From jerry.benton at mailborder.com Mon Mar 2 03:34:02 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Sun, 1 Mar 2015 22:34:02 -0500 Subject: MailScanner Change Message-ID: <1277DF14-0670-48EB-9722-910CA4FB9721@mailborder.com> Greetings, While putting together the Debian package based on Andrew Colin Kissa?s Debian build I noticed some differences from the RPM packages. In short, he was using /usr/share/MailScanner instead of the previous /usr/lib/MailScanner structure. According to the Filesystem Hierarchy Standard (FHS) this is the correct approach. Therefore, I am creating v4.85.2 that will incorporate this change in order to standardize the structure across all of the builds. The tarball build will retain the /opt/MailScanner/lib structure for now since /opt is essentially cowboy territory and anything goes. However, I will eventually update it. I will put out each build to this list in case anyone wants to test it once they are complete. Once I have all the packages completed I will update the MailScanner website. - Jerry Benton www.mailborder.com From jerry.benton at mailborder.com Mon Mar 2 04:20:28 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Sun, 1 Mar 2015 23:20:28 -0500 Subject: v4.85.2-0 Beta (Red Hat, SuSE, Tarball) Message-ID: Beta builds with the new directory structure in /usr/share/MailScanner. Lab tested. I am working on the Debian package now. RHEL https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2-0.rpm.tar.gz SuSE https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2-0.suse-rpm.tar.gz Tarball https://s3.amazonaws.com/mailscanner/test/MailScanner-install-4.85.2-0.tar.gz - Jerry Benton www.mailborder.com From alex at vidadigital.com.pa Mon Mar 2 12:28:31 2015 From: alex at vidadigital.com.pa (Alex Neuman) Date: Mon, 2 Mar 2015 07:28:31 -0500 Subject: MailScanner Change In-Reply-To: <1277DF14-0670-48EB-9722-910CA4FB9721@mailborder.com> References: <1277DF14-0670-48EB-9722-910CA4FB9721@mailborder.com> Message-ID: Would this affect MailWatch users or is copying the mailwatch .pm file in the new folder? On Mar 2, 2015 12:04 AM, "Jerry Benton" wrote: > Greetings, > > While putting together the Debian package based on Andrew Colin Kissa?s > Debian build I noticed some differences from the RPM packages. In short, he > was using /usr/share/MailScanner instead of the previous > /usr/lib/MailScanner structure. According to the Filesystem Hierarchy > Standard (FHS) this is the correct approach. Therefore, I am creating > v4.85.2 that will incorporate this change in order to standardize the > structure across all of the builds. The tarball build will retain the > /opt/MailScanner/lib structure for now since /opt is essentially cowboy > territory and anything goes. However, I will eventually update it. > > I will put out each build to this list in case anyone wants to test it > once they are complete. Once I have all the packages completed I will > update the MailScanner website. > > - > Jerry Benton > www.mailborder.com > > > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150302/021198cf/attachment.html From john at tradoc.fr Mon Mar 2 13:03:05 2015 From: john at tradoc.fr (John Wilcock) Date: Mon, 02 Mar 2015 14:03:05 +0100 Subject: v4.85.1-0 tarball beta In-Reply-To: References: <0C1B9CE6-525A-4E44-89FF-943618408DF4@mailborder.com> <54EDD97D.20900@tradoc.fr> <03D008D5-69C8-4255-B282-723D9C48C700@mailborder.com> <54EEC91C.5040007@tradoc.fr> <54EEF3A8.1030708@tradoc.fr> Message-ID: <54F45F89.8040907@tradoc.fr> Hi Jerry, You're missing a fix to PFDiskStore.pm that causes taint errors (Can't call method "print" on an undefined value at /usr/lib/MailScanner/MailScanner/PFDiskStore.pm line 758) when bad filenames/filetypes are detected. This was reported years ago though it never seems to have made it to the official repository. John --- /usr/lib/MailScanner/MailScanner/PFDiskStore.pm.4.85.orig 2015-03-02 13:49:11.000000000 +0100 +++ /usr/lib/MailScanner/MailScanner/PFDiskStore.pm 2015-03-02 13:55:53.000000000 +0100 @@ -630,8 +630,15 @@ my $this = shift; my($message, $targetdir, $targetfile, $uid, $gid, $changeowner) = @_; - $targetfile =~/([\w\d]{9,15}\.[\w\d]{5})/; - $targetfile = $1; + if ($targetfile =~ /([A-F\d]{8,15}\.[A-F\d]{5})/) { + $targetfile = $1; + } else { + if ($targetfile =~ /([\w\d\.]{4,32})/) { + $targetfile = $1; + } else { + $targetfile = "fallback"; + } + } #print STDERR "Copying to $targetdir $targetfile\n"; if (MailScanner::Config::Value('storeentireasdfqf')) { From jerry.benton at mailborder.com Mon Mar 2 13:12:01 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Mon, 2 Mar 2015 08:12:01 -0500 Subject: MailScanner Change In-Reply-To: References: <1277DF14-0670-48EB-9722-910CA4FB9721@mailborder.com> Message-ID: Yes. - Jerry Benton www.mailborder.com > On Mar 2, 2015, at 7:28 AM, Alex Neuman wrote: > > Would this affect MailWatch users or is copying the mailwatch .pm file in the new folder? > > On Mar 2, 2015 12:04 AM, "Jerry Benton" > wrote: > Greetings, > > While putting together the Debian package based on Andrew Colin Kissa?s Debian build I noticed some differences from the RPM packages. In short, he was using /usr/share/MailScanner instead of the previous /usr/lib/MailScanner structure. According to the Filesystem Hierarchy Standard (FHS) this is the correct approach. Therefore, I am creating v4.85.2 that will incorporate this change in order to standardize the structure across all of the builds. The tarball build will retain the /opt/MailScanner/lib structure for now since /opt is essentially cowboy territory and anything goes. However, I will eventually update it. > > I will put out each build to this list in case anyone wants to test it once they are complete. Once I have all the packages completed I will update the MailScanner website. > > - > Jerry Benton > www.mailborder.com > > > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150302/7e2021a9/attachment.html From jerry.benton at mailborder.com Mon Mar 2 13:49:00 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Mon, 2 Mar 2015 08:49:00 -0500 Subject: v4.85.1-0 tarball beta In-Reply-To: <54F45F89.8040907@tradoc.fr> References: <0C1B9CE6-525A-4E44-89FF-943618408DF4@mailborder.com> <54EDD97D.20900@tradoc.fr> <03D008D5-69C8-4255-B282-723D9C48C700@mailborder.com> <54EEC91C.5040007@tradoc.fr> <54EEF3A8.1030708@tradoc.fr> <54F45F89.8040907@tradoc.fr> Message-ID: <76D878EC-93E6-4EB1-AC54-183AFF250E40@mailborder.com> John, Thank you. I updated the source. Can you please verify that it is now correct? https://github.com/MailScanner/v4/blob/master/mailscanner/bin/MailScanner/PFDiskStore.pm - Jerry Benton www.mailborder.com > On Mar 2, 2015, at 8:03 AM, John Wilcock wrote: > > if ($targetfile =~ /([A-F\d]{8,15}\.[A-F\d]{5})/) { > + $targetfile = $1; > + } else { > + if ($targetfile =~ /([\w\d\.]{4,32})/) { > + $targetfile = $1; > + } else { > + $targetfile = "fallback"; > + } > + } From iversons at rushville.k12.in.us Mon Mar 2 14:48:07 2015 From: iversons at rushville.k12.in.us (Shawn Iverson) Date: Mon, 2 Mar 2015 09:48:07 -0500 Subject: MailScanner Change In-Reply-To: References: <1277DF14-0670-48EB-9722-910CA4FB9721@mailborder.com> Message-ID: I will gladly give the MailWatch devs a heads up. They have been responsive to these issues. On Mon, Mar 2, 2015 at 8:12 AM, Jerry Benton wrote: > Yes. > > - > Jerry Benton > www.mailborder.com > > > > On Mar 2, 2015, at 7:28 AM, Alex Neuman wrote: > > Would this affect MailWatch users or is copying the mailwatch .pm file in > the new folder? > On Mar 2, 2015 12:04 AM, "Jerry Benton" > wrote: > >> Greetings, >> >> While putting together the Debian package based on Andrew Colin Kissa?s >> Debian build I noticed some differences from the RPM packages. In short, he >> was using /usr/share/MailScanner instead of the previous >> /usr/lib/MailScanner structure. According to the Filesystem Hierarchy >> Standard (FHS) this is the correct approach. Therefore, I am creating >> v4.85.2 that will incorporate this change in order to standardize the >> structure across all of the builds. The tarball build will retain the >> /opt/MailScanner/lib structure for now since /opt is essentially cowboy >> territory and anything goes. However, I will eventually update it. >> >> I will put out each build to this list in case anyone wants to test it >> once they are complete. Once I have all the packages completed I will >> update the MailScanner website. >> >> - >> Jerry Benton >> www.mailborder.com >> >> >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -- Shawn Iverson Director of Technology Rush County Schools 765-932-3901 x271 iversons at rushville.k12.in.us -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150302/d7e414f1/attachment.html From jerry.benton at mailborder.com Mon Mar 2 15:24:40 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Mon, 2 Mar 2015 10:24:40 -0500 Subject: MailScanner Change In-Reply-To: References: <1277DF14-0670-48EB-9722-910CA4FB9721@mailborder.com> Message-ID: <91E1C25A-0BEB-4896-8EED-7E37BF419710@mailborder.com> Or I could just add the MailWatch.pm to the CustomFunctions directory in the source. - Jerry Benton www.mailborder.com > On Mar 2, 2015, at 9:48 AM, Shawn Iverson wrote: > > I will gladly give the MailWatch devs a heads up. They have been responsive to these issues. > > On Mon, Mar 2, 2015 at 8:12 AM, Jerry Benton > wrote: > Yes. > > - > Jerry Benton > www.mailborder.com > > > >> On Mar 2, 2015, at 7:28 AM, Alex Neuman > wrote: >> >> Would this affect MailWatch users or is copying the mailwatch .pm file in the new folder? >> >> On Mar 2, 2015 12:04 AM, "Jerry Benton" > wrote: >> Greetings, >> >> While putting together the Debian package based on Andrew Colin Kissa?s Debian build I noticed some differences from the RPM packages. In short, he was using /usr/share/MailScanner instead of the previous /usr/lib/MailScanner structure. According to the Filesystem Hierarchy Standard (FHS) this is the correct approach. Therefore, I am creating v4.85.2 that will incorporate this change in order to standardize the structure across all of the builds. The tarball build will retain the /opt/MailScanner/lib structure for now since /opt is essentially cowboy territory and anything goes. However, I will eventually update it. >> >> I will put out each build to this list in case anyone wants to test it once they are complete. Once I have all the packages completed I will update the MailScanner website. >> >> - >> Jerry Benton >> www.mailborder.com >> >> >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > > -- > Shawn Iverson > Director of Technology > Rush County Schools > 765-932-3901 x271 > iversons at rushville.k12.in.us -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150302/0a969bc1/attachment.html From jeremy at fluxlabs.net Tue Mar 3 03:45:33 2015 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Tue, 3 Mar 2015 03:45:33 +0000 Subject: Different SA scan results In-Reply-To: <16CE5A4E-0F53-40B5-83C9-DA2827F5B0BE@mailborder.com> References: <5269F9C4-BB61-42C3-AC19-DF9FC3ABC394@fluxlabs.net>, <16CE5A4E-0F53-40B5-83C9-DA2827F5B0BE@mailborder.com> Message-ID: <396FFD7F-35BF-4CB1-89B3-EEECE344C856@fluxlabs.net> Not sure what you mean. MS is calling spamassassin ... Shouldn't it be the same scan ? Why would NOT including my prefs.conf file change ? -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Feb 27, 2015, at 1:46 AM, Jerry Benton > wrote: You need to include your /etc/MailScanner/ spam.assassin.prefs.conf in your command to get the same results. - Jerry Benton www.mailborder.com On Feb 26, 2015, at 9:12 PM, Jeremy McSpadden > wrote: What would cause an cli scan (spamassassin -D < msg) to have different results than mailscanner scan ? via cli Content analysis details: (26.1 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS [46.105.49.218 listed in zen.spamhaus.org] 5.0 URIBL_BLACK Contains an URL listed in the URIBL blacklist [URIs: karefon.eu] 5.0 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist [URIs: karefon.eu] -2.0 SPF_HELO_PASS SPF: HELO matches SPF record -0.0 SPF_PASS SPF: sender matches SPF record 0.0 HTML_MESSAGE BODY: HTML included in message 1.5 BAYES_50 BODY: Bayes spam probability is 40 to 60% [score: 0.4995] 0.5 KAM_EU RAW: Prevalent use of .eu in spam/malware 5.0 KAM_GRABBAG2 Grabbag of Spams hitting EU domains and other indicators 0.8 RDNS_NONE Delivered to internal network by a host with no rDNS 2.0 HTML_OFF_PAGE HTML element rendered well off the displayed page 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines 5.0 KAM_VERY_BLACK_DBL Email that hits both URIBL Black and Spamhaus DBL 0.0 T_REMOTE_IMAGE Message contains an external image via ms 1.50 BAYES_50 Bayes spam probability is 40 to 60% 0.00 HTML_MESSAGE HTML included in message 2.00 HTML_OFF_PAGE HTML element rendered well off the displayed page 0.50 KAM_EU Prevalent use of .eu in spam/malware 0.79 RDNS_NONE Delivered to internal network by a host with no rDNS -2.00 SPF_HELO_PASS SPF: HELO matches SPF record -0.00 SPF_PASS SPF: sender matches SPF record 0.01 T_REMOTE_IMAGE 0.00 UNPARSEABLE_RELAY Informational: message has unparseable relay lines -- Jeremy McSpadden Flux Labs, Inc | http://www.fluxlabs.net | Endless Solutions Office : 850-250-5590 x 501 | Cell : 850-890-2543 | Fax : 850-254-2955 -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150303/48a37e2a/attachment.html From jerry.benton at mailborder.com Tue Mar 3 04:51:27 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Mon, 2 Mar 2015 23:51:27 -0500 Subject: Different SA scan results In-Reply-To: <396FFD7F-35BF-4CB1-89B3-EEECE344C856@fluxlabs.net> References: <5269F9C4-BB61-42C3-AC19-DF9FC3ABC394@fluxlabs.net> <, > <16CE5A4E-0F53-40B5-83C9-DA2827F5B0BE@mailborder.com> <396FFD7F-35BF-4CB1-89B3-EEECE344C856@fluxlabs.net> Message-ID: No. spamassassin -p /etc/MailScanner/spam.assassin.prefs.conf -D < msg - Jerry Benton www.mailborder.com > On Mar 2, 2015, at 10:45 PM, Jeremy McSpadden wrote: > > Not sure what you mean. MS is calling spamassassin ... Shouldn't it be the same scan ? Why would NOT including my prefs.conf file change ? > > -- > Jeremy McSpadden > Flux Labs | http://www.fluxlabs.net | Endless Solutions > Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 > > On Feb 27, 2015, at 1:46 AM, Jerry Benton > wrote: > >> You need to include your /etc/MailScanner/ spam.assassin.prefs.conf in your command to get the same results. >> >> - >> Jerry Benton >> www.mailborder.com >> >> >> >>> On Feb 26, 2015, at 9:12 PM, Jeremy McSpadden > wrote: >>> >>> What would cause an cli scan (spamassassin -D < msg) to have different results than mailscanner scan ? >>> >>> via cli >>> >>> Content analysis details: (26.1 points, 5.0 required) >>> >>> pts rule name description >>> ---- ---------------------- -------------------------------------------------- >>> 3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS >>> [46.105.49.218 listed in zen.spamhaus.org ] >>> 5.0 URIBL_BLACK Contains an URL listed in the URIBL blacklist >>> [URIs: karefon.eu ] >>> 5.0 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist >>> [URIs: karefon.eu ] >>> -2.0 SPF_HELO_PASS SPF: HELO matches SPF record >>> -0.0 SPF_PASS SPF: sender matches SPF record >>> 0.0 HTML_MESSAGE BODY: HTML included in message >>> 1.5 BAYES_50 BODY: Bayes spam probability is 40 to 60% >>> [score: 0.4995] >>> 0.5 KAM_EU RAW: Prevalent use of .eu in spam/malware >>> 5.0 KAM_GRABBAG2 Grabbag of Spams hitting EU domains and other indicators >>> 0.8 RDNS_NONE Delivered to internal network by a host with no rDNS >>> 2.0 HTML_OFF_PAGE HTML element rendered well off the displayed page >>> 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines >>> 5.0 KAM_VERY_BLACK_DBL Email that hits both URIBL Black and Spamhaus DBL >>> 0.0 T_REMOTE_IMAGE Message contains an external image >>> >>> >>> via ms >>> 1.50 >>> BAYES_50 >>> Bayes spam probability is 40 to 60% >>> 0.00 >>> HTML_MESSAGE >>> HTML included in message >>> 2.00 >>> HTML_OFF_PAGE >>> HTML element rendered well off the displayed page >>> 0.50 >>> KAM_EU >>> Prevalent use of .eu in spam/malware >>> 0.79 >>> RDNS_NONE >>> Delivered to internal network by a host with no rDNS >>> -2.00 >>> SPF_HELO_PASS >>> SPF: HELO matches SPF record >>> -0.00 >>> SPF_PASS >>> SPF: sender matches SPF record >>> 0.01 >>> T_REMOTE_IMAGE >>> 0.00 >>> UNPARSEABLE_RELAY >>> Informational: message has unparseable relay lines >>> -- >>> Jeremy McSpadden >>> Flux Labs, Inc | http://www.fluxlabs.net | Endless Solutions >>> Office : 850-250-5590 x 501 | Cell : 850-890-2543 | Fax : 850-254-2955 >>> >>> -- >>> MailScanner mailing list >>> mailscanner at lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150302/a34dba49/attachment.html From jerry.benton at mailborder.com Tue Mar 3 13:08:57 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Tue, 3 Mar 2015 08:08:57 -0500 Subject: Phishing Sites Message-ID: <0717BF01-0B2E-4161-8AE2-F169596E557E@mailborder.com> I spoke with Jules regarding the Phishing sites. We are deprecating the old system. I have rewritten the update script to use: phishing.bad.sites.custom + phishing.bad.sites.conf and phishing.safe.sites.custom + phishing.safe.sites.conf - If the custom file does not exist, it will create it. In this file you would put your custom lists. This removes the problem of my original method where it clobbered any custom entries you had. It is also a lot easier from the administrator end (you) to maintain. - The scripts currently use http://phishing.mailborder.com but that will be moved to http://phishing.mailscanner.info soon. It will not matter which one you use as it will be the same exact thing. - I updated the bad site generator to not include popular URL shortening services like bit.ly and goo.gl. The complete list is on this page: http://phishing.mailborder.com and I will gladly add anything you think should be added. If you already have a large list of safe items, you can email them directly to me in a text file. - The new cron jobs are also here: http://phishing.mailborder.com. These will be included in the next release of MailScanner. - Jerry Benton www.mailborder.com From Denis.Beauchemin at usherbrooke.ca Tue Mar 3 13:56:33 2015 From: Denis.Beauchemin at usherbrooke.ca (Denis Beauchemin) Date: Tue, 3 Mar 2015 13:56:33 +0000 Subject: Cloud-based scanning Message-ID: Hello, We are about to move our MX to the cloud in Microsoft 365. The way it would work would be to scan the emails there and then deliver them to our servers. The problem is that we can't for the moment tell MS365 which email addresses are valid and which are not (the data is in an LDAP server that is not synchronized with our AD). Thus MS365 will be forwarding all harmless emails to our internal servers who will reject invalid email addresses. I seem to remember this is really not a good idea but I can't remember why. Can someone shed some light on this please? Thanks. Denis From James.Nelson at vgt.net Tue Mar 3 14:33:02 2015 From: James.Nelson at vgt.net (James Nelson) Date: Tue, 3 Mar 2015 14:33:02 +0000 Subject: Cloud-based scanning In-Reply-To: References: Message-ID: <3A2560B2-7BDC-439F-85CB-A1D992C9CB40@vgt.net> Denis, I also use office 365 for an edge filtering. Mine is synchronized with my internal active directory via the Microsoft Dirsync tool, but aside from the additional load you will place on your internal servers by not offloading directory based blocking at the office 365 level, there's not technically any harm in what you describe, as long as you configure your internal servers not to send NDRs, which in addition to creating additional traffic can be used by spammers for address validation > On Mar 3, 2015, at 8:22 AM, Denis Beauchemin wrote: > > Hello, > > We are about to move our MX to the cloud in Microsoft 365. The way it would work would be to scan the emails there and then deliver them to our servers. > > The problem is that we can't for the moment tell MS365 which email addresses are valid and which are not (the data is in an LDAP server that is not synchronized with our AD). Thus MS365 will be forwarding all harmless emails to our internal servers who will reject invalid email addresses. > > I seem to remember this is really not a good idea but I can't remember why. Can someone shed some light on this please? > > Thanks. > > Denis > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From Denis.Beauchemin at usherbrooke.ca Tue Mar 3 14:47:52 2015 From: Denis.Beauchemin at usherbrooke.ca (Denis Beauchemin) Date: Tue, 3 Mar 2015 14:47:52 +0000 Subject: Cloud-based scanning In-Reply-To: <3A2560B2-7BDC-439F-85CB-A1D992C9CB40@vgt.net> References: <3A2560B2-7BDC-439F-85CB-A1D992C9CB40@vgt.net> Message-ID: James, Thanks for the info. But if my servers don't send NDRs, people who make a typo in the email address of one of our users won't be notified of the error and will not be able to retry with the correct email address... This is not desirable but on the other hand you are right about address harvesting. And if my servers do send NDRs they could be used to joe-job some poor pal. I don't really like both avenues... Thanks. Denis -----Message d'origine----- De?: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] De la part de James Nelson Envoy??: 3 mars 2015 09:41 ??: MailScanner discussion Objet?: Re: Cloud-based scanning Denis, I also use office 365 for an edge filtering. Mine is synchronized with my internal active directory via the Microsoft Dirsync tool, but aside from the additional load you will place on your internal servers by not offloading directory based blocking at the office 365 level, there's not technically any harm in what you describe, as long as you configure your internal servers not to send NDRs, which in addition to creating additional traffic can be used by spammers for address validation > On Mar 3, 2015, at 8:22 AM, Denis Beauchemin wrote: > > Hello, > > We are about to move our MX to the cloud in Microsoft 365. The way it would work would be to scan the emails there and then deliver them to our servers. > > The problem is that we can't for the moment tell MS365 which email addresses are valid and which are not (the data is in an LDAP server that is not synchronized with our AD). Thus MS365 will be forwarding all harmless emails to our internal servers who will reject invalid email addresses. > > I seem to remember this is really not a good idea but I can't remember why. Can someone shed some light on this please? > > Thanks. > > Denis > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From jerry.benton at mailborder.com Tue Mar 3 15:16:10 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Tue, 3 Mar 2015 10:16:10 -0500 Subject: Cloud-based scanning In-Reply-To: <3A2560B2-7BDC-439F-85CB-A1D992C9CB40@vgt.net> References: <3A2560B2-7BDC-439F-85CB-A1D992C9CB40@vgt.net> Message-ID: Or just enable recipient verification on your end and let 365 deal with the backscatter. - Jerry Benton www.mailborder.com > On Mar 3, 2015, at 9:33 AM, James Nelson wrote: > > Denis, > > I also use office 365 for an edge filtering. Mine is synchronized with my internal active directory via the Microsoft Dirsync tool, but aside from the additional load you will place on your internal servers by not offloading directory based blocking at the office 365 level, there's not technically any harm in what you describe, as long as you configure your internal servers not to send NDRs, which in addition to creating additional traffic can be used by spammers for address validation > >> On Mar 3, 2015, at 8:22 AM, Denis Beauchemin wrote: >> >> Hello, >> >> We are about to move our MX to the cloud in Microsoft 365. The way it would work would be to scan the emails there and then deliver them to our servers. >> >> The problem is that we can't for the moment tell MS365 which email addresses are valid and which are not (the data is in an LDAP server that is not synchronized with our AD). Thus MS365 will be forwarding all harmless emails to our internal servers who will reject invalid email addresses. >> >> I seem to remember this is really not a good idea but I can't remember why. Can someone shed some light on this please? >> >> Thanks. >> >> Denis >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From glenn.steen at gmail.com Tue Mar 3 15:25:30 2015 From: glenn.steen at gmail.com (Glenn Steen) Date: Tue, 3 Mar 2015 16:25:30 +0100 Subject: Different SA scan results In-Reply-To: References: <5269F9C4-BB61-42C3-AC19-DF9FC3ABC394@fluxlabs.net> <16CE5A4E-0F53-40B5-83C9-DA2827F5B0BE@mailborder.com> <396FFD7F-35BF-4CB1-89B3-EEECE344C856@fluxlabs.net> Message-ID: Actually.... The spa.