: > > > > I suspect this will not be an easy if at all viable idea, but here > goes... > > > > We currently use the sign clean messages option on our outbound > emails > > to attach our corporate signature and image and this is appended to > > the bottom of all outbound emails. > > > > This works for the first message we send out, but if we reply to an > > inbound message then our personal signature (i.e. name and position) > > from within outlook is put at the bottom of our part of the email, > and > > then the inline sig is added at the end of the email after the > > original email. Is it possible to insert the inline sig into the > email > > at a preset point by putting some form of tag into our signatures > i.e. > > after my name on a blank line I put <> and the inline sig > > is inserted at that point within the email and if its not present > then > > just append at end as normal? > > > > I know this will not work at all for signed messages, so if it can be > > done must be an option and I'm guessing it could add extra processing > > load to MailScanner? > > > > Jason > > > > Jules > > -- > Julian Field MEng CITP CEng > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > Need help customising MailScanner? > Contact me! > Need help fixing or optimising your systems? > Contact me! > Need help getting you started solving new requirements from your boss? > Contact me! > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > Follow me at twitter.com/JulesFM > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -------------- next part -------------- A non-text attachment was scrubbed... Name: install.log Type: application/octet-stream Size: 27534 bytes Desc: install.log Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090424/6380baf8/install.obj From J.Ede at birchenallhowden.co.uk Fri Apr 24 13:55:03 2009 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Fri Apr 24 13:55:23 2009 Subject: Signatures... In-Reply-To: <1213490F1F316842A544A850422BFA96239CFE45@BHLSBS.bhl.local> References: <1213490F1F316842A544A850422BFA96239CFDB6@BHLSBS.bhl.local> <49F05017.9010707@ecs.soton.ac.uk> <1213490F1F316842A544A850422BFA96239CFE45@BHLSBS.bhl.local> Message-ID: <1213490F1F316842A544A850422BFA96239CFE5E@BHLSBS.bhl.local> The not processing messages bit, I've just noticed the post by Rick Cooper that fixes the messages not being processed bit. Jason > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- > bounces@lists.mailscanner.info] On Behalf Of Jason Ede > Sent: 24 April 2009 12:18 > To: MailScanner discussion > Subject: RE: Signatures... > > I'm trying this beta on a CentOS 5.3 box (just updated from 5.2 to 5.3 > and had a working 4.75 ver of MailScanner on it). > > The install fails. That attached log is from the second time of running > it... By jiggling the order of the modules in install.sh round I can > get it to install, but when I try a --lint it hangs just after Virus > Scanning: Clamd found 2 infections for a good couple of minutes. It > didn't do this with 4.75. > > [root@smtp ~]# MailScanner --lint > Trying to setlogsock(unix) > Read 852 hostnames from the phishing whitelist Read 5616 hostnames from > the phishing blacklist Checking version numbers... > Version installed (4.76.17) does not match version stated in > MailScanner.conf file (4.75.11), you may want to run > upgrade_MailScanner_conf to ensure your MailScanner.conf file contains > all the latest settings. > > Unrar is not installed, it should be in /usr/local/bin/unrar. > This is required for RAR archives to be read to check filenames and > filetypes. Virus scanning is not affected. > > > Your envelope_sender_header in spam.assassin.prefs.conf is correct. > MailScanner setting GID to (89) > MailScanner setting UID to (89) > > Checking for SpamAssassin errors (if you use it)... > Using SpamAssassin results cache > Connected to SpamAssassin cache database SpamAssassin reported no > errors. > Using locktype = posix > MailScanner.conf says "Virus Scanners = clamd mcafee" > Found these virus scanners installed: clamd, mcafee > ======================================================================= > ==== > Filename Checks: Windows/DOS Executable (1 eicar.com) Other Checks: > Found 1 problems Virus and Content Scanning: Starting > Clamd::INFECTED:: Eicar-Test-Signature :: ./1/ > Clamd::INFECTED:: Eicar-Test-Signature :: ./1/eicar.com Virus Scanning: > Clamd found 2 infections > > ------------ > > /1/eicar.com Found: EICAR test file NOT a virus. > /1.message/icar.com Found: EICAR test file NOT a virus. > Virus Scanning: McAfee found 2 infections Infected message 1 came from > 10.1.1.1 Virus Scanning: Found 4 viruses > ======================================================================= > ==== > > If any of your virus scanners (clamd,mcafee) are not listed there, you > should check that they are installed correctly and that MailScanner is > finding them correctly via its virus.scanners.conf. > > > I'm guessing this is a centos issue since the other box I upgraded to > 5.3 is now processing slower than it was before and takes an age to > start up. I've looked at the thread MailScanner, CentOS 5 and perl-IO & > perl-File-Temp which I guess is related. > > If I then start MailScanner and put an email into the queue nothing > happened. I think something is timing out, but don't know where to > look. MailScanner -V (output below) takes ages to produce the output > below. > > Jason > > MailScanner -V > Running on > Linux smtp.birchenallhowden.com 2.6.18-128.1.6.el5 #1 SMP Wed Apr 1 > 09:10:25 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux This is CentOS release > 5.3 (Final) This is Perl version 5.008008 (5.8.8) > > This is MailScanner version 4.76.17 > Module versions are: > 1.00 AnyDBM_File > 1.16 Archive::Zip > 0.23 bignum > 1.04 Carp > 1.41 Compress::Zlib > 1.119 Convert::BinHex > 0.17 Convert::TNEF > 2.121_08 Data::Dumper > 2.27 Date::Parse > 1.00 DirHandle > 1.05 Fcntl > 2.74 File::Basename > 2.09 File::Copy > 2.01 FileHandle > 1.08 File::Path > 0.20 File::Temp > 0.90 Filesys::Df > 1.35 HTML::Entities > 3.56 HTML::Parser > 2.37 HTML::TokeParser > 1.23 IO > 1.14 IO::File > 1.13 IO::Pipe > 2.04 Mail::Header > 1.89 Math::BigInt > 0.22 Math::BigRat > 3.07 MIME::Base64 > 5.427 MIME::Decoder > 5.427 MIME::Decoder::UU > 5.427 MIME::Head > 5.427 MIME::Parser > 3.07 MIME::QuotedPrint > 5.427 MIME::Tools > 0.13 Net::CIDR > 1.25 Net::IP > 0.16 OLE::Storage_Lite > 1.04 Pod::Escapes > 3.05 Pod::Simple > 1.09 POSIX > 1.19 Scalar::Util > 1.78 Socket > 2.16 Storable > 1.4 Sys::Hostname::Long > 0.27 Sys::Syslog > 1.26 Test::Pod > 0.86 Test::Simple > 1.9715 Time::HiRes > 1.02 Time::localtime > > Optional module versions are: > 1.30 Archive::Tar > 0.23 bignum > missing Business::ISBN > missing Business::ISBN::Data > missing Data::Dump > 1.814 DB_File > 1.21 DBD::SQLite > 1.607 DBI > 1.14 Digest > 1.01 Digest::HMAC > 2.36 Digest::MD5 > 2.11 Digest::SHA1 > missing Encode::Detect > 0.17011 Error > missing ExtUtils::CBuilder > missing ExtUtils::ParseXS > 2.38 Getopt::Long > missing Inline > missing IO::String > 1.04 IO::Zlib > missing IP::Country > missing Mail::ClamAV > 3.002004 Mail::SpamAssassin > v2.005 Mail::SPF > 1.999001 Mail::SPF::Query > 0.2808 Module::Build > 0.20 Net::CIDR::Lite > 0.65 Net::DNS > v0.003 Net::DNS::Resolver::Programmable missing Net::LDAP > 4.007 NetAddr::IP > missing Parse::RecDescent > missing SAVI > 2.64 Test::Harness > missing Test::Manifest > 1.95 Text::Balanced > 1.35 URI > 0.74 version > missing YAML > > > -----Original Message----- > > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- > > bounces@lists.mailscanner.info] On Behalf Of Julian Field > > Sent: 23 April 2009 12:25 > > To: MailScanner discussion > > Subject: Re: Signatures... > > > > See 4.76.17. You put in the magic token _SIGNATURE_ and it will > > replace it with the inline HTML or text signature, as appropriate. > > > > All done, > > Jules. > > > > On 23/04/2009 11:46, Jason Ede wrote: > > > > > > I suspect this will not be an easy if at all viable idea, but here > > goes... > > > > > > We currently use the sign clean messages option on our outbound > > emails > > > to attach our corporate signature and image and this is appended to > > > the bottom of all outbound emails. > > > > > > This works for the first message we send out, but if we reply to an > > > inbound message then our personal signature (i.e. name and > position) > > > from within outlook is put at the bottom of our part of the email, > > and > > > then the inline sig is added at the end of the email after the > > > original email. Is it possible to insert the inline sig into the > > email > > > at a preset point by putting some form of tag into our signatures > > i.e. > > > after my name on a blank line I put <> and the inline > sig > > > is inserted at that point within the email and if its not present > > then > > > just append at end as normal? > > > > > > I know this will not work at all for signed messages, so if it can > > > be done must be an option and I'm guessing it could add extra > > > processing load to MailScanner? > > > > > > Jason > > > > > > > Jules > > > > -- > > Julian Field MEng CITP CEng > > www.MailScanner.info > > Buy the MailScanner book at www.MailScanner.info/store > > > > Need help customising MailScanner? > > Contact me! > > Need help fixing or optimising your systems? > > Contact me! > > Need help getting you started solving new requirements from your > boss? > > Contact me! > > > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > Follow me at twitter.com/JulesFM > > > > > > -- > > This message has been scanned for viruses and dangerous content by > > MailScanner, and is believed to be clean. > > > > -- > > MailScanner mailing list > > mailscanner@lists.mailscanner.info > > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > > > Before posting, read http://wiki.mailscanner.info/posting > > > > Support MailScanner development - buy the book off the website! From mark at msapiro.net Fri Apr 24 16:41:13 2009 From: mark at msapiro.net (Mark Sapiro) Date: Fri Apr 24 16:41:24 2009 Subject: Question about ordering in rulesets In-Reply-To: <49F17B8E.1060900@fsl.com> References: <49F17B8E.1060900@fsl.com> Message-ID: <20090424154113.GA4008@msapiro> On Fri, Apr 24, 2009 at 09:42:54AM +0100, Steve Freegard wrote: > Mark, > > See http://www.mailscanner.info/MailScanner.conf.index.html#Scan%20Messages > > Ruleset Type for this option is "All Match": Steve, Thanks for the pointer and the explanation. I had actually seen this page before, but I didn't find it yesterday when looking for help on rulesets (how quickly we forget). -- Mark Sapiro mark at msapiro net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From mark at msapiro.net Fri Apr 24 17:32:58 2009 From: mark at msapiro.net (Mark Sapiro) Date: Fri Apr 24 17:33:15 2009 Subject: MailScanner/Postfix/Logwatch heads up Message-ID: MailScanner 4.76.18 changes the form of the entropy fragment added to Postfix queue ids by MailScanner to avoid an issue ultimately caused by a perl bug. If you run MailScanner with Postfix and you run Logwatch, this change will cause the " D62EC6903AF.P0113C to C3FEF6903B1" portion of the Apr 24 09:27:30 sbh16 MailScanner[9194]: Requeue: D62EC6903AF.P0113C to C3FEF6903B1 log entries to be printed as "**Unmatched Entries**" instead of ignored. The attached lw.patch.txt patch will fix this. -- Mark Sapiro The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan -------------- next part -------------- --- /usr/share/logwatch/scripts/services/mailscanner 2007-01-06 06:08:22.000000000 -0800 +++ /etc/logwatch/scripts/services/mailscanner 2009-04-24 09:15:41.000000000 -0700 @@ -76,7 +79,7 @@ ( $ThisLine =~ m/Read [0-9]+ hostnames from the phishing whitelist/ ) or ( $ThisLine =~ m/completed at [0-9]+ bytes per second/ ) or ( $ThisLine =~ m/Message .+ from .+ to .+ is/ ) or - ( $ThisLine =~ m/^[A-F0-9]+\.[A-F0-9]{5} to/ ) or #for postfix Requeue: + ( $ThisLine =~ m/^[A-F0-9]+\.P[A-F0-9]{5} to/ ) or #for postfix Requeue: ( $ThisLine =~ m/^calling custom .* function/ ) or ( $ThisLine =~ m/^Initialising database connection/ ) or ( $ThisLine =~ m/^Finished initialising database connection/ ) or From maillists at conactive.com Fri Apr 24 21:31:20 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Fri Apr 24 21:31:33 2009 Subject: Signatures... In-Reply-To: <1213490F1F316842A544A850422BFA96239CFE45@BHLSBS.bhl.local> References: <1213490F1F316842A544A850422BFA96239CFDB6@BHLSBS.bhl.local> <49F05017.9010707@ecs.soton.ac.uk> <1213490F1F316842A544A850422BFA96239CFE45@BHLSBS.bhl.local> Message-ID: Jason Ede wrote on Fri, 24 Apr 2009 12:18:01 +0100: > Version installed (4.76.17) does not match version stated in > MailScanner.conf file (4.75.11), you may want to run upgrade_MailScanner_conf > to ensure your MailScanner.conf file contains all the latest settings. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From garvey at pushormitchell.com Fri Apr 24 22:04:17 2009 From: garvey at pushormitchell.com (Joe Garvey) Date: Fri Apr 24 22:04:29 2009 Subject: Very slow system Message-ID: I have been running mailscanner for about 5 years on various installs and systems and I am really scratching my head on this one. The MailScanner install is running on a dial Xeon 2.3G machine with 4Gig of ram but seems to be slow as a dog. Mail keeps coming into mqueue.in and it sits there for the longest time. Mailscanner will periodically take a chunk and process it but I get up to 3000 emails sitting in the queue and eventually I have to purge it out (as a last resort). I have a local caching DNS server which is working and I have upgraded to the latest MailScanner (4.75.11) and SA 3.2.5 Even connecting to MailWatch is very slow even if I purge the database. As soon as I stop MailScanner everything seems much more responsive. Any suggestions as to where else to look? Thanks Joe garvey@pushormitchell.com -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090424/cd6d94b5/attachment.html From J.Ede at birchenallhowden.co.uk Sat Apr 25 07:41:56 2009 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Sat Apr 25 07:42:20 2009 Subject: Signatures... In-Reply-To: References: <1213490F1F316842A544A850422BFA96239CFDB6@BHLSBS.bhl.local> <49F05017.9010707@ecs.soton.ac.uk> <1213490F1F316842A544A850422BFA96239CFE45@BHLSBS.bhl.local> Message-ID: <1213490F1F316842A544A850422BFA96239CFE81@BHLSBS.bhl.local> I'd run it, just not moved the new config into place. Ooops! Even once that is sorted a --lint and the startup is still significantly slower then the 4.75 for some reason. > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- > bounces@lists.mailscanner.info] On Behalf Of Kai Schaetzl > Sent: 24 April 2009 21:31 > To: mailscanner@lists.mailscanner.info > Subject: Re: Signatures... > > Jason Ede wrote on Fri, 24 Apr 2009 12:18:01 +0100: > > > Version installed (4.76.17) does not match version stated in > > MailScanner.conf file (4.75.11), you may want to run > upgrade_MailScanner_conf > > to ensure your MailScanner.conf file contains all the latest > settings. > > > > Kai > > -- > Kai Sch?tzl, Berlin, Germany > Get your web at Conactive Internet Services: http://www.conactive.com > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From paul.hutchings at mira.co.uk Sat Apr 25 12:07:30 2009 From: paul.hutchings at mira.co.uk (Paul Hutchings) Date: Sat Apr 25 12:07:50 2009 Subject: Preventing multple signatures in email conversation? Message-ID: As subject really, we're using MailScanner (4.74.16) and I've not kept as close an eye on developments/improvements as it basically "just works". The only niggle we do have is that we use it to add a signature to outbound mail and over the course of an email correspondence you end up with an email with 15 signatures added to the end. Any way yet of stopping this happening? Cheers, Paul -- MIRA Ltd Watling Street, Nuneaton, Warwickshire, CV10 0TU, England. Registered in England and Wales No. 402570 VAT Registration GB 114 5409 96 The contents of this e-mail are confidential and are solely for the use of the intended recipient. If you receive this e-mail in error, please delete it and notify us either by e-mail, telephone or fax. You should not copy, forward or otherwise disclose the content of the e-mail as this is prohibited. From MailScanner at ecs.soton.ac.uk Sat Apr 25 12:59:28 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Sat Apr 25 12:59:39 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: <9DBAD9F18D3049EE88792A9560BEAE38@SAHOMELT> References: <49F17B04.2040702@ecs.soton.ac.uk> <9DBAD9F18D3049EE88792A9560BEAE38@SAHOMELT> <49F2FB20.2080701@ecs.soton.ac.uk> Message-ID: On 24/04/2009 12:13, Rick Cooper wrote: > > > >> -----Original Message----- >> From: mailscanner-bounces@lists.mailscanner.info >> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf >> Of Julian Field >> Sent: Friday, April 24, 2009 4:41 AM >> To: MailScanner discussion >> Subject: Re: Found nn messages in the processing-messages database >> >> >> >> On 23/04/2009 20:57, Rick Cooper wrote: >> >>> >>> >>> >>>> -----Original Message----- >>>> From: mailscanner-bounces@lists.mailscanner.info >>>> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf >>>> Of Mark Sapiro >>>> Sent: Thursday, April 23, 2009 2:29 PM >>>> To: MailScanner List >>>> Subject: Re: Found nn messages in the processing-messages database >>>> >>>> Julian Field wrote: >>>> >>>> >>>>> On 23/04/2009 15:12, Mark Sapiro wrote: >>>>> >>>>> >>>>>> On Thu, Apr 23, 2009 at 09:31:45AM +0100, Julian Field wrote: >>>>>> >>>>>> >>>>>> >>>>>>> On 23/04/2009 02:57, Mark Sapiro wrote: >>>>>>> >>>>>>> >>>>>>> >>>>>>>> I have looked a bit more clusely at the messages that >>>>>>>> >>>>>>>> >>>> were left in the >>>> >>>> >>>>>>>> database. and it is not only that the id is all-decimal; >>>>>>>> >>>>>>>> >>>> the entropy >>>> >>>> >>>>>>>> fragment must also be all-decimal or contain only a >>>>>>>> >>>>>>>> >>>> single 'E', so in >>>> >>>> >>>>>>>> every case, they are being interpred as a floating point >>>>>>>> >>>>>>>> >>>> number rather >>>> >>>> >>>>>>>> than a string. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>> Which is a Perl bug. Perl should carry them around as >>>>>>> >>>>>>> >>>> both a number and >>>> >>>> >>>>>>> a string, and the final destination type is a string >>>>>>> >>>>>>> >>>> (that's the type of >>>> >>>> >>>>>>> the field in the SQL query), so someone is squashing it >>>>>>> >>>>>>> >>>> to just a number >>>> >>>> >>>>>>> before checking the destination type. That's either a bug >>>>>>> >>>>>>> >>>> in Perl or in >>>> >>>> >>>>>>> the implementation of DBD::SQLite. >>>>>>> >>>>>>> >>>>>>> >>>>>>>> E.g., the latest list from running for a while with the >>>>>>>> >>>>>>>> $sth->execute("$id"); >>>>>>>> >>>>>>>> patch is >>>>>>>> >>>>>>>> 74221690410.052E4 >>>>>>>> 36888690435.06105 >>>>>>>> 73061690441.05915 >>>>>>>> 15461690460.09210 >>>>>>>> >>>>>>>> all of which are valid floating point number >>>>>>>> >>>>>>>> >>>> representations. If you >>>> >>>> >>>>>>>> look at the lists in the messages I previously posted >>>>>>>> >> such as at >> >>>>>>>> >>>>>>>> >>>> >>> l/091022.html>, >>>> >>>> >>>>>>>> you will see that those too are all decimal to the left >>>>>>>> >>>>>>>> >>>> of the period >>>> >>>> >>>>>>>> and all decimal or contain at most one 'E' to the right >>>>>>>> >>>>>>>> >>>> of the period >>>> >>>> >>>>>>>> so they are all valid floating point number >>>>>>>> >>>>>>>> >>>> representations, and were >>>> >>>> >>>>>>>> apparently treated as floating point numbers when passed to the >>>>>>>> statement handler method with perl-DBD-SQLite-1.21, but >>>>>>>> >>>>>>>> >>>> apparently not >>>> >>>> >>>>>>>> with the prior perl-DBD-SQLite-1.13. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>> Well diagnosed, sir :-) >>>>>>> So an alternative solution would be to put a "P" (for >>>>>>> >>>>>>> >>>> Postfix, but is >>>> >>>> >>>>>>> arbitrary) on the front of the message id. >>>>>>> Would you like me to do that, or just live with the >>>>>>> >>>>>>> >>>> slight inefficiency >>>> >>>> >>>>>>> in the database deletion? >>>>>>> >>>>>>> >>>>>>> >>>>>> I had an idea, and I am trying >>>>>> >>>>>> $sth->execute("\'$id\'"); >>>>>> >>>>>> >>>>>> >>>>> That shouldn't work, as you are trying to delete the message >>>>> >>>>> >>>> id, not the >>>> >>>> >>>>> message id with quotes around it. >>>>> >>>>> >>>> You are correct. That doesn't work at all. >>>> >>>> I then tried installing MailScanner 4.76.17-1, but that >>>> >> seems to have >> >>>> some other problem in that it is not picking up new messages from >>>> Postfix at all. Postfix receives messages and puts them in the Hold >>>> queue, and they just stay there. MailScanner doesn't pick >>>> >> them up and >> >>>> doesn't log anything. >>>> >>>> So I have reverted to 4.76.15-1 with the additional replacement of >>>> >>>> $sth->execute($id); >>>> >>>> with >>>> >>>> $MailScanner::ProcDBH->do("DELETE FROM processing WHERE >>>> (id='$id')"); >>>> >>>> >>>> >>> Wouldn't >>> >>> my $sth = $MailScanner::ProcDBH->prepare(q{DELETE FROM >>> >> processing >> >>> WHERE (id='?')}); >>> Then >>> $sth->execute($id); >>> >>> Work? >>> >>> >> Yes, but it's slower as you aren't taking advantage of >> pre-preparing the >> statement and using placeholders to bind values to it. >> >> > No, you misunderstand, you do the prepare in the same spot as now but change > that line to > > my $sth = $MailScanner::ProcDBH->prepare(q{DELETE FROM processing WHERE > (id='?')}); > > You use the q{...} around the complete statement and change $id=? To $id='?' > (this is actually talked about in the module documentation) > That sounds wrong, but I'm prepared to believe you. Can you show me where in the documentation it says to do that? > So your sql will have single quotes around the value of $id as part of the > sql (which would the proper way to do it, generally speaking) > > Then $sth->execute($id); ought to work as intended. Of course you could > always use CAST in the prepare and there would be no doubt that it would be > interrprested as the type you cast the data as ( ex: id = CAST( ?, CHAR) ) > > Rick > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From rcooper at dwford.com Sat Apr 25 13:56:39 2009 From: rcooper at dwford.com (Rick Cooper) Date: Sat Apr 25 13:56:51 2009 Subject: Found nn messages in the processing-messages database In-Reply-To: References: <49F17B04.2040702@ecs.soton.ac.uk> <9DBAD9F18D3049EE88792A9560BEAE38@SAHOMELT><49F2FB20.2080701@ecs.soton.ac.uk> Message-ID: > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf > Of Julian Field > Sent: Saturday, April 25, 2009 7:59 AM > To: MailScanner discussion > Subject: Re: Found nn messages in the processing-messages database > > > > On 24/04/2009 12:13, Rick Cooper wrote: > > > > > > > >> -----Original Message----- > >> From: mailscanner-bounces@lists.mailscanner.info > >> [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf > >> Of Julian Field > >> Sent: Friday, April 24, 2009 4:41 AM > >> To: MailScanner discussion > >> Subject: Re: Found nn messages in the processing-messages database > >> [...] > >>>> > >>>> > >>>> > >>> Wouldn't > >>> > >>> my $sth = $MailScanner::ProcDBH->prepare(q{DELETE FROM > >>> > >> processing > >> > >>> WHERE (id='?')}); > >>> Then > >>> $sth->execute($id); > >>> > >>> Work? > >>> > >>> > >> Yes, but it's slower as you aren't taking advantage of > >> pre-preparing the > >> statement and using placeholders to bind values to it. > >> > >> > > No, you misunderstand, you do the prepare in the same spot > as now but change > > that line to > > > > my $sth = $MailScanner::ProcDBH->prepare(q{DELETE FROM > processing WHERE > > (id='?')}); > > > > You use the q{...} around the complete statement and change > $id=? To $id='?' > > (this is actually talked about in the module documentation) > > > That sounds wrong, but I'm prepared to believe you. Can you show me > where in the documentation it says to do that? You have to drive down to the underlying DBI that the driver works with, and you will see all kinds of examples that use the style listed above. Then all of the sudden the author mentions "The q{...} style quoting used in these examples avoids clashing with quotes that may be used in the SQL statement. Use the double-quote like qq{...} operator if you want to interpolate variables into the string. See "Quote and Quote-like Operators" in perlop for more details." Ordinarily when you use strings in an SQL statement you would use something like F1='F2'. And if there is any doubt that a field might be a reserved name them `F1` = 'F2'. So pretty much every example in the parent module uses the q{...} style which would make statements like my $sth = $MailScanner::ProcDBH->prepare(q{DELETE FROM processing WHERE (id='?')}); Look more like an sql statement. I am just guessing at this as there is no actual example of doing this. I personally never use perl for handling sql related tasks I find the entire processes tedious and unnecessarily complex, so I could well be wrong and I have no way to test it because I don't use postfix either. Perhaps the SQLite driver or DBI module automatically quotes the placeholder values but I see nothing in the docs to that effect either. IN fact if they did it would mean you couldn't use placeholders to reference tables,fields, etc. If they do not then either the statement or the value should be quoted or cast as a string such as my $SqlId = "'$id'"; and $sth->execute($SqlId); The reason that I believe the problem is quoting is because in the version that works $MailScanner::ProcDBH->do("DELETE FROM processing WHERE (id='$id')"); The $id would be correctly quoted. I cannot believe that there is no way to use a prepared statement that is not also correctly quoted. Either the module/driver or you would have to do it. Rick -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From maillists at conactive.com Sat Apr 25 14:31:19 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Sat Apr 25 14:31:31 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: References: Message-ID: Paul Hutchings wrote on Sat, 25 Apr 2009 12:07:30 +0100: > Any way yet of stopping this happening? That's easy, yes: stop quoting and quoting and quoting and quoting. Mail programs have a built-in threading mechanism, even Microsoft programs. If you rely on it there is no need to endlessly quote completely unnecessary text. A good mail program will also skip the signature when quoting, so it won't ever get added to your reply even if you do a "full quote". This has really nothing to do with MailScanner. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From mark at msapiro.net Sat Apr 25 16:04:43 2009 From: mark at msapiro.net (Mark Sapiro) Date: Sat Apr 25 16:04:52 2009 Subject: MailScanner/Postfix/Logwatch heads up In-Reply-To: References: Message-ID: <20090425150443.GA1312@msapiro> On Fri, Apr 24, 2009 at 09:32:58AM -0700, Mark Sapiro wrote: > > If you run MailScanner with Postfix and you run Logwatch, this change > will cause the " D62EC6903AF.P0113C to C3FEF6903B1" portion of the > > Apr 24 09:27:30 sbh16 MailScanner[9194]: Requeue: D62EC6903AF.P0113C to > C3FEF6903B1 > > log entries to be printed as "**Unmatched Entries**" instead of ignored. > > The attached lw.patch.txt patch will fix this. The revised patch attached is better as it doesn't break the logwatch script for pre 4.76.18 installations. It also fixes a minor line number discrepancy caused by my not correcting the line number when removing other patches from the diff. -- Mark Sapiro mark at msapiro net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan -------------- next part -------------- --- /usr/share/logwatch/scripts/services/mailscanner 2007-01-06 06:08:22.000000000 -0800 +++ /etc/logwatch/scripts/services/mailscanner 2009-04-24 16:33:17.000000000 -0700 @@ -76,7 +76,7 @@ ( $ThisLine =~ m/Read [0-9]+ hostnames from the phishing whitelist/ ) or ( $ThisLine =~ m/completed at [0-9]+ bytes per second/ ) or ( $ThisLine =~ m/Message .+ from .+ to .+ is/ ) or - ( $ThisLine =~ m/^[A-F0-9]+\.[A-F0-9]{5} to/ ) or #for postfix Requeue: + ( $ThisLine =~ m/^[A-F0-9]+\.P?[A-F0-9]{5} to/ ) or #for postfix Requeue: ( $ThisLine =~ m/^calling custom .* function/ ) or ( $ThisLine =~ m/^Initialising database connection/ ) or ( $ThisLine =~ m/^Finished initialising database connection/ ) or From MailScanner at ecs.soton.ac.uk Sat Apr 25 16:30:18 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Sat Apr 25 16:30:37 2009 Subject: MailScanner/Postfix/Logwatch heads up In-Reply-To: <20090425150443.GA1312@msapiro> References: <20090425150443.GA1312@msapiro> <49F32C8A.20504@ecs.soton.ac.uk> Message-ID: On 25/04/2009 16:04, Mark Sapiro wrote: > On Fri, Apr 24, 2009 at 09:32:58AM -0700, Mark Sapiro wrote: > >> If you run MailScanner with Postfix and you run Logwatch, this change >> will cause the " D62EC6903AF.P0113C to C3FEF6903B1" portion of the >> >> Apr 24 09:27:30 sbh16 MailScanner[9194]: Requeue: D62EC6903AF.P0113C to >> C3FEF6903B1 >> >> log entries to be printed as "**Unmatched Entries**" instead of ignored. >> >> The attached lw.patch.txt patch will fix this. >> > > The revised patch attached is better as it doesn't break the logwatch > script for pre 4.76.18 installations. It also fixes a minor line number > discrepancy caused by my not correcting the line number when removing > other patches from the diff. > To save you work, I have found a better way of solving the Postfix problem without adding the "P" so this won't be necessary in the new beta I'm just about to publish. 4.76.20 will hit the streets in a couple of minutes. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Sat Apr 25 16:34:11 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Sat Apr 25 16:34:31 2009 Subject: Signatures... In-Reply-To: <1213490F1F316842A544A850422BFA96239CFE45@BHLSBS.bhl.local> References: <1213490F1F316842A544A850422BFA96239CFDB6@BHLSBS.bhl.local> <49F05017.9010707@ecs.soton.ac.uk> <1213490F1F316842A544A850422BFA96239CFE45@BHLSBS.bhl.local> <49F32D73.6080701@ecs.soton.ac.uk> Message-ID: I have just done an installation on a fresh CentOS 5.3 box and it installs fine. Furthermore, the modules that were removed were not related to Math::BigInt or Math::BigRat, and the module installation order hasn't changed (with respect to Net::CIDR) at all in a very long time, so I suspect your CentOS installation was broken. Jules. On 24/04/2009 12:18, Jason Ede wrote: > I'm trying this beta on a CentOS 5.3 box (just updated from 5.2 to 5.3 and had a working 4.75 ver of MailScanner on it). > > The install fails. That attached log is from the second time of running it... By jiggling the order of the modules in install.sh round I can get it to install, but when I try a --lint it hangs just after Virus Scanning: Clamd found 2 infections for a good couple of minutes. It didn't do this with 4.75. > > [root@smtp ~]# MailScanner --lint > Trying to setlogsock(unix) > Read 852 hostnames from the phishing whitelist > Read 5616 hostnames from the phishing blacklist > Checking version numbers... > Version installed (4.76.17) does not match version stated in > MailScanner.conf file (4.75.11), you may want to run upgrade_MailScanner_conf > to ensure your MailScanner.conf file contains all the latest settings. > > Unrar is not installed, it should be in /usr/local/bin/unrar. > This is required for RAR archives to be read to check > filenames and filetypes. Virus scanning is not affected. > > > Your envelope_sender_header in spam.assassin.prefs.conf is correct. > MailScanner setting GID to (89) > MailScanner setting UID to (89) > > Checking for SpamAssassin errors (if you use it)... > Using SpamAssassin results cache > Connected to SpamAssassin cache database > SpamAssassin reported no errors. > Using locktype = posix > MailScanner.conf says "Virus Scanners = clamd mcafee" > Found these virus scanners installed: clamd, mcafee > =========================================================================== > Filename Checks: Windows/DOS Executable (1 eicar.com) > Other Checks: Found 1 problems > Virus and Content Scanning: Starting > Clamd::INFECTED:: Eicar-Test-Signature :: ./1/ > Clamd::INFECTED:: Eicar-Test-Signature :: ./1/eicar.com > Virus Scanning: Clamd found 2 infections > > ------------ > > /1/eicar.com Found: EICAR test file NOT a virus. > /1.message/icar.com Found: EICAR test file NOT a virus. > Virus Scanning: McAfee found 2 infections > Infected message 1 came from 10.1.1.1 > Virus Scanning: Found 4 viruses > =========================================================================== > > If any of your virus scanners (clamd,mcafee) > are not listed there, you should check that they are installed correctly > and that MailScanner is finding them correctly via its virus.scanners.conf. > > > I'm guessing this is a centos issue since the other box I upgraded to 5.3 is now processing slower than it was before and takes an age to start up. I've looked at the thread MailScanner, CentOS 5 and perl-IO& perl-File-Temp which I guess is related. > > If I then start MailScanner and put an email into the queue nothing happened. I think something is timing out, but don't know where to look. MailScanner -V (output below) takes ages to produce the output below. > > Jason > > MailScanner -V > Running on > Linux smtp.birchenallhowden.com 2.6.18-128.1.6.el5 #1 SMP Wed Apr 1 09:10:25 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux > This is CentOS release 5.3 (Final) > This is Perl version 5.008008 (5.8.8) > > This is MailScanner version 4.76.17 > Module versions are: > 1.00 AnyDBM_File > 1.16 Archive::Zip > 0.23 bignum > 1.04 Carp > 1.41 Compress::Zlib > 1.119 Convert::BinHex > 0.17 Convert::TNEF > 2.121_08 Data::Dumper > 2.27 Date::Parse > 1.00 DirHandle > 1.05 Fcntl > 2.74 File::Basename > 2.09 File::Copy > 2.01 FileHandle > 1.08 File::Path > 0.20 File::Temp > 0.90 Filesys::Df > 1.35 HTML::Entities > 3.56 HTML::Parser > 2.37 HTML::TokeParser > 1.23 IO > 1.14 IO::File > 1.13 IO::Pipe > 2.04 Mail::Header > 1.89 Math::BigInt > 0.22 Math::BigRat > 3.07 MIME::Base64 > 5.427 MIME::Decoder > 5.427 MIME::Decoder::UU > 5.427 MIME::Head > 5.427 MIME::Parser > 3.07 MIME::QuotedPrint > 5.427 MIME::Tools > 0.13 Net::CIDR > 1.25 Net::IP > 0.16 OLE::Storage_Lite > 1.04 Pod::Escapes > 3.05 Pod::Simple > 1.09 POSIX > 1.19 Scalar::Util > 1.78 Socket > 2.16 Storable > 1.4 Sys::Hostname::Long > 0.27 Sys::Syslog > 1.26 Test::Pod > 0.86 Test::Simple > 1.9715 Time::HiRes > 1.02 Time::localtime > > Optional module versions are: > 1.30 Archive::Tar > 0.23 bignum > missing Business::ISBN > missing Business::ISBN::Data > missing Data::Dump > 1.814 DB_File > 1.21 DBD::SQLite > 1.607 DBI > 1.14 Digest > 1.01 Digest::HMAC > 2.36 Digest::MD5 > 2.11 Digest::SHA1 > missing Encode::Detect > 0.17011 Error > missing ExtUtils::CBuilder > missing ExtUtils::ParseXS > 2.38 Getopt::Long > missing Inline > missing IO::String > 1.04 IO::Zlib > missing IP::Country > missing Mail::ClamAV > 3.002004 Mail::SpamAssassin > v2.005 Mail::SPF > 1.999001 Mail::SPF::Query > 0.2808 Module::Build > 0.20 Net::CIDR::Lite > 0.65 Net::DNS > v0.003 Net::DNS::Resolver::Programmable > missing Net::LDAP > 4.007 NetAddr::IP > missing Parse::RecDescent > missing SAVI > 2.64 Test::Harness > missing Test::Manifest > 1.95 Text::Balanced > 1.35 URI > 0.74 version > missing YAML > > >> -----Original Message----- >> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- >> bounces@lists.mailscanner.info] On Behalf Of Julian Field >> Sent: 23 April 2009 12:25 >> To: MailScanner discussion >> Subject: Re: Signatures... >> >> See 4.76.17. You put in the magic token _SIGNATURE_ and it will replace >> it with the inline HTML or text signature, as appropriate. >> >> All done, >> Jules. >> >> On 23/04/2009 11:46, Jason Ede wrote: >> >>> I suspect this will not be an easy if at all viable idea, but here >>> >> goes... >> >>> We currently use the sign clean messages option on our outbound >>> >> emails >> >>> to attach our corporate signature and image and this is appended to >>> the bottom of all outbound emails. >>> >>> This works for the first message we send out, but if we reply to an >>> inbound message then our personal signature (i.e. name and position) >>> from within outlook is put at the bottom of our part of the email, >>> >> and >> >>> then the inline sig is added at the end of the email after the >>> original email. Is it possible to insert the inline sig into the >>> >> email >> >>> at a preset point by putting some form of tag into our signatures >>> >> i.e. >> >>> after my name on a blank line I put<> and the inline sig >>> is inserted at that point within the email and if its not present >>> >> then >> >>> just append at end as normal? >>> >>> I know this will not work at all for signed messages, so if it can be >>> done must be an option and I'm guessing it could add extra processing >>> load to MailScanner? >>> >>> Jason >>> >>> >> Jules >> >> -- >> Julian Field MEng CITP CEng >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> >> Need help customising MailScanner? >> Contact me! >> Need help fixing or optimising your systems? >> Contact me! >> Need help getting you started solving new requirements from your boss? >> Contact me! >> >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> Follow me at twitter.com/JulesFM >> >> >> -- >> This message has been scanned for viruses and >> dangerous content by MailScanner, and is >> believed to be clean. >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From drew.marshall at trunknetworks.com Sat Apr 25 16:56:59 2009 From: drew.marshall at trunknetworks.com (Drew Marshall) Date: Sat Apr 25 16:57:13 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: <20090425133540.225F61701A@out-b.mx.mail-launder.com> References: <20090425133540.225F61701A@out-b.mx.mail-launder.com> Message-ID: <200904251557.n3PFv5hu016731@safir.blacknight.ie> On 25 Apr 2009, at 14:31, Kai Schaetzl wrote: > Paul Hutchings wrote on Sat, 25 Apr 2009 12:07:30 +0100: > >> Any way yet of stopping this happening? > > That's easy, yes: stop quoting and quoting and quoting and quoting. > Mail programs have a built-in threading mechanism, even Microsoft > programs. If you rely on it there is no need to endlessly quote > completely > unnecessary text. A good mail program will also skip the signature > when > quoting, so it won't ever get added to your reply even if you do a > "full > quote". Kai I do wish I could live in your idilic world. Sadly users (Both clients, suppliers and your own staff) just don't do that. The only client I know of that provides a 'Reply with out quoting' option is Lotus Notes but then you get a reply without your question so you are no better off (And often worse off). Sadly the world I live in is full of Microsoft Outlook users who hit reply and start typing, no snipping and all top posting. I am sure you would hate them all :-) > This has really nothing to do with MailScanner. Well, in my world, MailScanner adds them and no one takes them away so I suppose the point of 'blame' should be MailScanner. You are right in so much as MS is doing what it's told, so it's not it's fault but it would be cool if old signatures could be removed. Here in the UK companies are legally bound to use such things so simply not having them is not possible. I wonder if it would be possible to use the _SIGNATURE_ special word to perhaps add some form of unique additional identifier to a signature so when it sees it next time, it is removed. A little like the watermark but actually in the signature in some way. Drew PS All bar the last paragraph of this was written tongue in cheek and with out any form of upset or offence intended! From MailScanner at ecs.soton.ac.uk Sat Apr 25 17:17:42 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Sat Apr 25 17:18:10 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: <200904251557.n3PFv5hu016731@safir.blacknight.ie> References: <20090425133540.225F61701A@out-b.mx.mail-launder.com> <200904251557.n3PFv5hu016731@safir.blacknight.ie> <49F337A6.6000304@ecs.soton.ac.uk> Message-ID: On 25/04/2009 16:56, Drew Marshall wrote: > You are right in so much as MS is doing what it's told, so it's not > it's fault but it would be cool if old signatures could be removed. > Here in the UK companies are legally bound to use such things so > simply not having them is not possible. I wonder if it would be > possible to use the _SIGNATURE_ special word to perhaps add some form > of unique additional identifier to a signature so when it sees it next > time, it is removed. A little like the watermark but actually in the > signature in some way. There is Allow Multiple HTML Signatures = no which uses a marker in the HTML Signature to know not to add the signature again, but with text signatures there is no way of inserting "hidden text" in any way so that we would know not to add the signature again. There is also Dont Sign HTML If Headers Exist = # In-Reply-To: References: so it detects when not to add the HTML signature. Unfortunately I can't tell if the text signature has already been added, without searching the entire message for signs of the signature, which would be really slow and unreliable as a correspondent's email app may have re-wrapped the text in the message, so you can't just search for matching lines. It would be very slow with multi-line sigs especially. So that's not really practical. If you have any great ideas that might help solve this problem, then give me a shout. It is easy for HTML signatures as you can look for signs of the previous copy of the sig, but you can't do that as simply with text messages. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From lists at openenterprise.ca Sat Apr 25 18:59:52 2009 From: lists at openenterprise.ca (Johnny Stork) Date: Sat Apr 25 19:00:01 2009 Subject: FSL MailScanner Beta Yum Repo Message-ID: <49F34F98.6000509@openenterprise.ca> I thought I would finally try to move my existing MS 4.72.5 system to use the FSL MailScanner Beta repo, but on first run, to no surprise, I get mostly conflict errors. Should I force the first install? Or is there some other prefered.better way to move to this repo from FSL? Transaction Check Error: file /usr/bin/cdcc from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /usr/bin/dccproc from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /var/dcc/cgi-bin/README from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /var/dcc/cgi-bin/chgpasswd from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 ..... -- _____________________________________________ Johnny Stork Open Enterprise Solutions "Empowering Business With Open Solutions" http://www.openenterprise.ca Mountain Hosting "Secure Hosting Solutions for Business" http://www.mountainhosting.ca From steve.freegard at fsl.com Sat Apr 25 19:27:25 2009 From: steve.freegard at fsl.com (Steve Freegard) Date: Sat Apr 25 19:27:35 2009 Subject: FSL MailScanner Beta Yum Repo In-Reply-To: <49F34F98.6000509@openenterprise.ca> References: <49F34F98.6000509@openenterprise.ca> Message-ID: <49F3560D.1070600@fsl.com> Johnny Stork wrote: > I thought I would finally try to move my existing MS 4.72.5 system to > use the FSL MailScanner Beta repo, but on first run, to no surprise, I > get mostly conflict errors. Should I force the first install? Or is > there some other prefered.better way to move to this repo from FSL? > > > Transaction Check Error: > file /usr/bin/cdcc from install of fsl-dcc-clients-1.3.95-1.i386 > conflicts with file from package dcc-1.3.59-0.rhel5.i386 > file /usr/bin/dccproc from install of fsl-dcc-clients-1.3.95-1.i386 > conflicts with file from package dcc-1.3.59-0.rhel5.i386 > file /var/dcc/cgi-bin/README from install of > fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package > dcc-1.3.59-0.rhel5.i386 > file /var/dcc/cgi-bin/chgpasswd from install of > fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package > dcc-1.3.59-0.rhel5.i386 > ..... > Are all the conflicts from the dcc package?? If so 'rpm -e dcc' then 'yum groupinstall MailScannerGold'. This is better discussed on the fsl-mailscanner-beta list created specially for the help with the repos: http://listserv.fsl.com/mailman/listinfo/fsl-mailscanner-beta Regards, Steve. From lists at openenterprise.ca Sat Apr 25 19:52:24 2009 From: lists at openenterprise.ca (Johnny Stork) Date: Sat Apr 25 19:52:32 2009 Subject: FSL MailScanner Beta Yum Repo In-Reply-To: <49F3560D.1070600@fsl.com> References: <49F34F98.6000509@openenterprise.ca> <49F3560D.1070600@fsl.com> Message-ID: <49F35BE8.7030707@openenterprise.ca> No, I just cut the list short...its very long...full list below Transaction Check Error: file /usr/bin/cdcc from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /usr/bin/dccproc from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /var/dcc/cgi-bin/README from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /var/dcc/cgi-bin/chgpasswd from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /var/dcc/cgi-bin/common from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /var/dcc/cgi-bin/edit-whiteclnt from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /var/dcc/cgi-bin/footer from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /var/dcc/cgi-bin/header from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /var/dcc/cgi-bin/http2https from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /var/dcc/cgi-bin/list-log from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /var/dcc/cgi-bin/list-msg from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /var/dcc/cgi-bin/webuser-notify from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /var/dcc/dcc_conf from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /var/dcc/flod from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /var/dcc/grey_flod from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /var/dcc/ids from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /var/dcc/map from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /var/dcc/map.txt from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /var/dcc/whiteclnt from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /var/dcc/whitecommon from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /var/dcc/whitelist from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.59-0.rhel5.i386 file /usr/bin/cdcc from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /usr/bin/dccproc from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/cgi-bin/README from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/cgi-bin/chgpasswd from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/cgi-bin/common from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/cgi-bin/edit-whiteclnt from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/cgi-bin/footer from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/cgi-bin/header from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/cgi-bin/http2https from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/cgi-bin/list-log from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/cgi-bin/list-msg from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/cgi-bin/webuser-notify from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/dcc_conf from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/flod from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/grey_flod from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/ids from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/libexec/cron-dccd from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/libexec/dcc-stats-collect from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/libexec/dcc-stats-graph from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/libexec/dcc-stats-init from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/libexec/dccsight from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/libexec/fetch-testmsg-whitelist from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/libexec/fetchblack from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/libexec/fetchids from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/libexec/hackmc from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/libexec/list-clients from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/libexec/logger from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/libexec/newwebuser from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/libexec/rcDCC from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/libexec/start-dccd from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/libexec/start-dccifd from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/libexec/start-dccm from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/libexec/start-grey from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/libexec/stats-get from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/libexec/stop-dccd from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/libexec/uninstalldcc from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/libexec/updatedcc from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/libexec/wlist from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/map from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/map.txt from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /var/dcc/whiteclnt from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.92-2.rhel5.i386 file /usr/bin/cdcc from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.95-2.rhel5.i386 file /usr/bin/dccproc from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.95-2.rhel5.i386 file /var/dcc/cgi-bin/chgpasswd from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.95-2.rhel5.i386 file /var/dcc/cgi-bin/webuser-notify from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.95-2.rhel5.i386 file /var/dcc/dcc_conf from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.95-2.rhel5.i386 file /var/dcc/ids from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.95-2.rhel5.i386 file /var/dcc/libexec/dcc-stats-collect from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.95-2.rhel5.i386 file /var/dcc/libexec/dcc-stats-graph from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.95-2.rhel5.i386 file /var/dcc/libexec/dcc-stats-init from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.95-2.rhel5.i386 file /var/dcc/libexec/dccsight from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.95-2.rhel5.i386 file /var/dcc/libexec/newwebuser from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.95-2.rhel5.i386 file /var/dcc/libexec/rcDCC from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.95-2.rhel5.i386 file /var/dcc/libexec/updatedcc from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.95-2.rhel5.i386 file /var/dcc/libexec/wlist from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.95-2.rhel5.i386 file /var/dcc/map from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.95-2.rhel5.i386 file /var/dcc/map.txt from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.95-2.rhel5.i386 file /usr/bin/cdcc from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /usr/bin/dccproc from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/cgi-bin/README from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/cgi-bin/chgpasswd from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/cgi-bin/common from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/cgi-bin/edit-whiteclnt from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/cgi-bin/footer from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/cgi-bin/http2https from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/cgi-bin/list-log from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/cgi-bin/list-msg from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/cgi-bin/webuser-notify from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/dcc_conf from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/flod