From armando.montiel at gmail.com  Tue Dec  3 03:15:16 2013
From: armando.montiel at gmail.com (Armando Montiel)
Date: Mon, 02 Dec 2013 21:15:16 -0600
Subject: SOLVED: Re: MailScanner is processing queue every 300 seconds.
In-Reply-To: <CAGDKorJoNNWqa9tFRx1cBAfUrF6CmMqvhH=BqAUdUm24qz3iCg@mail.gmail.com>
References: <CAJY3TwHdx6DXCFFiTumdVh3JQtyeifup+jmQ-HnOp6OiA2BhBg@mail.gmail.com>
	<CAGDKorJoNNWqa9tFRx1cBAfUrF6CmMqvhH=BqAUdUm24qz3iCg@mail.gmail.com>
Message-ID: <529D4CC4.4010603@gmail.com>

Hi,

The server is now running smootly after the "Black Friday" mailing
increase and also
this monday (our peak hours are at the beginning of the week), and
everithing looks good.

Thank you guys!


El 30/11/2013 09:40 a.m., Martin Hepworth escribi?:
> Might be best to have the scanner part running on a separate machine
> to the mail server. Reduces issues with performance queries but also
> means internal email (between your own users) doesnt get scanned which
> keeps performance up
>
> Also means if the mailscanner bit fails uou can still transit internal
> email 
>
> On Saturday, 30 November 2013, Armando Montiel wrote:
>
>     Hi,
>
>     Thank you Martin.
>
>     You have pointed me to the right direction, but I would like to
>     share why I never think in this value before:
>
>     My "Delivery Method" was in "queue", so I was mind blocked about
>     not change this parameter. I was convinced that this value have no
>     relationship with my "batch" behavior.
>     Another value hat was necessary to change was not in MailScanner
>     but master.cf <http://master.cf> in Postfix:
>
>     cleanup, flush, pickup and qmgr values was setup to "unix", but
>     the new delivery method was unable to handle. I need to change
>     qmgr value to "fifo" in order to get this working.
>
>     Now I have delays with less than 20 seconds, which is pretty good,
>     but I dont know already if this will handle my users the next monday.
>
>     I will investigate which "fifo|unix" values have better
>     performance under Postfix and a heavy imap usage under Cyrus-imapd.
>
>     Thank you again.
>
>     El nov 29, 2013 3:53 PM, "Martin Hepworth" <maxsec at gmail.com
>     <javascript:_e({}, 'cvml', 'maxsec at gmail.com');>> escribi?:
>
>         Batch is the clue word there specifically the setting
>         is http://www.mailscanner.info/MailScanner.conf.index.html#Delivery%20Method
>
>
>         This is how is should work in batches but a 5 min interval
>         isnt right
>
>         I'd check the setting to call the second mta (sendmail2)
>         setting is correct
>
>         Martin
>
>         On Friday, 29 November 2013, Armando Montiel wrote:
>
>
>             Hi,
>
>             I am using a mail server solution where MailScanner is
>             used with postfix + cyrus-imapd.
>
>             Any clue about why this combination of software spends 300
>             seconds (5 minutes) to process and deliver email?
>
>             This is like my server take a look in the queue and
>             process this in a batch way, not individually.
>
>             The best time I get in this scenario is when a email is
>             received in the queue 15 or 20 seconds before the last
>             processing cycle of 5 minutes has been performed.
>
>             Sometime in the past this didn't happened but I am lost
>             looking for a possible reason.
>
>             Which MailScanner variables could make this effect?
>
>             Thank you.
>
>
>
>         -- 
>         -- 
>         Martin Hepworth, CISSP
>         Oxford, UK
>
>         --
>         MailScanner mailing list
>         mailscanner at lists.mailscanner.info <javascript:_e({}, 'cvml',
>         'mailscanner at lists.mailscanner.info');>
>         http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>         Before posting, read http://wiki.mailscanner.info/posting
>
>         Support MailScanner development - buy the book off the website!
>
>
>
> -- 
> -- 
> Martin Hepworth, CISSP
> Oxford, UK
>
>


From goetz.reinicke at filmakademie.de  Tue Dec  3 13:10:14 2013
From: goetz.reinicke at filmakademie.de (=?ISO-8859-15?Q?G=F6tz_Reinicke_-_IT_Koordinator?=)
Date: Tue, 03 Dec 2013 14:10:14 +0100
Subject: Training or adujsting of SpamAssassin How to?
Message-ID: <529DD836.3070402@filmakademie.de>

Hi,

usually our MailScanner installation is working fine, but from time to
time some spam/phishing mails slip through the grid and bug or confuse
our users.