-assassin.prefs.conf should already be "included" in all SA calls via the /etc/mail/spamassassin/mailscanner.cf symbolic link, so you should not need to include it in any other way (I think the "-p" option is more or less wrong anyway, since it is a cf file, not really a prefs file). So check that symlink... Usually differences between scans as done by MailScanner and done from the cli fall into two (well, three, counting the possible omission of the mailscanner.cf symlink categories): - Time has passed between invocation one and invocation two, meaning that things like digest tests and BLs will fire differently (as mentioned previously) - Different users "get" different result: If you have a run as user = postfix, for example, you might get a different Bayes (file) database etc. Also, if you normally run MS as a non-privileged user, you might actually have a problem reaching all the SA config your root user would. If the latter case is true, simply run your cli invocation logged on as postfix ("su - postfix -s /bin/bash" or somesuch, then do the spamassasin thing, lint or whatever). Cheers! -- -- Glenn On 3 March 2015 at 05:51, Jerry Benton wrote: > No. > > spamassassin -p /etc/MailScanner/spam.assassin.prefs.conf -D < msg > > - > Jerry Benton > www.mailborder.com > > > > On Mar 2, 2015, at 10:45 PM, Jeremy McSpadden wrote: > > Not sure what you mean. MS is calling spamassassin ... Shouldn't it be the > same scan ? Why would NOT including my prefs.conf file change ? > > -- > Jeremy McSpadden > Flux Labs | http://www.fluxlabs.net | Endless Solutions > Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 > > On Feb 27, 2015, at 1:46 AM, Jerry Benton > wrote: > > You need to include your /etc/MailScanner/ spam.assassin.prefs.conf in your > command to get the same results. > > - > Jerry Benton > www.mailborder.com > > > > On Feb 26, 2015, at 9:12 PM, Jeremy McSpadden wrote: > > What would cause an cli scan (spamassassin -D < msg) to have different > results than mailscanner scan ? > > via cli > > Content analysis details: (26.1 points, 5.0 required) > > pts rule name description > ---- ---------------------- > -------------------------------------------------- > 3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS > [46.105.49.218 listed in zen.spamhaus.org] > 5.0 URIBL_BLACK Contains an URL listed in the URIBL blacklist > [URIs: karefon.eu] > 5.0 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist > [URIs: karefon.eu] > -2.0 SPF_HELO_PASS SPF: HELO matches SPF record > -0.0 SPF_PASS SPF: sender matches SPF record > 0.0 HTML_MESSAGE BODY: HTML included in message > 1.5 BAYES_50 BODY: Bayes spam probability is 40 to 60% > [score: 0.4995] > 0.5 KAM_EU RAW: Prevalent use of .eu in spam/malware > 5.0 KAM_GRABBAG2 Grabbag of Spams hitting EU domains and other > indicators > 0.8 RDNS_NONE Delivered to internal network by a host with no > rDNS > 2.0 HTML_OFF_PAGE HTML element rendered well off the displayed > page > 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay > lines > 5.0 KAM_VERY_BLACK_DBL Email that hits both URIBL Black and Spamhaus > DBL > 0.0 T_REMOTE_IMAGE Message contains an external image > > > via ms > 1.50 > BAYES_50 > Bayes spam probability is 40 to 60% > 0.00 > HTML_MESSAGE > HTML included in message > 2.00 > HTML_OFF_PAGE > HTML element rendered well off the displayed page > 0.50 > KAM_EU > Prevalent use of .eu in spam/malware > 0.79 > RDNS_NONE > Delivered to internal network by a host with no rDNS > -2.00 > SPF_HELO_PASS > SPF: HELO matches SPF record > -0.00 > SPF_PASS > SPF: sender matches SPF record > 0.01 > T_REMOTE_IMAGE > 0.00 > UNPARSEABLE_RELAY > Informational: message has unparseable relay lines > -- > Jeremy McSpadden > Flux Labs, Inc | http://www.fluxlabs.net | Endless Solutions > Office : 850-250-5590 x 501 | Cell : 850-890-2543 | Fax : 850-254-2955 > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From glenn.steen at gmail.com Tue Mar 3 15:36:54 2015 From: glenn.steen at gmail.com (Glenn Steen) Date: Tue, 3 Mar 2015 16:36:54 +0100 Subject: Cloud-based scanning In-Reply-To: References: <3A2560B2-7BDC-439F-85CB-A1D992C9CB40@vgt.net> Message-ID: Well, one problem with doing most any rejections "after the fact" is that you may become a "spam reflector", apart from the efficiecy argument (rejections are a LOT cheaper than bounces;-). ISTR there being a lot of discussion about this about... Ohh... 6? years ago. There were some trends in how spammers crafted their filth back then ("joe jobs" etc) that made rejections particularily attractive. I suppose nothing really has changed on that account. Cheers! -- -- Glenn On 3 March 2015 at 15:47, Denis Beauchemin wrote: > James, > > Thanks for the info. But if my servers don't send NDRs, people who make a typo in the email address of one of our users won't be notified of the error and will not be able to retry with the correct email address... This is not desirable but on the other hand you are right about address harvesting. And if my servers do send NDRs they could be used to joe-job some poor pal. > > I don't really like both avenues... > > Thanks. > > Denis > > -----Message d'origine----- > De : mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] De la part de James Nelson > Envoy? : 3 mars 2015 09:41 > ? : MailScanner discussion > Objet : Re: Cloud-based scanning > > Denis, > > I also use office 365 for an edge filtering. Mine is synchronized with my internal active directory via the Microsoft Dirsync tool, but aside from the additional load you will place on your internal servers by not offloading directory based blocking at the office 365 level, there's not technically any harm in what you describe, as long as you configure your internal servers not to send NDRs, which in addition to creating additional traffic can be used by spammers for address validation > >> On Mar 3, 2015, at 8:22 AM, Denis Beauchemin wrote: >> >> Hello, >> >> We are about to move our MX to the cloud in Microsoft 365. The way it would work would be to scan the emails there and then deliver them to our servers. >> >> The problem is that we can't for the moment tell MS365 which email addresses are valid and which are not (the data is in an LDAP server that is not synchronized with our AD). Thus MS365 will be forwarding all harmless emails to our internal servers who will reject invalid email addresses. >> >> I seem to remember this is really not a good idea but I can't remember why. Can someone shed some light on this please? >> >> Thanks. >> >> Denis >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From J.Ede at birchenallhowden.co.uk Tue Mar 3 15:49:39 2015 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Tue, 3 Mar 2015 15:49:39 +0000 Subject: Cloud-based scanning In-Reply-To: References: <3A2560B2-7BDC-439F-85CB-A1D992C9CB40@vgt.net> Message-ID: It's one argument that made greylisting so attractive for a long while (and I think the argument still holds)... Steve Freegard of FSL published this... http://www.fortantispam.com/wp-content/uploads/2013/02/greylisting_whitepaper.pdf Jason > -----Original Message----- > From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- > bounces at lists.mailscanner.info] On Behalf Of Glenn Steen > Sent: 03 March 2015 15:37 > To: MailScanner discussion > Subject: Re: Cloud-based scanning > > Well, one problem with doing most any rejections "after the fact" is that you > may become a "spam reflector", apart from the efficiecy argument > (rejections are a LOT cheaper than bounces;-). > ISTR there being a lot of discussion about this about... Ohh... 6? > years ago. There were some trends in how spammers crafted their filth back > then ("joe jobs" etc) that made rejections particularily attractive. I suppose > nothing really has changed on that account. > > Cheers! > > -- > -- Glenn > > On 3 March 2015 at 15:47, Denis Beauchemin > wrote: > > James, > > > > Thanks for the info. But if my servers don't send NDRs, people who make a > typo in the email address of one of our users won't be notified of the error > and will not be able to retry with the correct email address... This is not > desirable but on the other hand you are right about address harvesting. And > if my servers do send NDRs they could be used to joe-job some poor pal. > > > > I don't really like both avenues... > > > > Thanks. > > > > Denis > > > > -----Message d'origine----- > > De : mailscanner-bounces at lists.mailscanner.info > > [mailto:mailscanner-bounces at lists.mailscanner.info] De la part de > > James Nelson Envoy? : 3 mars 2015 09:41 ? : MailScanner discussion > > Objet : Re: Cloud-based scanning > > > > Denis, > > > > I also use office 365 for an edge filtering. Mine is synchronized with > > my internal active directory via the Microsoft Dirsync tool, but aside > > from the additional load you will place on your internal servers by > > not offloading directory based blocking at the office 365 level, > > there's not technically any harm in what you describe, as long as you > > configure your internal servers not to send NDRs, which in addition to > > creating additional traffic can be used by spammers for address > > validation > > > >> On Mar 3, 2015, at 8:22 AM, Denis Beauchemin > wrote: > >> > >> Hello, > >> > >> We are about to move our MX to the cloud in Microsoft 365. The way it > would work would be to scan the emails there and then deliver them to our > servers. > >> > >> The problem is that we can't for the moment tell MS365 which email > addresses are valid and which are not (the data is in an LDAP server that is > not synchronized with our AD). Thus MS365 will be forwarding all harmless > emails to our internal servers who will reject invalid email addresses. > >> > >> I seem to remember this is really not a good idea but I can't remember > why. Can someone shed some light on this please? > >> > >> Thanks. > >> > >> Denis > >> -- > >> MailScanner mailing list > >> mailscanner at lists.mailscanner.info > >> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >> > >> Before posting, read http://wiki.mailscanner.info/posting > >> > >> Support MailScanner development - buy the book off the website! > > -- > > MailScanner mailing list > > mailscanner at lists.mailscanner.info > > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > > > Before posting, read http://wiki.mailscanner.info/posting > > > > Support MailScanner development - buy the book off the website! > > -- > > MailScanner mailing list > > mailscanner at lists.mailscanner.info > > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > > > Before posting, read http://wiki.mailscanner.info/posting > > > > Support MailScanner development - buy the book off the website! > > > > -- > -- Glenn > email: glenn < dot > steen < at > gmail < dot > com > work: glenn < dot > steen < at > ap1 < dot > se > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From steve.freegard at fsl.com Tue Mar 3 17:54:13 2015 From: steve.freegard at fsl.com (Steve Freegard) Date: Tue, 03 Mar 2015 17:54:13 +0000 Subject: Cloud-based scanning In-Reply-To: References: <54F5F545.4030201@fsl.com> Message-ID: Hi Denis, On 03/03/15 13:56, Denis Beauchemin wrote: > Hello, > > We are about to move our MX to the cloud in Microsoft 365. The way it would work would be to scan the emails there and then deliver them to our servers. > > The problem is that we can't for the moment tell MS365 which email addresses are valid and which are not (the data is in an LDAP server that is not synchronized with our AD). Thus MS365 will be forwarding all harmless emails to our internal servers who will reject invalid email addresses. > > I seem to remember this is really not a good idea but I can't remember why. Can someone shed some light on this please? > > Thanks. > > Denis > It depends if the MX is queue-and-forward or a proxy type. For a proxy - this situation wouldn't be an issue, provided your backend servers reject the recipients, it will reject them as a proxy would simply man-in-the-middle the SMTP conversation filtering the bad stuff. The issue with that method is that it's not particularly efficient. If they're a queue-and-forward type, then they'll be accepting the message (e.g. sending a '250 queued id=....' at the end of data) and then delivering the message to your backends afterwards. This is more common and where the problems are: 1) In SMTP - once you've accepted the message you have the responsibility to either deliver the message to it's destination or to bounce it back to the return-path. As we all know, the return-path is trivial to forge and therefore this causes backscatter from the MX. 2) Wasted resources on the MX. Scanning mail for recipients that are simply going to be rejected at delivery is a waste of I/O. Both can be considerable issues considering that invalid recipients can outweigh the valid on some domains. As you're paying Microsoft to deal with this - you might not really care about either (in my experience most people don't). Their mitigation for 1) might be that they simply never send bounces in this case - that's bad for your users because if someone genuinely misaddresses a message then they don't get a bounce and never know that it wasn't delivered (e.g. it goes down a black hole). You'd have to check the Microsoft terms of service to see what they have to say about both of these. Kind regards, Steve. From Denis.Beauchemin at usherbrooke.ca Tue Mar 3 18:13:31 2015 From: Denis.Beauchemin at usherbrooke.ca (Denis Beauchemin) Date: Tue, 3 Mar 2015 18:13:31 +0000 Subject: Cloud-based scanning In-Reply-To: References: <54F5F545.4030201@fsl.com> Message-ID: Thanks Steve and all the others. My server will act as a proxy and will reject invalid addresses in the connect phase so I should be safe. I will be testing this RSN with an alternate domain name, in case something goes wrong... Denis -----Message d'origine----- De?: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] De la part de Steve Freegard Envoy??: 3 mars 2015 13:02 ??: MailScanner discussion Objet?: Re: Cloud-based scanning Hi Denis, On 03/03/15 13:56, Denis Beauchemin wrote: > Hello, > > We are about to move our MX to the cloud in Microsoft 365. The way it would work would be to scan the emails there and then deliver them to our servers. > > The problem is that we can't for the moment tell MS365 which email addresses are valid and which are not (the data is in an LDAP server that is not synchronized with our AD). Thus MS365 will be forwarding all harmless emails to our internal servers who will reject invalid email addresses. > > I seem to remember this is really not a good idea but I can't remember why. Can someone shed some light on this please? > > Thanks. > > Denis > It depends if the MX is queue-and-forward or a proxy type. For a proxy - this situation wouldn't be an issue, provided your backend servers reject the recipients, it will reject them as a proxy would simply man-in-the-middle the SMTP conversation filtering the bad stuff. The issue with that method is that it's not particularly efficient. If they're a queue-and-forward type, then they'll be accepting the message (e.g. sending a '250 queued id=....' at the end of data) and then delivering the message to your backends afterwards. This is more common and where the problems are: 1) In SMTP - once you've accepted the message you have the responsibility to either deliver the message to it's destination or to bounce it back to the return-path. As we all know, the return-path is trivial to forge and therefore this causes backscatter from the MX. 2) Wasted resources on the MX. Scanning mail for recipients that are simply going to be rejected at delivery is a waste of I/O. Both can be considerable issues considering that invalid recipients can outweigh the valid on some domains. As you're paying Microsoft to deal with this - you might not really care about either (in my experience most people don't). Their mitigation for 1) might be that they simply never send bounces in this case - that's bad for your users because if someone genuinely misaddresses a message then they don't get a bounce and never know that it wasn't delivered (e.g. it goes down a black hole). You'd have to check the Microsoft terms of service to see what they have to say about both of these. Kind regards, Steve. -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From steve.freegard at fsl.com Tue Mar 3 23:08:04 2015 From: steve.freegard at fsl.com (Steve Freegard) Date: Tue, 03 Mar 2015 23:08:04 +0000 Subject: Cloud-based scanning In-Reply-To: References: <54F5F545.4030201@fsl.com> <54F63ED4.6080901@fsl.com> Message-ID: Denis, On 03/03/15 18:13, Denis Beauchemin wrote: > Thanks Steve and all the others. No problem - you're welcome. > My server will act as a proxy and will reject invalid addresses in the connect phase so I should be safe. I will be testing this RSN with an alternate domain name, in case something goes wrong... It will be interesting to see whether Microsoft will actually ask it like this (e.g. in a call-ahead style). What I suspect will happen is that Microsoft will actually accept mail to unknown recipients and then bounce it when the delivery is attempted to you later. I'd be interested to hear your results and experiences once you've switched over your initial test domain. Kind regards, Steve. From ryan.virgo at gmail.com Wed Mar 4 10:22:49 2015 From: ryan.virgo at gmail.com (Ryan Braganza) Date: Wed, 4 Mar 2015 15:52:49 +0530 Subject: High score mails get delivered Message-ID: Anyone has faced this issue before? The spam actions in the logs say "actions are store" based on the rules but the mail still gets delivered. I have noticed this happens with mails haveing a blank message id Mar 4 14:14:57 server1 postfix_spam2/smtpd[45570]: 087F2E8798D: client=unknown[192.200.112.35] Mar 4 14:14:58 server1 postfix_spam2/cleanup[45635]: 087F2E8798D: *message-id=<>* Mar 4 14:15:10 server1 MailScanner[46543]: Message 087F2E8798D.A5923 from 192.200.112.35 (mary at rolipvc.net) to abcd.com is spam, CTSCORE : 0 str=0001.0A160201.54F6C615.0076,ss=1,re=0.001,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, SpamAssassin (not cached, score=10.146, required 5, BOTNET 2.00, DEAR_SOMETHING 0.10, DKIM_ADSP_NXDOMAIN 0.80, FSL_HELO_NON_FQDN_1 0.00, HTML_MESSAGE 0.00, HTTP_ESCAPED_HOST 1.62, MIME_HEADER_CTYPE_ONLY 2.00, MIME_HTML_ONLY 0.10, MISSING_MID 0.14, NO_DNS_FOR_FROM 0.80, RDNS_NONE 1.27, URI_HEX 1.31) Mar 4 14:15:10 server1 MailScanner[46543]: *Spam Actions: message 087F2E8798D.A5923 actions3 are store* Mar 4 14:18:15 server1 postfix_spam2/qmgr[2533]: 087F2E8798D: from= , size=13333, nrcpt=1 (queue active) Mar 4 14:18:16 server1 postfix_spam2/smtp[2543]: *087F2E8798D: to= , relay=relay.myserver.com [x.x.x.x]:25, delay=200, delays=199/0.05/0.58/0.68, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 3D40B344FF4)* Any idea? Mailscanner 0.77 version mailscanner-4.84.6-1.noarch -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150304/90c3322b/attachment.html From J.Ede at birchenallhowden.co.uk Thu Mar 5 07:55:30 2015 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Thu, 5 Mar 2015 07:55:30 +0000 Subject: MailScanner v4.85.1-1 Final - RPM Release In-Reply-To: <326C0DFB-7412-4A70-9C37-EF2682BEABBB@mailborder.com> References: <326C0DFB-7412-4A70-9C37-EF2682BEABBB@mailborder.com> Message-ID: I think I found a bug in this release... If an email causes MS to crash too many times then it can't seem to quarantine it correctly... Looks like it's a path issue... Came in this morning to find a massive queue with MS going round and round trying to quarantine this one email... Warning: skipping message 61784180066.AE5C7 as it has been attempted too many times Mar 5 07:50:49 gateway MailScanner[26060]: Quarantined message 61784180066.AE5C7 as it caused MailScanner to crash several times Mar 5 07:50:49 gateway MailScanner[26060]: Saved entire message to /var/spool/MailScanner/quarantine/20150305/61784180066.AE5C7 Mar 5 07:50:49 gateway MailScanner[26060]: writing to /var/spool/MailScanner/quarantine/20150305/61784180066.AE5C7//var/spool/MailScanner/quarantine/20150305/61784180066.AE5C7: No such file or directory Jason -----Original Message----- From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jerry Benton Sent: 21 February 2015 12:07 To: MailScanner discussion Subject: MailScanner v4.85.1-1 Final - RPM Release This is the final for the release of MailScanner v4.85.1-1 for RPM based distributions. I am working on the tarball source installer now. This RPM version will get posted on the MailScanner website once I get access from Jules. I will send a separate email when the tarball source installer is ready. RPM Package: https://s3.amazonaws.com/mailscanner/release/v4/rpm/MailScanner-4.85.1-1.rpm.tar.gz MD5 Sum: https://s3.amazonaws.com/mailscanner/release/v4/rpm/MailScanner-4.85.1-1.md5sum - Jerry Benton www.mailborder.com -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From jerry.benton at mailborder.com Thu Mar 5 08:52:41 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Thu, 5 Mar 2015 03:52:41 -0500 Subject: MailScanner v4.85.1-1 Final - RPM Release In-Reply-To: References: <326C0DFB-7412-4A70-9C37-EF2682BEABBB@mailborder.com> Message-ID: <963846AE-8E21-42F3-8D9C-534601196E61@mailborder.com> I?ll have to do some review. The code in this release remains mostly unchanged aside from bug fixes. Anyone else seeing this? - Jerry Benton www.mailborder.com > On Mar 5, 2015, at 2:55 AM, Jason Ede wrote: > > I think I found a bug in this release... > > If an email causes MS to crash too many times then it can't seem to quarantine it correctly... Looks like it's a path issue... > > Came in this morning to find a massive queue with MS going round and round trying to quarantine this one email... > > Warning: skipping message 61784180066.AE5C7 as it has been attempted too many times > Mar 5 07:50:49 gateway MailScanner[26060]: Quarantined message 61784180066.AE5C7 as it caused MailScanner to crash several times > Mar 5 07:50:49 gateway MailScanner[26060]: Saved entire message to /var/spool/MailScanner/quarantine/20150305/61784180066.AE5C7 > Mar 5 07:50:49 gateway MailScanner[26060]: writing to /var/spool/MailScanner/quarantine/20150305/61784180066.AE5C7//var/spool/MailScanner/quarantine/20150305/61784180066.AE5C7: No such file or directory > > Jason > > -----Original Message----- > From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jerry Benton > Sent: 21 February 2015 12:07 > To: MailScanner discussion > Subject: MailScanner v4.85.1-1 Final - RPM Release > > This is the final for the release of MailScanner v4.85.1-1 for RPM based distributions. I am working on the tarball source installer now. This RPM version will get posted on the MailScanner website once I get access from Jules. I will send a separate email when the tarball source installer is ready. > > > RPM Package: https://s3.amazonaws.com/mailscanner/release/v4/rpm/MailScanner-4.85.1-1.rpm.tar.gz > > MD5 Sum: https://s3.amazonaws.com/mailscanner/release/v4/rpm/MailScanner-4.85.1-1.md5sum > > - > Jerry Benton > www.mailborder.com > > > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From jerry.benton at mailborder.com Thu Mar 5 09:03:45 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Thu, 5 Mar 2015 04:03:45 -0500 Subject: MailScanner v4.85.1-1 Final - RPM Release In-Reply-To: References: <326C0DFB-7412-4A70-9C37-EF2682BEABBB@mailborder.com> Message-ID: <705EB9D8-7B48-4EDE-B8DB-E316AA3540B5@mailborder.com> Jason, It might be the PFDiskStore.pm. Check yours around line 631. It should look like the one below where $targetfile is different. https://github.com/MailScanner/v4/blob/master/mailscanner/bin/MailScanner/PFDiskStore.pm - Jerry Benton www.mailborder.com > On Mar 5, 2015, at 2:55 AM, Jason Ede wrote: > > Saved entire message to From J.Ede at birchenallhowden.co.uk Thu Mar 5 09:04:50 2015 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Thu, 5 Mar 2015 09:04:50 +0000 Subject: MailScanner v4.85.1-1 Final - RPM Release In-Reply-To: <963846AE-8E21-42F3-8D9C-534601196E61@mailborder.com> References: <326C0DFB-7412-4A70-9C37-EF2682BEABBB@mailborder.com> <963846AE-8E21-42F3-8D9C-534601196E61@mailborder.com> Message-ID: I dropped down to the last version I was using and it fixed the issue. (4.83.5) Jason -----Original Message----- From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jerry Benton Sent: 05 March 2015 08:53 To: MailScanner discussion Subject: Re: MailScanner v4.85.1-1 Final - RPM Release I?ll have to do some review. The code in this release remains mostly unchanged aside from bug fixes. Anyone else seeing this? - Jerry Benton www.mailborder.com > On Mar 5, 2015, at 2:55 AM, Jason Ede wrote: > > I think I found a bug in this release... > > If an email causes MS to crash too many times then it can't seem to quarantine it correctly... Looks like it's a path issue... > > Came in this morning to find a massive queue with MS going round and round trying to quarantine this one email... > > Warning: skipping message 61784180066.AE5C7 as it has been attempted > too many times Mar 5 07:50:49 gateway MailScanner[26060]: Quarantined > message 61784180066.AE5C7 as it caused MailScanner to crash several > times Mar 5 07:50:49 gateway MailScanner[26060]: Saved entire message > to /var/spool/MailScanner/quarantine/20150305/61784180066.AE5C7 > Mar 5 07:50:49 gateway MailScanner[26060]: writing to > /var/spool/MailScanner/quarantine/20150305/61784180066.AE5C7//var/spoo > l/MailScanner/quarantine/20150305/61784180066.AE5C7: No such file or > directory > > Jason > > -----Original Message----- > From: mailscanner-bounces at lists.mailscanner.info > [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jerry > Benton > Sent: 21 February 2015 12:07 > To: MailScanner discussion > Subject: MailScanner v4.85.1-1 Final - RPM Release > > This is the final for the release of MailScanner v4.85.1-1 for RPM based distributions. I am working on the tarball source installer now. This RPM version will get posted on the MailScanner website once I get access from Jules. I will send a separate email when the tarball source installer is ready. > > > RPM Package: > https://s3.amazonaws.com/mailscanner/release/v4/rpm/MailScanner-4.85.1 > -1.rpm.tar.gz > > MD5 Sum: > https://s3.amazonaws.com/mailscanner/release/v4/rpm/MailScanner-4.85.1 > -1.md5sum > > - > Jerry Benton > www.mailborder.com > > > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From michele.schillaci at bmservice.it Thu Mar 5 09:09:14 2015 From: michele.schillaci at bmservice.it (Michele Schillaci) Date: Thu, 5 Mar 2015 09:09:14 +0000 Subject: Mailborder as full mail server Message-ID: Hi there, i know that maybe isn't the right place to ask this but i'll try: any plans to make a mailborder installation act like a real mail server? Sorry if I'm mistaken. Michele Schillaci [Descrizione: cid:image001.jpg at 01CA5187.EDADB6E0] BM SERVICE s.r.l. Via Della Salute n. 16/5/6 40132 Bologna Tel. 051.406092 Fax 051.403111 -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150305/0c2d4b64/attachment.html -------------- next part -------------- A non-text attachment was scrubbed... Name: image001.jpg Type: image/jpeg Size: 2432 bytes Desc: image001.jpg Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150305/0c2d4b64/attachment.jpg From jerry.benton at mailborder.com Thu Mar 5 09:43:45 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Thu, 5 Mar 2015 04:43:45 -0500 Subject: MailScanner v4.85.1-1 Final - RPM Release In-Reply-To: References: <326C0DFB-7412-4A70-9C37-EF2682BEABBB@mailborder.com> <963846AE-8E21-42F3-8D9C-534601196E61@mailborder.com> Message-ID: <61FFFAC6-9A02-43A5-B2C4-63014CC6FEFF@mailborder.com> Jason, Could you compare the PFDiskStore.pm ? - Jerry Benton www.mailborder.com > On Mar 5, 2015, at 4:04 AM, Jason Ede wrote: > > I dropped down to the last version I was using and it fixed the issue. (4.83.5) > > Jason > > -----Original Message----- > From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jerry Benton > Sent: 05 March 2015 08:53 > To: MailScanner discussion > Subject: Re: MailScanner v4.85.1-1 Final - RPM Release > > I?ll have to do some review. The code in this release remains mostly unchanged aside from bug fixes. Anyone else seeing this? > > > > - > Jerry Benton > www.mailborder.com > > > >> On Mar 5, 2015, at 2:55 AM, Jason Ede wrote: >> >> I think I found a bug in this release... >> >> If an email causes MS to crash too many times then it can't seem to quarantine it correctly... Looks like it's a path issue... >> >> Came in this morning to find a massive queue with MS going round and round trying to quarantine this one email... >> >> Warning: skipping message 61784180066.AE5C7 as it has been attempted >> too many times Mar 5 07:50:49 gateway MailScanner[26060]: Quarantined >> message 61784180066.AE5C7 as it caused MailScanner to crash several >> times Mar 5 07:50:49 gateway MailScanner[26060]: Saved entire message >> to /var/spool/MailScanner/quarantine/20150305/61784180066.AE5C7 >> Mar 5 07:50:49 gateway MailScanner[26060]: writing to >> /var/spool/MailScanner/quarantine/20150305/61784180066.AE5C7//var/spoo >> l/MailScanner/quarantine/20150305/61784180066.AE5C7: No such file or >> directory >> >> Jason >> >> -----Original Message----- >> From: mailscanner-bounces at lists.mailscanner.info >> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jerry >> Benton >> Sent: 21 February 2015 12:07 >> To: MailScanner discussion >> Subject: MailScanner v4.85.1-1 Final - RPM Release >> >> This is the final for the release of MailScanner v4.85.1-1 for RPM based distributions. I am working on the tarball source installer now. This RPM version will get posted on the MailScanner website once I get access from Jules. I will send a separate email when the tarball source installer is ready. >> >> >> RPM Package: >> https://s3.amazonaws.com/mailscanner/release/v4/rpm/MailScanner-4.85.1 >> -1.rpm.tar.gz >> >> MD5 Sum: >> https://s3.amazonaws.com/mailscanner/release/v4/rpm/MailScanner-4.85.1 >> -1.md5sum >> >> - >> Jerry Benton >> www.mailborder.com >> >> >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From jerry.benton at mailborder.com Thu Mar 5 09:46:40 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Thu, 5 Mar 2015 04:46:40 -0500 Subject: Mailborder as full mail server In-Reply-To: References: Message-ID: <07C7524A-398E-4000-B83A-7218343F8250@mailborder.com> Michele, Mailborder is a mail gateway, not a mail server. However, sometime in the future I may explore the option of adding that capability into a separate Mailborder product that could attach to the Mailborder cluster. In the future, the Mailborder website would be a better place for questions about Mailborder, or you can just email me directly. - Jerry Benton www.mailborder.com > On Mar 5, 2015, at 4:09 AM, Michele Schillaci wrote: > > Hi there, i know that maybe isn?t the right place to ask this but i?ll try: any plans to make a mailborder installation act like a real mail server? > Sorry if I?m mistaken. > > Michele Schillaci > > > BM SERVICE s.r.l. > Via Della Salute n. 16/5/6 > 40132 Bologna > Tel. 051.406092 Fax 051.403111 > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150305/e1a210d4/attachment.html From michele.schillaci at bmservice.it Thu Mar 5 09:56:30 2015 From: michele.schillaci at bmservice.it (Michele Schillaci) Date: Thu, 5 Mar 2015 09:56:30 +0000 Subject: R: Mailborder as full mail server In-Reply-To: <07C7524A-398E-4000-B83A-7218343F8250@mailborder.com> References: <07C7524A-398E-4000-B83A-7218343F8250@mailborder.com> Message-ID: Sorry, i?ll mail you directly next time. Thanks for your reply. Da: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] Per conto di Jerry Benton Inviato: gioved? 