From m.anderlini at database.it Fri Oct 1 09:17:04 2010 From: m.anderlini at database.it (Marcello Anderlini) Date: Fri Oct 1 09:19:10 2010 Subject: [OT] how to debug spamassassin timeout Message-ID: Hello guys, I know this could be named the "one million dollar question" but someone could me please tells an easy and full way to debug my spamassassin getting killed by timeout ? I ran a spamassassin --lint -D and I get a very long file very obscure for me to understand I attach just the last two lines: ============== Sep 30 12:47:52.808 [13455] dbg: timing: total 58389 ms - init: 48281 (82.7%), parse: 9 (0.0%), extract_message_metadata: 15 (0.0%), get_uri_detail_list: 7 (0.0%), tests_pri_-1000: 376 (0.6%), compile_gen: 3777 (6.5%), compile_eval: 258 (0.4%), tests_pri_-950: 28 (0.0%), tests_pri_-900: 56 (0.1%), tests_pri_-400: 1241 (2.1%), check_bayes: 1035 (1.8%), tests_pri_0: 6026 (10.3%), tests_pri_500: 1995 (3.4%), tests_pri_900: 24 (0.0%), tests_pri_1000: 24 (0.0%) ============== Starting from this point where should I go to check what is slow ? Thanks to all and sorry for my worst english. cheers Dr. Marcello Anderlini m.anderlini@database.it --------------------------------------------- Database Informatica S.r.l. Microsoft Certified Partner Tel. +39059775070 Fax. +39059779545 http://www.database.it --------------------------------------------- -- Messaggio verificato dal servizio antivirus di Database Informatica From Rainer.Blaes at astrium.eads.net Fri Oct 1 11:22:01 2010 From: Rainer.Blaes at astrium.eads.net (Rainer Blaes) Date: Fri Oct 1 11:23:25 2010 Subject: Clamav + Mailscanner: Denial of Service Attack in message Message-ID: <4CA5B649.3010603@astrium.eads.net> Dear all, we are sending during the night some text based notifications to hundreds of users. When we enable virus scanning by Clamav 0.96 there are a lot of messages in the log saying Virus Scanning: Denial of Service attack in message From the list we learnt that this could be (is) a server's resource problem ie setting Virus Scanner Timeout to 600 and/or using clamdscan instead of clamscan in the wrapper script should solve our problem. This we will check in the night. Only to understand: Why does Mailscanner has this DOS Attack Protection for OUTGOING mails what's the reason for, for INCOMING mails it is obvious respectively is there a config parameter to stop scanning OUTGOING mails? Thanks for any hint! Rainer This email (including any attachments) may contain confidential and/or privileged information or information otherwise protected from disclosure. If you are not the intended recipient, please notify the sender immediately, do not copy this message or any attachments and do not use it for any purpose or disclose its content to any person, but delete this message and any attachments from your system. Astrium disclaims any and all liability if this email transmission was virus corrupted, altered or falsified. --------------------------------------------------------- Astrium GmbH Vorsitzender des Aufsichtsrates: Thomas Mueller - Geschaeftsfuehrung: Evert Dudok (Vorsitzender), Dr. Reinhold Lutz, Josef Stukenborg Sitz der Gesellschaft: Muenchen - Registergericht: Amtsgericht Muenchen, HRB Nr. 107 647 Weitere Informationen ueber EADS Astrium @ http://www.astrium.eads.net/ From hvdkooij at vanderkooij.org Fri Oct 1 11:26:31 2010 From: hvdkooij at vanderkooij.org (Hugo van der Kooij) Date: Fri Oct 1 11:32:17 2010 Subject: [OT] how to debug spamassassin timeout In-Reply-To: References: Message-ID: <4abc1b97df23f444349a5b22c38e02b0@127.0.0.1> On Fri, 1 Oct 2010 10:17:04 +0200, "Marcello Anderlini" wrote: > Sep 30 12:47:52.808 [13455] dbg: timing: total 58389 ms - init: 48281 > (82.7%), parse: 9 (0.0%), extract_message_metadata: 15 (0.0%), It takes 58.3 seconds to run. Of which 48.2 seconds is needed just to start spamassassin and load everything. I would definitly check if your system is not overloaded or just short of RAM. Hugo. -- hvdkooij@vanderkooij.org http://hugo.vanderkooij.org/ PGP/GPG? Use: http://hugo.vanderkooij.org/0x58F19981.asc From hvdkooij at vanderkooij.org Fri Oct 1 14:56:29 2010 From: hvdkooij at vanderkooij.org (Hugo van