My question: How to handle such messages? The messages in questions
usually have a good looking subject and not to much errors in the body,
the from address exists. So all in all they look quite good, beside some
foolish phishing urls.

AFAIK I can train SpamAssassin some how or is there some other best
practice suggestions?


	Thanks for any suggestion, hint etc. Regards . G?tz
-- 
G?tz Reinicke
IT-Koordinator

Tel. +49 7141 969 82 420
E-Mail goetz.reinicke at filmakademie.de

Filmakademie Baden-W?rttemberg GmbH
Akademiehof 10
71638 Ludwigsburg
www.filmakademie.de

Eintragung Amtsgericht Stuttgart HRB 205016

Vorsitzender des Aufsichtsrats: J?rgen Walter MdL
Staatssekret?r im Ministerium f?r Wissenschaft,
Forschung und Kunst Baden-W?rttemberg

Gesch?ftsf?hrer: Prof. Thomas Schadt

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5223 bytes
Desc: S/MIME Cryptographic Signature
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20131203/7fe96a23/attachment.bin 

From maxsec at gmail.com  Tue Dec  3 16:22:57 2013
From: maxsec at gmail.com (Martin Hepworth)
Date: Tue, 3 Dec 2013 16:22:57 +0000
Subject: Training or adujsting of SpamAssassin How to?
In-Reply-To: <529DD836.3070402@filmakademie.de>
References: <529DD836.3070402@filmakademie.de>
Message-ID: <CAGDKorLwiQxLCNAmF8XJxwwEq_rrT+UEP6Q6U+WHPSjm1dubfA@mail.gmail.com>

User education, banks dont send these things, are u expecting this from
this user....

-- 
Martin Hepworth, CISSP
Oxford, UK


On 3 December 2013 13:10, G?tz Reinicke - IT Koordinator <
goetz.reinicke at filmakademie.de> wrote:

> Hi,
>
> usually our MailScanner installation is working fine, but from time to
> time some spam/phishing mails slip through the grid and bug or confuse
> our users.
>
> My question: How to handle such messages? The messages in questions
> usually have a good looking subject and not to much errors in the body,
> the from address exists. So all in all they look quite good, beside some
> foolish phishing urls.
>
> AFAIK I can train SpamAssassin some how or is there some other best
> practice suggestions?
>
>
>         Thanks for any suggestion, hint etc. Regards . G?tz
> --
> G?tz Reinicke
> IT-Koordinator
>
> Tel. +49 7141 969 82 420
> E-Mail goetz.reinicke at filmakademie.de
>
> Filmakademie Baden-W?rttemberg GmbH
> Akademiehof 10
> 71638 Ludwigsburg
> www.filmakademie.de
>
> Eintragung Amtsgericht Stuttgart HRB 205016
>
> Vorsitzender des Aufsichtsrats: J?rgen Walter MdL
> Staatssekret?r im Ministerium f?r Wissenschaft,
> Forschung und Kunst Baden-W?rttemberg
>
> Gesch?ftsf?hrer: Prof. Thomas Schadt
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20131203/b8e074dc/attachment.html 

From vladob at pb.coopexsoft.sk  Wed Dec  4 09:54:05 2013
From: vladob at pb.coopexsoft.sk (VladoB)
Date: Wed, 04 Dec 2013 10:54:05 +0100
Subject: Training or adujsting of SpamAssassin How to?
In-Reply-To: <529DD836.3070402@filmakademie.de>
References: <529DD836.3070402@filmakademie.de>
Message-ID: <529EFBBD.90202@pb.coopexsoft.sk>

Hi.