5 marzo 2015 10:47 A: MailScanner discussion Oggetto: Re: Mailborder as full mail server Michele, Mailborder is a mail gateway, not a mail server. However, sometime in the future I may explore the option of adding that capability into a separate Mailborder product that could attach to the Mailborder cluster. In the future, the Mailborder website would be a better place for questions about Mailborder, or you can just email me directly. - Jerry Benton www.mailborder.com On Mar 5, 2015, at 4:09 AM, Michele Schillaci > wrote: Hi there, i know that maybe isn?t the right place to ask this but i?ll try: any plans to make a mailborder installation act like a real mail server? Sorry if I?m mistaken. Michele Schillaci BM SERVICE s.r.l. Via Della Salute n. 16/5/6 40132 Bologna Tel. 051.406092 Fax 051.403111 -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150305/99fb28fd/attachment.html From sylvain at opensource-expert.com Thu Mar 5 11:34:01 2015 From: sylvain at opensource-expert.com (Sylvain Viart) Date: Thu, 05 Mar 2015 12:34:01 +0100 Subject: filename.rules.conf reload and tests Message-ID: <54F83F29.8050304@opensource-expert.com> Hi, I would like to modify MailScanner so that it reloads pattern in filenames.rules.conf dynamically without reload. Also, there's no test suite, is there a plan to put the code under test? Regards, Sylvain. From J.Ede at birchenallhowden.co.uk Thu Mar 5 14:27:16 2015 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Thu, 5 Mar 2015 14:27:16 +0000 Subject: MailScanner v4.85.1-1 Final - RPM Release In-Reply-To: <61FFFAC6-9A02-43A5-B2C4-63014CC6FEFF@mailborder.com> References: <326C0DFB-7412-4A70-9C37-EF2682BEABBB@mailborder.com> <963846AE-8E21-42F3-8D9C-534601196E61@mailborder.com> <61FFFAC6-9A02-43A5-B2C4-63014CC6FEFF@mailborder.com> Message-ID: Jerry, The version I have here (on older version of MS) is different from that one. Jason -----Original Message----- From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jerry Benton Sent: 05 March 2015 09:44 To: MailScanner discussion Subject: Re: MailScanner v4.85.1-1 Final - RPM Release Jason, Could you compare the PFDiskStore.pm ? - Jerry Benton www.mailborder.com > On Mar 5, 2015, at 4:04 AM, Jason Ede wrote: > > I dropped down to the last version I was using and it fixed the issue. > (4.83.5) > > Jason > > -----Original Message----- > From: mailscanner-bounces at lists.mailscanner.info > [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jerry > Benton > Sent: 05 March 2015 08:53 > To: MailScanner discussion > Subject: Re: MailScanner v4.85.1-1 Final - RPM Release > > I?ll have to do some review. The code in this release remains mostly unchanged aside from bug fixes. Anyone else seeing this? > > > > - > Jerry Benton > www.mailborder.com > > > >> On Mar 5, 2015, at 2:55 AM, Jason Ede wrote: >> >> I think I found a bug in this release... >> >> If an email causes MS to crash too many times then it can't seem to quarantine it correctly... Looks like it's a path issue... >> >> Came in this morning to find a massive queue with MS going round and round trying to quarantine this one email... >> >> Warning: skipping message 61784180066.AE5C7 as it has been attempted >> too many times Mar 5 07:50:49 gateway MailScanner[26060]: >> Quarantined message 61784180066.AE5C7 as it caused MailScanner to >> crash several times Mar 5 07:50:49 gateway MailScanner[26060]: Saved >> entire message to >> /var/spool/MailScanner/quarantine/20150305/61784180066.AE5C7 >> Mar 5 07:50:49 gateway MailScanner[26060]: writing to >> /var/spool/MailScanner/quarantine/20150305/61784180066.AE5C7//var/spo >> o >> l/MailScanner/quarantine/20150305/61784180066.AE5C7: No such file or >> directory >> >> Jason >> >> -----Original Message----- >> From: mailscanner-bounces at lists.mailscanner.info >> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of >> Jerry Benton >> Sent: 21 February 2015 12:07 >> To: MailScanner discussion >> Subject: MailScanner v4.85.1-1 Final - RPM Release >> >> This is the final for the release of MailScanner v4.85.1-1 for RPM based distributions. I am working on the tarball source installer now. This RPM version will get posted on the MailScanner website once I get access from Jules. I will send a separate email when the tarball source installer is ready. >> >> >> RPM Package: >> https://s3.amazonaws.com/mailscanner/release/v4/rpm/MailScanner-4.85. >> 1 >> -1.rpm.tar.gz >> >> MD5 Sum: >> https://s3.amazonaws.com/mailscanner/release/v4/rpm/MailScanner-4.85. >> 1 >> -1.md5sum >> >> - >> Jerry Benton >> www.mailborder.com >> >> >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From jerry.benton at mailborder.com Thu Mar 5 15:16:39 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Thu, 5 Mar 2015 10:16:39 -0500 Subject: MailScanner v4.85.1-1 Final - RPM Release In-Reply-To: References: <326C0DFB-7412-4A70-9C37-EF2682BEABBB@mailborder.com> <963846AE-8E21-42F3-8D9C-534601196E61@mailborder.com> <61FFFAC6-9A02-43A5-B2C4-63014CC6FEFF@mailborder.com> Message-ID: <8F82B880-76C6-41A3-8900-1693E374E728@mailborder.com> Can you email it to me directly in an attachment please? You are using Postfix? - Jerry Benton www.mailborder.com > On Mar 5, 2015, at 9:27 AM, Jason Ede wrote: > > Jerry, > The version I have here (on older version of MS) is different from that one. > > Jason > -----Original Message----- > From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jerry Benton > Sent: 05 March 2015 09:44 > To: MailScanner discussion > Subject: Re: MailScanner v4.85.1-1 Final - RPM Release > > Jason, > > Could you compare the PFDiskStore.pm ? > > - > Jerry Benton > www.mailborder.com > > > >> On Mar 5, 2015, at 4:04 AM, Jason Ede wrote: >> >> I dropped down to the last version I was using and it fixed the issue. >> (4.83.5) >> >> Jason >> >> -----Original Message----- >> From: mailscanner-bounces at lists.mailscanner.info >> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jerry >> Benton >> Sent: 05 March 2015 08:53 >> To: MailScanner discussion >> Subject: Re: MailScanner v4.85.1-1 Final - RPM Release >> >> I?ll have to do some review. The code in this release remains mostly unchanged aside from bug fixes. Anyone else seeing this? >> >> >> >> - >> Jerry Benton >> www.mailborder.com >> >> >> >>> On Mar 5, 2015, at 2:55 AM, Jason Ede wrote: >>> >>> I think I found a bug in this release... >>> >>> If an email causes MS to crash too many times then it can't seem to quarantine it correctly... Looks like it's a path issue... >>> >>> Came in this morning to find a massive queue with MS going round and round trying to quarantine this one email... >>> >>> Warning: skipping message 61784180066.AE5C7 as it has been attempted >>> too many times Mar 5 07:50:49 gateway MailScanner[26060]: >>> Quarantined message 61784180066.AE5C7 as it caused MailScanner to >>> crash several times Mar 5 07:50:49 gateway MailScanner[26060]: Saved >>> entire message to >>> /var/spool/MailScanner/quarantine/20150305/61784180066.AE5C7 >>> Mar 5 07:50:49 gateway MailScanner[26060]: writing to >>> /var/spool/MailScanner/quarantine/20150305/61784180066.AE5C7//var/spo >>> o >>> l/MailScanner/quarantine/20150305/61784180066.AE5C7: No such file or >>> directory >>> >>> Jason >>> >>> -----Original Message----- >>> From: mailscanner-bounces at lists.mailscanner.info >>> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of >>> Jerry Benton >>> Sent: 21 February 2015 12:07 >>> To: MailScanner discussion >>> Subject: MailScanner v4.85.1-1 Final - RPM Release >>> >>> This is the final for the release of MailScanner v4.85.1-1 for RPM based distributions. I am working on the tarball source installer now. This RPM version will get posted on the MailScanner website once I get access from Jules. I will send a separate email when the tarball source installer is ready. >>> >>> >>> RPM Package: >>> https://s3.amazonaws.com/mailscanner/release/v4/rpm/MailScanner-4.85. >>> 1 >>> -1.rpm.tar.gz >>> >>> MD5 Sum: >>> https://s3.amazonaws.com/mailscanner/release/v4/rpm/MailScanner-4.85. >>> 1 >>> -1.md5sum >>> >>> - >>> Jerry Benton >>> www.mailborder.com >>> >>> >>> >>> -- >>> MailScanner mailing list >>> mailscanner at lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> -- >>> MailScanner mailing list >>> mailscanner at lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From mailborder at gmail.com Thu Mar 5 15:41:16 2015 From: mailborder at gmail.com (Mailborder at Gmail) Date: Thu, 5 Mar 2015 10:41:16 -0500 Subject: filename.rules.conf reload and tests In-Reply-To: <54F83F29.8050304@opensource-expert.com> References: <54F83F29.8050304@opensource-expert.com> Message-ID: Hi, MailScanner was at a development pause for a long time. There will eventually be a new website and a proper release cycle where there will be a testing release (alpha,beta) along with production releases (current, stable). That might take some time though. Post your reload request here: https://github.com/MailScanner/v4/issues On Thu, Mar 5, 2015 at 6:34 AM, Sylvain Viart wrote: > Hi, > > I would like to modify MailScanner so that it reloads pattern in > filenames.rules.conf dynamically without reload. > > Also, there's no test suite, is there a plan to put the code under test? > > > Regards, > Sylvain. > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150305/48fe9ee1/attachment.html From jerry.benton at mailborder.com Thu Mar 5 15:44:18 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Thu, 5 Mar 2015 10:44:18 -0500 Subject: High score mails get delivered In-Reply-To: References: Message-ID: Are your spam actions set to: store deliver ??? You can have it do more than one thing. - Jerry Benton www.mailborder.com > On Mar 4, 2015, at 5:22 AM, Ryan Braganza wrote: > > Anyone has faced this issue before? > > The spam actions in the logs say "actions are store" based on the rules but the mail still gets delivered. I have noticed this happens with mails haveing a blank message id > > Mar 4 14:14:57 server1 postfix_spam2/smtpd[45570]: 087F2E8798D: client=unknown[192.200.112.35] > Mar 4 14:14:58 server1 postfix_spam2/cleanup[45635]: 087F2E8798D: message-id=<> > > Mar 4 14:15:10 server1 MailScanner[46543]: Message 087F2E8798D.A5923 from 192.200.112.35 (mary at rolipvc.net ) to abcd.com is spam, CTSCORE : 0 str=0001.0A160201.54F6C615.0076,ss=1,re=0.001,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, SpamAssassin (not cached, score=10.146, required 5, BOTNET 2.00, DEAR_SOMETHING 0.10, DKIM_ADSP_NXDOMAIN 0.80, FSL_HELO_NON_FQDN_1 0.00, HTML_MESSAGE 0.00, HTTP_ESCAPED_HOST 1.62, MIME_HEADER_CTYPE_ONLY 2.00, MIME_HTML_ONLY 0.10, MISSING_MID 0.14, NO_DNS_FOR_FROM 0.80, RDNS_NONE 1.27, URI_HEX 1.31) > Mar 4 14:15:10 server1 MailScanner[46543]: Spam Actions: message 087F2E8798D.A5923 actions3 are store > > Mar 4 14:18:15 server1 postfix_spam2/qmgr[2533]: 087F2E8798D: from= , size=13333, nrcpt=1 (queue active) > Mar 4 14:18:16 server1 postfix_spam2/smtp[2543]: 087F2E8798D: to= , relay=relay.myserver.com [x.x.x.x]:25, delay=200, delays=199/0.05/0.58/0.68, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 3D40B344FF4) > > > Any idea? > > Mailscanner 0.77 version > mailscanner-4.84.6-1.noarch > > > > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150305/07f81efe/attachment.html From sylvain at opensource-expert.com Fri Mar 6 05:19:52 2015 From: sylvain at opensource-expert.com (Sylvain Viart) Date: Fri, 06 Mar 2015 06:19:52 +0100 Subject: filename.rules.conf reload and tests In-Reply-To: References: <54F83F29.8050304@opensource-expert.com> Message-ID: <54F938F8.4000801@opensource-expert.com> Hi, >> Also, there's no test suite, is there a plan to put the code under test? On 05/03/2015 16:41, Mailborder at Gmail wrote: > MailScanner was at a development pause for a long time. There will > eventually be a new website and a proper release cycle where there > will be a testing release (alpha,beta) along with production releases > (current, stable). That might take some time though. Yes, I see that the code was in a huge pause. About testing, I'm speaking about to start writing code testing and unit testing, about some folder holding a test suites? Not really about testing stage level you mention. Sorry for the confusion. [reloads pattern in filenames.rules.conf dynamically without reload.] > Post your reload request here: https://github.com/MailScanner/v4/issues I will. But if you know some part of code you can point me about that feature, I can start modifying. I will also need to put the code under testing do achieve that. ;-) Regards, Sylvain. From jerry.benton at mailborder.com Fri Mar 6 06:04:42 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Fri, 6 Mar 2015 01:04:42 -0500 Subject: filename.rules.conf reload and tests In-Reply-To: <54F938F8.4000801@opensource-expert.com> References: <54F83F29.8050304@opensource-expert.com> <54F938F8.4000801@opensource-expert.com> Message-ID: I created a public test group and repository. Send me your github info and I will invite you to it with write access. - Jerry Benton www.mailborder.com > On Mar 6, 2015, at 12:19 AM, Sylvain Viart wrote: > > Hi, > > >>> Also, there's no test suite, is there a plan to put the code > under test? > > On 05/03/2015 16:41, Mailborder at Gmail wrote: >> MailScanner was at a development pause for a long time. There will >> eventually be a new website and a proper release cycle where there >> will be a testing release (alpha,beta) along with production releases >> (current, stable). That might take some time though. > > Yes, I see that the code was in a huge pause. About testing, I'm > speaking about to start writing code testing and unit testing, about > some folder holding a test suites? Not really about testing stage level > you mention. Sorry for the confusion. > > [reloads pattern in filenames.rules.conf dynamically without reload.] >> Post your reload request here: https://github.com/MailScanner/v4/issues > > I will. But if you know some part of code you can point me about that > feature, I can start modifying. > I will also need to put the code under testing do achieve that. ;-) > > Regards, > Sylvain. > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From sylvain at opensource-expert.com Fri Mar 6 17:18:29 2015 From: sylvain at opensource-expert.com (Sylvain Viart) Date: Fri, 06 Mar 2015 18:18:29 +0100 Subject: install procedure debian-testing? Message-ID: <54F9E165.9050707@opensource-expert.com> Hi, I started to install github MailScanner on a debian testing, from scratch. I produced a package list. I used: ./installer/install.sh Install missing Perl modules via CPAN? [n/Y] : n ? WARNING: Digest::SHA1 is missing. You should fix this. This perl package seems deprecated. and not used in the source I have. Regards. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150306/6d8bbc10/attachment.html From sylvain at opensource-expert.com Fri Mar 6 17:35:00 2015 From: sylvain at opensource-expert.com (Sylvain Viart) Date: Fri, 06 Mar 2015 18:35:00 +0100 Subject: install procedure debian-testing? In-Reply-To: <54F9E165.9050707@opensource-expert.com> References: <54F9E165.9050707@opensource-expert.com> Message-ID: <54F9E544.3050202@opensource-expert.com> On 06/03/2015 18:18, Sylvain Viart wrote: > > ./installer/install.sh > > Install missing Perl modules via CPAN? [n/Y] : n > ? > WARNING: Digest::SHA1 is missing. You should fix this. > I removed it. (Digest::SHA1) ? humm missing something here: nstalling MailScanner into the /opt directory. If you do not want it there, just move it to where you want it and then edit MailScanner.conf and check_mailscanner to set the correct locations. ls: cannot access perl-tar/MailScanner*.tar.gz: No such file or directory ./install.sh: line 168: $SOURCE: ambiguous redirect ./install.sh: line 419: cd: perl-tar: No such file or directory ls: cannot access MailScanner*.tar.gz: No such file or directory Installed version into /opt/MailScanner- I will dig further. Sylvain. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150306/b631d8b7/attachment.html From jerry.benton at mailborder.com Fri Mar 6 17:58:24 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Fri, 6 Mar 2015 12:58:24 -0500 Subject: install procedure debian-testing? In-Reply-To: <54F9E165.9050707@opensource-expert.com> References: <54F9E165.9050707@opensource-expert.com> Message-ID: I am working on a new Debian package. it will be done next week. - Jerry Benton www.mailborder.com Sent from my iPhone > On Mar 6, 2015, at 12:18, Sylvain Viart wrote: > > Hi, > > I started to install github MailScanner on a debian testing, from scratch. > > I produced a package list. > > I used: > > ./installer/install.sh > Install missing Perl modules via CPAN? [n/Y] : n > ? > WARNING: Digest::SHA1 is missing. You should fix this. > > This perl package seems deprecated. > > and not used in the source I have. > > Regards. > > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150306/7acb24f3/attachment.html From jerry.benton at mailborder.com Fri Mar 6 18:02:44 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Fri, 6 Mar 2015 13:02:44 -0500 Subject: install procedure debian-testing? In-Reply-To: <54F9E165.9050707@opensource-expert.com> References: <54F9E165.9050707@opensource-expert.com> Message-ID: <00E9A8EA-2865-49C6-9ECB-58EF9256D3E1@mailborder.com> I misread your message. One of the Perl modules uses it. I forgot which one, but I spent 2 weeks figuring out these decencies. You can ignore it if you want, but it sure doesn?t hurt to have it. - Jerry Benton www.mailborder.com > On Mar 6, 2015, at 12:18 PM, Sylvain Viart wrote: > > Hi, > > I started to install github MailScanner on a debian testing, from scratch. > > I produced a package list. > > I used: > > ./installer/install.sh > Install missing Perl modules via CPAN? [n/Y] : n > ? > WARNING: Digest::SHA1 is missing. You should fix this. > > This perl package seems deprecated. > > and not used in the source I have. > > Regards. > > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150306/fc314d21/attachment.html From jerry.benton at mailborder.com Fri Mar 6 18:08:01 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Fri, 6 Mar 2015 13:08:01 -0500 Subject: install procedure debian-testing? In-Reply-To: <54F9E544.3050202@opensource-expert.com> References: <54F9E165.9050707@opensource-expert.com> <54F9E544.3050202@opensource-expert.com> Message-ID: <3E384AD5-A74C-4E8C-8AA7-A526C8F64924@mailborder.com> Did you run ./install.sh from the same directory? Unpack it, cd to it, then run it. - Jerry Benton www.mailborder.com > On Mar 6, 2015, at 12:35 PM, Sylvain Viart wrote: > > > > On 06/03/2015 18:18, Sylvain Viart wrote: >> >> ./installer/install.sh >> Install missing Perl modules via CPAN? [n/Y] : n >> ? >> WARNING: Digest::SHA1 is missing. You should fix this. > > I removed it. (Digest::SHA1) > > ? humm missing something here: > > nstalling MailScanner into the /opt directory. If you do not want it there, > just move it to where you want it and then edit MailScanner.conf and > check_mailscanner to set the correct locations. > > ls: cannot access perl-tar/MailScanner*.tar.gz: No such file or directory > ./install.sh: line 168: $SOURCE: ambiguous redirect > ./install.sh: line 419: cd: perl-tar: No such file or directory > ls: cannot access MailScanner*.tar.gz: No such file or directory > > Installed version into /opt/MailScanner- > > I will dig further. > > Sylvain. > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150306/9dd0d9ce/attachment.html From Denis.Beauchemin at usherbrooke.ca Fri Mar 6 19:12:22 2015 From: Denis.Beauchemin at usherbrooke.ca (Denis Beauchemin) Date: Fri, 6 Mar 2015 19:12:22 +0000 Subject: Cloud-based scanning In-Reply-To: References: <54F5F545.4030201@fsl.com> <54F63ED4.6080901@fsl.com> Message-ID: Here is my first impression of the Microsoft 365 email filtering service: 1- you may not know it but you are already getting email from it because it looks like all email coming from @hotmail.com, @outlook.com and others are sharing the same outbound servers as 365. a) look here for the IP addresses used: https://technet.microsoft.com/en-us/library/dn163583(v=exchg.150).aspx b) all server names seen so far contain this string: outbound.protection.outlook.com 2- it looks like emails to invalid addresses are handled correctly as you can see in the following email I received after sending from gmail: smtpe2.usherbrooke.ca rejected your message to the following email addresses: toto at usherbrooke.quebec The email address wasn't found at the destination domain. It might be misspelled or it might not exist any longer. Try retyping the address and resending the message. If that doesn't work, contact the recipient (by phone or instant messaging, for example) to check that the address is correct. If the problem continues, forward this message to your email admin. For Email Administrators For more tips to help fix this issue, see DSN 5.1.1 Errors in Exchange Online and Office 365. smtpe2.usherbrooke.ca gave this error: ... User unknown 3- MailScanner is still useful for fine-grained work such as: a) detecting and neutralizing different tags: , phishing, Form, Scripp, Web bugs, HTML b) phishing attempts c) whitelisted stuff (could probably be done by 365) d) Sanesecurity and other Clam stuff e) local SpamAssassin rules 4- I ended up archiving all emails that come from the list in #1 so I could get a look at them if I wanted to make sure MailScanner did the right thing when it decided to tag one of those emails as spam 5- During part of yesterday I managed to get these stats for the Microsoft 365 emails that went through MailScanner (I should get more in a few days): === Emails Rejected Domain of sender address laurent.heylen at student.fi2.be does not exist: 2 Domain of sender address no-reply-iTunes.iso at Support.inc.out.com does not exist: 2 HAM: 774 SPAM: 20 Actions Attach, Deliver, Header: 10 Actions Delete: 10 tags: 577 Form tags: 1 Phishing tags: 23 Script tags: 2 Web Bug tags: 29 HTML Form tags: 1 HTML IMG tags: 354 HTML Script tags: 2 Expanding TNEF: 5 Removed TNEF: 5 Added TNEF: 4 Phishing Frauds: 52 Whitelisted: 27 === Clamd::Infected:: Sanesecurity.ScamL.151.UNOFFICIAL: 1 === Found spam-virus Sanesecurity.ScamL.151.UNOFFICIAL: 2 === SpamAssassin Rules ADVANCE_FEE_4_NEW_FRM_MNY: 1 AXB_X_FF_SEZ_S: 18 BAYES_50: 3 BAYES_60: 2 BAYES_80: 3 BAYES_99: 12 BAYES_999: 9 BIGNUM_EMAILS: 1 BODY_URI_ONLY: 2 DCC_CHECK: 3 DEAR_WINNER: 1 EMPTY_MESSAGE: 9 FILL_THIS_FORM: 1 FILL_THIS_FORM_LONG: 1 FORM_FRAUD_5: 1 HAS_SHORT_URL: 2 HK_LOTTO: 1 HTML_FONT_LOW_CONTRAST: 1 HTML_MESSAGE: 8 LIST_PARTIAL: 3 LOTS_OF_MONEY: 1 MISSING_HEADERS: 3 MONEY_FRAUD_5: 1 RCVD_IN_BL_SPAMCOP_NET: 7 RCVD_IN_BRBL: 12 RCVD_IN_DNSWL_LOW: 2 RCVD_IN_DNSWL_NONE: 18 RCVD_IN_LASHBACK: 6 RCVD_IN_PSBL: 4 RCVD_IN_SORBS_WEB: 2 RCVD_IN_UCE_PFSM_1: 3 REPLYTO_WITHOUT_TO_CC: 1 TVD_SPACE_RATIO: 2 T_FSL_HELO_BARE_IP_2: 11 UDES_BUY15: 2 UDES_BUY17: 2 UDES_BUY99: 2 UDES_VIRUS01: 1 URIBL_AB_SURBL: 1 URIBL_DBL_ABUSE_BOTCC: 1 URIBL_DBL_ABUSE_REDIR: 2 US_DOLLARS_3: 1 6- For now I would not accept Microsoft 365-filtered emails without any local filtering; it does a good job of blocking with RBL because I didn't get any email that I blocked with Spamhaus or URIBL; I guess my MX servers will just go idle because they won't have to work as hard as before Have a good week-end everybody! Denis -----Message d'origine----- De?: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] De la part de Steve Freegard Envoy??: 3 mars 2015 18:15 ??: MailScanner discussion Objet?: Re: Cloud-based scanning Denis, On 03/03/15 18:13, Denis Beauchemin wrote: > Thanks Steve and all the others. No problem - you're welcome. > My server will act as a proxy and will reject invalid addresses in the connect phase so I should be safe. I will be testing this RSN with an alternate domain name, in case something goes wrong... It will be interesting to see whether Microsoft will actually ask it like this (e.g. in a call-ahead style). What I suspect will happen is that Microsoft will actually accept mail to unknown recipients and then bounce it when the delivery is attempted to you later. I'd be interested to hear your results and experiences once you've switched over your initial test domain. Kind regards, Steve. -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From sylvain at opensource-expert.com Fri Mar 6 19:47:21 2015 From: sylvain at opensource-expert.com (Sylvain Viart) Date: Fri, 06 Mar 2015 20:47:21 +0100 Subject: install procedure debian-testing? In-Reply-To: <3E384AD5-A74C-4E8C-8AA7-A526C8F64924@mailborder.com> References: <54F9E165.9050707@opensource-expert.com> <54F9E544.3050202@opensource-expert.com> <3E384AD5-A74C-4E8C-8AA7-A526C8F64924@mailborder.com> Message-ID: <54FA0449.50505@opensource-expert.com> On 06/03/2015 19:08, Jerry Benton wrote: > Did you run ./install.sh from the same directory? Unpack it, cd to it, > then run it. I did cd to installer/ and run ./install.sh without parameter. It is debian testing / jessie my grep on Digest::SHA1 didn't return any interesting code. But reading the errors about MailScanner*.tar.gz I think I don't have the source yet. It is downloaded at some stage? I wont ready any more code tonight and closed my VM. I will continue next time. Regards. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150306/19d38955/attachment.html -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 819 bytes Desc: OpenPGP digital signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150306/19d38955/attachment.bin From jerry.benton at mailborder.com Fri Mar 6 21:02:31 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Fri, 6 Mar 2015 16:02:31 -0500 Subject: install procedure debian-testing? In-Reply-To: <54FA0449.50505@opensource-expert.com> References: <54F9E165.9050707@opensource-expert.com> <54F9E544.3050202@opensource-expert.com> <3E384AD5-A74C-4E8C-8AA7-A526C8F64924@mailborder.com> <54FA0449.50505@opensource-expert.com> Message-ID: <3EDC7123-E996-41A2-BF28-55F31687A6B9@mailborder.com> You can?t download the source tree and run the installer. You have to build the package from the source. Just wait until next week and I will have all of the packages done. You can test then. - Jerry Benton www.mailborder.com > On Mar 6, 2015, at 2:47 PM, Sylvain Viart wrote: > > > On 06/03/2015 19:08, Jerry Benton wrote: >> Did you run ./install.sh from the same directory? Unpack it, cd to it, then run it. > > I did cd to installer/ and run ./install.sh without parameter. > > It is debian testing / jessie > > my grep on Digest::SHA1 didn't return any interesting code. > But reading the errors about MailScanner*.tar.gz I think I don't have the source yet. > > It is downloaded at some stage? > I wont ready any more code tonight and closed my VM. > > I will continue next time. > > Regards. > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150306/eeb7c53e/attachment.html From sylvain at opensource-expert.com Sat Mar 7 07:06:58 2015 From: sylvain at opensource-expert.com (Sylvain Viart) Date: Sat, 07 Mar 2015 08:06:58 +0100 Subject: install procedure debian testing / jessie? In-Reply-To: <3EDC7123-E996-41A2-BF28-55F31687A6B9@mailborder.com> References: <54F9E165.9050707@opensource-expert.com> <54F9E544.3050202@opensource-expert.com> <3E384AD5-A74C-4E8C-8AA7-A526C8F64924@mailborder.com> <54FA0449.50505@opensource-expert.com> <3EDC7123-E996-41A2-BF28-55F31687A6B9@mailborder.com> Message-ID: <54FAA392.80608@opensource-expert.com> Hi, On 06/03/2015 22:02, Jerry Benton wrote: > You can?t download the source tree and run the installer. That why it fails for now. OK. ;-) Is there an old doc how to build previous MS? Did you plan to change it? > You have to build the package from the source. hacked? Thanks for the hint. Why this dependency to an extra programming language? ./config.index/parse_conf.php ./config.index/create_conf_array.php ./config.index/dump_config.php ./config.index/conf_array.php Is there a doc how to Build your current MS? or a wiki I can post some commands? No deep doc writing, at start, blocks of bash output would be fine. > Just wait until next week and I will have all of the packages done. > You can test then. yes too. But I'm also interested in the building process. I saw Build.* scripts but didn't notice where or how they are called. I suspect I can call ./Build.all or ./Build.debian I'm graphing (with a pen) the scripts order I guessed, I will scan the result and post it.