der Kooij) Date: Fri Oct 1 15:02:17 2010 Subject: AVG 8.5 support? Message-ID: <5ef8d9eba070609da7251fc979116dee@127.0.0.1> Hi Jules, AVG has brought us AVG v8.5 which you can download from http://free.avg.com/us-en/download.prd-alf It might be nice to add this to MailScanner in a future release. -- hvdkooij@vanderkooij.org http://hugo.vanderkooij.org/ PGP/GPG? Use: http://hugo.vanderkooij.org/0x58F19981.asc -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20101001/8767a278/attachment.html From alex at rtpty.com Fri Oct 1 15:10:14 2010 From: alex at rtpty.com (Alex Neuman) Date: Fri Oct 1 15:09:42 2010 Subject: AVG 8.5 support? In-Reply-To: <5ef8d9eba070609da7251fc979116dee@127.0.0.1> References: <5ef8d9eba070609da7251fc979116dee@127.0.0.1> Message-ID: <954634577-1285942168-cardhu_decombobulator_blackberry.rim.net-1620559316-@bda957.bisx.prod.on.blackberry> What's the deal with the free version of avg licensewise? Can it be used in a commercial environment? How about on a home server? -- Alex Neuman van der Hans Reliant Technologies +507 6781-9505 +507 832-6725 +1-440-253-9789 (USA) Recuerda visitar http://vidadigital.com.pa/ BB PIN 20EA17C5 Twitter: @AlexNeuman - @VidaDigitalTV http://facebook.com/vidadigital Skype: alexneuman -----Original Message----- From: Hugo van der Kooij Sender: mailscanner-bounces@lists.mailscanner.info Date: Fri, 01 Oct 2010 15:56:29 To: Reply-To: MailScanner discussion Subject: AVG 8.5 support? -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From hvdkooij at vanderkooij.org Fri Oct 1 15:45:17 2010 From: hvdkooij at vanderkooij.org (Hugo van der Kooij) Date: Fri Oct 1 15:51:07 2010 Subject: AVG 8.5 support? In-Reply-To: <954634577-1285942168-cardhu_decombobulator_blackberry.rim.net-1620559316-@bda957.bisx.prod.on.blackberry> References: <5ef8d9eba070609da7251fc979116dee@127.0.0.1> <954634577-1285942168-cardhu_decombobulator_blackberry.rim.net-1620559316-@bda957.bisx.prod.on.blackberry> Message-ID: <348494bfa0901d51990ed1493ca2602d@127.0.0.1> On Fri, 1 Oct 2010 14:10:14 +0000, "Alex Neuman" wrote: > What's the deal with the free version of avg licensewise? Can it be used > in a commercial environment? How about on a home server? I guess you can find those details on the link there. I suggest you read them to see how they apply to your setup. Hugo. -- hvdkooij@vanderkooij.org http://hugo.vanderkooij.org/ PGP/GPG? Use: http://hugo.vanderkooij.org/0x58F19981.asc From alex at rtpty.com Fri Oct 1 15:58:24 2010 From: alex at rtpty.com (Alex Neuman) Date: Fri Oct 1 15:57:55 2010 Subject: AVG 8.5 support? Message-ID: <1803833154-1285945059-cardhu_decombobulator_blackberry.rim.net-764347920-@bda957.bisx.prod.on.blackberry> Thanks. ------Original Message------ From: Hugo van der Kooij Sender: mailscanner-bounces@lists.mailscanner.info To: MailScanner discussion ReplyTo: MailScanner discussion Subject: Re: AVG 8.5 support? Sent: Oct 1, 2010 9:45 AM On Fri, 1 Oct 2010 14:10:14 +0000, "Alex Neuman" wrote: > What's the deal with the free version of avg licensewise? Can it be used > in a commercial environment? How about on a home server? I guess you can find those details on the link there. I suggest you read them to see how they apply to your setup. Hugo. -- hvdkooij@vanderkooij.org http://hugo.vanderkooij.org/ PGP/GPG? Use: http://hugo.vanderkooij.org/0x58F19981.asc -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- Alex Neuman van der Hans Reliant Technologies +507 6781-9505 +507 832-6725 +1-440-253-9789 (USA) Recuerda visitar http://vidadigital.com.pa/ BB PIN 20EA17C5 Twitter: @AlexNeuman - @VidaDigitalTV http://facebook.com/vidadigital Skype: alexneuman From campbell at cnpapers.com Fri Oct 1 16:18:29 2010 From: campbell at cnpapers.com (Steve Campbell) Date: Fri Oct 1 16:18:41 2010 Subject: Charter.net just seems to be A-holes Message-ID: <4CA5FBC5.2040905@cnpapers.com> It's OT, but I've been fighting this one on and off for a while. Time to vent. charter.net keeps tempfailing our servers with a 452.4.1.0. All the research and all the efforts to contact them seems to be useless. I've blocked outgoing to charter.net from our most commonly used server to charter, but still get that