from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/grey_flod from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/ids from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/libexec/cron-dccd from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/libexec/dcc-stats-collect from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/libexec/dcc-stats-graph from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/libexec/dcc-stats-init from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/libexec/dccsight from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/libexec/fetch-testmsg-whitelist from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/libexec/fetchblack from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/libexec/fetchids from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/libexec/hackmc from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/libexec/list-clients from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/libexec/logger from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/libexec/newwebuser from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/libexec/rcDCC from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/libexec/start-dccd from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/libexec/start-dccifd from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/libexec/start-dccm from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/libexec/start-grey from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/libexec/stats-get from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/libexec/stop-dccd from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/libexec/uninstalldcc from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/libexec/updatedcc from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/libexec/wlist from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/map from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/map.txt from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /var/dcc/whiteclnt from install of fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package dcc-1.3.99-2.rhel5.i386 file /etc/mail/spamassassin/local.cf from install of fsl-spamassassin-3.2.5-2.i386 conflicts with file from package spamassassin-3.2.5-4.rhel5.i386 file /etc/mail/spamassassin/spamassassin-default.rc from install of fsl-spamassassin-3.2.5-2.i386 conflicts with file from package spamassassin-3.2.5-4.rhel5.i386 file /etc/mail/spamassassin/v310.pre from install of fsl-spamassassin-3.2.5-2.i386 conflicts with file from package spamassassin-3.2.5-4.rhel5.i386 file /etc/sysconfig/spamassassin from install of fsl-spamassassin-3.2.5-2.i386 conflicts with file from package spamassassin-3.2.5-4.rhel5.i386 file /usr/bin/sa-compile from install of fsl-spamassassin-3.2.5-2.i386 conflicts with file from package spamassassin-3.2.5-4.rhel5.i386 file /usr/bin/sa-learn from install of fsl-spamassassin-3.2.5-2.i386 conflicts with file from package spamassassin-3.2.5-4.rhel5.i386 file /usr/bin/sa-update from install of fsl-spamassassin-3.2.5-2.i386 conflicts with file from package spamassassin-3.2.5-4.rhel5.i386 file /usr/bin/spamassassin from install of fsl-spamassassin-3.2.5-2.i386 conflicts with file from package spamassassin-3.2.5-4.rhel5.i386 file /usr/bin/spamc from install of fsl-spamassassin-3.2.5-2.i386 conflicts with file from package spamassassin-3.2.5-4.rhel5.i386 file /usr/bin/spamd from install of fsl-spamassassin-3.2.5-2.i386 conflicts with file from package spamassassin-3.2.5-4.rhel5.i386 file /usr/share/man/man1/sa-compile.1.gz from install of fsl-spamassassin-3.2.5-2.i386 conflicts with file from package spamassassin-3.2.5-4.rhel5.i386 file /usr/share/man/man1/sa-learn.1.gz from install of fsl-spamassassin-3.2.5-2.i386 conflicts with file from package spamassassin-3.2.5-4.rhel5.i386 file /usr/share/man/man1/sa-update.1.gz from install of fsl-spamassassin-3.2.5-2.i386 conflicts with file from package spamassassin-3.2.5-4.rhel5.i386 file /usr/share/man/man1/spamassassin-run.1.gz from install of fsl-spamassassin-3.2.5-2.i386 conflicts with file from package spamassassin-3.2.5-4.rhel5.i386 file /usr/share/man/man1/spamassassin.1.gz from install of fsl-spamassassin-3.2.5-2.i386 conflicts with file from package spamassassin-3.2.5-4.rhel5.i386 file /usr/share/man/man1/spamc.1.gz from install of fsl-spamassassin-3.2.5-2.i386 conflicts with file from package spamassassin-3.2.5-4.rhel5.i386 file /usr/share/man/man1/spamd.1.gz from install of fsl-spamassassin-3.2.5-2.i386 conflicts with file from package spamassassin-3.2.5-4.rhel5.i386 file /usr/share/spamassassin/sa-update.cron from install of fsl-spamassassin-3.2.5-2.i386 conflicts with file from package spamassassin-3.2.5-4.rhel5.i386 Steve Freegard wrote: > Johnny Stork wrote: > >> I thought I would finally try to move my existing MS 4.72.5 system to >> use the FSL MailScanner Beta repo, but on first run, to no surprise, I >> get mostly conflict errors. Should I force the first install? Or is >> there some other prefered.better way to move to this repo from FSL? >> >> >> Transaction Check Error: >> file /usr/bin/cdcc from install of fsl-dcc-clients-1.3.95-1.i386 >> conflicts with file from package dcc-1.3.59-0.rhel5.i386 >> file /usr/bin/dccproc from install of fsl-dcc-clients-1.3.95-1.i386 >> conflicts with file from package dcc-1.3.59-0.rhel5.i386 >> file /var/dcc/cgi-bin/README from install of >> fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package >> dcc-1.3.59-0.rhel5.i386 >> file /var/dcc/cgi-bin/chgpasswd from install of >> fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package >> dcc-1.3.59-0.rhel5.i386 >> ..... >> >> > > Are all the conflicts from the dcc package?? If so 'rpm -e dcc' then > 'yum groupinstall MailScannerGold'. > > This is better discussed on the fsl-mailscanner-beta list created > specially for the help with the repos: > http://listserv.fsl.com/mailman/listinfo/fsl-mailscanner-beta > > Regards, > Steve. > -- _____________________________________________ Johnny Stork Open Enterprise Solutions "Empowering Business With Open Solutions" http://www.openenterprise.ca Mountain Hosting "Secure Hosting Solutions for Business" http://www.mountainhosting.ca -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090425/ae2e0e69/attachment-0001.html From lists at openenterprise.ca Sat Apr 25 19:53:19 2009 From: lists at openenterprise.ca (Johnny Stork) Date: Sat Apr 25 19:53:18 2009 Subject: FSL MailScanner Beta Yum Repo In-Reply-To: <49F3560D.1070600@fsl.com> References: <49F34F98.6000509@openenterprise.ca> <49F3560D.1070600@fsl.com> Message-ID: <49F35C1F.6040009@openenterprise.ca> Yes I just noticed that list after sending so have now joined Steve Freegard wrote: > Johnny Stork wrote: > >> I thought I would finally try to move my existing MS 4.72.5 system to >> use the FSL MailScanner Beta repo, but on first run, to no surprise, I >> get mostly conflict errors. Should I force the first install? Or is >> there some other prefered.better way to move to this repo from FSL? >> >> >> Transaction Check Error: >> file /usr/bin/cdcc from install of fsl-dcc-clients-1.3.95-1.i386 >> conflicts with file from package dcc-1.3.59-0.rhel5.i386 >> file /usr/bin/dccproc from install of fsl-dcc-clients-1.3.95-1.i386 >> conflicts with file from package dcc-1.3.59-0.rhel5.i386 >> file /var/dcc/cgi-bin/README from install of >> fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package >> dcc-1.3.59-0.rhel5.i386 >> file /var/dcc/cgi-bin/chgpasswd from install of >> fsl-dcc-clients-1.3.95-1.i386 conflicts with file from package >> dcc-1.3.59-0.rhel5.i386 >> ..... >> >> > > Are all the conflicts from the dcc package?? If so 'rpm -e dcc' then > 'yum groupinstall MailScannerGold'. > > This is better discussed on the fsl-mailscanner-beta list created > specially for the help with the repos: > http://listserv.fsl.com/mailman/listinfo/fsl-mailscanner-beta > > Regards, > Steve. > -- _____________________________________________ Johnny Stork Open Enterprise Solutions "Empowering Business With Open Solutions" http://www.openenterprise.ca Mountain Hosting "Secure Hosting Solutions for Business" http://www.mountainhosting.ca -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090425/1a989258/attachment.html From mgt at stellarcore.net Sat Apr 25 20:10:00 2009 From: mgt at stellarcore.net (Mike Tremaine) Date: Sat Apr 25 20:10:13 2009 Subject: Subject: Re: MailScanner/Postfix/Logwatch heads up In-Reply-To: <200904251857.n3PIvatY024888@safir.blacknight.ie> References: <200904251857.n3PIvatY024888@safir.blacknight.ie> Message-ID: <49F36008.4060907@stellarcore.net> > > On 25/04/2009 16:04, Mark Sapiro wrote: >> > On Fri, Apr 24, 2009 at 09:32:58AM -0700, Mark Sapiro wrote: >> > >> >>> >> If you run MailScanner with Postfix and you run Logwatch, this change >>> >> will cause the " D62EC6903AF.P0113C to C3FEF6903B1" portion of the >>> >> >>> >> Apr 24 09:27:30 sbh16 MailScanner[9194]: Requeue: D62EC6903AF.P0113C to >>> >> C3FEF6903B1 >>> >> >>> >> log entries to be printed as "**Unmatched Entries**" instead of ignored. >>> >> >>> >> The attached lw.patch.txt patch will fix this. >>> >> >>> >> > >> > The revised patch attached is better as it doesn't break the logwatch >> > script for pre 4.76.18 installations. It also fixes a minor line number >> > discrepancy caused by my not correcting the line number when removing >> > other patches from the diff. >> > >> > To save you work, I have found a better way of solving the Postfix > problem without adding the "P" so this won't be necessary in the new > beta I'm just about to publish. 4.76.20 will hit the streets in a couple > of minutes. > > Jules > I'm happy to patch the logwatch cvs tree with this, but sounds like Julian is all over it so I'll hold off. -Mike From maillists at conactive.com Sat Apr 25 21:31:26 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Sat Apr 25 21:31:36 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: <200904251557.n3PFv5hu016731@safir.blacknight.ie> References: <20090425133540.225F61701A@out-b.mx.mail-launder.com> <200904251557.n3PFv5hu016731@safir.blacknight.ie> Message-ID: Drew Marshall wrote on Sat, 25 Apr 2009 16:56:59 +0100: > The only > client I know of that provides a 'Reply with out quoting' option This is something different. A good client removes the signature from the full quote (not the whole quote ;-). Mine does it and I remember that Outlook Express did it as well. As long as you just take what you get as a given you will get broken programs. Complain to the manufacturer if you want a change in the program you use. Yes, it matters. > Sadly the world I live in is full > of Microsoft Outlook users who hit reply and start typing, no snipping > and all top posting. You can still refrain from that yourself. That cuts the whole thing *extremely* well. e.g. if you just quote their last answer and snip what they quote *they* don't have a chance to build up a pile of quoted text. You are not forced in any way to "requote" their quote. > Well, in my world, MailScanner adds them and no one takes them away so > I suppose the point of 'blame' should be MailScanner. Wrong. The issue occurs no matter which way you add the signature, be that client or gateway (=MailScanner) or manually. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Sat Apr 25 21:31:26 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Sat Apr 25 21:31:37 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: References: <20090425133540.225F61701A@out-b.mx.mail-launder.com> <200904251557.n3PFv5hu016731@safir.blacknight.ie> <49F337A6.6000304@ecs.soton.ac.uk> Message-ID: Julian Field wrote on Sat, 25 Apr 2009 17:17:42 +0100: > There is > Allow Multiple HTML Signatures = no > which uses a marker in the HTML Signature to know not to add the > signature again, but with text signatures there is no way of inserting > "hidden text" in any way so that we would know not to add the signature > again. > There is also > Dont Sign HTML If Headers Exist = # In-Reply-To: References: > so it detects when not to add the HTML signature. Unfortunately I can't > tell if the text signature has already been added, without searching the > entire message for signs of the signature, which would be really slow > and unreliable as a correspondent's email app may have re-wrapped the > text in the message, so you can't just search for matching lines. It > would be very slow with multi-line sigs especially. I don't think this applies here, HTML or not. As I understand the point is that sending a message back and forth between two correspondents four times you may have 8 signatures in the end, most of them somewhere in the quoted text. He wants to have these signatures removed if I understand correctly. The options you mention can help with accidental double-adding of a signature by MailScanner (not sure in which scenario that could happen, maybe if you have more than one gateway server and all of them could be used), but not if a signature is already present somewhere deep in the mail, right? One possible way with text signatures might be to remove all lines that start with a signature marker and the next lines until it reaches a blank line or exceeds four lines. Might FP sometimes. But for that you have to scan the message completely. As I understand you wanted to avoid this. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From craigwhite at azapple.com Sat Apr 25 22:16:05 2009 From: craigwhite at azapple.com (Craig White) Date: Sat Apr 25 22:16:25 2009 Subject: New beta 4.76.16 In-Reply-To: References: <49F02E0B.8090502@ecs.soton.ac.uk> Message-ID: <1240694165.9602.635.camel@lin-workstation.azapple.com> On Thu, 2009-04-23 at 09:59 +0100, Julian Field wrote: > There have been a few changes recently, including the Postfix > processing-messages database fix and changes to the installer. > So I have just released a new beta for you to try, which should solve > all the outstanding issues. > It's 4.76.16 and you can download it from www.mailscanner.info as usual. > > Please give it a try! ---- I'm uncertain that I have enough knowledge to be too helpful here. I think that the build order of the perl packages is wrong CentOS 5.3, MailScanner-4.76.20-1 executed ./install.sh reinstall halted installation after removal of MailScanner perl packages, did a normal yum update and continued the MailScanner process and noticed this happen... Attempting to build and install perl-Net-CIDR-0.13-1 Installing perl-Net-CIDR-0.13-1.src.rpm Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.67171 + umask 022 + cd /usr/src/redhat/BUILD + LANG=C + export LANG + unset DISPLAY + cd /usr/src/redhat/BUILD + rm -rf Net-CIDR-0.13 + /bin/gzip -dc /usr/src/redhat/SOURCES/Net-CIDR-0.13.tar.gz + make test PERL_DL_NONLAZY=1 /usr/bin/perl "-Iblib/lib" "-Iblib/arch" test.pl 1..1 Can't locate Math/BigInt.pm in @INC (@INC contains: blib/lib blib/arch /usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.8 /usr/lib/perl5/site_perl/5.8.7 /usr/lib/perl5/site_perl/5.8.6 /usr/lib/perl5/site_perl/5.8.5 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.8.8/i386 -linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.8 /usr/lib/perl5/vendor_perl/5.8.7 /usr/lib/perl5/vendor_perl/5.8.6 /usr/lib/perl5/vendor_perl/5.8.5 /usr /lib/perl5/vendor_perl /usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.7/i386-linux-thread-multi /usr/lib/perl5/site_per l/5.8.6/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.5/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.8 /usr/lib/perl5/site_perl/5.8.7 /usr/li b/perl5/site_perl/5.8.6 /usr/lib/perl5/site_perl/5.8.5 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.8.8/i386-linux-thread-multi /usr/lib/perl5/vend or_perl/5.8.7/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.6/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.5/i386-linux-thread-multi /usr /lib/perl5/vendor_perl/5.8.8 /usr/lib/perl5/vendor_perl/5.8.7 /usr/lib/perl5/vendor_perl/5.8.6 /usr/lib/perl5/vendor_perl/5.8.5 /usr/lib/perl5/vendor_perl / usr/lib/perl5/5.8.8/i386-linux-thread-multi /usr/lib/perl5/5.8.8 .) at blib/lib/Net/CIDR.pm line 22. BEGIN failed--compilation aborted at blib/lib/Net/CIDR.pm line 22. Compilation failed in require at test.pl line 11. BEGIN failed--compilation aborted at test.pl line 11. not ok 1 make: *** [test_dynamic] Error 2 error: Bad exit status from /var/tmp/rpm-tmp.67171 (%build) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.67171 (%build) and so I couldn't restart MailScanner service but afterwards, I was able to build it separately and install it... # rpmbuild --rebuild perl-Net-CIDR-0.13-1.src.rpm # rpm -ivh /usr/src/redhat/RPMS/noarch/perl-Net-CIDR-0.1 perl-Net-CIDR-0.11-2.noarch.rpm perl-Net-CIDR-0.13-1.noarch.rpm [root@srv1 MailScanner-4.76.20-1]# rpm -ivh /usr/src/redhat/RPMS/noarch/perl-Net-CIDR-0.13-1.noarch.rpm Preparing... ########################################### [100%] 1:perl-Net-CIDR ########################################### [100%] and then of course, MailScanner could start Craig -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From mark at msapiro.net Sat Apr 25 23:23:14 2009 From: mark at msapiro.net (Mark Sapiro) Date: Sat Apr 25 23:23:23 2009 Subject: MailScanner/Postfix/Logwatch heads up In-Reply-To: References: <20090425150443.GA1312@msapiro> <49F32C8A.20504@ecs.soton.ac.uk> Message-ID: <20090425222314.GA2556@msapiro> On Sat, Apr 25, 2009 at 04:30:18PM +0100, Julian Field wrote: > > To save you work, I have found a better way of solving the Postfix > problem without adding the "P" so this won't be necessary in the new > beta I'm just about to publish. 4.76.20 will hit the streets in a couple > of minutes. I have installed 4.76.20 with the $sth->bind_param(1, "$id", SQL_VARCHAR); $sth->execute(); change to MessageBatch.pm. I am sad to report it doesn't work. I have a residual entry already # MailScanner --processing=0 Currently being processed: Number of messages: 1 Tries Message Next Try At ===== ======= =========== 1 28356690403.09691 Sat Apr 25 15:05:00 2009 # I am going to add the 'P' back at least temporarily. -- Mark Sapiro mark at msapiro net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From MailScanner at ecs.soton.ac.uk Sun Apr 26 10:08:14 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Sun Apr 26 10:08:36 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: References: <20090425133540.225F61701A@out-b.mx.mail-launder.com> <200904251557.n3PFv5hu016731@safir.blacknight.ie> <49F337A6.6000304@ecs.soton.ac.uk> <49F4247E.2090404@ecs.soton.ac.uk> Message-ID: On 25/04/2009 21:31, Kai Schaetzl wrote: > Julian Field wrote on Sat, 25 Apr 2009 17:17:42 +0100: > > >> There is >> Allow Multiple HTML Signatures = no >> which uses a marker in the HTML Signature to know not to add the >> signature again, but with text signatures there is no way of inserting >> "hidden text" in any way so that we would know not to add the signature >> again. >> There is also >> Dont Sign HTML If Headers Exist = # In-Reply-To: References: >> so it detects when not to add the HTML signature. Unfortunately I can't >> tell if the text signature has already been added, without searching the >> entire message for signs of the signature, which would be really slow >> and unreliable as a correspondent's email app may have re-wrapped the >> text in the message, so you can't just search for matching lines. It >> would be very slow with multi-line sigs especially. >> > I don't think this applies here, HTML or not. As I understand the point is > that sending a message back and forth between two correspondents four times > you may have 8 signatures in the end, most of them somewhere in the quoted > text. He wants to have these signatures removed if I understand correctly. > > The options you mention can help with accidental double-adding of a > signature by MailScanner (not sure in which scenario that could happen, > maybe if you have more than one gateway server and all of them could be > used), but not if a signature is already present somewhere deep in the > mail, right? > That scenario does occur and I have already taken care of it, see the "Sign Messages Already Processed" option in MailScanner.conf. > One possible way with text signatures might be to remove all lines that > start with a signature marker and the next lines until it reaches a blank > line or exceeds four lines. Might FP sometimes. But for that you have to > scan the message completely. As I understand you wanted to avoid this. > Exactly, I don't want to have to do that, it'll slow things down quite a lot for every message, when you're only trying to target a tiny fraction of messages. I would rather leave it to the mail clients to correctly chop off the sig when they quote the message text in a reply or forward. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Sun Apr 26 10:11:59 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Sun Apr 26 10:12:23 2009 Subject: New beta 4.76.16 In-Reply-To: <1240694165.9602.635.camel@lin-workstation.azapple.com> References: <49F02E0B.8090502@ecs.soton.ac.uk> <1240694165.9602.635.camel@lin-workstation.azapple.com> <49F4255F.7090500@ecs.soton.ac.uk> Message-ID: On 25/04/2009 22:16, Craig White wrote: > On Thu, 2009-04-23 at 09:59 +0100, Julian Field wrote: > >> There have been a few changes recently, including the Postfix >> processing-messages database fix and changes to the installer. >> So I have just released a new beta for you to try, which should solve >> all the outstanding issues. >> It's 4.76.16 and you can download it from www.mailscanner.info as usual. >> >> Please give it a try! >> > ---- > I'm uncertain that I have enough knowledge to be too helpful here. I > think that the build order of the perl packages is wrong > > CentOS 5.3, MailScanner-4.76.20-1 > > executed ./install.sh reinstall > > halted installation after removal of MailScanner perl packages, did a > normal yum update and continued the MailScanner process and noticed this > happen... > You don't have to do that any more, certainly not once you have installed a 4.76 version *once*. As of 4.76.12, none of the Perl modules get in the way of Perl's updates. > Attempting to build and install perl-Net-CIDR-0.13-1 > Installing perl-Net-CIDR-0.13-1.src.rpm > Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.67171 > + umask 022 > + cd /usr/src/redhat/BUILD > + LANG=C > + export LANG > + unset DISPLAY > + cd /usr/src/redhat/BUILD > + rm -rf Net-CIDR-0.13 > + /bin/gzip -dc /usr/src/redhat/SOURCES/Net-CIDR-0.13.tar.gz > > > > + make test > PERL_DL_NONLAZY=1 /usr/bin/perl "-Iblib/lib" "-Iblib/arch" test.pl > 1..1 > Can't locate Math/BigInt.pm in @INC (@INC contains: blib/lib > This only appears to happen to CentOS 5.2 systems that have been upgraded to 5.3. It does not happen on clean 5.3 installations, I tried it. I'll do a clean install on 5.3 with Net::CIDR moved to after bignum, BigRat and BigInt and see if it still works okay. But I still don't see why this is suddenly a problem for you, I have not changed the module installation order for a *very* long time. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Sun Apr 26 10:13:30 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Sun Apr 26 10:13:50 2009 Subject: MailScanner/Postfix/Logwatch heads up In-Reply-To: <20090425222314.GA2556@msapiro> References: <20090425150443.GA1312@msapiro> <49F32C8A.20504@ecs.soton.ac.uk> <20090425222314.GA2556@msapiro> <49F425BA.80703@ecs.soton.ac.uk> Message-ID: On 25/04/2009 23:23, Mark Sapiro wrote: > On Sat, Apr 25, 2009 at 04:30:18PM +0100, Julian Field wrote: > >> To save you work, I have found a better way of solving the Postfix >> problem without adding the "P" so this won't be necessary in the new >> beta I'm just about to publish. 4.76.20 will hit the streets in a couple >> of minutes. >> > > I have installed 4.76.20 with the > > $sth->bind_param(1, "$id", SQL_VARCHAR); > $sth->execute(); > > change to MessageBatch.pm. I am sad to report it doesn't work. > Bother. :-( And I tried it out too, and it worked for me. I'm going to add a letter in the range A-F instead of P, so that the MailWatch regexp doesn't need changing. I'm sure 'A' will work around the problem just as well as 'P' did, and has no consequences. > I have a residual entry already > > # MailScanner --processing=0 > Currently being processed: > > Number of messages: 1 > Tries Message Next Try At > ===== ======= =========== > 1 28356690403.09691 Sat Apr 25 15:05:00 2009 > # > > I am going to add the 'P' back at least temporarily. > > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Sun Apr 26 10:32:35 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Sun Apr 26 10:32:51 2009 Subject: 4.76.21 References: <49F42A33.7080203@ecs.soton.ac.uk> Message-ID: I have changed the Postfix message id code again. It now replaces the first character after the ".", which would always have been 0 in recent versions anyway, with an "A". This means it cannot be interpreted as a number and so should solve the problem. I have moved Net::CIDR right down near the bottom of the module installation process, after Math::BigInt which it needs for testing. On some upgraded systems, the Math::BigInt module is not available after upgrading the operating system. Note that you no longer need to use the "--reinstall" option at all. I have left it in, but it should no longer be needed. If it detects a pre-big-sort-out installation of MailScanner, it will automatically do it anyway. And post-big-sort-out systems no longer require it as none of the modules clash with Perl's rpm anyway. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From paul.hutchings at mira.co.uk Sun Apr 26 11:31:12 2009 From: paul.hutchings at mira.co.uk (Paul Hutchings) Date: Sun Apr 26 11:31:26 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: References: Message-ID: Hmm.. well we use Outlook 2003/2007 and realistically I can't expect any of our few hundred users to go out of their way when replying to an email - they just want to hit reply and start typing. Does anyone know if there is anything that Outlook and popular mail clients will recognize as a signature and treat differently? Our current signature will be added to this so you can see what we're doing currently. Cheers, Paul -- MIRA Ltd Watling Street, Nuneaton, Warwickshire, CV10 0TU, England. Registered in England and Wales No. 402570 VAT Registration GB 114 5409 96 The contents of this e-mail are confidential and are solely for the use of the intended recipient. If you receive this e-mail in error, please delete it and notify us either by e-mail, telephone or fax. You should not copy, forward or otherwise disclose the content of the e-mail as this is prohibited. From MailScanner at ecs.soton.ac.uk Sun Apr 26 11:57:43 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Sun Apr 26 11:58:04 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: References: <49F43E27.60704@ecs.soton.ac.uk> Message-ID: Well Thunderbird handled that correctly and chopped off your sig when I thumped Reply. See below :-) On 26/04/2009 11:31, Paul Hutchings wrote: > Hmm.. well we use Outlook 2003/2007 and realistically I can't expect any > of our few hundred users to go out of their way when replying to an > email - they just want to hit reply and start typing. > > Does anyone know if there is anything that Outlook and popular mail > clients will recognize as a signature and treat differently? > > Our current signature will be added to this so you can see what we're > doing currently. > > Cheers, > Paul > > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From craigwhite at azapple.com Sun Apr 26 14:04:18 2009 From: craigwhite at azapple.com (Craig White) Date: Sun Apr 26 14:04:36 2009 Subject: New beta 4.76.16 In-Reply-To: References: <49F02E0B.8090502@ecs.soton.ac.uk> <1240694165.9602.635.camel@lin-workstation.azapple.com> <49F4255F.7090500@ecs.soton.ac.uk> Message-ID: <1240751058.1902.15.camel@lin-workstation.azapple.com> On Sun, 2009-04-26 at 10:11 +0100, Julian Field wrote: > On 25/04/2009 22:16, Craig White wrote: > > On Thu, 2009-04-23 at 09:59 +0100, Julian Field wrote: > > > >> There have been a few changes recently, including the Postfix > >> processing-messages database fix and changes to the installer. > >> So I have just released a new beta for you to try, which should solve > >> all the outstanding issues. > >> It's 4.76.16 and you can download it from www.mailscanner.info as usual. > >> > >> Please give it a try! > >> > > ---- > > I'm uncertain that I have enough knowledge to be too helpful here. I > > think that the build order of the perl packages is wrong > > > > CentOS 5.3, MailScanner-4.76.20-1 > > > > executed ./install.sh reinstall > > > > halted installation after removal of MailScanner perl packages, did a > > normal yum update and continued the MailScanner process and noticed this > > happen... > > > You don't have to do that any more, certainly not once you have > installed a 4.76 version *once*. As of 4.76.12, none of the Perl modules > get in the way of Perl's updates. ---- this was an upgrade over stable 4.74.16-1, sorry, I should have made that clear. figured, it was the mail server at my house and that I could try out your beta since you were putting so much effort in it. ---- > > Attempting to build and install perl-Net-CIDR-0.13-1 > > Installing perl-Net-CIDR-0.13-1.src.rpm > > Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.67171 > > + umask 022 > > + cd /usr/src/redhat/BUILD > > + LANG=C > > + export LANG > > + unset DISPLAY > > + cd /usr/src/redhat/BUILD > > + rm -rf Net-CIDR-0.13 > > + /bin/gzip -dc /usr/src/redhat/SOURCES/Net-CIDR-0.13.tar.gz > > > > > > > > + make test > > PERL_DL_NONLAZY=1 /usr/bin/perl "-Iblib/lib" "-Iblib/arch" test.pl > > 1..1 > > Can't locate Math/BigInt.pm in @INC (@INC contains: blib/lib > > > This only appears to happen to CentOS 5.2 systems that have been > upgraded to 5.3. It does not happen on clean 5.3 installations, I tried > it. I'll do a clean install on 5.3 with Net::CIDR moved to after bignum, > BigRat and BigInt and see if it still works okay. > > But I still don't see why this is suddenly a problem for you, I have not > changed the module installation order for a *very* long time. ---- this indeed was a CentOS 5.2 installation that was upgraded to 5.3 a couple of weeks ago. this was a 4.74.16 installation of MailScanner upgraded to 4.76.20 It wasn't that big a deal and just thought it would be useful to report which I thought was the point of trying out your beta. Craig -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From glenn.steen at gmail.com Sun Apr 26 14:12:43 2009 From: glenn.steen at gmail.com (Glenn Steen) Date: Sun Apr 26 14:12:52 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: References: Message-ID: <223f97700904260612r3f1a3e6ar80fcb93c8f4df89c@mail.gmail.com> 2009/4/26 Paul Hutchings : > Hmm.. well we use Outlook 2003/2007 and realistically I can't expect any > of our few hundred users to go out of their way when replying to an > email - they just want to hit reply and start typing. > > Does anyone know if there is anything that Outlook and popular mail > clients will recognize as a signature and treat differently? > > Our current signature will be added to this so you can see what we're > doing currently. > > Cheers, > Paul > IIRC.... OutlookQuoteFix will do the right thing, so ... you could perhaps make your users use that (if you package their clients...:-). Cheers -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From glenn.steen at gmail.com Sun Apr 26 14:17:09 2009 From: glenn.steen at gmail.com (Glenn Steen) Date: Sun Apr 26 14:17:17 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: <223f97700904260612r3f1a3e6ar80fcb93c8f4df89c@mail.gmail.com> References: <223f97700904260612r3f1a3e6ar80fcb93c8f4df89c@mail.gmail.com> Message-ID: <223f97700904260617u2d049d13n3bdf1ab0bc0b7d31@mail.gmail.com> 2009/4/26 Glenn Steen : > 2009/4/26 Paul Hutchings : >> Hmm.. well we use Outlook 2003/2007 and realistically I can't expect any >> of our few hundred users to go out of their way when replying to an >> email - they just want to hit reply and start typing. >> >> Does anyone know if there is anything that Outlook and popular mail >> clients will recognize as a signature and treat differently? >> >> Our current signature will be added to this so you can see what we're >> doing currently. >> >> Cheers, >> Paul >> > > IIRC.... OutlookQuoteFix will do the right thing, so ... you could > perhaps make your users use that (if you package their clients...:-). > > Cheers Seems I remember right... http://home.in.tum.de/~jain/software/outlook-quotefix/docs/features.html ... :-) Cheers -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From MailScanner at ecs.soton.ac.uk Sun Apr 26 14:37:52 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Sun Apr 26 14:38:16 2009 Subject: New beta 4.76.16 In-Reply-To: <1240751058.1902.15.camel@lin-workstation.azapple.com> References: <49F02E0B.8090502@ecs.soton.ac.uk> <1240694165.9602.635.camel@lin-workstation.azapple.com> <49F4255F.7090500@ecs.soton.ac.uk> <1240751058.1902.15.camel@lin-workstation.azapple.com> <49F463B0.1080404@ecs.soton.ac.uk> Message-ID: On 26/04/2009 14:04, Craig White wrote: > On Sun, 2009-04-26 at 10:11 +0100, Julian Field wrote: > >> On 25/04/2009 22:16, Craig White wrote: >> >>> On Thu, 2009-04-23 at 09:59 +0100, Julian Field wrote: >>> >>> >>>> There have been a few changes recently, including the Postfix >>>> processing-messages database fix and changes to the installer. >>>> So I have just released a new beta for you to try, which should solve >>>> all the outstanding issues. >>>> It's 4.76.16 and you can download it from www.mailscanner.info as usual. >>>> >>>> Please give it a try! >>>> >>>> >>> ---- >>> I'm uncertain that I have enough knowledge to be too helpful here. I >>> think that the build order of the perl packages is wrong >>> >>> CentOS 5.3, MailScanner-4.76.20-1 >>> >>> executed ./install.sh reinstall >>> >>> halted installation after removal of MailScanner perl packages, did a >>> normal yum update and continued the MailScanner process and noticed this >>> happen... >>> >>> >> You don't have to do that any more, certainly not once you have >> installed a 4.76 version *once*. As of 4.76.12, none of the Perl modules >> get in the way of Perl's updates. >> > ---- > this was an upgrade over stable 4.74.16-1, sorry, I should have made > that clear. > > figured, it was the mail server at my house and that I could try out > your beta since you were putting so much effort in it. > ---- > >>> Attempting to build and install perl-Net-CIDR-0.13-1 >>> Installing perl-Net-CIDR-0.13-1.src.rpm >>> Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.67171 >>> + umask 022 >>> + cd /usr/src/redhat/BUILD >>> + LANG=C >>> + export LANG >>> + unset DISPLAY >>> + cd /usr/src/redhat/BUILD >>> + rm -rf Net-CIDR-0.13 >>> + /bin/gzip -dc /usr/src/redhat/SOURCES/Net-CIDR-0.13.tar.gz >>> >>> >>> >>> + make test >>> PERL_DL_NONLAZY=1 /usr/bin/perl "-Iblib/lib" "-Iblib/arch" test.pl >>> 1..1 >>> Can't locate Math/BigInt.pm in @INC (@INC contains: blib/lib >>> >>> >> This only appears to happen to CentOS 5.2 systems that have been >> upgraded to 5.3. It does not happen on clean 5.3 installations, I tried >> it. I'll do a clean install on 5.3 with Net::CIDR moved to after bignum, >> BigRat and BigInt and see if it still works okay. >> >> But I still don't see why this is suddenly a problem for you, I have not >> changed the module installation order for a *very* long time. >> > ---- > this indeed was a CentOS 5.2 installation that was upgraded to 5.3 a > couple of weeks ago. > > this was a 4.74.16 installation of MailScanner upgraded to 4.76.20 > > It wasn't that big a deal and just thought it would be useful to report > which I thought was the point of trying out your beta. > Yes, many thanks for reporting it. I've moved it in 4.76.21 and it seems to install okay now. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From J.Ede at birchenallhowden.co.uk Sun Apr 26 17:05:20 2009 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Sun Apr 26 17:05:46 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: <223f97700904260617u2d049d13n3bdf1ab0bc0b7d31@mail.gmail.com> References: <223f97700904260612r3f1a3e6ar80fcb93c8f4df89c@mail.gmail.com> <223f97700904260617u2d049d13n3bdf1ab0bc0b7d31@mail.gmail.com> Message-ID: <1213490F1F316842A544A850422BFA96239CFE83@BHLSBS.bhl.local> > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- > bounces@lists.mailscanner.info] On Behalf Of Glenn Steen > Sent: 26 April 2009 14:17 > To: MailScanner discussion > Subject: Re: Preventing multple signatures in email conversation? > > 2009/4/26 Glenn Steen : > > 2009/4/26 Paul Hutchings : > >> Hmm.. well we use Outlook 2003/2007 and realistically I can't expect > any > >> of our few hundred users to go out of their way when replying to an > >> email - they just want to hit reply and start typing. > >> > >> Does anyone know if there is anything that Outlook and popular mail > >> clients will recognize as a signature and treat differently? > >> > >> Our current signature will be added to this so you can see what > we're > >> doing currently. > >> > >> Cheers, > >> Paul > >> > > > > IIRC.... OutlookQuoteFix will do the right thing, so ... you could > > perhaps make your users use that (if you package their clients...:-). > > > > Cheers > > Seems I remember right... > http://home.in.tum.de/~jain/software/outlook- > quotefix/docs/features.html > ... :-) It seems it doesn't yet work with outlook 2007 tho :( although he links to http://macros4outlook.wiki.sourceforge.net/QuoteFix+Macro which does some of it. From lists at openenterprise.ca Sun Apr 26 18:46:37 2009 From: lists at openenterprise.ca (Johnny Stork) Date: Sun Apr 26 18:46:52 2009 Subject: OT: Bounced Email Message-ID: <49F49DFD.9070901@openenterprise.ca> I know this is not striclty a MS question, but it is an issue with mail on my MS server, and with so many knowledgable mail admins on this list I thought I might have success here. For a couple years now (yes I should have tried to fix this long time ago), I have been having trouble with pretty much all of the lists I subscribe to, including vanlug. I seem to get the messages from vanlug-bounces+lists=myaddress.com@robomod.net, or clug-talk-bounces@clug.ca and of course mailscanner-bounces@lists.mailscanner.info etc. Certainly this has something to do with my own mail servers but I route through a couple machines so am not sure where to start looking for the problem. Mail does of course get through fine, just seems to be when I send mail to, or receive mail from, mailman listservs? I dont want to include one of the entire probe emails since there is a great deal of server/host info but if someone is willing to give me a hand, and take a look, please email me off-list and I can send you one of the probes showing all the header details. Thanks to anyone that can help with this. From paul.hutchings at mira.co.uk Sun Apr 26 18:51:27 2009 From: paul.hutchings at mira.co.uk (Paul Hutchings) Date: Sun Apr 26 18:54:17 2009 Subject: Preventing multple signatures in email conversation? References: <49F43E27.60704@ecs.soton.ac.uk> Message-ID: Outlook definitely doesn't appear to do this, nor does mail.app on OS X which I used to have a small test conversation. I take the point about not wanting to scan each and every email body for signatures, but doesn't MailScanner already do this in order to find/highlight things like phishing fraud? It's not a show stopper, just mildly irritating if/when you bother to look at the end of an email discussion and notice 15 signatures appended :-) -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info on behalf of Julian Field Sent: Sun 4/26/2009 11:57 AM To: MailScanner discussion Subject: Re: Preventing multple signatures in email conversation? Well Thunderbird handled that correctly and chopped off your sig when I thumped Reply. See below :-) On 26/04/2009 11:31, Paul Hutchings wrote: > Hmm.. well we use Outlook 2003/2007 and realistically I can't expect any > of our few hundred users to go out of their way when replying to an > email - they just want to hit reply and start typing. > > Does anyone know if there is anything that Outlook and popular mail > clients will recognize as a signature and treat differently? > > Our current signature will be added to this so you can see what we're > doing currently. > > Cheers, > Paul > > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MIRA Ltd Watling Street, Nuneaton, Warwickshire, CV10 0TU, England. Registered in England and Wales No. 402570 VAT Registration GB 114 5409 96 The contents of this e-mail are confidential and are solely for the use of the intended recipient. If you receive this e-mail in error, please delete it and notify us either by e-mail, telephone or fax. You should not copy, forward or otherwise disclose the content of the e-mail as this is prohibited. From MailScanner at ecs.soton.ac.uk Sun Apr 26 19:28:34 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Sun Apr 26 19:28:55 2009 Subject: Maximum Processing Attempts References: <49F4A7D2.4060100@ecs.soton.ac.uk> Message-ID: Please can someone add an entry into the wiki about this MailScanner.conf option and its compatriot "Processing Attempts Database". As requested, I'm going to make this option disabled by default, as it has a speed impact, so people need to know it exists if they get any messages that kill MailScanner and therefore need to enable it. Unless people think I should leave it enabled of course... (your votes are welcome) Many thanks! Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Sun Apr 26 19:32:07 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Sun Apr 26 19:32:29 2009 Subject: OT: Bounced Email In-Reply-To: <49F49DFD.9070901@openenterprise.ca> References: <49F49DFD.9070901@openenterprise.ca> <49F4A8A7.9060109@ecs.soton.ac.uk> Message-ID: What is the actual problem? Either I'm being thick, or you don't tell us what the actual problem is. You say "I have been having trouble" but you don't tell us *what* trouble. On 26/04/2009 18:46, Johnny Stork wrote: > I know this is not striclty a MS question, but it is an issue with > mail on my MS server, and with so many knowledgable mail admins on > this list I thought I might have success here. > > For a couple years now (yes I should have tried to fix this long time > ago), I have been having trouble with pretty much all of the lists I > subscribe to, including vanlug. I seem to get the messages from > vanlug-bounces+lists=myaddress.com@robomod.net, or > clug-talk-bounces@clug.ca and of course > mailscanner-bounces@lists.mailscanner.info etc. Certainly this has > something to do with my own mail servers but I route through a couple > machines so am not sure where to start looking for the problem. Mail > does of course get through fine, just seems to be when I send mail > to, or receive mail from, mailman listservs? > > I dont want to include one of the entire probe emails since there is a > great deal of server/host info but if someone is willing to give me a > hand, and take a look, please email me off-list and I can send you one > of the probes showing all the header details. > > Thanks to anyone that can help with this. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From drew.marshall at trunknetworks.com Sun Apr 26 19:37:44 2009 From: drew.marshall at trunknetworks.com (Drew Marshall) Date: Sun Apr 26 19:38:00 2009 Subject: OT: Bounced Email In-Reply-To: <20090426175038.8256B17062@out-b.mx.mail-launder.com> References: <20090426175038.8256B17062@out-b.mx.mail-launder.com> Message-ID: <200904261837.n3QIbqct018045@safir.blacknight.ie> On 26 Apr 2009, at 18:46, Johnny Stork wrote: > I know this is not striclty a MS question, but it is an issue with > mail on my MS server, and with so many knowledgable mail admins on > this list I thought I might have success here. > > For a couple years now (yes I should have tried to fix this long > time ago), I have been having trouble with pretty much all of the > lists I subscribe to, including vanlug. I seem to get the messages > from vanlug-bounces+lists=myaddress.com@robomod.net, or clug-talk-bounces@clug.ca > and of course mailscanner-bounces@lists.mailscanner.info etc. > Certainly this has something to do with my own mail servers but I > route through a couple machines so am not sure where to start > looking for the problem. Mail does of course get through fine, just > seems to be when I send mail to, or receive mail from, mailman > listservs? > > I dont want to include one of the entire probe emails since there is > a great deal of server/host info but if someone is willing to give > me a hand, and take a look, please email me off-list and I can send > you one of the probes showing all the header details. > > Thanks to anyone that can help with this. Well, I'm confused. So you can receive mail but you have a problem or you can't send but you have a problem? Oh and if you could give us just a little more on what the problem might be I think that might help, my crystal ball was an economy model from some dodgy Internet site :-) Drew From lists at openenterprise.ca Sun Apr 26 19:48:32 2009 From: lists at openenterprise.ca (Johnny Stork) Date: Sun Apr 26 19:48:51 2009 Subject: OT: Bounced Email In-Reply-To: References: <49F49DFD.9070901@openenterprise.ca> <49F4A8A7.9060109@ecs.soton.ac.uk> Message-ID: <49F4AC80.8040903@openenterprise.ca> Oops, didnt give it a quick re-read before sending. Almost all my email from mailing lists comes in as bounces, such as this one which came in from mailscanner-bounces@lists.mailscanner.info. And every once in a while I get one of those mailing list probe emails saying that my messages are bouncing. I still get them, and mail elsewhere comes/go just fine. But every mailman list I subscribe to seems to bounce messages to me? I just got one of those probes from the spamassassin list....most of the content removed below. I dont want to send the whole probe message with all the headers since all mty hosts are listed. But I can certainly send to someone off list if they might wish to take a look and make some suggestions. Hi! This is the ezmlm program. I'm managing the users@spamassassin.apache.org mailing list. Messages to you from the users mailing list seem to have been bouncing. I sent you a warning message, but it bounced. I've attached a copy of the bounce message. Julian Field wrote: > What is the actual problem? Either I'm being thick, or you don't tell > us what the actual problem is. You say "I have been having trouble" > but you don't tell us *what* trouble. > > On 26/04/2009 18:46, Johnny Stork wrote: >> I know this is not striclty a MS question, but it is an issue with >> mail on my MS server, and with so many knowledgable mail admins on >> this list I thought I might have success here. >> >> For a couple years now (yes I should have tried to fix this long time >> ago), I have been having trouble with pretty much all of the lists I >> subscribe to, including vanlug. I seem to get the messages from >> vanlug-bounces+lists=myaddress.com@robomod.net, or >> clug-talk-bounces@clug.ca and of course >> mailscanner-bounces@lists.mailscanner.info etc. Certainly this has >> something to do with my own mail servers but I route through a couple >> machines so am not sure where to start looking for the problem. Mail >> does of course get through fine, just seems to be when I send mail >> to, or receive mail from, mailman listservs? >> >> I dont want to include one of the entire probe emails since there is >> a great deal of server/host info but if someone is willing to give me >> a hand, and take a look, please email me off-list and I can send you >> one of the probes showing all the header details. >> >> Thanks to anyone that can help with this. > > Jules > From drew.marshall at trunknetworks.com Mon Apr 27 07:28:44 2009 From: drew.marshall at trunknetworks.com (Drew Marshall) Date: Mon Apr 27 07:28:59 2009 Subject: OT: Bounced Email In-Reply-To: <20090426185257.2AC1F1702E@out-b.mx.mail-launder.com> References: <49F49DFD.9070901@openenterprise.ca> <49F4A8A7.9060109@ecs.soton.ac.uk> <20090426185257.2AC1F1702E@out-b.mx.mail-launder.com> Message-ID: <200904270628.n3R6Spuc008276@safir.blacknight.ie> On 26 Apr 2009, at 19:48, Johnny Stork wrote: > Oops, didnt give it a quick re-read before sending. > > Almost all my email from mailing lists comes in as bounces, such as > this one which came in from mailscanner- > bounces@lists.mailscanner.info. And every once in a while I get one > of those mailing list probe emails saying that my messages are > bouncing. I still get them, and mail elsewhere comes/go just fine. > But every mailman list I subscribe to seems to bounce messages to > me? I just got one of those probes from the spamassassin > list....most of the content removed below. I dont want to send the > whole probe message with all the headers since all mty hosts are > listed. But I can certainly send to someone off list if they might > wish to take a look and make some suggestions. > > > Hi! This is the ezmlm program. I'm managing the > users@spamassassin.apache.org mailing list. > > > Messages to you from the users mailing list seem to > have been bouncing. I sent you a warning message, but it bounced. > I've attached a copy of the bounce message. The mailing lists are designed to send their mail from an address that allows them to capture bouncing mail so they can do something about it. Mailman uses the -bounces@ address as it's return path so it can work out that mail received to that address is a bounce and not a new post (As would happen if the From address was the actual mailing list address). The ezmlm bounce message you list doesn't actually say why your address rejected the mail, so I can't tell you why that might be but the mailman stuff looks fine to me. Drew From support-lists at petdoctors.co.uk Mon Apr 27 09:45:55 2009 From: support-lists at petdoctors.co.uk (Nigel Kendrick) Date: Mon Apr 27 09:46:01 2009 Subject: 'Local' MailScanner config file? Message-ID: <84109DC3A89741C2AE900BE327B4FB90@SUPPORT01V> Hi Folks, I look after 6 servers running MailScanner and the config for all of them is pretty much the same except for a few site-specific specific parameters. It would make admin a tad easier if I could keep MailScanner.conf generic, but have site-specific elements to override the generic settings in, say, MailScanner-local.conf. For example, one thing I do occasionally is re-enable the forwarding of spam to a mailbox for checking and it would be handy to upload a revised MailScanner.conf to all servers rather than have to go edit the files every time. As far as I can tell, local configs are not supported - yet!? Julian - nice weekend project if this wet weather keeps up!? Cheers Nigel Kendrick IT Associate Pet Doctors Ltd -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090427/48b33b04/attachment.html From maillists at conactive.com Mon Apr 27 10:17:13 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Mon Apr 27 10:17:27 2009 Subject: OT: Bounced Email In-Reply-To: <200904270628.n3R6Spuc008276@safir.blacknight.ie> References: <49F49DFD.9070901@openenterprise.ca> <49F4A8A7.9060109@ecs.soton.ac.uk> <20090426185257.2AC1F1702E@out-b.mx.mail-launder.com> <200904270628.n3R6Spuc008276@safir.blacknight.ie> Message-ID: Drew, could you please fix your message headers? They are seriously broken. You send the wrong References and In-Reply-To headers, so that your messages don't thread correctly. Furthermore, you don't send any message-id, so the mailing-list server is forced to add one. It actually looks like you are adding the "would-be" message-id to the References and In-Reply-To headers instead of the replied-to message-id. Thus the message-id referenced there never exists. Going back in the list this started with your first posting in Feb. 2009. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Mon Apr 27 10:17:13 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Mon Apr 27 10:17:28 2009 Subject: OT: Bounced Email In-Reply-To: <49F4AC80.8040903@openenterprise.ca> References: <49F49DFD.9070901@openenterprise.ca> <49F4A8A7.9060109@ecs.soton.ac.uk> <49F4AC80.8040903@openenterprise.ca> Message-ID: Johnny Stork wrote on Sun, 26 Apr 2009 11:48:32 -0700: > Almost all my email from mailing lists comes in as bounces, such as this > one which came in from mailscanner-bounces@lists.mailscanner.info. This is normal, this is *not* a bounce. It is a reply-to address that *your* bounce is sent to in case your address bounces. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From t.d.lee at durham.ac.uk Mon Apr 27 10:20:39 2009 From: t.d.lee at durham.ac.uk (David Lee) Date: Mon Apr 27 10:21:06 2009 Subject: 'Local' MailScanner config file? In-Reply-To: <84109DC3A89741C2AE900BE327B4FB90@SUPPORT01V> References: <84109DC3A89741C2AE900BE327B4FB90@SUPPORT01V> Message-ID: On Mon, 27 Apr 2009, Nigel Kendrick wrote: > I look after?6 servers running MailScanner and the config for all of > them is pretty much the same except for a few site-specific specific > parameters. It would make admin a tad easier if I could keep > MailScanner.conf generic, but have site-specific elements to override > the generic settings in, say, MailScanner-local.conf. For example, one > thing I do occasionally is re-enable the forwarding of spam to a mailbox > for checking and it would be handy to upload a revised MailScanner.conf > to all servers rather than have to go edit the files every time. ? As > far as I can tell, local configs are not supported - yet!? Julian - nice > weekend project if this wet weather keeps up!? Just to put a slightly different consideration on this, to look wider than MS. You may well other cluster-like services at your site where you wish similar "mostly common but with individual minor variant" configuration. If so, then you might wish to investigate things such as "cfengine" which allow you both to hold configurations together across machines, but also to do some controlled variant-tailoring. So the MS bit of our cfengine config has some clauses that apply to all hosts, and some that apply to particular sub-classes of our MS machines. Those sub-classes might be conceptual (inbound MX gateway; outbound smarthost; internal SMTP submission) or particular tweaks (on our random variety of hardware different "Max Children" settings). Obviously that is a bigger and wider and longer-term thing than a quick fix to just MS, but it might be a service-wide question worth asking (even if the eventual outcome ends up "not applicable".) -- : David Lee I.T. Service : : Senior Systems Programmer Computer Centre : : UNIX Team Leader Durham University : : South Road : : http://www.dur.ac.uk/t.d.lee/ Durham DH1 3LE : : Phone: +44 191 334 2752 U.K. : From MailScanner at ecs.soton.ac.uk Mon Apr 27 10:24:56 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Mon Apr 27 10:25:18 2009 Subject: 'Local' MailScanner config file? In-Reply-To: <84109DC3A89741C2AE900BE327B4FB90@SUPPORT01V> References: <84109DC3A89741C2AE900BE327B4FB90@SUPPORT01V> <49F579E8.2010909@ecs.soton.ac.uk> Message-ID: Not easy to do I'm afraid, so I doubt this one will happen. You can write yourself a quick Perl script which will substitute in the local settings for each MailScanner server before pushing out the files to the appropriate servers. Jules. On 27/04/2009 09:45, Nigel Kendrick wrote: > Hi Folks, > I look after 6 servers running MailScanner and the config for all of > them is pretty much the same except for a few site-specific specific > parameters. It would make admin a tad easier if I could keep > MailScanner.conf generic, but have site-specific elements to override > the generic settings in, say, MailScanner-local.conf. For example, one > thing I do occasionally is re-enable the forwarding of spam to a > mailbox for checking and it would be handy to upload a revised > MailScanner.conf to all servers rather than have to go edit the files > every time. > As far as I can tell, local configs are not supported - yet!? Julian - > nice weekend project if this wet weather keeps up!? Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From steve.freegard at fsl.com Mon Apr 27 10:25:23 2009 From: steve.freegard at fsl.com (Steve Freegard) Date: Mon Apr 27 10:25:33 2009 Subject: OT: Bounced Email In-Reply-To: <200904270628.n3R6Spuc008276@safir.blacknight.ie> References: <49F49DFD.9070901@openenterprise.ca> <49F4A8A7.9060109@ecs.soton.ac.uk> <20090426185257.2AC1F1702E@out-b.mx.mail-launder.com> <200904270628.n3R6Spuc008276@safir.blacknight.ie> Message-ID: <49F57A03.4060905@fsl.com> Drew Marshall wrote: > > On 26 Apr 2009, at 19:48, Johnny Stork wrote: > >> Oops, didnt give it a quick re-read before sending. >> >> Almost all my email from mailing lists comes in as bounces, such as >> this one which came in from >> mailscanner-bounces@lists.mailscanner.info. And every once in a while >> I get one of those mailing list probe emails saying that my messages >> are bouncing. I still get them, and mail elsewhere comes/go just fine. >> But every mailman list I subscribe to seems to bounce messages to me? >> I just got one of those probes from the spamassassin list....most of >> the content removed below. I dont want to send the whole probe message >> with all the headers since all mty hosts are listed. But I can >> certainly send to someone off list if they might wish to take a look >> and make some suggestions. >> You should whitelist any mailing lists that discuss Spam if you do SMTP time rejections using content filters. Otherwise when people post spammy stuff - your filter will reject the mail and cause the bounce actions like this. Regards, Steve. From gordon at itnt.co.za Mon Apr 27 11:31:06 2009 From: gordon at itnt.co.za (Gordon Colyn) Date: Mon Apr 27 11:31:24 2009 Subject: Stop incoming mail if message queue exceeds set value Message-ID: <018101c9c723$46c9c1a0$0a00080a@gordon> I am running a round robin dns mail solution with 4 mailscanner servers accepting mail. The problem I am having is that on occasion 1 of the servers gets hit with massive volumes over a very short time so the queue can grow to 5000+ in a matter of minutes causing mail delivery delays on that specific server. I would like to be able to set a limit on the queue size so that the server stops accepting mail until the queue drops below that set value. I have tried with sendmail creating 2 cf files but can't get it working. Does this have to be managed by mailscanner, r can it be done in sendmail? Currently using sendmail-8.14.1 and Mailscanner 4.63.8 Thanks Gordon Colyn Office : 086 123 ITNT (4868) Cell : 083 296 7534 Fax : 086 520 0885 InTheNet Technologies www.itnt.co.za MSN:gordoncolyn@hotmail.com SKYPE:gordoncolyn Confidentiality: This e-mail including any attachments is intended for the above named addressee(s) only and contains confidential information. If you have received this email in error you must take no action based on its contents, nor must you reproduce or show the e-mail or any attachments or any part thereof or communicate the contents to anyone; please reply to the sender of this e-mail informing them of the error. Viruses: We recommend that in keeping with good computing practice the recipient should ensure that e-mails received are virus free before opening. __________ Information from ESET NOD32 Antivirus, version of virus signature database 4035 (20090425) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com From maillists at conactive.com Mon Apr 27 11:40:47 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Mon Apr 27 11:40:58 2009 Subject: Stop incoming mail if message queue exceeds set value In-Reply-To: <018101c9c723$46c9c1a0$0a00080a@gordon> References: <018101c9c723$46c9c1a0$0a00080a@gordon> Message-ID: Gordon Colyn wrote on Mon, 27 Apr 2009 12:31:06 +0200: > I have tried with sendmail creating 2 cf files but can't get it working. > Does this have to be managed by mailscanner, r can it be done in sendmail? It can only be done in sendmail. sendmail stops accepting mail if your load average exceeds 9 (by default). You could drop this to a lower value. You can also stop accepting mail when you reach a number of children. I'm not sure if you can stop accepting mail with a certain queue volume. Have a look at the sendmail config options. -> www.sendmail.org Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From gary at sgluk.com Mon Apr 27 11:46:44 2009 From: gary at sgluk.com (Gary Pentland) Date: Mon Apr 27 11:46:56 2009 Subject: Stop incoming mail if message queue exceeds set value In-Reply-To: <018101c9c723$46c9c1a0$0a00080a@gordon> References: <018101c9c723$46c9c1a0$0a00080a@gordon> Message-ID: Hi, Look here... http://www.sendmail.org/m4/tweaking_config.html Particularly these... confQUEUE_LA QueueLA [varies] Load average at which queue-only function kicks in. Default values is (8 * numproc) where numproc is the number of processors online (if that can be determined). confREFUSE_LA RefuseLA [varies] Load average at which incoming SMTP connections are refused. Default values is (12 * numproc) where numproc is the number of processors online (if that can be determined). confDELAY_LA DelayLA [0] Load average at which sendmail will sleep for one second on most SMTP commands and before accepting connections. 0 means no limit. But a few others might be of use. Be sure you're rejecting invalid recipients during the SMTP dialouge and not at some stage later. It sounds obvious but can easily be missed and result in 1,000s of messages from a bot being queued and work being done on them, reject these before you queue them! Regards, Gary mailscanner-bounces@lists.mailscanner.info wrote: > I am running a round robin dns mail solution with 4 > mailscanner servers accepting mail. The problem I am having > is that on occasion 1 of the servers gets hit with massive > volumes over a very short time so the queue can grow to 5000+ > in a matter of minutes causing mail delivery delays on that > specific server. I would like to be able to set a limit on > the queue size so that the server stops accepting mail until > the queue drops below that set value. > > I have tried with sendmail creating 2 cf files but can't get it > working. Does this have to be managed by mailscanner, r can it be > done in sendmail? > > Currently using sendmail-8.14.1 and Mailscanner 4.63.8 > > Thanks > > > Gordon Colyn > Office : 086 123 ITNT (4868) > Cell : 083 296 7534 > Fax : 086 520 0885 > InTheNet Technologies > www.itnt.co.za > MSN:gordoncolyn@hotmail.com > SKYPE:gordoncolyn > > Confidentiality: This e-mail including any attachments is > intended for the above named addressee(s) only and contains > confidential information. If you have received this email in > error you must take no action based on its contents, nor must > you reproduce or show the e-mail or any attachments or any > part thereof or communicate the contents to anyone; please > reply to the sender of this e-mail informing them of the error. > > Viruses: We recommend that in keeping with good computing > practice the recipient should ensure that e-mails received > are virus free before opening. > > > > __________ Information from ESET NOD32 Antivirus, version of > virus signature database 4035 (20090425) __________ > > The message was checked by ESET NOD32 Antivirus. > > http://www.eset.com From gordon at itnt.co.za Mon Apr 27 11:55:08 2009 From: gordon at itnt.co.za (Gordon Colyn) Date: Mon Apr 27 11:55:27 2009 Subject: Stop incoming mail if message queue exceeds set value In-Reply-To: References: <018101c9c723$46c9c1a0$0a00080a@gordon> Message-ID: <018501c9c726$a225ca00$0a00080a@gordon> Thanks, have implemented these already. The issue is not on the load, the load stays pretty under control. I just want to stop accepting mail on the 1 server so the mails are forced to go to the other servers, i.e. 1000 messages handled by 4 servers will be quicker than 1000 mails handled by 1... -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Gary Pentland Sent: 27 April 2009 12:47 PM To: 'MailScanner discussion' Subject: RE: Stop incoming mail if message queue exceeds set value Hi, Look here... http://www.sendmail.org/m4/tweaking_config.html Particularly these... confQUEUE_LA QueueLA [varies] Load average at which queue-only function kicks in. Default values is (8 * numproc) where numproc is the number of processors online (if that can be determined). confREFUSE_LA RefuseLA [varies] Load average at which incoming SMTP connections are refused. Default values is (12 * numproc) where numproc is the number of processors online (if that can be determined). confDELAY_LA DelayLA [0] Load average at which sendmail will sleep for one second on most SMTP commands and before accepting connections. 0 means no limit. But a few others might be of use. Be sure you're rejecting invalid recipients during the SMTP dialouge and not at some stage later. It sounds obvious but can easily be missed and result in 1,000s of messages from a bot being queued and work being done on them, reject these before you queue them! Regards, Gary mailscanner-bounces@lists.mailscanner.info wrote: > I am running a round robin dns mail solution with 4 mailscanner > servers accepting mail. The problem I am having is that on occasion 1 > of the servers gets hit with massive volumes over a very short time so > the queue can grow to 5000+ in a matter of minutes causing mail > delivery delays on that specific server. I would like to be able to > set a limit on the queue size so that the server stops accepting mail > until the queue drops below that set value. > > I have tried with sendmail creating 2 cf files but can't get it > working. Does this have to be managed by mailscanner, r can it be done > in sendmail? > > Currently using sendmail-8.14.1 and Mailscanner 4.63.8 > > Thanks > > > Gordon Colyn > Office : 086 123 ITNT (4868) > Cell : 083 296 7534 > Fax : 086 520 0885 > InTheNet Technologies > www.itnt.co.za > MSN:gordoncolyn@hotmail.com > SKYPE:gordoncolyn > > Confidentiality: This e-mail including any attachments is intended for > the above named addressee(s) only and contains confidential > information. If you have received this email in error you must take no > action based on its contents, nor must you reproduce or show the > e-mail or any attachments or any part thereof or communicate the > contents to anyone; please reply to the sender of this e-mail > informing them of the error. > > Viruses: We recommend that in keeping with good computing practice the > recipient should ensure that e-mails received are virus free before > opening. > > > > __________ Information from ESET NOD32 Antivirus, version of virus > signature database 4035 (20090425) __________ > > The message was checked by ESET NOD32 Antivirus. > > http://www.eset.com -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! __________ Information from ESET NOD32 Antivirus, version of virus signature database 4036 (20090427) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com From gary at sgluk.com Mon Apr 27 12:02:16 2009 From: gary at sgluk.com (Gary Pentland) Date: Mon Apr 27 12:02:28 2009 Subject: Stop incoming mail if message queue exceeds set value In-Reply-To: <018501c9c726$a225ca00$0a00080a@gordon> References: <018101c9c723$46c9c1a0$0a00080a@gordon> <018501c9c726$a225ca00$0a00080a@gordon> Message-ID: Well, there are many options... confMAX_DAEMON_CHILDREN, and confCONNECTION_RATE_THROTTLE will control how many open connections / concurrently accepted connections there are... Setting these low(ish)will help. http://www.milter.info/sendmail/milter-limit/ is another option. Depending on what you want to achieve, and how big your budget is, some proper network load balancing may be another answer. Gary mailscanner-bounces@lists.mailscanner.info wrote: > Thanks, have implemented these already. The issue is not on > the load, the load stays pretty under control. I just want > to stop accepting mail on the > 1 server so the mails are forced to go to the other servers, > i.e. 1000 messages handled by 4 servers will be quicker than 1000 > mails handled by 1... > > > > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf > Of Gary Pentland > Sent: 27 April 2009 12:47 PM > To: 'MailScanner discussion' > Subject: RE: Stop incoming mail if message queue exceeds set value > > Hi, > > Look here... > > http://www.sendmail.org/m4/tweaking_config.html > > Particularly these... > > confQUEUE_LA QueueLA [varies] Load average at which > queue-only function kicks in. Default values is (8 * numproc) > where numproc is the number of processors online (if that can > be determined). > > confREFUSE_LA RefuseLA [varies] Load average at which > incoming SMTP connections are refused. Default values is (12 > * numproc) where numproc is the number of processors online (if that > can be determined). > > confDELAY_LA DelayLA [0] Load average at which sendmail will > sleep for one second on most SMTP commands and before > accepting connections. 0 means no limit. > > > But a few others might be of use. Be sure you're rejecting > invalid recipients during the SMTP dialouge and not at some > stage later. It sounds obvious but can easily be missed and > result in 1,000s of messages from a bot being queued and work > being done on them, reject these before you queue them! > > Regards, > > Gary > > > mailscanner-bounces@lists.mailscanner.info wrote: >> I am running a round robin dns mail solution with 4 mailscanner >> servers accepting mail. The problem I am having is that on occasion >> 1 of the servers gets hit with massive volumes over a very short >> time so the queue can grow to 5000+ in a matter of minutes causing >> mail delivery delays on that specific server. I would like to be >> able to set a limit on the queue size so that the server stops >> accepting mail until the queue drops below that set value. >> >> I have tried with sendmail creating 2 cf files but can't get it >> working. Does this have to be managed by mailscanner, r can it be >> done in sendmail? >> >> Currently using sendmail-8.14.1 and Mailscanner 4.63.8 >> >> Thanks >> >> >> Gordon Colyn >> Office : 086 123 ITNT (4868) >> Cell : 083 296 7534 >> Fax : 086 520 0885 >> InTheNet Technologies >> www.itnt.co.za >> MSN:gordoncolyn@hotmail.com >> SKYPE:gordoncolyn >> >> Confidentiality: This e-mail including any attachments is intended >> for the above named addressee(s) only and contains confidential >> information. If you have received this email in error you must take >> no action based on its contents, nor must you reproduce or show the >> e-mail or any attachments or any part thereof or communicate the >> contents to anyone; please reply to the sender of this e-mail >> informing them of the error. >> >> Viruses: We recommend that in keeping with good computing practice >> the recipient should ensure that e-mails received are virus free >> before opening. >> >> >> >> __________ Information from ESET NOD32 Antivirus, version of virus >> signature database 4035 (20090425) __________ >> >> The message was checked by ESET NOD32 Antivirus. >> >> http://www.eset.com > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > __________ Information from ESET NOD32 Antivirus, version of > virus signature database 4036 (20090427) __________ > > The message was checked by ESET NOD32 Antivirus. > > http://www.eset.com From support-lists at petdoctors.co.uk Mon Apr 27 13:12:47 2009 From: support-lists at petdoctors.co.uk (Nigel Kendrick) Date: Mon Apr 27 13:12:46 2009 Subject: 'Local' MailScanner config file? In-Reply-To: References: <84109DC3A89741C2AE900BE327B4FB90@SUPPORT01V><49F579E8.2010909@ecs.soton.ac.uk> Message-ID: <0AA58DF03CC749669952BDB451BF53E0@SUPPORT01V> > > >-----Original Message----- >From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Julian Field >Sent: Monday, April 27, 2009 10:25 AM >To: MailScanner discussion >Subject: Re: 'Local' MailScanner config file? > >Not easy to do I'm afraid, so I doubt this one will happen. You can >write yourself a quick Perl script which will substitute in the local >settings for each MailScanner server before pushing out the files to the >appropriate servers. > >Jules. Thanks for the reply Jules, I was hoping it may be simple to just check for the existence of the second (local config) file and parse it using the same procedure that does MailScanner.conf and just update any parameters that are found. Nigel From drew.marshall at trunknetworks.com Mon Apr 27 13:43:34 2009 From: drew.marshall at trunknetworks.com (Drew Marshall) Date: Mon Apr 27 13:43:56 2009 Subject: OT: Bounced Email In-Reply-To: <20090427092756.689B617023@out-b.mx.mail-launder.com> References: <49F49DFD.9070901@openenterprise.ca> <49F4A8A7.9060109@ecs.soton.ac.uk> <20090426185257.2AC1F1702E@out-b.mx.mail-launder.com> <200904270628.n3R6Spuc008276@safir.blacknight.ie> <20090427092756.689B617023@out-b.mx.mail-launder.com> Message-ID: <200904271243.n3RChmiu031589@safir.blacknight.ie> On 27 Apr 2009, at 10:17, Kai Schaetzl wrote: > Drew, could you please fix your message headers? They are seriously > broken. You send the wrong References and In-Reply-To headers, so that > your messages don't thread correctly. Furthermore, you don't send any > message-id, so the mailing-list server is forced to add one. > It actually looks like you are adding the "would-be" message-id to the > References and In-Reply-To headers instead of the replied-to message- > id. > Thus the message-id referenced there never exists. > Going back in the list this started with your first posting in Feb. > 2009. Hi Kai I would love to but I'm not sure what has changed. I am using the same Mac Mail app that I was in Feb (Although there might have been an update to it that I have not recognised). The copy that I received had the following References header: References: <49F49DFD.9070901@openenterprise.ca> <49F4A8A7.9060109@ecs.soton.ac.uk > <20090426185257.2AC1F1702E@out-b.mx.mail-launder.com> Which looks ok to me and should allow threading, certainly Mail has not broken the thread at my end. Other than to say sorry, I'm not sure what else to kick at the moment. Drew From maillists at conactive.com Mon Apr 27 15:10:56 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Mon Apr 27 15:11:11 2009 Subject: OT: Bounced Email In-Reply-To: <200904271243.n3RChmiu031589@safir.blacknight.ie> References: <49F49DFD.9070901@openenterprise.ca> <49F4A8A7.9060109@ecs.soton.ac.uk> <20090426185257.2AC1F1702E@out-b.mx.mail-launder.com> <200904270628.n3R6Spuc008276@safir.blacknight.ie> <20090427092756.689B617023@out-b.mx.mail-launder.com> <200904271243.n3RChmiu031589@safir.blacknight.ie> Message-ID: Drew Marshall wrote on Mon, 27 Apr 2009 13:43:34 +0100: > I would love to but I'm not sure what has changed. I am using the same > Mac Mail app that I was in Feb (Although there might have been an > update to it that I have not recognised). Actually, I suspect it's not your mail app. Have you told MS to remove some headers or so? Or use some header-mangling milter? Check mail going thru your system from other clients (=programs). Send thru another system. Compare the results. I think your mail system is seriously broken, see below. > > The copy that I received had the following References header: > References: <49F49DFD.9070901@openenterprise.ca> > <49F4A8A7.9060109@ecs.soton.ac.uk > > > <20090426185257.2AC1F1702E@out-b.mx.mail-launder.com> > > Which looks ok to me it's not ok. This last message-id simply does not exist at all! And if it existed this would mean you reply to yourself! *All* the message-ids you reference in the last postion or in In-Reply-To do not exist! And that's the problem! And as they end with out-b.mx.mail-launder.com it's rather your mail system doing this as I don't see how your local mail app should be adding that unless you are writing the messages on that machine. I suspect that all mail going thru it is broken in this way. Moreover, your own messages are getting sent without a message-id, so that the mailing-list server has to add it. Which is very unusual and likely to be considered some spam score points worth on many SA installations. As I already said, it looks like is placing the correct new message-id for that message in the wrong place and at the same time removes or doesn't add the message-id there where it belongs. Your headers are really very, very broken! and should allow threading, certainly Mail has > not broken the thread at my end. It surely has, you may just not notice it, because you are not that familiar with how the thread should look like. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From lists at openenterprise.ca Mon Apr 27 16:44:05 2009 From: lists at openenterprise.ca (Johnny Stork) Date: Mon Apr 27 16:44:16 2009 Subject: OT: Bounced Email In-Reply-To: References: <49F49DFD.9070901@openenterprise.ca> <49F4A8A7.9060109@ecs.soton.ac.uk> <49F4AC80.8040903@openenterprise.ca> Message-ID: <49F5D2C5.6070503@openenterprise.ca> Hmm, ok, but what about these occaisional "probes" I get from a couple lists? Hi! This is the ezmlm program. I'm managing the users@spamassassin.apache.org mailing list. Messages to you from the users mailing list seem to have been bouncing. I sent you a warning message, but it bounced. I've attached a copy of the bounce message. Kai Schaetzl wrote: > Johnny Stork wrote on Sun, 26 Apr 2009 11:48:32 -0700: > > >> Almost all my email from mailing lists comes in as bounces, such as this >> one which came in from mailscanner-bounces@lists.mailscanner.info. >> > > This is normal, this is *not* a bounce. It is a reply-to address that > *your* bounce is sent to in case your address bounces. > > Kai > > -- _____________________________________________ Johnny Stork -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090427/5cb5096f/attachment.html From drew.marshall at trunknetworks.com Mon Apr 27 17:10:19 2009 From: drew.marshall at trunknetworks.com (Drew Marshall) Date: Mon Apr 27 17:10:36 2009 Subject: OT: Bounced Email In-Reply-To: <20090427141557.9C6C117025@out-b.mx.mail-launder.com> References: <49F49DFD.9070901@openenterprise.ca> <49F4A8A7.9060109@ecs.soton.ac.uk> <20090426185257.2AC1F1702E@out-b.mx.mail-launder.com> <200904270628.n3R6Spuc008276@safir.blacknight.ie> <20090427092756.689B617023@out-b.mx.mail-launder.com> <200904271243.n3RChmiu031589@safir.blacknight.ie> <20090427141557.9C6C117025@out-b.mx.mail-launder.com> Message-ID: <8FD70134-81B0-4BCF-8D21-AE70ABAE1942@trunknetworks.com> On 27 Apr 2009, at 15:10, Kai Schaetzl wrote: > Drew Marshall wrote on Mon, 27 Apr 2009 13:43:34 +0100: > >> I would love to but I'm not sure what has changed. I am using the >> same >> Mac Mail app that I was in Feb (Although there might have been an >> update to it that I have not recognised). > > Actually, I suspect it's not your mail app. Have you told MS to > remove some > headers or so? Oh knickers, so I have. Ok, should be fixed now. >> >> The copy that I received had the following References header: >> References: <49F49DFD.9070901@openenterprise.ca> >> <49F4A8A7.9060109@ecs.soton.ac.uk >>> >> <20090426185257.2AC1F1702E@out-b.mx.mail-launder.com> >> >> Which looks ok to me > > it's not ok. This last message-id simply does not exist at all! Quite correct, it was added by the next MTA after the MS servers > And if it existed this would mean you reply to yourself! Yes, not thinking. Sorry > Your headers are really very, very broken! Yup but now fixed I think. Drew From Kevin_Miller at ci.juneau.ak.us Mon Apr 27 17:37:00 2009 From: Kevin_Miller at ci.juneau.ak.us (Kevin Miller) Date: Mon Apr 27 17:37:18 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: References: Message-ID: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> Paul Hutchings wrote: > As subject really, we're using MailScanner (4.74.16) and I've not > kept as close an eye on developments/improvements as it basically > "just works". > > The only niggle we do have is that we use it to add a signature to > outbound mail and over the course of an email correspondence you end > up with an email with 15 signatures added to the end. > > Any way yet of stopping this happening? > > Cheers, > Paul > > -- > MIRA Ltd > Snip Yes - change the above "dash dash" to "dash dash space". Most email clients will stip away anything following that, recognizing it as a signature seperator. IIRC, I've seen instances where the trailing space is included in the signature, but stripped out somewhere along the way, so maybe you're already putting in the space. But in the event you aren't, add one and see if that doesn't take care of the problem... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 From chris at techquility.net Mon Apr 27 17:42:40 2009 From: chris at techquility.net (Chris Barber) Date: Mon Apr 27 17:42:59 2009 Subject: Preventing multiple signatures in email conversation? In-Reply-To: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> Message-ID: <43F62CA225017044BC84CFAF92B4333B06F530@sbsserver.Techquility.net> Paul Hutchings wrote: > As subject really, we're using MailScanner (4.74.16) and I've not > kept as close an eye on developments/improvements as it basically > "just works". > > The only niggle we do have is that we use it to add a signature to > outbound mail and over the course of an email correspondence you end > up with an email with 15 signatures added to the end. > > Any way yet of stopping this happening? > > Cheers, > Paul > > -- > MIRA Ltd > >>Snip >> >>Yes - change the above "dash dash" to "dash dash space". >>Most email clients will stip away anything following that, recognizing it as a signature seperator. >> >>IIRC, I've seen instances where the trailing space is included in the signature, but stripped out somewhere along the way, so maybe you're >>already putting in the space. But in the event you aren't, add one and see if that doesn't take care of the problem... >> >>...Kevin >>-- Is there a way to get MailScanner to not put multiple signatures? Like detect that there is already one on the message and not append subsequent signatures? I would rather not rely on the email clients to do this... Thanks, Chris From MailScanner at ecs.soton.ac.uk Mon Apr 27 18:04:31 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Mon Apr 27 18:04:52 2009 Subject: Preventing multiple signatures in email conversation? In-Reply-To: <43F62CA225017044BC84CFAF92B4333B06F530@sbsserver.Techquility.net> References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> <43F62CA225017044BC84CFAF92B4333B06F530@sbsserver.Techquility.net> <49F5E59F.10104@ecs.soton.ac.uk> Message-ID: On 27/04/2009 17:42, Chris Barber wrote: > Is there a way to get MailScanner to not put multiple signatures? Like > detect that there is already one on the message and not append > subsequent signatures? I would rather not rely on the email clients to > do this... > I think this has already been mentioned in this thread. But... With an HTML signature, it's easy as you can insert some hidden text in the sig that doesn't appear in the viewed result, and use that as an identifier to say "Here is the sig, don't add another one". But in a plain text message, it's a lot harder as there is no way of putting in hidden text, and once the message has been badly quoted by some mail client when the reply was done, you can't reliably automatically find the original signature in it. When you're passing through multiple MailScanner servers in the same organisation, you can do it with a header. But you can't trust the contents of any header once you've been outside your organisation, as many environments throw away most headers, particularly when the message has been replied to. In the cases of multiple MailScanner servers, and HTML signatures, I can and already have solved the problem. There just isn't a neat way of doing it for plain text signatures, sorry. If you have any stunning ideas, then let me know :-) Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From Kevin_Miller at ci.juneau.ak.us Mon Apr 27 18:20:22 2009 From: Kevin_Miller at ci.juneau.ak.us (Kevin Miller) Date: Mon Apr 27 18:20:33 2009 Subject: Preventing multiple signatures in email conversation? In-Reply-To: References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> <43F62CA225017044BC84CFAF92B4333B06F530@sbsserver.Techquility.net> <49F5E59F.10104@ecs.soton.ac.uk> Message-ID: <4A09477D575C2C4B86497161427DD94C0D153E2A64@city-exchange07> Julian Field wrote: > On 27/04/2009 17:42, Chris Barber wrote: >> Is there a way to get MailScanner to not put multiple signatures? >> Like detect that there is already one on the message and not append >> subsequent signatures? I would rather not rely on the email clients >> to do this... >> > I think this has already been mentioned in this thread. But... > With an HTML signature, it's easy as you can insert some hidden text > in the sig that doesn't appear in the viewed result, and use that as > an identifier to say "Here is the sig, don't add another one". > But in a plain text message, it's a lot harder as there is no way of > putting in hidden text, and once the message has been badly quoted by > some mail client when the reply was done, you can't reliably > automatically find the original signature in it. > When you're passing through multiple MailScanner servers in the same > organisation, you can do it with a header. But you can't trust the > contents of any header once you've been outside your organisation, as > many environments throw away most headers, particularly when the > message has been replied to. > > In the cases of multiple MailScanner servers, and HTML signatures, I > can and already have solved the problem. There just isn't a neat way > of doing it for plain text signatures, sorry. > > If you have any stunning ideas, then let me know :-) Way back in the old DOS days, I used to use ASCI character 255 as an invisible character now and then. Can't remember what for, but for some reason I needed a non-space white character. It was easy to generate - hold down the Alt key and press 255 on the keypad. It was invisible, but benign. Perhaps sticking char(255) in the text sig would be a possiblity? ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 From mark at msapiro.net Mon Apr 27 18:24:26 2009 From: mark at msapiro.net (Mark Sapiro) Date: Mon Apr 27 18:24:38 2009 Subject: OT: Bounced Email In-Reply-To: <200904271243.n3RChmiu031589@safir.blacknight.ie> Message-ID: Drew Marshall wrote: > >On 27 Apr 2009, at 10:17, Kai Schaetzl wrote: > >> Drew, could you please fix your message headers? They are seriously >> broken. You send the wrong References and In-Reply-To headers, so that >> your messages don't thread correctly. Furthermore, you don't send any >> message-id, so the mailing-list server is forced to add one. >> It actually looks like you are adding the "would-be" message-id to the >> References and In-Reply-To headers instead of the replied-to message- >> id. >> Thus the message-id referenced there never exists. >> Going back in the list this started with your first posting in Feb. >> 2009. > >Hi Kai > >I would love to but I'm not sure what has changed. I am using the same >Mac Mail app that I was in Feb (Although there might have been an >update to it that I have not recognised). > >The copy that I received had the following References header: >References: <49F49DFD.9070901@openenterprise.ca> <49F4A8A7.9060109@ecs.soton.ac.uk > > > <20090426185257.2AC1F1702E@out-b.mx.mail-launder.com> > >Which looks ok to me and should allow threading, certainly Mail has >not broken the thread at my end. Other than to say sorry, I'm not sure >what else to kick at the moment. The problem is that mail-launder.com is munging the Message-Id: of Drew's incoming mail. The message to which Drew replied had a Message-Id: of <49F4AC80.8040903@openenterprise.ca>, but Drew's reply references <20090426185257.2AC1F1702E@out-b.mx.mail-launder.com>, which is a message-id that the rest of us have never seen. Drew, you need to tell mail-launder.com to stup munging Message-IDs. -- Mark Sapiro The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From MailScanner at ecs.soton.ac.uk Mon Apr 27 18:25:46 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Mon Apr 27 18:26:12 2009 Subject: Preventing multiple signatures in email conversation? In-Reply-To: <4A09477D575C2C4B86497161427DD94C0D153E2A64@city-exchange07> References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> <43F62CA225017044BC84CFAF92B4333B06F530@sbsserver.Techquility.net> <49F5E59F.10104@ecs.soton.ac.uk> <4A09477D575C2C4B86497161427DD94C0D153E2A64@city-exchange07> <49F5EA9A.7080402@ecs.soton.ac.uk> Message-ID: On 27/04/2009 18:20, Kevin Miller wrote: > Julian Field wrote: > >> On 27/04/2009 17:42, Chris Barber wrote: >> >>> Is there a way to get MailScanner to not put multiple signatures? >>> Like detect that there is already one on the message and not append >>> subsequent signatures? I would rather not rely on the email clients >>> to do this... >>> >>> >> I think this has already been mentioned in this thread. But... >> With an HTML signature, it's easy as you can insert some hidden text >> in the sig that doesn't appear in the viewed result, and use that as >> an identifier to say "Here is the sig, don't add another one". >> But in a plain text message, it's a lot harder as there is no way of >> putting in hidden text, and once the message has been badly quoted by >> some mail client when the reply was done, you can't reliably >> automatically find the original signature in it. >> When you're passing through multiple MailScanner servers in the same >> organisation, you can do it with a header. But you can't trust the >> contents of any header once you've been outside your organisation, as >> many environments throw away most headers, particularly when the >> message has been replied to. >> >> In the cases of multiple MailScanner servers, and HTML signatures, I >> can and already have solved the problem. There just isn't a neat way >> of doing it for plain text signatures, sorry. >> >> If you have any stunning ideas, then let me know :-) >> > Way back in the old DOS days, I used to use ASCI character 255 as an invisible character now and then. Can't remember what for, but for some reason I needed a non-space white character. It was easy to generate - hold down the Alt key and press 255 on the keypad. It was invisible, but benign. Perhaps sticking char(255) in the text sig would be a possiblity? > ASCII 160 is always quite good for that, it's a non-breaking space. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From maillists at conactive.com Mon Apr 27 18:31:19 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Mon Apr 27 18:31:33 2009 Subject: OT: Bounced Email In-Reply-To: <8FD70134-81B0-4BCF-8D21-AE70ABAE1942@trunknetworks.com> References: <49F49DFD.9070901@openenterprise.ca> <49F4A8A7.9060109@ecs.soton.ac.uk> <20090426185257.2AC1F1702E@out-b.mx.mail-launder.com> <200904270628.n3R6Spuc008276@safir.blacknight.ie> <20090427092756.689B617023@out-b.mx.mail-launder.com> <200904271243.n3RChmiu031589@safir.blacknight.ie> <20090427141557.9C6C117025@out-b.mx.mail-launder.com> <8FD70134-81B0-4BCF-8D21-AE70ABAE1942@trunknetworks.com> Message-ID: Drew Marshall wrote on Mon, 27 Apr 2009 17:10:19 +0100: > Oh knickers, so I have. Ok, should be fixed now. Still broken ;-) You are adding the message-id now again, but the References and In-Reply-To header are still wrong. In-Reply-To: <20090427141557.9C6C117025@out-b.mx.mail-launder.com> this message-id doesn't exist at all! correct would by: In-Reply-To: So, your gateway is still breaking a probably valid header. This result could happen if you also strip *incoming* headers. Then the message-id of the incoming message gets removed, gets replaced by your server and when you reply the wrong message-id is used because the original one got removed. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Mon Apr 27 18:31:19 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Mon Apr 27 18:31:34 2009 Subject: OT: Bounced Email In-Reply-To: <49F5D2C5.6070503@openenterprise.ca> References: <49F49DFD.9070901@openenterprise.ca> <49F4A8A7.9060109@ecs.soton.ac.uk> <49F4AC80.8040903@openenterprise.ca> <49F5D2C5.6070503@openenterprise.ca> Message-ID: Johnny Stork wrote on Mon, 27 Apr 2009 08:44:05 -0700: > Hmm, ok, but what about these occaisional "probes" I get from a couple > lists? Yes, these are bounces. However, how should we know why your mail *sometimes* bounces? There can be umpteen reasons, from connectivity to load to spam rejection (as already pointed out by Steve). This is then hardly mailing list-specific. When you get such a mail, go to your logs and check. Unfortunately, a bounce probe will usually not come right after it happened, I have seen them come in up to a week later. Then, of course, it's hard to find something out, unless the message that bounced is explicitely specified in the probe and identifiable. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From mark at msapiro.net Mon Apr 27 18:34:50 2009 From: mark at msapiro.net (Mark Sapiro) Date: Mon Apr 27 18:35:00 2009 Subject: OT: Bounced Email In-Reply-To: <49F5D2C5.6070503@openenterprise.ca> Message-ID: Johnny Stork wrote: >Hmm, ok, but what about these occaisional "probes" I get from a couple >lists? > >Hi! This is the ezmlm program. I'm managing the >users@spamassassin.apache.org mailing list. > > >Messages to you from the users mailing list seem to >have been bouncing. I sent you a warning message, but it bounced. >I've attached a copy of the bounce message. I have no idea about ezmlm, but as far as Mailman is concerned, Mailman's bounce processing can be configured to send probes. If Mailman is so configured, when a list member reaches the bounce score threshold, instead of disabling the member's delivery immediately, Mailman sends a probe message and only disables delivery to the list member if the probe bounces. If you receive a probe, it means that other mail to you from the list has bounced. If you check the archives of the list, you may notice that you haven't received all messages. Also, Mailman's probe contains a copy of the 'bounce' DSN that was returned to Mailman. This may help you figure out why list mail to you is intermittently bouncing. -- Mark Sapiro The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From rcooper at dwford.com Mon Apr 27 18:50:22 2009 From: rcooper at dwford.com (Rick Cooper) Date: Mon Apr 27 18:50:37 2009 Subject: Preventing multiple signatures in email conversation? In-Reply-To: <4A09477D575C2C4B86497161427DD94C0D153E2A64@city-exchange07> References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07><43F62CA225017044BC84CFAF92B4333B06F530@sbsserver.Techquility.net><49F5E59F.10104@ecs.soton.ac.uk> <4A09477D575C2C4B86497161427DD94C0D153E2A64@city-exchange07> Message-ID: ----Original Message---- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Kevin Miller Sent: Monday, April 27, 2009 1:20 PM To: 'MailScanner discussion' Subject: RE: Preventing multiple signatures in email conversation? > Julian Field wrote: >> On 27/04/2009 17:42, Chris Barber wrote: >>> Is there a way to get MailScanner to not put multiple signatures? >>> Like detect that there is already one on the message and not append >>> subsequent signatures? I would rather not rely on the email clients to >>> do this... >>> >> I think this has already been mentioned in this thread. But... >> With an HTML signature, it's easy as you can insert some hidden text >> in the sig that doesn't appear in the viewed result, and use that as >> an identifier to say "Here is the sig, don't add another one". >> But in a plain text message, it's a lot harder as there is no way of >> putting in hidden text, and once the message has been badly quoted by >> some mail client when the reply was done, you can't reliably >> automatically find the original signature in it. >> When you're passing through multiple MailScanner servers in the same >> organisation, you can do it with a header. But you can't trust the >> contents of any header once you've been outside your organisation, as >> many environments throw away most headers, particularly when the message >> has been replied to. >> >> In the cases of multiple MailScanner servers, and HTML signatures, I >> can and already have solved the problem. There just isn't a neat way >> of doing it for plain text signatures, sorry. >> >> If you have any stunning ideas, then let me know :-) > > Way back in the old DOS days, I used to use ASCI character 255 as an > invisible character now and then. Can't remember what for, but for some > reason I needed a non-space white character. It was easy to generate - > hold down the Alt key and press 255 on the keypad. It was invisible, but > benign. Perhaps sticking char(255) in the text sig would be a > possiblity? > [...] I will bet you did it for the same reason as I did, if a directory or filename began with a char(255) it did not appear in directory listings so it was a way to create items that were completely unaccessable (even from delete commands) unless you knew the file/dir name was alt+255FileName Rick -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From Kevin_Miller at ci.juneau.ak.us Mon Apr 27 18:55:19 2009 From: Kevin_Miller at ci.juneau.ak.us (Kevin Miller) Date: Mon Apr 27 18:55:31 2009 Subject: OT: Tales of woe... Message-ID: <4A09477D575C2C4B86497161427DD94C0D153E2A67@city-exchange07> Forgive me if this is too off topic, but maybe it'll spare someone out there a bit of grief. Internally we have an Exchange 2003 server. I'm in the process of migrating our users to Exchange 2007. Our mail retention policy purges messages older than 90 days in certain folders. Historically, the Mailbox Manager in Exchange would clean out the specified folder but not subfolders, so we told our users if they needed to keep messages for historical purposes to move them. I created a folder called Archive at the same level in the tree as the managed folders. Some users created subfolders under the managed folders. We've been using Exchange since 2000. The subfolders have *never* been touched. So what do the boys from Redmond do in Exchange 2007? They learned a new word. Recursion. Sigh. I'm sure you can imagine the rest. Suddenly the users I migrated to 2007 are calling and asking where they're important historical mail is. At least the one's that created subfolders under the managed folders anyway. So of course we have backups. Everybody has backups, right? Ours are swell. CA Arcserve Exchange agent w/document level resotres. Snazzy. Except they didn't work. Well, sometimes they did. One user might get their mail back, but the next user doesn't. Groan. After spending hours on the phone with CA over the course of several days, we finally did a database lever restore to a recovery storage group and merged the mail from there. It got the missing mail back, but also any mail the users had read and deleted. Acceptable, but not optimal. So why post this here? Well, mostly because MailScanner users are generally a great bunch of folks, some of whom also have to support Exchange, and I hope I can save someone the same hassle I had to go through. Microsoft released a fix for the recursion issue last summer (a year or more after first rolling out Exchange 2007) when "enough of their customers complained". I think that means some very big customer threatened to jump ship to Lotus Notes. Anyway, if the Exchange 2007 server is on security rollup 5 or higher, there's a powershell command to turn off the recursion. See http://support.microsoft.com/kb/939037. The default is still to have recursion enabled. I can't imagine how many other shops were bit by this. It's not a particularly well advertised "feature". At least I never stumbled across it in my reading and it was never mentioned in either the Exchange migration, nor administration classes I went to. Again, sorry if this steps on anybodies toes. I hope it helps someone out there... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 From drew.marshall at trunknetworks.com Mon Apr 27 18:57:35 2009 From: drew.marshall at trunknetworks.com (Drew Marshall) Date: Mon Apr 27 18:57:52 2009 Subject: OT: Bounced Email In-Reply-To: References: <49F49DFD.9070901@openenterprise.ca> <49F4A8A7.9060109@ecs.soton.ac.uk> <20090426185257.2AC1F1702E@out-b.mx.mail-launder.com> <200904270628.n3R6Spuc008276@safir.blacknight.ie> <20090427092756.689B617023@out-b.mx.mail-launder.com> <200904271243.n3RChmiu031589@safir.blacknight.ie> <20090427141557.9C6C117025@out-b.mx.mail-launder.com> <8FD70134-81B0-4BCF-8D21-AE70ABAE1942@trunknetworks.com> Message-ID: <5AF4C52B-FF88-479A-BE68-6174758C9769@trunknetworks.com> On 27 Apr 2009, at 18:31, Kai Schaetzl wrote: > Drew Marshall wrote on Mon, 27 Apr 2009 17:10:19 +0100: > >> Oh knickers, so I have. Ok, should be fixed now. > > Still broken ;-) You are adding the message-id now again, but the > References and In-Reply-To header are still wrong. > > In-Reply-To: <20090427141557.9C6C117025@out-b.mx.mail-launder.com> > > this message-id doesn't exist at all! That would be because I was replying to a message that came through before I fixed it. This one should be fine (I hope!) > This result could happen if you also strip *incoming* headers. Then > the > message-id of the incoming message gets removed, gets replaced by your > server and when you reply the wrong message-id is used because the > original one got removed. That is almost exactly that was happening. All inbound mail is scanned by 'edge' boxes, then handed off to a delivery server (out-b) and then to the mail box server. The Message-id header was being stripped at the edge, then replaced by out-b, which caused the invalid message-id problem (Which I then replied to etc, etc). I think we are there now (Fingers crossed!). Drew From drew.marshall at trunknetworks.com Mon Apr 27 19:02:56 2009 From: drew.marshall at trunknetworks.com (Drew Marshall) Date: Mon Apr 27 19:03:15 2009 Subject: OT: Bounced Email In-Reply-To: <20090427154924.2A0231702C@out-b.mx.mail-launder.com> References: <49F49DFD.9070901@openenterprise.ca> <49F4A8A7.9060109@ecs.soton.ac.uk> <49F4AC80.8040903@openenterprise.ca> <20090427154924.2A0231702C@out-b.mx.mail-launder.com> Message-ID: <0E434D79-D2D7-4D3E-B058-4A5FE410F4B2@trunknetworks.com> -- In line with our policy, this message has been scanned for viruses and dangerous content by our Mail Launder system www.mail-launder.com Our email policy can be found at www.trunknetworks.com/policy Trunk Networks Limited is registered in Scotland with registration number: 351063 Registered Office 55-57 West High Street Inverurie AB51 3QQ -------------- next part -------------- On 27 Apr 2009, at 16:44, Johnny Stork wrote: > Hmm, ok, but what about these occaisional "probes" I get from a > couple lists? > > Hi! This is the ezmlm program. I'm managing the > users@spamassassin.apache.org mailing list. > > > Messages to you from the users mailing list seem to > have been bouncing. I sent you a warning message, but it bounced. > I've attached a copy of the bounce message. Almost certainly generated because your address generated some form of 4xx error message that was returned to the list server. Do you have grey listing or some form of recipient checking going on? Either of these could cause this sort of probe. Drew -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090427/daa80bb4/attachment.html From chris at techquility.net Mon Apr 27 19:09:17 2009 From: chris at techquility.net (Chris Barber) Date: Mon Apr 27 19:09:38 2009 Subject: Preventing multiple signatures in email conversation? In-Reply-To: References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07><43F62CA225017044BC84CFAF92B4333B06F530@sbsserver.Techquility.net><49F5E59F.10104@ecs.soton.ac.uk> Message-ID: <43F62CA225017044BC84CFAF92B4333B06F533@sbsserver.Techquility.net> >I think this has already been mentioned in this thread. But... >With an HTML signature, it's easy as you can insert some hidden text in >the sig that doesn't appear in the viewed result, and use that as an >identifier to say "Here is the sig, don't add another one". >But in a plain text message, it's a lot harder as there is no way of >putting in hidden text, and once the message has been badly quoted by >some mail client when the reply was done, you can't reliably >automatically find the original signature in it. >When you're passing through multiple MailScanner servers in the same >organisation, you can do it with a header. But you can't trust the >contents of any header once you've been outside your organisation, as >many environments throw away most headers, particularly when the message >has been replied to. > >In the cases of multiple MailScanner servers, and HTML signatures, I can >and already have solved the problem. There just isn't a neat way of >doing it for plain text signatures, sorry. > >If you have any stunning ideas, then let me know :-) > >Jules Jules, >From your first paragraph there, are you referring to the "Allow Multiple HTML Signatures" setting? I tried that setting using an image tag without a src and it doesn't work for me because some email client change the tag that is missing the src to an error message and thus MailScanner won't see it when it comes back in. >From your reply above it sound like there is another way to get this done? Thanks for all you do, Chris From MailScanner at ecs.soton.ac.uk Mon Apr 27 19:39:10 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Mon Apr 27 19:39:31 2009 Subject: Preventing multiple signatures in email conversation? In-Reply-To: <43F62CA225017044BC84CFAF92B4333B06F533@sbsserver.Techquility.net> References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07><43F62CA225017044BC84CFAF92B4333B06F530@sbsserver.Techquility.net><49F5E59F.10104@ecs.soton.ac.uk> <43F62CA225017044BC84CFAF92B4333B06F533@sbsserver.Techquility.net> <49F5FBCE.8080506@ecs.soton.ac.uk> Message-ID: On 27/04/2009 19:09, Chris Barber wrote: >> I think this has already been mentioned in this thread. But... >> With an HTML signature, it's easy as you can insert some hidden text in >> > >> the sig that doesn't appear in the viewed result, and use that as an >> identifier to say "Here is the sig, don't add another one". >> But in a plain text message, it's a lot harder as there is no way of >> putting in hidden text, and once the message has been badly quoted by >> some mail client when the reply was done, you can't reliably >> automatically find the original signature in it. >> When you're passing through multiple MailScanner servers in the same >> organisation, you can do it with a header. But you can't trust the >> contents of any header once you've been outside your organisation, as >> many environments throw away most headers, particularly when the >> > message > >> has been replied to. >> >> In the cases of multiple MailScanner servers, and HTML signatures, I >> > can > >> and already have solved the problem. There just isn't a neat way of >> doing it for plain text signatures, sorry. >> >> If you have any stunning ideas, then let me know :-) >> >> Jules >> > Jules, > > > From your first paragraph there, are you referring to the "Allow > Multiple HTML Signatures" setting? Yes. > I tried that setting using an image > tag without a src and it doesn't work for me because some email client > change the tag that is missing the src to an error message and > thus MailScanner won't see it when it comes back in. > You could put in the src as the same URL as the Web Bug Replacement in MailScanner.conf. They won't be able to see that, but it will make the img tag correct. And that URL will always be accessible, and widely available as it's hosted by an anycast network of servers scattered around the world. > > From your reply above it sound like there is another way to get this > done? > Not particularly, should there be another way? Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From ajcartmell at fonant.com Mon Apr 27 20:08:43 2009 From: ajcartmell at fonant.com (Anthony Cartmell) Date: Mon Apr 27 20:08:59 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: References: Message-ID: > Our current signature will be added to this so you can see what we're > doing currently. Looks and works fine for me in Opera. The signature is in grey, rather than black, and it isn't included in my reply :) Perhaps MS will eventually see the benefit of dealing with dash-dash-space lines as signature separators properly. I suspect that they think that including everything in every reply is the safest way to proceed to avoid lost data and potential litigation. As far as MailScanner is concerned, I think it's correct that it should try not to add the same signature twice, but I don't think MailScanner should be changing messages to cover up for mail client problems. Someone might have actually intended to include the signature text in their reply, for example. Cheers! Anthony -- www.fonant.com - Quality web sites From chris at scorpion.nl Mon Apr 27 22:24:15 2009 From: chris at scorpion.nl (Christiaan den Besten) Date: Mon Apr 27 22:24:33 2009 Subject: Maximum Processing Attempts References: <49F4A7D2.4060100@ecs.soton.ac.uk> Message-ID: Does it realy hit performance noticably? ..... in normal behaviour the database is extremly small .... so it should probably always live in disk-cache. And if people want to be sure, they can place it on tmpfs, doesn't hurt if it gets lost :) We have seen 'our share of broken messages' that trashed some of our servers, .... would have loved to have had the processing database back then :) :) bye, Chris ----- Original Message ----- From: "Julian Field" To: "MailScanner discussion" Sent: Sunday, April 26, 2009 20:28 Subject: Maximum Processing Attempts > Please can someone add an entry into the wiki about this MailScanner.conf > option and its compatriot "Processing Attempts Database". > > As requested, I'm going to make this option disabled by default, as it has > a speed impact, so people need to know it exists if they get any messages > that kill MailScanner and therefore need to enable it. > > Unless people think I should leave it enabled of course... (your votes are > welcome) > > Many thanks! > > Jules > > -- > Julian Field MEng CITP CEng > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > Need help customising MailScanner? > Contact me! > Need help fixing or optimising your systems? > Contact me! > Need help getting you started solving new requirements from your boss? > Contact me! > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > Follow me at twitter.com/JulesFM > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Apr 27 22:40:16 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Mon Apr 27 22:40:37 2009 Subject: Maximum Processing Attempts In-Reply-To: References: <49F4A7D2.4060100@ecs.soton.ac.uk> <49F62640.3080504@ecs.soton.ac.uk> Message-ID: Can someone test this please? How much of a difference does it really make? It is a few small SQL operations per message on a very fast lightweight (if any SQL server is lightweight!) database that will be in memory anyway. I have specifically switched off fsyncs when it writes to the database, so it shouldn't result in any appreciable disk i/o at all. Should I leave it switched on by default, so heavily loaded sites can switch it off to gain that extra bit of performance, at the cost of a potential reliability hit? If we go for that, can someone please edit the "optimising tips" wiki page for me? Thanks folks! Jules. P.S. Have you seen I am on twitter too these days? You too can get to see my inane ramblings at twitter.com/JulesFM. On 27/04/2009 22:24, Christiaan den Besten wrote: > Does it realy hit performance noticably? ..... in normal behaviour the > database is extremly small .... so it should probably always live in > disk-cache. And if people want to be sure, they can place it on tmpfs, > doesn't hurt if it gets lost :) > > We have seen 'our share of broken messages' that trashed some of our > servers, .... would have loved to have had the processing database > back then :) :) > > bye, > Chris > > ----- Original Message ----- From: "Julian Field" > > To: "MailScanner discussion" > Sent: Sunday, April 26, 2009 20:28 > Subject: Maximum Processing Attempts > > >> Please can someone add an entry into the wiki about this >> MailScanner.conf option and its compatriot "Processing Attempts >> Database". >> >> As requested, I'm going to make this option disabled by default, as >> it has a speed impact, so people need to know it exists if they get >> any messages that kill MailScanner and therefore need to enable it. >> >> Unless people think I should leave it enabled of course... (your >> votes are welcome) >> >> Many thanks! >> >> Jules >> >> -- >> Julian Field MEng CITP CEng >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> >> Need help customising MailScanner? >> Contact me! >> Need help fixing or optimising your systems? >> Contact me! >> Need help getting you started solving new requirements from your boss? >> Contact me! >> >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> Follow me at twitter.com/JulesFM >> >> >> -- >> This message has been scanned for viruses and >> dangerous content by MailScanner, and is >> believed to be clean. >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From mark at msapiro.net Tue Apr 28 00:07:32 2009 From: mark at msapiro.net (Mark Sapiro) Date: Tue Apr 28 00:07:41 2009 Subject: OT: Bounced Email In-Reply-To: <0E434D79-D2D7-4D3E-B058-4A5FE410F4B2@trunknetworks.com> References: <49F49DFD.9070901@openenterprise.ca> <49F4A8A7.9060109@ecs.soton.ac.uk> <49F4AC80.8040903@openenterprise.ca> <20090427154924.2A0231702C@out-b.mx.mail-launder.com> <0E434D79-D2D7-4D3E-B058-4A5FE410F4B2@trunknetworks.com> Message-ID: <20090427230732.GA3304@msapiro> On Mon, Apr 27, 2009 at 07:02:56PM +0100, Drew Marshall wrote: > On 27 Apr 2009, at 16:44, Johnny Stork wrote: > > >Hmm, ok, but what about these occaisional "probes" I get from a > >couple lists? > > > >Hi! This is the ezmlm program. I'm managing the > >users@spamassassin.apache.org mailing list. > > > > > >Messages to you from the users mailing list seem to > >have been bouncing. I sent you a warning message, but it bounced. > >I've attached a copy of the bounce message. > > Almost certainly generated because your address generated some form of > 4xx error message that was returned to the list server. Do you have > grey listing or some form of recipient checking going on? Either of > these could cause this sort of probe. Again, I don't know about ezmlm, but bounces with 4xx status to a Mailman list are ignored. -- Mark Sapiro mark at msapiro net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan From khaled.jamil at gmail.com Tue Apr 28 07:21:07 2009 From: khaled.jamil at gmail.com (Khaled Hussein) Date: Tue Apr 28 07:21:16 2009 Subject: attachments block Message-ID: <819715630904272321uc267b11m3efe2200d31b89dc@mail.gmail.com> Hi All, i added a rule in my filename.rulse.conf file to deny attachments start with DSL (all of them viagra pics), it works fine but i want to prevent mailscanner from sending the report to the email address that this file has been blocked, how can i do this or if ther is another way to block these messages Thanks -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090428/f6a9d697/attachment.html From MailScanner at ecs.soton.ac.uk Tue Apr 28 08:29:45 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 28 08:30:04 2009 Subject: attachments block In-Reply-To: <819715630904272321uc267b11m3efe2200d31b89dc@mail.gmail.com> References: <819715630904272321uc267b11m3efe2200d31b89dc@mail.gmail.com> <49F6B069.1040500@ecs.soton.ac.uk> Message-ID: On 28/04/2009 07:21, Khaled Hussein wrote: > Hi All, > > i added a rule in my filename.rulse.conf file to deny attachments > start with DSL (all of them viagra pics), it works fine but i want to > prevent mailscanner from sending the report to the email address Which email address? The sender or the recipient? > that this file has been blocked, how can i do this or if ther is > another way to block these messages > > > Thanks > > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From support-lists at petdoctors.co.uk Tue Apr 28 10:27:20 2009 From: support-lists at petdoctors.co.uk (Nigel Kendrick) Date: Tue Apr 28 10:27:43 2009 Subject: Slooow MailScanner = bitdefender?? Message-ID: <4D373C90AFA24050BDABCAC9CDD9A525@SUPPORT01V> Morning, I have a P4 3GHz server running MailScanner 4.75.11 that has has been working fine, but over the last few days it has taken to slowing down dramatically and the CPU load hits 13+ Admittedly the server could do with a bit more RAM (it has 768MB), but it has worked fine for several years and the load is very small (<300 emails a day). A quick look at htop shows that the bitdefender update process seems to run 'forever' and eats up >500MB and then the server goes into swap city and almost grinds to a halt. The upgrade from 4.69.? happened around the same time as the slow down so has something changed that might have caused this? I guess something may have just tipped the server over a critical RAM requirement so I am going to fit some more (1.5GB) but any other thoughts appreciated as other servers upgraded at the same time (fitted with more RAM) have not experienced the slow down. Thanks Nigel Kendrick -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090428/370a2596/attachment.html From maillists at conactive.com Tue Apr 28 10:31:19 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Tue Apr 28 10:31:30 2009 Subject: Maximum Processing Attempts In-Reply-To: References: <49F4A7D2.4060100@ecs.soton.ac.uk> <49F62640.3080504@ecs.soton.ac.uk> Message-ID: Julian Field wrote on Mon, 27 Apr 2009 22:40:16 +0100: > Should I leave it switched on by default, so heavily loaded sites can > switch it off to gain that extra bit of performance, at the cost of a > potential reliability hit? >From the past discussion I think it is mainly those heavy-traffic sites that would benefit from it. I think we had exactly two folks mentioning a problem with occasional messages getting not processed somehow. Both with high-volume sites. So, the majority does not need this feature to be on. On the other hand, exactly those people who need it will also be hit most by the performance hit (as small as it may be). Unfortunately none of them participated in the recent discussion. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Tue Apr 28 10:31:19 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Tue Apr 28 10:31:30 2009 Subject: OT: Bounced Email In-Reply-To: <5AF4C52B-FF88-479A-BE68-6174758C9769@trunknetworks.com> References: <49F49DFD.9070901@openenterprise.ca> <49F4A8A7.9060109@ecs.soton.ac.uk> <20090426185257.2AC1F1702E@out-b.mx.mail-launder.com> <200904270628.n3R6Spuc008276@safir.blacknight.ie> <20090427092756.689B617023@out-b.mx.mail-launder.com> <200904271243.n3RChmiu031589@safir.blacknight.ie> <20090427141557.9C6C117025@out-b.mx.mail-launder.com> <8FD70134-81B0-4BCF-8D21-AE70ABAE1942@trunknetworks.com> <5AF4C52B-FF88-479A-BE68-6174758C9769@trunknetworks.com> Message-ID: Drew Marshall wrote on Mon, 27 Apr 2009 18:57:35 +0100: > This one should be fine Yes, it's back to normal now. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Tue Apr 28 10:31:18 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Tue Apr 28 10:31:31 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> Message-ID: Kevin Miller wrote on Mon, 27 Apr 2009 08:37:00 -0800: > Yes - change the above "dash dash" to "dash dash space". look again. The separator is correct. It's a QP message. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From spamlists at coders.co.uk Tue Apr 28 11:03:49 2009 From: spamlists at coders.co.uk (Matt) Date: Tue Apr 28 11:05:06 2009 Subject: Maximum Processing Attempts In-Reply-To: References: <49F4A7D2.4060100@ecs.soton.ac.uk> <49F62640.3080504@ecs.soton.ac.uk> Message-ID: <49F6D485.2020501@coders.co.uk> Kai Schaetzl wrote: > >From the past discussion I think it is mainly those heavy-traffic sites > that would benefit from it. I think we had exactly two folks mentioning a > problem with occasional messages getting not processed somehow. Both with > high-volume sites. So, the majority does not need this feature to be on. > On the other hand, exactly those people who need it will also be hit most > by the performance hit (as small as it may be). > > Unfortunately none of them participated in the recent discussion. > I run a high volume service and up until recently I have had nothing to add as we have have only been affected by this issue once. However, in the last couple of weeks we have had this happen to two of servers. Within in 20 minutes the queues had grown to unexceptable levels and the LA on the box jumped hugely. It took me over an hour to track down which message caused the issue (as an aside - adding the message back in to the processing queue about an hour later and it went through fine!). I for one would have accepted the the tiny hit a few SQLite queries per message would have caused had the code been avalible then. I hope to have the code in production by the end of the week matt From t.d.lee at durham.ac.uk Tue Apr 28 11:06:33 2009 From: t.d.lee at durham.ac.uk (David Lee) Date: Tue Apr 28 11:07:03 2009 Subject: Maximum Processing Attempts In-Reply-To: References: <49F4A7D2.4060100@ecs.soton.ac.uk> <49F62640.3080504@ecs.soton.ac.uk> Message-ID: On Tue, 28 Apr 2009, Kai Schaetzl wrote: > Julian Field wrote on Mon, 27 Apr 2009 22:40:16 +0100: > >> Should I leave it switched on by default, so heavily loaded sites can >> switch it off to gain that extra bit of performance, at the cost of a >> potential reliability hit? > >> From the past discussion I think it is mainly those heavy-traffic sites > that would benefit from it. I think we had exactly two folks mentioning a > problem with occasional messages getting not processed somehow. Both with > high-volume sites. So, the majority does not need this feature to be on. > On the other hand, exactly those people who need it will also be hit most > by the performance hit (as small as it may be). > Unfortunately none of them participated in the recent discussion. Kai, the feature isn't primarily about "occasional messages getting not processed somehow". Rather it is about the severe knock-on effects that can have. (Reminder: If there is some characteristic with a number of emails that causes perl/MS to crash, then that causes the whole "batch", including many innocent emails, not to get processed. Subsequent runs keep tripping over the same thing. If there are a few more such rogue emails than there are MS children, then almost all the innocent email gets held up indefinitely. Such rogue emails are typically spam, and so there tend to be many instances of it. Yes, the problem is rare. But when it hits, it can be very severe: all email blocked; massive inbound queue build-up; load average through the roof.) We've been running it in production ever since Julian first put it into a beta. (I was honour-bound to do so; I had suggested it!) I haven't noticed a performance impact. My vote is to leave it on. Email sys.admins have varying ability. When this problem hits, even experienced sys.admins struggle. (Been there; more than once.) The less experienced would struggle even more. The default of this option should be biased in favour of the inexperienced sys.admin. So the default (I suggest) should be "on". (A sys.admin. who is experienced enough to know they don't need it is, by definition, experienced enough to find their way to switching it off.) Hope that helps. -- : David Lee I.T. Service : : Senior Systems Programmer Computer Centre : : UNIX Team Leader Durham University : : South Road : : http://www.dur.ac.uk/t.d.lee/ Durham DH1 3LE : : Phone: +44 191 334 2752 U.K. : From MailScanner at ecs.soton.ac.uk Tue Apr 28 11:52:26 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 28 11:52:58 2009 Subject: Maximum Processing Attempts In-Reply-To: References: <49F4A7D2.4060100@ecs.soton.ac.uk> <49F62640.3080504@ecs.soton.ac.uk> <49F6DFEA.9000808@ecs.soton.ac.uk> Message-ID: On 28/04/2009 11:06, David Lee wrote: > On Tue, 28 Apr 2009, Kai Schaetzl wrote: > >> Julian Field wrote on Mon, 27 Apr 2009 22:40:16 +0100: >> >>> Should I leave it switched on by default, so heavily loaded sites can >>> switch it off to gain that extra bit of performance, at the cost of a >>> potential reliability hit? >> >>> From the past discussion I think it is mainly those heavy-traffic sites >> that would benefit from it. I think we had exactly two folks >> mentioning a >> problem with occasional messages getting not processed somehow. Both >> with >> high-volume sites. So, the majority does not need this feature to be on. >> On the other hand, exactly those people who need it will also be hit >> most >> by the performance hit (as small as it may be). >> Unfortunately none of them participated in the recent discussion. > > Kai, the feature isn't primarily about "occasional messages getting > not processed somehow". Rather it is about the severe knock-on > effects that can have. > > (Reminder: If there is some characteristic with a number of emails > that causes perl/MS to crash, then that causes the whole "batch", > including many innocent emails, not to get processed. Subsequent runs > keep tripping over the same thing. If there are a few more such rogue > emails than there are MS children, then almost all the innocent email > gets held up indefinitely. Such rogue emails are typically spam, and > so there tend to be many instances of it. Yes, the problem is rare. > But when it hits, it can be very severe: all email blocked; massive > inbound queue build-up; load average through the roof.) > > We've been running it in production ever since Julian first put it > into a beta. (I was honour-bound to do so; I had suggested it!) I > haven't noticed a performance impact. > > > My vote is to leave it on. > > Email sys.admins have varying ability. When this problem hits, even > experienced sys.admins struggle. (Been there; more than once.) The > less experienced would struggle even more. The default of this option > should be biased in favour of the inexperienced sys.admin. So the > default (I suggest) should be "on". (A sys.admin. who is experienced > enough to know they don't need it is, by definition, experienced > enough to find their way to switching it off.) > I am convinced by these arguments. I have improved the code since the last beta, so that it pre-prepares all the SQL statements once when the database is opened, so the SQL code should be even faster than it was. I have also switched off the fsync() call that was done at the end of every database write operation, so that should speed it up too. I will release a new beta right now for you to test what is hopefully the final version of the code, and the feature will remain enabled in the production stable release. Those who know enough that they can dig themselves out of the hole without the assistance of this feature can switch it off. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 Follow me at twitter.com/JulesFM and twitter.com/MailScanner -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Tue Apr 28 11:56:21 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 28 11:56:43 2009 Subject: 4.76.22 References: <49F6E0D5.1020809@ecs.soton.ac.uk> Message-ID: I have just released a new beta, this will be one of the last before the next stable release. Please test it, as I have optimised the processing-messages database code, and fixed one or two little bugs. The Change Log will tell you all the details. Download as usual from www.mailscanner.info. Thanks! Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 Follow me at twitter.com/JulesFM and twitter.com/MailScanner -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From jonas at vrt.dk Tue Apr 28 12:03:31 2009 From: jonas at vrt.dk (Jonas Akrouh Larsen) Date: Tue Apr 28 12:03:42 2009 Subject: Maximum Processing Attempts In-Reply-To: References: <49F4A7D2.4060100@ecs.soton.ac.uk> <49F62640.3080504@ecs.soton.ac.uk> Message-ID: <001301c9c7f0$f7e92520$e7bb6f60$@dk> > Unfortunately none of them participated in the recent discussion. > I was one of those who pushed for this feature originally. We don?t really run a high volume service as such. (only around 10k mails scanned per day) Still this feature will help a lot when a crash/problem does occur with a mail. As somebody else just said, it can take a long time to track down precisely which mail is causing the problem, while your queue starts to clime until u stop ur smtp server. On topic: Its fine either way for me if its left on or off by default, as long as I know its there. However I do not see any good reason to disable it by default? As have been said, those who run high enough volume/loads for it to be a factor will be looking into tweaking in any case, so they should find this option automatically and turn it off if they so desire. As long as its described in the conf and or on the wiki, I don?t see why it should be turned off by default. That?s just my 5 cents. Med venlig hilsen / Best regards Jonas Akrouh Larsen TechBiz ApS Laplandsgade 4, 2. sal 2300 K?benhavn S Office: 7020 0979 Direct: 3336 9974 Mobile: 5120 1096 Fax: 7020 0978 Web: www.techbiz.dk From spamlists at coders.co.uk Tue Apr 28 12:12:34 2009 From: spamlists at coders.co.uk (Matt) Date: Tue Apr 28 12:13:36 2009 Subject: Spear Phishing sa-update Channel Update (my that is wordy!) Message-ID: <49F6E4A2.7070001@coders.co.uk> All Based on some input from the sa-users list, I have re-worked Jule's script to use Regexp::Assemble. This means that the file looks completely different but has the same functionality and also compiles alot quicker. If you don't know what I am talking about please see Jules' log book post http://www.jules.fm/Logbook/files/anti-spear-phishing.html matt From ms-list at alexb.ch Tue Apr 28 12:21:45 2009 From: ms-list at alexb.ch (Alex Broens) Date: Tue Apr 28 12:21:54 2009 Subject: Spear Phishing sa-update Channel Update (my that is wordy!) In-Reply-To: <49F6E4A2.7070001@coders.co.uk> References: <49F6E4A2.7070001@coders.co.uk> Message-ID: <49F6E6C9.4010201@alexb.ch> On 4/28/2009 1:12 PM, Matt wrote: > All > > Based on some input from the sa-users list, I have re-worked Jule's > script to use Regexp::Assemble. This means that the file looks > completely different but has the same functionality and also compiles > alot quicker. > > If you don't know what I am talking about please see Jules' log book post > > http://www.jules.fm/Logbook/files/anti-spear-phishing.html > does anoybody have any daily stats regarding hits? Alex From gulenler at boun.edu.tr Tue Apr 28 12:30:55 2009 From: gulenler at boun.edu.tr (Berk Gulenler) Date: Tue Apr 28 12:31:12 2009 Subject: MailScanner Stops Suddenly Message-ID: <49F6E8EF.7020204@boun.edu.tr> Hi, I think MailScanner has a problem with handling the process db (I'm not entirely sure). After queue size exceed 3000 mails, MailScanner suddenly stops working. Is there anyone having the same problem? Thanks. -- Berk Gulenler System Administrator Bogazici University Computer Center Phone: +90 212 359 47 20 Fax: +90 212 257 50 21 E-mail: gulenler@boun.edu.tr From spamlists at coders.co.uk Tue Apr 28 13:28:22 2009 From: spamlists at coders.co.uk (Matt) Date: Tue Apr 28 13:29:26 2009 Subject: Spear Phishing sa-update Channel Update (my that is wordy!) In-Reply-To: <49F6E6C9.4010201@alexb.ch> References: <49F6E4A2.7070001@coders.co.uk> <49F6E6C9.4010201@alexb.ch> Message-ID: <49F6F666.4040902@coders.co.uk> Alex Broens wrote: > > does anoybody have any daily stats regarding hits? > It really depends on your environment - these seem to hit educational sites more than anyone else however we do get a few hits every day. matt From maillists at conactive.com Tue Apr 28 13:33:58 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Tue Apr 28 13:34:04 2009 Subject: 4.76.22 In-Reply-To: References: <49F6E0D5.1020809@ecs.soton.ac.uk> Message-ID: Julian Field wrote on Tue, 28 Apr 2009 11:56:21 +0100: > I have just released a new beta, this will be one of the last before the > next stable release. > Please test it, as I have optimised the processing-messages database > code, and fixed one or two little bugs. The Change Log will tell you all > the details. upgraded from 4.75.9. No problems so far. These options got added: Added new: Web Bug Replacement = http://www.mailscanner.tv/1x1spacer.gif Added new: Archives Are = zip rar ole Added new: Archives: Allow Filenames = Added new: Archives: Deny Filenames = Added new: Archives: Filename Rules = %etc- dir%/archives.filename.rules.conf Added new: Archives: Allow Filetypes = Added new: Archives: Allow File MIME Types = Added new: Archives: Deny Filetypes = Added new: Archives: Deny File MIME Types = Added new: Archives: Filetype Rules = %etc- dir%/archives.filetype.rules.conf Added new: Lockfile Dir = /var/spool/MailScanner/incoming/Locks Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From J.Ede at birchenallhowden.co.uk Tue Apr 28 13:45:58 2009 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Tue Apr 28 13:46:26 2009 Subject: 4.76.22 In-Reply-To: References: <49F6E0D5.1020809@ecs.soton.ac.uk> Message-ID: <1213490F1F316842A544A850422BFA96239CFF42@BHLSBS.bhl.local> I'm still having issues with the order of the modules on Centos 5.3 box that has recently upgraded from 5.2. I'm build a fresh box on 5.2 that I'll then upgrade and test... I can still get it to install by moving IO:Stringy and MailTools till after IO and the perl-Math stuff to before IO. Can anyone else confirm this on a 5.2 box that has recently gone up to 5.3? > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- > bounces@lists.mailscanner.info] On Behalf Of Julian Field > Sent: 28 April 2009 11:56 > To: MailScanner discussion > Subject: 4.76.22 > > I have just released a new beta, this will be one of the last before > the > next stable release. > Please test it, as I have optimised the processing-messages database > code, and fixed one or two little bugs. The Change Log will tell you > all > the details. > > Download as usual from www.mailscanner.info. > > Thanks! > > Jules > > -- > Julian Field MEng CITP CEng > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > Need help customising MailScanner? > Contact me! > Need help fixing or optimising your systems? > Contact me! > Need help getting you started solving new requirements from your boss? > Contact me! > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > Follow me at twitter.com/JulesFM and twitter.com/MailScanner > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From J.Ede at birchenallhowden.co.uk Tue Apr 28 14:14:06 2009 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Tue Apr 28 14:14:26 2009 Subject: 4.76.22 In-Reply-To: References: <49F6E0D5.1020809@ecs.soton.ac.uk> Message-ID: <1213490F1F316842A544A850422BFA96239CFF4E@BHLSBS.bhl.local> Jules, The new signature embedded with the _ SIGNATURE _ bit (extra spaces in there) works a treat. I've even tested it with messages bounced around internally so there are multiple entries of that within an email and they all get replaced. If there is more than 1 of those tags in an email then it seems that there is also an extra copy of the sig appended to the end of the email though. Jason > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- > bounces@lists.mailscanner.info] On Behalf Of Julian Field > Sent: 28 April 2009 11:56 > To: MailScanner discussion > Subject: 4.76.22 > > I have just released a new beta, this will be one of the last before > the > next stable release. > Please test it, as I have optimised the processing-messages database > code, and fixed one or two little bugs. The Change Log will tell you > all > the details. > > Download as usual from www.mailscanner.info. > > Thanks! > > Jules > > -- > Julian Field MEng CITP CEng > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > Need help customising MailScanner? > Contact me! > Need help fixing or optimising your systems? > Contact me! > Need help getting you started solving new requirements from your boss? > Contact me! > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > Follow me at twitter.com/JulesFM and twitter.com/MailScanner > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Apr 28 15:23:55 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 28 15:24:22 2009 Subject: 4.76.22 In-Reply-To: <1213490F1F316842A544A850422BFA96239CFF42@BHLSBS.bhl.local> References: <49F6E0D5.1020809@ecs.soton.ac.uk> <1213490F1F316842A544A850422BFA96239CFF42@BHLSBS.bhl.local> <49F7117B.4050003@ecs.soton.ac.uk> Message-ID: If you are cleanly installing boxes with 5.2 then upgrading them to 5.3, why pray not just install 5.3 in the first place, as we all know that works. I cannot cope with every combination of every upgrade that has ever happened to a system in the past. That's just not practical. Jules. On 28/04/2009 13:45, Jason Ede wrote: > I'm still having issues with the order of the modules on Centos 5.3 box that has recently upgraded from 5.2. I'm build a fresh box on 5.2 that I'll then upgrade and test... I can still get it to install by moving IO:Stringy and MailTools till after IO and the perl-Math stuff to before IO. > > Can anyone else confirm this on a 5.2 box that has recently gone up to 5.3? > > >> -----Original Message----- >> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- >> bounces@lists.mailscanner.info] On Behalf Of Julian Field >> Sent: 28 April 2009 11:56 >> To: MailScanner discussion >> Subject: 4.76.22 >> >> I have just released a new beta, this will be one of the last before >> the >> next stable release. >> Please test it, as I have optimised the processing-messages database >> code, and fixed one or two little bugs. The Change Log will tell you >> all >> the details. >> >> Download as usual from www.mailscanner.info. >> >> Thanks! >> >> Jules >> >> -- >> Julian Field MEng CITP CEng >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> >> Need help customising MailScanner? >> Contact me! >> Need help fixing or optimising your systems? >> Contact me! >> Need help getting you started solving new requirements from your boss? >> Contact me! >> >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> Follow me at twitter.com/JulesFM and twitter.com/MailScanner >> >> >> -- >> This message has been scanned for viruses and >> dangerous content by MailScanner, and is >> believed to be clean. >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From lubega at gmail.com Tue Apr 28 16:06:09 2009 From: lubega at gmail.com (Lubega) Date: Tue Apr 28 16:06:18 2009 Subject: Mailscanner Strange message Message-ID: <7c1dbd70904280806ve409352i7c69b180d63458c2@mail.gmail.com> Hello to all, I've recently installed my mail server with Mailscanner, with spamassin 3.2.5, clamav 0.95, and razor. I received a message today from a sender I use to contact, but te header is {disarmed} and the text of the message is "-- MailScanner was attacked by a Denial Of Service attack, and has therefore deleted this part of the message. Please contact your e-mail providers for more information if you need it, giving them the whole of this report. Attack in: /var/spool/MailScanner/incoming/7245/5F0062E58056.F21D6/msg-7245-4.html " When I try to find that report, it doesn't exists, and I'm little Scary about that. Seemingly there's no problem: Spam is being filter, I can send and receive mails... I don't know what to do or the real importance of this trouble. Anyone can help me? Thanks in advance P.D. Sorry if my english is no good enough :D -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090428/561bf66f/attachment.html From J.Ede at birchenallhowden.co.uk Tue Apr 28 16:10:26 2009 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Tue Apr 28 16:10:47 2009 Subject: 4.76.22 In-Reply-To: References: <49F6E0D5.1020809@ecs.soton.ac.uk> <1213490F1F316842A544A850422BFA96239CFF42@BHLSBS.bhl.local> <49F7117B.4050003@ecs.soton.ac.uk> Message-ID: <1213490F1F316842A544A850422BFA96239CFF6C@BHLSBS.bhl.local> I'll schedule to move the boxes over to a clean 5.3 install then. Jason > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- > bounces@lists.mailscanner.info] On Behalf Of Julian Field > Sent: 28 April 2009 15:24 > To: MailScanner discussion > Subject: Re: 4.76.22 > > If you are cleanly installing boxes with 5.2 then upgrading them to > 5.3, > why pray not just install 5.3 in the first place, as we all know that > works. > > I cannot cope with every combination of every upgrade that has ever > happened to a system in the past. That's just not practical. > > Jules. > > On 28/04/2009 13:45, Jason Ede wrote: > > I'm still having issues with the order of the modules on Centos 5.3 > box that has recently upgraded from 5.2. I'm build a fresh box on 5.2 > that I'll then upgrade and test... I can still get it to install by > moving IO:Stringy and MailTools till after IO and the perl-Math stuff > to before IO. > > > > Can anyone else confirm this on a 5.2 box that has recently gone up > to 5.3? > > > > > >> -----Original Message----- > >> From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner- > >> bounces@lists.mailscanner.info] On Behalf Of Julian Field > >> Sent: 28 April 2009 11:56 > >> To: MailScanner discussion > >> Subject: 4.76.22 > >> > >> I have just released a new beta, this will be one of the last before > >> the > >> next stable release. > >> Please test it, as I have optimised the processing-messages database > >> code, and fixed one or two little bugs. The Change Log will tell you > >> all > >> the details. > >> > >> Download as usual from www.mailscanner.info. > >> > >> Thanks! > >> > >> Jules > >> > >> -- > >> Julian Field MEng CITP CEng > >> www.MailScanner.info > >> Buy the MailScanner book at www.MailScanner.info/store > >> > >> Need help customising MailScanner? > >> Contact me! > >> Need help fixing or optimising your systems? > >> Contact me! > >> Need help getting you started solving new requirements from your > boss? > >> Contact me! > >> > >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >> Follow me at twitter.com/JulesFM and twitter.com/MailScanner > >> > >> > >> -- > >> This message has been scanned for viruses and > >> dangerous content by MailScanner, and is > >> believed to be clean. > >> > >> -- > >> MailScanner mailing list > >> mailscanner@lists.mailscanner.info > >> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >> > >> Before posting, read http://wiki.mailscanner.info/posting > >> > >> Support MailScanner development - buy the book off the website! > >> > > Jules > > -- > Julian Field MEng CITP CEng > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > MailScanner customisation, or any advanced system administration help? > Contact me at Jules@Jules.FM > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > PGP public key: http://www.jules.fm/julesfm.asc > Follow me at twitter.com/JulesFM > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From michael at cyber-mage.com Tue Apr 28 16:21:22 2009 From: michael at cyber-mage.com (Michael Van Der Beek) Date: Tue Apr 28 16:20:06 2009 Subject: 4.76.22 In-Reply-To: References: <49F6E0D5.1020809@ecs.soton.ac.uk> Message-ID: <49F71EF2.6030201@cyber-mage.com> Hi Julian, There are some who build their servers in VPS (virtual private servers). These facilities don't usually have the latest distros available. Most I've seen are still at 5.2 so upgrading is necessary : ) Yes, I'm one of those.. running in 360meg ram, postfix+dovecot (set in virtual domains), MailScanner,clamd, mysql, lighttpd,drupal, and squid (and I don't know what else yet.. : ) Oh only running one child process of Mailscanner if you're interested : ) with a few domains thrown in for friends and relatives. Regards, Michael Julian Field wrote: > If you are cleanly installing boxes with 5.2 then upgrading them to > 5.3, why pray not just install 5.3 in the first place, as we all know > that works. > > I cannot cope with every combination of every upgrade that has ever > happened to a system in the past. That's just not practical. > > Jules. > > On 28/04/2009 13:45, Jason Ede wrote: >> I'm still having issues with the order of the modules on Centos 5.3 >> box that has recently upgraded from 5.2. I'm build a fresh box on 5.2 >> that I'll then upgrade and test... I can still get it to install by >> moving IO:Stringy and MailTools till after IO and the perl-Math stuff >> to before IO. >> >> Can anyone else confirm this on a 5.2 box that has recently gone up >> to 5.3? >> >> >>> -----Original Message----- >>> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- >>> bounces@lists.mailscanner.info] On Behalf Of Julian Field >>> Sent: 28 April 2009 11:56 >>> To: MailScanner discussion >>> Subject: 4.76.22 >>> >>> I have just released a new beta, this will be one of the last before >>> the >>> next stable release. >>> Please test it, as I have optimised the processing-messages database >>> code, and fixed one or two little bugs. The Change Log will tell you >>> all >>> the details. >>> >>> Download as usual from www.mailscanner.info. >>> >>> Thanks! >>> >>> Jules >>> >>> -- >>> Julian Field MEng CITP CEng >>> www.MailScanner.info >>> Buy the MailScanner book at www.MailScanner.info/store >>> >>> Need help customising MailScanner? >>> Contact me! >>> Need help fixing or optimising your systems? >>> Contact me! >>> Need help getting you started solving new requirements from your boss? >>> Contact me! >>> >>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>> Follow me at twitter.com/JulesFM and twitter.com/MailScanner >>> >>> >>> -- >>> This message has been scanned for viruses and >>> dangerous content by MailScanner, and is >>> believed to be clean. >>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> > > Jules > From MailScanner at ecs.soton.ac.uk Tue Apr 28 16:35:21 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 28 16:35:48 2009 Subject: 4.76.22 In-Reply-To: <49F71EF2.6030201@cyber-mage.com> References: <49F6E0D5.1020809@ecs.soton.ac.uk> <49F71EF2.6030201@cyber-mage.com> <49F72239.7090200@ecs.soton.ac.uk> Message-ID: On 28/04/2009 16:21, Michael Van Der Beek wrote: > Hi Julian, > > There are some who build their servers in VPS (virtual private > servers). These facilities don't usually have the latest distros > available. > Most I've seen are still at 5.2 so upgrading is necessary : ) I disagree. What features of 5.3 do you need? 5.2 is still fully-supported with patches and so on, you can just continue to "yum update" your servers and keep them at 5.2. I see no reason to upgrade them at all. > Julian Field wrote: >> If you are cleanly installing boxes with 5.2 then upgrading them to >> 5.3, why pray not just install 5.3 in the first place, as we all know >> that works. >> >> I cannot cope with every combination of every upgrade that has ever >> happened to a system in the past. That's just not practical. >> >> Jules. >> >> On 28/04/2009 13:45, Jason Ede wrote: >>> I'm still having issues with the order of the modules on Centos 5.3 >>> box that has recently upgraded from 5.2. I'm build a fresh box on >>> 5.2 that I'll then upgrade and test... I can still get it to install >>> by moving IO:Stringy and MailTools till after IO and the perl-Math >>> stuff to before IO. >>> >>> Can anyone else confirm this on a 5.2 box that has recently gone up >>> to 5.3? >>> >>>> -----Original Message----- >>>> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- >>>> bounces@lists.mailscanner.info] On Behalf Of Julian Field >>>> Sent: 28 April 2009 11:56 >>>> To: MailScanner discussion >>>> Subject: 4.76.22 >>>> >>>> I have just released a new beta, this will be one of the last before >>>> the >>>> next stable release. >>>> Please test it, as I have optimised the processing-messages database >>>> code, and fixed one or two little bugs. The Change Log will tell you >>>> all >>>> the details. >>>> >>>> Download as usual from www.mailscanner.info. >>>> >>>> Thanks! >>>> >>>> Jules >>>> >>>> -- >>>> Julian Field MEng CITP CEng >>>> www.MailScanner.info >>>> Buy the MailScanner book at www.MailScanner.info/store >>>> >>>> Need help customising MailScanner? >>>> Contact me! >>>> Need help fixing or optimising your systems? >>>> Contact me! >>>> Need help getting you started solving new requirements from your boss? >>>> Contact me! >>>> >>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>>> Follow me at twitter.com/JulesFM and twitter.com/MailScanner >>>> >>>> >>>> -- >>>> This message has been scanned for viruses and >>>> dangerous content by MailScanner, and is >>>> believed to be clean. >>>> >>>> -- >>>> MailScanner mailing list >>>> mailscanner@lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >> >> Jules >> > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From john at tradoc.fr Tue Apr 28 16:41:36 2009 From: john at tradoc.fr (John Wilcock) Date: Tue Apr 28 16:44:26 2009 Subject: 4.76.22 In-Reply-To: References: <49F6E0D5.1020809@ecs.soton.ac.uk> Message-ID: <49F723B0.4010000@tradoc.fr> Le 28/04/2009 12:56, Julian Field a ?crit : > I have just released a new beta, this will be one of the last before the > next stable release. > Please test it, as I have optimised the processing-messages database > code, and fixed one or two little bugs. The Change Log will tell you all > the details. > > Download as usual from www.mailscanner.info. > > Thanks! > > Jules > I haven't had time to test the new beta myself, but I do have one little request for a correction to a long-standing minor niggle that I forgot to report earlier: Your update_bad_phishing_sites script stores its working data as a subdirectory of the quarantine directory, which results in a spurious "hi/ng/phis" date being reported in MailWatch's list of quarantine directories, and also requires you to implement a workaround to stop this subdirectory being deleted by the quarantine cleaning script. Simply shifting to the SpamAssassin User State Directory instead would avoid both these problems. John. -- -- Over 3000 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr From J.Ede at birchenallhowden.co.uk Tue Apr 28 16:45:43 2009 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Tue Apr 28 16:47:10 2009 Subject: 4.76.22 In-Reply-To: <49F71EF2.6030201@cyber-mage.com> References: , <49F71EF2.6030201@cyber-mage.com> Message-ID: <1213490F1F316842A544A850422BFA96239BA534@BHLSBS.bhl.local> If you're interested Michael, here is the order that works for me. ________________________________________ From: mailscanner-bounces@lists.mailscanner.info [mailscanner-bounces@lists.mailscanner.info] On Behalf Of Michael Van Der Beek [michael@cyber-mage.com] Sent: 28 April 2009 16:21 To: MailScanner discussion Subject: Re: 4.76.22 Hi Julian, There are some who build their servers in VPS (virtual private servers). These facilities don't usually have the latest distros available. Most I've seen are still at 5.2 so upgrading is necessary : ) Yes, I'm one of those.. running in 360meg ram, postfix+dovecot (set in virtual domains), MailScanner,clamd, mysql, lighttpd,drupal, and squid (and I don't know what else yet.. : ) Oh only running one child process of Mailscanner if you're interested : ) with a few domains thrown in for friends and relatives. Regards, Michael Julian Field wrote: > If you are cleanly installing boxes with 5.2 then upgrading them to > 5.3, why pray not just install 5.3 in the first place, as we all know > that works. > > I cannot cope with every combination of every upgrade that has ever > happened to a system in the past. That's just not practical. > > Jules. > > On 28/04/2009 13:45, Jason Ede wrote: >> I'm still having issues with the order of the modules on Centos 5.3 >> box that has recently upgraded from 5.2. I'm build a fresh box on 5.2 >> that I'll then upgrade and test... I can still get it to install by >> moving IO:Stringy and MailTools till after IO and the perl-Math stuff >> to before IO. >> >> Can anyone else confirm this on a 5.2 box that has recently gone up >> to 5.3? >> >> >>> -----Original Message----- >>> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- >>> bounces@lists.mailscanner.info] On Behalf Of Julian Field >>> Sent: 28 April 2009 11:56 >>> To: MailScanner discussion >>> Subject: 4.76.22 >>> >>> I have just released a new beta, this will be one of the last before >>> the >>> next stable release. >>> Please test it, as I have optimised the processing-messages database >>> code, and fixed one or two little bugs. The Change Log will tell you >>> all >>> the details. >>> >>> Download as usual from www.mailscanner.info. >>> >>> Thanks! >>> >>> Jules >>> >>> -- >>> Julian Field MEng CITP CEng >>> www.MailScanner.info >>> Buy the MailScanner book at www.MailScanner.info/store >>> >>> Need help customising MailScanner? >>> Contact me! >>> Need help fixing or optimising your systems? >>> Contact me! >>> Need help getting you started solving new requirements from your boss? >>> Contact me! >>> >>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>> Follow me at twitter.com/JulesFM and twitter.com/MailScanner >>> >>> >>> -- >>> This message has been scanned for viruses and >>> dangerous content by MailScanner, and is >>> believed to be clean. >>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> > > Jules > -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- #!/bin/sh MOD="File::Spec File-Spec 0.82 3 noarch no no ExtUtils::MakeMaker ExtUtils-MakeMaker 6.50 1 noarch no no Math::BigInt Math-BigInt 1.89 1 noarch no no Math::BigRat Math-BigRat 0.22 1 noarch no no bignum bignum 0.23 1 noarch no no MIME::Base64 MIME-Base64 3.07 3 arch no no IsABundle TimeDate 1.16 4 noarch no no Pod::Escapes Pod-Escapes 1.04 2 noarch no no Pod::Simple Pod-Simple 3.05 2 noarch no no Test::Harness Test-Harness 2.64 3 noarch no no Test::Simple Test-Simple 0.86 2 noarch no no Test::Pod Test-Pod 1.26 2 noarch no no IO IO 1.2301 4 noarch no no IsABundle IO-stringy 2.110 2 noarch no no IsABundle MailTools 2.04 2 noarch no no File::Temp File-Temp 0.20 4 noarch no no HTML::Tagset HTML-Tagset 3.03 2 noarch no no HTML::Parser HTML-Parser 3.56 2 arch no no Convert::BinHex Convert-BinHex 1.119 3 noarch no no IsABundle MIME-tools 5.427 2 noarch no no Convert::TNEF Convert-TNEF 0.17 2 noarch no no Compress::Zlib Compress-Zlib 1.41 2 arch no no Archive::Zip Archive-Zip 1.16 2 noarch no no Scalar::Util Scalar-List-Utils 1.19 3 noarch no no Storable Storable 2.16 3 noarch no no DBI DBI 1.607 1 noarch no no DBD::SQLite DBD-SQLite 1.21 1 noarch no no Getopt::Long Getopt-Long 2.38 2 noarch no no Time::HiRes Time-HiRes 1.9707 3 noarch no no Filesys::Df Filesys-Df 0.90 2 noarch no no Net::CIDR Net-CIDR 0.13 1 noarch no no Net::IP Net-IP 1.25 2 noarch no no Sys::Hostname::Long Sys-Hostname-Long 1.4 2 noarch no no Sys::Syslog Sys-Syslog 0.27 1 noarch no no Digest::MD5 Digest-MD5 2.36 3 noarch no no Digest::SHA1 Digest-SHA1 2.11 2 noarch no no Digest::HMAC Digest-HMAC 1.01 1 noarch no no Net::DNS Net-DNS 0.65 1 noarch no no OLE::Storage_Lite OLE-Storage_Lite 0.16 2 noarch no no" # Wait for n seconds unless they ran me with "fast" on the command-line timewait () { DELAY=$1 if [ "x$FAST" = "x" ]; then sleep $DELAY fi } ( echo echo I am logging everything into \"install.log\". timewait 3 echo if [ -x /bin/rpmbuild ]; then RPMBUILD=/bin/rpmbuild elif [ -x /usr/bin/rpmbuild ]; then RPMBUILD=/usr/bin/rpmbuild elif [ -x /bin/rpm ]; then RPMBUILD=/bin/rpm elif [ -x /usr/bin/rpm ]; then RPMBUILD=/usr/bin/rpm else echo I cannot find any rpm or rpmbuild command on your path. echo Please check you are definitely using an RPM-based system. echo If you are, then please install the RPMs called rpm and echo rpm-build, then try running this script again. echo exit 1 fi echo if [ -x /bin/patch -o -x /usr/bin/patch ]; then echo Good. You have the patch command. else echo You need to install the patch command from your Linux distribution. echo Once you have done that, please try running this script again. exit 1 fi # Check that /usr/src/redhat exists echo if [ -d ~/rpmbuild ]; then echo Aha, a new Fedora system building in your home directory. RPMROOT=~/rpmbuild elif [ -d /usr/src/redhat ]; then echo Good, you have /usr/src/redhat in place. RPMROOT=/usr/src/redhat elif [ -d /usr/src/RPM ]; then echo Okay, you have /usr/src/RPM. RPMROOT=/usr/src/RPM elif [ -d /usr/src/rpm ]; then echo Okay, you have /usr/src/rpm. RPMROOT=/usr/src/rpm elif [ -d /usr/src/packages ]; then echo Okay, you have /usr/src/packages. RPMROOT=/usr/src/packages elif rpmbuild --showrc | grep ': _topdir' | grep -q 'HOME.