// Don't think I'm hurrying you or something, I'm just playing with source and digging the code. Do your stuff. Thanks. Regards. Sylvain -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150307/cd265c93/attachment.html From email at ace.net.au Sun Mar 8 08:06:57 2015 From: email at ace.net.au (Peter Nitschke) Date: Sun, 08 Mar 2015 18:36:57 +1030 Subject: v4.85.2-0 Beta (Red Hat, SuSE, Tarball) In-Reply-To: References: Message-ID: <201503081836570634.3BCAA315@web.ace.net.au> Hi Jerry, Just testing the RHEL version on Centos 6.6 X64 and it looks to be a nice piece of work. Will report back if I notice anything. Cheers, Peter *********** REPLY SEPARATOR *********** On 1/03/2015 at 11:20 PM Jerry Benton wrote: >Beta builds with the new directory structure in /usr/share/MailScanner. >Lab tested. I am working on the Debian package now. > > > >RHEL >https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2-0.rpm.tar.gz > >SuSE >https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2-0.suse-rpm.tar .gz > >Tarball >https://s3.amazonaws.com/mailscanner/test/MailScanner-install-4.85.2-0.tar. gz > > > >- >Jerry Benton >www.mailborder.com > > > >-- >MailScanner mailing list >mailscanner at lists.mailscanner.info >http://lists.mailscanner.info/mailman/listinfo/mailscanner > >Before posting, read http://wiki.mailscanner.info/posting > >Support MailScanner development - buy the book off the website! From jerry.benton at mailborder.com Sun Mar 8 13:59:42 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Sun, 8 Mar 2015 09:59:42 -0400 Subject: v4.85.2-0 Beta (Red Hat, SuSE, Tarball) In-Reply-To: <201503081836570634.3BCAA315@web.ace.net.au> References: <201503081836570634.3BCAA315@web.ace.net.au> Message-ID: Peter, Double check your PFDislStore.pm if you are using Postfix. I can?t remember if I updated it before or after I built that package. It addresses a bug. Line 635 here: https://github.com/MailScanner/v4/blob/master/mailscanner/bin/MailScanner/PFDiskStore.pm - Jerry Benton www.mailborder.com > On Mar 8, 2015, at 4:06 AM, Peter Nitschke wrote: > > Hi Jerry, > > Just testing the RHEL version on Centos 6.6 X64 and it looks to be a nice > piece of work. > > Will report back if I notice anything. > > Cheers, > > Peter > > > *********** REPLY SEPARATOR *********** > > On 1/03/2015 at 11:20 PM Jerry Benton wrote: > >> Beta builds with the new directory structure in /usr/share/MailScanner. >> Lab tested. I am working on the Debian package now. >> >> >> >> RHEL >> https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2-0.rpm.tar.gz >> >> SuSE >> https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2-0.suse-rpm.tar > .gz >> >> Tarball >> https://s3.amazonaws.com/mailscanner/test/MailScanner-install-4.85.2-0.tar. > gz >> >> >> >> - >> Jerry Benton >> www.mailborder.com >> >> >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > > > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From email at ace.net.au Sun Mar 8 16:00:43 2015 From: email at ace.net.au (Peter Nitschke) Date: Mon, 09 Mar 2015 02:30:43 +1030 Subject: v4.85.2-0 Beta (Red Hat, SuSE, Tarball) In-Reply-To: References: <201503081836570634.3BCAA315@web.ace.net.au> Message-ID: <201503090230430150.3D7C6041@web.ace.net.au> I am using Sendmail. ClamAV-autoupdate[21295]: ClamAV updater /usr/local/bin/freshclam cannot be run It's actually located at /usr/bin/freshclam I might try to find the few missing RPMs so I can avoid the cpan installs. Cheers. Peter *********** REPLY SEPARATOR *********** On 8/03/2015 at 9:59 AM Jerry Benton wrote: >This encoded message has been converted to an attachment. > >Peter, Double check your PFDislStore.pm if you are using Postfix. I >can???t remember if I updated it before or after I built that package. It >addresses a bug. Line 635 >here: https://github.com/MailScanner/v4/blob/master/mailscanner/bin/MailScanner/PF DiskStore.pm - Jerry Benton www.mailborder.com > On Mar 8, 2015, at 4:06 AM, Peter Nitschke wrote: > > Hi Jerry, > > Just testing the RHEL version on Centos 6.6 X64 and it looks to be a nice > piece of work. > > Will report back if I notice anything. > > Cheers, > > Peter > > > *********** REPLY SEPARATOR *********** > > On 1/03/2015 at 11:20 PM Jerry Benton wrote: > >> Beta builds with the new directory structure in /usr/share/MailScanner. >> Lab tested. I am working on the Debian package now. >> >> >> >> RHEL >> https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2-0.rpm.tar.gz >> >> SuSE >> https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2-0.suse-rpm.tar > .gz >> >> Tarball >> https://s3.amazonaws.com/mailscanner/test/MailScanner-install-4.85.2-0.tar. > gz >> >> >> >> - >> Jerry Benton >> www.mailborder.com >> >> >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > > > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From jerry.benton at mailborder.com Sun Mar 8 21:06:55 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Sun, 8 Mar 2015 17:06:55 -0400 Subject: v4.85.2-0 Beta (Red Hat, SuSE, Tarball) In-Reply-To: <201503090230430150.3D7C6041@web.ace.net.au> References: <201503081836570634.3BCAA315@web.ace.net.au> <201503090230430150.3D7C6041@web.ace.net.au> Message-ID: <4AFF4FCD-52A8-4A1C-B40A-98761081964C@mailborder.com> Peter, I looked for like 3 weeks for RPMs. I ended up building a couple. If you are using CentOS 7, there are only a couple things missing. - Jerry Benton www.mailborder.com > On Mar 8, 2015, at 12:00 PM, Peter Nitschke wrote: > > I am using Sendmail. > > ClamAV-autoupdate[21295]: ClamAV updater /usr/local/bin/freshclam cannot be > run > > It's actually located at /usr/bin/freshclam > > I might try to find the few missing RPMs so I can avoid the cpan installs. > > Cheers. > > Peter > > > *********** REPLY SEPARATOR *********** > > On 8/03/2015 at 9:59 AM Jerry Benton wrote: > >> This encoded message has been converted to an attachment. >> >> Peter, > > Double check your PFDislStore.pm if you are using Postfix. I >> can?t remember if I updated it before or after I built that > package. It >> addresses a bug. Line 635 >> here: > > https://github.com/MailScanner/v4/blob/master/mailscanner/bin/MailScanner/PF > DiskStore.pm > > > - > Jerry Benton > www.mailborder.com > > > >> On Mar 8, 2015, at 4:06 AM, Peter Nitschke wrote: >> >> Hi Jerry, >> >> Just testing the RHEL version on Centos 6.6 X64 and it looks to be a nice >> piece of work. >> >> Will report back if I notice anything. >> >> Cheers, >> >> Peter >> >> >> *********** REPLY SEPARATOR *********** >> >> On 1/03/2015 at 11:20 PM Jerry Benton wrote: >> >>> Beta builds with the new directory structure in /usr/share/MailScanner. >>> Lab tested. I am working on the Debian package now. >>> >>> >>> >>> RHEL >>> https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2-0.rpm.tar.gz >>> >>> SuSE >>> > https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2-0.suse-rpm.tar >> .gz >>> >>> Tarball >>> > https://s3.amazonaws.com/mailscanner/test/MailScanner-install-4.85.2-0.tar. >> gz >>> >>> >>> >>> - >>> Jerry Benton >>> www.mailborder.com >>> >>> >>> >>> -- >>> MailScanner mailing list >>> mailscanner at lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >> >> >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From michael at huntley.net Sun Mar 8 23:02:11 2015 From: michael at huntley.net (Michael Huntley) Date: Sun, 08 Mar 2015 16:02:11 -0700 Subject: v4.85.2-0 Beta (Red Hat, SuSE, Tarball) In-Reply-To: <4AFF4FCD-52A8-4A1C-B40A-98761081964C@mailborder.com> References: <201503081836570634.3BCAA315@web.ace.net.au> <201503090230430150.3D7C6041@web.ace.net.au> <4AFF4FCD-52A8-4A1C-B40A-98761081964C@mailborder.com> Message-ID: <54FCD4F3.8@huntley.net> Jerry - You're looking for clamav rpms for CentOS 6.x? If so, I found those at EPEL, and ATRPMS. Cheers, mph On 3/8/2015 2:06 PM, Jerry Benton wrote: > Peter, > > I looked for like 3 weeks for RPMs. I ended up building a couple. If you are using CentOS 7, there are only a couple things missing. > > - > Jerry Benton > www.mailborder.com > > > >> On Mar 8, 2015, at 12:00 PM, Peter Nitschke wrote: >> >> I am using Sendmail. >> >> ClamAV-autoupdate[21295]: ClamAV updater /usr/local/bin/freshclam cannot be >> run >> >> It's actually located at /usr/bin/freshclam >> >> I might try to find the few missing RPMs so I can avoid the cpan installs. >> >> Cheers. >> >> Peter >> >> >> *********** REPLY SEPARATOR *********** >> >> On 8/03/2015 at 9:59 AM Jerry Benton wrote: >> >>> This encoded message has been converted to an attachment. >>> >>> Peter, >> Double check your PFDislStore.pm if you are using Postfix. I >>> can?t remember if I updated it before or after I built that >> package. It >>> addresses a bug. Line 635 >>> here: >> https://github.com/MailScanner/v4/blob/master/mailscanner/bin/MailScanner/PF >> DiskStore.pm >> >> >> - >> Jerry Benton >> www.mailborder.com >> >> >> >>> On Mar 8, 2015, at 4:06 AM, Peter Nitschke wrote: >>> >>> Hi Jerry, >>> >>> Just testing the RHEL version on Centos 6.6 X64 and it looks to be a nice >>> piece of work. >>> >>> Will report back if I notice anything. >>> >>> Cheers, >>> >>> Peter >>> >>> >>> *********** REPLY SEPARATOR *********** >>> >>> On 1/03/2015 at 11:20 PM Jerry Benton wrote: >>> >>>> Beta builds with the new directory structure in /usr/share/MailScanner. >>>> Lab tested. I am working on the Debian package now. >>>> >>>> >>>> >>>> RHEL >>>> https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2-0.rpm.tar.gz >>>> >>>> SuSE >>>> >> https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2-0.suse-rpm.tar >>> .gz >>>> Tarball >>>> >> https://s3.amazonaws.com/mailscanner/test/MailScanner-install-4.85.2-0.tar. >>> gz >>>> >>>> >>>> - >>>> Jerry Benton >>>> www.mailborder.com >>>> >>>> >>>> >>>> -- >>>> MailScanner mailing list >>>> mailscanner at lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>> >>> >>> -- >>> MailScanner mailing list >>> mailscanner at lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! From jerry.benton at mailborder.com Sun Mar 8 23:51:06 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Sun, 8 Mar 2015 19:51:06 -0400 Subject: v4.85.2-0 Beta (Red Hat, SuSE, Tarball) In-Reply-To: <54FCD4F3.8@huntley.net> References: <201503081836570634.3BCAA315@web.ace.net.au> <201503090230430150.3D7C6041@web.ace.net.au> <4AFF4FCD-52A8-4A1C-B40A-98761081964C@mailborder.com> <54FCD4F3.8@huntley.net> Message-ID: No, that is not what this thread is about. You will need to rewind through the email traffic at Gmane if you want more detail. Here is how the installer works: Clam is installed via yum on all versions (5,6,7) if you elect to use EPEL and elect to install ClamAV. For Perl Modules: - Tries to install via RPM packages by name. Example: "yum install perl-Filesys-Df" - It then checks to see if the module is installed. If missing, it attempts to install like this: "yum install perl(Filesys::Df)?. This basically leverages the ?what provides? feature in yum to install something if you don?t know the package name or typed it incorrectly. - Finally it will install via CPAN if still missing. (If you elect to use CPAN when asked.) On some versions there are some packages missing. I built the RPMs from source. Example: tnef However, the installer still tries to install tnef via yum first because some of the distros have it available in EPEL. It then checks for it and if it is missing it then pulls the RPM I built. - Jerry Benton www.mailborder.com > On Mar 8, 2015, at 7:02 PM, Michael Huntley wrote: > > Jerry - > > You're looking for clamav rpms for CentOS 6.x? If so, I found those at > EPEL, and ATRPMS. > > Cheers, > > mph > > On 3/8/2015 2:06 PM, Jerry Benton wrote: >> Peter, >> >> I looked for like 3 weeks for RPMs. I ended up building a couple. If you are using CentOS 7, there are only a couple things missing. >> >> - >> Jerry Benton >> www.mailborder.com >> >> >> >>> On Mar 8, 2015, at 12:00 PM, Peter Nitschke wrote: >>> >>> I am using Sendmail. >>> >>> ClamAV-autoupdate[21295]: ClamAV updater /usr/local/bin/freshclam cannot be >>> run >>> >>> It's actually located at /usr/bin/freshclam >>> >>> I might try to find the few missing RPMs so I can avoid the cpan installs. >>> >>> Cheers. >>> >>> Peter >>> >>> >>> *********** REPLY SEPARATOR *********** >>> >>> On 8/03/2015 at 9:59 AM Jerry Benton wrote: >>> >>>> This encoded message has been converted to an attachment. >>>> >>>> Peter, >>> Double check your PFDislStore.pm if you are using Postfix. I >>>> can?t remember if I updated it before or after I built that >>> package. It >>>> addresses a bug. Line 635 >>>> here: >>> https://github.com/MailScanner/v4/blob/master/mailscanner/bin/MailScanner/PF >>> DiskStore.pm >>> >>> >>> - >>> Jerry Benton >>> www.mailborder.com >>> >>> >>> >>>> On Mar 8, 2015, at 4:06 AM, Peter Nitschke wrote: >>>> >>>> Hi Jerry, >>>> >>>> Just testing the RHEL version on Centos 6.6 X64 and it looks to be a nice >>>> piece of work. >>>> >>>> Will report back if I notice anything. >>>> >>>> Cheers, >>>> >>>> Peter >>>> >>>> >>>> *********** REPLY SEPARATOR *********** >>>> >>>> On 1/03/2015 at 11:20 PM Jerry Benton wrote: >>>> >>>>> Beta builds with the new directory structure in /usr/share/MailScanner. >>>>> Lab tested. I am working on the Debian package now. >>>>> >>>>> >>>>> >>>>> RHEL >>>>> https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2-0.rpm.tar.gz >>>>> >>>>> SuSE >>>>> >>> https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2-0.suse-rpm.tar >>>> .gz >>>>> Tarball >>>>> >>> https://s3.amazonaws.com/mailscanner/test/MailScanner-install-4.85.2-0.tar. >>>> gz >>>>> >>>>> >>>>> - >>>>> Jerry Benton >>>>> www.mailborder.com >>>>> >>>>> >>>>> >>>>> -- >>>>> MailScanner mailing list >>>>> mailscanner at lists.mailscanner.info >>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>> >>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>> >>>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>>> -- >>>> MailScanner mailing list >>>> mailscanner at lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>> -- >>> MailScanner mailing list >>> mailscanner at lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >>> >>> -- >>> MailScanner mailing list >>> mailscanner at lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From jerry.benton at mailborder.com Sun Mar 8 23:57:18 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Sun, 8 Mar 2015 19:57:18 -0400 Subject: v4.85.2-0 Beta (Red Hat, SuSE, Tarball) In-Reply-To: <201503090230430150.3D7C6041@web.ace.net.au> References: <201503081836570634.3BCAA315@web.ace.net.au> <201503090230430150.3D7C6041@web.ace.net.au> Message-ID: <16D97CF7-B5C3-410A-B0A9-CA9B27DDD4B9@mailborder.com> Peter, This is because the packagers of ClamAV can?t be consistent between distro versions (5,6,7). In one the executable is one place, then in another. They also like to change the user and group names. Example: clam, clamav, vscan. They also like to do stupid crap like disable freshclam until you edit freshclam.conf and remove the ?Example? line, but only in version 7. Versions 5 and 6 don?t do this. If you could, please create an issue for this on Github. I can modify the installer to check for freshclam in one place and then modify the updater if it is in another place. I could also just update the updater to find it via the user?s environment. meh ? - Jerry Benton www.mailborder.com > On Mar 8, 2015, at 12:00 PM, Peter Nitschke wrote: > > I am using Sendmail. > > ClamAV-autoupdate[21295]: ClamAV updater /usr/local/bin/freshclam cannot be > run > > It's actually located at /usr/bin/freshclam > > I might try to find the few missing RPMs so I can avoid the cpan installs. > > Cheers. > > Peter > > > *********** REPLY SEPARATOR *********** > > On 8/03/2015 at 9:59 AM Jerry Benton wrote: > >> This encoded message has been converted to an attachment. >> >> Peter, > > Double check your PFDislStore.pm if you are using Postfix. I >> can?t remember if I updated it before or after I built that > package. It >> addresses a bug. Line 635 >> here: > > https://github.com/MailScanner/v4/blob/master/mailscanner/bin/MailScanner/PF > DiskStore.pm > > > - > Jerry Benton > www.mailborder.com > > > >> On Mar 8, 2015, at 4:06 AM, Peter Nitschke wrote: >> >> Hi Jerry, >> >> Just testing the RHEL version on Centos 6.6 X64 and it looks to be a nice >> piece of work. >> >> Will report back if I notice anything. >> >> Cheers, >> >> Peter >> >> >> *********** REPLY SEPARATOR *********** >> >> On 1/03/2015 at 11:20 PM Jerry Benton wrote: >> >>> Beta builds with the new directory structure in /usr/share/MailScanner. >>> Lab tested. I am working on the Debian package now. >>> >>> >>> >>> RHEL >>> https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2-0.rpm.tar.gz >>> >>> SuSE >>> > https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2-0.suse-rpm.tar >> .gz >>> >>> Tarball >>> > https://s3.amazonaws.com/mailscanner/test/MailScanner-install-4.85.2-0.tar. >> gz >>> >>> >>> >>> - >>> Jerry Benton >>> www.mailborder.com >>> >>> >>> >>> -- >>> MailScanner mailing list >>> mailscanner at lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >> >> >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From ak6783 at gmail.com Mon Mar 9 03:02:21 2015 From: ak6783 at gmail.com (=?UTF-8?B?5ZCz5rGd5Ymb?=) Date: Mon, 9 Mar 2015 11:02:21 +0800 Subject: About Sign Clean Message. Message-ID: Hello, I have installed MailScanner 4.84.6-1. I have about sign clean message question.I have set Sign Clean Messages = yes.And report file is correct.But I mail to anyone haven't any clean message in my mail.What's this problem?How to check and fix it? -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150309/c7538be1/attachment.html From Antony.Stone at mailscanner.open.source.it Mon Mar 9 09:30:39 2015 From: Antony.Stone at mailscanner.open.source.it (Antony Stone) Date: Mon, 9 Mar 2015 10:30:39 +0100 Subject: About Sign Clean Message. In-Reply-To: References: Message-ID: <201503091030.39981.Antony.Stone@mailscanner.open.source.it> On Monday 09 March 2015 at 04:02:21 (EU time), ??? wrote: > Hello, > I have installed MailScanner 4.84.6-1. > I have about sign clean message question.I have set Sign Clean Messages = > yes.And report file is correct.But I mail to anyone haven't any clean > message in my mail.What's this problem?How to check and fix it? I assume you have checked from the headers of delivered mail that they're being processed by MS at all. Have you defined the signature for both plain text and HTML messages? Is it possible that you only defined a text signature, and you're looking at HTML emails? If the above ideas don't help, please share your mailscanner.conf without comments and without blank lines (and without any sensitive data). Regards, Antony. -- Software development can be quick, high quality, or low cost. The customer gets to pick any two out of three. Please reply to the list; please *don't* CC me. From steve.freegard at fsl.com Mon Mar 9 10:56:56 2015 From: steve.freegard at fsl.com (Steve Freegard) Date: Mon, 09 Mar 2015 10:56:56 +0000 Subject: Cloud-based scanning In-Reply-To: References: <54F5F545.4030201@fsl.com> <54F63ED4.6080901@fsl.com> <54FD7C78.3080001@fsl.com> Message-ID: On 06/03/15 19:12, Denis Beauchemin wrote: > 2- it looks like emails to invalid addresses are handled correctly as you can see in the following email I received after sending from gmail: > smtpe2.usherbrooke.ca rejected your message to the following email addresses: > > toto at usherbrooke.quebec > The email address wasn't found at the destination domain. It might be misspelled or it might not exist any longer. Try retyping the address and resending the message. > If that doesn't work, contact the recipient (by phone or instant messaging, for example) to check that the address is correct. If the problem continues, forward this message to your email admin. > > For Email Administrators > For more tips to help fix this issue, see DSN 5.1.1 Errors in Exchange Online and Office 365. > > smtpe2.usherbrooke.ca gave this error: > ... User unknown > Unfortunately - that isn't really the 'proper' way. They're doing what I expected they'd do - they're accepting the message and bouncing it afterwards (instead of rejecting it outright at receipt and making the originating hop bounce it without it leaving their system). Basically - if a spammer decided to send mail to a bunch of old expired (or simply invalid) userbrooke.queuec addresses as recipients with a spoofed-but-valid return-path, then the poor owner of the spoofed address would get a load of backscatter in return (from Microsoft). Helpfully too - Microsoft attach the original mail to the bounce (I just tried it myself), so it could potentially be used as a crude way to make Microsoft send a load of spam (e.g. send the mail with a return-path of the victim and intentionally make the recipient invalid, then Microsoft will bounce the message to the victim with the spam payload attached). Kind regards, Steve. From maxsec at gmail.com Mon Mar 9 12:05:00 2015 From: maxsec at gmail.com (Martin Hepworth) Date: Mon, 9 Mar 2015 12:05:00 +0000 Subject: About Sign Clean Message. In-Reply-To: References: Message-ID: Did you restart MailScanner after you altered the file? -- Martin Hepworth, CISSP Oxford, UK On 9 March 2015 at 03:02, ??? wrote: > Hello, > I have installed MailScanner 4.84.6-1. > I have about sign clean message question.I have set Sign Clean Messages = > yes.And report file is correct.But I mail to anyone haven't any clean > message in my mail.What's this problem?How to check and fix it? > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150309/1fdf321b/attachment.html From glenn.steen at gmail.com Mon Mar 9 12:42:56 2015 From: glenn.steen at gmail.com (Glenn Steen) Date: Mon, 9 Mar 2015 13:42:56 +0100 Subject: Cloud-based scanning In-Reply-To: References: <54F5F545.4030201@fsl.com> <54F63ED4.6080901@fsl.com> <54FD7C78.3080001@fsl.com> Message-ID: As said, potential spam reflector... Yuk. Good explanation Steve, thanks for that! Cheers! -- -- Glenn Den 9 mar 2015 12:26 skrev "Steve Freegard" : > On 06/03/15 19:12, Denis Beauchemin wrote: > > > 2- it looks like emails to invalid addresses are handled correctly as > you can see in the following email I received after sending from gmail: > > smtpe2.usherbrooke.ca rejected your message to the following email > addresses: > > > > toto at usherbrooke.quebec > > The email address wasn't found at the destination domain. It might be > misspelled or it might not exist any longer. Try retyping the address and > resending the message. > > If that doesn't work, contact the recipient (by phone or instant > messaging, for example) to check that the address is correct. If the > problem continues, forward this message to your email admin. > > > > For Email Administrators > > For more tips to help fix this issue, see DSN 5.1.1 Errors in Exchange > Online and Office 365. > > > > smtpe2.usherbrooke.ca gave this error: > > ... User unknown > > > > Unfortunately - that isn't really the 'proper' way. They're doing what > I expected they'd do - they're accepting the message and bouncing it > afterwards (instead of rejecting it outright at receipt and making the > originating hop bounce it without it leaving their system). > > Basically - if a spammer decided to send mail to a bunch of old expired > (or simply invalid) userbrooke.queuec addresses as recipients with a > spoofed-but-valid return-path, then the poor owner of the spoofed > address would get a load of backscatter in return (from Microsoft). > > Helpfully too - Microsoft attach the original mail to the bounce (I just > tried it myself), so it could potentially be used as a crude way to make > Microsoft send a load of spam (e.g. send the mail with a return-path of > the victim and intentionally make the recipient invalid, then Microsoft > will bounce the message to the victim with the spam payload attached). > > Kind regards, > Steve. > > > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150309/36fc964e/attachment.html From ak6783 at gmail.com Tue Mar 10 00:49:05 2015 From: ak6783 at gmail.com (=?UTF-8?B?5ZCz5rGd5Ymb?=) Date: Tue, 10 Mar 2015 08:49:05 +0800 Subject: About Sign Clean Message. In-Reply-To: References: Message-ID: Hello, I attachment my mailscanner.conf.Please check it. I have restart MailScanner when I edit some settings. 2015-03-09 20:05 GMT+08:00 Martin Hepworth : > Did you restart MailScanner after you altered the file? > > -- > Martin Hepworth, CISSP > Oxford, UK > > On 9 March 2015 at 03:02, ??? wrote: > >> Hello, >> I have installed MailScanner 4.84.6-1. >> I have about sign clean message question.I have set Sign Clean Messages = >> yes.And report file is correct.But I mail to anyone haven't any clean >> message in my mail.What's this problem?How to check and fix it? >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -- ??? ???? http://pc.aspa.idv.tw ??Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong at aspa.idv.tw Email (2) : ak6783 at gmail.com ?? : 0960599655 -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150310/bfd6261a/attachment.html -------------- next part -------------- A non-text attachment was scrubbed... Name: Mailscanner.conf Type: application/octet-stream Size: 13574 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150310/bfd6261a/attachment.obj From ak6783 at gmail.com Tue Mar 10 07:14:04 2015 From: ak6783 at gmail.com (=?UTF-8?B?5ZCz5rGd5Ymb?=) Date: Tue, 10 Mar 2015 15:14:04 +0800 Subject: About Sign Clean Message. In-Reply-To: References: Message-ID: I have check inline file.And make sure file is exist. 2015-03-10 8:49 GMT+08:00 ??? : > Hello, > I attachment my mailscanner.conf.Please check it. > I have restart MailScanner when I edit some settings. > > 2015-03-09 20:05 GMT+08:00 Martin Hepworth : > >> Did you restart MailScanner after you altered the file? >> >> -- >> Martin Hepworth, CISSP >> Oxford, UK >> >> On 9 March 2015 at 03:02, ??? wrote: >> >>> Hello, >>> I have installed MailScanner 4.84.6-1. >>> I have about sign clean message question.I have set Sign Clean Messages >>> = yes.And report file is correct.But I mail to anyone haven't any clean >>> message in my mail.What's this problem?How to check and fix it? >>> >>> -- >>> MailScanner mailing list >>> mailscanner at lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> > > > -- > ??? > ???? http://pc.aspa.idv.tw > ??Blog http://ak6783.blogspot.com/ > Twitter http://twitter.com/akong77 > Plurk http://www.plurk.com/akong77 > Facebook http://www.facebook.com/akong77 > Email (1) : akong at aspa.idv.tw > Email (2) : ak6783 at gmail.com > ?? : 0960599655 > -- ??? ???? http://pc.aspa.idv.tw ??Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong at aspa.idv.tw Email (2) : ak6783 at gmail.com ?? : 0960599655 -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150310/cb761128/attachment.html From Antony.Stone at mailscanner.open.source.it Tue Mar 10 08:58:16 2015 From: Antony.Stone at mailscanner.open.source.it (Antony Stone) Date: Tue, 10 Mar 2015 09:58:16 +0100 Subject: About Sign Clean Message. In-Reply-To: References: Message-ID: <201503100958.16795.Antony.Stone@mailscanner.open.source.it> On Tuesday 10 March 2015 at 01:49:05 (EU time), ??? wrote: > Hello, > I attachment my mailscanner.conf.Please check it. > I have restart MailScanner when I edit some settings. So, I can see you have: Inline HTML Signature = %report-dir%/inline.sig.html Inline Text Signature = %report-dir%/inline.sig.txt Sign Clean Messages = %rules-dir%/scm.rules I assume you have checked that both of those inline signature files exist and have appropriate content. Please show us what scm.rules says, and then give us an example (just the To: and From: domains) of an email which did not get signed. Regards, Antony. -- The truth is rarely pure, and never simple. - Oscar Wilde Please reply to the list; please *don't* CC me. From ak6783 at gmail.com Tue Mar 10 10:02:02 2015 From: ak6783 at gmail.com (=?UTF-8?B?5ZCz5rGd5Ymb?=) Date: Tue, 10 Mar 2015 18:02:02 +0800 Subject: About Sign Clean Message. In-Reply-To: <201503100958.16795.Antony.Stone@mailscanner.open.source.it> References: <201503100958.16795.Antony.Stone@mailscanner.open.source.it> Message-ID: OK, My scm.rules content is follow: From: mountain.chen at linguitronics.com yes From: mailmaster at linguitronics.com yes From: akong at linguitronics.com yes FromOrTo: default no Is it all right? 