stupid "exceeded limit" return code. If any of you all are charter.net customers, do us all a favor and notify someone there that they're blocking valid emails being sent from websites to their own accounts with really stupid rules. The rules they use for resetting limits never reset themselves. None of their email addresses for reporting this seems to be open, and I'm tired of answering the same question over and over again about why charter thinks 6 emails a week is too much. There, I feel better now. Steve Campbell From davejones70 at gmail.com Fri Oct 1 16:30:12 2010 From: davejones70 at gmail.com (Dave Jones) Date: Fri Oct 1 16:30:21 2010 Subject: X-???-MailScanner-SpamCheck: header empty when forwarding with rules In-Reply-To: References: Message-ID: I tried just doing plain "Archive Mail" rule and I am seeing the same results. I am getting the blank SpamCheck: header still. The only subject modifications that are happening is the {Disarmed} tag so it appears that these are getting forwarded/archived before the SA check. Do I have something wrong with my rules file? I have removed the original rules below so I only have this single archive rule in place now. Archive Mail = %rules-dir%/archive.rules FromOrTo: mailbox@mydomain.com maibox@archive.mydomain.com FromOrTo: default no On Mon, Sep 27, 2010 at 8:45 AM, Dave Jones wrote: > Update: The problem seems to occur mainly when I have the forward in the > nonspam.actions.rules file. I get all email to the forwarded address > including High Spam that should be deleted. > > MailScanner Version Number = 4.79.11 > > On Mon, Sep 27, 2010 at 8:35 AM, Dave Jones wrote: > >> Detailed Spam Report = yes >> Include Scores In SpamAssassin Report = yes >> Always Include SpamAssassin Report = yes >> >> I am trying to send nonspam and spam to alternate mailboxes for copying >> email using rules with the forward action. When a forward comes from the >> Spam Actions rule, I get the subject tagged with spam like I expect and I >> get a full SpamCheck: header like below. However, when I put an email >> address in both Spam Actions and Non Spam Actions rule, I appear to get all >> email forwarded to my copy mailbox without and subject changes and the >> SpamCheck: is empty. The original recipient doesn't get the email when it's >> obviously High Spam based on the subject so the problem seems to only be >> with the forwarded address. >> >> Spam Actions = %rules-dir%/spam.actions.rules >> High Scoring Spam Actions = delete >> Non Spam Actions = %rules-dir%/nonspam.actions.rules >> >> X-???-MailScanner-SpamCheck: spam, SpamAssassin (not cached, score=8.939, >> required 6, DCC_CHECK 1.10, HTML_MESSAGE 0.50, INVALID_DATE 1.10, >> KAM_MX4 2.00, MIME_HTML_MOSTLY 0.43, MIME_QP_LONG_LINE 0.00, >> MPART_ALT_DIFF 0.79, SPF_PASS -0.20, T_DOS_OUTLOOK_TO_MX_IMAGE 0.01, >> URIBL_DBL_SPAM 1.70, URIBL_RHS_DOB 1.51) >> >> %rules-dir%/nonspam.actions.rules >> ========================== >> FromOrTo: mailbox@mydomain.com deliver forward >> mailbox@archive.mydomain.com >> FromOrTo: default deliver >> >> %rules-dir%/spam.actions.rules >> ======================= >> FromOrTo: mailbox@mydomain.com deliver striphtml forward >> mailbox@archive.mydomain.com >> FromOrTo: default deliver striphtml >> >> An interesting point to note is that when I put my archive address in as >> the default, everything appears to work properly and I receive the >> SpamCheck: header and the subjects are modified. >> >> I realize I could use the Archive feature but I wasn't sure if this >> feature followed the Actions rules. I don't want to copy High Scoring Spam. >> Does the Archive feature forward all email? >> >> Dave >> > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20101001/40c18000/attachment.html From peter at farrows.org Fri Oct 1 16:40:17 2010 From: peter at farrows.org (Peter Farrow) Date: Fri Oct 1 16:40:26 2010 Subject: Charter.net just seems to be A-holes In-Reply-To: <4CA5FBC5.2040905@cnpapers.com> References: <4CA5FBC5.2040905@cnpapers.com> Message-ID: <4CA600E1.2010004@farrows.org> On 01/10/2010 16:18, Steve Campbell wrote: > It's OT, but I've been fighting this one on and off for a while. Time > to