*rpmbuild'; then echo Okay, a recent system building into '~/rpmbuild'. RPMROOT=~/rpmbuild else echo Your /usr/src/redhat, /usr/src/RPM or /usr/src/packages echo tree is missing. echo If you have access to an RPM called rpm-build or rpmbuild echo then install it first and come back and try again. echo exit 1 fi # Fix up 2 problems with Mandriva ONFIVE='no' if [ -f /etc/redhat-release ]; then if egrep -qi 'mandrake|mandriva' /etc/redhat-release then echo I think you are running on Mandrake or Mandriva. echo There are 2 problems I need to correct. # Mandriva only DONT_CLEAN_PERL=1 export DONT_CLEAN_PERL if [ -f /usr/lib/rpm/brp-compress ]; then perl -pi.bak -e 's/^COMPRESS=(.*)-n/COMPRESS=$1/' /usr/lib/rpm/brp-compress timewait 1 echo Done. else echo Failed to find /usr/lib/rpm/brp-compress. echo Have you installed the rpm-build package\? echo You need to do that first or I cannot do anything. exit 1 fi timewait 5 fi # Don't force install of anything on RedHat 5 or CentOS 5 or above if grep -q 'release *[56]' /etc/redhat-release then echo You are running release 5 of RedHat, or a clone. #echo So I will only force the installation of a very few Perl modules. timewait 2 ONFIVE='yes' fi if grep -iq 'Fedora' /etc/redhat-release then if grep -q '1[0-9]' /etc/redhat-release then echo You are running a Fedora 10 or above system. #echo So I will only force the installation of a very few Perl modules. timewait 2 ONFIVE='yes' else echo You are running Fedora 9 or below system. #echo But you are running Fedora, so I am going to force the installation #echo of the Perl modules that normally require it. timewait 2 ONFIVE='no' fi fi fi export ONFIVE # Ensure that the RPM macro # %_unpackaged_files_terminate_build 1 # is set. Otherwise package building will fail. echo if grep -qs '%_unpackaged_files_terminate_build[ ][ ]*0' ~/.rpmmacros then echo Good, unpackaged files will not break the build process. else echo Writing a .rpmmacros file in your home directory to stop echo unpackaged files breaking the build process. echo You can delete it once MailScanner is installed if you want to. echo '%_unpackaged_files_terminate_build 0' >> ~/.rpmmacros echo timewait 10 fi if grep -qs '%__perl_requires[ ][ ]*%{!?nil}' ~/.rpmmacros then echo Good, far-too-clever Perl requirements will be ignored. else echo Adding to the .rpmmacros file in your home directory to stop echo RPM trying to be too clever finding Perl requirements. echo You can delete it once MailScanner is installed if you want to. echo '%__perl_requires %{!?nil}' >> ~/.rpmmacros echo timewait 10 fi if grep -qs '%__arch_install_post[ ][ ]*%{nil}' ~/.rpmmacros then echo Good, Fedora 8 options will be ignored. else echo Adding to the .rpmmacros file in your home directory to stop echo RPM trying to break on Fedora 8. echo You can delete it once MailScanner is installed if you want to. echo '%__arch_install_post %{nil}' >> ~/.rpmmacros echo timewait 10 fi timewait 5 # Process the command-line options # This is blatantly plagiarised from the typical "./configure" produced by # "autoconf". If we need to get more complicated, then we should probably # migrate towards using "autoconf" itself. (Hence not optimising this part, to # preserve resemblance and encourage compability with "autoconf" conventions.) as_me=`(basename "$0") 2>/dev/null` ac_init_help= ignoreperl= nodeps= fast= nomodules= reinstall= for ac_option do ac_optarg=`expr "x$ac_option" : 'x[^=]*=\(.*\)'` case $ac_option in ignore-perl) ignoreperl=$ac_option ;; nodeps) nodeps=$ac_option ;; reinstall) reinstall=$ac_option ;; --reinstall) reinstall=$ac_option ;; fast) fast=$ac_option ;; --fast) fast=$ac_option ;; --nomodules) nomodules=$ac_option ;; nomodules) nomodules=$ac_option ;; --help | -h) ac_init_help=long ;; -*) { echo "$as_me: error: unrecognized option: $ac_option Try \`$0 --help' for more information." >&2 { (exit 1); exit 1; }; } ;; *) { echo "$as_me: error: unrecognized argument: $ac_option Try \`$0 --help' for more information." >&2 { (exit 1); exit 1; }; } ;; esac done if test "$ac_init_help" = "long"; then cat <<_ACEOF Usage: $0 [OPTION]... [VAR=VALUE]... -h, --help display this help and exit nodeps ignore dependencies when installing MailScanner ignore-perl ignore perl versions check fast do not wait for long during installation reinstall force uninstallation of Perl modules before install nomodules do not install required Perl modules _ACEOF fi test -n "$ac_init_help" && exit 0 # Set variables for later use IGNORE_PERL=$ignoreperl NODEPS=$nodeps FAST=$fast NOMODULES=$nomodules REINSTALL=$reinstall # Check they don't have 2 Perl installations, this will cause all sorts # of grief later. echo if [ \! "x$IGNORE_PERL" = "xignore-perl" ] ; then if [ -x /usr/bin/perl -a -f /usr/local/bin/perl -a -x /usr/local/bin/perl ] ; then echo You appear to have 2 versions of Perl installed, echo the normal one in /usr/bin and one in /usr/local. echo This often happens if you have used CPAN to install modules. PERL1=`ls -l /usr/bin/perl | awk '{ print $NF }'` PERL2=`ls -l /usr/local/bin/perl | awk '{ print $NF }'` if [ "x$PERL1" = "x$PERL2" ]; then echo Fortunately they both point to the same place, so you are fine. sleep 2 else echo I strongly advise you remove all traces of perl from echo within /usr/local and then run this script again. echo echo If you do not want to do that, and really want to continue, echo then you will need to run this script as echo ' ./install.sh ignore-perl' echo exit 1 fi else echo Good, you appear to only have 1 copy of Perl installed. fi fi PERL="/usr/bin/perl" # Check to see if they want to ignore dependencies in the final # MailScanner RPM install. if [ \! "x$NODEPS" = "x" ] then NODEPS='--nodeps' else NODEPS= fi # Check that they aren't on a RaQ3 with a broken copy of Perl 5.005003. if [ -d /usr/lib/perl5/5.00503/i386-linux/CORE ]; then echo echo I think you are running Perl 5.00503. echo Ensuring that you have all the header files that are needed echo to build HTML-Parser which is used by both MailScanner and echo SpamAssassin. touch /usr/lib/perl5/5.00503/i386-linux/CORE/opnames.h touch /usr/lib/perl5/5.00503/i386-linux/CORE/perlapi.h touch /usr/lib/perl5/5.00503/i386-linux/CORE/utf8.h touch /usr/lib/perl5/5.00503/i386-linux/CORE/warnings.h fi # Check that they aren't missing pod2text but have pod2man. if [ -x /usr/bin/pod2man -a \! -x /usr/bin/pod2text ] ; then echo echo You appear to have pod2man but not pod2text. echo Creating pod2text for you. ln -s pod2man /usr/bin/pod2text fi # Check they have the development tools installed on SuSE if [ -f /etc/SuSE-release -o -f /etc/redhat-release ]; then echo echo I think you are running on RedHat Linux, Mandriva Linux or SuSE Linux. GCC=gcc #if [ -f /etc/redhat-release ] && fgrep -q ' 6.' /etc/redhat-release ; then # # RedHat used egcs in RedHat 6 and not gcc # GCC=egcs #fi if rpm -q binutils glibc-devel $GCC make >/dev/null 2>&1 ; then echo Good, you appear to have the basic development tools installed. timewait 5 else echo You must have the following RPM packages installed before echo you try and do anything else: echo ' binutils glibc-devel' $GCC 'make' echo You are missing at least 1 of these. echo Please install them all echo '(Read the manuals if you do not know how to do this).' echo Then come back and run this install.sh script again. echo exit 1 fi fi echo echo This script will pause for a few seconds after each major step, echo so do not worry if it appears to stop for a while. echo If you want it to stop so you can scroll back through the output echo then press Ctrl-S to stop the output and Ctrl-Q to start it again. echo timewait 10 echo echo If this fails due to dependency checks, and you wish to ignore echo these problems, you can run echo ' ./install.sh nodeps' timewait 5 echo echo Setting Perl5 search path echo #PERL5LIB=`perl -V | grep site_perl | grep -v config_args | tr -d ' ' | tr '\n' ':'` #export PERL5LIB LOCALPERL5LIB=`./getPERLLIB` export LOCALPERL5LIB # Work out the architecture we are building for BUILDARCH=`rpm -q --queryformat='%{ARCH}' perl` # Fedora Core 3 reports both i386 and x86_64, so use x86_64 if [ $BUILDARCH = 'i386x86_64' -o $BUILDARCH = 'x86_64i386' ]; then BUILDARCH='x86_64' fi export BUILDARCH echo I think your system will build architecture-dependent modules for $BUILDARCH # If they are upgrading from an old version of MailScanner before 4.76.11 # then insist that we delete all the old RPM packages and install new ones. OLDMSVERSION=`rpm -q --queryformat='%{VERSION}' mailscanner` OLDMSLEN=`echo $OLDMSVERSION | wc -m` #echo VERSION = $OLDMSVERSION LENGTH = $OLDMSLEN if echo "$OLDMSVERSION" | grep -q 'not installed'; then REINSTALL=yes fi if [ -n "$OLDMSVERSION" -a "$OLDMSLEN" -le 15 ]; then VONE=`echo $OLDMSVERSION | cut -d. -f1` VTWO=`echo $OLDMSVERSION | cut -d. -f2` VTHREE=`echo $OLDMSVERSION | cut -d. -f3` #echo 1 = $VONE, 2 = $VTWO, 3 = $VTHREE if [ "$VONE" -lt 4 ]; then REINSTALL=yes elif [ "$VONE" -eq 4 ]; then if [ "$VTWO" -lt 76 ]; then REINSTALL=yes elif [ "$VTWO" -eq 76 ]; then if [ "$VTHREE" -lt 11 ]; then REINSTALL=yes fi fi fi fi if [ "x$REINSTALL" \!= "x" ]; then echo echo Deleting all the old versions of your Perl modules, echo I will re-install them in a minute. echo timewait 5 while read MODNAME MODFILE VERS BUILD ARC FORCE FORCE5 do if rpm -q --quiet perl-${MODFILE}; then echo -n Removing perl-${MODFILE} rpm -e --nodeps --allmatches perl-${MODFILE} >/dev/null 2>&1 echo fi done </dev/null || rpm -q perl-${MODFILE}-${VERS}-${BUILD} >/dev/null 2>&1 ; then echo Oh good, module ${MODFILE} version ${VERS} is already installed. echo timewait 5 else FILEPREFIX=perl-${MODFILE}-${VERS}-${BUILD} ## Need to install my customised version of MIME-Base64 #if [ "x${MODFILE}" = "xMIME-Base64" ]; then # FILEPREFIX=MailScanner-${FILEPREFIX} #fi echo Attempting to build and install ${FILEPREFIX} if [ -f ${FILEPREFIX}.src.rpm ]; then if [ "x${MODFILE}" = "xCompress-Zlib" -o "x${MODFILE}" = "xTest-Harness" -o "x${MODFILE}" = "xTest-Simple" ]; then echo Detected Compress-Zlib, building appropriately... PERL5LIB= $RPMBUILD --rebuild ${FILEPREFIX}.src.rpm elif [ "x${MODFILE}" = "xNet-DNS" ]; then # Net-DNS asks a question about live tests, don't want them. yes n | $RPMBUILD --rebuild ${FILEPREFIX}.src.rpm else $RPMBUILD --rebuild ${FILEPREFIX}.src.rpm fi timewait 10 echo echo echo else echo Missing file ${FILEPREFIX}.src.rpm. Are you in the right directory\? timewait 10 echo fi if [ -f ${RPMROOT}/RPMS/${ARC}/${FILEPREFIX}.${ARC}.rpm ]; then echo echo Do not worry too much about errors from the next command. echo It is quite likely that some of the Perl modules are echo already installed on your system. echo echo The important ones are HTML-Parser and MIME-tools. echo timewait 10 if [ -f /etc/SuSE-release -a "x${MODFILE}" = "xMIME-tools" ]; then echo As you are running SuSE, I have to force installation of echo the MIME-tools package to ensure you have all the security echo patches applied. rpm -Uvh --force ${NODEPS} ${RPMROOT}/RPMS/${ARC}/${FILEPREFIX}.${ARC}.rpm elif [ "x${FORCE}${ONFIVE}" = "xyesno" -o "x${FORCE5}${ONFIVE}" = "xyesyes" ]; then echo I have to force installation of ${MODFILE}. Sorry. rpm -Uvh --force ${NODEPS} ${RPMROOT}/RPMS/${ARC}/${FILEPREFIX}.${ARC}.rpm else rpm -Uvh ${NODEPS} ${RPMROOT}/RPMS/${ARC}/${FILEPREFIX}.${ARC}.rpm fi timewait 10 echo echo echo else echo Missing file ${RPMROOT}/RPMS/${ARC}/${FILEPREFIX}.${ARC}.rpm. echo Maybe it did not build correctly\? timewait 10 echo fi PERL5LIB="$OLDPERL5LIB" export PERL5LIB fi done </dev/null | wc -w` if [ $rpmnew -ne 0 ]; then echo echo 'There are new *.rpmnew files in /usr/lib/MailScanner.' echo 'You should rename each of these over the top of the old' echo 'version of each file, but remember to copy any changes' echo 'you have made to the old versions.' echo fi sleep 5 echo '----------------------------------------------------------' echo 'Please buy the MailScanner book from www.mailscanner.info!' echo 'It is a very useful administration guide and introduction' echo 'to MailScanner. All the proceeds go directly to making' echo 'MailScanner a better supported package than it is today.' echo ) 2>&1 | tee install.log From J.Ede at birchenallhowden.co.uk Tue Apr 28 16:46:26 2009 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Tue Apr 28 16:48:48 2009 Subject: 4.76.22 In-Reply-To: References: <49F6E0D5.1020809@ecs.soton.ac.uk> <49F71EF2.6030201@cyber-mage.com> <49F72239.7090200@ecs.soton.ac.uk>, Message-ID: <1213490F1F316842A544A850422BFA96239BA535@BHLSBS.bhl.local> A yum update on a centos 5.2 box will update it to 5.3 automatically. ________________________________________ From: mailscanner-bounces@lists.mailscanner.info [mailscanner-bounces@lists.mailscanner.info] On Behalf Of Julian Field [MailScanner@ecs.soton.ac.uk] Sent: 28 April 2009 16:35 To: MailScanner discussion Subject: Re: 4.76.22 On 28/04/2009 16:21, Michael Van Der Beek wrote: > Hi Julian, > > There are some who build their servers in VPS (virtual private > servers). These facilities don't usually have the latest distros > available. > Most I've seen are still at 5.2 so upgrading is necessary : ) I disagree. What features of 5.3 do you need? 5.2 is still fully-supported with patches and so on, you can just continue to "yum update" your servers and keep them at 5.2. I see no reason to upgrade them at all. > Julian Field wrote: >> If you are cleanly installing boxes with 5.2 then upgrading them to >> 5.3, why pray not just install 5.3 in the first place, as we all know >> that works. >> >> I cannot cope with every combination of every upgrade that has ever >> happened to a system in the past. That's just not practical. >> >> Jules. >> >> On 28/04/2009 13:45, Jason Ede wrote: >>> I'm still having issues with the order of the modules on Centos 5.3 >>> box that has recently upgraded from 5.2. I'm build a fresh box on >>> 5.2 that I'll then upgrade and test... I can still get it to install >>> by moving IO:Stringy and MailTools till after IO and the perl-Math >>> stuff to before IO. >>> >>> Can anyone else confirm this on a 5.2 box that has recently gone up >>> to 5.3? >>> >>>> -----Original Message----- >>>> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- >>>> bounces@lists.mailscanner.info] On Behalf Of Julian Field >>>> Sent: 28 April 2009 11:56 >>>> To: MailScanner discussion >>>> Subject: 4.76.22 >>>> >>>> I have just released a new beta, this will be one of the last before >>>> the >>>> next stable release. >>>> Please test it, as I have optimised the processing-messages database >>>> code, and fixed one or two little bugs. The Change Log will tell you >>>> all >>>> the details. >>>> >>>> Download as usual from www.mailscanner.info. >>>> >>>> Thanks! >>>> >>>> Jules >>>> >>>> -- >>>> Julian Field MEng CITP CEng >>>> www.MailScanner.info >>>> Buy the MailScanner book at www.MailScanner.info/store >>>> >>>> Need help customising MailScanner? >>>> Contact me! >>>> Need help fixing or optimising your systems? >>>> Contact me! >>>> Need help getting you started solving new requirements from your boss? >>>> Contact me! >>>> >>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>>> Follow me at twitter.com/JulesFM and twitter.com/MailScanner >>>> >>>> >>>> -- >>>> This message has been scanned for viruses and >>>> dangerous content by MailScanner, and is >>>> believed to be clean. >>>> >>>> -- >>>> MailScanner mailing list >>>> mailscanner@lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >> >> Jules >> > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From craigwhite at azapple.com Tue Apr 28 16:55:48 2009 From: craigwhite at azapple.com (Craig White) Date: Tue Apr 28 16:56:10 2009 Subject: 4.76.22 In-Reply-To: References: <49F6E0D5.1020809@ecs.soton.ac.uk> <49F71EF2.6030201@cyber-mage.com> <49F72239.7090200@ecs.soton.ac.uk> Message-ID: <1240934148.1902.87.camel@lin-workstation.azapple.com> On Tue, 2009-04-28 at 16:35 +0100, Julian Field wrote: > > On 28/04/2009 16:21, Michael Van Der Beek wrote: > > Hi Julian, > > > > There are some who build their servers in VPS (virtual private > > servers). These facilities don't usually have the latest distros > > available. > > Most I've seen are still at 5.2 so upgrading is necessary : ) > I disagree. What features of 5.3 do you need? 5.2 is still > fully-supported with patches and so on, you can just continue to "yum > update" your servers and keep them at 5.2. I see no reason to upgrade > them at all. ---- if you simply do 'yum update' on a CentOS 5.2 system, it automatically upgrades it to 5.3. That is the automatic path for updating a CentOS system. Craig -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Tue Apr 28 17:15:55 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 28 17:16:24 2009 Subject: 4.76.22 In-Reply-To: <1213490F1F316842A544A850422BFA96239BA534@BHLSBS.bhl.local> References: , <49F71EF2.6030201@cyber-mage.com> <1213490F1F316842A544A850422BFA96239BA534@BHLSBS.bhl.local> <49F72BBB.2000009@ecs.soton.ac.uk> Message-ID: Ah, okay, I didn't appreciate RedHat and CentOS were different in this respect. You just patch RedHat systems, no "upgrade" ever happens. I have changed the installation order to what you have suggested, let's see if it all still works for everyone else! Hopefully, having had a good look through the changes, nothing should break. On 28/04/2009 16:45, Jason Ede wrote: > If you're interested Michael, here is the order that works for me. > > ________________________________________ > From: mailscanner-bounces@lists.mailscanner.info [mailscanner-bounces@lists.mailscanner.info] On Behalf Of Michael Van Der Beek [michael@cyber-mage.com] > Sent: 28 April 2009 16:21 > To: MailScanner discussion > Subject: Re: 4.76.22 > > Hi Julian, > > There are some who build their servers in VPS (virtual private servers). > These facilities don't usually have the latest distros available. > Most I've seen are still at 5.2 so upgrading is necessary : ) > > Yes, I'm one of those.. running in 360meg ram, postfix+dovecot (set in > virtual domains), MailScanner,clamd, mysql, lighttpd,drupal, and squid > (and I don't know what else yet.. : ) > Oh only running one child process of Mailscanner if you're interested : > ) with a few domains thrown in for friends and relatives. > > Regards, > > Michael > > Julian Field wrote: > >> If you are cleanly installing boxes with 5.2 then upgrading them to >> 5.3, why pray not just install 5.3 in the first place, as we all know >> that works. >> >> I cannot cope with every combination of every upgrade that has ever >> happened to a system in the past. That's just not practical. >> >> Jules. >> >> On 28/04/2009 13:45, Jason Ede wrote: >> >>> I'm still having issues with the order of the modules on Centos 5.3 >>> box that has recently upgraded from 5.2. I'm build a fresh box on 5.2 >>> that I'll then upgrade and test... I can still get it to install by >>> moving IO:Stringy and MailTools till after IO and the perl-Math stuff >>> to before IO. >>> >>> Can anyone else confirm this on a 5.2 box that has recently gone up >>> to 5.3? >>> >>> >>> >>>> -----Original Message----- >>>> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- >>>> bounces@lists.mailscanner.info] On Behalf Of Julian Field >>>> Sent: 28 April 2009 11:56 >>>> To: MailScanner discussion >>>> Subject: 4.76.22 >>>> >>>> I have just released a new beta, this will be one of the last before >>>> the >>>> next stable release. >>>> Please test it, as I have optimised the processing-messages database >>>> code, and fixed one or two little bugs. The Change Log will tell you >>>> all >>>> the details. >>>> >>>> Download as usual from www.mailscanner.info. >>>> >>>> Thanks! >>>> >>>> Jules >>>> >>>> -- >>>> Julian Field MEng CITP CEng >>>> www.MailScanner.info >>>> Buy the MailScanner book at www.MailScanner.info/store >>>> >>>> Need help customising MailScanner? >>>> Contact me! >>>> Need help fixing or optimising your systems? >>>> Contact me! >>>> Need help getting you started solving new requirements from your boss? >>>> Contact me! >>>> >>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>>> Follow me at twitter.com/JulesFM and twitter.com/MailScanner >>>> >>>> >>>> -- >>>> This message has been scanned for viruses and >>>> dangerous content by MailScanner, and is >>>> believed to be clean. >>>> >>>> -- >>>> MailScanner mailing list >>>> mailscanner@lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >> Jules >> >> > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From Kevin_Miller at ci.juneau.ak.us Tue Apr 28 17:29:13 2009 From: Kevin_Miller at ci.juneau.ak.us (Kevin Miller) Date: Tue Apr 28 17:29:24 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> Message-ID: <4A09477D575C2C4B86497161427DD94C0D153E2A77@city-exchange07> Kai Schaetzl wrote: > Kevin Miller wrote on Mon, 27 Apr 2009 08:37:00 -0800: > >> Yes - change the above "dash dash" to "dash dash space". > > look again. The separator is correct. It's a QP message. > > Kai > > -- > Kai Sch?tzl, Berlin, Germany > Get your web at Conactive Internet Services: http://www.conactive.com What's a "QP" message? Interestingly, the MailScanner footer is preceeded by dash dash space and doesn't appear in the reply. You're signature just has dashes but I presume it originally had a space following. So where is that getting stripped? Do email clients parse from the bottom up until they see the last instance of dash dash space and then change any others to just dual dashes? I'm reading the list with Outlook 2003. Not sure what happens in other clients... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 From J.Ede at birchenallhowden.co.uk Tue Apr 28 17:34:02 2009 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Tue Apr 28 17:34:21 2009 Subject: 4.76.22 Message-ID: <1213490F1F316842A544A850422BFA96239BA536@BHLSBS.bhl.local> So its basically yum update on centos that is broke and seems like they're confusing update and upgrade. :) Sent from my Windows Mobile? phone. -----Original Message----- From: Julian Field Sent: 28 April 2009 17:22 To: MailScanner discussion Subject: Re: 4.76.22 Ah, okay, I didn't appreciate RedHat and CentOS were different in this respect. You just patch RedHat systems, no "upgrade" ever happens. I have changed the installation order to what you have suggested, let's see if it all still works for everyone else! Hopefully, having had a good look through the changes, nothing should break. On 28/04/2009 16:45, Jason Ede wrote: > If you're interested Michael, here is the order that works for me. > > ________________________________________ > From: mailscanner-bounces@lists.mailscanner.info [mailscanner-bounces@lists.mailscanner.info] On Behalf Of Michael Van Der Beek [michael@cyber-mage.com] > Sent: 28 April 2009 16:21 > To: MailScanner discussion > Subject: Re: 4.76.22 > > Hi Julian, > > There are some who build their servers in VPS (virtual private servers). > These facilities don't usually have the latest distros available. > Most I've seen are still at 5.2 so upgrading is necessary : ) > > Yes, I'm one of those.. running in 360meg ram, postfix+dovecot (set in > virtual domains), MailScanner,clamd, mysql, lighttpd,drupal, and squid > (and I don't know what else yet.. : ) > Oh only running one child process of Mailscanner if you're interested : > ) with a few domains thrown in for friends and relatives. > > Regards, > > Michael > > Julian Field wrote: > >> If you are cleanly installing boxes with 5.2 then upgrading them to >> 5.3, why pray not just install 5.3 in the first place, as we all know >> that works. >> >> I cannot cope with every combination of every upgrade that has ever >> happened to a system in the past. That's just not practical. >> >> Jules. >> >> On 28/04/2009 13:45, Jason Ede wrote: >> >>> I'm still having issues with the order of the modules on Centos 5.3 >>> box that has recently upgraded from 5.2. I'm build a fresh box on 5.2 >>> that I'll then upgrade and test... I can still get it to install by >>> moving IO:Stringy and MailTools till after IO and the perl-Math stuff >>> to before IO. >>> >>> Can anyone else confirm this on a 5.2 box that has recently gone up >>> to 5.3? >>> >>> >>> >>>> -----Original Message----- >>>> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- >>>> bounces@lists.mailscanner.info] On Behalf Of Julian Field >>>> Sent: 28 April 2009 11:56 >>>> To: MailScanner discussion >>>> Subject: 4.76.22 >>>> >>>> I have just released a new beta, this will be one of the last before >>>> the >>>> next stable release. >>>> Please test it, as I have optimised the processing-messages database >>>> code, and fixed one or two little bugs. The Change Log will tell you >>>> all >>>> the details. >>>> >>>> Download as usual from www.mailscanner.info. >>>> >>>> Thanks! >>>> >>>> Jules >>>> >>>> -- >>>> Julian Field MEng CITP CEng >>>> www.MailScanner.info >>>> Buy the MailScanner book at www.MailScanner.info/store >>>> >>>> Need help customising MailScanner? >>>> Contact me! >>>> Need help fixing or optimising your systems? >>>> Contact me! >>>> Need help getting you started solving new requirements from your boss? >>>> Contact me! >>>> >>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>>> Follow me at twitter.com/JulesFM and twitter.com/MailScanner >>>> >>>> >>>> -- >>>> This message has been scanned for viruses and >>>> dangerous content by MailScanner, and is >>>> believed to be clean. >>>> >>>> -- >>>> MailScanner mailing list >>>> mailscanner@lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >> Jules >> >> > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From craigwhite at azapple.com Tue Apr 28 17:46:41 2009 From: craigwhite at azapple.com (Craig White) Date: Tue Apr 28 17:46:56 2009 Subject: 4.76.22 In-Reply-To: <1213490F1F316842A544A850422BFA96239BA536@BHLSBS.bhl.local> References: <1213490F1F316842A544A850422BFA96239BA536@BHLSBS.bhl.local> Message-ID: <1240937201.1902.97.camel@lin-workstation.azapple.com> No - RHEL and CentOS do things pretty much the same. i.e., CentOS 5 and RHELv5 The designation of 5.3 is probably more important when you want a set of installation disks as they differ from 5.2 installation disks but after install and update to current, they should be the same regardless of which you originally installed. Any other reference is more to the effect of saying that you are up-to-date. Craig On Tue, 2009-04-28 at 17:34 +0100, Jason Ede wrote: > So its basically yum update on centos that is broke and seems like they're confusing update and upgrade. :) > > Sent from my Windows Mobile? phone. > > -----Original Message----- > From: Julian Field > Sent: 28 April 2009 17:22 > To: MailScanner discussion > Subject: Re: 4.76.22 > > > Ah, okay, I didn't appreciate RedHat and CentOS were different in this > respect. You just patch RedHat systems, no "upgrade" ever happens. > > I have changed the installation order to what you have suggested, let's > see if it all still works for everyone else! Hopefully, having had a > good look through the changes, nothing should break. > > On 28/04/2009 16:45, Jason Ede wrote: > > If you're interested Michael, here is the order that works for me. > > > > ________________________________________ > > From: mailscanner-bounces@lists.mailscanner.info [mailscanner-bounces@lists.mailscanner.info] On Behalf Of Michael Van Der Beek [michael@cyber-mage.com] > > Sent: 28 April 2009 16:21 > > To: MailScanner discussion > > Subject: Re: 4.76.22 > > > > Hi Julian, > > > > There are some who build their servers in VPS (virtual private servers). > > These facilities don't usually have the latest distros available. > > Most I've seen are still at 5.2 so upgrading is necessary : ) > > > > Yes, I'm one of those.. running in 360meg ram, postfix+dovecot (set in > > virtual domains), MailScanner,clamd, mysql, lighttpd,drupal, and squid > > (and I don't know what else yet.. : ) > > Oh only running one child process of Mailscanner if you're interested : > > ) with a few domains thrown in for friends and relatives. > > > > Regards, > > > > Michael > > > > Julian Field wrote: > > > >> If you are cleanly installing boxes with 5.2 then upgrading them to > >> 5.3, why pray not just install 5.3 in the first place, as we all know > >> that works. > >> > >> I cannot cope with every combination of every upgrade that has ever > >> happened to a system in the past. That's just not practical. > >> > >> Jules. > >> > >> On 28/04/2009 13:45, Jason Ede wrote: > >> > >>> I'm still having issues with the order of the modules on Centos 5.3 > >>> box that has recently upgraded from 5.2. I'm build a fresh box on 5.2 > >>> that I'll then upgrade and test... I can still get it to install by > >>> moving IO:Stringy and MailTools till after IO and the perl-Math stuff > >>> to before IO. > >>> > >>> Can anyone else confirm this on a 5.2 box that has recently gone up > >>> to 5.3? > >>> > >>> > >>> > >>>> -----Original Message----- > >>>> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- > >>>> bounces@lists.mailscanner.info] On Behalf Of Julian Field > >>>> Sent: 28 April 2009 11:56 > >>>> To: MailScanner discussion > >>>> Subject: 4.76.22 > >>>> > >>>> I have just released a new beta, this will be one of the last before > >>>> the > >>>> next stable release. > >>>> Please test it, as I have optimised the processing-messages database > >>>> code, and fixed one or two little bugs. The Change Log will tell you > >>>> all > >>>> the details. > >>>> > >>>> Download as usual from www.mailscanner.info. > >>>> > >>>> Thanks! > >>>> > >>>> Jules > >>>> > >>>> -- > >>>> Julian Field MEng CITP CEng > >>>> www.MailScanner.info > >>>> Buy the MailScanner book at www.MailScanner.info/store > >>>> > >>>> Need help customising MailScanner? > >>>> Contact me! > >>>> Need help fixing or optimising your systems? > >>>> Contact me! > >>>> Need help getting you started solving new requirements from your boss? > >>>> Contact me! > >>>> > >>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >>>> Follow me at twitter.com/JulesFM and twitter.com/MailScanner > >>>> > >>>> > >>>> -- > >>>> This message has been scanned for viruses and > >>>> dangerous content by MailScanner, and is > >>>> believed to be clean. > >>>> > >>>> -- > >>>> MailScanner mailing list > >>>> mailscanner@lists.mailscanner.info > >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >>>> > >>>> Before posting, read http://wiki.mailscanner.info/posting > >>>> > >>>> Support MailScanner development - buy the book off the website! > >>>> > >>>> > >> Jules > >> > >> > > -- > > MailScanner mailing list > > mailscanner@lists.mailscanner.info > > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > > > Before posting, read http://wiki.mailscanner.info/posting > > > > Support MailScanner development - buy the book off the website! > > Jules > > -- > Julian Field MEng CITP CEng > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > MailScanner customisation, or any advanced system administration help? > Contact me at Jules@Jules.FM > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > PGP public key: http://www.jules.fm/julesfm.asc > Follow me at twitter.com/JulesFM > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From chris at techquility.net Tue Apr 28 18:33:05 2009 From: chris at techquility.net (Chris Barber) Date: Tue Apr 28 18:33:33 2009 Subject: Preventing multiple signatures in email conversation? In-Reply-To: References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07><43F62CA225017044BC84CFAF92B4333B06F530@sbsserver.Techquility.net><49F5E59F.10104@ecs.soton.ac.uk> <43F62CA225017044BC84CFAF92B4333B06F533@sbsserver.Techquility.net><49F5FBCE.8080506@ecs.soton.ac.uk> Message-ID: <43F62CA225017044BC84CFAF92B4333B06F53D@sbsserver.Techquility.net> > >> > From your first paragraph there, are you referring to the "Allow >> Multiple HTML Signatures" setting? >Yes. >> I tried that setting using an image >> tag without a src and it doesn't work for me because some email client >> change the tag that is missing the src to an error message and >> thus MailScanner won't see it when it comes back in. >> >You could put in the src as the same URL as the Web Bug Replacement in >MailScanner.conf. They won't be able to see that, but it will make the >img tag correct. And that URL will always be accessible, and widely >available as it's hosted by an anycast network of servers scattered >around the world. >> > From your reply above it sound like there is another way to get this >> done? >> >Not particularly, should there be another way? It might be nice to be able to specify the string MailScanner looks for when deciding to include the signature or not. The tag isn't good for some of my picky customers who don't like to see the blocked image and download warnings when using a client such as Outlook. If I could specify the text that MailScanner should look for, I could strip the repeat signatures without annoying anyone. Thoughts? >Jules > From MailScanner at ecs.soton.ac.uk Tue Apr 28 19:02:19 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 28 19:02:43 2009 Subject: Preventing multiple signatures in email conversation? In-Reply-To: <43F62CA225017044BC84CFAF92B4333B06F53D@sbsserver.Techquility.net> References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07><43F62CA225017044BC84CFAF92B4333B06F530@sbsserver.Techquility.net><49F5E59F.10104@ecs.soton.ac.uk> <43F62CA225017044BC84CFAF92B4333B06F533@sbsserver.Techquility.net><49F5FBCE.8080506@ecs.soton.ac.uk> <43F62CA225017044BC84CFAF92B4333B06F53D@sbsserver.Techquility.net> <49F744AB.3060306@ecs.soton.ac.uk> Message-ID: On 28/04/2009 18:33, Chris Barber wrote: >> >> >>>> From your first paragraph there, are you referring to the "Allow >>>> >>> Multiple HTML Signatures" setting? >>> >> Yes. >> >>> I tried that setting using an image >>> tag without a src and it doesn't work for me because some email >>> > client > >>> change the tag that is missing the src to an error message and >>> thus MailScanner won't see it when it comes back in. >>> >>> >> You could put in the src as the same URL as the Web Bug Replacement in >> MailScanner.conf. They won't be able to see that, but it will make the >> img tag correct. And that URL will always be accessible, and widely >> available as it's hosted by an anycast network of servers scattered >> around the world. >> >>>> From your reply above it sound like there is another way to get >>>> > this > >>> done? >>> >>> >> Not particularly, should there be another way? >> > It might be nice to be able to specify the string MailScanner looks for > when deciding to include the signature or not. The tag isn't good > for some of my picky customers who don't like to see the blocked image > and download warnings when using a client such as Outlook. > If I could specify the text that MailScanner should look for, I could > strip the repeat signatures without annoying anyone. > Thoughts? > It needs to be in a tag, so I can parse it out easily. That's why I went for an img tag, as the original person who wanted the feature was going to use. If you can suggest an additional attribute of a tag it could go into, I could probably implement that as well. But be warned that all these things slow it all down even further :-( Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From J.Ede at birchenallhowden.co.uk Tue Apr 28 20:19:11 2009 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Tue Apr 28 20:19:27 2009 Subject: 4.76.22 In-Reply-To: References: <49F6E0D5.1020809@ecs.soton.ac.uk> Message-ID: <1213490F1F316842A544A850422BFA96239CFF91@BHLSBS.bhl.local> I've been testing the _SIGNATURE_ option here and it seems that it always adds the signature at the end as well as in the message at the signature tags. I'm using html sigs with an inline image. I've taken at look at what I think is the code in message.pm but it all looks correct to me :( I don't need to change something in the config to stop it signing at the end as well? Jason > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- > bounces@lists.mailscanner.info] On Behalf Of Julian Field > Sent: 28 April 2009 11:56 > To: MailScanner discussion > Subject: 4.76.22 > > I have just released a new beta, this will be one of the last before > the > next stable release. > Please test it, as I have optimised the processing-messages database > code, and fixed one or two little bugs. The Change Log will tell you > all > the details. > > Download as usual from www.mailscanner.info. > > Thanks! > > Jules > > -- > Julian Field MEng CITP CEng > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > Need help customising MailScanner? > Contact me! > Need help fixing or optimising your systems? > Contact me! > Need help getting you started solving new requirements from your boss? > Contact me! > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > Follow me at twitter.com/JulesFM and twitter.com/MailScanner > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Apr 28 20:40:46 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 28 20:41:09 2009 Subject: 4.76.22 In-Reply-To: <1213490F1F316842A544A850422BFA96239CFF91@BHLSBS.bhl.local> References: <49F6E0D5.1020809@ecs.soton.ac.uk> <1213490F1F316842A544A850422BFA96239CFF91@BHLSBS.bhl.local> <49F75BBE.1070202@ecs.soton.ac.uk> Message-ID: On 28/04/2009 20:19, Jason Ede wrote: > I've been testing the _SIGNATURE_ option here and it seems that it always adds the signature at the end as well as in the message at the signature tags. I'm using html sigs with an inline image. I've taken at look at what I think is the code in message.pm but it all looks correct to me :( > Yes, I have looked too, when someone else commented they were getting the sig at the end too. But the code is incredibly simple and I can't see anything wrong with it either. FoundSigMark = 0 FoundSigMark = 1 if we successfully replace _SIGNATURE_ with the signature text. print signature text at end of message unless FoundSigMark is non-zero. That's all there is to it. > I don't need to change something in the config to stop it signing at the end as well? > No. If you could try adding some lines like print STDERR "FoundSigMark = $FoundSigMark\n"; lines into the code at suitable places, then run it on your system with "MailScanner --debug" and see what it prints, that would really help me debug it. Many thanks. >> -----Original Message----- >> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- >> bounces@lists.mailscanner.info] On Behalf Of Julian Field >> Sent: 28 April 2009 11:56 >> To: MailScanner discussion >> Subject: 4.76.22 >> >> I have just released a new beta, this will be one of the last before >> the >> next stable release. >> Please test it, as I have optimised the processing-messages database >> code, and fixed one or two little bugs. The Change Log will tell you >> all >> the details. >> >> Download as usual from www.mailscanner.info. >> Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From glenn.steen at gmail.com Tue Apr 28 21:14:06 2009 From: glenn.steen at gmail.com (Glenn Steen) Date: Tue Apr 28 21:14:16 2009 Subject: Mailscanner Strange message In-Reply-To: <7c1dbd70904280806ve409352i7c69b180d63458c2@mail.gmail.com> References: <7c1dbd70904280806ve409352i7c69b180d63458c2@mail.gmail.com> Message-ID: <223f97700904281314t56e8b804r6de383d5e96dae92@mail.gmail.com> 2009/4/28 Lubega : > Hello to all, > I've recently installed my mail server with Mailscanner, with spamassin > 3.2.5, clamav 0.95, and razor. I received a message today from a sender I > use to contact, but te header is {disarmed} and the text of the message is > "-- MailScanner was attacked by a Denial Of Service attack, and has > therefore deleted this part of the message. Please contact your e-mail > providers for more information if you need it, giving them the whole of this > report. Attack in: > /var/spool/MailScanner/incoming/7245/5F0062E58056.F21D6/msg-7245-4.html " > > When I try to find that report, it doesn't exists, and I'm little Scary > about that. Seemingly there's no problem: Spam is being filter, I can send > and receive mails... > > I don't know what to do or the real importance of this trouble. Anyone can > help me? > Have you looked in the quarantine for 5F0062E58056.F21D6? > Thanks in advance > > P.D. Sorry if my english is no good enough :D > Don't worry about it, it's fine;) Cheers -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From J.Ede at birchenallhowden.co.uk Tue Apr 28 21:16:40 2009 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Tue Apr 28 21:16:58 2009 Subject: 4.76.22 Message-ID: <1213490F1F316842A544A850422BFA96239BA538@BHLSBS.bhl.local> I'll try that tmw. There is nowhere else that the sig could be added is there? Sent from my Windows Mobile? phone. -----Original Message----- From: Julian Field Sent: 28 April 2009 20:47 To: MailScanner discussion Subject: Re: 4.76.22 On 28/04/2009 20:19, Jason Ede wrote: > I've been testing the _SIGNATURE_ option here and it seems that it always adds the signature at the end as well as in the message at the signature tags. I'm using html sigs with an inline image. I've taken at look at what I think is the code in message.pm but it all looks correct to me :( > Yes, I have looked too, when someone else commented they were getting the sig at the end too. But the code is incredibly simple and I can't see anything wrong with it either. FoundSigMark = 0 FoundSigMark = 1 if we successfully replace _SIGNATURE_ with the signature text. print signature text at end of message unless FoundSigMark is non-zero. That's all there is to it. > I don't need to change something in the config to stop it signing at the end as well? > No. If you could try adding some lines like print STDERR "FoundSigMark = $FoundSigMark\n"; lines into the code at suitable places, then run it on your system with "MailScanner --debug" and see what it prints, that would really help me debug it. Many thanks. >> -----Original Message----- >> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- >> bounces@lists.mailscanner.info] On Behalf Of Julian Field >> Sent: 28 April 2009 11:56 >> To: MailScanner discussion >> Subject: 4.76.22 >> >> I have just released a new beta, this will be one of the last before >> the >> next stable release. >> Please test it, as I have optimised the processing-messages database >> code, and fixed one or two little bugs. The Change Log will tell you >> all >> the details. >> >> Download as usual from www.mailscanner.info. >> Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Apr 28 21:35:01 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Tue Apr 28 21:35:23 2009 Subject: 4.76.22 In-Reply-To: <1213490F1F316842A544A850422BFA96239BA538@BHLSBS.bhl.local> References: <1213490F1F316842A544A850422BFA96239BA538@BHLSBS.bhl.local> <49F76875.5030904@ecs.soton.ac.uk> Message-ID: On 28/04/2009 21:16, Jason Ede wrote: > I'll try that tmw. There is nowhere else that the sig could be added is there? > No. That's the code that adds the sig to the message, it's very simple. > Sent from my Windows Mobile? phone. > My condolences to you. > -----Original Message----- > From: Julian Field > Sent: 28 April 2009 20:47 > To: MailScanner discussion > Subject: Re: 4.76.22 > > > On 28/04/2009 20:19, Jason Ede wrote: > >> I've been testing the _SIGNATURE_ option here and it seems that it always adds the signature at the end as well as in the message at the signature tags. I'm using html sigs with an inline image. I've taken at look at what I think is the code in message.pm but it all looks correct to me :( >> >> > Yes, I have looked too, when someone else commented they were getting > the sig at the end too. But the code is incredibly simple and I can't > see anything wrong with it either. > FoundSigMark = 0 > FoundSigMark = 1 if we successfully replace _SIGNATURE_ with the > signature text. > print signature text at end of message unless FoundSigMark is non-zero. > That's all there is to it. > >> I don't need to change something in the config to stop it signing at the end as well? >> >> > No. > If you could try adding some lines like > print STDERR "FoundSigMark = $FoundSigMark\n"; > lines into the code at suitable places, then run it on your system with > "MailScanner --debug" and see what it prints, that would really help me > debug it. > > Many thanks. > >>> -----Original Message----- >>> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- >>> bounces@lists.mailscanner.info] On Behalf Of Julian Field >>> Sent: 28 April 2009 11:56 >>> To: MailScanner discussion >>> Subject: 4.76.22 >>> >>> I have just released a new beta, this will be one of the last before >>> the >>> next stable release. >>> Please test it, as I have optimised the processing-messages database >>> code, and fixed one or two little bugs. The Change Log will tell you >>> all >>> the details. >>> >>> Download as usual from www.mailscanner.info. >>> >>> > Jules > > -- > Julian Field MEng CITP CEng > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > MailScanner customisation, or any advanced system administration help? > Contact me at Jules@Jules.FM > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > PGP public key: http://www.jules.fm/julesfm.asc > Follow me at twitter.com/JulesFM > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From ssilva at sgvwater.com Tue Apr 28 22:26:13 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Tue Apr 28 22:26:36 2009 Subject: Please help - Not catching these spam - LOTS of them In-Reply-To: <73BF1D6676C4E04E9675A08BA0C9825A01804C97@exchsrvr01.CBOCS.com> References: <73BF1D6676C4E04E9675A08BA0C9825A01804C97@exchsrvr01.CBOCS.com> Message-ID: on 4-22-2009 3:43 PM Andrews Carl 448 spake the following: > All of them have an attachment named DSL####.png where the #### is a > four digit number. I have tried to write a spamassassin rule but I do > not know what I am doing because when I run the attached file through > 'spamassassin -t' I get a report of 1.0 requires 5.0 and it states the > message is spam. which is confusting since I am getting an overall score > of 1.0 and need a 5.0 to be spam. > > > Thanks, > Carl > Content analysis details: (20.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 2.5 RCVD_IN_UCE_PFSM_1 RBL: Received via a relay in UCE_PFSM_1 [202.129.232.141 listed in dnsbl-1.uceprotect.net] 0.5 RCVD_IN_BRBL RBL: Received via a relay in BRBL [202.129.232.141 listed in b.barracudacentral.org] 2.0 RCVD_IN_PSBL RBL: Received via a relay in PSBL [202.129.232.141 listed in psbl.surriel.com] 2.0 RCVD_IN_UCE_PFSM_2 RBL: Received via a relay in UCE_PFSM_2 [202.129.232.141 listed in dnsbl-2.uceprotect.net] 0.5 RCVD_IN_LASHBACK RBL: Received via a relay in LashBack [202.129.232.141 listed in ubl.unsubscore.com] 5.0 BAYES_99 BODY: Bayesian spam probability is 99 to 100% [score: 1.0000] 0.1 BOTNET_BADDNS Relay doesn't have full circle DNS [botnet_baddns,ip=170.58.38.140,rdns=gatekeeper.crackerbarrel.com] 4.0 BOTNET Relay might be a spambot or virusbot [botnet0.8,ip=170.58.38.140,rdns=gatekeeper.crackerbarrel.com,baddns] 0.0 T_TVD_FW_GRAPHIC_ID1 BODY: T_TVD_FW_GRAPHIC_ID1 0.0 HTML_MESSAGE BODY: HTML included in message 2.0 INLINE_IMAGE RAW: Inline Images 1.6 PART_CID_STOCK Has a spammy image attachment (by Content-ID) Look for the botnet plugin and install it Here are the rules that hit; header RCVD_IN_UCE_PFSM_1 eval:check_rbl('UCE_PFSM_1', 'dnsbl-1.uceprotect.net') describe RCVD_IN_UCE_PFSM_1 Received via a relay in UCE_PFSM_1 tflags RCVD_IN_UCE_PFSM_1 net score RCVD_IN_UCE_PFSM_1 0 2.50 0 2.50 header RCVD_IN_UCE_PFSM_2 eval:check_rbl('UCE_PFSM_2', 'dnsbl-2.uceprotect.net') describe RCVD_IN_UCE_PFSM_2 Received via a relay in UCE_PFSM_2 tflags RCVD_IN_UCE_PFSM_2 net score RCVD_IN_UCE_PFSM_2 0 2 0 2 header RCVD_IN_UCE_PFSM_3 eval:check_rbl('UCE_PFSM_3', 'dnsbl-3.uceprotect.net') describe RCVD_IN_UCE_PFSM_3 Received via a relay in UCE_PFSM_3 tflags RCVD_IN_UCE_PFSM_3 net score RCVD_IN_UCE_PFSM_3 0 2.50 0 2.50 header RCVD_IN_PSBL eval:check_rbl('psbl', 'psbl.surriel.com.') describe RCVD_IN_PSBL Received via a relay in PSBL tflags RCVD_IN_PSBL net score RCVD_IN_PSBL 0 2 0 2 header RCVD_IN_BRBL eval:check_rbl('brbl', 'b.barracudacentral.org.') describe RCVD_IN_BRBL Received via a relay in BRBL tflags RCVD_IN_BRBL net score RCVD_IN_BRBL 0 0.50 0 0.50 header RCVD_IN_LASHBACK eval:check_rbl('ubl', 'ubl.unsubscore.com.') describe RCVD_IN_LASHBACK Received via a relay in LashBack tflags RCVD_IN_LASHBACK net score RCVD_IN_LASHBACK 0 0.50 0 0.50 -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090428/b28675d8/signature.bin From michael at cyber-mage.com Tue Apr 28 22:59:53 2009 From: michael at cyber-mage.com (Michael Van Der Beek) Date: Tue Apr 28 22:59:03 2009 Subject: 4.76.22 In-Reply-To: References: <49F6E0D5.1020809@ecs.soton.ac.uk> Message-ID: <49F77C59.70902@cyber-mage.com> Hi Julian, I think you misunderstand. What I'm saying is some people don't have a choice to go to 5.3 directly because there is no 5.3 distribution for them to install, because the hosting provider doesn't have 5.3 available yet. So they have to do a yum upgrade/update if the want to go to 5.3. I did not mean that you must upgrade to 5.3. As the others have said its a simple yum upgrade command. Regards, Michael Julian Field wrote: > > > On 28/04/2009 16:21, Michael Van Der Beek wrote: >> Hi Julian, >> >> There are some who build their servers in VPS (virtual private >> servers). These facilities don't usually have the latest distros >> available. >> Most I've seen are still at 5.2 so upgrading is necessary : ) > I disagree. What features of 5.3 do you need? 5.2 is still > fully-supported with patches and so on, you can just continue to "yum > update" your servers and keep them at 5.2. I see no reason to upgrade > them at all. > >> Julian Field wrote: >>> If you are cleanly installing boxes with 5.2 then upgrading them to >>> 5.3, why pray not just install 5.3 in the first place, as we all >>> know that works. >>> >>> I cannot cope with every combination of every upgrade that has ever >>> happened to a system in the past. That's just not practical. >>> >>> Jules. >>> >>> On 28/04/2009 13:45, Jason Ede wrote: >>>> I'm still having issues with the order of the modules on Centos 5.3 >>>> box that has recently upgraded from 5.2. I'm build a fresh box on >>>> 5.2 that I'll then upgrade and test... I can still get it to >>>> install by moving IO:Stringy and MailTools till after IO and the >>>> perl-Math stuff to before IO. >>>> >>>> Can anyone else confirm this on a 5.2 box that has recently gone up >>>> to 5.3? >>>> >>>>> -----Original Message----- >>>>> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- >>>>> bounces@lists.mailscanner.info] On Behalf Of Julian Field >>>>> Sent: 28 April 2009 11:56 >>>>> To: MailScanner discussion >>>>> Subject: 4.76.22 >>>>> >>>>> I have just released a new beta, this will be one of the last before >>>>> the >>>>> next stable release. >>>>> Please test it, as I have optimised the processing-messages database >>>>> code, and fixed one or two little bugs. The Change Log will tell you >>>>> all >>>>> the details. >>>>> >>>>> Download as usual from www.mailscanner.info. >>>>> >>>>> Thanks! >>>>> >>>>> Jules >>>>> >>>>> -- >>>>> Julian Field MEng CITP CEng >>>>> www.MailScanner.info >>>>> Buy the MailScanner book at www.MailScanner.info/store >>>>> >>>>> Need help customising MailScanner? >>>>> Contact me! >>>>> Need help fixing or optimising your systems? >>>>> Contact me! >>>>> Need help getting you started solving new requirements from your >>>>> boss? >>>>> Contact me! >>>>> >>>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>>>> Follow me at twitter.com/JulesFM and twitter.com/MailScanner >>>>> >>>>> >>>>> -- >>>>> This message has been scanned for viruses and >>>>> dangerous content by MailScanner, and is >>>>> believed to be clean. >>>>> >>>>> -- >>>>> MailScanner mailing list >>>>> mailscanner@lists.mailscanner.info >>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>> >>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>> >>>>> Support MailScanner development - buy the book off the website! >>> >>> Jules >>> >> > > Jules > From maillists at conactive.com Tue Apr 28 23:06:16 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Tue Apr 28 23:06:27 2009 Subject: 4.76.22 In-Reply-To: References: <49F6E0D5.1020809@ecs.soton.ac.uk> <49F71EF2.6030201@cyber-mage.com> <49F72239.7090200@ecs.soton.ac.uk> Message-ID: Julian Field wrote on Tue, 28 Apr 2009 16:35:21 +0100: > I disagree. What features of 5.3 do you need? 5.2 is still > fully-supported with patches and so on, you can just continue to "yum > update" your servers and keep them at 5.2. I see no reason to upgrade > them at all. No. 5.2 is not supported. Supported is upgrading it to 5.3. I don't think that his problem is 5.3-specific, anyway, he just happens to install on 5.3. He might get the same on 5.2. It's probably caused by some earlier instalaltion of MailScanner or other Perl modules that are not part of CentOS. I he installs a fresh 5.2 or 5.3 box he probably won't have a problem, like you. (As always I can't comment as I'm not using install.sh :-) Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Tue Apr 28 23:06:16 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Tue Apr 28 23:06:28 2009 Subject: Preventing multiple signatures in email conversation? In-Reply-To: References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> <43F62CA225017044BC84CFAF92B4333B06F530@sbsserver.Techquility.net> <49F5E59F.10104@ecs.soton.ac.uk> <43F62CA225017044BC84CFAF92B4333B06F533@sbsserver.Techquility.net> <49F5FBCE.8080506@ecs.soton.ac.uk> <43F62CA225017044BC84CFAF92B4333B06F53D@sbsserver.Techquility.net> <49F744AB.3060306@ecs.soton.ac.uk> Message-ID: Julian Field wrote on Tue, 28 Apr 2009 19:02:19 +0100: > It needs to be in a tag, so I can parse it out easily. That's why I went > for an img tag, as the original person who wanted the feature was going > to use. If you can suggest an additional attribute of a tag it could go > into, I could probably implement that as well. But be warned that all > these things slow it all down even further :-(