2015-03-10 16:58 GMT+08:00 Antony Stone < Antony.Stone at mailscanner.open.source.it>: > On Tuesday 10 March 2015 at 01:49:05 (EU time), ??? wrote: > > > Hello, > > I attachment my mailscanner.conf.Please check it. > > I have restart MailScanner when I edit some settings. > > So, I can see you have: > > Inline HTML Signature = %report-dir%/inline.sig.html > Inline Text Signature = %report-dir%/inline.sig.txt > Sign Clean Messages = %rules-dir%/scm.rules > > I assume you have checked that both of those inline signature files exist > and > have appropriate content. > > Please show us what scm.rules says, and then give us an example (just the > To: > and From: domains) of an email which did not get signed. > > > Regards, > > > Antony. > > -- > The truth is rarely pure, and never simple. > > - Oscar Wilde > > Please reply to the > list; > please *don't* CC > me. > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- ??? ???? http://pc.aspa.idv.tw ??Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong at aspa.idv.tw Email (2) : ak6783 at gmail.com ?? : 0960599655 -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150310/136b0216/attachment.html From Antony.Stone at mailscanner.open.source.it Tue Mar 10 11:26:14 2015 From: Antony.Stone at mailscanner.open.source.it (Antony Stone) Date: Tue, 10 Mar 2015 12:26:14 +0100 Subject: About Sign Clean Message. In-Reply-To: References: <201503100958.16795.Antony.Stone@mailscanner.open.source.it> Message-ID: <201503101226.14889.Antony.Stone@mailscanner.open.source.it> On Tuesday 10 March 2015 at 11:02:02 (EU time), ??? wrote: > OK, > My scm.rules content is follow: > From: mountain.chen at linguitronics.com yes > From: mailmaster at linguitronics.com yes > From: akong at linguitronics.com yes > FromOrTo: default no > Is it all right? That looks okay to me. Now please give us an example (just the To: and From: domains) of an email which did not get signed. If you can supply the full headers of such an email that would also be helpful. Antony. -- Users don't know what they want until they see what they get. Please reply to the list; please *don't* CC me. From kevin.miller at juneau.org Tue Mar 10 19:23:47 2015 From: kevin.miller at juneau.org (Kevin Miller) Date: Tue, 10 Mar 2015 19:23:47 +0000 Subject: v4.85.2-0 Beta (Red Hat, SuSE, Tarball) In-Reply-To: References: Message-ID: <55415e1947a7415a8d3f1e7f2c6a8e56@City-Exch-DB1.cbj.local> What will happen to the old version in /usr/lib/MailScanner? Does that get cleaned up in the install? ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 > -----Original Message----- > From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- > bounces at lists.mailscanner.info] On Behalf Of Jerry Benton > Sent: Sunday, March 01, 2015 7:20 PM > To: MailScanner discussion > Subject: v4.85.2-0 Beta (Red Hat, SuSE, Tarball) > > Beta builds with the new directory structure in /usr/share/MailScanner. > Lab tested. I am working on the Debian package now. > > > > RHEL > https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2- > 0.rpm.tar.gz > > SuSE > https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2-0.suse- > rpm.tar.gz > > Tarball > https://s3.amazonaws.com/mailscanner/test/MailScanner-install-4.85.2- > 0.tar.gz > > > > - > Jerry Benton > www.mailborder.com > > > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From kevin.miller at juneau.org Tue Mar 10 20:01:49 2015 From: kevin.miller at juneau.org (Kevin Miller) Date: Tue, 10 Mar 2015 20:01:49 +0000 Subject: Install script stuck in a loop? Message-ID: I'm running the rpm install script (Centos 7), using postfix. It seems to be stuck in a loop trying to do SPF lookups. I killed it after 105+ fails. # Detailed debug log for test(s) 105: # | 91.spf1-test.mailzone.com new: ipv4=192.0.2.129, sender=91.spf1-test.mailzone.com, helo=91.spf1-test.mailzone.com # | postmaster 91.spf1-test.mailzone.com localpart is postmaster # || postmaster 91.spf1-test.mailzone.com DirectiveSet->new(): doing TXT query on 91.spf1-test.mailzone.com # || postmaster 91.spf1-test.mailzone.com myquery: doing TXT query on 91.spf1-test.mailzone.com # || postmaster 91.spf1-test.mailzone.com myquery: 91.spf1-test.mailzone.com TXT failed: NXDOMAIN. # || postmaster 91.spf1-test.mailzone.com DirectiveSet->new(): TXT query on 91.spf1-test.mailzone.com returned error=, last_dns_error=NXDOMAIN # || postmaster 91.spf1-test.mailzone.com DirectiveSet->new(): SPF policy: # || postmaster 91.spf1-test.mailzone.com no SPF record found for 91.spf1-test.mailzone.com # || postmaster 91.spf1-test.mailzone.com header_comment: spf_source = domain of 91.spf1-test.mailzone.com # || postmaster 91.spf1-test.mailzone.com header_comment: spf_source_type = original-spf-record # Test 106 got: "unknown" (t/00_all.t at line 127 fail #103) # Expected: "fail" # Detailed debug log for test(s) 106: # | 92.spf1-test.mailzone.com new: ipv4=192.168.2.1, sender=92.spf1-test.mailzone.com, helo=92.spf1-test.mailzone.com # | postmaster 92.spf1-test.mailzone.com localpart is postmaster # || postmaster 92.spf1-test.mailzone.com DirectiveSet->new(): doing TXT query on 92.spf1-test.mailzone.com # || postmaster 92.spf1-test.mailzone.com myquery: doing TXT query on 92.spf1-test.mailzone.com # || postmaster 92.spf1-test.mailzone.com myquery: 92.spf1-test.mailzone.com TXT failed: NXDOMAIN. # || postmaster 92.spf1-test.mailzone.com DirectiveSet->new(): TXT query on 92.spf1-test.mailzone.com returned error=, last_dns_error=NXDOMAIN # || postmaster 92.spf1-test.mailzone.com DirectiveSet->new(): SPF policy: # || postmaster 92.spf1-test.mailzone.com no SPF record found for 92.spf1-test.mailzone.com # || postmaster 92.spf1-test.mailzone.com header_comment: spf_source = domain of 92.spf1-test.mailzone.com # || postmaster 92.spf1-test.mailzone.com header_comment: spf_source_type = original-spf-record I chose not to install an MTA (postfix was already installed), nor clam, nor spamassassin. They were installed from source since updates for them always seem to lag way behind a new release. Pretty much took the defaults on the rest. Complete install log can be perused at ftp://ftp.ci.juneau.ak.us/pub/MailScanner/ ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 From jerry.benton at mailborder.com Tue Mar 10 20:38:31 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Tue, 10 Mar 2015 16:38:31 -0400 Subject: v4.85.2-0 Beta (Red Hat, SuSE, Tarball) In-Reply-To: <55415e1947a7415a8d3f1e7f2c6a8e56@City-Exch-DB1.cbj.local> References: <55415e1947a7415a8d3f1e7f2c6a8e56@City-Exch-DB1.cbj.local> Message-ID: <44856219-CC3A-4928-A1B9-D33C7D0E3DB1@mailborder.com> I haven?t done it yet, but I am going to add something like to the postinstall if [-d ?/usr/lib/MailScanner? ]; then cp -f /usr/lib/MailScanner/CustomFunctions /usr/share/MailScanner/MailScanner/CustomFunctions/* /usr/share/MailScanner/MailScanner/CustomFunctions rm -rf /usr/lib/MailScanner fi - Jerry Benton www.mailborder.com > On Mar 10, 2015, at 3:23 PM, Kevin Miller wrote: > > What will happen to the old version in /usr/lib/MailScanner? Does that get cleaned up in the install? > > ...Kevin > -- > Kevin Miller > Network/email Administrator, CBJ MIS Dept. > 155 South Seward Street > Juneau, Alaska 99801 > Phone: (907) 586-0242, Fax: (907) 586-4500 > Registered Linux User No: 307357 > > >> -----Original Message----- >> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- >> bounces at lists.mailscanner.info] On Behalf Of Jerry Benton >> Sent: Sunday, March 01, 2015 7:20 PM >> To: MailScanner discussion >> Subject: v4.85.2-0 Beta (Red Hat, SuSE, Tarball) >> >> Beta builds with the new directory structure in /usr/share/MailScanner. >> Lab tested. I am working on the Debian package now. >> >> >> >> RHEL >> https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2- >> 0.rpm.tar.gz >> >> SuSE >> https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2-0.suse- >> rpm.tar.gz >> >> Tarball >> https://s3.amazonaws.com/mailscanner/test/MailScanner-install-4.85.2- >> 0.tar.gz >> >> >> >> - >> Jerry Benton >> www.mailborder.com >> >> >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From jerry.benton at mailborder.com Tue Mar 10 20:45:44 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Tue, 10 Mar 2015 16:45:44 -0400 Subject: Install script stuck in a loop? In-Reply-To: References: Message-ID: That is a failure on the SPF record. (Bad DNS entry or format.). MailScanner kept looping on the same message? - Jerry Benton www.mailborder.com > On Mar 10, 2015, at 4:01 PM, Kevin Miller wrote: > > last_dns_error=NXDOMAIN From kevin.miller at juneau.org Tue Mar 10 21:56:32 2015 From: kevin.miller at juneau.org (Kevin Miller) Date: Tue, 10 Mar 2015 21:56:32 +0000 Subject: Install script stuck in a loop? In-Reply-To: References: Message-ID: It was when running the install scripts. It got to the part where it does some testing and just kept looping, incrementing the hostname by 1 and failing each time. Here's where it starts: Running make for J/JM/JMEHNLE/mail-spf-query/Mail-SPF-Query-1.999.1.tar.gz Has already been unwrapped into directory /root/.cpan/build/Mail-SPF-Query-1.999.1-oPA2yy CPAN.pm: Building J/JM/JMEHNLE/mail-spf-query/Mail-SPF-Query-1.999.1.tar.gz cp lib/Mail/SPF/Query.pm blib/lib/Mail/SPF/Query.pm cp bin/spfd blib/script/spfd /usr/bin/perl -MExtUtils::MY -e 'MY->fixin(shift)' -- blib/script/spfd cp bin/spfquery blib/script/spfquery /usr/bin/perl -MExtUtils::MY -e 'MY->fixin(shift)' -- blib/script/spfquery Manifying blib/man1/spfd.1 Manifying blib/man1/spfquery.1 Manifying blib/man3/Mail::SPF::Query.3pm JMEHNLE/mail-spf-query/Mail-SPF-Query-1.999.1.tar.gz /usr/bin/make -- OK Running make test PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t # Test 3 got: "unknown" (t/00_all.t at line 127 fail #2) # Expected: "neutral" # t/00_all.t line 127 is: my $ok = ok($result, $expected_result); # Detailed debug log for test(s) 3: # | 01.spf1-test.mailzone.com new: ipv4=192.0.2.1, sender=01.spf1-test.mailzone.com, helo=01.spf1-test.mailzone.com # | postmaster 01.spf1-test.mailzone.com localpart is postmaster #... So maybe it's the CPAN Mail-SPF-Query install routine? ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 > -----Original Message----- > From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- > bounces at lists.mailscanner.info] On Behalf Of Jerry Benton > Sent: Tuesday, March 10, 2015 12:46 PM > To: MailScanner discussion > Subject: Re: Install script stuck in a loop? > > That is a failure on the SPF record. (Bad DNS entry or format.). > MailScanner kept looping on the same message? > > - > Jerry Benton > www.mailborder.com > > > > > On Mar 10, 2015, at 4:01 PM, Kevin Miller > wrote: > > > > last_dns_error=NXDOMAIN > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From jerry.benton at mailborder.com Tue Mar 10 22:36:09 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Tue, 10 Mar 2015 18:36:09 -0400 Subject: Install script stuck in a loop? In-Reply-To: References: Message-ID: <66C898FE-80B5-4F0C-994E-045F205B48E0@mailborder.com> Ah ok, that is a CPAN thing with the package then. Did you select to use EPEL? I think that is covered in EPEL. - Jerry Benton www.mailborder.com > On Mar 10, 2015, at 5:56 PM, Kevin Miller wrote: > > It was when running the install scripts. It got to the part where it does some testing and just kept looping, incrementing the hostname by 1 and failing each time. > Here's where it starts: > > Running make for J/JM/JMEHNLE/mail-spf-query/Mail-SPF-Query-1.999.1.tar.gz > Has already been unwrapped into directory /root/.cpan/build/Mail-SPF-Query-1.999.1-oPA2yy > > CPAN.pm: Building J/JM/JMEHNLE/mail-spf-query/Mail-SPF-Query-1.999.1.tar.gz > > cp lib/Mail/SPF/Query.pm blib/lib/Mail/SPF/Query.pm > cp bin/spfd blib/script/spfd > /usr/bin/perl -MExtUtils::MY -e 'MY->fixin(shift)' -- blib/script/spfd > cp bin/spfquery blib/script/spfquery > /usr/bin/perl -MExtUtils::MY -e 'MY->fixin(shift)' -- blib/script/spfquery > Manifying blib/man1/spfd.1 > Manifying blib/man1/spfquery.1 > Manifying blib/man3/Mail::SPF::Query.3pm > JMEHNLE/mail-spf-query/Mail-SPF-Query-1.999.1.tar.gz > /usr/bin/make -- OK > Running make test > PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t > # Test 3 got: "unknown" (t/00_all.t at line 127 fail #2) > # Expected: "neutral" > # t/00_all.t line 127 is: my $ok = ok($result, $expected_result); > # Detailed debug log for test(s) 3: > # | 01.spf1-test.mailzone.com new: ipv4=192.0.2.1, sender=01.spf1-test.mailzone.com, helo=01.spf1-test.mailzone.com > # | postmaster 01.spf1-test.mailzone.com localpart is postmaster > #... > > So maybe it's the CPAN Mail-SPF-Query install routine? > > ...Kevin > -- > Kevin Miller > Network/email Administrator, CBJ MIS Dept. > 155 South Seward Street > Juneau, Alaska 99801 > Phone: (907) 586-0242, Fax: (907) 586-4500 > Registered Linux User No: 307357 > > >> -----Original Message----- >> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- >> bounces at lists.mailscanner.info] On Behalf Of Jerry Benton >> Sent: Tuesday, March 10, 2015 12:46 PM >> To: MailScanner discussion >> Subject: Re: Install script stuck in a loop? >> >> That is a failure on the SPF record. (Bad DNS entry or format.). >> MailScanner kept looping on the same message? >> >> - >> Jerry Benton >> www.mailborder.com >> >> >> >>> On Mar 10, 2015, at 4:01 PM, Kevin Miller >> wrote: >>> >>> last_dns_error=NXDOMAIN >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From kevin.miller at juneau.org Tue Mar 10 22:58:58 2015 From: kevin.miller at juneau.org (Kevin Miller) Date: Tue, 10 Mar 2015 22:58:58 +0000 Subject: Install script stuck in a loop? In-Reply-To: <66C898FE-80B5-4F0C-994E-045F205B48E0@mailborder.com> References: <66C898FE-80B5-4F0C-994E-045F205B48E0@mailborder.com> Message-ID: <000ed11d2556444b91ba00212fc7f0e6@City-Exch-DB1.cbj.local> I already had EPEL installed, so I said not to install it but it looks like it was recognizing it was available: Loaded plugins: fastestmirror, langpacks Loading mirror speeds from cached hostfile * base: mirror.tocici.com * epel: mirror.steadfast.net * extras: centos.sonn.com * updates: cosmos.cites.illinois.edu No package 'perl(Mail::SPF::Query)' available. Error: Nothing to do The install log can be viewed at ftp://ftp.ci.juneau.ak.us/pub/MailScanner/mailscanner-install.log if that's any help... ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 > -----Original Message----- > From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- > bounces at lists.mailscanner.info] On Behalf Of Jerry Benton > Sent: Tuesday, March 10, 2015 2:36 PM > To: MailScanner discussion > Subject: Re: Install script stuck in a loop? > > Ah ok, that is a CPAN thing with the package then. Did you select to use > EPEL? I think that is covered in EPEL. > > - > Jerry Benton > www.mailborder.com > > > > > On Mar 10, 2015, at 5:56 PM, Kevin Miller > wrote: > > > > It was when running the install scripts. It got to the part where it > does some testing and just kept looping, incrementing the hostname by 1 > and failing each time. > > Here's where it starts: > > > > Running make for > > J/JM/JMEHNLE/mail-spf-query/Mail-SPF-Query-1.999.1.tar.gz > > Has already been unwrapped into directory > > /root/.cpan/build/Mail-SPF-Query-1.999.1-oPA2yy > > > > CPAN.pm: Building > > J/JM/JMEHNLE/mail-spf-query/Mail-SPF-Query-1.999.1.tar.gz > > > > cp lib/Mail/SPF/Query.pm blib/lib/Mail/SPF/Query.pm cp bin/spfd > > blib/script/spfd /usr/bin/perl -MExtUtils::MY -e 'MY->fixin(shift)' -- > > blib/script/spfd cp bin/spfquery blib/script/spfquery /usr/bin/perl > > -MExtUtils::MY -e 'MY->fixin(shift)' -- blib/script/spfquery Manifying > > blib/man1/spfd.1 Manifying blib/man1/spfquery.1 Manifying > > blib/man3/Mail::SPF::Query.3pm > > JMEHNLE/mail-spf-query/Mail-SPF-Query-1.999.1.tar.gz > > /usr/bin/make -- OK > > Running make test > > PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" > > "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t # Test 3 got: > "unknown" (t/00_all.t at line 127 fail #2) > > # Expected: "neutral" > > # t/00_all.t line 127 is: my $ok = ok($result, > $expected_result); > > # Detailed debug log for test(s) 3: > > # | 01.spf1-test.mailzone.com new: ipv4=192.0.2.1, > sender=01.spf1-test.mailzone.com, helo=01.spf1-test.mailzone.com > > # | postmaster 01.spf1-test.mailzone.com localpart is > postmaster > > #... > > > > So maybe it's the CPAN Mail-SPF-Query install routine? > > > > ...Kevin > > -- > > Kevin Miller > > Network/email Administrator, CBJ MIS Dept. > > 155 South Seward Street > > Juneau, Alaska 99801 > > Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: > > 307357 > > > > > >> -----Original Message----- > >> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- > >> bounces at lists.mailscanner.info] On Behalf Of Jerry Benton > >> Sent: Tuesday, March 10, 2015 12:46 PM > >> To: MailScanner discussion > >> Subject: Re: Install script stuck in a loop? > >> > >> That is a failure on the SPF record. (Bad DNS entry or format.). > >> MailScanner kept looping on the same message? > >> > >> - > >> Jerry Benton > >> www.mailborder.com > >> > >> > >> > >>> On Mar 10, 2015, at 4:01 PM, Kevin Miller > >> wrote: > >>> > >>> last_dns_error=NXDOMAIN > >> > >> -- > >> MailScanner mailing list > >> mailscanner at lists.mailscanner.info > >> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >> > >> Before posting, read http://wiki.mailscanner.info/posting > >> > >> Support MailScanner development - buy the book off the website! > > -- > > MailScanner mailing list > > mailscanner at lists.mailscanner.info > > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > > > Before posting, read http://wiki.mailscanner.info/posting > > > > Support MailScanner development - buy the book off the website! > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From ak6783 at gmail.com Wed Mar 11 01:24:58 2015 From: ak6783 at gmail.com (=?UTF-8?B?5ZCz5rGd5Ymb?=) Date: Wed, 11 Mar 2015 09:24:58 +0800 Subject: About Sign Clean Message. In-Reply-To: <201503101226.14889.Antony.Stone@mailscanner.open.source.it> References: <201503100958.16795.Antony.Stone@mailscanner.open.source.it> <201503101226.14889.Antony.Stone@mailscanner.open.source.it> Message-ID: Hello, This attachment is from akong at linguitronics.com to ak6783 at gmail.com. Please check it. 2015-03-10 19:26 GMT+08:00 Antony Stone < Antony.Stone at mailscanner.open.source.it>: > On Tuesday 10 March 2015 at 11:02:02 (EU time), ??? wrote: > > > OK, > > My scm.rules content is follow: > > From: mountain.chen at linguitronics.com yes > > From: mailmaster at linguitronics.com yes > > From: akong at linguitronics.com yes > > FromOrTo: default no > > Is it all right? > > That looks okay to me. > > Now please give us an example (just the To: and From: domains) of an email > which did not get signed. > > If you can supply the full headers of such an email that would also be > helpful. > > > Antony. > > > -- > Users don't know what they want until they see what they get. > > Please reply to the > list; > please *don't* CC > me. > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- ??? ???? http://pc.aspa.idv.tw ??Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong at aspa.idv.tw Email (2) : ak6783 at gmail.com ?? : 0960599655 -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150311/d94b9fec/attachment.html -------------- next part -------------- Delivered-To: ak6783 at gmail.com Received: by 10.170.89.4 with SMTP id g4csp2582118yka; Tue, 10 Mar 2015 18:17:21 -0700 (PDT) X-Received: by 10.66.145.41 with SMTP id sr9mr35724704pab.18.1426036639788; Tue, 10 Mar 2015 18:17:19 -0700 (PDT) Return-Path: Received: from tw.linguitronics.com (tw.linguitronics.com. [220.130.148.52]) by mx.google.com with ESMTP id tb7si3893025pac.140.2015.03.10.18.17.19 for ; Tue, 10 Mar 2015 18:17:19 -0700 (PDT) Received-SPF: pass (google.com: domain of akong at linguitronics.com designates 220.130.148.52 as permitted sender) client-ip=220.130.148.52; Authentication-Results: mx.google.com; spf=pass (google.com: domain of akong at linguitronics.com designates 220.130.148.52 as permitted sender) smtp.mail=akong at linguitronics.com; dkim=pass header.i=@linguitronics.com Received: from [127.0.0.1] (eta-004-win7-tc.linguitronics.com [192.168.2.4]) by tw.linguitronics.com (Postfix) with ESMTP id D211340172 for ; Wed, 11 Mar 2015 09:17:11 +0800 (CST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linguitronics.com; s=key2; t=1426036631; bh=7eRSSbqA7sf9sLWxwYAtFWZNINsdnFBCSBoH4pXLT+k=; h=Date:From:To:Subject; b=TEFLdOuONSJ6KugYGk3LCp3i/2LqW2tVB6K72hQXS57Htvx6H0X37/i/8S5zC70q/ TJw5EEs0P5o3ataK2WUrikBLf0/ICcRBBZAl/7HHnV9kIUPmZ0k6EnFBMrBOIX2hpZ u34cqFU/YlXM292L6h9NoXAMChAAPkuJkXZtOmXw= Message-ID: <54FF9798.4060105 at linguitronics.com> Date: Wed, 11 Mar 2015 09:17:12 +0800 From: Akong User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.5.0 MIME-Version: 1.0 To: ak6783 at gmail.com Subject: test mail Content-Type: multipart/alternative; boundary="------------070501040507040909000001" X-Antivirus: avast! (VPS 150310-1, 2015/03/10), Outbound message X-Antivirus-Status: Clean X-Linguitronics-MailScanner-Information: Please contact the ISP for more information X-Linguitronics-MailScanner-ID: D211340172.AEFB8 X-Linguitronics-MailScanner: Found to be clean X-Linguitronics-MailScanner-From: akong at linguitronics.com X-Spam-Status: No This is a multi-part message in MIME format. --------------070501040507040909000001 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit test mail -- *Akong Wu ??? *System Engineer *Linguitronics Co., Ltd.* 14F, No.57, Fuxing North Road, Taipei city, Taiwan(105) Tel: +886 (2) 2740-0706 ext 899 Fax: +886 (2) 2740-0566 Email: akong at linguitronics.com Skype: akong at linguitronics.com URL: www.linguitronics.com *Helps You Localize, Helps You Globalize* --------------070501040507040909000001 Content-Type: multipart/related; boundary="------------090600070004090900020000" --------------090600070004090900020000 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit test mail
--

--------------090600070004090900020000 Content-Type: image/jpeg; name="Line.jpg" Content-Transfer-Encoding: base64 Content-ID: Content-Disposition: inline; filename="Line.jpg" /9j/4AAQSkZJRgABAQEASABIAAD/2wBDAAUDBAQEAwUEBAQFBQUGBwwIBwcHBw8LCwkMEQ8S EhEPERETFhwXExQaFRERGCEYGh0dHx8fExciJCIeJBweHx7/2wBDAQUFBQcGBw4ICA4eFBEU Hh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh7/wAAR CAACAcIDASEAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAA AgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkK FhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWG h4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl 5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREA AgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYk NOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOE hYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk 5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwDzWivEP0sKKACigAooAKKACigAooAKKACi gAooAKKACigAooAKKACigAooAKKACigAooAKKACigAooAKKACigAooAKKACigAooAKKAP//Z --------------090600070004090900020000 Content-Type: image/jpeg; name="G_x0020_1" Content-Transfer-Encoding: base64 Content-ID: Content-Disposition: inline; filename="G_x0020_1" /9j/4AAQSkZJRgABAgAAAQABAAD/4QDdRXhpZgAASUkqAAgAAAAIABIBAwABAAAAAQAAABoB BQABAAAAbgAAABsBBQABAAAAdgAAACgBAwABAAAAAgAAADEBAgAVAAAAfgAAADIBAgAUAAAA kwAAABMCAwABAAAAAQAAAGmHBAABAAAApwAAAAAAAABgAAAAAQAAAGAAAAABAAAAQUNEIFN5 c3RlbXMgvMam7KaoubMAMjAwODowODoyMSAxNzo0MDoxOQADAJCSAgAEAAAAOTU3AAKgBAAB AAAANAAAAAOgBAABAAAASQAAAAAAAADExcbH/8AAEQgASQA0AwEhAAIRAQMRAf/bAIQAAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEB/8QA1AAAAgEFAAMAAAAAAAAAAAAACQoIAgQFBgcAAQMQAAAE BAQCBAINFw0AAAAAAAECAwQFBgcRCAkSIQATFCIxQQpRFRYXMjM0NTlhcXeBtRgZJThCUlVY YnJ0eJGWobGytsHF09TwJicoU1aCkpOUlZej1QEAAgIDAQAAAAAAAAAAAAAABgcICQMEBQoR AAIBAwMCAwMGBg8JAQAAAAECAwQFEQYHEgghABMxIiNBCRQyUWGzFRYzQnFyGCQlNDY4c3V2 gZGxssHwGUNEU1VidJa01P/aAAwDAQACEQMRAD8An1nDZkuMrDNjMiNKKI1dGRpGh9NJAjqc FSlKUosIRaYGTtxEHvklHoI+dnUVOkmQl1ClTKUS2ABASivRzrcyNpuliVUbk0gUCKyLTMpC 6h1gUoGl1MCaw69t77m8YFiPrPdjWFh1XqGyW9oTDT145K1O7n2EyPbWVR25HB48sdjyyGi9 GfSt8nx0r7j9Oe0O4Or9HyVeq9W6Nt9xuFzN1ajeKWren+eTxKQsfsNFCrhln7ufZZgjJcfH u8yf6Z1P7yKYf+Fx4Gd3mTfTOk+8elwfqMf433uGkXbezXqdx5A+HemmP+GY/wB3w+3xIL/Z gdHP/R6n/wBih/8Ay/5eKT53WZMICA4niWEBAf5E0uDtt3hARt75R8e/bx6JnY5kRzFIXEwY w3AeUSRKYra73L6EnLusbXAb7j1QABEw24xS7069ngqVk+b+X5alz81mAGHyGblKBgH7GIzk g9iuSL5MTovDpE+nqieodlji/d0M37Z5RoitHTr9No3IXi2SvtZ9keGQcorGPiQxJ4ZJpn+s 1Q1ZwmxlWmbJYbRMJfl6FglBIbKkhPmrIG0Hh7VqPKexWILiodMVxFwKahxKkmVIpfmizt9G Vf8AQtP2HEoNK6orbtp2z3GdV82roopJPYP0h7BPbI78c/35OD4om6gNm9C6C3o3H0ZYbU1J Z9N6mrLVQU7Vbu0UFMsS8SwUgkvyY4OO/wCgeE2PCAUiNsxCPh1zAhR6kiigiJR5qiTCIrXt otpNpTLYwb2MBrXKBXCKc4UcMS8gyJFH+HiiLxd7JcpqunTil0kqOlFlYCwWVcuXK0FMusJj ahOJlVVDGHUJTbnKH6MoqW5bj7mtcooJWir6OBWKAqpqBWuMCWOTAC0RQ/ncnTuyqWV9dV+q dUaZ6Mvk/aiyajulkluGiNxmuIs9bV0UVZTQVemDbYZ1hImlkplkYNyd4izHguDlN9JhRwpn AB+JyoYACF7+ZdI1rXtcACDgJg7B2AfZC4XNWGE7CmN7YdKFf8WSUH6lN+j9HDVksVhh5tLR 06qGEYYwQujsRy7BIGfsB3yqr+k441tx7nbnzRLIusdW98dje7grYK5yQZV7AnHxOe/ce0vz Wwm4V+Wfl4c6EGU0iKYGpZJWkTBbYfkKTa1+/wAV+3qiGztsP9B6c5e9TJkkCj9LJRj7SdKY tEY5LkjSzA402bvZtYouiIRSGwxo5bprpn5Z7HEFAHlmKYTFEvC1TZ7C2kdRvT09KrfgyqzJ 5CR8DHA7pj3EcnqSWKn1CEHKHw8emfc/c89RGx9BUa01M9Hcd19AwVNJNeLo6zwfjDSipSYe Y9PJFNE4hEcqtnMoZSrqfEdMhhfk4N55A4gPMxFzwsQUiqkIJVZDpaa4FIQShqNqNv1t+uGv VwbHphPq/wDv/Z8CGhOB0hYcTqR8xXGDKo/KSeg4dh9n+lkh1cUp/ZL708WBDa6uzAll/PMT f8vPx+IB7Dl38KJ+EF+uJTV7jlKvgqIcM/5glUKjUYywJyqZSabYpI8/SvTKl68AmeCnQJFI Ws/cSxC3CrPpLdy3UUM1eqgKSyCxDl1XINgEvFstRJSam3tq4s+bSzUtRFx7HzIaTUEkZGP+ 9VP2/X8Vam8lntWodkfkm9PXyn+d2bUFXVWO6UvEOKigvGr9BW6qhKGOUMJYalkIMbAg+0CP Cd7PNOzNnhTOWeKesbtuKolIs3ZwsyBipdQwFUJLJ26ggb0QiRj8o4impoMTq3Bs03M5KYwB ierSew9oMYZYfZAPKsG390Nw79xKkTulueYYpY6qoWmmMjQzrFVSiXi+HHJJT9FiexXtjB7r 4tcHQ10UxTSQz7eaD82ENDLTS1dlp6yOWGqqoZGnik4OvIRRjvCmXUnJblxpHNLzOVLEHE7W oura4MoaFvfCVhH8H4QDjkla8dGOOuEhxGnNcK3VMnmn8RdQ5/EIDMzVoSELO4Y6K6hThdZG As9Kzd6RNRqAuCidyVILGESgXUr9xdxbjarhR3CpqJLfUQNDUu0NTHxSQcXUNJJj2kyGHBs5 HxwykGluj/pA0tqbT9/0xt1oal1BY73arvZ6+nrrNNV01wo6nzqSWGKCUTFqeqip5o2EXd/R 5OLIjE2QqqBcG09ddEoGxHT4oUVRG5ynkal5uYUggAppqCImInbqgN97hpNpzy/1rTiSmgqK NNHaeXzUb9zomJ9r1dmY/wC7+BOPj6ep9fFFHVvCV6lt6QPnDj8e7uQxYdwWjI9YM4AOB9Yw fq8KF+EF+uJTV7jlKvgqIcMhZqZiEyhqnqHABFOmNHjphew6/JuTAuXYesBTGEPa7724G6Fi t634ZThhFkH0IP4M1H3H2j1/s8PLcN3TbH5H14xl01NSMAOxPHX23RIH6Rn/AD8aVkSQmFOM uamz91DYUs7Cd6qoArEIc1cGOgWbljJ9dRHnL6DXKmYDKAUoiUPOgBTKpS/La6JVkoFBnAnC 4qGhMPJqG+nzijNM4dneUOzsG1+G9t/FE2h9LfNljVEsdrLRAgRpJNT+bM6RYU+ZUSe1NJ3V yi5IPitTqnqUTqn38EtdXxXGbeDc4CctJk26DWdxFPSmoNL2ggeVjBTGUCLzJWWPuWS9JLMu aSqFl+CEMA9UQhUPuA9mq3Rdx329jtC49UM+fNAoKxy4KkO2cKhjV0M+UnILhtDmiC+k04tR MHNTQIcANpDVpNuAB8zYC49cwwVOjtVCamjLQ2O8EeYob3kNE0kUq+zgFHPKMjuG75yAfG50 tVNR+yY2JX51NIs+7W3NLMTI3vqWXVVIJKeVgB5kEmW5RMGRgzAgBvZhHkIpENgznjUBTacR k9FLqLcQKEi0usUPYC+2wcG25CXzif8Ag4FtBqv4maZ9kd7PRk/aWiUsf0k5J+36/XxLPq4k kPUvvUPMfC68vCKObYCo0aIo9vsqqqqo+AAHfAPhQ7wgv1xKavccpV8FRDhj3NZKc2UFVIUi lOoSllJDplNawm8lpPALB26wvdMwB1DgU47FExQ+haNb1vyZW4x+SQzYY4za9SAdlViRyK57 AfFmAyyurcd3j2t+SDeMEyDUEPlgAktIddbehAOIJyzFR6faT6MqTVNMV2KKikJh0LpTXysd NZUYRJ2eDQmWptjcIlRvEFlQdPQZMLkgz52quYxogksk6EypjkOSwAQps8C2f9V+TJogEh4z n6NSabxJ4nDTVbYMEodPsnmcKaOnzO0hSKEKnGCthEvSPIuFw2Y4YkbnoKRflGIVVaF3Svel Ky00dxEjWZ6a3wsXEr8Kb3qxSIQZOHEHPlqpDJHwZcLyWwDq86F9o9/9Ha21Bt9ZbPS7s0Vb ebuLrbjbKOou1/WSpe5Wm9K0FI05rauVQKusqh5FQwljneUlZXHJYmeX5tgkEmCWI0wj8Aj8 PZRiCReGOivobFYXEGoO2b5i+SDo7hBy3Eq6RyGETJCU4lLcB4EPn6etr1F90ClHj/ti27u7 +L93EttaTrVaI1FUoMJUaYvEyHkGDK9A5DDAGAfqPf7B+d52+lqiqLb1N7DUFWkkVVR7z7f0 tRFKGWWGan1lTQSwzIQGSWOSMxyRthlZCHXIHGB+Qh8pnPP2x09/mLS3g3HAfoP+Bmmf5mof uV8S26t/4y+9f9Pr196nhQjwgv1xKavccpV8FRDhj7NW0/Gh6ndXUoNLqSgiUREpOaMVlAAF UAGxyFKJjaB03MAbiNg4C6VxHd9+nK8gIe6/WDbdRg+mfTOfT4Z7+Htr0TNtr8j6tOEaY6jg EayY8st+Pe3mOeSAV/rHp657+ORZKVJKbVXyz5HhVSJFlCeYQ6naq6JobNctQKPNFmxZtcEB BROKwp2bQiKihUy6wsXTpN1QHgbmbrk2yfSCSo9iiwnwZ3BZXl8TxWrFIGazx9D4DA+Wcis6 yUo7O5cs4NBxExpjlVqoo2SaORircEGbFZEm9fND2/UW0tnq6GijF2odOWeuilVI1lCU9slk liZhEpkWRmcqME+bwIOCx8CG1fVRqfZf5Q3c/TVxv1bPtZrvfrXmlL7bKyprZaKlu9z1zUx2 W6xU7SNHSPSVcFLDPVGm+bpQNL5jBo6d4pNeDrYsYrPlPp3wnzdGDvX1G0Wk50xO7U1reZzM T00PjEsthMmOphK0xnZO4WKaheQ3jQMgL0RqUpJq5+Q3y16jdwBP9Jx+7OLb2At3dt/bEeOx ZLtJedj5aqZ+dRHpK/Uk55Mx50kE8K8i2TyMaxls9z2LDJz4X25e3MG2PypVoslBSmjs956h tttaWmDkjIsOsr/a79XrD5aLGII71WXOKFFRQkcax9+Ct4gjkIfKZzz9sdPf5i0t4NxxvaD/ AIGaZ/mah+5Xxh6t/wCMvvX/AE+vX3qeFCPCC/XEpq9xylXwVEOGP81YoGyhKoD3lphSASm3 uX5NSaAiWwDuIbX8Qj575kOoMfhrfnIBHkMcHuDi1alOCPiD8R8R+nKvLcEsu2XyPxVmRvxk psOjFGXOvduxlWXJB+3H9vjG5ByQDlw08uJhDy+1TLp1WAANNahzaQ0CAajBqHtub3x4LxMU