vent. > > charter.net keeps tempfailing our servers with a 452.4.1.0. All the > research and all the efforts to contact them seems to be useless. I've > blocked outgoing to charter.net from our most commonly used server to > charter, but still get that stupid "exceeded limit" return code. > > If any of you all are charter.net customers, do us all a favor and > notify someone there that they're blocking valid emails being sent > from websites to their own accounts with really stupid rules. The > rules they use for resetting limits never reset themselves. > > None of their email addresses for reporting this seems to be open, and > I'm tired of answering the same question over and over again about why > charter thinks 6 emails a week is too much. > > There, I feel better now. > > Steve Campbell > This is how I deal with charter.net: charter.net DISCARD ;-) -- horizontal ruler Peter Farrow avatar ______________________ Home: 01249 654183 Fax: 01249 461 548 Mobile: 07799605617 Skype: peter_farrow Web: www.peterfarrow.com -------------- next part -------------- Skipped content of type multipart/related From mrebsamen at unimatrix0.ch Fri Oct 1 17:38:45 2010 From: mrebsamen at unimatrix0.ch (Marco Rebsamen) Date: Sat Oct 2 09:57:17 2010 Subject: AW: "Notices To" As a ruleset References: Message-ID: OK It's a bug... I Updated to the newest version... Von: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] Im Auftrag von Marco Rebsamen Gesendet: Mittwoch, 29. September 2010 10:48 An: mailscanner@lists.mailscanner.info Betreff: "Notices To" As a ruleset Hello Everbody I set the parameter "Notices to" to %rules-dir%/notice_recipients.rules . But now I have seen in the logfile that the notice messages are delivered to this: /etc/mailscanner/rules/notice_recipients.rules@mx-rel.unimatrix0.ch which i guess isn't correct obviously.... What did happen here ?? Thank you -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20101001/e3a5e996/attachment.html From davejones70 at gmail.com Sat Oct 2 21:45:45 2010 From: davejones70 at gmail.com (Dave Jones) Date: Sat Oct 2 21:45:54 2010 Subject: X-???-MailScanner-SpamCheck: header empty when forwarding with rules In-Reply-To: References: Message-ID: Something is strange with this. I have tested 2 other MailScanner instances and they work perfectly. I guess this MailScanner.conf has something that is causing the empty SpamCheck: header. I have done a diff on the configs and nothing major jumps out as being different. I will try to debug this further but it's an odd one. On Fri, Oct 1, 2010 at 10:30 AM, Dave Jones wrote: > I tried just doing plain "Archive Mail" rule and I am seeing the same > results. I am getting the blank SpamCheck: header still. The only subject > modifications that are happening is the {Disarmed} tag so it appears that > these are getting forwarded/archived before the SA check. > > Do I have something wrong with my rules file? I have removed the original > rules below so I only have this single archive rule in place now. > > Archive Mail = %rules-dir%/archive.rules > FromOrTo: mailbox@mydomain.com maibox@archive.mydomain.com > FromOrTo: default no > > > On Mon, Sep 27, 2010 at 8:45 AM, Dave Jones wrote: > >> Update: The problem seems to occur mainly when I have the forward in the >> nonspam.actions.rules file. I get all email to the forwarded address >> including High Spam that should be deleted. >> >> MailScanner Version Number = 4.79.11 >> >> On Mon, Sep 27, 2010 at 8:35 AM, Dave Jones wrote: >> >>> Detailed Spam Report = yes >>> Include Scores In SpamAssassin Report = yes >>> Always Include SpamAssassin Report = yes >>> >>> I am trying to send nonspam and spam to alternate mailboxes for copying >>> email using rules with the forward action. When a forward comes from the >>> Spam Actions rule, I get the subject tagged with spam like I expect and I >>> get a full SpamCheck: header like below. However, when I put an email >>> address in both Spam Actions and Non Spam Actions rule, I appear to get all >>> email forwarded to my copy mailbox without and subject changes and the >>> SpamCheck: is empty. The original recipient doesn't get the email when it's >>> obviously High Spam based on the subject so the problem seems to only be >>> with the forwarded address. >>> >>> Spam Actions = %rules-dir%/spam.actions.rules >>> High Scoring Spam Actions = delete >>> Non Spam Actions = %rules-dir%/nonspam.actions.rules >>> >>> X-???