I use SpamAssassin. I occasionally run sa-learn on selected IMAP 
folders, like this:

    sa-learn --ham --no-sync "/home/user1/Maildir/dir1/cur"
    sa-learn --ham --no-sync "/home/user1/Maildir/dir2/cur"
    sa-learn --ham --no-sync "/home/user2/Maildir/dir3/cur"
    ...
    sa-learn --spam --no-sync "/home/user3/Maildir/.Junk/cur"
    sa-learn --spam --no-sync "/home/user4/Maildir/.Junk/cur"
    ...
    sa-learn --sync

In case of extra annoying spam I add rules to spamassassin-local.cf 
manually, like this:

    body     LOCAL_ELGORDO1         /El Gordo International Email
    Lottery Award/i
    score    LOCAL_ELGORDO1         4
    describe LOCAL_ELGORDO1         Spam from El Gordo

Spam countermeasures will never be 100% perfect. Better some mails slip 
through, than correct mail catched and not delivered.

~~/VladoB/~~

On 3.12.2013 14:10, G?tz Reinicke - IT Koordinator wrote:
> Hi,
>
> usually our MailScanner installation is working fine, but from time to
> time some spam/phishing mails slip through the grid and bug or confuse
> our users.
>
> My question: How to handle such messages? The messages in questions
> usually have a good looking subject and not to much errors in the body,
> the from address exists. So all in all they look quite good, beside some
> foolish phishing urls.
>
> AFAIK I can train SpamAssassin some how or is there some other best
> practice suggestions?
>
>
> 	Thanks for any suggestion, hint etc. Regards . G?tz
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20131204/d8035850/attachment.html 

From stef at aoc-uk.com  Thu Dec  5 10:06:44 2013
From: stef at aoc-uk.com (Stef Morrell)
Date: Thu, 5 Dec 2013 10:06:44 +0000
Subject: Exceptions to the rules.
Message-ID: <92665C7597419742B19470DFA3D5BEA208E56B15@vonLipwig.aoc-uk.com>

Hi,

Running MailScanner 4.84.5-3 with Postfix 2.5.1 

Assuming a domain receipt.com for which incoming email is normally scanned. I need to make an exception for a couple of known safe senders, so that email they send is never scanned at all, even when addressed to receipt.com

This may not be the most sensible plan in the universe, but it is the one I have been tasked with by the man who signs my paycheck!
 
My understanding is that I can have in MailScanner.conf a line

Scan Messages = %rules-dir%/scan.messages.rules
 
And then in scan.messages.rules, lines of the form

From: safesender at domain.com no
From: safesender2 at domain.com And To: recipient at receipt.com no
To: receipt.com yes

And this will completely bypass MS for those senders (optionally only when sending to stated recipient).

Nevertheless, the sender's emails are being quarantined, as they contain attachments normally stopped by the file content rules.

I've tried also adding the safe senders into a content ruleset to try and get them through the system, but this hasn't helped either.

I presume I am missing something here. What do I need to do, in order to have MS honour such exceptions to the normal rules?

Thanks

Stef

From maxsec at gmail.com  Thu Dec  5 12:46:53 2013
From: maxsec at gmail.com (Martin Hepworth)
Date: Thu, 5 Dec 2013 12:46:53 +0000
Subject: Exceptions to the rules.
In-Reply-To: <92665C7597419742B19470DFA3D5BEA208E56B15@vonLipwig.aoc-uk.com>
References: <92665C7597419742B19470DFA3D5BEA208E56B15@vonLipwig.aoc-uk.com>
Message-ID: <CAGDKorLXv9b4HuioZR79=QYJJgSd=mH1PL8kD956Cnqip2KYxA@mail.gmail.com>

and those rules are before the default action line in the
scan.messages.rules files?

-- 
Martin Hepworth, CISSP
Oxford, UK


On 5 December 2013 10:06, Stef Morrell <stef at aoc-uk.com> wrote:

> Hi,
>
> Running MailScanner 4.84.5-3 with Postfix 2.5.1
>
> Assuming a domain receipt.com for which incoming email is normally
> scanned. I need to make an exception for a couple of known safe senders, so
> that email they send is never scanned at all, even when addressed to
> receipt.com
>
> This may not be the most sensible plan in the universe, but it is the one
> I have been tasked with by the man who signs my paycheck!
>
> My understanding is that I can have in MailScanner.conf a line
>
> Scan Messages = %rules-dir%/scan.messages.rules
>
> And then in scan.messages.rules, lines of the form
>
> From: safesender at domain.com no
> From: safesender2 at domain.com And To: recipient at receipt.com no
> To: receipt.com yes
>
> And this will completely bypass MS for those senders (optionally only when
> sending to stated recipient).
>
> Nevertheless, the sender's emails are being quarantined, as they contain
> attachments normally stopped by the file content rules.
>
> I've tried also adding the safe senders into a content ruleset to try and
> get them through the system, but this hasn't helped either.
>
> I presume I am missing something here. What do I need to do, in order to
> have MS honour such exceptions to the normal rules?
>
> Thanks
>
> Stef
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20131205/fc168215/attachment.html 