rQSZYVGYBHWacUgUahTyCxiEP7OIbFIbEE+jvmr1qdIE1U3LNRZosUw2UbqnIIG2HhwaCIm0 RplXVOFXpq0wSqqlfdtR+UTGOPsPh88stlhyPqF8Vu9Uk5oOqff2sgbyWoN7dxJYPLJRYZ01 jcilWqrj9swsFeKccSjLyxnBVIHL5l9/gxzs2lESOVmcKPUiqlFxQWFRJJ7KsxQaJzLJplSG KBVR5TSALoHESkO4T5pUyiYpCsAZ9RhPlqVEER38v9JinDuv5cGo3DtHe99w7u/hP6OAg2t3 GtatmOzV2qrbCD3YQGJ1952AZyFXBAXDAkj042LdQ8kl866+h/X8hLSbkaU6cdVVrBsxvcH1 DRJUtBkHhEZaiQsjO78sFmOAfED8g1Q3xGU9bX/pGzwN/rpBpWYfmi94/O+K/wBSbrmG+d/j /M4JtBSyHRunOw7WuBBgN9FMov8AXxC5+s9/1U11bZbqU3lbBzJra5SNjljlKsMjY+peTHA7 4GBk+vhQ3wgkQNmJTUBd/wCZ2lewDcdoTEB7t/buAD3j3cMgZqhyDlCVTADF2pfSMBscLAJI 1JmsBt2CXtOAjcvafTsJRmgwbzvxg5507cMH6RNq1GAFx9L2pI17fnOg7lk4vDcTC7ZfI/8A IgFdSUZYE8SqvrzbxkLA4wGCuVJxyCMVLBCVsMg4xQy4adlEbGGf6pWKI2MNppV3ABtf7g+/ cpuDIOzCYFkylMIqHFK4AO2pIDAa+kLB3agEQv33ENTa0I4j0VpFCeEkdksYkjJKuvu4uSsh w69u7BlyAMsMZK1pdWhD9TvUZECPfby7oJnP0W/GW8yJnuMEsqY7gnK4GWBZLXGNyZP8IJkS Jw5XQeJVdwzxx0KCgkAjiNQSCwlwOohQARXblMktvqWA50lBPuBTZZ93LTy26mJavQag0k1d YOws5M0xUMAWsUVOrqHqiaxdzWAqxtNMKXTe9tOqkI2odQmAe173zKCOX3Y4AyZLlvZDZ7sf hxsF1rWC47s/JWXGRvfHbHZGCpLMWKGi3FalIlJBKFI4EBEnEqqqD6LxgRkHaS4M56Awab4j J2ENW1wGn1KRuFwC4CN99w9kduDdXT8Zful47mgFYaM06CrAi2xAghgQeTeoPcH6+w+3wv8A q2UjqS3iGD/DGt7nl3zBTHP9fr/oeFNM+uR5umnMJmN/AZOmyNQxzSKlZQewyWY8+ZHORjEE nCZHbRgs3OqkcvXIRYTEHQYwDsBR9TlW/H3UCS31OZ8qTiem+n8SaNIa/kqYnE8xaVl4azOQ 7RuMGUYdFFBocrcySBUSnszIHPEpgKZBa5/Gyi1rrOOwCvioLlV+TU/N46zy5o+KhV5U8RQE HPoT9TAeni2npSp+n/VvTB0z1W5dz2qu2qNu9LUtfZYtQah0a9203W09WtZFUUy3OonqqCeK ejpSWiWmmU4bKcT4tKf1yx6UelRrJ9LKkYoaeSc2dvHjSWZPPUWDQdq9iKxl4gu1h0NhZxQ6 WsXnqiIiYTjucBHrbyGMfNCExiExBYxjD2Dqj1TrGAbDa54UBPF3mABDvENXHCpNRbm0iLBF NdQiZVcxV7HEaqn0jxPHGMZQA4yM+qNW87UdEWqLzc7zqDS2yN01BqGrGoNRXepqtvKqre8X 7zK2aeprpqSaWaWZopZjPJI7MxZuTFgy8QmONYrZrqIyrFNLqukfqvC3EFewyoUTYTk6m2Hv ZeBMkDds4yMNM6bOIZ0dFZBVI2shxNouIiJt7qLWnHtWKWHUl1TqJiYqFKD500ePJdm5Sd4t CHDmGHKrDnCjN7C1CG6K6TB4S5Sn5yph2Hrcc+O57iAV9Csl2xdaqWqqvdXP3s00aQO5YIBx MaqhBVhgYycqVN6nR3SJWVuibi02yq1m2dNTUek6lb1oEvYqOgneso6anlLl6eKCrk+dRxQv AsUp8wqzEFWO8i2Xo1LuEKemMflmPQl8piHnV0VrFIFGGzjo6sh0uKmoUrhgkZRLWmomVQhR T1pnT1a0zAUz+kPoY8/2uI/unEqdEW680+k7FDUycZ0oU8xZA3MMXdsPzfnywRyDAEH1+Hjz 6dVV2oLn1E7uXC33+x3Kiq9X1s1LXW+9WupoqmBoafy5Kaemq5YJIuIABjkdRx4kkr4kLGPV AfsJp+JxxqZ/VAv15fxcFdJ++r5/5k33knitKx/kB/Nbfcx+KGHp+J/W/u3GGZ+lkfbP+Wpx k+L/AKtH9xL4ZNN+SuX6lm/+Gp8ZxP0sf2g/Hxbt/Pre0P6OMMP78H8m33i+B3/h7n/Kv/hX x26WfU032W5/KLxsPBRT/kY/1fAXB+ST9B/v8f/Z --------------090600070004090900020000-- --------------070501040507040909000001-- From jerry.benton at mailborder.com Wed Mar 11 02:41:13 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Tue, 10 Mar 2015 22:41:13 -0400 Subject: Install script stuck in a loop? In-Reply-To: <000ed11d2556444b91ba00212fc7f0e6@City-Exch-DB1.cbj.local> References: <66C898FE-80B5-4F0C-994E-045F205B48E0@mailborder.com> <000ed11d2556444b91ba00212fc7f0e6@City-Exch-DB1.cbj.local> Message-ID: <74BBBB93-E565-4647-89CF-1660C3156CCD@mailborder.com> Kevin, You need to let it run longer. I just installed it and it did as you mentioned and ended. It did 223 tests. Appending installation info to /usr/lib64/perl5/perllocal.pod JMEHNLE/mail-spf-query/Mail-SPF-Query-1.999.1.tar.gz /usr/bin/make install ? OK [root at msdev20 tmp]# perldoc -l Mail::SPF::Query /usr/local/share/perl5/Mail/SPF/Query.pm - Jerry Benton www.mailborder.com > On Mar 10, 2015, at 6:58 PM, Kevin Miller wrote: > > I already had EPEL installed, so I said not to install it but it looks like it was recognizing it was available: > > Loaded plugins: fastestmirror, langpacks > Loading mirror speeds from cached hostfile > * base: mirror.tocici.com > * epel: mirror.steadfast.net > * extras: centos.sonn.com > * updates: cosmos.cites.illinois.edu > No package 'perl(Mail::SPF::Query)' available. > Error: Nothing to do > > The install log can be viewed at ftp://ftp.ci.juneau.ak.us/pub/MailScanner/mailscanner-install.log if that's any help... > > ...Kevin > -- > Kevin Miller > Network/email Administrator, CBJ MIS Dept. > 155 South Seward Street > Juneau, Alaska 99801 > Phone: (907) 586-0242, Fax: (907) 586-4500 > Registered Linux User No: 307357 > > >> -----Original Message----- >> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- >> bounces at lists.mailscanner.info] On Behalf Of Jerry Benton >> Sent: Tuesday, March 10, 2015 2:36 PM >> To: MailScanner discussion >> Subject: Re: Install script stuck in a loop? >> >> Ah ok, that is a CPAN thing with the package then. Did you select to use >> EPEL? I think that is covered in EPEL. >> >> - >> Jerry Benton >> www.mailborder.com >> >> >> >>> On Mar 10, 2015, at 5:56 PM, Kevin Miller >> wrote: >>> >>> It was when running the install scripts. It got to the part where it >> does some testing and just kept looping, incrementing the hostname by 1 >> and failing each time. >>> Here's where it starts: >>> >>> Running make for >>> J/JM/JMEHNLE/mail-spf-query/Mail-SPF-Query-1.999.1.tar.gz >>> Has already been unwrapped into directory >>> /root/.cpan/build/Mail-SPF-Query-1.999.1-oPA2yy >>> >>> CPAN.pm: Building >>> J/JM/JMEHNLE/mail-spf-query/Mail-SPF-Query-1.999.1.tar.gz >>> >>> cp lib/Mail/SPF/Query.pm blib/lib/Mail/SPF/Query.pm cp bin/spfd >>> blib/script/spfd /usr/bin/perl -MExtUtils::MY -e 'MY->fixin(shift)' -- >>> blib/script/spfd cp bin/spfquery blib/script/spfquery /usr/bin/perl >>> -MExtUtils::MY -e 'MY->fixin(shift)' -- blib/script/spfquery Manifying >>> blib/man1/spfd.1 Manifying blib/man1/spfquery.1 Manifying >>> blib/man3/Mail::SPF::Query.3pm >>> JMEHNLE/mail-spf-query/Mail-SPF-Query-1.999.1.tar.gz >>> /usr/bin/make -- OK >>> Running make test >>> PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" >>> "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t # Test 3 got: >> "unknown" (t/00_all.t at line 127 fail #2) >>> # Expected: "neutral" >>> # t/00_all.t line 127 is: my $ok = ok($result, >> $expected_result); >>> # Detailed debug log for test(s) 3: >>> # | 01.spf1-test.mailzone.com new: ipv4=192.0.2.1, >> sender=01.spf1-test.mailzone.com, helo=01.spf1-test.mailzone.com >>> # | postmaster 01.spf1-test.mailzone.com localpart is >> postmaster >>> #... >>> >>> So maybe it's the CPAN Mail-SPF-Query install routine? >>> >>> ...Kevin >>> -- >>> Kevin Miller >>> Network/email Administrator, CBJ MIS Dept. >>> 155 South Seward Street >>> Juneau, Alaska 99801 >>> Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: >>> 307357 >>> >>> >>>> -----Original Message----- >>>> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- >>>> bounces at lists.mailscanner.info] On Behalf Of Jerry Benton >>>> Sent: Tuesday, March 10, 2015 12:46 PM >>>> To: MailScanner discussion >>>> Subject: Re: Install script stuck in a loop? >>>> >>>> That is a failure on the SPF record. (Bad DNS entry or format.). >>>> MailScanner kept looping on the same message? >>>> >>>> - >>>> Jerry Benton >>>> www.mailborder.com >>>> >>>> >>>> >>>>> On Mar 10, 2015, at 4:01 PM, Kevin Miller >>>> wrote: >>>>> >>>>> last_dns_error=NXDOMAIN >>>> >>>> -- >>>> MailScanner mailing list >>>> mailscanner at lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>> -- >>> MailScanner mailing list >>> mailscanner at lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From jerry.benton at mailborder.com Wed Mar 11 02:43:55 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Tue, 10 Mar 2015 22:43:55 -0400 Subject: Install script stuck in a loop? In-Reply-To: <74BBBB93-E565-4647-89CF-1660C3156CCD@mailborder.com> References: <66C898FE-80B5-4F0C-994E-045F205B48E0@mailborder.com> <000ed11d2556444b91ba00212fc7f0e6@City-Exch-DB1.cbj.local> <74BBBB93-E565-4647-89CF-1660C3156CCD@mailborder.com> Message-ID: Also, many of the tests are supposed to ?fail?. - Jerry Benton www.mailborder.com > On Mar 10, 2015, at 10:41 PM, Jerry Benton wrote: > > Kevin, > > You need to let it run longer. I just installed it and it did as you mentioned and ended. It did 223 tests. > > Appending installation info to /usr/lib64/perl5/perllocal.pod > JMEHNLE/mail-spf-query/Mail-SPF-Query-1.999.1.tar.gz > /usr/bin/make install ? OK > > [root at msdev20 tmp]# perldoc -l Mail::SPF::Query > /usr/local/share/perl5/Mail/SPF/Query.pm > > > > - > Jerry Benton > www.mailborder.com > > > >> On Mar 10, 2015, at 6:58 PM, Kevin Miller wrote: >> >> I already had EPEL installed, so I said not to install it but it looks like it was recognizing it was available: >> >> Loaded plugins: fastestmirror, langpacks >> Loading mirror speeds from cached hostfile >> * base: mirror.tocici.com >> * epel: mirror.steadfast.net >> * extras: centos.sonn.com >> * updates: cosmos.cites.illinois.edu >> No package 'perl(Mail::SPF::Query)' available. >> Error: Nothing to do >> >> The install log can be viewed at ftp://ftp.ci.juneau.ak.us/pub/MailScanner/mailscanner-install.log if that's any help... >> >> ...Kevin >> -- >> Kevin Miller >> Network/email Administrator, CBJ MIS Dept. >> 155 South Seward Street >> Juneau, Alaska 99801 >> Phone: (907) 586-0242, Fax: (907) 586-4500 >> Registered Linux User No: 307357 >> >> >>> -----Original Message----- >>> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- >>> bounces at lists.mailscanner.info] On Behalf Of Jerry Benton >>> Sent: Tuesday, March 10, 2015 2:36 PM >>> To: MailScanner discussion >>> Subject: Re: Install script stuck in a loop? >>> >>> Ah ok, that is a CPAN thing with the package then. Did you select to use >>> EPEL? I think that is covered in EPEL. >>> >>> - >>> Jerry Benton >>> www.mailborder.com >>> >>> >>> >>>> On Mar 10, 2015, at 5:56 PM, Kevin Miller >>> wrote: >>>> >>>> It was when running the install scripts. It got to the part where it >>> does some testing and just kept looping, incrementing the hostname by 1 >>> and failing each time. >>>> Here's where it starts: >>>> >>>> Running make for >>>> J/JM/JMEHNLE/mail-spf-query/Mail-SPF-Query-1.999.1.tar.gz >>>> Has already been unwrapped into directory >>>> /root/.cpan/build/Mail-SPF-Query-1.999.1-oPA2yy >>>> >>>> CPAN.pm: Building >>>> J/JM/JMEHNLE/mail-spf-query/Mail-SPF-Query-1.999.1.tar.gz >>>> >>>> cp lib/Mail/SPF/Query.pm blib/lib/Mail/SPF/Query.pm cp bin/spfd >>>> blib/script/spfd /usr/bin/perl -MExtUtils::MY -e 'MY->fixin(shift)' -- >>>> blib/script/spfd cp bin/spfquery blib/script/spfquery /usr/bin/perl >>>> -MExtUtils::MY -e 'MY->fixin(shift)' -- blib/script/spfquery Manifying >>>> blib/man1/spfd.1 Manifying blib/man1/spfquery.1 Manifying >>>> blib/man3/Mail::SPF::Query.3pm >>>> JMEHNLE/mail-spf-query/Mail-SPF-Query-1.999.1.tar.gz >>>> /usr/bin/make -- OK >>>> Running make test >>>> PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" >>>> "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t # Test 3 got: >>> "unknown" (t/00_all.t at line 127 fail #2) >>>> # Expected: "neutral" >>>> # t/00_all.t line 127 is: my $ok = ok($result, >>> $expected_result); >>>> # Detailed debug log for test(s) 3: >>>> # | 01.spf1-test.mailzone.com new: ipv4=192.0.2.1, >>> sender=01.spf1-test.mailzone.com, helo=01.spf1-test.mailzone.com >>>> # | postmaster 01.spf1-test.mailzone.com localpart is >>> postmaster >>>> #... >>>> >>>> So maybe it's the CPAN Mail-SPF-Query install routine? >>>> >>>> ...Kevin >>>> -- >>>> Kevin Miller >>>> Network/email Administrator, CBJ MIS Dept. >>>> 155 South Seward Street >>>> Juneau, Alaska 99801 >>>> Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: >>>> 307357 >>>> >>>> >>>>> -----Original Message----- >>>>> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- >>>>> bounces at lists.mailscanner.info] On Behalf Of Jerry Benton >>>>> Sent: Tuesday, March 10, 2015 12:46 PM >>>>> To: MailScanner discussion >>>>> Subject: Re: Install script stuck in a loop? >>>>> >>>>> That is a failure on the SPF record. (Bad DNS entry or format.). >>>>> MailScanner kept looping on the same message? >>>>> >>>>> - >>>>> Jerry Benton >>>>> www.mailborder.com >>>>> >>>>> >>>>> >>>>>> On Mar 10, 2015, at 4:01 PM, Kevin Miller >>>>> wrote: >>>>>> >>>>>> last_dns_error=NXDOMAIN >>>>> >>>>> -- >>>>> MailScanner mailing list >>>>> mailscanner at lists.mailscanner.info >>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>> >>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>> >>>>> Support MailScanner development - buy the book off the website! >>>> -- >>>> MailScanner mailing list >>>> mailscanner at lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>> >>> -- >>> MailScanner mailing list >>> mailscanner at lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > From mejaz at cyberia.net.sa Wed Mar 11 06:46:29 2015 From: mejaz at cyberia.net.sa (Mohammed Ejaz) Date: Wed, 11 Mar 2015 09:46:29 +0300 Subject: bounce-message Message-ID: <010801d05bc7$1d30c7a0$579256e0$@net.sa> Hi all Some of the emails are bouncing back with below error message, any clue what could be the reason Thanks in advance for your kind support. Ejaz Our virus detector failed to completely analyse a message you sent:- To: 83088 at mcdonalds.com.sa, 83089 at mcdonalds.com.sa, 83090 at mcdonalds.com.sa, 83091 at mcdonalds.com.sa, 83092 at mcdonalds.com.sa, 83093 at mcdonalds.com.sa, 83094 at mcdonalds.com.sa, 83095 at mcdonalds.com.sa, 83096 at mcdonalds.com.sa, 83097 at mcdonalds.com.sa Subject: LINEN ORDERING (REMINDER) Date: Wed Mar 11 08:50:32 2015 Any parts of the message that could not be analysed will not have been delivered. If you are using Microsoft Outlook, we strongly recommend you change your outgoing message format from "Rich Text" to "HTML" or "Plain Text". 1) Click on the "Tools" menu and choose "Options..." 2) Go to the "Mail Format" tab 3) For message format, select "HTML" or "Plain text" 4) Click OK The virus detector said this about the message: Report: Report: MailScanner: Message attempted to kill MailScanner -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150311/83e5e5dd/attachment.html From mejaz at cyberia.net.sa Wed Mar 11 08:07:03 2015 From: mejaz at cyberia.net.sa (Mohammed Ejaz) Date: Wed, 11 Mar 2015 11:07:03 +0300 Subject: bounce-message In-Reply-To: <010801d05bc7$1d30c7a0$579256e0$@net.sa> References: <010801d05bc7$1d30c7a0$579256e0$@net.sa> Message-ID: <01cf01d05bd2$6081bf40$21853dc0$@net.sa> In addition to below, here my mailscanner logs of to the problematic email. root at nmersal ~]# grep -i 83028 at mcdonalds.com.sa /var/log/maillog Mar 11 08:29:32 nmersal postfix/cleanup[12092]: 36F1F5DFFBA: hold: header Received: from mail.unitedgroup.com.sa (SRV-EXCHHUB.unitedgroup.com.sa [213.210.243.36 ])??by nmersal.cyberia.net.sa (Postfix) with ESMTP id 36F1F5DFFBA;??Wed, 11 Mar2015 08:29:32 +0300 (AST) from SRV-EXCHHUB.unitedgroup.com.sa[213.210.243.36]; f rom= to=<83028 at mcdonalds.com.sa> proto=ESMTP helo = Mar 11 10:26:49 nmersal postfix/cleanup[17702]: DC9985DFFDE: hold: header Receiv ed: from mail.unitedgroup.com.sa (SRV-EXCHHUB.unitedgroup.com.sa [213.210.243.36 ])??by nmersal.cyberia.net.sa (Postfix) with ESMTP id DC9985DFFDE;??Wed, 11 Mar 2015 10:26:49 +0300 (AST) from SRV-EXCHHUB.unitedgroup.com.sa[213.210.243.36]; f rom= to=<83028 at mcdonalds.com.sa> proto=ESMTP helo = You have mail in /var/spool/mail/root [root at nmersal ~]# grep -i DC9985DFFDE /var/log/maillog Mar 11 10:26:49 nmersal postfix/smtpd[17698]: DC9985DFFDE: client=SRV-EXCHHUB.unitedgroup.com.sa[213.210.243.36] Mar 11 10:26:49 nmersal postfix/cleanup[17702]: DC9985DFFDE: hold: header Received: from mail.unitedgroup.com.sa (SRV-EXCHHUB.unitedgroup.com.sa [213.210.243.36])??by nmersal.cyberia.net.sa (Postfix) with ESMTP id DC9985DFFDE;??Wed, 11 Mar 2015 10:26:49 +0300 (AST) from SRV-EXCHHUB.unitedgroup.com.sa[213.210.243.36]; from= to=<83028 at mcdonalds.com.sa> proto=ESMTP helo= Mar 11 10:26:49 nmersal postfix/cleanup[17702]: DC9985DFFDE: message-id=<4F4E9A676DD5C94AACA1D2FE1342D3104453622501 at SRV-EXCHANGE.unitedgr oup.com.sa> Mar 11 10:29:20 nmersal MailScanner[17677]: Making attempt 2 at processing message DC9985DFFDE.A112E Mar 11 10:29:20 nmersal MailScanner[17677]: SpamAssassin cache hit for message DC9985DFFDE.A112E Mar 11 10:34:26 nmersal MailScanner[18000]: Making attempt 3 at processing message DC9985DFFDE.A112E Mar 11 10:34:26 nmersal MailScanner[18000]: SpamAssassin cache hit for message DC9985DFFDE.A112E Mar 11 10:37:46 nmersal MailScanner[18480]: Making attempt 4 at processing message DC9985DFFDE.A112E Mar 11 10:37:46 nmersal MailScanner[18480]: SpamAssassin cache hit for message DC9985DFFDE.A112E Mar 11 10:40:54 nmersal MailScanner[18712]: Making attempt 5 at processing message DC9985DFFDE.A112E Mar 11 10:40:54 nmersal MailScanner[18712]: SpamAssassin cache hit for message DC9985DFFDE.A112E Mar 11 10:43:11 nmersal MailScanner[18763]: Making attempt 6 at processing message DC9985DFFDE.A112E Mar 11 10:43:11 nmersal MailScanner[18763]: SpamAssassin cache hit for message DC9985DFFDE.A112E Mar 11 10:43:12 nmersal MailScanner[18850]: Warning: skipping message DC9985DFFDE.A112E as it has been attempted too many times Mar 11 10:43:12 nmersal MailScanner[18850]: Quarantined message DC9985DFFDE.A112E as it caused MailScanner to crash several times Mar 11 10:43:12 nmersal MailScanner[18850]: Saved entire message to /var/spool/MailScanner/quarantine/20150311/DC9985DFFDE.A112E Ejaz From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Mohammed Ejaz Sent: Wednesday, March 11, 2015 9:46 AM To: mailscanner at lists.mailscanner.info Subject: bounce-message Hi all Some of the emails are bouncing back with below error message, any clue what could be the reason Thanks in advance for your kind support. Ejaz Our virus detector failed to completely analyse a message you sent:- To: 83088 at mcdonalds.com.sa, 83089 at mcdonalds.com.sa, 83090 at mcdonalds.com.sa, 83091 at mcdonalds.com.sa, 83092 at mcdonalds.com.sa, 83093 at mcdonalds.com.sa, 83094 at mcdonalds.com.sa, 83095 at mcdonalds.com.sa, 83096 at mcdonalds.com.sa, 83097 at mcdonalds.com.sa Subject: LINEN ORDERING (REMINDER) Date: Wed Mar 11 08:50:32 2015 Any parts of the message that could not be analysed will not have been delivered. If you are using Microsoft Outlook, we strongly recommend you change your outgoing message format from "Rich Text" to "HTML" or "Plain Text". 1) Click on the "Tools" menu and choose "Options..." 2) Go to the "Mail Format" tab 3) For message format, select "HTML" or "Plain text" 4) Click OK The virus detector said this about the message: Report: Report: MailScanner: Message attempted to kill MailScanner -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150311/22a68b66/attachment-0001.html From Antony.Stone at mailscanner.open.source.it Wed Mar 11 09:33:19 2015 From: Antony.Stone at mailscanner.open.source.it (Antony Stone) Date: Wed, 11 Mar 2015 10:33:19 +0100 Subject: About Sign Clean Message. In-Reply-To: References: <201503101226.14889.Antony.Stone@mailscanner.open.source.it> Message-ID: <201503111033.19470.Antony.Stone@mailscanner.open.source.it> On Wednesday 11 March 2015 at 02:24:58 (EU time), ??? wrote: > Hello, > This attachment is from akong at linguitronics.com to ak6783 at gmail.com. > Please check it. I'm sorry, but I don't see where the problem is here. Can anyone else see why the clean message didn't get signed? > > On Tuesday 10 March 2015 at 11:02:02 (EU time), ??? wrote: > > > OK, > > > My scm.rules content is follow: > > > From: mountain.chen at linguitronics.com yes > > > From: mailmaster at linguitronics.com yes > > > From: akong at linguitronics.com yes > > > FromOrTo: default no > > > Is it all right? > > > > That looks okay to me. > > > > Now please give us an example (just the To: and From: domains) of an > > email which did not get signed. > > > > If you can supply the full headers of such an email that would also be > > helpful. > > > > > > Antony. -- If the human brain were so simple that we could understand it, we'd be so simple that we couldn't. Please reply to the list; please *don't* CC me. From alex at vidadigital.com.pa Wed Mar 11 12:58:35 2015 From: alex at vidadigital.com.pa (Alex Neuman) Date: Wed, 11 Mar 2015 07:58:35 -0500 Subject: bounce-message In-Reply-To: <010801d05bc7$1d30c7a0$579256e0$@net.sa> References: <010801d05bc7$1d30c7a0$579256e0$@net.sa> Message-ID: As it says on the bounce, improperly configured Outlook settings prevent the message from being properly analyzed. Follow the instructions and change the outgoing message format to either HTML or Plain Text, as "Rich Text" is proprietary, has been obsolete for over a decade, and is potentially dangerous for your users. *Alex Neuman van der Hans* Reliant Technologies / Vida Digital http://vidadigital.com.pa/ Mobile: +507 6781-9505 Work: +507 832-6725 Work (USA): +1 (440) 253-9789 Skype: AlexNeuman Don't miss Vida Digital on LiveStream ! Saturdays 8am-10am on M?xima 91.7FM Panama Follow *@AlexNeuman * on Twitter Like Vida Digital on Facebook Follow VidaDigital on Instagram Subscribe to Vida Digital on Youtube On Wed, Mar 11, 2015 at 1:46 AM, Mohammed Ejaz wrote: > Hi all > > > > > > Some of the emails are bouncing back with below error message, any clue > what could be the reason > > > > Thanks in advance for your kind support. > > > > Ejaz > > > > > > > > Our virus detector failed to completely analyse a message you sent:- > > To: 83088 at mcdonalds.com.sa, 83089 at mcdonalds.com.sa, > 83090 at mcdonalds.com.sa, 83091 at mcdonalds.com.sa, 83092 at mcdonalds.com.sa, > 83093 at mcdonalds.com.sa, 83094 at mcdonalds.com.sa, 83095 at mcdonalds.com.sa, > 83096 at mcdonalds.com.sa, 83097 at mcdonalds.com.sa > > Subject: LINEN ORDERING (REMINDER) > > Date: Wed Mar 11 08:50:32 2015 > > Any parts of the message that could not be analysed will not have been > delivered. > > > > If you are using Microsoft Outlook, we strongly recommend you change your > outgoing message format from "Rich Text" to "HTML" or "Plain Text". > > > > 1) Click on the "Tools" menu and choose "Options..." > > 2) Go to the "Mail Format" tab > > 3) For message format, select "HTML" or "Plain text" > > 4) Click OK > > > > The virus detector said this about the message: > > Report: Report: MailScanner: Message attempted to kill MailScanner > > > > > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150311/f306d677/attachment.html From kevin.miller at juneau.org Wed Mar 11 16:19:01 2015 From: kevin.miller at juneau.org (Kevin Miller) Date: Wed, 11 Mar 2015 16:19:01 +0000 Subject: Install script stuck in a loop? In-Reply-To: References: <66C898FE-80B5-4F0C-994E-045F205B48E0@mailborder.com> <000ed11d2556444b91ba00212fc7f0e6@City-Exch-DB1.cbj.local> <74BBBB93-E565-4647-89CF-1660C3156CCD@mailborder.com> Message-ID: <5efe82c55f374244b0b18219582becda@City-Exch-DB1.cbj.local> Thanks - I knew some were supposed to fail, but after 100+ I figured whomever wrote the test forgot about it and the process fell by the wayside. I'll kick it off and just let it run its course... ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 > -----Original Message----- > From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- > bounces at lists.mailscanner.info] On Behalf Of Jerry Benton > Sent: Tuesday, March 10, 2015 6:44 PM > To: MailScanner discussion > Subject: Re: Install script stuck in a loop? > > Also, many of the tests are supposed to ?fail?. > > - > Jerry Benton > www.mailborder.com > > > > > On Mar 10, 2015, at 10:41 PM, Jerry Benton > wrote: > > > > Kevin, > > > > You need to let it run longer. I just installed it and it did as you > mentioned and ended. It did 223 tests. > > > > Appending installation info to /usr/lib64/perl5/perllocal.pod > > JMEHNLE/mail-spf-query/Mail-SPF-Query-1.999.1.tar.gz > > /usr/bin/make install ? OK > > > > [root at msdev20 tmp]# perldoc -l Mail::SPF::Query > > /usr/local/share/perl5/Mail/SPF/Query.pm > > > > > > > > - > > Jerry Benton > > www.mailborder.com > > > > > > > >> On Mar 10, 2015, at 6:58 PM, Kevin Miller > wrote: > >> > >> I already had EPEL installed, so I said not to install it but it > looks like it was recognizing it was available: > >> > >> Loaded plugins: fastestmirror, langpacks Loading mirror speeds from > >> cached hostfile > >> * base: mirror.tocici.com > >> * epel: mirror.steadfast.net > >> * extras: centos.sonn.com > >> * updates: cosmos.cites.illinois.edu > >> No package 'perl(Mail::SPF::Query)' available. > >> Error: Nothing to do > >> > >> The install log can be viewed at > ftp://ftp.ci.juneau.ak.us/pub/MailScanner/mailscanner-install.log if > that's any help... > >> > >> ...Kevin > >> -- > >> Kevin Miller > >> Network/email Administrator, CBJ MIS Dept. > >> 155 South Seward Street > >> Juneau, Alaska 99801 > >> Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: > >> 307357 > >> > >> > >>> -----Original Message----- > >>> From: mailscanner-bounces at lists.mailscanner.info > >>> [mailto:mailscanner- bounces at lists.mailscanner.info] On Behalf Of > >>> Jerry Benton > >>> Sent: Tuesday, March 10, 2015 2:36 PM > >>> To: MailScanner discussion > >>> Subject: Re: Install script stuck in a loop? > >>> > >>> Ah ok, that is a CPAN thing with the package then. Did you select to > >>> use EPEL? I think that is covered in EPEL. > >>> > >>> - > >>> Jerry Benton > >>> www.mailborder.com > >>> > >>> > >>> > >>>> On Mar 10, 2015, at 5:56 PM, Kevin Miller > >>> wrote: > >>>> > >>>> It was when running the install scripts. It got to the part where > >>>> it > >>> does some testing and just kept looping, incrementing the hostname > >>> by 1 and failing each time. > >>>> Here's where it starts: > >>>> > >>>> Running make for > >>>> J/JM/JMEHNLE/mail-spf-query/Mail-SPF-Query-1.999.1.tar.gz > >>>> Has already been unwrapped into directory > >>>> /root/.cpan/build/Mail-SPF-Query-1.999.1-oPA2yy > >>>> > >>>> CPAN.pm: Building > >>>> J/JM/JMEHNLE/mail-spf-query/Mail-SPF-Query-1.999.1.tar.gz > >>>> > >>>> cp lib/Mail/SPF/Query.pm blib/lib/Mail/SPF/Query.pm cp bin/spfd > >>>> blib/script/spfd /usr/bin/perl -MExtUtils::MY -e 'MY->fixin(shift)' > >>>> -- blib/script/spfd cp bin/spfquery blib/script/spfquery > >>>> /usr/bin/perl -MExtUtils::MY -e 'MY->fixin(shift)' -- > >>>> blib/script/spfquery Manifying > >>>> blib/man1/spfd.1 Manifying blib/man1/spfquery.1 Manifying > >>>> blib/man3/Mail::SPF::Query.3pm > >>>> JMEHNLE/mail-spf-query/Mail-SPF-Query-1.999.1.tar.gz > >>>> /usr/bin/make -- OK > >>>> Running make test > >>>> PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" > >>>> "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t # Test 3 got: > >>> "unknown" (t/00_all.t at line 127 fail #2) > >>>> # Expected: "neutral" > >>>> # t/00_all.t line 127 is: my $ok = ok($result, > >>> $expected_result); > >>>> # Detailed debug log for test(s) 3: > >>>> # | 01.spf1-test.mailzone.com new: ipv4=192.0.2.1, > >>> sender=01.spf1-test.mailzone.com, helo=01.spf1-test.mailzone.com > >>>> # | postmaster 01.spf1-test.mailzone.com localpart is > >>> postmaster > >>>> #... > >>>> > >>>> So maybe it's the CPAN Mail-SPF-Query install routine? > >>>> > >>>> ...Kevin > >>>> -- > >>>> Kevin Miller > >>>> Network/email Administrator, CBJ MIS Dept. > >>>> 155 South Seward Street > >>>> Juneau, Alaska 99801 > >>>> Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User > No: > >>>> 307357 > >>>> > >>>> > >>>>> -----Original Message----- > >>>>> From: mailscanner-bounces at lists.mailscanner.info > >>>>> [mailto:mailscanner- bounces at lists.mailscanner.info] On Behalf Of > >>>>> Jerry Benton > >>>>> Sent: Tuesday, March 10, 2015 12:46 PM > >>>>> To: MailScanner discussion > >>>>> Subject: Re: Install script stuck in a loop? > >>>>> > >>>>> That is a failure on the SPF record. (Bad DNS entry or format.). > >>>>> MailScanner kept looping on the same message? > >>>>> > >>>>> - > >>>>> Jerry Benton > >>>>> www.mailborder.com > >>>>> > >>>>> > >>>>> > >>>>>> On Mar 10, 2015, at 4:01 PM, Kevin Miller > >>>>>> > >>>>> wrote: > >>>>>> > >>>>>> last_dns_error=NXDOMAIN > >>>>> > >>>>> -- > >>>>> MailScanner mailing list > >>>>> mailscanner at lists.mailscanner.info > >>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >>>>> > >>>>> Before posting, read http://wiki.mailscanner.info/posting > >>>>> > >>>>> Support MailScanner development - buy the book off the website! > >>>> -- > >>>> MailScanner mailing list > >>>> mailscanner at lists.mailscanner.info > >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >>>> > >>>> Before posting, read http://wiki.mailscanner.info/posting > >>>> > >>>> Support MailScanner development - buy the book off the website! > >>> > >>> -- > >>> MailScanner mailing list > >>> mailscanner at lists.mailscanner.info > >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >>> > >>> Before posting, read http://wiki.mailscanner.info/posting > >>> > >>> Support MailScanner development - buy the book off the website! > >> -- > >> MailScanner mailing list > >> mailscanner at lists.mailscanner.info > >> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >> > >> Before posting, read http://wiki.mailscanner.info/posting > >> > >> Support MailScanner development - buy the book off the website! > > > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From kevin.miller at juneau.org Wed Mar 11 16:28:54 2015 From: kevin.miller at juneau.org (Kevin Miller) Date: Wed, 11 Mar 2015 16:28:54 +0000 Subject: bounce-message In-Reply-To: References: <010801d05bc7$1d30c7a0$579256e0$@net.sa> Message-ID: Additionally, it could be dependent on whether you're using the internal or external TNEF decoder. Query the archives for TNEF and you'll find lots of posts about this issue. No perfect solutions however. I'll see it every once in a while from external users that are using Microsoft email clients. I haven't had a problem lately however. My settings are: Expand TNEF = yes Use TNEF Contents = replace Deliver Unparsable TNEF = no TNEF Expander = internal TNEF Timeout = 120 IIRC, when I began using "Use TNEF Contents = replace" things got better. ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Alex Neuman Sent: Wednesday, March 11, 2015 4:59 AM To: MailScanner discussion Subject: Re: bounce-message As it says on the bounce, improperly configured Outlook settings prevent the message from being properly analyzed. Follow the instructions and change the outgoing message format to either HTML or Plain Text, as "Rich Text" is proprietary, has been obsolete for over a decade, and is potentially dangerous for your users. From jerry.benton at mailborder.com Wed Mar 11 17:21:46 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Wed, 11 Mar 2015 13:21:46 -0400 Subject: Phishing Updates - Update Message-ID: Hello, If you are using the phishing updates from Mailborder, please update your scripts: http://phishing.mailborder.com/update_bad_phishing_sites http://phishing.mailborder.com/update_phishing_sites The "--header="accept-encoding: gzip? in the wget command was causing some problems. - Jerry Benton www.mailborder.com From ak6783 at gmail.com Thu Mar 12 01:00:29 2015 From: ak6783 at gmail.com (=?UTF-8?B?5ZCz5rGd5Ymb?=) Date: Thu, 12 Mar 2015 09:00:29 +0800 Subject: About Sign Clean Message. In-Reply-To: <201503111033.19470.Antony.Stone@mailscanner.open.source.it> References: <201503101226.14889.Antony.Stone@mailscanner.open.source.it> <201503111033.19470.Antony.Stone@mailscanner.open.source.it> Message-ID: Hello, So,do I support wrong file?Could you want what file?I will get it for you check. Thanks a lot. 2015-03-11 17:33 GMT+08:00 Antony Stone < Antony.Stone at mailscanner.open.source.it>: > On Wednesday 11 March 2015 at 02:24:58 (EU time), ??? wrote: > > > Hello, > > This attachment is from akong at linguitronics.com to ak6783 at gmail.com. > > Please check it. > > I'm sorry, but I don't see where the problem is here. > > Can anyone else see why the clean message didn't get signed? > > > > On Tuesday 10 March 2015 at 11:02:02 (EU time), ??? wrote: > > > > OK, > > > > My scm.rules content is follow: > > > > From: mountain.chen at linguitronics.com yes > > > > From: mailmaster at linguitronics.com yes > > > > From: akong at linguitronics.com yes > > > > FromOrTo: default no > > > > Is it all right? > > > > > > That looks okay to me. > > > > > > Now please give us an example (just the To: and From: domains) of an > > > email which did not get signed. > > > > > > If you can supply the full headers of such an email that would also be > > > helpful. > > > > > > > > > Antony. > > -- > If the human brain were so simple that we could understand it, > we'd be so simple that we couldn't. > > Please reply to the > list; > please *don't* CC > me. > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- ??? ???? http://pc.aspa.idv.tw ??Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong at aspa.idv.tw Email (2) : ak6783 at gmail.com ?? : 0960599655 -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150312/dc122730/attachment.html From it at festa.bg Fri Mar 13 11:29:00 2015 From: it at festa.bg (Valentin Laskov) Date: Fri, 13 Mar 2015 13:29:00 +0200 Subject: MailScanner.conf quarantine section Message-ID: <2830B60EB19B40A8B8C969C368B95236@festa.bg> Hello, MailScanner-4.84.6-1 In the MailScanner.conf file has quarantine options in the section "Reports and Responses". I think section "Quarantine and Archive Settings" is better place :) . Regards Valentin Laskov From jerry.benton at mailborder.com Sun Mar 15 04:26:30 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Sun, 15 Mar 2015 00:26:30 -0400 Subject: Debian package beta Message-ID: <8D5ECCE2-49AD-4F73-A666-15F70115377E@mailborder.com> Here is the deb package and installer. I think we should call this MailScanner Pi https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2-1.deb.tar.gz - Jerry Benton www.mailborder.com From jerry.benton at mailborder.com Sun Mar 15 05:07:03 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Sun, 15 Mar 2015 01:07:03 -0400 Subject: Hold on that debian pkg Message-ID: Hold up on that debian package. There is a kink in the package if it is upgrading from a pervious version. I am working on it. Couple hours of testing maybe. - Jerry Benton www.mailborder.com From jerry.benton at mailborder.com Sun Mar 15 06:14:59 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Sun, 15 Mar 2015 02:14:59 -0400 Subject: v4.85.2-1 Release Candidates Message-ID: <11B61808-4EE3-4980-B01A-F41F36FAEBE9@mailborder.com> Ok, here are all of the packages. These will be released in one or two weeks after I get some feedback. I built in an auto save feature for Custom Functions since the directory structures have changed. (Except for the tarball installer.) Tarball: https://s3.amazonaws.com/mailscanner/test/MailScanner-install-4.85.2-1.tar.gz RHEL: https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2-1.rpm.tar.gz SuSE: https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2-1.suse-rpm.tar.gz Debian: https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2-1.deb.tar.gz - Jerry Benton www.mailborder.com From mejaz at cyberia.net.sa Sun Mar 15 14:31:11 2015 From: mejaz at cyberia.net.sa (Mohammed Ejaz) Date: Sun, 15 Mar 2015 17:31:11 +0300 Subject: unable-to-release-qurantine-message Message-ID: <039c01d05f2c$b1b60440$15220cc0$@net.sa> Hill I am trying to release the quarantine message with the below send mail command, but still it get failed to release and shows the below error. Any help would be highly appreciated. Thanks in advance Below are my settings In MailScanner.conf Quarantine Whole Messages As Queue Files = no and in the quarantine directory you have a file called message (this is the complete human-readible message, but without the envelope info). Just do Command cd /path/to/quarantine/dir sendmail -t -i < message Error ============================================================================ ================ his is a message from the MailScanner E-Mail Virus Protection Service ---------------------------------------------------------------------- The original e-mail attachment "EAWEMA150300207, ELSHERIF AHMED.RAMI.doc" is on the list of unacceptable attachments for this site and has been replaced by this warning message. If you wish to receive a copy of the original attachment, please e-mail helpdesk and include the whole of this message in your request. Alternatively, you can call them, with the contents of this message to hand when you call. At Sun Mar 15 17:16:24 2015 the virus scanner said: MailScanner: Attempt to hide real filename extension (EAWEMA150300207, ELSHERIF AHMED.RAMI.doc) Note to Help Desk: Look on the yoursite (nmersal.cyberia.net.sa) MailScanner in /var/spool/MailScanner/quarantine/20150315 (message 1208F5DFF51.A76CD). -- Postmaster Your Organisation Name Here www.your-organisation.com For all your IT requirements visit: http://www.transtec.co.uk ============================================================================ ====================================== -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150315/1cb1d410/attachment.html From jeremy at fluxlabs.net Sun Mar 15 15:21:28 2015 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Sun, 15 Mar 2015 15:21:28 +0000 Subject: unable-to-release-qurantine-message In-Reply-To: <039c01d05f2c$b1b60440$15220cc0$@net.sa> References: <039c01d05f2c$b1b60440$15220cc0$@net.sa> Message-ID: <528EAD99-2D6A-4320-934E-4C7D82080B88@fluxlabs.net> The original e-mail attachment "EAWEMA150300207, ELSHERIF AHMED.RAMI.doc" Your file has a double extension. .rami.doc -- Jeremy McSpadden | Flux Labs Local - 850-250-5590x501 | Mobile - 850-890-2543 Fax - 850-254-2955 | Toll Free - 877-699-FLUX Web - http://www.fluxlabs.net On Mar 15, 2015, at 9:49 AM, Mohammed Ejaz > wrote: Hill I am trying to release the quarantine message with the below send mail command, but still it get failed to release and shows the below error. Any help would be highly appreciated. Thanks in advance Below are my settings In MailScanner.conf Quarantine Whole Messages As Queue Files = no and in the quarantine directory you have a file called message (this is the complete human-readible message, but without the envelope info). Just do Command cd /path/to/quarantine/dir sendmail -t -i < message Error ============================================================================================ his is a message from the MailScanner E-Mail Virus Protection Service ---------------------------------------------------------------------- The original e-mail attachment "EAWEMA150300207, ELSHERIF AHMED.RAMI.doc" is on the list of unacceptable attachments for this site and has been replaced by this warning message. If you wish to receive a copy of the original attachment, please e-mail helpdesk and include the whole of this message in your request. Alternatively, you can call them, with the contents of this message to hand when you call. At Sun Mar 15 17:16:24 2015 the virus scanner said: MailScanner: Attempt to hide real filename extension (EAWEMA150300207, ELSHERIF AHMED.RAMI.doc) Note to Help Desk: Look on the yoursite (nmersal.cyberia.net.sa) MailScanner in /var/spool/MailScanner/quarantine/20150315 (message 1208F5DFF51.A76CD). -- Postmaster Your Organisation Name Here www.your-organisation.com For all your IT requirements visit: http://www.transtec.co.uk ================================================================================================================== -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150315/17f70abb/attachment.html From mejaz at cyberia.net.sa Sun Mar 15 15:50:37 2015 From: mejaz at cyberia.net.sa (Mohammed Ejaz) Date: Sun, 15 Mar 2015 18:50:37 +0300 Subject: unable-to-release-qurantine-message In-Reply-To: <528EAD99-2D6A-4320-934E-4C7D82080B88@fluxlabs.net> References: <039c01d05f2c$b1b60440$15220cc0$@net.sa> <528EAD99-2D6A-4320-934E-4C7D82080B88@fluxlabs.net> Message-ID: <03f801d05f37$ca2ea940$5e8bfbc0$@net.sa> Is there any way to overcome this problem. as I wanted to allow double extension. It should be from the filename.rules file. This is the syntax is it?? # Deny all other double file extensions. This catches any hidden filenames. allow \.[a-z][a-z0-9]{2,3}\s*\.[a-z0-9]{3}$ Found possible filename hiding Attempt to hide real filename extension Ejaz From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jeremy McSpadden Sent: Sunday, March 15, 2015 6:21 PM To: MailScanner discussion Subject: Re: unable-to-release-qurantine-message The original e-mail attachment "EAWEMA150300207, ELSHERIF AHMED.RAMI.doc" Your file has a double extension. .rami.doc -- Jeremy McSpadden | Flux Labs Local - 850-250-5590x501 | Mobile - 850-890-2543 Fax - 850-254-2955 | Toll Free - 877-699-FLUX Web - http://www.fluxlabs.net On Mar 15, 2015, at 9:49 AM, Mohammed Ejaz wrote: Hill I am trying to release the quarantine message with the below send mail command, but still it get failed to release and shows the below error. Any help would be highly appreciated. Thanks in advance Below are my settings In MailScanner.conf Quarantine Whole Messages As Queue Files = no and in the quarantine directory you have a file called message (this is the complete human-readible message, but without the envelope info). Just do Command cd /path/to/quarantine/dir sendmail -t -i < message Error ============================================================================ ================ his is a message from the MailScanner E-Mail Virus Protection Service ---------------------------------------------------------------------- The original e-mail attachment "EAWEMA150300207, ELSHERIF AHMED.RAMI.doc" is on the list of unacceptable attachments for this site and has been replaced by this warning message. If you wish to receive a copy of the original attachment, please e-mail helpdesk and include the whole of this message in your request. Alternatively, you can call them, with the contents of this message to hand when you call. At Sun Mar 15 17:16:24 2015 the virus scanner said: MailScanner: Attempt to hide real filename extension (EAWEMA150300207, ELSHERIF AHMED.RAMI.doc) Note to Help Desk: Look on the yoursite (nmersal.cyberia.net.sa) MailScanner in /var/spool/MailScanner/quarantine/20150315 (message 1208F5DFF51.A76CD). -- Postmaster Your Organisation Name Here www.your-organisation.com For all your IT requirements visit: http://www.transtec.co.uk ============================================================================ ====================================== -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150315/c88d29df/attachment.html From jerry.benton at mailborder.com Sun Mar 15 16:28:14 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Sun, 15 Mar 2015 12:28:14 -0400 Subject: unable-to-release-qurantine-message In-Reply-To: <03f801d05f37$ca2ea940$5e8bfbc0$@net.sa> References: <039c01d05f2c$b1b60440$15220cc0$@net.sa> <528EAD99-2D6A-4320-934E-4C7D82080B88@fluxlabs.net> <03f801d05f37$ca2ea940$5e8bfbc0$@net.sa> Message-ID: <54D24B8F-61D4-4CD7-9B73-26049928A204@mailborder.com> You must do this for it to work correctly: Quarantine Whole Messages As Queue Files = yes - Jerry Benton www.mailborder.com > On Mar 15, 2015, at 11:50 AM, Mohammed Ejaz wrote: > > Is there any way to overcome this problem. as I wanted to allow double extension. It should be from the filename.rules file. > > This is the syntax is it?? > > # Deny all other double file extensions. This catches any hidden filenames. > allow \.[a-z][a-z0-9]{2,3}\s*\.[a-z0-9]{3}$ Found possible filename hiding Attempt to hide real filename extension > > Ejaz > > From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jeremy McSpadden > Sent: Sunday, March 15, 2015 6:21 PM > To: MailScanner discussion > Subject: Re: unable-to-release-qurantine-message > > The original e-mail attachment "EAWEMA150300207, ELSHERIF AHMED.RAMI.doc" > > Your file has a double extension. > > .rami.doc > > -- > Jeremy McSpadden | Flux Labs > Local - 850-250-5590x501 | Mobile - 850-890-2543 > Fax - 850-254-2955 | Toll Free - 877-699-FLUX > Web - http://www.fluxlabs.net > > > On Mar 15, 2015, at 9:49 AM, Mohammed Ejaz > wrote: > >> >> Hill >> >> I am trying to release the quarantine message with the below send mail command, but still it get failed to release and shows the below error. Any help would be highly appreciated. >> >> >> Thanks in advance >> >> >> >> Below are my settings In MailScanner.conf >> >> Quarantine Whole Messages As Queue Files = no >> and in the quarantine directory you have a file called message (this is the complete human-readible message, but without the envelope info). Just do >> >> >> Command >> >> cd /path/to/quarantine/dir >> sendmail -t -i < message >> >> >> Error >> >> ============================================================================================ >> his is a message from the MailScanner E-Mail Virus Protection Service >> ---------------------------------------------------------------------- >> The original e-mail attachment "EAWEMA150300207, ELSHERIF AHMED.RAMI.doc" >> is on the list of unacceptable attachments for this site and has been >> replaced by this warning message. >> >> If you wish to receive a copy of the original attachment, please >> e-mail helpdesk and include the whole of this message >> in your request. Alternatively, you can call them, with >> the contents of this message to hand when you call. >> >> At Sun Mar 15 17:16:24 2015 the virus scanner said: >> MailScanner: Attempt to hide real filename extension (EAWEMA150300207, ELSHERIF AHMED.RAMI.doc) >> >> Note to Help Desk: Look on the yoursite (nmersal.cyberia.net.sa) MailScanner in /var/spool/MailScanner/quarantine/20150315 (message 1208F5DFF51.A76CD). >> -- >> Postmaster >> Your Organisation Name Here >> www.your-organisation.com >> >> For all your IT requirements visit: http://www.transtec.co.uk >> ================================================================================================================== >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150315/b92e3abb/attachment.html From kevin.miller at juneau.org Mon Mar 16 16:25:39 2015 From: kevin.miller at juneau.org (Kevin Miller) Date: Mon, 16 Mar 2015 16:25:39 +0000 Subject: Debian package beta In-Reply-To: <8D5ECCE2-49AD-4F73-A666-15F70115377E@mailborder.com> References: <8D5ECCE2-49AD-4F73-A666-15F70115377E@mailborder.com> Message-ID: Historically, the Debian package has always lagged way behind, as Julian didn't maintain it - someone else did, as their time permitted. Is it safe to assume that it will now be updated along with the other packages? That would be great, as we pretty much use Debian but have used other distros (SUSE & centOS) where it was more practical. Thanks for all you're doing Jerry! ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 > -----Original Message----- > From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- > bounces at lists.mailscanner.info] On Behalf Of Jerry Benton > Sent: Saturday, March 14, 2015 8:27 PM > To: MailScanner discussion > Subject: Debian package beta > > Here is the deb package and installer. I think we should call this > MailScanner Pi > > > https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2- > 1.deb.tar.gz > > > - > Jerry Benton > www.mailborder.com > > > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From brad at trinsictech.com Mon Mar 16 16:54:19 2015 From: brad at trinsictech.com (Brad Triem) Date: Mon, 16 Mar 2015 11:54:19 -0500 (CDT) Subject: Spamassasin Rule Actions SpamScore negative values issue In-Reply-To: <1675684109.389449.1411246207517.JavaMail.zimbra@trinsictech.com> References: <2747.b75900f0.1410738774.nsm@mail.fumlersoft.dk> <541B5416.2080707@farrows.org> <1535416A-B06A-4E2F-9CF5-13620FAF971F@mailborder.com> <1842746928.389072.1411241158277.JavaMail.zimbra@trinsictech.com> <1675684109.389449.1411246207517.JavaMail.zimbra@trinsictech.com> Message-ID: <1311460686.69082.1426524859471.JavaMail.zimbra@trinsictech.com> I was able to resolve the first issue of negative numbers. See attached patch file for MailScanner-4.84.6-1. One line regex modification to allow for negative numbers in SpamScore for Spamassassin Rule Actions. Regards, Brad From: "Brad Triem" To: "MailScanner discussion" Sent: Saturday, September 20, 2014 2:25:58 PM Subject: Spamassasin Rule Actions SpamScore negative values issue BQ_BEGIN There appears to be a parsing issue when declaring a negative number when using Spamassassin Rule Actions: SpamScore. Working example: SpamScore<0=>store-/to/some/directory Failing example: SpamScore<-2=>store-/to/some/dirctory Also, on the same note, I would like to have multiple default FromOrTo: actions of the same type of check, but the below doesn't work. It only does the last action. FromOrTo: default SpamScore<0=>store-/to/some/directory SpamScore>10=>store-/to/some/other/dirctory Has anyone found a way around this or perhaps I'm doing something wrong? Regards, Brad BQ_END -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150316/03c636f9/attachment.html -------------- next part -------------- A non-text attachment was scrubbed... Name: Message.pm.patch Type: text/x-patch Size: 533 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150316/03c636f9/attachment.bin From jerry.benton at mailborder.com Mon Mar 16 17:03:30 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Mon, 16 Mar 2015 13:03:30 -0400 Subject: Debian package beta In-Reply-To: References: <8D5ECCE2-49AD-4F73-A666-15F70115377E@mailborder.com> Message-ID: <55D91511-98A2-490C-8693-2B30009343DA@mailborder.com> I built the repo on github so anyone can do it. so, yes it will be maintained. - Jerry Benton www.mailborder.com Sent from my iPhone > On Mar 16, 2015, at 12:25, Kevin Miller wrote: > > Historically, the Debian package has always lagged way behind, as Julian didn't maintain it - someone else did, as their time permitted. Is it safe to assume that it will now be updated along with the other packages? That would be great, as we pretty much use Debian but have used other distros (SUSE & centOS) where it was more practical. > > Thanks for all you're doing Jerry! > > ...Kevin > -- > Kevin Miller > Network/email Administrator, CBJ MIS Dept. > 155 South Seward Street > Juneau, Alaska 99801 > Phone: (907) 586-0242, Fax: (907) 586-4500 > Registered Linux User No: 307357 > > >> -----Original Message----- >> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- >> bounces at lists.mailscanner.info] On Behalf Of Jerry Benton >> Sent: Saturday, March 14, 2015 8:27 PM >> To: MailScanner discussion >> Subject: Debian package beta >> >> Here is the deb package and installer. I think we should call this >> MailScanner Pi >> >> >> https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2- >> 1.deb.tar.gz >> >> >> - >> Jerry Benton >> www.mailborder.com >> >> >> >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From kevin.miller at juneau.org Mon Mar 16 22:14:54 2015 From: kevin.miller at juneau.org (Kevin Miller) Date: Mon, 16 Mar 2015 22:14:54 +0000 Subject: Debian package beta In-Reply-To: <55D91511-98A2-490C-8693-2B30009343DA@mailborder.com> References: <8D5ECCE2-49AD-4F73-A666-15F70115377E@mailborder.com> <55D91511-98A2-490C-8693-2B30009343DA@mailborder.com> Message-ID: <48e0abb29ace4329bc7da4fe732eb4a4@City-Exch-DB1.cbj.local> Great. Does the installer deal with dependencies and such (i.e., a .deb package) or is it just the MailScanner essentials and and install script? ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357 > -----Original Message----- > From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- > bounces at lists.mailscanner.info] On Behalf Of Jerry Benton > Sent: Monday, March 16, 2015 9:04 AM > To: MailScanner discussion > Subject: Re: Debian package beta > > I built the repo on github so anyone can do it. so, yes it will be > maintained. > > - > Jerry Benton > www.mailborder.com > Sent from my iPhone > > > On Mar 16, 2015, at 12:25, Kevin Miller > wrote: > > > > Historically, the Debian package has always lagged way behind, as > Julian didn't maintain it - someone else did, as their time permitted. > Is it safe to assume that it will now be updated along with the other > packages? That would be great, as we pretty much use Debian but have > used other distros (SUSE & centOS) where it was more practical. > > > > Thanks for all you're doing Jerry! > > > > ...Kevin > > -- > > Kevin Miller > > Network/email Administrator, CBJ MIS Dept. > > 155 South Seward Street > > Juneau, Alaska 99801 > > Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: > > 307357 > > > > > >> -----Original Message----- > >> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- > >> bounces at lists.mailscanner.info] On Behalf Of Jerry Benton > >> Sent: Saturday, March 14, 2015 8:27 PM > >> To: MailScanner discussion > >> Subject: Debian package beta > >> > >> Here is the deb package and installer. I think we should call this > >> MailScanner Pi > >> > >> > >> https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2- > >> 1.deb.tar.gz > >> > >> > >> - > >> Jerry Benton > >> www.mailborder.com > >> > >> > >> > >> -- > >> MailScanner mailing list > >> mailscanner at lists.mailscanner.info > >> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >> > >> Before posting, read http://wiki.mailscanner.info/posting > >> > >> Support MailScanner development - buy the book off the website! > > -- > > MailScanner mailing list > > mailscanner at lists.mailscanner.info > > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > > > Before posting, read http://wiki.mailscanner.info/posting > > > > Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From jerry.benton at mailborder.com Mon Mar 16 23:49:55 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Mon, 16 Mar 2015 19:49:55 -0400 Subject: Debian package beta In-Reply-To: <48e0abb29ace4329bc7da4fe732eb4a4@City-Exch-DB1.cbj.local> References: <8D5ECCE2-49AD-4F73-A666-15F70115377E@mailborder.com> <55D91511-98A2-490C-8693-2B30009343DA@mailborder.com> <48e0abb29ace4329bc7da4fe732eb4a4@City-Exch-DB1.cbj.local> Message-ID: The installer covers everything. - Jerry Benton www.mailborder.com > On Mar 16, 2015, at 6:14 PM, Kevin Miller wrote: > > Great. Does the installer deal with dependencies and such (i.e., a .deb package) or is it just the MailScanner essentials and and install script? > > ...Kevin > -- > Kevin Miller > Network/email Administrator, CBJ MIS Dept. > 155 South Seward Street > Juneau, Alaska 99801 > Phone: (907) 586-0242, Fax: (907) 586-4500 > Registered Linux User No: 307357 > > >> -----Original Message----- >> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- >> bounces at lists.mailscanner.info] On Behalf Of Jerry Benton >> Sent: Monday, March 16, 2015 9:04 AM >> To: MailScanner discussion >> Subject: Re: Debian package beta >> >> I built the repo on github so anyone can do it. so, yes it will be >> maintained. >> >> - >> Jerry Benton >> www.mailborder.com >> Sent from my iPhone >> >>> On Mar 16, 2015, at 12:25, Kevin Miller >> wrote: >>> >>> Historically, the Debian package has always lagged way behind, as >> Julian didn't maintain it - someone else did, as their time permitted. >> Is it safe to assume that it will now be updated along with the other >> packages? That would be great, as we pretty much use Debian but have >> used other distros (SUSE & centOS) where it was more practical. >>> >>> Thanks for all you're doing Jerry! >>> >>> ...Kevin >>> -- >>> Kevin Miller >>> Network/email Administrator, CBJ MIS Dept. >>> 155 South Seward Street >>> Juneau, Alaska 99801 >>> Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: >>> 307357 >>> >>> >>>> -----Original Message----- >>>> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner- >>>> bounces at lists.mailscanner.info] On Behalf Of Jerry Benton >>>> Sent: Saturday, March 14, 2015 8:27 PM >>>> To: MailScanner discussion >>>> Subject: Debian package beta >>>> >>>> Here is the deb package and installer. I think we should call this >>>> MailScanner Pi >>>> >>>> >>>> https://s3.amazonaws.com/mailscanner/test/MailScanner-4.85.2- >>>> 1.deb.tar.gz >>>> >>>> >>>> - >>>> Jerry Benton >>>> www.mailborder.com >>>> >>>> >>>> >>>> -- >>>> MailScanner mailing list >>>> mailscanner at lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>> -- >>> MailScanner mailing list >>> mailscanner at lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From ak6783 at gmail.com Tue Mar 17 05:50:39 2015 From: ak6783 at gmail.com (=?UTF-8?B?5ZCz5rGd5Ymb?