You could actually wrap that around the whole signature. In the example above you could scan for *any* tag with an id of id="mailscanner-removeme" and remove that tag from start to end. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Tue Apr 28 23:06:16 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Tue Apr 28 23:06:29 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: <4A09477D575C2C4B86497161427DD94C0D153E2A77@city-exchange07> References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> <4A09477D575C2C4B86497161427DD94C0D153E2A77@city-exchange07> Message-ID: Kevin Miller wrote on Tue, 28 Apr 2009 08:29:13 -0800: > What's a "QP" message? quoted-printable > > Interestingly, the MailScanner footer is preceeded by dash dash space > and doesn't appear in the reply. You're signature just has dashes > but I presume it originally had a space following. Right. So where is that > getting stripped? Do email clients parse from the bottom up until > they see the last instance of dash dash space and then change any > others to just dual dashes? Yes, it looks like that. My client is doing the same. I thought it's the QP, but it's the duplicate signature marker. No message should have two signature seperators. I would have already complained with Julian, if I had a better solution ;-) Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Tue Apr 28 23:06:16 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Tue Apr 28 23:06:30 2009 Subject: 4.76.22 In-Reply-To: <1213490F1F316842A544A850422BFA96239BA536@BHLSBS.bhl.local> References: <1213490F1F316842A544A850422BFA96239BA536@BHLSBS.bhl.local> Message-ID: Jason Ede wrote on Tue, 28 Apr 2009 17:34:02 +0100: > So its basically yum update on centos that is broke and seems like > they're confusing update and upgrade. :) No. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From ssilva at sgvwater.com Tue Apr 28 23:07:34 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Tue Apr 28 23:07:59 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: References: Message-ID: on 4-25-2009 4:07 AM Paul Hutchings spake the following: > As subject really, we're using MailScanner (4.74.16) and I've not kept > as close an eye on developments/improvements as it basically "just > works". > > The only niggle we do have is that we use it to add a signature to > outbound mail and over the course of an email correspondence you end up > with an email with 15 signatures added to the end. > > Any way yet of stopping this happening? > > Cheers, > Paul > Do you have the standard dash dash space (-- ) at the beginning of your sig on a line by itself? -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090428/61331b9e/signature.bin From MailScanner at ecs.soton.ac.uk Wed Apr 29 00:13:08 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Wed Apr 29 00:13:28 2009 Subject: 4.76.22 In-Reply-To: <49F77C59.70902@cyber-mage.com> References: <49F6E0D5.1020809@ecs.soton.ac.uk> <49F77C59.70902@cyber-mage.com> <49F78D84.2070109@ecs.soton.ac.uk> Message-ID: Yes, agreed. The difference between RedHat and CentOS here is that when you "yum update" a RedHat 5.2 box you don't end up with a RedHat 5.3 box, you end up with a fully patched RedHat 5.2 box. I'm used to using RedHat and not CentOS, and didn't appreciate there was this difference in how they handle "yum update" instructions. My bad. On 28/04/2009 22:59, Michael Van Der Beek wrote: > Hi Julian, > > I think you misunderstand. What I'm saying is some people don't have a > choice to go to 5.3 directly because > there is no 5.3 distribution for them to install, because the hosting > provider doesn't have 5.3 available yet. > So they have to do a yum upgrade/update if the want to go to 5.3. > > I did not mean that you must upgrade to 5.3. As the others have said > its a simple yum upgrade command. > > Regards, > > Michael > > Julian Field wrote: >> >> >> On 28/04/2009 16:21, Michael Van Der Beek wrote: >>> Hi Julian, >>> >>> There are some who build their servers in VPS (virtual private >>> servers). These facilities don't usually have the latest distros >>> available. >>> Most I've seen are still at 5.2 so upgrading is necessary : ) >> I disagree. What features of 5.3 do you need? 5.2 is still >> fully-supported with patches and so on, you can just continue to "yum >> update" your servers and keep them at 5.2. I see no reason to upgrade >> them at all. >> >>> Julian Field wrote: >>>> If you are cleanly installing boxes with 5.2 then upgrading them to >>>> 5.3, why pray not just install 5.3 in the first place, as we all >>>> know that works. >>>> >>>> I cannot cope with every combination of every upgrade that has ever >>>> happened to a system in the past. That's just not practical. >>>> >>>> Jules. >>>> >>>> On 28/04/2009 13:45, Jason Ede wrote: >>>>> I'm still having issues with the order of the modules on Centos >>>>> 5.3 box that has recently upgraded from 5.2. I'm build a fresh box >>>>> on 5.2 that I'll then upgrade and test... I can still get it to >>>>> install by moving IO:Stringy and MailTools till after IO and the >>>>> perl-Math stuff to before IO. >>>>> >>>>> Can anyone else confirm this on a 5.2 box that has recently gone >>>>> up to 5.3? >>>>> >>>>>> -----Original Message----- >>>>>> From: mailscanner-bounces@lists.mailscanner.info >>>>>> [mailto:mailscanner- >>>>>> bounces@lists.mailscanner.info] On Behalf Of Julian Field >>>>>> Sent: 28 April 2009 11:56 >>>>>> To: MailScanner discussion >>>>>> Subject: 4.76.22 >>>>>> >>>>>> I have just released a new beta, this will be one of the last before >>>>>> the >>>>>> next stable release. >>>>>> Please test it, as I have optimised the processing-messages database >>>>>> code, and fixed one or two little bugs. The Change Log will tell you >>>>>> all >>>>>> the details. >>>>>> >>>>>> Download as usual from www.mailscanner.info. >>>>>> >>>>>> Thanks! >>>>>> >>>>>> Jules >>>>>> >>>>>> -- >>>>>> Julian Field MEng CITP CEng >>>>>> www.MailScanner.info >>>>>> Buy the MailScanner book at www.MailScanner.info/store >>>>>> >>>>>> Need help customising MailScanner? >>>>>> Contact me! >>>>>> Need help fixing or optimising your systems? >>>>>> Contact me! >>>>>> Need help getting you started solving new requirements from your >>>>>> boss? >>>>>> Contact me! >>>>>> >>>>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>>>>> Follow me at twitter.com/JulesFM and twitter.com/MailScanner >>>>>> >>>>>> >>>>>> -- >>>>>> This message has been scanned for viruses and >>>>>> dangerous content by MailScanner, and is >>>>>> believed to be clean. >>>>>> >>>>>> -- >>>>>> MailScanner mailing list >>>>>> mailscanner@lists.mailscanner.info >>>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>>> >>>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>>> >>>>>> Support MailScanner development - buy the book off the website! >>>> >>>> Jules >>>> >>> >> >> Jules >> > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From MailScanner at ecs.soton.ac.uk Wed Apr 29 00:21:09 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Wed Apr 29 00:21:29 2009 Subject: Preventing multiple signatures in email conversation? In-Reply-To: References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> <43F62CA225017044BC84CFAF92B4333B06F530@sbsserver.Techquility.net> <49F5E59F.10104@ecs.soton.ac.uk> <43F62CA225017044BC84CFAF92B4333B06F533@sbsserver.Techquility.net> <49F5FBCE.8080506@ecs.soton.ac.uk> <43F62CA225017044BC84CFAF92B4333B06F53D@sbsserver.Techquility.net> <49F744AB.3060306@ecs.soton.ac.uk> <49F78F65.1070502@ecs.soton.ac.uk> Message-ID: On 28/04/2009 23:06, Kai Schaetzl wrote: > Julian Field wrote on Tue, 28 Apr 2009 19:02:19 +0100: > > >> It needs to be in a tag, so I can parse it out easily. That's why I went >> for an img tag, as the original person who wanted the feature was going >> to use. If you can suggest an additional attribute of a tag it could go >> into, I could probably implement that as well. But be warned that all >> these things slow it all down even further :-( >> > >
> > You could actually wrap that around the whole signature. > In the example above you could scan for *any* tag with an id of > id="mailscanner-removeme" and remove that tag from start to end. > I could look for the span or the div and remove that, but I would prefer a tag which didn't have a "close tag" equivalent (such as img) as that makes the parsing a lot safer and simpler. It's all to do with the way that HTML::Parser works, as that does the heavy lifting for me in this case. So we need a tag that is a) valid in most HTML standards b) does not display anything c) does not need a "close" tag "img" fitted the bill rather nicely for the original user of the feature, as he wanted to display an image anyway. Why not just use the "Web Bug Replacement" image in an tag? You can't see it and it fits the other requirements. I agree it's not perfect, but I don't know of a perfect solution. But I'm not a web tech, so there may be something better that I don't know of. I just want to look for the tag. If it's there, I don't add the signature again. Simple as that. So maybe a with an id with no definition would be okay. Is that legal HTML in all the standards? Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From vanhorn at whidbey.com Wed Apr 29 00:32:26 2009 From: vanhorn at whidbey.com (G. Armour Van Horn) Date: Wed Apr 29 00:32:37 2009 Subject: Webmin module Message-ID: <49F7920A.6070902@whidbey.com> I've long been a big WebMin fan, so I was pleased to note on the MS download page a link to a MailScanner module. I immediately grabbed it. It told me MailScanner wasn't running. I went to the configuration, which was all blank, and added the things I could be confident of, but I'm not sure I dare use this for anything yet. Here's what I've got: Full path to MailScanner program : /usr/sbin/MailScanner Full path and filename of MailScanner config file : /etc/MailScanner/MailScanner.conf Full path to the MailScanner bin directory =BLANK= Full path and filename for the MailScanner pid file : /var/run/MailScanner.pid Command to start MailScanner Just run server (selected) Command to stop MailScanner Once I entered that much, the module now thinks MS is running, and "Edit MailScanner Config File" does call up the right file. System is CentOS 4.7, still running MS 4.57.6 but it will be upgraded to the current stable tonight. (Yes, it has been running nicely for over three years.) So what should I have in there as the MS bin directory? I usually start and stop MS with service MailScanner start|stop|restart Or rather more accurately, I normally don't touch that, but that's what I'd use if I had to. What should go in those last two lines? Van -- ---------------------------------------------------------- Sign up now for Quotes of the Day, a handful of quotations on a theme delivered every morning. Enlightenment! Daily, for free! mailto:twisted@whidbey.com?subject=Subscribe_QOTD For photography, web design, hosting, and maintenance, visit Van's home page: http://www.domainvanhorn.com/van/ ----------------------------------------------------------- From ssilva at sgvwater.com Wed Apr 29 00:35:24 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Wed Apr 29 00:35:48 2009 Subject: Slooow MailScanner = bitdefender?? In-Reply-To: <4D373C90AFA24050BDABCAC9CDD9A525@SUPPORT01V> References: <4D373C90AFA24050BDABCAC9CDD9A525@SUPPORT01V> Message-ID: on 4-28-2009 2:27 AM Nigel Kendrick spake the following: > Morning, > > I have a P4 3GHz server running MailScanner 4.75.11 that has has been > working fine, but over the last few days it has taken to slowing down > dramatically and the CPU load hits 13+ > > Admittedly the server could do with a bit more RAM (it has 768MB), but > it has worked fine for several years and the load is very small (<300 > emails a day). > > A quick look at htop shows that the bitdefender update process seems to > run 'forever' and eats up >500MB and then the server goes into swap city > and almost grinds to a halt. > > The upgrade from 4.69.? happened around the same time as the slow down > so has something changed that might have caused this? I guess something > may have just tipped the server over a critical RAM requirement so I am > going to fit some more (1.5GB) but any other thoughts appreciated as > other servers upgraded at the same time (fitted with more RAM) have not > experienced the slow down. > > Thanks > > Nigel Kendrick > > > > Bitdefender has always been a processor hog, and maybe as the signatures get bigger it gets worse. How many children do you run? You could probably get away with one with that low a load. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090428/1f46bbdf/signature-0001.bin From ssilva at sgvwater.com Wed Apr 29 00:45:38 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Wed Apr 29 00:45:57 2009 Subject: Webmin module In-Reply-To: <49F7920A.6070902@whidbey.com> References: <49F7920A.6070902@whidbey.com> Message-ID: on 4-28-2009 4:32 PM G. Armour Van Horn spake the following: > I've long been a big WebMin fan, so I was pleased to note on the MS > download page a link to a MailScanner module. I immediately grabbed it. > It told me MailScanner wasn't running. > > I went to the configuration, which was all blank, and added the things I > could be confident of, but I'm not sure I dare use this for anything > yet. Here's what I've got: > > Full path to MailScanner program : /usr/sbin/MailScanner > Full path and filename of MailScanner config file : > /etc/MailScanner/MailScanner.conf > Full path to the MailScanner bin directory =BLANK= > Full path and filename for the MailScanner pid file : > /var/run/MailScanner.pid > Command to start MailScanner Just run server (selected) > Command to stop MailScanner > > Once I entered that much, the module now thinks MS is running, and "Edit > MailScanner Config File" does call up the right file. > > System is CentOS 4.7, still running MS 4.57.6 but it will be upgraded to > the current stable tonight. (Yes, it has been running nicely for over > three years.) > > So what should I have in there as the MS bin directory? > > I usually start and stop MS with > service MailScanner start|stop|restart > Or rather more accurately, I normally don't touch that, but that's what > I'd use if I had to. What should go in those last two lines? > > Van > I wouldn't use that module, as it is quite out of date and some have complained about config file damage not too long ago. You could probably use it for starting and stopping, but you can write custom commands for that. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090428/ef9cacec/signature.bin From lists at openenterprise.ca Wed Apr 29 02:03:32 2009 From: lists at openenterprise.ca (Johnny Stork) Date: Wed Apr 29 02:03:55 2009 Subject: Blocking Mail from Invalid Email Addresses Message-ID: <49F7A764.5000805@openenterprise.ca> I am running MS 4.72.5 on CentOS 5x. I also run milter-greylist and smf-sav for sender verification but I am not sure its working properly since the email address below (tatrixes_1996@mydomain.ca does NOT exist and in fact there are only 2 valid email addresses on my mail server. So, while I try to figure out whats wrong with smf-sav, is there anywhere else in MS where I can set something to ONLY accept mail from specific address? For some reason I am seeing a flood of around 2000 messages a day to invalid addresses. Fortunately they do get tagged as spam and not delivered, but do fill up the sendmail outbound que. I would rather reject them rather than process. Apr 28 17:57:52 gateway smf-sav[26340]: recipient check succeeded: , 209.216.227.46, mail1.planetnet.com, , [00:00:00] --- Johnny Stork "Empowering Business With Open Solutions" www.openenterprise.ca -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090428/c49174be/attachment.html From kwang at ucalgary.ca Wed Apr 29 02:26:00 2009 From: kwang at ucalgary.ca (Kai Wang) Date: Wed Apr 29 02:26:15 2009 Subject: MailScanner archive a message multiple times Message-ID: <975ACAD1F82F5540BD5397D900C5AE2E58415ACB46@EXMBSRV01.msg.ucalgary.ca> Greetings. We started to run MailScanner-4.75.11-1 with postfix-2.3.3-2.1.el5_2 on redhat 5 about a week ago. I noticed that our MailScanner archive file system was filled up. I checked into it and found many messages were archived many times. Below is an example: Apr 28 15:23:11 smtp4 postfix/smtpd[24352]: F3CA058002: client=l5.acs.ucalgary.ca[136.159.254.7] Apr 28 15:23:12 smtp4 postfix/cleanup[24397]: F3CA058002: hold: header Received: from l5.acs.ucalgary.ca (l5.acs.ucalgary.ca [136.159.254.7])??(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))??(No client certificate requested)??by smtp4.ucalgary.ca (Postfix) w from l5.acs.ucalgary.ca[136.159.254.7]; from= to= proto=ESMTP helo= Apr 28 15:23:12 smtp4 postfix/cleanup[24397]: F3CA058002: message-id=<200904282123.n3SLNAkR028670@l5.acs.ucalgary.ca> Apr 28 15:23:14 smtp4 MailScanner[23234]: Saved archive copies of F3CA058002.B6300 A38AB58004.360C0 52DEC5800B.63C17 Apr 28 15:23:18 smtp4 MailScanner[24265]: Saved archive copies of F3CA058002.57F78 52DEC5800B.B3C49 A38AB58004.19C12 Apr 28 15:23:25 smtp4 MailScanner[24658]: Saved archive copies of F3CA058002.D6243 A38AB58004.40395 099AA58005.34E58 B035558007.D1C75 52DEC5800B.3168F Apr 28 15:23:29 smtp4 MailScanner[24055]: Saved archive copies of F3CA058002.1425A B035558007.3EDFF 099AA58005.BA47B A38AB58004.23BA7 52DEC5800B.C5CC5 Apr 28 15:23:35 smtp4 MailScanner[24746]: Saved archive copies of F3CA058002.5AB76 52DEC5800B.405F1 099AA58005.68BCE A38AB58004.51C62 B035558007.7C8C9 Apr 28 15:23:40 smtp4 MailScanner[24790]: Saved archive copies of F3CA058002.D3E1F 099AA58005.602B0 A38AB58004.0879B B035558007.42E20 52DEC5800B.96D93 Apr 28 15:23:44 smtp4 MailScanner[24703]: Saved archive copies of F3CA058002.B0CCF B035558007.E2C7B 52DEC5800B.95473 A38AB58004.12BB0 099AA58005.CB8C6 Apr 28 15:23:49 smtp4 MailScanner[24531]: Saved archive copies of F3CA058002.12A87 52DEC5800B.07E4D B035558007.AEA81 099AA58005.11978 A38AB58004.2DDB6 Apr 28 15:23:53 smtp4 MailScanner[24573]: Saved archive copies of F3CA058002.046CD A38AB58004.C84B3 335EB5800E.41524 B035558007.08567 099AA58005.4F6DF 52DEC5800B.C572A Apr 28 15:23:59 smtp4 MailScanner[24836]: Saved archive copies of F3CA058002.088FB Apr 28 15:24:02 smtp4 MailScanner[24836]: Requeue: F3CA058002.088FB to 71DAD58009 Kai Wang System Services Information Technologies, University of Calgary, 2500 University Drive, N.W., Calgary, Alberta, Canada T2N 1N4 Phone (403) 220-2423 Fax (403) 282-9361 -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090428/e58c6b06/attachment.html From kwang at ucalgary.ca Wed Apr 29 02:40:23 2009 From: kwang at ucalgary.ca (Kai Wang) Date: Wed Apr 29 02:40:39 2009 Subject: MailScanner archive a message multiple times In-Reply-To: <975ACAD1F82F5540BD5397D900C5AE2E58415ACB46@EXMBSRV01.msg.ucalgary.ca> References: <975ACAD1F82F5540BD5397D900C5AE2E58415ACB46@EXMBSRV01.msg.ucalgary.ca> Message-ID: <975ACAD1F82F5540BD5397D900C5AE2E58415ACB47@EXMBSRV01.msg.ucalgary.ca> Also in /var/log/messages, many "postfix: Process did not exit cleanly" errors. Apr 28 15:23:04 smtp4 postfix: Process did not exit cleanly, returned 255 with signal 0 Kai Wang System Services Information Technologies, University of Calgary, 2500 University Drive, N.W., Calgary, Alberta, Canada T2N 1N4 Phone (403) 220-2423 Fax (403) 282-9361 From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Kai Wang Sent: April-28-09 7:26 PM To: MailScanner discussion Subject: MailScanner archive a message multiple times Greetings. We started to run MailScanner-4.75.11-1 with postfix-2.3.3-2.1.el5_2 on redhat 5 about a week ago. I noticed that our MailScanner archive file system was filled up. I checked into it and found many messages were archived many times. Below is an example: Apr 28 15:23:11 smtp4 postfix/smtpd[24352]: F3CA058002: client=l5.acs.ucalgary.ca[136.159.254.7] Apr 28 15:23:12 smtp4 postfix/cleanup[24397]: F3CA058002: hold: header Received: from l5.acs.ucalgary.ca (l5.acs.ucalgary.ca [136.159.254.7])??(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))??(No client certificate requested)??by smtp4.ucalgary.ca (Postfix) w from l5.acs.ucalgary.ca[136.159.254.7]; from= to= proto=ESMTP helo= Apr 28 15:23:12 smtp4 postfix/cleanup[24397]: F3CA058002: message-id=<200904282123.n3SLNAkR028670@l5.acs.ucalgary.ca> Apr 28 15:23:14 smtp4 MailScanner[23234]: Saved archive copies of F3CA058002.B6300 A38AB58004.360C0 52DEC5800B.63C17 Apr 28 15:23:18 smtp4 MailScanner[24265]: Saved archive copies of F3CA058002.57F78 52DEC5800B.B3C49 A38AB58004.19C12 Apr 28 15:23:25 smtp4 MailScanner[24658]: Saved archive copies of F3CA058002.D6243 A38AB58004.40395 099AA58005.34E58 B035558007.D1C75 52DEC5800B.3168F Apr 28 15:23:29 smtp4 MailScanner[24055]: Saved archive copies of F3CA058002.1425A B035558007.3EDFF 099AA58005.BA47B A38AB58004.23BA7 52DEC5800B.C5CC5 Apr 28 15:23:35 smtp4 MailScanner[24746]: Saved archive copies of F3CA058002.5AB76 52DEC5800B.405F1 099AA58005.68BCE A38AB58004.51C62 B035558007.7C8C9 Apr 28 15:23:40 smtp4 MailScanner[24790]: Saved archive copies of F3CA058002.D3E1F 099AA58005.602B0 A38AB58004.0879B B035558007.42E20 52DEC5800B.96D93 Apr 28 15:23:44 smtp4 MailScanner[24703]: Saved archive copies of F3CA058002.B0CCF B035558007.E2C7B 52DEC5800B.95473 A38AB58004.12BB0 099AA58005.CB8C6 Apr 28 15:23:49 smtp4 MailScanner[24531]: Saved archive copies of F3CA058002.12A87 52DEC5800B.07E4D B035558007.AEA81 099AA58005.11978 A38AB58004.2DDB6 Apr 28 15:23:53 smtp4 MailScanner[24573]: Saved archive copies of F3CA058002.046CD A38AB58004.C84B3 335EB5800E.41524 B035558007.08567 099AA58005.4F6DF 52DEC5800B.C572A Apr 28 15:23:59 smtp4 MailScanner[24836]: Saved archive copies of F3CA058002.088FB Apr 28 15:24:02 smtp4 MailScanner[24836]: Requeue: F3CA058002.088FB to 71DAD58009 Kai Wang System Services Information Technologies, University of Calgary, 2500 University Drive, N.W., Calgary, Alberta, Canada T2N 1N4 Phone (403) 220-2423 Fax (403) 282-9361 -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090428/fc0a423c/attachment.html From craigwhite at azapple.com Wed Apr 29 03:08:54 2009 From: craigwhite at azapple.com (Craig White) Date: Wed Apr 29 03:09:14 2009 Subject: 4.76.22 In-Reply-To: References: <49F6E0D5.1020809@ecs.soton.ac.uk> <49F77C59.70902@cyber-mage.com> <49F78D84.2070109@ecs.soton.ac.uk> Message-ID: <1240970934.1902.164.camel@lin-workstation.azapple.com> On Wed, 2009-04-29 at 00:13 +0100, Julian Field wrote: > Yes, agreed. The difference between RedHat and CentOS here is that when > you "yum update" a RedHat 5.2 box you don't end up with a RedHat 5.3 > box, you end up with a fully patched RedHat 5.2 box. I'm used to using > RedHat and not CentOS, and didn't appreciate there was this difference > in how they handle "yum update" instructions. > > My bad. ---- maybe I'm not understanding you but CentOS is like RHEL which does indeed update /etc/redhat-release with each yum update if a new one is available and if you had RHELv5.2 and did 'yum update' - it would end up being RHELv5.3 and for all purposes, the same as if you had just installed RHELv5.3 clean. Craig -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From vanhorn at whidbey.com Wed Apr 29 04:05:49 2009 From: vanhorn at whidbey.com (G. Armour Van Horn) Date: Wed Apr 29 04:05:59 2009 Subject: Startup errors after major upgrade Message-ID: <49F7C40D.5080008@whidbey.com> Okay, I just installed MailScanner 4.75.11 over an existing installation, which was 4.57.6. When I restarted MS I got a few complaints about spaces that should have been tabs in a couple of domain-specific rule files, which I took care of. Well, I guess not. I'm still getting this one: Possible syntax error on line 14 of /etc/MailScanner/filename.tlc.conf at /usr/lib/MailScanner/MailScanner/Config.pm line 1472 Remember to separate fields with tab characters! at /usr/lib/MailScanner/MailScanner/Config.pm line 1474 Line 14 of that file is the "allow" line below, and the space after allow and the space between $ and Found are both single tabs. # Allow all other double file extensions. Specifically for ClickAndPledge.com allow \.[a-z][a-z0-9]{2,3}\s*\.[a-z0-9]{3}$ Found possible filename hiding The main problem, I think, is this one: Your setting "Mail Header" contains illegal characters. This is most likely caused by your "%org-name%" setting which must not contain any spaces, "." or "_" characters as these are known to cause problems with many mail systems. I believe these are the applicable lines out of MailScanner.conf: %org-name% = DomainVanHorn Mail Header = X-%org-name%-MailScanner(vanguard): I sent myself a test message, and here is a chunk out of the source of the message I got back: Subject: test Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-DomainVanHorn-MailScanner-Information: Please contact the ISP for more information X-DomainVanHorn-MailScanner-ID: n3T2mLYw025775 X-DomainVanHorn-MailScanner(vanguard): Found to be clean X-DomainVanHorn-MailScanner-SpamCheck(vanguard): not spam, SpamAssassin (not cached, score=-2.599, required 4, autolearn=not spam, BAYES_00 -2.60) X-DomainVanHorn-MailScanner-From: vanhorn@whidbey.com X-Spam-Status: No X-WNSpam-Score: 6.3 X-WNSpam-Int: 63 X-Spambayes-Classification: ham X-Spambayes-Spam-Probability: 0.00 (7) X-Spambayes-MailId: 1240953637 Odd that my server and SpamBayes both say it's clean, but my ISP considered it spam (WNSpam at 6.3, on that system 3.5 is a good default for the cutoff.) But the MS headers seem to be working coherently, and without any spaces that I can see. Can these be ignored, or do I have to worry about them? Van -- ---------------------------------------------------------- Sign up now for Quotes of the Day, a handful of quotations on a theme delivered every morning. Enlightenment! Daily, for free! mailto:twisted@whidbey.com?subject=Subscribe_QOTD For photography, web design, hosting, and maintenance, visit Van's home page: http://www.domainvanhorn.com/van/ ----------------------------------------------------------- From alex at rtpty.com Wed Apr 29 03:55:32 2009 From: alex at rtpty.com (Alex Neuman) Date: Wed Apr 29 04:27:49 2009 Subject: 4.76.22 In-Reply-To: <1240970934.1902.164.camel@lin-workstation.azapple.com> References: <49F6E0D5.1020809@ecs.soton.ac.uk> <49F77C59.70902@cyber-mage.com> <49F78D84.2070109@ecs.soton.ac.uk> <1240970934.1902.164.camel@lin-workstation.azapple.com> Message-ID: <24e3d2e40904281955n586b7d48r81689013f527695d@mail.gmail.com> I can attest to that - yum update + yum upgrade + reboot will give you a 5.3 box, as long as you start from a 5.0/5.1/5.2. On Tue, Apr 28, 2009 at 9:08 PM, Craig White wrote: > On Wed, 2009-04-29 at 00:13 +0100, Julian Field wrote: > > Yes, agreed. The difference between RedHat and CentOS here is that when > > you "yum update" a RedHat 5.2 box you don't end up with a RedHat 5.3 > > box, you end up with a fully patched RedHat 5.2 box. I'm used to using > > RedHat and not CentOS, and didn't appreciate there was this difference > > in how they handle "yum update" instructions. > > > > My bad. > ---- > maybe I'm not understanding you but CentOS is like RHEL which does > indeed update /etc/redhat-release with each yum update if a new one is > available and if you had RHELv5.2 and did 'yum update' - it would end up > being RHELv5.3 and for all purposes, the same as if you had just > installed RHELv5.3 clean. > > Craig > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- Alex Neuman van der Hans Reliant Technologies +507 6781-9505 +507 202-1525 alex@rtpty.com Skype: alexneuman -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090428/ed527f53/attachment.html From lists at openenterprise.ca Wed Apr 29 06:35:28 2009 From: lists at openenterprise.ca (Johnny Stork) Date: Wed Apr 29 06:35:52 2009 Subject: OT: MailWatch db indexes? Message-ID: <49F7E720.5080509@openenterprise.ca> I realize this is not strictly a MS question, but the MW list seems to have really died down with little or no activity, possibly due to the pending MW 2 release? Anyway, I just converted all my myisam tables to innodb and noticed none of the tables seem to have any indexes? Does anyone have any existing scripts, or suggestions for a set of indexes for the mw database? -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090428/1a543354/attachment.html From khaled.jamil at gmail.com Wed Apr 29 06:43:01 2009 From: khaled.jamil at gmail.com (Khaled Hussein) Date: Wed Apr 29 06:43:09 2009 Subject: attachments block Message-ID: <819715630904282243m2b7c5778w60ce87db4895682c@mail.gmail.com> The recipient address On Tue, Apr 28, 2009 at 2:04 PM, wrote: > Send MailScanner mailing list submissions to > mailscanner@lists.mailscanner.info > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.mailscanner.info/mailman/listinfo/mailscanner > or, via email, send a message with subject or body 'help' to > mailscanner-request@lists.mailscanner.info > > You can reach the person managing the list at > mailscanner-owner@lists.mailscanner.info > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of MailScanner digest..." > > > Today's Topics: > > 1. Re: OT: Bounced Email (Mark Sapiro) > 2. attachments block (Khaled Hussein) > 3. Re: attachments block (Julian Field) > 4. Slooow MailScanner = bitdefender?? (Nigel Kendrick) > 5. Re: Maximum Processing Attempts (Kai Schaetzl) > 6. Re: OT: Bounced Email (Kai Schaetzl) > 7. Re: Preventing multple signatures in email conversation? > (Kai Schaetzl) > 8. Re: Maximum Processing Attempts (Matt) > 9. Re: Maximum Processing Attempts (David Lee) > 10. Re: Maximum Processing Attempts (Julian Field) > 11. 4.76.22 (Julian Field) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 27 Apr 2009 16:07:32 -0700 > From: Mark Sapiro > Subject: Re: OT: Bounced Email > To: MailScanner discussion > Message-ID: <20090427230732.GA3304@msapiro> > Content-Type: text/plain; charset=us-ascii > > On Mon, Apr 27, 2009 at 07:02:56PM +0100, Drew Marshall wrote: > > On 27 Apr 2009, at 16:44, Johnny Stork wrote: > > > > >Hmm, ok, but what about these occaisional "probes" I get from a > > >couple lists? > > > > > >Hi! This is the ezmlm program. I'm managing the > > >users@spamassassin.apache.org mailing list. > > > > > > > > >Messages to you from the users mailing list seem to > > >have been bouncing. I sent you a warning message, but it bounced. > > >I've attached a copy of the bounce message. > > > > Almost certainly generated because your address generated some form of > > 4xx error message that was returned to the list server. Do you have > > grey listing or some form of recipient checking going on? Either of > > these could cause this sort of probe. > > > Again, I don't know about ezmlm, but bounces with 4xx status to a > Mailman list are ignored. > > -- > Mark Sapiro mark at msapiro net The highway is for gamblers, > San Francisco Bay Area, California better use your sense - B. Dylan > > > ------------------------------ > > Message: 2 > Date: Tue, 28 Apr 2009 09:21:07 +0300 > From: Khaled Hussein > Subject: attachments block > To: mailscanner@lists.mailscanner.info > Message-ID: > <819715630904272321uc267b11m3efe2200d31b89dc@mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi All, > > i added a rule in my filename.rulse.conf file to deny attachments start > with > DSL (all of them viagra pics), it works fine but i want to prevent > mailscanner from sending the report to the email address that this file has > been blocked, how can i do this or if ther is another way to block these > messages > > > Thanks > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: > http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090428/f6a9d697/attachment-0001.html > > ------------------------------ > > Message: 3 > Date: Tue, 28 Apr 2009 08:29:45 +0100 > From: Julian Field > Subject: Re: attachments block > To: MailScanner discussion > Message-ID: > ecs.soton.ac.uk|040500@ecs.soton.ac.uk> > > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > > > On 28/04/2009 07:21, Khaled Hussein wrote: > > Hi All, > > > > i added a rule in my filename.rulse.conf file to deny attachments > > start with DSL (all of them viagra pics), it works fine but i want to > > prevent mailscanner from sending the report to the email address > Which email address? The sender or the recipient? > > that this file has been blocked, how can i do this or if ther is > > another way to block these messages > > > > > > Thanks > > > > > > Jules > > -- > Julian Field MEng CITP CEng > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > MailScanner customisation, or any advanced system administration help? > Contact me at Jules@Jules.FM > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > PGP public key: http://www.jules.fm/julesfm.asc > Follow me at twitter.com/JulesFM > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > > > ------------------------------ > > Message: 4 > Date: Tue, 28 Apr 2009 10:27:20 +0100 > From: "Nigel Kendrick" > Subject: Slooow MailScanner = bitdefender?? > To: "'MailScanner discussion'" > Message-ID: <4D373C90AFA24050BDABCAC9CDD9A525@SUPPORT01V> > Content-Type: text/plain; charset="us-ascii" > > Morning, > > I have a P4 3GHz server running MailScanner 4.75.11 that has has been > working fine, but over the last few days it has taken to slowing down > dramatically and the CPU load hits 13+ > > Admittedly the server could do with a bit more RAM (it has 768MB), but it > has worked fine for several years and the load is very small (<300 emails a > day). > > A quick look at htop shows that the bitdefender update process seems to run > 'forever' and eats up >500MB and then the server goes into swap city and > almost grinds to a halt. > > The upgrade from 4.69.? happened around the same time as the slow down so > has something changed that might have caused this? I guess something may > have just tipped the server over a critical RAM requirement so I am going > to > fit some more (1.5GB) but any other thoughts appreciated as other servers > upgraded at the same time (fitted with more RAM) have not experienced the > slow down. > > Thanks > > Nigel Kendrick > > > > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: > http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090428/370a2596/attachment-0001.html > > ------------------------------ > > Message: 5 > Date: Tue, 28 Apr 2009 11:31:19 +0200 > From: Kai Schaetzl > Subject: Re: Maximum Processing Attempts > To: mailscanner@lists.mailscanner.info > Message-ID: > Content-Type: text/plain; charset=iso-8859-1 > > Julian Field wrote on Mon, 27 Apr 2009 22:40:16 +0100: > > > Should I leave it switched on by default, so heavily loaded sites can > > switch it off to gain that extra bit of performance, at the cost of a > > potential reliability hit? > > >From the past discussion I think it is mainly those heavy-traffic sites > that would benefit from it. I think we had exactly two folks mentioning a > problem with occasional messages getting not processed somehow. Both with > high-volume sites. So, the majority does not need this feature to be on. > On the other hand, exactly those people who need it will also be hit most > by the performance hit (as small as it may be). > Unfortunately none of them participated in the recent discussion. > > Kai > > -- > Kai Sch?tzl, Berlin, Germany > Get your web at Conactive Internet Services: http://www.conactive.com > > > > > > ------------------------------ > > Message: 6 > Date: Tue, 28 Apr 2009 11:31:19 +0200 > From: Kai Schaetzl > Subject: Re: OT: Bounced Email > To: mailscanner@lists.mailscanner.info > Message-ID: > Content-Type: text/plain; charset=iso-8859-1 > > Drew Marshall wrote on Mon, 27 Apr 2009 18:57:35 +0100: > > > This one should be fine > > Yes, it's back to normal now. > > Kai > > -- > Kai Sch?tzl, Berlin, Germany > Get your web at Conactive Internet Services: http://www.conactive.com > > > > > > ------------------------------ > > Message: 7 > Date: Tue, 28 Apr 2009 11:31:18 +0200 > From: Kai Schaetzl > Subject: Re: Preventing multple signatures in email conversation? > To: mailscanner@lists.mailscanner.info > Message-ID: > Content-Type: text/plain; charset=iso-8859-1 > > Kevin Miller wrote on Mon, 27 Apr 2009 08:37:00 -0800: > > > Yes - change the above "dash dash" to "dash dash space". > > look again. The separator is correct. It's a QP message. > > Kai > > -- > Kai Sch?tzl, Berlin, Germany > Get your web at Conactive Internet Services: http://www.conactive.com > > > > > > ------------------------------ > > Message: 8 > Date: Tue, 28 Apr 2009 11:03:49 +0100 > From: Matt > Subject: Re: Maximum Processing Attempts > To: MailScanner discussion > Message-ID: <49F6D485.2020501@coders.co.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Kai Schaetzl wrote: > > >From the past discussion I think it is mainly those heavy-traffic sites > > that would benefit from it. I think we had exactly two folks mentioning a > > problem with occasional messages getting not processed somehow. Both with > > high-volume sites. So, the majority does not need this feature to be on. > > On the other hand, exactly those people who need it will also be hit most > > by the performance hit (as small as it may be). > > > > Unfortunately none of them participated in the recent discussion. > > > > I run a high volume service and up until recently I have had nothing to > add as we have have only been affected by this issue once. However, in > the last couple of weeks we have had this happen to two of servers. > Within in 20 minutes the queues had grown to unexceptable levels and the > LA on the box jumped hugely. It took me over an hour to track down > which message caused the issue (as an aside - adding the message back in > to the processing queue about an hour later and it went through fine!). > > I for one would have accepted the the tiny hit a few SQLite queries per > message would have caused had the code been avalible then. I hope to > have the code in production by the end of the week > > > matt > > > ------------------------------ > > Message: 9 > Date: Tue, 28 Apr 2009 11:06:33 +0100 (BST) > From: David Lee > Subject: Re: Maximum Processing Attempts > To: MailScanner discussion > Message-ID: > Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed > > On Tue, 28 Apr 2009, Kai Schaetzl wrote: > > > Julian Field wrote on Mon, 27 Apr 2009 22:40:16 +0100: > > > >> Should I leave it switched on by default, so heavily loaded sites can > >> switch it off to gain that extra bit of performance, at the cost of a > >> potential reliability hit? > > > >> From the past discussion I think it is mainly those heavy-traffic sites > > that would benefit from it. I think we had exactly two folks mentioning a > > problem with occasional messages getting not processed somehow. Both with > > high-volume sites. So, the majority does not need this feature to be on. > > On the other hand, exactly those people who need it will also be hit most > > by the performance hit (as small as it may be). > > Unfortunately none of them participated in the recent discussion. > > Kai, the feature isn't primarily about "occasional messages getting not > processed somehow". Rather it is about the severe knock-on effects that > can have. > > (Reminder: If there is some characteristic with a number of emails that > causes perl/MS to crash, then that causes the whole "batch", including > many innocent emails, not to get processed. Subsequent runs keep tripping > over the same thing. If there are a few more such rogue emails than there > are MS children, then almost all the innocent email gets held up > indefinitely. Such rogue emails are typically spam, and so there tend to > be many instances of it. Yes, the problem is rare. But when it hits, it > can be very severe: all email blocked; massive inbound queue build-up; > load average through the roof.) > > We've been running it in production ever since Julian first put it into a > beta. (I was honour-bound to do so; I had suggested it!) I haven't > noticed a performance impact. > > > My vote is to leave it on. > > Email sys.admins have varying ability. When this problem hits, even > experienced sys.admins struggle. (Been there; more than once.) The less > experienced would struggle even more. The default of this option should > be biased in favour of the inexperienced sys.admin. So the default (I > suggest) should be "on". (A sys.admin. who is experienced enough to know > they don't need it is, by definition, experienced enough to find their way > to switching it off.) > > Hope that helps. > > -- > > : David Lee I.T. Service : > : Senior Systems Programmer Computer Centre : > : UNIX Team Leader Durham University : > : South Road : > : http://www.dur.ac.uk/t.d.lee/ Durham DH1 3LE : > : Phone: +44 191 334 2752 U.K. : > > > ------------------------------ > > Message: 10 > Date: Tue, 28 Apr 2009 11:52:26 +0100 > From: Julian Field > Subject: Re: Maximum Processing Attempts > To: MailScanner discussion > Message-ID: > ecs.soton.ac.uk|000808@ecs.soton.ac.uk> > > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > > > On 28/04/2009 11:06, David Lee wrote: > > On Tue, 28 Apr 2009, Kai Schaetzl wrote: > > > >> Julian Field wrote on Mon, 27 Apr 2009 22:40:16 +0100: > >> > >>> Should I leave it switched on by default, so heavily loaded sites can > >>> switch it off to gain that extra bit of performance, at the cost of a > >>> potential reliability hit? > >> > >>> From the past discussion I think it is mainly those heavy-traffic sites > >> that would benefit from it. I think we had exactly two folks > >> mentioning a > >> problem with occasional messages getting not processed somehow. Both > >> with > >> high-volume sites. So, the majority does not need this feature to be on. > >> On the other hand, exactly those people who need it will also be hit > >> most > >> by the performance hit (as small as it may be). > >> Unfortunately none of them participated in the recent discussion. > > > > Kai, the feature isn't primarily about "occasional messages getting > > not processed somehow". Rather it is about the severe knock-on > > effects that can have. > > > > (Reminder: If there is some characteristic with a number of emails > > that causes perl/MS to crash, then that causes the whole "batch", > > including many innocent emails, not to get processed. Subsequent runs > > keep tripping over the same thing. If there are a few more such rogue > > emails than there are MS children, then almost all the innocent email > > gets held up indefinitely. Such rogue emails are typically spam, and > > so there tend to be many instances of it. Yes, the problem is rare. > > But when it hits, it can be very severe: all email blocked; massive > > inbound queue build-up; load average through the roof.) > > > > We've been running it in production ever since Julian first put it > > into a beta. (I was honour-bound to do so; I had suggested it!) I > > haven't noticed a performance impact. > > > > > > My vote is to leave it on. > > > > Email sys.admins have varying ability. When this problem hits, even > > experienced sys.admins struggle. (Been there; more than once.) The > > less experienced would struggle even more. The default of this option > > should be biased in favour of the inexperienced sys.admin. So the > > default (I suggest) should be "on". (A sys.admin. who is experienced > > enough to know they don't need it is, by definition, experienced > > enough to find their way to switching it off.) > > > I am convinced by these arguments. I have improved the code since the > last beta, so that it pre-prepares all the SQL statements once when the > database is opened, so the SQL code should be even faster than it was. I > have also switched off the fsync() call that was done at the end of > every database write operation, so that should speed it up too. > > I will release a new beta right now for you to test what is hopefully > the final version of the code, and the feature will remain enabled in > the production stable release. > > Those who know enough that they can dig themselves out of the hole > without the assistance of this feature can switch it off. > > Jules > > -- > Julian Field MEng CITP CEng > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > Need help customising MailScanner? > Contact me! > Need help fixing or optimising your systems? > Contact me! > Need help getting you started solving new requirements from your boss? > Contact me! > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > Follow me at twitter.com/JulesFM and twitter.com/MailScanner > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > > > ------------------------------ > > Message: 11 > Date: Tue, 28 Apr 2009 11:56:21 +0100 > From: Julian Field > Subject: 4.76.22 > To: MailScanner discussion > Message-ID: > ecs.soton.ac.uk|020809@ecs.soton.ac.uk> > > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > I have just released a new beta, this will be one of the last before the > next stable release. > Please test it, as I have optimised the processing-messages database > code, and fixed one or two little bugs. The Change Log will tell you all > the details. > > Download as usual from www.mailscanner.info. > > Thanks! > > Jules > > -- > Julian Field MEng CITP CEng > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > Need help customising MailScanner? > Contact me! > Need help fixing or optimising your systems? > Contact me! > Need help getting you started solving new requirements from your boss? > Contact me! > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > Follow me at twitter.com/JulesFM and twitter.com/MailScanner > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > > > ------------------------------ > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read the Wiki (http://wiki.mailscanner.info/). > > Support MailScanner development - buy the book off the website! > > > End of MailScanner Digest, Vol 40, Issue 38 > ******************************************* > -- Best Regards ================== Khaled Hussein khaled.jamil@gmail.com Tulkarem - Palestine ================== -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090429/290a18d3/attachment-0001.html From J.Ede at birchenallhowden.co.uk Wed Apr 29 08:27:57 2009 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Wed Apr 29 08:32:04 2009 Subject: 4.76.22 In-Reply-To: References: <49F6E0D5.1020809@ecs.soton.ac.uk> <1213490F1F316842A544A850422BFA96239CFF91@BHLSBS.bhl.local> <49F75BBE.1070202@ecs.soton.ac.uk>, Message-ID: <1213490F1F316842A544A850422BFA96239BA53A@BHLSBS.bhl.local> I've been trying this morning to break it using blat to send text based emails (email-plain) to the server and its been working perfectly. I then used blat again with source copied from an outlook email (email-html) that shows the problem and it does append an extra signature on the end every time. I'll try some more debug on this later by adding some debug lines into the code. I've attached the 2 text files that I've been using. ________________________________________ From: mailscanner-bounces@lists.mailscanner.info [mailscanner-bounces@lists.mailscanner.info] On Behalf Of Julian Field [MailScanner@ecs.soton.ac.uk] Sent: 28 April 2009 20:40 To: MailScanner discussion Subject: Re: 4.76.22 On 28/04/2009 20:19, Jason Ede wrote: > I've been testing the _SIGNATURE_ option here and it seems that it always adds the signature at the end as well as in the message at the signature tags. I'm using html sigs with an inline image. I've taken at look at what I think is the code in message.pm but it all looks correct to me :( > Yes, I have looked too, when someone else commented they were getting the sig at the end too. But the code is incredibly simple and I can't see anything wrong with it either. FoundSigMark = 0 FoundSigMark = 1 if we successfully replace _SIGNATURE_ with the signature text. print signature text at end of message unless FoundSigMark is non-zero. That's all there is to it. > I don't need to change something in the config to stop it signing at the end as well? > No. If you could try adding some lines like print STDERR "FoundSigMark = $FoundSigMark\n"; lines into the code at suitable places, then run it on your system with "MailScanner --debug" and see what it prints, that would really help me debug it. Many thanks. >> -----Original Message----- >> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- >> bounces@lists.mailscanner.info] On Behalf Of Julian Field >> Sent: 28 April 2009 11:56 >> To: MailScanner discussion >> Subject: 4.76.22 >> >> I have just released a new beta, this will be one of the last before >> the >> next stable release. >> Please test it, as I have optimised the processing-messages database >> code, and fixed one or two little bugs. The Change Log will tell you >> all >> the details. >> >> Download as usual from www.mailscanner.info. >> Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part --------------