From stef at aoc-uk.com  Thu Dec  5 13:44:14 2013
From: stef at aoc-uk.com (Stefan Morrell)
Date: Thu, 5 Dec 2013 13:44:14 +0000
Subject: Exceptions to the rules.
In-Reply-To: <a84ff59f-301a-4497-b4d3-9ad3012c5ded@VONLIPWIG.aoc-uk.com>
References: <92665C7597419742B19470DFA3D5BEA208E56B15@vonLipwig.aoc-uk.com>
	<a84ff59f-301a-4497-b4d3-9ad3012c5ded@VONLIPWIG.aoc-uk.com>
Message-ID: <52A0832E.1060701@aoc-uk.com>

On 05/12/2013 12:46, Martin Hepworth wrote:
> and those rules are before the default action line in the
> scan.messages.rules files?

The full file is..

From: safesender at blah.com no
...etc
To: *@DomainsThatShouldBeScanned.com yes
...etc
FromOrTo: default no

So - Exceptions first with a no, after that stuff to be scanned with a 
yes, and finally a default no.

>
> --
> Martin Hepworth, CISSP
> Oxford, UK
>
>
> On 5 December 2013 10:06, Stef Morrell <stef at aoc-uk.com
> <mailto:stef at aoc-uk.com>> wrote:
>
>     Hi,
>
>     Running MailScanner 4.84.5-3 with Postfix 2.5.1
>
>     Assuming a domain receipt.com <http://receipt.com> for which
>     incoming email is normally scanned. I need to make an exception for
>     a couple of known safe senders, so that email they send is never
>     scanned at all, even when addressed to receipt.com <http://receipt.com>
>
>     This may not be the most sensible plan in the universe, but it is
>     the one I have been tasked with by the man who signs my paycheck!
>
>     My understanding is that I can have in MailScanner.conf a line
>
>     Scan Messages = %rules-dir%/scan.messages.rules
>
>     And then in scan.messages.rules, lines of the form
>
>     From: safesender at domain.com <mailto:safesender at domain.com> no
>     From: safesender2 at domain.com <mailto:safesender2 at domain.com> And To:
>     recipient at receipt.com <mailto:recipient at receipt.com> no
>     To: receipt.com <http://receipt.com> yes
>
>     And this will completely bypass MS for those senders (optionally
>     only when sending to stated recipient).
>
>     Nevertheless, the sender's emails are being quarantined, as they
>     contain attachments normally stopped by the file content rules.
>
>     I've tried also adding the safe senders into a content ruleset to
>     try and get them through the system, but this hasn't helped either.
>
>     I presume I am missing something here. What do I need to do, in
>     order to have MS honour such exceptions to the normal rules?
>
>     Thanks
>
>     Stef

From stef at aoc-uk.com  Thu Dec  5 13:47:59 2013
From: stef at aoc-uk.com (Stef Morrell)
Date: Thu, 5 Dec 2013 13:47:59 +0000
Subject: Exceptions to the rules.
In-Reply-To: <a84ff59f-301a-4497-b4d3-9ad3012c5ded@VONLIPWIG.aoc-uk.com>
References: <92665C7597419742B19470DFA3D5BEA208E56B15@vonLipwig.aoc-uk.com>
	<a84ff59f-301a-4497-b4d3-9ad3012c5ded@VONLIPWIG.aoc-uk.com>
Message-ID: <92665C7597419742B19470DFA3D5BEA208E56F4E@vonLipwig.aoc-uk.com>

On 05/12/2013 12:46, Martin Hepworth wrote:
> and those rules are before the default action line in the
> scan.messages.rules files?

The full file is..