-MailScanner-SpamCheck: spam, SpamAssassin (not cached, score=8.939, >>> required 6, DCC_CHECK 1.10, HTML_MESSAGE 0.50, INVALID_DATE 1.10, >>> KAM_MX4 2.00, MIME_HTML_MOSTLY 0.43, MIME_QP_LONG_LINE 0.00, >>> MPART_ALT_DIFF 0.79, SPF_PASS -0.20, T_DOS_OUTLOOK_TO_MX_IMAGE 0.01, >>> URIBL_DBL_SPAM 1.70, URIBL_RHS_DOB 1.51) >>> >>> %rules-dir%/nonspam.actions.rules >>> ========================== >>> FromOrTo: mailbox@mydomain.com deliver forward >>> mailbox@archive.mydomain.com >>> FromOrTo: default deliver >>> >>> %rules-dir%/spam.actions.rules >>> ======================= >>> FromOrTo: mailbox@mydomain.com deliver striphtml forward >>> mailbox@archive.mydomain.com >>> FromOrTo: default deliver striphtml >>> >>> An interesting point to note is that when I put my archive address in as >>> the default, everything appears to work properly and I receive the >>> SpamCheck: header and the subjects are modified. >>> >>> I realize I could use the Archive feature but I wasn't sure if this >>> feature followed the Actions rules. I don't want to copy High Scoring Spam. >>> Does the Archive feature forward all email? >>> >>> Dave >>> >> >> > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20101002/68633a3e/attachment.html From noel.butler at ausics.net Sun Oct 3 02:13:08 2010 From: noel.butler at ausics.net (Noel Butler) Date: Sun Oct 3 02:13:52 2010 Subject: [Fwd: [mailop] Change at dnswl.org] Message-ID: <1286068388.8150.1.camel@tardis> For those who have not seen... -------- Forwarded Message -------- From: Matthias Leisi Subject: [mailop] Change at dnswl.org Date: Sat, 2 Oct 2010 20:48:45 +0200 Hello all, dnswl.org has been running as a pure volunteer project since 2006. However, given the changing anti-spam industry and the challenges ahead, we decided that we need some sound financial basis. In a number of steps, we will introduce a subscription model for "heavy" users and vendors of anti-spam solutions using our data. The vast majority of our 50'000 users will not be affected by this change, since they neither need rsync access nor are they "heavy" users (which we define as above 100'000 queries / 24 hours on our public nameserver mirrors). Those who contribute to the project (eg with resources, data, time, know how) will get a free subscription, and we plan to introduce a reduced rate for educational and not-for-profit organisations. The current implementation schedule is in this blog posting: http://www.dnswl.org/news/archives/18-Changes-at-dnswl.org.html (http://goo.gl/info/T0j3) Any inputs are of course appreciated - and you are very welcome to contribute to the project :) -- Matthias -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20101003/91363152/attachment.html From jan-peter at koopmann.eu Mon Oct 4 11:43:59 2010 From: jan-peter at koopmann.eu (Koopmann, Jan-Peter) Date: Mon Oct 4 11:44:39 2010 Subject: Still Deliver Silent Viruses References: Message-ID: Hi Julian, as discussed here http://lists.mailscanner.info/pipermail/mailscanner/2010-April/095450.html http://lists.mailscanner.info/pipermail/mailscanner/2010-March/095233.h there seems to be a problem bug with Still Deliver Silent Viruses. If this is set to yes some attachments are delivered even if they contain viruses. This caused some trouble here as you can imagine. :-) I can say for sure that ZIPs containing viruses are delivered (without the attachment being replaced by a warning) if the virus is classified silent (e.g. All-Viruses) and silent deliver is set to yes. I would consider this a bug. Is there any plan to change this? Regards, JP -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20101004/8dc0a142/attachment.html From peter at farrows.org Mon Oct 4 16:29:52 2010 From: peter at farrows.org (Peter Farrow) Date: Mon Oct 4 16:30:02 2010 Subject: scamp error Message-ID: <4CA9F2F0.3000702@farrows.org> Hi There, as part of my mailscanner installation, I run the scamp shell utility