And part 2

 

--

J D Ede 

_SIGNATURE_

 

From: Jason Ede
Sent: 28 April 2009 14:09
To: Messages
Subject: This will have 2 sigs when it goes out

 

part 1

 

--

J D Ede 

_SIGNATURE_

 

-------------- next part -------------- This is some random text No sig here nor here _SIGNATURE_ -- and another one here _SIGNATURE_ more stuff here and yet more stuff here... Any sig on end? From maxsec at gmail.com Wed Apr 29 08:45:10 2009 From: maxsec at gmail.com (Martin Hepworth) Date: Wed Apr 29 08:45:20 2009 Subject: Blocking Mail from Invalid Email Addresses In-Reply-To: <49F7A764.5000805@openenterprise.ca> References: <49F7A764.5000805@openenterprise.ca> Message-ID: <72cf361e0904290045r11dae66aq168a17f37af0edad@mail.gmail.com> Johnny that's the MTA's job really - smf-sav can do recipient verification also. -- Martin Hepworth Oxford, UK 2009/4/29 Johnny Stork > I am running MS 4.72.5 on CentOS 5x. I also run milter-greylist and > smf-sav for sender verification but I am not sure its working properly since > the email address below (tatrixes_1996@mydomain.ca does NOT exist and in > fact there are only 2 valid email addresses on my mail server. > > So, while I try to figure out whats wrong with smf-sav, is there anywhere > else in MS where I can set something to ONLY accept mail from specific > address? For some reason I am seeing a flood of around 2000 messages a day > to invalid addresses. Fortunately they do get tagged as spam and not > delivered, but do fill up the sendmail outbound que. I would rather reject > them rather than process. > > > Apr 28 17:57:52 gateway smf-sav[26340]: recipient check succeeded: > , 209.216.227.46, > mail1.planetnet.com, , > [00:00:00] > > > > --- > Johnny Stork > "Empowering Business With Open Solutions" > www.openenterprise.ca > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090429/0c94cd6b/attachment.html From maxsec at gmail.com Wed Apr 29 08:48:47 2009 From: maxsec at gmail.com (Martin Hepworth) Date: Wed Apr 29 08:48:56 2009 Subject: Startup errors after major upgrade In-Reply-To: <49F7C40D.5080008@whidbey.com> References: <49F7C40D.5080008@whidbey.com> Message-ID: <72cf361e0904290048x90b4928qd63f3ab1ae4f7b94@mail.gmail.com> Hi not sure the the brackets - () - are valid characters in the mail header left hand side try removing those from the mail header line. -- Martin Hepworth Oxford, UK 2009/4/29 G. Armour Van Horn > Okay, I just installed MailScanner 4.75.11 over an existing installation, > which was 4.57.6. When I restarted MS I got a few complaints about spaces > that should have been tabs in a couple of domain-specific rule files, which > I took care of. > > Well, I guess not. I'm still getting this one: > > Possible syntax error on line 14 of /etc/MailScanner/filename.tlc.conf at > /usr/lib/MailScanner/MailScanner/Config.pm line 1472 > Remember to separate fields with tab characters! at > /usr/lib/MailScanner/MailScanner/Config.pm line 1474 > > Line 14 of that file is the "allow" line below, and the space after allow > and the space between $ and Found are both single tabs. > > # Allow all other double file extensions. Specifically for > ClickAndPledge.com > allow \.[a-z][a-z0-9]{2,3}\s*\.[a-z0-9]{3}$ Found possible filename > hiding > > > The main problem, I think, is this one: > > Your setting "Mail Header" contains illegal characters. > This is most likely caused by your "%org-name%" setting > which must not contain any spaces, "." or "_" characters > as these are known to cause problems with many mail systems. > > I believe these are the applicable lines out of MailScanner.conf: > > %org-name% = DomainVanHorn > > Mail Header = X-%org-name%-MailScanner(vanguard): > > I sent myself a test message, and here is a chunk out of the source of the > message I got back: > > Subject: test > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > Content-Transfer-Encoding: 7bit > X-DomainVanHorn-MailScanner-Information: Please contact the ISP for more > information > X-DomainVanHorn-MailScanner-ID: n3T2mLYw025775 > X-DomainVanHorn-MailScanner(vanguard): Found to be clean > X-DomainVanHorn-MailScanner-SpamCheck(vanguard): not spam, > SpamAssassin (not cached, score=-2.599, required 4, > autolearn=not spam, BAYES_00 -2.60) > X-DomainVanHorn-MailScanner-From: vanhorn@whidbey.com > X-Spam-Status: No > X-WNSpam-Score: 6.3 > X-WNSpam-Int: 63 > X-Spambayes-Classification: ham > X-Spambayes-Spam-Probability: 0.00 (7) > X-Spambayes-MailId: 1240953637 > > > Odd that my server and SpamBayes both say it's clean, but my ISP considered > it spam (WNSpam at 6.3, on that system 3.5 is a good default for the > cutoff.) But the MS headers seem to be working coherently, and without any > spaces that I can see. > > Can these be ignored, or do I have to worry about them? > > Van > > -- > ---------------------------------------------------------- > Sign up now for Quotes of the Day, a handful of quotations > on a theme delivered every morning. > Enlightenment! Daily, for free! mailto:twisted@whidbey.com > ?subject=Subscribe_QOTD > > For photography, web design, hosting, and maintenance, visit Van's home > page: http://www.domainvanhorn.com/van/ > ----------------------------------------------------------- > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090429/83f47dc5/attachment.html From J.Ede at birchenallhowden.co.uk Wed Apr 29 09:07:31 2009 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Wed Apr 29 09:07:51 2009 Subject: 4.76.22 In-Reply-To: <1213490F1F316842A544A850422BFA96239BA53A@BHLSBS.bhl.local> References: <49F6E0D5.1020809@ecs.soton.ac.uk> <1213490F1F316842A544A850422BFA96239CFF91@BHLSBS.bhl.local> <49F75BBE.1070202@ecs.soton.ac.uk>, <1213490F1F316842A544A850422BFA96239BA53A@BHLSBS.bhl.local> Message-ID: <1213490F1F316842A544A850422BFA96239CFF9C@BHLSBS.bhl.local> >From some more digging and inserting debug statements it seems to be something on one of these 2 lines. $FoundBodyEnd = 1 if $line =~ s/\<\/body\>/$signature$&/i; $FoundHTMLEnd = 1 if !$FoundBodyEnd && $line =~ s/\<\/x?html\>/$signature$&/i; If I comment both of them out then it seems to work, but I'm betting it breaks something else. Is it a odd combination of html tags at the end of the email that triggers this again? Jason > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- > bounces@lists.mailscanner.info] On Behalf Of Jason Ede > Sent: 29 April 2009 08:28 > To: MailScanner discussion > Subject: RE: 4.76.22 > > I've been trying this morning to break it using blat to send text based > emails (email-plain) to the server and its been working perfectly. I > then used blat again with source copied from an outlook email (email- > html) that shows the problem and it does append an extra signature on > the end every time. I'll try some more debug on this later by adding > some debug lines into the code. I've attached the 2 text files that > I've been using. > > ________________________________________ > From: mailscanner-bounces@lists.mailscanner.info [mailscanner- > bounces@lists.mailscanner.info] On Behalf Of Julian Field > [MailScanner@ecs.soton.ac.uk] > Sent: 28 April 2009 20:40 > To: MailScanner discussion > Subject: Re: 4.76.22 > > On 28/04/2009 20:19, Jason Ede wrote: > > I've been testing the _SIGNATURE_ option here and it seems that it > > always adds the signature at the end as well as in the message at the > > signature tags. I'm using html sigs with an inline image. I've taken > > at look at what I think is the code in message.pm but it all looks > > correct to me :( > > > Yes, I have looked too, when someone else commented they were getting > the sig at the end too. But the code is incredibly simple and I can't > see anything wrong with it either. > FoundSigMark = 0 > FoundSigMark = 1 if we successfully replace _SIGNATURE_ with the > signature text. > print signature text at end of message unless FoundSigMark is non-zero. > That's all there is to it. > > I don't need to change something in the config to stop it signing at > the end as well? > > > No. > If you could try adding some lines like > print STDERR "FoundSigMark = $FoundSigMark\n"; lines into the code > at suitable places, then run it on your system with "MailScanner -- > debug" and see what it prints, that would really help me debug it. > > Many thanks. > >> -----Original Message----- > >> From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner- > >> bounces@lists.mailscanner.info] On Behalf Of Julian Field > >> Sent: 28 April 2009 11:56 > >> To: MailScanner discussion > >> Subject: 4.76.22 > >> > >> I have just released a new beta, this will be one of the last before > >> the next stable release. > >> Please test it, as I have optimised the processing-messages database > >> code, and fixed one or two little bugs. The Change Log will tell you > >> all the details. > >> > >> Download as usual from www.mailscanner.info. > >> > > Jules > > -- > Julian Field MEng CITP CEng > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > MailScanner customisation, or any advanced system administration help? > Contact me at Jules@Jules.FM > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP > public key: http://www.jules.fm/julesfm.asc Follow me at > twitter.com/JulesFM > > > -- > This message has been scanned for viruses and dangerous content by > MailScanner, and is believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From Johan at double-l.nl Wed Apr 29 09:18:30 2009 From: Johan at double-l.nl (Johan Hendriks) Date: Wed Apr 29 09:18:40 2009 Subject: FreeBSD port of MailScanner-4.75.11,1 - could someone test Message-ID: <57200BF94E69E54880C9BB1AF714BBCB5DE7CA@w2003s01.double-l.local> I created a port for MailScanner-4.75.11,1 on FreeBSD. My programming skills are poor, but it al seems to work on my 7.1-stable and 8.0 machine (both AMD64) This is with perl 5.10.x , it does not work with perl-5.8.9 So please test it and let me know if it al works. You can download the file here. http://www.double-l.nl/mailscanner.tar regards, Johan Hendriks -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090429/cc3d25e0/attachment.html From MailScanner at ecs.soton.ac.uk Wed Apr 29 09:26:39 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Wed Apr 29 09:27:05 2009 Subject: Startup errors after major upgrade In-Reply-To: <49F7C40D.5080008@whidbey.com> References: <49F7C40D.5080008@whidbey.com> <49F80F3F.5090502@ecs.soton.ac.uk> Message-ID: On 29/04/2009 04:05, G. Armour Van Horn wrote: > Okay, I just installed MailScanner 4.75.11 over an existing > installation, which was 4.57.6. When I restarted MS I got a few > complaints about spaces that should have been tabs in a couple of > domain-specific rule files, which I took care of. > > Well, I guess not. I'm still getting this one: > > Possible syntax error on line 14 of /etc/MailScanner/filename.tlc.conf > at /usr/lib/MailScanner/MailScanner/Config.pm line 1472 > Remember to separate fields with tab characters! at > /usr/lib/MailScanner/MailScanner/Config.pm line 1474 > > Line 14 of that file is the "allow" line below, and the space after > allow and the space between $ and Found are both single tabs. > > # Allow all other double file extensions. Specifically for > ClickAndPledge.com > allow \.[a-z][a-z0-9]{2,3}\s*\.[a-z0-9]{3}$ Found possible > filename hiding If you look at the other "allow" and "deny" lines, they have 2 strings after the regexp. Both of which, in an allow, are normally "-" as they are not used. But there must be **2* of them! > > > The main problem, I think, is this one: > > Your setting "Mail Header" contains illegal characters. > This is most likely caused by your "%org-name%" setting > which must not contain any spaces, "." or "_" characters > as these are known to cause problems with many mail systems. > > I believe these are the applicable lines out of MailScanner.conf: > > %org-name% = DomainVanHorn > > Mail Header = X-%org-name%-MailScanner(vanguard): Are () brackets allowed in mail header names? I don't think they are. > > I sent myself a test message, and here is a chunk out of the source of > the message I got back: > > Subject: test > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > Content-Transfer-Encoding: 7bit > X-DomainVanHorn-MailScanner-Information: Please contact the ISP for > more information > X-DomainVanHorn-MailScanner-ID: n3T2mLYw025775 > X-DomainVanHorn-MailScanner(vanguard): Found to be clean > X-DomainVanHorn-MailScanner-SpamCheck(vanguard): not spam, > SpamAssassin (not cached, score=-2.599, required 4, > autolearn=not spam, BAYES_00 -2.60) > X-DomainVanHorn-MailScanner-From: vanhorn@whidbey.com > X-Spam-Status: No > X-WNSpam-Score: 6.3 > X-WNSpam-Int: 63 > X-Spambayes-Classification: ham > X-Spambayes-Spam-Probability: 0.00 (7) > X-Spambayes-MailId: 1240953637 > > > Odd that my server and SpamBayes both say it's clean, but my ISP > considered it spam (WNSpam at 6.3, on that system 3.5 is a good > default for the cutoff.) But the MS headers seem to be working > coherently, and without any spaces that I can see. > > Can these be ignored, or do I have to worry about them? > > Van > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From maillists at conactive.com Wed Apr 29 09:48:31 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Wed Apr 29 09:48:38 2009 Subject: Webmin module In-Reply-To: <49F7920A.6070902@whidbey.com> References: <49F7920A.6070902@whidbey.com> Message-ID: G. Armour Van Horn wrote on Tue, 28 Apr 2009 16:32:26 -0700: > I've long been a big WebMin fan, so I was pleased to note on the MS > download page a link to a MailScanner module Don't use it, it's years old! You should also check your MailScanner.conf now, it might have some incorrect lines if you edited it with the webmin module. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Wed Apr 29 09:48:31 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Wed Apr 29 09:48:38 2009 Subject: Blocking Mail from Invalid Email Addresses In-Reply-To: <49F7A764.5000805@openenterprise.ca> References: <49F7A764.5000805@openenterprise.ca> Message-ID: Johnny Stork wrote on Tue, 28 Apr 2009 18:03:32 -0700: > I am running MS 4.72.5 on CentOS 5x. I also run milter-greylist and > smf-sav for sender verification but I am not sure its working properly > since the email address below (tatrixes_1996@mydomain.ca does NOT exist > and in fact there are only 2 valid email addresses on my mail server. I don't understand. Is that server your only mail server? If yes, then you don't need a milter to stop *sending* to invalid recipients on your side. You simply do not create them (no catch-all). sendmail won't deliver, but reject (and not bounce and not fill up your queue). Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Wed Apr 29 09:48:32 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Wed Apr 29 09:48:43 2009 Subject: attachments block In-Reply-To: <819715630904282243m2b7c5778w60ce87db4895682c@mail.gmail.com> References: <819715630904282243m2b7c5778w60ce87db4895682c@mail.gmail.com> Message-ID: Khaled Hussein wrote on Wed, 29 Apr 2009 08:43:01 +0300: > The recipient address and for that you had to quote everything? Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Wed Apr 29 09:48:32 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Wed Apr 29 09:48:44 2009 Subject: MailScanner archive a message multiple times In-Reply-To: <975ACAD1F82F5540BD5397D900C5AE2E58415ACB47@EXMBSRV01.msg.ucalgary.ca> References: <975ACAD1F82F5540BD5397D900C5AE2E58415ACB46@EXMBSRV01.msg.ucalgary.ca> <975ACAD1F82F5540BD5397D900C5AE2E58415ACB47@EXMBSRV01.msg.ucalgary.ca> Message-ID: Kai Wang wrote on Tue, 28 Apr 2009 19:40:23 -0600: > Also in /var/log/messages, many "postfix: Process did not exit cleanly" errors. Yes, this shows that the processing had to be done several times. You get this message when you restart MailScanner, you may also get it when a child has a problem and dies. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Wed Apr 29 09:48:33 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Wed Apr 29 09:48:45 2009 Subject: Preventing multiple signatures in email conversation? In-Reply-To: References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> <43F62CA225017044BC84CFAF92B4333B06F530@sbsserver.Techquility.net> <49F5E59F.10104@ecs.soton.ac.uk> <43F62CA225017044BC84CFAF92B4333B06F533@sbsserver.Techquility.net> <49F5FBCE.8080506@ecs.soton.ac.uk> <43F62CA225017044BC84CFAF92B4333B06F53D@sbsserver.Techquility.net> <49F744AB.3060306@ecs.soton.ac.uk> <49F78F65.1070502@ecs.soton.ac.uk> Message-ID: Julian Field wrote on Wed, 29 Apr 2009 00:21:09 +0100: > I just want to look for the tag. If it's there, I don't add the > signature again. Simple as that. So maybe a with an id with no > definition would be okay. Is that legal HTML in all the standards? Don't know what you mean by "no definition". With my original example I was actually thinking about wrapping the signature in the tag like so:
Your signature here
Then you could remove the whole thing and automatically get everything. If that is a problem with HTML::Parser I would think about Signature This is also a problem? Hm. All the other empty tags that come to mind do something, for instance
or
. An empty image tag may look weird, though, anyway. Newer mail programs (including Outlook) do not automatically download web content. Depending on the rendering engine that gets used it may not display at all or with a placeholder. Which may not look that nice. Also the src= might get replaced or the img entirely removed because of policy. I think using an img tag is not such a great idea. I understand, there wasn't another option ;-) Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Wed Apr 29 09:48:31 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Wed Apr 29 09:48:47 2009 Subject: MailScanner archive a message multiple times In-Reply-To: <975ACAD1F82F5540BD5397D900C5AE2E58415ACB46@EXMBSRV01.msg.ucalgary.ca> References: <975ACAD1F82F5540BD5397D900C5AE2E58415ACB46@EXMBSRV01.msg.ucalgary.ca> Message-ID: Kai Wang wrote on Tue, 28 Apr 2009 19:26:00 -0600: > Apr 28 15:23:12 smtp4 postfix/cleanup[24397]: F3CA058002: message-id=<200904282123.n3SLNAkR028670@l5.acs.ucalgary.ca> > Apr 28 15:23:14 smtp4 MailScanner[23234]: Saved archive copies of > F3CA058002.B6300 A38AB58004.360C0 52DEC5800B.63C17 > Apr 28 15:23:18 smtp4 MailScanner[24265]: Saved archive copies of > F3CA058002.57F78 52DEC5800B.B3C49 A38AB58004.19C12 > Apr 28 15:23:25 smtp4 MailScanner[24658]: Saved archive copies of > F3CA058002.D6243 A38AB58004.40395 099AA58005.34E58 B035558007.D1C75 > 52DEC5800B.3168F This indicates that the message had to be processed several times. Either because there was a processing problem first or (guess) you split the messages to one for each recipient. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Wed Apr 29 09:48:32 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Wed Apr 29 09:48:48 2009 Subject: Startup errors after major upgrade In-Reply-To: <49F7C40D.5080008@whidbey.com> References: <49F7C40D.5080008@whidbey.com> Message-ID: Stop using that webmin module, correct these lines in your MailScanner.conf or install it new. Your config was broken by that module. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From MailScanner at ecs.soton.ac.uk Wed Apr 29 09:58:52 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Wed Apr 29 09:59:14 2009 Subject: 4.76.22 In-Reply-To: <1213490F1F316842A544A850422BFA96239CFF9C@BHLSBS.bhl.local> References: <49F6E0D5.1020809@ecs.soton.ac.uk> <1213490F1F316842A544A850422BFA96239CFF91@BHLSBS.bhl.local> <49F75BBE.1070202@ecs.soton.ac.uk>, <1213490F1F316842A544A850422BFA96239BA53A@BHLSBS.bhl.local> <1213490F1F316842A544A850422BFA96239CFF9C@BHLSBS.bhl.local> <49F816CC.3000005@ecs.soton.ac.uk> Message-ID: Once I actually concentrated on the detail of the code for 2 minutes, it stared me in the face. All fixed. I have just released 4.76.23 which contains both this fix, and the re-ordering of Perl modules for CentOS 5.2->5.3 users. Please test both aspects. Many thanks, Jules. On 29/04/2009 09:07, Jason Ede wrote: > > From some more digging and inserting debug statements it seems to be something on one of these 2 lines. > > $FoundBodyEnd = 1 if $line =~ s/\<\/body\>/$signature$&/i; > $FoundHTMLEnd = 1 if !$FoundBodyEnd&& $line =~ s/\<\/x?html\>/$signature$&/i; > > If I comment both of them out then it seems to work, but I'm betting it breaks something else. Is it a odd combination of html tags at the end of the email that triggers this again? > > Jason > > >> -----Original Message----- >> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- >> bounces@lists.mailscanner.info] On Behalf Of Jason Ede >> Sent: 29 April 2009 08:28 >> To: MailScanner discussion >> Subject: RE: 4.76.22 >> >> I've been trying this morning to break it using blat to send text based >> emails (email-plain) to the server and its been working perfectly. I >> then used blat again with source copied from an outlook email (email- >> html) that shows the problem and it does append an extra signature on >> the end every time. I'll try some more debug on this later by adding >> some debug lines into the code. I've attached the 2 text files that >> I've been using. >> >> ________________________________________ >> From: mailscanner-bounces@lists.mailscanner.info [mailscanner- >> bounces@lists.mailscanner.info] On Behalf Of Julian Field >> [MailScanner@ecs.soton.ac.uk] >> Sent: 28 April 2009 20:40 >> To: MailScanner discussion >> Subject: Re: 4.76.22 >> >> On 28/04/2009 20:19, Jason Ede wrote: >> >>> I've been testing the _SIGNATURE_ option here and it seems that it >>> always adds the signature at the end as well as in the message at the >>> signature tags. I'm using html sigs with an inline image. I've taken >>> at look at what I think is the code in message.pm but it all looks >>> correct to me :( >>> >>> >> Yes, I have looked too, when someone else commented they were getting >> the sig at the end too. But the code is incredibly simple and I can't >> see anything wrong with it either. >> FoundSigMark = 0 >> FoundSigMark = 1 if we successfully replace _SIGNATURE_ with the >> signature text. >> print signature text at end of message unless FoundSigMark is non-zero. >> That's all there is to it. >> >>> I don't need to change something in the config to stop it signing at >>> >> the end as well? >> >>> >> No. >> If you could try adding some lines like >> print STDERR "FoundSigMark = $FoundSigMark\n"; lines into the code >> at suitable places, then run it on your system with "MailScanner -- >> debug" and see what it prints, that would really help me debug it. >> >> Many thanks. >> >>>> -----Original Message----- >>>> From: mailscanner-bounces@lists.mailscanner.info >>>> >> [mailto:mailscanner- >> >>>> bounces@lists.mailscanner.info] On Behalf Of Julian Field >>>> Sent: 28 April 2009 11:56 >>>> To: MailScanner discussion >>>> Subject: 4.76.22 >>>> >>>> I have just released a new beta, this will be one of the last before >>>> the next stable release. >>>> Please test it, as I have optimised the processing-messages database >>>> code, and fixed one or two little bugs. The Change Log will tell you >>>> all the details. >>>> >>>> Download as usual from www.mailscanner.info. >>>> >>>> >> Jules >> >> -- >> Julian Field MEng CITP CEng >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> >> MailScanner customisation, or any advanced system administration help? >> Contact me at Jules@Jules.FM >> >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP >> public key: http://www.jules.fm/julesfm.asc Follow me at >> twitter.com/JulesFM >> >> >> -- >> This message has been scanned for viruses and dangerous content by >> MailScanner, and is believed to be clean. >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From J.Ede at birchenallhowden.co.uk Wed Apr 29 10:44:44 2009 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Wed Apr 29 10:45:05 2009 Subject: 4.76.22 In-Reply-To: References: <49F6E0D5.1020809@ecs.soton.ac.uk> <1213490F1F316842A544A850422BFA96239CFF91@BHLSBS.bhl.local> <49F75BBE.1070202@ecs.soton.ac.uk>, <1213490F1F316842A544A850422BFA96239BA53A@BHLSBS.bhl.local> <1213490F1F316842A544A850422BFA96239CFF9C@BHLSBS.bhl.local> <49F816CC.3000005@ecs.soton.ac.uk> Message-ID: <1213490F1F316842A544A850422BFA96239CFFB8@BHLSBS.bhl.local> Umm... Is the mailscanner rpm missing from that? > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- > bounces@lists.mailscanner.info] On Behalf Of Julian Field > Sent: 29 April 2009 09:59 > To: MailScanner discussion > Subject: Re: 4.76.22 > > Once I actually concentrated on the detail of the code for 2 minutes, > it > stared me in the face. > All fixed. > > I have just released 4.76.23 which contains both this fix, and the > re-ordering of Perl modules for CentOS 5.2->5.3 users. > > Please test both aspects. > > Many thanks, > Jules. > > On 29/04/2009 09:07, Jason Ede wrote: > > > From some more digging and inserting debug statements it seems to > be something on one of these 2 lines. > > > > $FoundBodyEnd = 1 if $line =~ s/\<\/body\>/$signature$&/i; > > $FoundHTMLEnd = 1 if !$FoundBodyEnd&& $line =~ > s/\<\/x?html\>/$signature$&/i; > > > > If I comment both of them out then it seems to work, but I'm betting > it breaks something else. Is it a odd combination of html tags at the > end of the email that triggers this again? > > > > Jason > > > > > >> -----Original Message----- > >> From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner- > >> bounces@lists.mailscanner.info] On Behalf Of Jason Ede > >> Sent: 29 April 2009 08:28 > >> To: MailScanner discussion > >> Subject: RE: 4.76.22 > >> > >> I've been trying this morning to break it using blat to send text > based > >> emails (email-plain) to the server and its been working perfectly. I > >> then used blat again with source copied from an outlook email > (email- > >> html) that shows the problem and it does append an extra signature > on > >> the end every time. I'll try some more debug on this later by adding > >> some debug lines into the code. I've attached the 2 text files that > >> I've been using. > >> > >> ________________________________________ > >> From: mailscanner-bounces@lists.mailscanner.info [mailscanner- > >> bounces@lists.mailscanner.info] On Behalf Of Julian Field > >> [MailScanner@ecs.soton.ac.uk] > >> Sent: 28 April 2009 20:40 > >> To: MailScanner discussion > >> Subject: Re: 4.76.22 > >> > >> On 28/04/2009 20:19, Jason Ede wrote: > >> > >>> I've been testing the _SIGNATURE_ option here and it seems that it > >>> always adds the signature at the end as well as in the message at > the > >>> signature tags. I'm using html sigs with an inline image. I've > taken > >>> at look at what I think is the code in message.pm but it all looks > >>> correct to me :( > >>> > >>> > >> Yes, I have looked too, when someone else commented they were > getting > >> the sig at the end too. But the code is incredibly simple and I > can't > >> see anything wrong with it either. > >> FoundSigMark = 0 > >> FoundSigMark = 1 if we successfully replace _SIGNATURE_ with the > >> signature text. > >> print signature text at end of message unless FoundSigMark is non- > zero. > >> That's all there is to it. > >> > >>> I don't need to change something in the config to stop it signing > at > >>> > >> the end as well? > >> > >>> > >> No. > >> If you could try adding some lines like > >> print STDERR "FoundSigMark = $FoundSigMark\n"; lines into the > code > >> at suitable places, then run it on your system with "MailScanner -- > >> debug" and see what it prints, that would really help me debug it. > >> > >> Many thanks. > >> > >>>> -----Original Message----- > >>>> From: mailscanner-bounces@lists.mailscanner.info > >>>> > >> [mailto:mailscanner- > >> > >>>> bounces@lists.mailscanner.info] On Behalf Of Julian Field > >>>> Sent: 28 April 2009 11:56 > >>>> To: MailScanner discussion > >>>> Subject: 4.76.22 > >>>> > >>>> I have just released a new beta, this will be one of the last > before > >>>> the next stable release. > >>>> Please test it, as I have optimised the processing-messages > database > >>>> code, and fixed one or two little bugs. The Change Log will tell > you > >>>> all the details. > >>>> > >>>> Download as usual from www.mailscanner.info. > >>>> > >>>> > >> Jules > >> > >> -- > >> Julian Field MEng CITP CEng > >> www.MailScanner.info > >> Buy the MailScanner book at www.MailScanner.info/store > >> > >> MailScanner customisation, or any advanced system administration > help? > >> Contact me at Jules@Jules.FM > >> > >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP > >> public key: http://www.jules.fm/julesfm.asc Follow me at > >> twitter.com/JulesFM > >> > >> > >> -- > >> This message has been scanned for viruses and dangerous content by > >> MailScanner, and is believed to be clean. > >> > >> -- > >> MailScanner mailing list > >> mailscanner@lists.mailscanner.info > >> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >> > >> Before posting, read http://wiki.mailscanner.info/posting > >> > >> Support MailScanner development - buy the book off the website! > >> > > Jules > > -- > Julian Field MEng CITP CEng > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > MailScanner customisation, or any advanced system administration help? > Contact me at Jules@Jules.FM > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > PGP public key: http://www.jules.fm/julesfm.asc > Follow me at twitter.com/JulesFM > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 29 11:35:05 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Wed Apr 29 11:35:29 2009 Subject: 4.76.22 In-Reply-To: <1213490F1F316842A544A850422BFA96239CFFB8@BHLSBS.bhl.local> References: <49F6E0D5.1020809@ecs.soton.ac.uk> <1213490F1F316842A544A850422BFA96239CFF91@BHLSBS.bhl.local> <49F75BBE.1070202@ecs.soton.ac.uk>, <1213490F1F316842A544A850422BFA96239BA53A@BHLSBS.bhl.local> <1213490F1F316842A544A850422BFA96239CFF9C@BHLSBS.bhl.local> <49F816CC.3000005@ecs.soton.ac.uk> <1213490F1F316842A544A850422BFA96239CFFB8@BHLSBS.bhl.local> <49F82D59.10000@ecs.soton.ac.uk> Message-ID: Somehow the IP address of www.mailscanner.eu has been changed, certainly not by me (I don't even know the username or password to do that any more). This broke the build. I have worked around this while I work with my favourite ISP to get this fixed. I have just released 4.76.23-2 which includes all the files. Thanks for letting me know so quickly, Jules. On 29/04/2009 10:44, Jason Ede wrote: > Umm... Is the mailscanner rpm missing from that? > >> -----Original Message----- >> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- >> bounces@lists.mailscanner.info] On Behalf Of Julian Field >> Sent: 29 April 2009 09:59 >> To: MailScanner discussion >> Subject: Re: 4.76.22 >> >> Once I actually concentrated on the detail of the code for 2 minutes, >> it >> stared me in the face. >> All fixed. >> >> I have just released 4.76.23 which contains both this fix, and the >> re-ordering of Perl modules for CentOS 5.2->5.3 users. >> >> Please test both aspects. >> >> Many thanks, >> Jules. >> >> On 29/04/2009 09:07, Jason Ede wrote: >> >>>> From some more digging and inserting debug statements it seems to >>>> >> be something on one of these 2 lines. >> >>> $FoundBodyEnd = 1 if $line =~ s/\<\/body\>/$signature$&/i; >>> $FoundHTMLEnd = 1 if !$FoundBodyEnd&& $line =~ >>> >> s/\<\/x?html\>/$signature$&/i; >> >>> If I comment both of them out then it seems to work, but I'm betting >>> >> it breaks something else. Is it a odd combination of html tags at the >> end of the email that triggers this again? >> >>> Jason >>> >>> >>> >>>> -----Original Message----- >>>> From: mailscanner-bounces@lists.mailscanner.info >>>> >> [mailto:mailscanner- >> >>>> bounces@lists.mailscanner.info] On Behalf Of Jason Ede >>>> Sent: 29 April 2009 08:28 >>>> To: MailScanner discussion >>>> Subject: RE: 4.76.22 >>>> >>>> I've been trying this morning to break it using blat to send text >>>> >> based >> >>>> emails (email-plain) to the server and its been working perfectly. I >>>> then used blat again with source copied from an outlook email >>>> >> (email- >> >>>> html) that shows the problem and it does append an extra signature >>>> >> on >> >>>> the end every time. I'll try some more debug on this later by adding >>>> some debug lines into the code. I've attached the 2 text files that >>>> I've been using. >>>> >>>> ________________________________________ >>>> From: mailscanner-bounces@lists.mailscanner.info [mailscanner- >>>> bounces@lists.mailscanner.info] On Behalf Of Julian Field >>>> [MailScanner@ecs.soton.ac.uk] >>>> Sent: 28 April 2009 20:40 >>>> To: MailScanner discussion >>>> Subject: Re: 4.76.22 >>>> >>>> On 28/04/2009 20:19, Jason Ede wrote: >>>> >>>> >>>>> I've been testing the _SIGNATURE_ option here and it seems that it >>>>> always adds the signature at the end as well as in the message at >>>>> >> the >> >>>>> signature tags. I'm using html sigs with an inline image. I've >>>>> >> taken >> >>>>> at look at what I think is the code in message.pm but it all looks >>>>> correct to me :( >>>>> >>>>> >>>>> >>>> Yes, I have looked too, when someone else commented they were >>>> >> getting >> >>>> the sig at the end too. But the code is incredibly simple and I >>>> >> can't >> >>>> see anything wrong with it either. >>>> FoundSigMark = 0 >>>> FoundSigMark = 1 if we successfully replace _SIGNATURE_ with the >>>> signature text. >>>> print signature text at end of message unless FoundSigMark is non- >>>> >> zero. >> >>>> That's all there is to it. >>>> >>>> >>>>> I don't need to change something in the config to stop it signing >>>>> >> at >> >>>>> >>>> the end as well? >>>> >>>> >>>>> >>>> No. >>>> If you could try adding some lines like >>>> print STDERR "FoundSigMark = $FoundSigMark\n"; lines into the >>>> >> code >> >>>> at suitable places, then run it on your system with "MailScanner -- >>>> debug" and see what it prints, that would really help me debug it. >>>> >>>> Many thanks. >>>> >>>> >>>>>> -----Original Message----- >>>>>> From: mailscanner-bounces@lists.mailscanner.info >>>>>> >>>>>> >>>> [mailto:mailscanner- >>>> >>>> >>>>>> bounces@lists.mailscanner.info] On Behalf Of Julian Field >>>>>> Sent: 28 April 2009 11:56 >>>>>> To: MailScanner discussion >>>>>> Subject: 4.76.22 >>>>>> >>>>>> I have just released a new beta, this will be one of the last >>>>>> >> before >> >>>>>> the next stable release. >>>>>> Please test it, as I have optimised the processing-messages >>>>>> >> database >> >>>>>> code, and fixed one or two little bugs. The Change Log will tell >>>>>> >> you >> >>>>>> all the details. >>>>>> >>>>>> Download as usual from www.mailscanner.info. >>>>>> >>>>>> >>>>>> >>>> Jules >>>> >>>> -- >>>> Julian Field MEng CITP CEng >>>> www.MailScanner.info >>>> Buy the MailScanner book at www.MailScanner.info/store >>>> >>>> MailScanner customisation, or any advanced system administration >>>> >> help? >> >>>> Contact me at Jules@Jules.FM >>>> >>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP >>>> public key: http://www.jules.fm/julesfm.asc Follow me at >>>> twitter.com/JulesFM >>>> >>>> >>>> -- >>>> This message has been scanned for viruses and dangerous content by >>>> MailScanner, and is believed to be clean. >>>> >>>> -- >>>> MailScanner mailing list >>>> mailscanner@lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >> Jules >> >> -- >> Julian Field MEng CITP CEng >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> >> MailScanner customisation, or any advanced system administration help? >> Contact me at Jules@Jules.FM >> >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> PGP public key: http://www.jules.fm/julesfm.asc >> Follow me at twitter.com/JulesFM >> >> >> -- >> This message has been scanned for viruses and >> dangerous content by MailScanner, and is >> believed to be clean. >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From J.Ede at birchenallhowden.co.uk Wed Apr 29 12:08:39 2009 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Wed Apr 29 12:14:33 2009 Subject: 4.76.22 In-Reply-To: References: <49F6E0D5.1020809@ecs.soton.ac.uk> <1213490F1F316842A544A850422BFA96239CFF91@BHLSBS.bhl.local> <49F75BBE.1070202@ecs.soton.ac.uk>, <1213490F1F316842A544A850422BFA96239BA53A@BHLSBS.bhl.local> <1213490F1F316842A544A850422BFA96239CFF9C@BHLSBS.bhl.local> <49F816CC.3000005@ecs.soton.ac.uk> <1213490F1F316842A544A850422BFA96239CFFB8@BHLSBS.bhl.local> <49F82D59.10000@ecs.soton.ac.uk> Message-ID: <1213490F1F316842A544A850422BFA96239CFFC8@BHLSBS.bhl.local> That new version looks to be working perfectly for me :-) Many thanks for all your hard work on this :D Jason > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- > bounces@lists.mailscanner.info] On Behalf Of Julian Field > Sent: 29 April 2009 11:35 > To: MailScanner discussion > Subject: Re: 4.76.22 > > Somehow the IP address of www.mailscanner.eu has been changed, > certainly > not by me (I don't even know the username or password to do that any > more). > This broke the build. > I have worked around this while I work with my favourite ISP to get > this > fixed. > > I have just released 4.76.23-2 which includes all the files. > > Thanks for letting me know so quickly, > Jules. > > On 29/04/2009 10:44, Jason Ede wrote: > > Umm... Is the mailscanner rpm missing from that? > > > >> -----Original Message----- > >> From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner- > >> bounces@lists.mailscanner.info] On Behalf Of Julian Field > >> Sent: 29 April 2009 09:59 > >> To: MailScanner discussion > >> Subject: Re: 4.76.22 > >> > >> Once I actually concentrated on the detail of the code for 2 > minutes, > >> it > >> stared me in the face. > >> All fixed. > >> > >> I have just released 4.76.23 which contains both this fix, and the > >> re-ordering of Perl modules for CentOS 5.2->5.3 users. > >> > >> Please test both aspects. > >> > >> Many thanks, > >> Jules. > >> > >> On 29/04/2009 09:07, Jason Ede wrote: > >> > >>>> From some more digging and inserting debug statements it seems to > >>>> > >> be something on one of these 2 lines. > >> > >>> $FoundBodyEnd = 1 if $line =~ s/\<\/body\>/$signature$&/i; > >>> $FoundHTMLEnd = 1 if !$FoundBodyEnd&& $line =~ > >>> > >> s/\<\/x?html\>/$signature$&/i; > >> > >>> If I comment both of them out then it seems to work, but I'm > betting > >>> > >> it breaks something else. Is it a odd combination of html tags at > the > >> end of the email that triggers this again? > >> > >>> Jason > >>> > >>> > >>> > >>>> -----Original Message----- > >>>> From: mailscanner-bounces@lists.mailscanner.info > >>>> > >> [mailto:mailscanner- > >> > >>>> bounces@lists.mailscanner.info] On Behalf Of Jason Ede > >>>> Sent: 29 April 2009 08:28 > >>>> To: MailScanner discussion > >>>> Subject: RE: 4.76.22 > >>>> > >>>> I've been trying this morning to break it using blat to send text > >>>> > >> based > >> > >>>> emails (email-plain) to the server and its been working perfectly. > I > >>>> then used blat again with source copied from an outlook email > >>>> > >> (email- > >> > >>>> html) that shows the problem and it does append an extra signature > >>>> > >> on > >> > >>>> the end every time. I'll try some more debug on this later by > adding > >>>> some debug lines into the code. I've attached the 2 text files > that > >>>> I've been using. > >>>> > >>>> ________________________________________ > >>>> From: mailscanner-bounces@lists.mailscanner.info [mailscanner- > >>>> bounces@lists.mailscanner.info] On Behalf Of Julian Field > >>>> [MailScanner@ecs.soton.ac.uk] > >>>> Sent: 28 April 2009 20:40 > >>>> To: MailScanner discussion > >>>> Subject: Re: 4.76.22 > >>>> > >>>> On 28/04/2009 20:19, Jason Ede wrote: > >>>> > >>>> > >>>>> I've been testing the _SIGNATURE_ option here and it seems that > it > >>>>> always adds the signature at the end as well as in the message at > >>>>> > >> the > >> > >>>>> signature tags. I'm using html sigs with an inline image. I've > >>>>> > >> taken > >> > >>>>> at look at what I think is the code in message.pm but it all > looks > >>>>> correct to me :( > >>>>> > >>>>> > >>>>> > >>>> Yes, I have looked too, when someone else commented they were > >>>> > >> getting > >> > >>>> the sig at the end too. But the code is incredibly simple and I > >>>> > >> can't > >> > >>>> see anything wrong with it either. > >>>> FoundSigMark = 0 > >>>> FoundSigMark = 1 if we successfully replace _SIGNATURE_ with the > >>>> signature text. > >>>> print signature text at end of message unless FoundSigMark is non- > >>>> > >> zero. > >> > >>>> That's all there is to it. > >>>> > >>>> > >>>>> I don't need to change something in the config to stop it signing > >>>>> > >> at > >> > >>>>> > >>>> the end as well? > >>>> > >>>> > >>>>> > >>>> No. > >>>> If you could try adding some lines like > >>>> print STDERR "FoundSigMark = $FoundSigMark\n"; lines into > the > >>>> > >> code > >> > >>>> at suitable places, then run it on your system with "MailScanner - > - > >>>> debug" and see what it prints, that would really help me debug it. > >>>> > >>>> Many thanks. > >>>> > >>>> > >>>>>> -----Original Message----- > >>>>>> From: mailscanner-bounces@lists.mailscanner.info > >>>>>> > >>>>>> > >>>> [mailto:mailscanner- > >>>> > >>>> > >>>>>> bounces@lists.mailscanner.info] On Behalf Of Julian Field > >>>>>> Sent: 28 April 2009 11:56 > >>>>>> To: MailScanner discussion > >>>>>> Subject: 4.76.22 > >>>>>> > >>>>>> I have just released a new beta, this will be one of the last > >>>>>> > >> before > >> > >>>>>> the next stable release. > >>>>>> Please test it, as I have optimised the processing-messages > >>>>>> > >> database > >> > >>>>>> code, and fixed one or two little bugs. The Change Log will tell > >>>>>> > >> you > >> > >>>>>> all the details. > >>>>>> > >>>>>> Download as usual from www.mailscanner.info. > >>>>>> > >>>>>> > >>>>>> > >>>> Jules > >>>> > >>>> -- > >>>> Julian Field MEng CITP CEng > >>>> www.MailScanner.info > >>>> Buy the MailScanner book at www.MailScanner.info/store > >>>> > >>>> MailScanner customisation, or any advanced system administration > >>>> > >> help? > >> > >>>> Contact me at Jules@Jules.FM > >>>> > >>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > PGP > >>>> public key: http://www.jules.fm/julesfm.asc Follow me at > >>>> twitter.com/JulesFM > >>>> > >>>> > >>>> -- > >>>> This message has been scanned for viruses and dangerous content by > >>>> MailScanner, and is believed to be clean. > >>>> > >>>> -- > >>>> MailScanner mailing list > >>>> mailscanner@lists.mailscanner.info > >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >>>> > >>>> Before posting, read http://wiki.mailscanner.info/posting > >>>> > >>>> Support MailScanner development - buy the book off the website! > >>>> > >>>> > >> Jules > >> > >> -- > >> Julian Field MEng CITP CEng > >> www.MailScanner.info > >> Buy the MailScanner book at www.MailScanner.info/store > >> > >> MailScanner customisation, or any advanced system administration > help? > >> Contact me at Jules@Jules.FM > >> > >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >> PGP public key: http://www.jules.fm/julesfm.asc > >> Follow me at twitter.com/JulesFM > >> > >> > >> -- > >> This message has been scanned for viruses and > >> dangerous content by MailScanner, and is > >> believed to be clean. > >> > >> -- > >> MailScanner mailing list > >> mailscanner@lists.mailscanner.info > >> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >> > >> Before posting, read http://wiki.mailscanner.info/posting > >> > >> Support MailScanner development - buy the book off the website! > >> > > Jules > > -- > Julian Field MEng CITP CEng > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > MailScanner customisation, or any advanced system administration help? > Contact me at Jules@Jules.FM > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > PGP public key: http://www.jules.fm/julesfm.asc > Follow me at twitter.com/JulesFM > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 29 18:55:06 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Wed Apr 29 18:55:24 2009 Subject: Mailing list outage today References: <49F8947A.8040908@ecs.soton.ac.uk> Message-ID: Many apologies folks, I screwed up the DNS domain transfer to Blacknight as I couldn't do a zone transfer of the old copy of the domain (I lost the password long ago). I have moved www, wiki and lists along with their appropriate A, MX and TXT records. Hopefully that's it. Please do not adjust your set, normal service will be resumed shortly. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From paul.welsh.3 at googlemail.com Wed Apr 29 15:35:31 2009 From: paul.welsh.3 at googlemail.com (Paul Welsh) Date: Wed Apr 29 19:46:28 2009 Subject: lists.mailscanner.info down? Message-ID: <49df20710904290735v61d6d786h85b709b793cfa51f@mail.gmail.com> > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.mailscanner.info/mailman/listinfo/mailscanner http://lists.mailscanner.info/mailman/listinfo/mailscanner seems to be unavailable. I can't ping lists.mailscanner.info either. Anyone else noticed this? From frankd at iaw.on.ca Wed Apr 29 20:35:17 2009 From: frankd at iaw.on.ca (Frank DeChellis) Date: Wed Apr 29 20:35:32 2009 Subject: Quick setup for Exim Message-ID: Hi, We are setting up mailscanner to work with Exim on a server that will serve as a gateway. Our main server with all the mailboxes is running Exim. Our mailscanner will use ClamAV and Spamassassin. We are using NetBSD 4.0.1. So we want email coming into the gateway, scanned and passed on (if valid) to our main server. Is there a simple set of exim configs (in and out) that are used for gateway boxes? I?ve read many articles and they all have a different twist but all I was looking for was something simple. Thanks Frank Frank DeChellis President, Internet Access Worldwide Welland, Ontario, Canada www.iaw.com -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090429/9ad71ce7/attachment.html From MailScanner at ecs.soton.ac.uk Wed Apr 29 20:46:29 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Wed Apr 29 20:46:59 2009 Subject: Quick setup for Exim In-Reply-To: References: <49F8AE95.2040504@ecs.soton.ac.uk> Message-ID: On 29/04/2009 20:35, Frank DeChellis wrote: > Hi, > > We are setting up mailscanner to work with Exim on a server that will > serve as a gateway. Our main server with all the mailboxes is running > Exim. > > Our mailscanner will use ClamAV and Spamassassin. We are using NetBSD > 4.0.1. > > So we want email coming into the gateway, scanned and passed on (if > valid) to our main server. > > Is there a simple set of exim configs (in and out) that are used for > gateway boxes? Start here: http://www.mailscanner.info/exim.html > > I?ve read many articles and they all have a different twist but all I > was looking for was something simple. > > Thanks > Frank > > > Frank DeChellis > President, Internet Access Worldwide > Welland, Ontario, Canada > www.iaw.com > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From davejones70 at gmail.com Wed Apr 29 21:27:21 2009 From: davejones70 at gmail.com (Dave Jones) Date: Wed Apr 29 21:27:30 2009 Subject: Anyone have any experience with Avast AV? Message-ID: <67a55ed50904291327m71f236a3wbd9245e6f3079a1d@mail.gmail.com> Anyone have any experience with Avast? The pricing is much, much cheaper than other commercial AV scanners so I wanted to make sure it was good before I pursue switching to it. It is not priced by the mailbox so you can get a 3 year license for a pair of MailScanner servers for roughly $8,000. This would only cover about 4 months of our current commercial AV license for 8K mailboxes. -- Dave Jones From kwang at ucalgary.ca Wed Apr 29 21:43:30 2009 From: kwang at ucalgary.ca (Kai Wang) Date: Wed Apr 29 21:43:48 2009 Subject: MailScanner archive a message multiple times In-Reply-To: References: <975ACAD1F82F5540BD5397D900C5AE2E58415ACB46@EXMBSRV01.msg.ucalgary.ca> Message-ID: <975ACAD1F82F5540BD5397D900C5AE2E58415ACB4E@EXMBSRV01.msg.ucalgary.ca> Good news. I solved the problem myself. I read the "MailScanner Installation Guide - Postfix" and verified smtp4 configuration with it. I noticed that the /var/spool/MailScanner/quarantine ownership was incorrect. I modified it and restarted postfix at abour 2:10pm. It has been 30+ minutes. There is not duplicate archive copies since then. Also the "postfix: Process did not exit cleanly, returned 255 with signal 0" error disappeared from /var/log/messages. [root@smtp4 postfix]# ls -dl /var/spool/MailScanner/quarantine drwxr-xr-x 2 root root 4096 Apr 10 10:03 /var/spool/MailScanner/quarantine [root@smtp4 postfix]# chown -R postfix.postfix /var/spool/MailScanner/quarantine [root@smtp4 20090429]# pwd /var/spool/MailScanner/archive/20090429 [root@smtp4 20090429]# ls -l | grep " 29 14:1" | cut -c52-61 | sort | uniq -c | sort -rn | head -5 1 F28845800C 1 EF8AB5801A 1 EED185800A 1 EE4845800A 1 EC1E05801A [root@smtp4 20090429]# ls -l | grep " 29 07:1" | cut -c52-61 | sort | uniq -c | sort -rn | head -5 90 52DEC5800B 84 1EFBE5801E 48 20CC258004 33 6CA8958003 26 E2B7B58003 [root@smtp4 ~]# grep -E "postfix: Process did not exit cleanly|last message repeated" /var/log/messages | tail -5 Apr 29 13:58:58 smtp4 last message repeated 2 times Apr 29 13:59:09 smtp4 postfix: Process did not exit cleanly, returned 255 with signal 0 Apr 29 13:59:21 smtp4 postfix: Process did not exit cleanly, returned 255 with signal 0 Apr 29 13:59:57 smtp4 last message repeated 3 times Apr 29 14:00:50 smtp4 last message repeated 8 times Kai Wang System Services Information Technologies, University of Calgary, 2500 University Drive, N.W., Calgary, Alberta, Canada T2N 1N4 Phone (403) 220-2423 Fax (403) 282-9361 -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Kai Schaetzl Sent: Wednesday, April 29, 2009 2:49 AM To: mailscanner@lists.mailscanner.info Subject: Re: MailScanner archive a message multiple times Kai Wang wrote on Tue, 28 Apr 2009 19:26:00 -0600: > Apr 28 15:23:12 smtp4 postfix/cleanup[24397]: F3CA058002: message-id=<200904282123.n3SLNAkR028670@l5.acs.ucalgary.ca> > Apr 28 15:23:14 smtp4 MailScanner[23234]: Saved archive copies of > F3CA058002.B6300 A38AB58004.360C0 52DEC5800B.63C17 > Apr 28 15:23:18 smtp4 MailScanner[24265]: Saved archive copies of > F3CA058002.57F78 52DEC5800B.B3C49 A38AB58004.19C12 > Apr 28 15:23:25 smtp4 MailScanner[24658]: Saved archive copies of > F3CA058002.D6243 A38AB58004.40395 099AA58005.34E58 B035558007.D1C75 > 52DEC5800B.3168F This indicates that the message had to be processed several times. Either because there was a processing problem first or (guess) you split the messages to one for each recipient. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From vanhorn at whidbey.com Wed Apr 29 21:57:31 2009 From: vanhorn at whidbey.com (G. Armour Van Horn) Date: Wed Apr 29 21:57:41 2009 Subject: Startup errors after major upgrade In-Reply-To: References: <49F7C40D.5080008@whidbey.com> Message-ID: <49F8BF3B.7070303@whidbey.com> Okay, I've removed it, but that isn't contributing to the startup problems because I hadn't made any changes at all in the webmin module. I trust Jules will see this and consider removing it from the Other Downloads section where I first saw it yesterday. Van Kai Schaetzl wrote: > Stop using that webmin module, correct these lines in your > MailScanner.conf or install it new. Your config was broken by that module. > > Kai > > -- ---------------------------------------------------------- Sign up now for Quotes of the Day, a handful of quotations on a theme delivered every morning. Enlightenment! Daily, for free! mailto:twisted@whidbey.com?subject=Subscribe_QOTD For photography, web design, hosting, and maintenance, visit Van's home page: http://www.domainvanhorn.com/van/ ----------------------------------------------------------- From vanhorn at whidbey.com Wed Apr 29 22:10:56 2009 From: vanhorn at whidbey.com (G. Armour Van Horn) Date: Wed Apr 29 22:11:06 2009 Subject: Startup errors after major upgrade In-Reply-To: References: <49F7C40D.5080008@whidbey.com> <49F80F3F.5090502@ecs.soton.ac.uk> Message-ID: <49F8C260.1030502@whidbey.com> Jules, To the first, you were dead on. I originally copied the lines from the default filename rules and just changed "deny" to "allow". It didn't generate any errors before. To the second, the error lists three characters that aren't allowed, and I'm not using any of them. I didn't change the string, it's the same as it has been for the two and a half years since this machine was setup. It also failed with square brackets, and with just a semi-colon before the server name. I ended up with this: Mail Header = X-%org-name%-VanguardMailScanner: I really don't like confusing my server name with your product name, but without at least some non-alpha character that works it's difficult. Van Julian Field wrote: > > On 29/04/2009 04:05, G. Armour Van Horn wrote: >> Okay, I just installed MailScanner 4.75.11 over an existing >> installation, which was 4.57.6. When I restarted MS I got a few >> complaints about spaces that should have been tabs in a couple of >> domain-specific rule files, which I took care of. >> >> Well, I guess not. I'm still getting this one: >> >> Possible syntax error on line 14 of >> /etc/MailScanner/filename.tlc.conf at >> /usr/lib/MailScanner/MailScanner/Config.pm line 1472 >> Remember to separate fields with tab characters! at >> /usr/lib/MailScanner/MailScanner/Config.pm line 1474 >> >> Line 14 of that file is the "allow" line below, and the space after >> allow and the space between $ and Found are both single tabs. >> >> # Allow all other double file extensions. Specifically for >> ClickAndPledge.com >> allow \.[a-z][a-z0-9]{2,3}\s*\.[a-z0-9]{3}$ Found possible >> filename hiding > If you look at the other "allow" and "deny" lines, they have 2 strings > after the regexp. Both of which, in an allow, are normally "-" as they > are not used. But there must be **2* of them! > >> >> >> The main problem, I think, is this one: >> >> Your setting "Mail Header" contains illegal characters. >> This is most likely caused by your "%org-name%" setting >> which must not contain any spaces, "." or "_" characters >> as these are known to cause problems with many mail systems. >> >> I believe these are the applicable lines out of MailScanner.conf: >> >> %org-name% = DomainVanHorn >> >> Mail Header = X-%org-name%-MailScanner(vanguard): > Are () brackets allowed in mail header names? I don't think they are. >> >> I sent myself a test message, and here is a chunk out of the source >> of the message I got back: >> >> Subject: test >> Content-Type: text/plain; charset=ISO-8859-1; format=flowed >> Content-Transfer-Encoding: 7bit >> X-DomainVanHorn-MailScanner-Information: Please contact the ISP for >> more information >> X-DomainVanHorn-MailScanner-ID: n3T2mLYw025775 >> X-DomainVanHorn-MailScanner(vanguard): Found to be clean >> X-DomainVanHorn-MailScanner-SpamCheck(vanguard): not spam, >> SpamAssassin (not cached, score=-2.599, required 4, >> autolearn=not spam, BAYES_00 -2.60) >> X-DomainVanHorn-MailScanner-From: vanhorn@whidbey.com >> X-Spam-Status: No >> X-WNSpam-Score: 6.3 >> X-WNSpam-Int: 63 >> X-Spambayes-Classification: ham >> X-Spambayes-Spam-Probability: 0.00 (7) >> X-Spambayes-MailId: 1240953637 >> >> >> Odd that my server and SpamBayes both say it's clean, but my ISP >> considered it spam (WNSpam at 6.3, on that system 3.5 is a good >> default for the cutoff.) But the MS headers seem to be working >> coherently, and without any spaces that I can see. >> >> Can these be ignored, or do I have to worry about them? >> >> Van >> > > Jules > -- ---------------------------------------------------------- Sign up now for Quotes of the Day, a handful of quotations on a theme delivered every morning. Enlightenment! Daily, for free! mailto:twisted@whidbey.com?subject=Subscribe_QOTD For photography, web design, hosting, and maintenance, visit Van's home page: http://www.domainvanhorn.com/van/ ----------------------------------------------------------- From ssilva at sgvwater.com Wed Apr 29 22:58:26 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Wed Apr 29 22:58:58 2009 Subject: Anyone have any experience with Avast AV? In-Reply-To: <67a55ed50904291327m71f236a3wbd9245e6f3079a1d@mail.gmail.com> References: <67a55ed50904291327m71f236a3wbd9245e6f3079a1d@mail.gmail.com> Message-ID: on 4-29-2009 1:27 PM Dave Jones spake the following: > Anyone have any experience with Avast? The pricing is much, much > cheaper than other commercial AV scanners so I wanted to make sure it > was good before I pursue switching to it. It is not priced by the > mailbox so you can get a 3 year license for a pair of MailScanner > servers for roughly $8,000. This would only cover about 4 months of > our current commercial AV license for 8K mailboxes. > You could check if your desktop licensing entitles you to a commandline scanner for free. McAfee does, and I think symantec might. Maybe some others do also. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090429/66db0108/signature.bin From peter at farrows.org Wed Apr 29 23:04:49 2009 From: peter at farrows.org (Peter Farrow) Date: Wed Apr 29 23:05:12 2009 Subject: Anyone have any experience with Avast AV? In-Reply-To: References: <67a55ed50904291327m71f236a3wbd9245e6f3079a1d@mail.gmail.com> Message-ID: <49F8CF01.60904@farrows.org> Scott Silva wrote: > on 4-29-2009 1:27 PM Dave Jones spake the following: > >> Anyone have any experience with Avast? The pricing is much, much >> cheaper than other commercial AV scanners so I wanted to make sure it >> was good before I pursue switching to it. It is not priced by the >> mailbox so you can get a 3 year license for a pair of MailScanner >> servers for roughly $8,000. This would only cover about 4 months of >> our current commercial AV license for 8K mailboxes. >> >> > You could check if your desktop licensing entitles you to a commandline > scanner for free. McAfee does, and I think symantec might. Maybe some others > do also. > > I use Avast AV on desktops and servers, and its the best AV product around IMHO. Its lightweight so doesn't hog resources, I come across machines infected with virsues when they use Norton (yuk) Mcaffee, AVG etc etc but never have I had to clean a machine that was running Avast, speaks volumes really. Just my 10pence worth... Pete -- This message has been scanned for viruses and dangerous content by the Inexcom system Scanner, and is believed to be clean. Advanced heuristic mail scanning server [-]. http://www.inexcom.co.uk From maillists at conactive.com Thu Apr 30 00:12:12 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Thu Apr 30 00:12:24 2009 Subject: Startup errors after major upgrade In-Reply-To: <49F8C260.1030502@whidbey.com> References: <49F7C40D.5080008@whidbey.com> <49F80F3F.5090502@ecs.soton.ac.uk> <49F8C260.1030502@whidbey.com> Message-ID: G. Armour Van Horn wrote on Wed, 29 Apr 2009 14:10:56 -0700: > I really don't like confusing my server name with your product name, but > without at least some non-alpha character that works it's difficult. As you can easily see you can use hyphens. Also, nobody requires you to use "MailScanner" in there. And isn't the org-name sufficient for a distinction? Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From vanhorn at whidbey.com Thu Apr 30 02:04:06 2009 From: vanhorn at whidbey.com (G. Armour Van Horn) Date: Thu Apr 30 02:04:19 2009 Subject: Startup errors after major upgrade In-Reply-To: References: <49F7C40D.5080008@whidbey.com> <49F80F3F.5090502@ecs.soton.ac.uk> <49F8C260.1030502@whidbey.com> Message-ID: <49F8F906.4000305@whidbey.com> Well, no, as it specifically banned spaces, periods, and underscores, but was complaining about parentheses, I somehow hadn't thought to try hyphens. If Jules puts the product name in there by default, I have no reason to take it out. I don't particularly want to hide the name, the product is worthy of mention. As it happens, I actually don't need anything more than the org-name at the moment, because only one of my three servers is running MailScanner. Over the last ten years, that hasn't normally been the pattern, and I can't imagine that I'll stay with only three servers, only one of which runs MailScanner, for all that long. If I have to dig a file out of the quarantine for a client I would just as soon start digging on the right server. Van Kai Schaetzl wrote: > G. Armour Van Horn wrote on Wed, 29 Apr 2009 14:10:56 -0700: > > >> I really don't like confusing my server name with your product name, but >> without at least some non-alpha character that works it's difficult. >> > > As you can easily see you can use hyphens. Also, nobody requires you to use > "MailScanner" in there. And isn't the org-name sufficient for a > distinction? > > Kai > > -- ---------------------------------------------------------- Sign up now for Quotes of the Day, a handful of quotations on a theme delivered every morning. Enlightenment! Daily, for free! mailto:twisted@whidbey.com?subject=Subscribe_QOTD For photography, web design, hosting, and maintenance, visit Van's home page: http://www.domainvanhorn.com/van/ ----------------------------------------------------------- -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090429/65d52658/attachment.html From ajcartmell at fonant.com Thu Apr 30 09:09:23 2009 From: ajcartmell at fonant.com (Anthony Cartmell) Date: Thu Apr 30 09:09:33 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> <4A09477D575C2C4B86497161427DD94C0D153E2A77@city-exchange07> Message-ID: >> Interestingly, the MailScanner footer is preceeded by dash dash space >> and doesn't appear in the reply. You're signature just has dashes >> but I presume it originally had a space following. Kai's message appears correctly in Opera, his signature is recognised and is displayed in grey rather than black. > Right. > > So where is that >> getting stripped? Do email clients parse from the bottom up until >> they see the last instance of dash dash space and then change any >> others to just dual dashes? > > Yes, it looks like that. My client is doing the same. I thought it's the > QP, but it's the duplicate signature marker. > No message should have two signature seperators. I would have already > complained with Julian, if I had a better solution ;-) Opera is quite happy with two signature separators in a message, it simply treats the first one as the start of the signature: all text after it is in grey. Further signature separator lines are simply treated as part of the signature text. This has a slight downside that if a dash-dash-space line appears in a digest email then all the following messages are treated as signature text, and shown in grey. Perhaps other mail clients work backwards from the end of the message to find the signature separator they are going to use, to avoid this particular problem? Perhaps in an ideal world the signature would be a separate MIME part in the message, so we wouldn't need to resort to text parsing tricks to identify it... Anthony -- www.fonant.com - Quality web sites From MailScanner at ecs.soton.ac.uk Thu Apr 30 09:12:32 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Apr 30 09:12:56 2009 Subject: Startup errors after major upgrade In-Reply-To: <49F8C260.1030502@whidbey.com> References: <49F7C40D.5080008@whidbey.com> <49F80F3F.5090502@ecs.soton.ac.uk> <49F8C260.1030502@whidbey.com> <49F95D70.7040602@ecs.soton.ac.uk> Message-ID: On 29/04/2009 22:10, G. Armour Van Horn wrote: > Jules, > > To the first, you were dead on. I originally copied the lines from the > default filename rules and just changed "deny" to "allow". It didn't > generate any errors before. > > To the second, the error lists three characters that aren't allowed, > and I'm not using any of them. I didn't change the string, it's the > same as it has been for the two and a half years since this machine > was setup. It also failed with square brackets, and with just a > semi-colon before the server name. I ended up with this: > Mail Header = X-%org-name%-VanguardMailScanner: > > I really don't like confusing my server name with your product name, > but without at least some non-alpha character that works it's difficult. You do have the option of removing the word "MailScanner" from that setting. The legal characters (from my code) are these: _ a-z A-Z 0-9 - so you could also use X-%org-name%-Vanguard-MailScanner: for example. I play it safe as many mail systems are badly written and misbehave if you don't. > > Van > > Julian Field wrote: >> >> On 29/04/2009 04:05, G. Armour Van Horn wrote: >>> Okay, I just installed MailScanner 4.75.11 over an existing >>> installation, which was 4.57.6. When I restarted MS I got a few >>> complaints about spaces that should have been tabs in a couple of >>> domain-specific rule files, which I took care of. >>> >>> Well, I guess not. I'm still getting this one: >>> >>> Possible syntax error on line 14 of >>> /etc/MailScanner/filename.tlc.conf at >>> /usr/lib/MailScanner/MailScanner/Config.pm line 1472 >>> Remember to separate fields with tab characters! at >>> /usr/lib/MailScanner/MailScanner/Config.pm line 1474 >>> >>> Line 14 of that file is the "allow" line below, and the space after >>> allow and the space between $ and Found are both single tabs. >>> >>> # Allow all other double file extensions. Specifically for >>> ClickAndPledge.com >>> allow \.[a-z][a-z0-9]{2,3}\s*\.[a-z0-9]{3}$ Found possible >>> filename hiding >> If you look at the other "allow" and "deny" lines, they have 2 >> strings after the regexp. Both of which, in an allow, are normally >> "-" as they are not used. But there must be **2* of them! >> >>> >>> >>> The main problem, I think, is this one: >>> >>> Your setting "Mail Header" contains illegal characters. >>> This is most likely caused by your "%org-name%" setting >>> which must not contain any spaces, "." or "_" characters >>> as these are known to cause problems with many mail systems. >>> >>> I believe these are the applicable lines out of MailScanner.conf: >>> >>> %org-name% = DomainVanHorn >>> >>> Mail Header = X-%org-name%-MailScanner(vanguard): >> Are () brackets allowed in mail header names? I don't think they are. >>> >>> I sent myself a test message, and here is a chunk out of the source >>> of the message I got back: >>> >>> Subject: test >>> Content-Type: text/plain; charset=ISO-8859-1; format=flowed >>> Content-Transfer-Encoding: 7bit >>> X-DomainVanHorn-MailScanner-Information: Please contact the ISP for >>> more information >>> X-DomainVanHorn-MailScanner-ID: n3T2mLYw025775 >>> X-DomainVanHorn-MailScanner(vanguard): Found to be clean >>> X-DomainVanHorn-MailScanner-SpamCheck(vanguard): not spam, >>> SpamAssassin (not cached, score=-2.599, required 4, >>> autolearn=not spam, BAYES_00 -2.60) >>> X-DomainVanHorn-MailScanner-From: vanhorn@whidbey.com >>> X-Spam-Status: No >>> X-WNSpam-Score: 6.3 >>> X-WNSpam-Int: 63 >>> X-Spambayes-Classification: ham >>> X-Spambayes-Spam-Probability: 0.00 (7) >>> X-Spambayes-MailId: 1240953637 >>> >>> >>> Odd that my server and SpamBayes both say it's clean, but my ISP >>> considered it spam (WNSpam at 6.3, on that system 3.5 is a good >>> default for the cutoff.) But the MS headers seem to be working >>> coherently, and without any spaces that I can see. >>> >>> Can these be ignored, or do I have to worry about them? >>> >>> Van >>> >> >> Jules >> > Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 Follow me at twitter.com/JulesFM and twitter.com/MailScanner -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From ajcartmell at fonant.com Thu Apr 30 09:18:27 2009 From: ajcartmell at fonant.com (Anthony Cartmell) Date: Thu Apr 30 09:18:35 2009 Subject: Preventing multiple signatures in email conversation? In-Reply-To: References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> <43F62CA225017044BC84CFAF92B4333B06F530@sbsserver.Techquility.net> <49F5E59F.10104@ecs.soton.ac.uk> <43F62CA225017044BC84CFAF92B4333B06F533@sbsserver.Techquility.net> <49F5FBCE.8080506@ecs.soton.ac.uk> <43F62CA225017044BC84CFAF92B4333B06F53D@sbsserver.Techquility.net> <49F744AB.3060306@ecs.soton.ac.uk> <49F78F65.1070502@ecs.soton.ac.uk> Message-ID: > Hm. All the other empty tags that come to mind do something, for instance >