From: safesender at blah.com no
...etc
To: *@DomainsThatShouldBeScanned.com yes
...etc
FromOrTo: default no

So - Exceptions first with a no, stuff I want scanned second with a yes and finally a default no for everything else.

>
> --
> Martin Hepworth, CISSP
> Oxford, UK
>
>
> On 5 December 2013 10:06, Stef Morrell <stef at aoc-uk.com
> <mailto:stef at aoc-uk.com>> wrote:
>
>     Hi,
>
>     Running MailScanner 4.84.5-3 with Postfix 2.5.1
>
>     Assuming a domain receipt.com <http://receipt.com> for which
>     incoming email is normally scanned. I need to make an exception for
>     a couple of known safe senders, so that email they send is never
>     scanned at all, even when addressed to receipt.com <http://receipt.com>
>
>     This may not be the most sensible plan in the universe, but it is
>     the one I have been tasked with by the man who signs my paycheck!
>
>     My understanding is that I can have in MailScanner.conf a line
>
>     Scan Messages = %rules-dir%/scan.messages.rules
>
>     And then in scan.messages.rules, lines of the form
>
>     From: safesender at domain.com <mailto:safesender at domain.com> no
>     From: safesender2 at domain.com <mailto:safesender2 at domain.com> And To:
>     recipient at receipt.com <mailto:recipient at receipt.com> no
>     To: receipt.com <http://receipt.com> yes
>
>     And this will completely bypass MS for those senders (optionally
>     only when sending to stated recipient).
>
>     Nevertheless, the sender's emails are being quarantined, as they
>     contain attachments normally stopped by the file content rules.
>
>     I've tried also adding the safe senders into a content ruleset to
>     try and get them through the system, but this hasn't helped either.
>
>     I presume I am missing something here. What do I need to do, in
>     order to have MS honour such exceptions to the normal rules?
>
>     Thanks
>
>     Stef

From mailscanner at virtual.drop.net  Wed Dec 18 19:32:01 2013
From: mailscanner at virtual.drop.net (Matthew Davis)
Date: Wed, 18 Dec 2013 14:32:01 -0500
Subject: Known Web Bug Servers
Message-ID: <52B1F831.1030306@virtual.drop.net>

This question was asked many years ago, but I have not seen and answer.  
Is there a collection of "Known Web Bug Servers" out there?  In addition 
to msgtag.com, I have found advmailservice.com to also be a Web Bug 
service (front end is pointofmail.com).  Are there any more out there?

Thanks
-- 
*
Matthew Davis

*


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20131218/8ce63f0a/attachment.html 

From alex at vidadigital.com.pa  Wed Dec 18 20:43:25 2013
From: alex at vidadigital.com.pa (Alex Neuman)
Date: Wed, 18 Dec 2013 15:43:25 -0500
Subject: Known Web Bug Servers
In-Reply-To: <52B1F831.1030306@virtual.drop.net>
References: <52B1F831.1030306@virtual.drop.net>
Message-ID: <CANyE0PrNi9KGVvN44Mm0huyB0tuOs6QFHa1GJ9_cbF+8+LCQfA@mail.gmail.com>

I've heard of "Signals by Hubspot".


On Wed, Dec 18, 2013 at 2:32 PM, Matthew Davis <mailscanner at virtual.drop.net
> wrote:

>  This question was asked many years ago, but I have not seen and answer.
> Is there a collection of "Known Web Bug Servers" out there?  In addition to
> msgtag.com, I have found advmailservice.com to also be a Web Bug service
> (front end is pointofmail.com).  Are there any more out there?
>
> Thanks
> --
> * Matthew Davis *
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
>


-- 

Alex Neuman van der Hans
Reliant Technologies / Vida Digital
http://vidadigital.com.pa/

+507-6781-9505
+507-832-6725
+1-440-253-9789 (USA)

Follow @AlexNeuman on Twitter
http://facebook.com/vidadigital
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20131218/4c9c64f6/attachment.html 

From mailscanner-list at okla.com  Thu Dec 26 19:53:12 2013
From: mailscanner-list at okla.com (Tracy Greggs)
Date: Thu, 26 Dec 2013 13:53:12 -0600
Subject: test
Message-ID: <024901cf0274$1f362de0$5da289a0$@okla.com>

test


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.