to add extra databases to clamav. All my mailscanners work fine with this, except one, which repeatedly gets this error: ********** WARNING ********** Unable to install: securiteinfosh.hdb Clamscan exited with error code 2 Try downloading and installing the file again. The file is good (same as the others), clamav is all uptodate the permissions are correct, but it just keeps bailing out on this one file Has anyone else seen this problem? Pete From peter.ong at hypermediasystems.com Mon Oct 4 18:03:38 2010 From: peter.ong at hypermediasystems.com (Peter Ong) Date: Mon Oct 4 18:03:49 2010 Subject: Getting Past SpamAssassin In-Reply-To: <352950744.40413.1286211720544.JavaMail.root@mail021.dti> Message-ID: <2083495480.40415.1286211818683.JavaMail.root@mail021.dti> Dear MailScanner Gods, MailScanner: 4.79.11 spamassassin-3.2.5-1.el5 Please hear my prayers. Here's the weirdest thing... Under what circumstance could an email come through without passing through SpamAssassin? My configuration is as close to vanilla as possible. There have been no esoteric changes. A piece of spam came through this morning. It does not appear to have been scanned by SpamAssassin. Just to test, I scanned it as root. It scored a whopping 25.5 points. Then, I thought, maybe MailScanner runs spamassassin as postfix. So I scanned the same email as postfix, and spamassassin gave it a 32 points. Either way this should've been obliterated, but it shows: X-Spam-Status: No X-DTi-MailScanner-From: myemail@myserver.com X-DTi-MailScanner: Found to be clean X-DTi-MailScanner-ID: 7BB9B1908B1.AB3F2 X-DTi-MailScanner-Information: Please contact the ISP for more information X-Greylist: delayed 303 seconds by postgrey-1.32 at mygateway.tld; Mon, 04 Oct 2010 06:22:01 UTC Received: from 240.34.177.94.netvisiontelecom.ro (unknown [94.177.34.240]) by myserver.com (Postfix) with ESMTP id 7BB9B1908B1 for ; Mon, 4 Oct 2010 06:22:01 +0000 (UTC) At first, I thought this was the reason: Max SpamAssassin Size = 200k But the message was only 4K. Therefore, it is something else. Running spamassassin as postfix, I got these: [26774] warn: config: cannot write to /var/spool/postfix/.spamassassin/user_prefs: No such file or directory [26774] warn: config: failed to create default user preference file /var/spool/postfix/.spamassassin/user_prefs Could these have something to do with my problem? Under what circumstance could an email come through without passing through SpamAssassin? Thanks. p From steve.freegard at fsl.com Mon Oct 4 19:18:20 2010 From: steve.freegard at fsl.com (Steve Freegard) Date: Mon Oct 4 19:18:32 2010 Subject: Getting Past SpamAssassin In-Reply-To: <2083495480.40415.1286211818683.JavaMail.root@mail021.dti> References: <352950744.40413.1286211720544.JavaMail.root@mail021.dti> <2083495480.40415.1286211818683.JavaMail.root@mail021.dti> Message-ID: <4CAA1A6C.1060701@fsl.com> On 04/10/10 18:03, Peter Ong wrote: > > Under what circumstance could an email come through without passing through SpamAssassin? My configuration is as close to vanilla as possible. There have been no esoteric changes. > Check the following MailScanner.conf settings and make sure they are *blank*: SpamAssassin User State Dir SpamAssassin Local Rules Dir SpamAssassin Local State Dir SpamAssassin Default Rules Dir Otherwise you'll find SA will not find it's rules properly and will run considerably degraded. Cheers, Steve. From maxsec at gmail.com Mon Oct 4 19:41:39 2010 From: maxsec at gmail.com (Martin Hepworth) Date: Mon Oct 4 19:42:06 2010 Subject: Getting Past SpamAssassin In-Reply-To: <2083495480.40415.1286211818683.JavaMail.root@mail021.dti> References: <352950744.40413.1286211720544.JavaMail.root@mail021.dti> <2083495480.40415.1286211818683.JavaMail.root@mail021.dti> Message-ID: HI try putting in the additional headers for spamassassin in the mails, then you'll know what spamassassin actually said about the email as as far as MailScanner was concerned. Make the following changes to the settings in MailScanner.conf: Spam Score Number Format = %5.2f Detailed Spam Report = yes Include Scores In SpamAssassin Report = yes Always Include SpamAssassin Report = yes Spam Score Number Format = %5.2f Also the "X-Spam-Status:No" headers isn't anything do with MailScanner unless you're trusting this header which is perhaps a bad thing. -- Martin Hepworth Oxford, UK On 4 October 2010 18:03, Peter Ong wrote: > Dear MailScanner Gods, > > MailScanner: 4.79.11 > spamassassin-3.2.5-1.el5 > > > Please hear my prayers. Here's the weirdest thing... > > Under what circumstance could an email come through without passing through > SpamAssassin? My configuration is as close to vanilla as possible. There > have been no esoteric changes. > > A piece of spam came through this morning. It does not appear to have been > scanned by SpamAssassin. Just to test, I scanned it as root. It scored a > whopping 25.5 points. Then, I thought, maybe MailScanner runs spamassassin > as postfix. So I scanned the same email as postfix, and spamassassin gave it > a 32 points. Either way this should've been obliterated, but it shows: > > X-Spam-Status: No > X-DTi-MailScanner-From: myemail@myserver.com > X-DTi-MailScanner: Found to be clean > X-DTi-MailScanner-ID: 7BB9B1908B1.AB3F2 > X-DTi-MailScanner-Information: Please contact the ISP for more information > X-Greylist: delayed 303 seconds by postgrey-1.32 at mygateway.tld; Mon, 04 > Oct 2010 06:22:01 UTC > Received: from 240.34.177.94.netvisiontelecom.ro (unknown [94.177.34.240]) > by myserver.com (Postfix) with ESMTP id 7BB9B1908B1 > for ; Mon, 4 Oct 2010 06:22:01 +0000 (UTC) > > At first, I thought this was the reason: > Max SpamAssassin Size = 200k > > But the message was only 4K. Therefore, it is something else. > > Running spamassassin as postfix, I got these: > [26774] warn: config: cannot write to > /var/spool/postfix/.spamassassin/user_prefs: No such file or directory > [26774] warn: config: failed to create default user preference file > /var/spool/postfix/.spamassassin/user_prefs > > Could these have something to do with my problem? Under what circumstance > could an email come through without passing through SpamAssassin? > > Thanks. > > p > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20101004/f82cfb3b/attachment.html From peter.ong at hypermediasystems.com Mon Oct 4 19:46:02 2010 From: peter.ong at hypermediasystems.com (Peter Ong) Date: Mon Oct 4 19:46:12 2010 Subject: Getting Past SpamAssassin In-Reply-To: <4CAA1A6C.1060701@fsl.com> Message-ID: <553330351.40520.1286217962048.JavaMail.root@mail021.dti> > Check the following MailScanner.conf settings and make sure they are > *blank*: Here's my config: SpamAssassin User State Dir = /var/spool/MailScanner/spamassassin SpamAssassin Local Rules Dir = SpamAssassin Local State Dir = # /var/lib/spamassassin SpamAssassin Default Rules Dir = So let me confirm, you want me to make these settings blank? p ----- Original Message ----- > From: "Steve Freegard" > To: "MailScanner discussion" > Sent: Monday, October 4, 2010 11:18:20 AM > Subject: Re: Getting Past SpamAssassin > > On 04/10/10 18:03, Peter Ong wrote: > > > > Under what circumstance could an email come through without passing > through SpamAssassin? My configuration is as close to vanilla as > possible. There have been no esoteric changes. > > > > Check the following MailScanner.conf settings and make sure they are > *blank*: > > SpamAssassin User State Dir > SpamAssassin Local Rules Dir > SpamAssassin Local State Dir > SpamAssassin Default Rules Dir > > Otherwise you'll find SA will not find it's rules properly and will > run > considerably degraded. > > Cheers, > Steve. > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From peter.ong at hypermediasystems.com Mon Oct 4 19:49:35 2010 From: peter.ong at hypermediasystems.com (Peter Ong) Date: Mon Oct 4 19:49:45 2010 Subject: Getting Past SpamAssassin In-Reply-To: Message-ID: <516882619.40522.1286218175691.JavaMail.root@mail021.dti> Martin, Brilliant! I was just going to do that. p ----- Original Message ----- > From: "Martin Hepworth" > To: "MailScanner discussion" > Sent: Monday, October 4, 2010 11:41:39 AM > Subject: Re: Getting Past SpamAssassin > > HI > > > try putting in the additional headers for spamassassin in the mails, > then you'll know what spamassassin actually said about the email as as > far as