or
. How about ? Normally you'd need for most browsers to actually work with the in-page anchor, but since we're not actually going to use it as such you can probably use the single tag. In fact you could probably use or
too, although that is possibly slightly more likely to break the rendering in some clients. HTH, Anthony -- www.fonant.com - Quality web sites From MailScanner at ecs.soton.ac.uk Thu Apr 30 09:29:45 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Apr 30 09:30:06 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> <4A09477D575C2C4B86497161427DD94C0D153E2A77@city-exchange07> <49F96179.6030007@ecs.soton.ac.uk> Message-ID: On 30/04/2009 09:09, Anthony Cartmell wrote: > Perhaps in an ideal world the signature would be a separate MIME part > in the message, so we wouldn't need to resort to text parsing tricks > to identify it... I did try this when I first implemented it, as it's a much neater solution to the problem. Unfortunately a lot of mail clients didn't play well with that idea, so I had to resort to the current solution of inserting the signature in the most likely MIME parts of the message. This is a pain as it breaks cryptographic signatures of the MIME parts, but it's the only way most mail clients will display correctly. And a lot less the half the people in the world use cryptographic signatures of email messages, so they lost out to the majority. If you want crypto sigs to work, just turn the feature off :-) Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 Follow me at twitter.com/JulesFM and twitter.com/MailScanner -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From mailadmin at midland-ics.ie Thu Apr 30 09:48:38 2009 From: mailadmin at midland-ics.ie (Mail Admin) Date: Thu Apr 30 09:49:57 2009 Subject: MailScanner slowwing down Message-ID: <045c01c9c970$75545130$5ffcf390$@ie> Hi All, Recently I am finding that the amount of incoming mail through my MailScanner Server is really slowing down things. There is a heavy load now since I took on a domain that seems to me well spammed. Yesterdays processing processed 22,000 emails @88% Spam approx. Server Spec POWEREDGE 1850 XEON 2.8GHZ/2MB 800FSB - WITH 2 GIG RAM and RAID 1 Configuration on two Disks RPM 10K. Its Running Fedora Core 5, Send Mail 8.13.8-1.fc5 with MailScanner 4.69.7-1 with SA, Razor, DCC., MailWatch V1 Its working very well blocking spam, but only in the last couple of days its got really slow. Any ideas on how to reduce the load on this server>? By blocking mail at the MTA before it hits MS? OR Tweaking my processes? What do the Experts think on the Server Spec, for the amount of traffic? I'd appreciate any help Regards Kevin This e-mail is intended solely for the addressee(s) and is strictly confidential. The unauthorised use, disclosure or copying of this e-mail, or any information it contains is prohibited. If you have received this e-mail in error, please notify us immediately and then permanently delete it. Although Midland Internet & Computer Solutions make every effort to keep our systems free from viruses you should check this e-mail and any attachments to it for viruses as we cannot accept any liability for viruses inadvertently transmitted by use. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090430/7f3ff679/attachment.html From t.d.lee at durham.ac.uk Thu Apr 30 10:18:37 2009 From: t.d.lee at durham.ac.uk (David Lee) Date: Thu Apr 30 10:19:11 2009 Subject: install: a debug-like "I would but I won't" option? Message-ID: I've got a vague recollection that this might have been raised before, but I'm raising it again, especially in the light of the recent (and good!) developments that rationalise the Redhat/Centos perl module installation procedures. Julian: Would it be possible (pretty please) to have an option on "install.sh" which shows what would happen, without actually doing it? In particular, for folk rationalising various inherited and new installations of various OSes, it could show which modules were going to be removed, updated, re-installed etc, and why. I suspect that many of us have perl installations that are in various states, both from various historical installastions of MS and from other non-MS causes. Such an option would show what the install was about to do, and why, but without actually harming the current system. We could then investigate deeper in a controlled, per-module, way to try to achieve convergence. -- : David Lee I.T. Service : : Senior Systems Programmer Computer Centre : : UNIX Team Leader Durham University : : South Road : : http://www.dur.ac.uk/t.d.lee/ Durham DH1 3LE : : Phone: +44 191 334 2752 U.K. : From maxsec at gmail.com Thu Apr 30 10:26:22 2009 From: maxsec at gmail.com (Martin Hepworth) Date: Thu Apr 30 10:26:31 2009 Subject: MailScanner slowwing down In-Reply-To: <045c01c9c970$75545130$5ffcf390$@ie> References: <045c01c9c970$75545130$5ffcf390$@ie> Message-ID: <72cf361e0904300226y78c8dbf0v8aa6c2b16e3b1d79@mail.gmail.com> See http://wiki.mailscanner.info/doku.php?id=maq:index#optimization_tips and http://wiki.mailscanner.info/doku.php?id=maq:index#getting_the_best_out_of_spamassassin Dropping unknown recipients and having a local caching nameserver are generally the first things to sort, then look at the number of children and batch size... -- Martin Hepworth Oxford, UK 2009/4/30 Mail Admin > Hi All, > > > > Recently I am finding that the amount of incoming mail through my > MailScanner Server is really slowing down things. There is a heavy load > now since I took on a domain that seems to me well spammed. Yesterdays > processing processed 22,000 emails @88% Spam approx. > > Server Spec POWEREDGE 1850 XEON 2.8GHZ/2MB 800FSB ? WITH 2 GIG RAM and RAID > 1 Configuration on two Disks RPM 10K? Its Running Fedora Core 5, Send Mail > 8.13.8-1.fc5 with MailScanner 4.69.7-1 with SA, Razor, DCC., MailWatch V1 > > Its working very well blocking spam, but only in the last couple of days > its got really slow. > > Any ideas on how to reduce the load on this server>? By blocking mail at > the MTA before it hits MS? OR Tweaking my processes? > > What do the Experts think on the Server Spec, for the amount of traffic? > > I?d appreciate any help > > > > Regards > > Kevin > > > > This e-mail is intended solely for the addressee(s) and is strictly > confidential. The unauthorised use, disclosure or copying of this e-mail, or > any information it contains is prohibited. If you have received this e-mail > in error, please notify us immediately and then permanently delete it. > Although we make every effort to keep our systems free from viruses, you > should check this e-mail and any attachments to it for viruses as we cannot > accept any liability for viruses inadvertently transmitted by use. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090430/702f6fb8/attachment.html From maillists at conactive.com Thu Apr 30 10:31:39 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Thu Apr 30 10:31:50 2009 Subject: Startup errors after major upgrade In-Reply-To: <49F8F906.4000305@whidbey.com> References: <49F7C40D.5080008@whidbey.com> <49F80F3F.5090502@ecs.soton.ac.uk> <49F8C260.1030502@whidbey.com> <49F8F906.4000305@whidbey.com> Message-ID: G. Armour Van Horn wrote on Wed, 29 Apr 2009 18:04:06 -0700: > Well, no, as it specifically banned spaces, periods, and underscores, > but was complaining about parentheses, I somehow hadn't thought to try > hyphens. Well, they are in that very string ;-) > As it happens, I actually don't need anything more than the org-name at > the moment, because only one of my three servers is running MailScanner. > Over the last ten years, that hasn't normally been the pattern, and I > can't imagine that I'll stay with only three servers, only one of which > runs MailScanner, for all that long. If I have to dig a file out of the > quarantine for a client I would just as soon start digging on the right > server. org-name does not have to be the orgname. You can just set it to Vanguard1, Vanguard2 etc. Much easier to set one variable than to tweak this variable and that variable by hand ... Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Thu Apr 30 10:31:39 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Thu Apr 30 10:31:51 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> <4A09477D575C2C4B86497161427DD94C0D153E2A77@city-exchange07> Message-ID: Anthony Cartmell wrote on Thu, 30 Apr 2009 09:09:23 +0100: > Opera is quite happy with two signature separators in a message, it simply > treats the first one as the start of the signature: all text after it is > in grey. Further signature separator lines are simply treated as part of > the signature text. Yes, that's expected. We were not talking about signature detection for display, but for quoting. When you quote, does it remove *both* signatures? Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From ajcartmell at fonant.com Thu Apr 30 11:14:35 2009 From: ajcartmell at fonant.com (Anthony Cartmell) Date: Thu Apr 30 11:14:44 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> <4A09477D575C2C4B86497161427DD94C0D153E2A77@city-exchange07> Message-ID: > Yes, that's expected. We were not talking about signature detection for > display, but for quoting. When you quote, does it remove *both* > signatures? Yes. I can't think of any reason why the definition of signature lines for quoting be differently to that for display. Other than buggy code ;) HTH, Anthony -- www.fonant.com - Quality web sites From mailadmin at midland-ics.ie Thu Apr 30 11:50:24 2009 From: mailadmin at midland-ics.ie (Mail Admin) Date: Thu Apr 30 12:10:35 2009 Subject: MailScanner slowwing down In-Reply-To: <72cf361e0904300226y78c8dbf0v8aa6c2b16e3b1d79@mail.gmail.com> References: <045c01c9c970$75545130$5ffcf390$@ie> <72cf361e0904300226y78c8dbf0v8aa6c2b16e3b1d79@mail.gmail.com> Message-ID: <047301c9c981$7805cce0$681166a0$@ie> The unknown recipients would solve a lot of the problems. I'm not sure if I can get my head around this though. The Server has some local domains with pop3 and the big domains I relay on to their Exchange Server. I'd love to put all the valid exchange users in a file and allow the system to only accept for thes valid addresses, but is there an easy way? So my exchange domains I lookup a file of addresses and other local I use the access file? Thanks From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Martin Hepworth Sent: 30 April 2009 10:26 To: MailScanner discussion Subject: Re: MailScanner slowwing down See http://wiki.mailscanner.info/doku.php?id=maq:index#optimization_tips and http://wiki.mailscanner.info/doku.php?id=maq:index#getting_the_best_out_of_s pamassassin Dropping unknown recipients and having a local caching nameserver are generally the first things to sort, then look at the number of children and batch size... -- Martin Hepworth Oxford, UK 2009/4/30 Mail Admin Hi All, Recently I am finding that the amount of incoming mail through my MailScanner Server is really slowing down things. There is a heavy load now since I took on a domain that seems to me well spammed. Yesterdays processing processed 22,000 emails @88% Spam approx. Server Spec POWEREDGE 1850 XEON 2.8GHZ/2MB 800FSB - WITH 2 GIG RAM and RAID 1 Configuration on two Disks RPM 10K. Its Running Fedora Core 5, Send Mail 8.13.8-1.fc5 with MailScanner 4.69.7-1 with SA, Razor, DCC., MailWatch V1 Its working very well blocking spam, but only in the last couple of days its got really slow. Any ideas on how to reduce the load on this server>? By blocking mail at the MTA before it hits MS? OR Tweaking my processes? What do the Experts think on the Server Spec, for the amount of traffic? I'd appreciate any help Regards Kevin This e-mail is intended solely for the addressee(s) and is strictly confidential. The unauthorised use, disclosure or copying of this e-mail, or any information it contains is prohibited. If you have received this e-mail in error, please notify us immediately and then permanently delete it. Although we make every effort to keep our systems free from viruses, you should check this e-mail and any attachments to it for viruses as we cannot accept any liability for viruses inadvertently transmitted by use. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. This e-mail is intended solely for the addressee(s) and is strictly confidential. The unauthorised use, disclosure or copying of this e-mail, or any information it contains is prohibited. If you have received this e-mail in error, please notify us immediately and then permanently delete it. Although Midland Internet & Computer Solutions make every effort to keep our systems free from viruses you should check this e-mail and any attachments to it for viruses as we cannot accept any liability for viruses inadvertently transmitted by use. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090430/4fac8e33/attachment.html From maxsec at gmail.com Thu Apr 30 12:27:24 2009 From: maxsec at gmail.com (Martin Hepworth) Date: Thu Apr 30 12:27:33 2009 Subject: MailScanner slowwing down In-Reply-To: <047301c9c981$7805cce0$681166a0$@ie> References: <045c01c9c970$75545130$5ffcf390$@ie> <72cf361e0904300226y78c8dbf0v8aa6c2b16e3b1d79@mail.gmail.com> <047301c9c981$7805cce0$681166a0$@ie> Message-ID: <72cf361e0904300427t47ab1106nc22e6a08c40b4f01@mail.gmail.com> Hi you need to do a lookup on each address rather than keeping it a file you have to maintain - smf-sav can do this quite easily although it's main purpose it to check senders it can also check recipients http://smfs.sourceforge.net/smf-sav.html -- Martin Hepworth Oxford, UK 2009/4/30 Mail Admin > The unknown recipients would solve a lot of the problems. > > I?m not sure if I can get my head around this though. > > The Server has some local domains with pop3 and the big domains I relay on > to their Exchange Server. > > I?d love to put all the valid exchange users in a file and allow the system > to only accept for thes valid addresses, but is there an easy way? So my > exchange domains I lookup a file of addresses and other local I use the > access file? > > Thanks > > > > *From:* mailscanner-bounces@lists.mailscanner.info [mailto: > mailscanner-bounces@lists.mailscanner.info] *On Behalf Of *Martin Hepworth > *Sent:* 30 April 2009 10:26 > *To:* MailScanner discussion > *Subject:* Re: MailScanner slowwing down > > > > See > > > > http://wiki.mailscanner.info/doku.php?id=maq:index#optimization_tips > > > > and > > > > > http://wiki.mailscanner.info/doku.php?id=maq:index#getting_the_best_out_of_spamassassin > > > > Dropping unknown recipients and having a local caching nameserver are > generally the first things to sort, then look at the number of children and > batch size... > > > > -- > Martin Hepworth > Oxford, UK > > 2009/4/30 Mail Admin > > Hi All, > > > > Recently I am finding that the amount of incoming mail through my > MailScanner Server is really slowing down things. There is a heavy load > now since I took on a domain that seems to me well spammed. Yesterdays > processing processed 22,000 emails @88% Spam approx. > > Server Spec POWEREDGE 1850 XEON 2.8GHZ/2MB 800FSB ? WITH 2 GIG RAM and RAID > 1 Configuration on two Disks RPM 10K? Its Running Fedora Core 5, Send Mail > 8.13.8-1.fc5 with MailScanner 4.69.7-1 with SA, Razor, DCC., MailWatch V1 > > Its working very well blocking spam, but only in the last couple of days > its got really slow. > > Any ideas on how to reduce the load on this server>? By blocking mail at > the MTA before it hits MS? OR Tweaking my processes? > > What do the Experts think on the Server Spec, for the amount of traffic? > > I?d appreciate any help > > > > Regards > > Kevin > > > > This e-mail is intended solely for the addressee(s) and is strictly > confidential. The unauthorised use, disclosure or copying of this e-mail, or > any information it contains is prohibited. If you have received this e-mail > in error, please notify us immediately and then permanently delete it. > Although we make every effort to keep our systems free from viruses, you > should check this e-mail and any attachments to it for viruses as we cannot > accept any liability for viruses inadvertently transmitted by use. > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > This message has been scanned for viruses and dangerous content by * > MailScanner* , and is believed to be clean. > > This e-mail is intended solely for the addressee(s) and is strictly > confidential. The unauthorised use, disclosure or copying of this e-mail, or > any information it contains is prohibited. If you have received this e-mail > in error, please notify us immediately and then permanently delete it. > Although we make every effort to keep our systems free from viruses, you > should check this e-mail and any attachments to it for viruses as we cannot > accept any liability for viruses inadvertently transmitted by use. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090430/ed6a1e57/attachment.html From maillists at conactive.com Thu Apr 30 12:31:22 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Thu Apr 30 12:31:35 2009 Subject: MailScanner slowwing down In-Reply-To: <045c01c9c970$75545130$5ffcf390$@ie> References: <045c01c9c970$75545130$5ffcf390$@ie> Message-ID: Mail Admin wrote on Thu, 30 Apr 2009 09:48:38 +0100: > Recently I am finding that the amount of incoming mail through my > MailScanner Server is really slowing down things. There is a heavy load > now since I took on a domain that seems to me well spammed. Yesterdays > processing processed 22,000 emails @88% Spam approx. then reject more mail at MTA level. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Thu Apr 30 12:31:22 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Thu Apr 30 12:31:36 2009 Subject: install: a debug-like "I would but I won't" option? In-Reply-To: References: Message-ID: David Lee wrote on Thu, 30 Apr 2009 10:18:37 +0100 (BST): > I've got a vague recollection that this might have been raised before, yep, by me. A --test switch similar to what rpm has. I indeed think this would be helpful. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Thu Apr 30 12:31:21 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Thu Apr 30 12:31:37 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> <4A09477D575C2C4B86497161427DD94C0D153E2A77@city-exchange07> Message-ID: Anthony Cartmell wrote on Thu, 30 Apr 2009 11:14:35 +0100: > Yes. > > I can't think of any reason why the definition of signature lines for > quoting be differently to that for display. Other than buggy code ;) For display you might detect every signature marker and do what is supposed to do about signatures. That comes in the normal course of parsing the raw text and building a message display. What you do at quoting time is completely different. And then you may indeed go up from the bottom until you detect it. Is much faster then to go higher as normally there should be only one ... Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From ajcartmell at fonant.com Thu Apr 30 14:29:15 2009 From: ajcartmell at fonant.com (Anthony Cartmell) Date: Thu Apr 30 14:29:23 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> <4A09477D575C2C4B86497161427DD94C0D153E2A77@city-exchange07> Message-ID: > What you do at quoting time is completely different. And then you may > indeed go up from the bottom until you detect it. Is much faster then to > go higher as normally there should be only one ... But then you have the odd situation that a line might be treated as a signature for display, but not when quoting. Which sounds like an inconsistency bug to me - a line can't be a signature line and not a signature line at the same time. Cheers! Anthony -- www.fonant.com - Quality web sites From alex at rtpty.com Thu Apr 30 14:47:30 2009 From: alex at rtpty.com (Alex Neuman) Date: Thu Apr 30 14:47:41 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> <4A09477D575C2C4B86497161427DD94C0D153E2A77@city-exchange07> Message-ID: <24e3d2e40904300647of7d6582m675f88823e7b7ca8@mail.gmail.com> Just my 2p worth... It's admirable that all of you guys are working on solving - as if it were a problem - what amounts to broken clients and lazy users. I hope I don't have to wear the asbestos suit again - I just wanted to acknowledge what is probably a thankless job on your part! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090430/e9bdc824/attachment.html From maillists at conactive.com Thu Apr 30 15:31:31 2009 From: maillists at conactive.com (Kai Schaetzl) Date: Thu Apr 30 15:31:43 2009 Subject: Preventing multiple signatures in email conversation? In-Reply-To: References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> <43F62CA225017044BC84CFAF92B4333B06F530@sbsserver.Techquility.net> <49F5E59F.10104@ecs.soton.ac.uk> <43F62CA225017044BC84CFAF92B4333B06F533@sbsserver.Techquility.net> <49F5FBCE.8080506@ecs.soton.ac.uk> <43F62CA225017044BC84CFAF92B4333B06F53D@sbsserver.Techquility.net> <49F744AB.3060306@ecs.soton.ac.uk> <49F78F65.1070502@ecs.soton.ac.uk> Message-ID: Anthony Cartmell wrote on Thu, 30 Apr 2009 09:18:27 +0100: > In fact you could probably use > or
> too, although that is possibly slightly more likely to break the rendering > in some clients. yes. Your solution might indeed break less. ;-) Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com From mailadmin at midland-ics.ie Thu Apr 30 15:28:38 2009 From: mailadmin at midland-ics.ie (Mail Admin) Date: Thu Apr 30 15:36:25 2009 Subject: MailScanner slowwing down In-Reply-To: <72cf361e0904300427t47ab1106nc22e6a08c40b4f01@mail.gmail.com> References: <045c01c9c970$75545130$5ffcf390$@ie> <72cf361e0904300226y78c8dbf0v8aa6c2b16e3b1d79@mail.gmail.com> <047301c9c981$7805cce0$681166a0$@ie> <72cf361e0904300427t47ab1106nc22e6a08c40b4f01@mail.gmail.com> Message-ID: <056901c9c99f$f49a5d70$ddcf1850$@ie> Martin, sorry for bothering you, but is there a description on how smf-sav actually works. How does it check the recipient of my domains? Does it know somehow how to get to the exchange server for each domain>? I cant find any descriptions on the workings? Thanks a lot From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Martin Hepworth Sent: 30 April 2009 12:27 To: MailScanner discussion Subject: Re: MailScanner slowwing down Hi you need to do a lookup on each address rather than keeping it a file you have to maintain - smf-sav can do this quite easily although it's main purpose it to check senders it can also check recipients http://smfs.sourceforge.net/smf-sav.html -- Martin Hepworth Oxford, UK 2009/4/30 Mail Admin The unknown recipients would solve a lot of the problems. I'm not sure if I can get my head around this though. The Server has some local domains with pop3 and the big domains I relay on to their Exchange Server. I'd love to put all the valid exchange users in a file and allow the system to only accept for thes valid addresses, but is there an easy way? So my exchange domains I lookup a file of addresses and other local I use the access file? Thanks From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Martin Hepworth Sent: 30 April 2009 10:26 To: MailScanner discussion Subject: Re: MailScanner slowwing down See http://wiki.mailscanner.info/doku.php?id=maq:index#optimization_tips and http://wiki.mailscanner.info/doku.php?id=maq:index#getting_the_best_out_of_s pamassassin Dropping unknown recipients and having a local caching nameserver are generally the first things to sort, then look at the number of children and batch size... -- Martin Hepworth Oxford, UK 2009/4/30 Mail Admin Hi All, Recently I am finding that the amount of incoming mail through my MailScanner Server is really slowing down things. There is a heavy load now since I took on a domain that seems to me well spammed. Yesterdays processing processed 22,000 emails @88% Spam approx. Server Spec POWEREDGE 1850 XEON 2.8GHZ/2MB 800FSB - WITH 2 GIG RAM and RAID 1 Configuration on two Disks RPM 10K. Its Running Fedora Core 5, Send Mail 8.13.8-1.fc5 with MailScanner 4.69.7-1 with SA, Razor, DCC., MailWatch V1 Its working very well blocking spam, but only in the last couple of days its got really slow. Any ideas on how to reduce the load on this server>? By blocking mail at the MTA before it hits MS? OR Tweaking my processes? What do the Experts think on the Server Spec, for the amount of traffic? I'd appreciate any help Regards Kevin This e-mail is intended solely for the addressee(s) and is strictly confidential. The unauthorised use, disclosure or copying of this e-mail, or any information it contains is prohibited. If you have received this e-mail in error, please notify us immediately and then permanently delete it. Although we make every effort to keep our systems free from viruses, you should check this e-mail and any attachments to it for viruses as we cannot accept any liability for viruses inadvertently transmitted by use. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. This e-mail is intended solely for the addressee(s) and is strictly confidential. The unauthorised use, disclosure or copying of this e-mail, or any information it contains is prohibited. If you have received this e-mail in error, please notify us immediately and then permanently delete it. Although we make every effort to keep our systems free from viruses, you should check this e-mail and any attachments to it for viruses as we cannot accept any liability for viruses inadvertently transmitted by use. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. This e-mail is intended solely for the addressee(s) and is strictly confidential. The unauthorised use, disclosure or copying of this e-mail, or any information it contains is prohibited. If you have received this e-mail in error, please notify us immediately and then permanently delete it. Although Midland Internet & Computer Solutions make every effort to keep our systems free from viruses you should check this e-mail and any attachments to it for viruses as we cannot accept any liability for viruses inadvertently transmitted by use. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090430/08afbd56/attachment.html From rpoe at plattesheriff.org Thu Apr 30 16:25:27 2009 From: rpoe at plattesheriff.org (Rob Poe) Date: Thu Apr 30 16:25:50 2009 Subject: Signatures... In-Reply-To: <1213490F1F316842A544A850422BFA96239CFE81@BHLSBS.bhl.local> References: <1213490F1F316842A544A850422BFA96239CFDB6@BHLSBS.bhl.local> <49F05017.9010707@ecs.soton.ac.uk> <1213490F1F316842A544A850422BFA96239CFE45@BHLSBS.bhl.local> <1213490F1F316842A544A850422BFA96239CFE81@BHLSBS.bhl.local> Message-ID: <49F97C97020000A20000CD0B@platteco-2.plattesheriff.org> I usually do something like mv MailScanner.conf MailScanner.conf.old upgrade_MailScanner_Conf MailScanner.conf.old MailScanner.conf.rpmnew > MailScanner.conf ;) >>> On 4/25/2009 at 1:41 AM, in message <1213490F1F316842A544A850422BFA96239CFE81@BHLSBS.bhl.local>, Jason Ede wrote: > I'd run it, just not moved the new config into place. Ooops! > Even once that is sorted a --lint and the startup is still significantly > slower then the 4.75 for some reason. > >> -----Original Message----- >> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- >> bounces@lists.mailscanner.info] On Behalf Of Kai Schaetzl >> Sent: 24 April 2009 21:31 >> To: mailscanner@lists.mailscanner.info >> Subject: Re: Signatures... >> >> Jason Ede wrote on Fri, 24 Apr 2009 12:18:01 +0100: >> >> > Version installed (4.76.17) does not match version stated in >> > MailScanner.conf file (4.75.11), you may want to run >> upgrade_MailScanner_conf >> > to ensure your MailScanner.conf file contains all the latest >> settings. >> >> >> >> Kai >> >> -- >> Kai Sch?tzl, Berlin, Germany >> Get your web at Conactive Internet Services: http://www.conactive.com >> >> >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Apr 30 16:38:12 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Apr 30 16:38:31 2009 Subject: Preventing multiple signatures in email conversation? In-Reply-To: References: <43F62CA225017044BC84CFAF92B4333B06F530@sbsserver.Techquility.net> <49F5E59F.10104@ecs.soton.ac.uk> <43F62CA225017044BC84CFAF92B4333B06F533@sbsserver.Techquility.net> <49F5FBCE.8080506@ecs.soton.ac.uk> <43F62CA225017044BC84CFAF92B4333B06F53D@sbsserver.Techquility.net> <49F744AB.3060306@ecs.soton.ac.uk> <49F78F65.1070502@ecs.soton.ac.uk> <49F9C5E4.1070200@ecs.soton.ac.uk> Message-ID: On 30/04/2009 15:31, Kai Schaetzl wrote: > Anthony Cartmell wrote on Thu, 30 Apr 2009 09:18:27 +0100: > > >> In fact you could probably use >> or
>> too, although that is possibly slightly more likely to break the rendering >> in some clients. >> > yes. Your solution might indeed break less. ;-) > > Okay, I will go with that. But it's going to be in the next beta, not in tomorrow's stable release. Sorry guys, but too late to change the code now. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! Need help fixing or optimising your systems? Contact me! Need help getting you started solving new requirements from your boss? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 Follow me at twitter.com/JulesFM and twitter.com/MailScanner -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From Kevin_Miller at ci.juneau.ak.us Thu Apr 30 17:28:03 2009 From: Kevin_Miller at ci.juneau.ak.us (Kevin Miller) Date: Thu Apr 30 17:28:18 2009 Subject: MailScanner slowwing down In-Reply-To: <056901c9c99f$f49a5d70$ddcf1850$@ie> References: <045c01c9c970$75545130$5ffcf390$@ie> <72cf361e0904300226y78c8dbf0v8aa6c2b16e3b1d79@mail.gmail.com> <047301c9c981$7805cce0$681166a0$@ie> <72cf361e0904300427t47ab1106nc22e6a08c40b4f01@mail.gmail.com> <056901c9c99f$f49a5d70$ddcf1850$@ie> Message-ID: <4A09477D575C2C4B86497161427DD94C0D153E2A9C@city-exchange07> When you install smf-sav, there's a config file you'll need to edit slightly. You specify your Exchange server, and it will query it. The conf file is also where you can white/blacklist specific addresses, domains, etc. It is fairly efficient, as it caches the results so that it's not asking the Exchange server about every message. I think the TTL is 3 hours, but it can be changed as well. Another good milter to add is smf-spf. Grey-listing and greet-pause are also very effective in reducing inbound noise. HTH... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 ________________________________ From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Mail Admin Sent: Thursday, April 30, 2009 6:29 AM To: 'MailScanner discussion' Subject: RE: MailScanner slowwing down Martin, sorry for bothering you, but is there a description on how smf-sav actually works. How does it check the recipient of my domains? Does it know somehow how to get to the exchange server for each domain>? I cant find any descriptions on the workings? Thanks a lot From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Martin Hepworth Sent: 30 April 2009 12:27 To: MailScanner discussion Subject: Re: MailScanner slowwing down Hi you need to do a lookup on each address rather than keeping it a file you have to maintain - smf-sav can do this quite easily although it's main purpose it to check senders it can also check recipients http://smfs.sourceforge.net/smf-sav.html -- Martin Hepworth Oxford, UK 2009/4/30 Mail Admin > The unknown recipients would solve a lot of the problems. I'm not sure if I can get my head around this though. The Server has some local domains with pop3 and the big domains I relay on to their Exchange Server. I'd love to put all the valid exchange users in a file and allow the system to only accept for thes valid addresses, but is there an easy way? So my exchange domains I lookup a file of addresses and other local I use the access file? Thanks From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Martin Hepworth Sent: 30 April 2009 10:26 To: MailScanner discussion Subject: Re: MailScanner slowwing down See http://wiki.mailscanner.info/doku.php?id=maq:index#optimization_tips and http://wiki.mailscanner.info/doku.php?id=maq:index#getting_the_best_out_of_spamassassin Dropping unknown recipients and having a local caching nameserver are generally the first things to sort, then look at the number of children and batch size... -- Martin Hepworth Oxford, UK 2009/4/30 Mail Admin > Hi All, Recently I am finding that the amount of incoming mail through my MailScanner Server is really slowing down things. There is a heavy load now since I took on a domain that seems to me well spammed. Yesterdays processing processed 22,000 emails @88% Spam approx. Server Spec POWEREDGE 1850 XEON 2.8GHZ/2MB 800FSB - WITH 2 GIG RAM and RAID 1 Configuration on two Disks RPM 10K... Its Running Fedora Core 5, Send Mail 8.13.8-1.fc5 with MailScanner 4.69.7-1 with SA, Razor, DCC., MailWatch V1 Its working very well blocking spam, but only in the last couple of days its got really slow. Any ideas on how to reduce the load on this server>? By blocking mail at the MTA before it hits MS? OR Tweaking my processes? What do the Experts think on the Server Spec, for the amount of traffic? I'd appreciate any help Regards Kevin This e-mail is intended solely for the addressee(s) and is strictly confidential. The unauthorised use, disclosure or copying of this e-mail, or any information it contains is prohibited. If you have received this e-mail in error, please notify us immediately and then permanently delete it. Although we make every effort to keep our systems free from viruses, you should check this e-mail and any attachments to it for viruses as we cannot accept any liability for viruses inadvertently transmitted by use. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. This e-mail is intended solely for the addressee(s) and is strictly confidential. The unauthorised use, disclosure or copying of this e-mail, or any information it contains is prohibited. If you have received this e-mail in error, please notify us immediately and then permanently delete it. Although we make every effort to keep our systems free from viruses, you should check this e-mail and any attachments to it for viruses as we cannot accept any liability for viruses inadvertently transmitted by use. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. This e-mail is intended solely for the addressee(s) and is strictly confidential. The unauthorised use, disclosure or copying of this e-mail, or any information it contains is prohibited. If you have received this e-mail in error, please notify us immediately and then permanently delete it. Although we make every effort to keep our systems free from viruses, you should check this e-mail and any attachments to it for viruses as we cannot accept any liability for viruses inadvertently transmitted by use. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090430/6f210a02/attachment.html From Kevin_Miller at ci.juneau.ak.us Thu Apr 30 18:24:24 2009 From: Kevin_Miller at ci.juneau.ak.us (Kevin Miller) Date: Thu Apr 30 18:24:38 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> <4A09477D575C2C4B86497161427DD94C0D153E2A77@city-exchange07> Message-ID: <4A09477D575C2C4B86497161427DD94C0D153E2A9E@city-exchange07> Anthony Cartmell wrote: >>> Interestingly, the MailScanner footer is preceeded by dash dash >>> space and doesn't appear in the reply. You're signature just has >>> dashes but I presume it originally had a space following. > > Kai's message appears correctly in Opera, his signature is recognised > and is displayed in grey rather than black. Interesting. Never knew Opera did email - always figured it was just a browser. I just subscribed my home email account to see how Thunderbird displays. I expect it will be similar to Opera. I've noticed that behavior before in it. Probably because Outlook is written to top post, it makes signature handling much harder. If I have a signature after my contribution at the top, the conversation below it would disappear. >> Right. >> >> So where is that >>> getting stripped? Do email clients parse from the bottom up until >>> they see the last instance of dash dash space and then change any >>> others to just dual dashes? >> >> Yes, it looks like that. My client is doing the same. I thought it's >> the QP, but it's the duplicate signature marker. >> No message should have two signature seperators. I would have already >> complained with Julian, if I had a better solution ;-) > > Opera is quite happy with two signature separators in a message, it > simply treats the first one as the start of the signature: all text > after it is in grey. Further signature separator lines are simply > treated as part of the signature text. In replying to your message, the MS signature was stripped, but as you can see below, Outlook ignored yours. Again, this is probably an outgrowth of it's propensity for top-posting. Yet another reason not to. I don't think this is something Julian can/should fix. It seems to me that it's dumb decisions on Microsoft's part (and probably other clients as well) that cause the issue. AFAIC, if I use a broken client, I should make the effort to clean up the posts. Unfortunately, at work, I'm stuck w/a broken client. Sigh. > This has a slight downside that if a dash-dash-space line appears in > a digest email then all the following messages are treated as > signature text, and shown in grey. Perhaps other mail clients work > backwards from the end of the message to find the signature separator > they are going to use, to avoid this particular problem? That would make sense. And, as Kai notes, it's much faster to parse from the bottom up. > Perhaps in an ideal world the signature would be a separate MIME part > in the message, so we wouldn't need to resort to text parsing tricks > to identify it... > > Anthony > -- > www.fonant.com - Quality web sites No, in an ideal world Outlook would be rewritten to behave in a rational way. I'm not holding my breath. ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 From kkobb at skylinecorp.com Thu Apr 30 18:47:16 2009 From: kkobb at skylinecorp.com (Kevin Kobb) Date: Thu Apr 30 18:47:43 2009 Subject: FreeBSD port of MailScanner-4.75.11,1 - could someone test In-Reply-To: <57200BF94E69E54880C9BB1AF714BBCB5DE7CA@w2003s01.double-l.local> References: <57200BF94E69E54880C9BB1AF714BBCB5DE7CA@w2003s01.double-l.local> Message-ID: Johan Hendriks wrote: > I created a port for MailScanner-4.75.11,1 on FreeBSD. > My programming skills are poor, but it al seems to work on my 7.1-stable > and 8.0 machine (both AMD64) > This is with perl 5.10.x , it does not work with perl-5.8.9 > > So please test it and let me know if it al works. > > > > You can download the file here. > > http://www.double-l.nl/mailscanner.tar > > > > regards, > > Johan Hendriks > > > For better or worse, the official FreeBSD port has been updated to 4.75.11. I had submitted a patch to an open PR and to the port maintainer several weeks ago, but never got any feedback. It looks like the update was automatically committed. I don't claim to be a ports, or MailScanner expert, but I gave it the old college try. Hopefully, this will work for others (seems to be OK on my tests), or motivate some guru to fix my feeble effort ;-) From ajcartmell at fonant.com Thu Apr 30 20:16:20 2009 From: ajcartmell at fonant.com (Anthony Cartmell) Date: Thu Apr 30 20:16:28 2009 Subject: Preventing multiple signatures in email conversation? In-Reply-To: References: <43F62CA225017044BC84CFAF92B4333B06F530@sbsserver.Techquility.net> <49F5E59F.10104@ecs.soton.ac.uk> <43F62CA225017044BC84CFAF92B4333B06F533@sbsserver.Techquility.net> <49F5FBCE.8080506@ecs.soton.ac.uk> <43F62CA225017044BC84CFAF92B4333B06F53D@sbsserver.Techquility.net> <49F744AB.3060306@ecs.soton.ac.uk> <49F78F65.1070502@ecs.soton.ac.uk> <49F9C5E4.1070200@ecs.soton.ac! .uk> Message-ID: > Okay, I will go with that. But it's going to be in the next beta, not in > tomorrow's stable release. Sorry guys, but too late to change the code > now. I think the one is most likely to be ignored by mail clients. The
and options might affect display a little. Anthony -- www.fonant.com - Quality web sites From MailScanner at ecs.soton.ac.uk Thu Apr 30 20:42:28 2009 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Apr 30 20:42:53 2009 Subject: Preventing multiple signatures in email conversation? In-Reply-To: References: <43F62CA225017044BC84CFAF92B4333B06F533@sbsserver.Techquility.net> <49F5FBCE.8080506@ecs.soton.ac.uk> <43F62CA225017044BC84CFAF92B4333B06F53D@sbsserver.Techquility.net> <49F744AB.3060306@ecs.soton.ac.uk> <49F78F65.1070502@ecs.soton.ac.uk> <49F9C5E4.1070200@ecs.soton.ac! .uk> <49F9FF24.4090501@ecs.soton.ac.uk> Message-ID: On 30/04/2009 20:16, Anthony Cartmell wrote: >> Okay, I will go with that. But it's going to be in the next beta, not >> in tomorrow's stable release. Sorry guys, but too late to change the >> code now. > > I think the one is most likely to be ignored by > mail clients. The
and options might affect display a little. That would be easier for me to implement, and a lot faster, as I already process tags anyway. Do you want to let me know when you've all agreed what it should be? Tell me what I should look for, and what I should do when I find it. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store MailScanner customisation, or any advanced system administration help? Contact me at Jules@Jules.FM PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 PGP public key: http://www.jules.fm/julesfm.asc Follow me at twitter.com/JulesFM -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From vanhorn at whidbey.com Thu Apr 30 21:59:51 2009 From: vanhorn at whidbey.com (G. Armour Van Horn) Date: Thu Apr 30 22:00:03 2009 Subject: MailScanner slowwing down In-Reply-To: <72cf361e0904300226y78c8dbf0v8aa6c2b16e3b1d79@mail.gmail.com> References: <045c01c9c970$75545130$5ffcf390$@ie> <72cf361e0904300226y78c8dbf0v8aa6c2b16e3b1d79@mail.gmail.com> Message-ID: <49FA1147.7060101@whidbey.com> I was looking at those yesterday because I was running the load average up to 10 or 12 in spurts. My box has a Sempron 2200 and a gig of RAM, so it does swap when it gets busy. I can upgrade to a machine that's half again faster with twice the memory for the same monthly fee, but I'd have to run both during the transition and it would take a ton of time to move everything over. (It's a webserver for a couple of dozen domains and my secondary name server.) I told Sendmail to stop accepting connections at load average of 6, which kept the load average from trying to get to 50. (Yes, I have seen the la go that high, although not on this system. It ain't pretty!) I dropped the child count from five to three, which seemed to help - each child just took bigger bites and the throughput didn't seem to be affected. One thing that looked appealing was setting up a caching nameserver, but all the docs I ran into assumed that you weren't already running BIND on the box and that you wanted to cache your local network, so I was too confused to get that running. (I do have everything installed, just need to figure out the config.) I did add pause-greet to the Sendmail config, it blocked at least a hundred messages overnight. Not a big change, but the price is right. I'm thinking about setting up greylisting, it will cut down on the MS load and should spread out the surges a little. I guess I should have expected things to slow down when I leapfrogged so many versions on Tuesday. Now I've got to figure out how to get it back in control or bite the bullet and get some more horsepower. Van Martin Hepworth wrote: > See > > http://wiki.mailscanner.info/doku.php?id=maq:index#optimization_tips > > and > > http://wiki.mailscanner.info/doku.php?id=maq:index#getting_the_best_out_of_spamassassin > > Dropping unknown recipients and having a local caching nameserver are > generally the first things to sort, then look at the number of > children and batch size... > > -- > Martin Hepworth > Oxford, UK > > 2009/4/30 Mail Admin > > > Hi All, > > > > Recently I am finding that the amount of incoming mail through my > MailScanner Server is really slowing down things. There is a > heavy load now since I took on a domain that seems to me well > spammed. Yesterdays processing processed 22,000 emails @88% Spam > approx. > > Server Spec POWEREDGE 1850 XEON 2.8GHZ/2MB 800FSB ? WITH 2 GIG RAM > and RAID 1 Configuration on two Disks RPM 10K? Its Running Fedora > Core 5, Send Mail 8.13.8-1.fc5 with MailScanner 4.69.7-1 with SA, > Razor, DCC., MailWatch V1 > > Its working very well blocking spam, but only in the last couple > of days its got really slow. > > Any ideas on how to reduce the load on this server>? By blocking > mail at the MTA before it hits MS? OR Tweaking my processes? > > What do the Experts think on the Server Spec, for the amount of > traffic? > > I?d appreciate any help > > > > Regards > > Kevin > > > > This e-mail is intended solely for the addressee(s) and is > strictly confidential. The unauthorised use, disclosure or copying > of this e-mail, or any information it contains is prohibited. If > you have received this e-mail in error, please notify us > immediately and then permanently delete it. Although we make every > effort to keep our systems free from viruses, you should check > this e-mail and any attachments to it for viruses as we cannot > accept any liability for viruses inadvertently transmitted by use. > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > > -- ---------------------------------------------------------- Sign up now for Quotes of the Day, a handful of quotations on a theme delivered every morning. Enlightenment! Daily, for free! mailto:twisted@whidbey.com?subject=Subscribe_QOTD For photography, web design, hosting, and maintenance, visit Van's home page: http://www.domainvanhorn.com/van/ ----------------------------------------------------------- -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090430/0cf24102/attachment.html From mailadmin at midland-ics.ie Thu Apr 30 22:26:58 2009 From: mailadmin at midland-ics.ie (Mail Administrator) Date: Thu Apr 30 22:19:05 2009 Subject: MailScanner slowwing down In-Reply-To: <4A09477D575C2C4B86497161427DD94C0D153E2A9C@city-exchange07> References: <045c01c9c970$75545130$5ffcf390$@ie> <72cf361e0904300226y78c8dbf0v8aa6c2b16e3b1d79@mail.gmail.com> <047301c9c981$7805cce0$681166a0$@ie> <72cf361e0904300427t47ab1106nc22e6a08c40b4f01@mail.gmail.com> <056901c9c99f$f49a5d70$ddcf1850$@ie> <4A09477D575C2C4B86497161427DD94C0D153E2A9C@city-exchange07> Message-ID: <19270.89.184.43.180.1241126818.squirrel@webmail.midland-ics.ie> > When you install smf-sav, there's a config file you'll need to edit > slightly. You specify your Exchange server, and it will query it. The > conf file is also where you can white/blacklist specific addresses, > domains, etc. It is fairly efficient, as it caches the results so that > it's not asking the Exchange server about every message. I think the TTL > is 3 hours, but it can be changed as well. > > Another good milter to add is smf-spf. Grey-listing and greet-pause are > also very effective in reducing inbound noise. > > HTH... > > ...Kevin > -- > Kevin Miller Registered Linux User No: 307357 > CBJ MIS Dept. Network Systems Admin., Mail Admin. > 155 South Seward Street ph: (907) 586-0242 > Juneau, Alaska 99801 fax: (907 586-4500 > > > > ________________________________ > From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Mail > Admin > Sent: Thursday, April 30, 2009 6:29 AM > To: 'MailScanner discussion' > Subject: RE: MailScanner slowwing down > > Martin, sorry for bothering you, but is there a description on how smf-sav > actually works. How does it check the recipient of my domains? Does it > know somehow how to get to the exchange server for each domain>? I cant > find any descriptions on the workings? > > Thanks a lot > > From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Martin > Hepworth > Sent: 30 April 2009 12:27 > To: MailScanner discussion > Subject: Re: MailScanner slowwing down > > Hi > > you need to do a lookup on each address rather than keeping it a file you > have to maintain - smf-sav can do this quite easily although it's main > purpose it to check senders it can also check recipients > > http://smfs.sourceforge.net/smf-sav.html > > -- > Martin Hepworth > Oxford, UK > > 2009/4/30 Mail Admin > > > > The unknown recipients would solve a lot of the problems. > > I'm not sure if I can get my head around this though. > > The Server has some local domains with pop3 and the big domains I relay on > to their Exchange Server. > > I'd love to put all the valid exchange users in a file and allow the > system to only accept for thes valid addresses, but is there an easy way? > So my exchange domains I lookup a file of addresses and other local I use > the access file? > > Thanks > > > > From: > mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] > On Behalf Of Martin Hepworth > Sent: 30 April 2009 10:26 > To: MailScanner discussion > Subject: Re: MailScanner slowwing down > > > > See > > > > http://wiki.mailscanner.info/doku.php?id=maq:index#optimization_tips > > > > and > > > > http://wiki.mailscanner.info/doku.php?id=maq:index#getting_the_best_out_of_spamassassin > > > > Dropping unknown recipients and having a local caching nameserver are > generally the first things to sort, then look at the number of children > and batch size... > > > > -- > Martin Hepworth > Oxford, UK > > 2009/4/30 Mail Admin > > > > Hi All, > > > > Recently I am finding that the amount of incoming mail through my > MailScanner Server is really slowing down things. There is a heavy load > now since I took on a domain that seems to me well spammed. Yesterdays > processing processed 22,000 emails @88% Spam approx. > > Server Spec POWEREDGE 1850 XEON 2.8GHZ/2MB 800FSB - WITH 2 GIG RAM and > RAID 1 Configuration on two Disks RPM 10K... Its Running Fedora Core 5, > Send Mail 8.13.8-1.fc5 with MailScanner 4.69.7-1 with SA, Razor, DCC., > MailWatch V1 > > Its working very well blocking spam, but only in the last couple of days > its got really slow. > > Any ideas on how to reduce the load on this server>? By blocking mail at > the MTA before it hits MS? OR Tweaking my processes? > > What do the Experts think on the Server Spec, for the amount of traffic? > > I'd appreciate any help > > > > Regards > > Kevin > > > > This e-mail is intended solely for the addressee(s) and is strictly > confidential. The unauthorised use, disclosure or copying of this e-mail, > or any information it contains is prohibited. If you have received this > e-mail in error, please notify us immediately and then permanently delete > it. Although we make every effort to keep our systems free from viruses, > you should check this e-mail and any attachments to it for viruses as we > cannot accept any liability for viruses inadvertently transmitted by use. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > This message has been scanned for viruses and dangerous content by > MailScanner, and is believed to be clean. > > This e-mail is intended solely for the addressee(s) and is strictly > confidential. The unauthorised use, disclosure or copying of this e-mail, > or any information it contains is prohibited. If you have received this > e-mail in error, please notify us immediately and then permanently delete > it. Although we make every effort to keep our systems free from viruses, > you should check this e-mail and any attachments to it for viruses as we > cannot accept any liability for viruses inadvertently transmitted by use. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > This message has been scanned for viruses and dangerous content by > MailScanner, and is believed to be clean. > > This e-mail is intended solely for the addressee(s) and is strictly > confidential. The unauthorised use, disclosure or copying of this e-mail, > or any information it contains is prohibited. If you have received this > e-mail in error, please notify us immediately and then permanently delete > it. Although we make every effort to keep our systems free from viruses, > you should check this e-mail and any attachments to it for viruses as we > cannot accept any liability for viruses inadvertently transmitted by use. > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > This e-mail is intended solely for the addressee(s) and is strictly confidential. The unauthorised use, disclosure or copying of this e-mail, or any information it contains is prohibited. If you have received this e-mail in error, please notify us immediately and then permanently delete it. Although Midland Internet & Computer Solutions make every effort to keep our systems free from viruses you should check this e-mail and any attachments to it for viruses as we cannot accept any liability for viruses inadvertently transmitted by use. From ssilva at sgvwater.com Thu Apr 30 23:03:22 2009 From: ssilva at sgvwater.com (Scott Silva) Date: Thu Apr 30 23:03:50 2009 Subject: Preventing multple signatures in email conversation? In-Reply-To: <4A09477D575C2C4B86497161427DD94C0D153E2A9E@city-exchange07> References: <4A09477D575C2C4B86497161427DD94C0D153E2A60@city-exchange07> <4A09477D575C2C4B86497161427DD94C0D153E2A77@city-exchange07> <4A09477D575C2C4B86497161427DD94C0D153E2A9E@city-exchange07> Message-ID: > > No, in an ideal world Outlook would be rewritten to behave in a rational way. > I'm not holding my breath. > > > ...Kevin In Microsoft's world, Outlook IS the way. Everybody else is broken and will be crushed or assimilated!.. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090430/860414d1/signature.bin