Scan Messages = %rules-dir%/scan.messages.rules

[Steve Campbell]

Perhaps you should send us the "Scan Messages" line from your 
MailScanner.conf file and what you have in your file that is pointed to 
in by line above.

Have you restarted or reloaded MS since you changed the file?

Depending on what you have in that line and file, you probably shouldn't 
be seeing those lines in your mail log.

steve campbell

On 5/22/2013 1:45 PM, Robert Lopez wrote:
> On Wed, May 22, 2013 at 2:20 AM, Martin Hepworth <maxsec at gmail.com> wrote:
>> 1) nope, email addresses are not case sensitive.
>> 2) Envelope, MS always uses the Envelope-from in from parsing.
>> 3) this is the 'big knob' that tells whether MailScanner scans the email or
>> not. Way before it's passed to SA, anti-virus or checked by mailScanner
>> again RBLS (independently of SA). etc. Be very careful with setting as it's
>> basically sending email through with zero scanning. Might want to look at
>> the the "Is definitely Not spam" setting. Normally this is only used for
>> trusted ip-addresses not email 'from' addresses.
>>
>> hope that helps
>>
>> --
>> Martin Hepworth, CISSP
>> Oxford, UK
>>
>>
>> On 22 May 2013 02:18, Robert Lopez <rlopezcnm at gmail.com> wrote:
>>> wrt "Scan Messages = %rules-dir%/scan.messages.rules"
>>>
>>> Three questions:
>>>
>>> 1) Does MailScanner do a case sensitive match when
>>> scan.messages.rules file is used?
>>>
>>> 2) Which "From:" does scan.messages.rules use (Envelope or Email Body)?
>>>
>>> 3) Does MailScanner directly implement the match and action or is this
>>> passed to SpamAssassin to do the match and action?
>>>
>>> --
>>> Robert Lopez
>>> Unix Systems Administrator
>>> Central New Mexico Community College (CNM)
>>> 525 Buena Vista SE
>>> Albuquerque, New Mexico 87106
>>> --
>>> MailScanner mailing list
>>> mailscanner at lists.mailscanner.info
>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>>
>>> Before posting, read http://wiki.mailscanner.info/posting
>>>
>>> Support MailScanner development - buy the book off the website!
>>
>>
>> --
>> MailScanner mailing list
>> mailscanner at lists.mailscanner.info
>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>> Before posting, read http://wiki.mailscanner.info/posting
>>
>> Support MailScanner development - buy the book off the website!
>>
> Martin,
>
> Please clarify to which rule "Normally this" refers.
> I believe you are stating "Is definitely Not spam" is only used for
> trusted ip-addresses not email 'from' addresses.
>
> The situation I am trying to understand is email being scanned by
> SpamAssassin when I thought
> I had the system configured to not scan the email at all.
>
> May 20 12:55:08 mg04 MailScanner[11127]: Message 55370642025.7712B
> from 198.133.182.29 () to cnm.edu
> is not spam, SpamAssassin (not cached, score=-1.699, required 6,
> autolearn=disabled, CNM_EXCUSE 0.30,
> CNM_FROM -1.00, CNM_ITS -1.00, HTML_MESSAGE 0.00)
>
> --
> Robert Lopez
> Unix Systems Administrator
> Central New Mexico Community College (CNM)
> 525 Buena Vista SE
> Albuquerque, New Mexico 87106