MailScanner was concerned. Make the following changes to the > settings in MailScanner.conf: > > > > > Spam Score Number Format = %5.2f > > Detailed Spam Report = yes > > Include Scores In SpamAssassin Report = yes > > Always Include SpamAssassin Report = yes > > Spam Score Number Format = %5.2f > > > > > > > > Also the "X-Spam-Status:No" headers isn't anything do with MailScanner > unless you're trusting this header which is perhaps a bad thing. > > > -- > Martin Hepworth > Oxford, UK > > > > On 4 October 2010 18:03, Peter Ong < peter.ong@hypermediasystems.com > > wrote: > > > Dear MailScanner Gods, > > MailScanner: 4.79.11 > spamassassin-3.2.5-1.el5 > > > Please hear my prayers. Here's the weirdest thing... > > Under what circumstance could an email come through without passing > through SpamAssassin? My configuration is as close to vanilla as > possible. There have been no esoteric changes. > > A piece of spam came through this morning. It does not appear to have > been scanned by SpamAssassin. Just to test, I scanned it as root. It > scored a whopping 25.5 points. Then, I thought, maybe MailScanner runs > spamassassin as postfix. So I scanned the same email as postfix, and > spamassassin gave it a 32 points. Either way this should've been > obliterated, but it shows: > > X-Spam-Status: No > X-DTi-MailScanner-From: myemail@myserver.com > X-DTi-MailScanner: Found to be clean > X-DTi-MailScanner-ID: 7BB9B1908B1.AB3F2 > X-DTi-MailScanner-Information: Please contact the ISP for more > information > X-Greylist: delayed 303 seconds by postgrey-1.32 at mygateway.tld; > Mon, 04 Oct 2010 06:22:01 UTC > Received: from 240.34.177.94.netvisiontelecom.ro (unknown > [94.177.34.240]) > by myserver.com (Postfix) with ESMTP id 7BB9B1908B1 > for < myemail@myserver.com >; Mon, 4 Oct 2010 06:22:01 +0000 (UTC) > > At first, I thought this was the reason: > Max SpamAssassin Size = 200k > > But the message was only 4K. Therefore, it is something else. > > Running spamassassin as postfix, I got these: > [26774] warn: config: cannot write to > /var/spool/postfix/.spamassassin/user_prefs: No such file or directory > [26774] warn: config: failed to create default user preference file > /var/spool/postfix/.spamassassin/user_prefs > > Could these have something to do with my problem? Under what > circumstance could an email come through without passing through > SpamAssassin? > > Thanks. > > p > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From jvoorhees1 at gmail.com Mon Oct 4 23:07:08 2010 From: jvoorhees1 at gmail.com (Jason Voorhees) Date: Mon Oct 4 23:07:16 2010 Subject: Old MS versions Message-ID: Hi all: Does anybody know where can I get older MailScanner versions? Thanks From bonivart at opencsw.org Tue Oct 5 08:08:16 2010 From: bonivart at opencsw.org (Peter Bonivart) Date: Tue Oct 5 08:08:44 2010 Subject: Old MS versions In-Reply-To: References: Message-ID: On Tue, Oct 5, 2010 at 12:07 AM, Jason Voorhees wrote: > Hi all: > > Does anybody know where can I get older MailScanner versions? You used to be able to browse http://mailscanner.info/files/4/ but not any more. Maybe Julian can fix that? -- /peter From maxsec at gmail.com Tue Oct 5 08:17:55 2010 From: maxsec at gmail.com (Martin Hepworth) Date: Tue Oct 5 08:18:04 2010 Subject: Old MS versions In-Reply-To: References: Message-ID: Why would you want an older version, 1st thing with any question people ask here is that you are requested to upgrade to latest version and try that. I guess if you're trying to replicate an environment that's already running then that's maybe a reason. but I'd take the opportunity to upgrade anyway. -- Martin Hepworth Oxford, UK On 4 October 2010 23:07, Jason Voorhees wrote: > Hi all: > > Does anybody know where can I get older MailScanner versions? > > Thanks > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20101005/76935c23/attachment.html From glenn.steen at gmail.com Tue Oct 5 10:20:35 2010 From: glenn.steen at gmail.com (Glenn Steen) Date: Tue Oct 5 10:20:45 2010 Subject: Deny Filetypes In-Reply-To: References: Message-ID: On 24 September 2010 16:11, Joshua F. Withrow wrote: > > Question? > > > > How would I go about either stripping