=) Date: Tue, 17 Mar 2015 13:50:39 +0800 Subject: About Sign Clean Message. In-Reply-To: References: <201503101226.14889.Antony.Stone@mailscanner.open.source.it> <201503111033.19470.Antony.Stone@mailscanner.open.source.it> Message-ID: Hello, I have test another mailserver.It's create another mailserver and use mailscanner by me.It's almost use default setting and set Sign Clean Message = yes.But it's always not have clean message. I have test send mail to gamil and have mail detail.Please check it.I think it's mailscanner bug. 2015-03-12 9:00 GMT+08:00 ??? : > Hello, > So,do I support wrong file?Could you want what file?I will get it for you > check. > Thanks a lot. > > 2015-03-11 17:33 GMT+08:00 Antony Stone < > Antony.Stone at mailscanner.open.source.it>: > >> On Wednesday 11 March 2015 at 02:24:58 (EU time), ??? wrote: >> >> > Hello, >> > This attachment is from akong at linguitronics.com to ak6783 at gmail.com. >> > Please check it. >> >> I'm sorry, but I don't see where the problem is here. >> >> Can anyone else see why the clean message didn't get signed? >> >> > > On Tuesday 10 March 2015 at 11:02:02 (EU time), ??? wrote: >> > > > OK, >> > > > My scm.rules content is follow: >> > > > From: mountain.chen at linguitronics.com yes >> > > > From: mailmaster at linguitronics.com yes >> > > > From: akong at linguitronics.com yes >> > > > FromOrTo: default no >> > > > Is it all right? >> > > >> > > That looks okay to me. >> > > >> > > Now please give us an example (just the To: and From: domains) of an >> > > email which did not get signed. >> > > >> > > If you can supply the full headers of such an email that would also be >> > > helpful. >> > > >> > > >> > > Antony. >> >> -- >> If the human brain were so simple that we could understand it, >> we'd be so simple that we couldn't. >> >> Please reply to the >> list; >> please *don't* >> CC me. >> -- >> MailScanner mailing list >> mailscanner at lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> > > > > -- > ??? > ???? http://pc.aspa.idv.tw > ??Blog http://ak6783.blogspot.com/ > Twitter http://twitter.com/akong77 > Plurk http://www.plurk.com/akong77 > Facebook http://www.facebook.com/akong77 > Email (1) : akong at aspa.idv.tw > Email (2) : ak6783 at gmail.com > ?? : 0960599655 > -- ??? ???? http://pc.aspa.idv.tw ??Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong at aspa.idv.tw Email (2) : ak6783 at gmail.com ?? : 0960599655 -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150317/079e702d/attachment.html -------------- next part -------------- Delivered-To: ak6783 at gmail.com Received: by 10.170.77.194 with SMTP id t185csp271235ykt; Mon, 16 Mar 2015 22:45:22 -0700 (PDT) X-Received: by 10.70.87.174 with SMTP id az14mr2301416pdb.102.1426571121709; Mon, 16 Mar 2015 22:45:21 -0700 (PDT) Return-Path: Received: from mail.rmim.com.tw (218-161-18-157.HINET-IP.hinet.net. [218.161.18.157]) by mx.google.com with ESMTP id sg6si26987512pac.164.2015.03.16.22.45.21 for ; Mon, 16 Mar 2015 22:45:21 -0700 (PDT) Received-SPF: none (google.com: akong at rmim.com.tw does not designate permitted sender hosts) client-ip=218.161.18.157; Authentication-Results: mx.google.com; spf=none (google.com: akong at rmim.com.tw does not designate permitted sender hosts) smtp.mail=akong at rmim.com.tw Received: from [127.0.0.1] (unknown [203.74.122.103]) by mail.rmim.com.tw (Postfix) with ESMTPA id 451C4100002 for ; Tue, 17 Mar 2015 13:45:16 +0800 (CST) Message-ID: <5507BF69.6030400 at rmim.com.tw> Date: Tue, 17 Mar 2015 13:45:13 +0800 From: Akong_rmim User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.5.0 MIME-Version: 1.0 To: ak6783 at gmail.com Subject: test mail1 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Antivirus: avast! (VPS 150316-0, 2015/03/16), Outbound message X-Antivirus-Status: Clean X-RMIM-MailScanner-Information: Please contact the ISP for more information X-RMIM-MailScanner-ID: 451C4100002.AA688 X-RMIM-MailScanner: Found to be clean X-RMIM-MailScanner-From: akong at rmim.com.tw X-Spam-Status: No 123 From maxsec at gmail.com Tue Mar 17 12:27:15 2015 From: maxsec at gmail.com (Martin Hepworth) Date: Tue, 17 Mar 2015 12:27:15 +0000 Subject: About Sign Clean Message. In-Reply-To: References: <201503101226.14889.Antony.Stone@mailscanner.open.source.it> <201503111033.19470.Antony.Stone@mailscanner.open.source.it> Message-ID: what happens if you put in plain ascii to the html and txt signature files. I'm wondering if the multi-byte characters are confusing things somewhere? -- Martin Hepworth, CISSP Oxford, UK On 17 March 2015 at 05:50, ??? wrote: > Hello, > I have test another mailserver.It's create another mailserver and use > mailscanner by me.It's almost use default setting and set Sign Clean > Message = yes.But it's always not have clean message. > I have test send mail to gamil and have mail detail.Please check it.I > think it's mailscanner bug. > > 2015-03-12 9:00 GMT+08:00 ??? : > >> Hello, >> So,do I support wrong file?Could you want what file?I will get it for you >> check. >> Thanks a lot. >> >> 2015-03-11 17:33 GMT+08:00 Antony Stone < >> Antony.Stone at mailscanner.open.source.it>: >> >>> On Wednesday 11 March 2015 at 02:24:58 (EU time), ??? wrote: >>> >>> > Hello, >>> > This attachment is from akong at linguitronics.com to ak6783 at gmail.com. >>> > Please check it. >>> >>> I'm sorry, but I don't see where the problem is here. >>> >>> Can anyone else see why the clean message didn't get signed? >>> >>> > > On Tuesday 10 March 2015 at 11:02:02 (EU time), ??? wrote: >>> > > > OK, >>> > > > My scm.rules content is follow: >>> > > > From: mountain.chen at linguitronics.com yes >>> > > > From: mailmaster at linguitronics.com yes >>> > > > From: akong at linguitronics.com yes >>> > > > FromOrTo: default no >>> > > > Is it all right? >>> > > >>> > > That looks okay to me. >>> > > >>> > > Now please give us an example (just the To: and From: domains) of an >>> > > email which did not get signed. >>> > > >>> > > If you can supply the full headers of such an email that would also >>> be >>> > > helpful. >>> > > >>> > > >>> > > Antony. >>> >>> -- >>> If the human brain were so simple that we could understand it, >>> we'd be so simple that we couldn't. >>> >>> Please reply to the >>> list; >>> please *don't* >>> CC me. >>> -- >>> MailScanner mailing list >>> mailscanner at lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >> >> >> >> -- >> ??? >> ???? http://pc.aspa.idv.tw >> ??Blog http://ak6783.blogspot.com/ >> Twitter http://twitter.com/akong77 >> Plurk http://www.plurk.com/akong77 >> Facebook http://www.facebook.com/akong77 >> Email (1) : akong at aspa.idv.tw >> Email (2) : ak6783 at gmail.com >> ?? : 0960599655 >> > > > > -- > ??? > ???? http://pc.aspa.idv.tw > ??Blog http://ak6783.blogspot.com/ > Twitter http://twitter.com/akong77 > Plurk http://www.plurk.com/akong77 > Facebook http://www.facebook.com/akong77 > Email (1) : akong at aspa.idv.tw > Email (2) : ak6783 at gmail.com > ?? : 0960599655 > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150317/dd02495e/attachment.html From email at ace.net.au Wed Mar 18 02:38:53 2015 From: email at ace.net.au (Peter Nitschke) Date: Wed, 18 Mar 2015 13:08:53 +1030 Subject: CryptoLock Message-ID: <201503181308530034.1F100299@web.ace.net.au> How does anyone deal with all the new cryptolock stuff? Macros in docx files etc. From michele.schillaci at bmservice.it Wed Mar 18 06:53:03 2015 From: michele.schillaci at bmservice.it (Michele Schillaci) Date: Wed, 18 Mar 2015 06:53:03 +0000 Subject: CryptoLock Message-ID: No executables allowed. Il 18/03/15 03:47 Peter Nitschke ha scritto: How does anyone deal with all the new cryptolock stuff? Macros in docx files etc. -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://lists.mailscanner.info/mailman/listinfo/mailscanner Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150318/aae6e19a/attachment.html From michele.schillaci at bmservice.it Wed Mar 18 06:55:08 2015 From: michele.schillaci at bmservice.it (Michele Schillaci) Date: Wed, 18 Mar 2015 06:55:08 +0000 Subject: CryptoLock Message-ID: Sorry, i meant strictly permissions on attachments Il 18/03/15 03:47 Peter Nitschke ha scritto: How does anyone deal with all the new cryptolock stuff? Macros in docx files etc. -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://lists.mailscanner.info/mailman/listinfo/mailscanner Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150318/04a15d1f/attachment.html From steveb_clamav at sanesecurity.com Wed Mar 18 08:23:18 2015 From: steveb_clamav at sanesecurity.com (Steve Basford) Date: Wed, 18 Mar 2015 08:23:18 -0000 Subject: CryptoLock In-Reply-To: <201503181308530034.1F100299@web.ace.net.au> References: <201503181308530034.1F100299@web.ace.net.au> Message-ID: On Wed, March 18, 2015 2:38 am, Peter Nitschke wrote: > How does anyone deal with all the new cryptolock stuff? > > > Macros in docx files etc. If you are using ClamAV, install Sanesecurity sigs. phish.ndb database contains cryptolock etc. macro blocks rogue.hdb database contains current hourly zip/rar/7zip macro blocks foxhole_generic.cdb database blocks some double extensions foxhole_all.cdb databse blocks pretty much all dangerous items in archives. More details on sanesecurity.com Cheers, Steve Web : sanesecurity.com Blog: sanesecurity.blogspot.com From jim at shout.net Wed Mar 18 17:35:12 2015 From: jim at shout.net (Jim Creason) Date: Wed, 18 Mar 2015 12:35:12 -0500 Subject: debian 4.85.2-1 RC Message-ID: <5509B750.4090907@shout.net> I've installed the .deb on a fresh install and it mostly works just fine. The only things I've noticed were a few typos in the notes inside MailScanner.conf and /etc/default/mailscanner, and that the init script has a couple issues with the lockfile. The location by default is /var/lock/MailScanner.off but it should be /var/lock/MailScanner/mailscanner.off and the touch is still pointed at /var/lock/subsys . All in all, great work Jerry, many thanks. --jim -- Jim Creason Chief Engineer Shouting Ground Technologies From sylvain at opensource-expert.com Thu Mar 19 15:20:19 2015 From: sylvain at opensource-expert.com (Sylvain Viart) Date: Thu, 19 Mar 2015 16:20:19 +0100 Subject: who match first Filename Rules or Filetype Rules ? Message-ID: <550AE933.6050109@opensource-expert.com> Hi, I would like to know which rules will match first? Where is it handled in the code? Regards. Sylvain. From chapman at simplesrv.com Thu Mar 19 17:26:46 2015 From: chapman at simplesrv.com (Chris Chapman) Date: Thu, 19 Mar 2015 12:26:46 -0500 Subject: MailScanner and SA Bayes Message-ID: <9075F8C9-4F44-435C-8AA8-D86772B54345@simplesrv.com> I guess that might be more of a SA question but, maybe somebody knows the answer: Does the option 'Rebuild Bayes Every xxx? nullify any SA-Learn actions? Meaning if I train a message as spam, will SA forget this after a rebuild? Sorry I couldn?t find this info on the SA site. TIA. Chris Chapman chapman at simplesrv.com From sylvain at opensource-expert.com Fri Mar 20 14:51:10 2015 From: sylvain at opensource-expert.com (Sylvain Viart) Date: Fri, 20 Mar 2015 15:51:10 +0100 Subject: who match first Filename Rules or Filetype Rules ? In-Reply-To: <550AE933.6050109@opensource-expert.com> References: <550AE933.6050109@opensource-expert.com> Message-ID: <550C33DE.7030303@opensource-expert.com> On 19/03/2015 16:20, Sylvain Viart wrote: > I would like to know which rules will match first? > > Where is it handled in the code? If I'm right it is handled by: mailscanner/bin/MailScanner/SweepOther.pm sub ScanBatch { And /Filename Rules/ seems to be applied *before* /Filetype Rules/: https://github.com/MailScanner/v4/blob/master/mailscanner/bin/MailScanner/SweepOther.pm#L154 The following at the end which seems to handle the Filetype Rules https://github.com/MailScanner/v4/blob/master/mailscanner/bin/MailScanner/SweepOther.pm#L427 counter += CheckFileContentTypes($batch) Someone confirms? Regards. Sylvain. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150320/b909b27a/attachment.html From mejaz at cyberia.net.sa Sun Mar 22 15:19:44 2015 From: mejaz at cyberia.net.sa (Mohammed Ejaz) Date: Sun, 22 Mar 2015 18:19:44 +0300 Subject: Qurantine. Message-ID: <041401d064b3$a2a6d330$e7f47990$@net.sa> Hello All. Sometimes, Very strangely I noticed that My normal test Emails are being quarantined from the MailScanner. any help would be highly appreciated. I am enclosing the my MailScanner configuration file FYR. Below are my logs and I can see the my test message in the quarantine spam folder grep -i ejazrom at hotmail.com /var/log/maillog Mar 22 16:25:36 mailgate5 postfix/cleanup[4839]: E3A01A504E5: hold: header Received: from COL004-OMC3S5.hotmail.com (col004-omc3s5.hotmail.com [65.55.34.143])??by mailgate5.cyberia.net.sa (Postfix) with ESMTP id E3A01A504E5;??Sun, 22 Mar 2015 16:25:35 +0300 (AST) from col004-omc3s5.hotmail.com[65.55.34.143]; from= to= proto=ESMTP helo= Mar 22 16:25:45 mailgate5 MailScanner[31920]: Message E3A01A504E5.AA0BD from 65.55.34.143 (ejazrom at hotmail.com) to cyberia.net.sa is spam, SpamAssassin (not cached, score=5.453, required 5, BAYES_00 -1.90, DNS_FROM_AHBL_RHSBL 2.70, FREEMAIL_FROM 0.00, HTML_MESSAGE 0.00, KAM_FROM_URIBL_PCCC 5.00, RCVD_IN_DNSWL_NONE -0.00, RP_MATCHES_RCVD -0.35, SPF_PASS -0.00) Regards Ejaz -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150322/bbf04d68/attachment.html -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: config.txt Url: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150322/bbf04d68/attachment.txt From jeremy at fluxlabs.net Sun Mar 22 16:14:32 2015 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Sun, 22 Mar 2015 16:14:32 +0000 Subject: Qurantine. In-Reply-To: <041401d064b3$a2a6d330$e7f47990$@net.sa> References: <041401d064b3$a2a6d330$e7f47990$@net.sa> Message-ID: Being detected as spam. -- Jeremy McSpadden | Flux Labs Local - 850-250-5590x501 | Mobile - 850-890-2543 Fax - 850-254-2955 | Toll Free - 877-699-FLUX Web - http://www.fluxlabs.net On Mar 22, 2015, at 10:31 AM, Mohammed Ejaz > wrote: Hello All. Sometimes, Very strangely I noticed that My normal test Emails are being quarantined from the MailScanner. any help would be highly appreciated. I am enclosing the my MailScanner configuration file FYR. Below are my logs and I can see the my test message in the quarantine spam folder grep -i ejazrom at hotmail.com /var/log/maillog Mar 22 16:25:36 mailgate5 postfix/cleanup[4839]: E3A01A504E5: hold: header Received: from COL004-OMC3S5.hotmail.com (col004-omc3s5.hotmail.com [65.55.34.143])??by mailgate5.cyberia.net.sa (Postfix) with ESMTP id E3A01A504E5;??Sun, 22 Mar 2015 16:25:35 +0300 (AST) from col004-omc3s5.hotmail.com[65.55.34.143]; from=> to=> proto=ESMTP helo=> Mar 22 16:25:45 mailgate5 MailScanner[31920]: Message E3A01A504E5.AA0BD from 65.55.34.143 (ejazrom at hotmail.com) to cyberia.net.sa is spam, SpamAssassin (not cached, score=5.453, required 5, BAYES_00 -1.90, DNS_FROM_AHBL_RHSBL 2.70, FREEMAIL_FROM 0.00, HTML_MESSAGE 0.00, KAM_FROM_URIBL_PCCC 5.00, RCVD_IN_DNSWL_NONE -0.00, RP_MATCHES_RCVD -0.35, SPF_PASS -0.00) Regards Ejaz -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150322/2821f7e4/attachment.html From jerry.benton at mailborder.com Sun Mar 22 16:29:26 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Sun, 22 Mar 2015 12:29:26 -0400 Subject: Qurantine. In-Reply-To: <041401d064b3$a2a6d330$e7f47990$@net.sa> References: <041401d064b3$a2a6d330$e7f47990$@net.sa> Message-ID: See here http://community.zimbra.com/collaboration/f/1884/t/1137276 - Jerry Benton www.mailborder.com > On Mar 22, 2015, at 11:19 AM, Mohammed Ejaz wrote: > > > Hello All. > > Sometimes, Very strangely I noticed that My normal test Emails are being quarantined from the MailScanner. any help would be highly appreciated. > > I am enclosing the my MailScanner configuration file FYR. > > > > Below are my logs and I can see the my test message in the quarantine spam folder > grep -i ejazrom at hotmail.com /var/log/maillog > Mar 22 16:25:36 mailgate5 postfix/cleanup[4839]: E3A01A504E5: hold: header Received: from COL004-OMC3S5.hotmail.com (col004-omc3s5.hotmail.com [65.55.34.143])??by mailgate5.cyberia.net.sa (Postfix) with ESMTP id E3A01A504E5;??Sun, 22 Mar 2015 16:25:35 +0300 (AST) from col004-omc3s5.hotmail.com [65.55.34.143]; from=> to=> proto=ESMTP helo=> > Mar 22 16:25:45 mailgate5 MailScanner[31920]: Message E3A01A504E5.AA0BD from 65.55.34.143 (ejazrom at hotmail.com ) to cyberia.net.sa is spam, SpamAssassin (not cached, score=5.453, required 5, BAYES_00 -1.90, DNS_FROM_AHBL_RHSBL 2.70, FREEMAIL_FROM 0.00, HTML_MESSAGE 0.00, KAM_FROM_URIBL_PCCC 5.00, RCVD_IN_DNSWL_NONE -0.00, RP_MATCHES_RCVD -0.35, SPF_PASS -0.00) > > > Regards > Ejaz > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150322/f883e73b/attachment.html From mejaz at cyberia.net.sa Mon Mar 23 10:04:36 2015 From: mejaz at cyberia.net.sa (Mohammed Ejaz) Date: Mon, 23 Mar 2015 13:04:36 +0300 Subject: Qurantine. In-Reply-To: References: <041401d064b3$a2a6d330$e7f47990$@net.sa> Message-ID: <055901d06550$c97dd380$5c797a80$@net.sa> Thank you, as seen in the article I opened the 50_scores.cf file and comment the lines from DNS_FROM_AHBL_RHSB Ejaz From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jerry Benton Sent: Sunday, March 22, 2015 7:29 PM To: MailScanner discussion Subject: Re: Qurantine. See here http://community.zimbra.com/collaboration/f/1884/t/1137276 - Jerry Benton www.mailborder.com On Mar 22, 2015, at 11:19 AM, Mohammed Ejaz wrote: Hello All. Sometimes, Very strangely I noticed that My normal test Emails are being quarantined from the MailScanner. any help would be highly appreciated. I am enclosing the my MailScanner configuration file FYR. Below are my logs and I can see the my test message in the quarantine spam folder grep -i ejazrom at hotmail.com /var/log/maillog Mar 22 16:25:36 mailgate5 postfix/cleanup[4839]: E3A01A504E5: hold: header Received: from COL004-OMC3S5.hotmail.com ( col004-omc3s5.hotmail.com [65.55.34.143])??by mailgate5.cyberia.net.sa (Postfix) with ESMTP id E3A01A504E5;??Sun, 22 Mar 2015 16:25:35 +0300 (AST) from col004-omc3s5.hotmail.com[65.55.34.143]; from=< ejazrom at hotmail.com> to=< mwt79 at cyberia.net.sa> proto=ESMTP helo=< COL004-OMC3S5.hotmail.com> Mar 22 16:25:45 mailgate5 MailScanner[31920]: Message E3A01A504E5.AA0BD from 65.55.34.143 ( ejazrom at hotmail.com) to cyberia.net.sa is spam, SpamAssassin (not cached, score=5.453, required 5, BAYES_00 -1.90, DNS_FROM_AHBL_RHSBL 2.70, FREEMAIL_FROM 0.00, HTML_MESSAGE 0.00, KAM_FROM_URIBL_PCCC 5.00, RCVD_IN_DNSWL_NONE -0.00, RP_MATCHES_RCVD -0.35, SPF_PASS -0.00) Regards Ejaz -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150323/c02587bf/attachment.html From phil.randal at hoopleltd.co.uk Tue Mar 24 10:03:38 2015 From: phil.randal at hoopleltd.co.uk (Randal, Phil) Date: Tue, 24 Mar 2015 10:03:38 +0000 Subject: Qurantine. In-Reply-To: <055901d06550$c97dd380$5c797a80$@net.sa> References: <041401d064b3$a2a6d330$e7f47990$@net.sa> <055901d06550$c97dd380$5c797a80$@net.sa> Message-ID: <7CA580B59C1ABD45B4614ED90D4C7B858A40D80C@HC-EXMBX03.herefordshire.gov.uk> That change will get trashed next time sa-update is run. Better to put score DNS_FROM_AHBL_RHSB 0 in your local.cf Cheers, Phil -- Phil Randal Infrastructure Engineer Hoople Ltd | Thorn Office Centre | Hereford | HR2 6JT Tel : 01432 260415 |Email: phil.randal at hoopleltd.co.uk General email: enquiries at hoopleltd.co.uk Website: www.hoopleltd.co.uk From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Mohammed Ejaz Sent: 23 March 2015 10:05 To: 'MailScanner discussion' Subject: RE: Qurantine. Thank you, as seen in the article I opened the 50_scores.cf file and comment the lines from DNS_FROM_AHBL_RHSB Ejaz From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jerry Benton Sent: Sunday, March 22, 2015 7:29 PM To: MailScanner discussion Subject: Re: Qurantine. See here http://community.zimbra.com/collaboration/f/1884/t/1137276 - Jerry Benton www.mailborder.com On Mar 22, 2015, at 11:19 AM, Mohammed Ejaz > wrote: Hello All. Sometimes, Very strangely I noticed that My normal test Emails are being quarantined from the MailScanner. any help would be highly appreciated. I am enclosing the my MailScanner configuration file FYR. Below are my logs and I can see the my test message in the quarantine spam folder grep -i ejazrom at hotmail.com /var/log/maillog Mar 22 16:25:36 mailgate5 postfix/cleanup[4839]: E3A01A504E5: hold: header Received: from COL004-OMC3S5.hotmail.com (col004-omc3s5.hotmail.com [65.55.34.143])??by mailgate5.cyberia.net.sa (Postfix) with ESMTP id E3A01A504E5;??Sun, 22 Mar 2015 16:25:35 +0300 (AST) from col004-omc3s5.hotmail.com[65.55.34.143]; from=> to=> proto=ESMTP helo=> Mar 22 16:25:45 mailgate5 MailScanner[31920]: Message E3A01A504E5.AA0BD from 65.55.34.143 (ejazrom at hotmail.com) to cyberia.net.sa is spam, SpamAssassin (not cached, score=5.453, required 5, BAYES_00 -1.90, DNS_FROM_AHBL_RHSBL 2.70, FREEMAIL_FROM 0.00, HTML_MESSAGE 0.00, KAM_FROM_URIBL_PCCC 5.00, RCVD_IN_DNSWL_NONE -0.00, RP_MATCHES_RCVD -0.35, SPF_PASS -0.00) Regards Ejaz -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! Hoople Ltd, Registered in England and Wales No. 7556595 Registered office: Plough Lane, Hereford, HR4 0LE "Any opinion expressed in this e-mail or any attached files are those of the individual and not necessarily those of Hoople Ltd. You should be aware that Hoople Ltd. monitors its email service. This e-mail and any attached files are confidential and intended solely for the use of the addressee. This communication may contain material protected by law from being passed on. If you are not the intended recipient and have received this e-mail in error, you are advised that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender immediately and destroy all copies of it." -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150324/724ef51d/attachment.html From mejaz at cyberia.net.sa Tue Mar 24 14:14:08 2015 From: mejaz at cyberia.net.sa (Mohammed Ejaz) Date: Tue, 24 Mar 2015 17:14:08 +0300 Subject: Qurantine. In-Reply-To: <7CA580B59C1ABD45B4614ED90D4C7B858A40D80C@HC-EXMBX03.herefordshire.gov.uk> References: <041401d064b3$a2a6d330$e7f47990$@net.sa> <055901d06550$c97dd380$5c797a80$@net.sa> <7CA580B59C1ABD45B4614ED90D4C7B858A40D80C@HC-EXMBX03.herefordshire.gov.uk> Message-ID: <012701d0663c$cdb73030$69259090$@net.sa> Thank you as I did it. From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Randal, Phil Sent: Tuesday, March 24, 2015 1:04 PM To: MailScanner discussion Subject: RE: Qurantine. That change will get trashed next time sa-update is run. Better to put score DNS_FROM_AHBL_RHSB 0 in your local.cf Cheers, Phil -- Phil Randal Infrastructure Engineer Hoople Ltd | Thorn Office Centre | Hereford | HR2 6JT Tel : 01432 260415 |Email: phil.randal at hoopleltd.co.uk General email: enquiries at hoopleltd.co.uk Website: www.hoopleltd.co.uk From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Mohammed Ejaz Sent: 23 March 2015 10:05 To: 'MailScanner discussion' Subject: RE: Qurantine. Thank you, as seen in the article I opened the 50_scores.cf file and comment the lines from DNS_FROM_AHBL_RHSB Ejaz From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jerry Benton Sent: Sunday, March 22, 2015 7:29 PM To: MailScanner discussion Subject: Re: Qurantine. See here http://community.zimbra.com/collaboration/f/1884/t/1137276 - Jerry Benton www.mailborder.com On Mar 22, 2015, at 11:19 AM, Mohammed Ejaz wrote: Hello All. Sometimes, Very strangely I noticed that My normal test Emails are being quarantined from the MailScanner. any help would be highly appreciated. I am enclosing the my MailScanner configuration file FYR. Below are my logs and I can see the my test message in the quarantine spam folder grep -i ejazrom at hotmail.com /var/log/maillog Mar 22 16:25:36 mailgate5 postfix/cleanup[4839]: E3A01A504E5: hold: header Received: from COL004-OMC3S5.hotmail.com ( col004-omc3s5.hotmail.com [65.55.34.143])??by mailgate5.cyberia.net.sa (Postfix) with ESMTP id E3A01A504E5;??Sun, 22 Mar 2015 16:25:35 +0300 (AST) from col004-omc3s5.hotmail.com[65.55.34.143]; from=< ejazrom at hotmail.com> to=< mwt79 at cyberia.net.sa> proto=ESMTP helo=< COL004-OMC3S5.hotmail.com> Mar 22 16:25:45 mailgate5 MailScanner[31920]: Message E3A01A504E5.AA0BD from 65.55.34.143 ( ejazrom at hotmail.com) to cyberia.net.sa is spam, SpamAssassin (not cached, score=5.453, required 5, BAYES_00 -1.90, DNS_FROM_AHBL_RHSBL 2.70, FREEMAIL_FROM 0.00, HTML_MESSAGE 0.00, KAM_FROM_URIBL_PCCC 5.00, RCVD_IN_DNSWL_NONE -0.00, RP_MATCHES_RCVD -0.35, SPF_PASS -0.00) Regards Ejaz -- MailScanner mailing list mailscanner at lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! Hoople Ltd, Registered in England and Wales No. 7556595 Registered office: Plough Lane, Hereford, HR4 0LE "Any opinion expressed in this e-mail or any attached files are those of the individual and not necessarily those of Hoople Ltd. You should be aware that Hoople Ltd. monitors its email service. This e-mail and any attached files are confidential and intended solely for the use of the addressee. This communication may contain material protected by law from being passed on. If you are not the intended recipient and have received this e-mail in error, you are advised that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender immediately and destroy all copies of it." -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150324/5b9f3b3d/attachment.html From glenn.steen at gmail.com Wed Mar 25 10:10:35 2015 From: glenn.steen at gmail.com (Glenn Steen) Date: Wed, 25 Mar 2015 11:10:35 +0100 Subject: who match first Filename Rules or Filetype Rules ? In-Reply-To: <550C33DE.7030303@opensource-expert.com> References: <550AE933.6050109@opensource-expert.com> <550C33DE.7030303@opensource-expert.com> Message-ID: Sure, I'll bite... IIRC this is exactly true. Unlike with AV and spam scanning, both tests will occur, so the individual order is not really that relevant.... Unless you have a problem in one (or the other). Cheers! -- -- Glenn On 20 March 2015 at 15:51, Sylvain Viart wrote: > On 19/03/2015 16:20, Sylvain Viart wrote: > > I would like to know which rules will match first? > > Where is it handled in the code? > > > If I'm right it is handled by: > > mailscanner/bin/MailScanner/SweepOther.pm > sub ScanBatch { > > And Filename Rules seems to be applied before Filetype Rules: > > https://github.com/MailScanner/v4/blob/master/mailscanner/bin/MailScanner/SweepOther.pm#L154 > > The following at the end which seems to handle the Filetype Rules > > https://github.com/MailScanner/v4/blob/master/mailscanner/bin/MailScanner/SweepOther.pm#L427 > > counter += CheckFileContentTypes($batch) > > Someone confirms? > > Regards. > Sylvain. > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From glenn.steen at gmail.com Wed Mar 25 10:35:35 2015 From: glenn.steen at gmail.com (Glenn Steen) Date: Wed, 25 Mar 2015 11:35:35 +0100 Subject: Qurantine. In-Reply-To: <012701d0663c$cdb73030$69259090$@net.sa> References: <041401d064b3$a2a6d330$e7f47990$@net.sa> <055901d06550$c97dd380$5c797a80$@net.sa> <7CA580B59C1ABD45B4614ED90D4C7B858A40D80C@HC-EXMBX03.herefordshire.gov.uk> <012701d0663c$cdb73030$69259090$@net.sa> Message-ID: I'd say the problem is twofold: 1. AHBL closing is probably what is tipping you over the edge. Running sa-update on a regular basis (from cron) solves this as the update removed those rules almost a year ago.. See: # grep AHBL /var/lib/spamassassin/3.004000/updates_spamassassin_org/* /var/lib/spamassassin/3.004000/updates_spamassassin_org/20_dnsbl_tests.cf:# AHBL is closing down. disabling early. (Axb-2014-03-28) /var/lib/spamassassin/3.004000/updates_spamassassin_org/20_dnsbl_tests.cf:#header DNS_FROM_AHBL_RHSBL eval:check_rbl_envfrom('ahbl', 'rhsbl.ahbl.org.') /var/lib/spamassassin/3.004000/updates_spamassassin_org/20_dnsbl_tests.cf:#describe DNS_FROM_AHBL_RHSBL Envelope sender listed in dnsbl.ahbl.org /var/lib/spamassassin/3.004000/updates_spamassassin_org/20_dnsbl_tests.cf:#tflags DNS_FROM_AHBL_RHSBL net /var/lib/spamassassin/3.004000/updates_spamassassin_org/20_dnsbl_tests.cf:#reuse DNS_FROM_AHBL_RHSBL /var/lib/spamassassin/3.004000/updates_spamassassin_org/50_scores.cf:# AHBL is closing down. disabling early. (Axb-2014-03-28) /var/lib/spamassassin/3.004000/updates_spamassassin_org/50_scores.cf:#score DNS_FROM_AHBL_RHSBL 0 2.438 0 2.699 # n=0 n=2 # Check that you have Disabled=no in /etc/cron.daily/update_spamassassin (or wherever...:-) 2. The KAM thing is what really loads you down there... Perhaps time to revisit whether it is a good fit or not, and whether the point attribution is OK:-) Cheers -- -- Glenn On 24 March 2015 at 15:14, Mohammed Ejaz wrote: > Thank you as I did it. > > > > From: mailscanner-bounces at lists.mailscanner.info > [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Randal, > Phil > Sent: Tuesday, March 24, 2015 1:04 PM > To: MailScanner discussion > Subject: RE: Qurantine. > > > > That change will get trashed next time sa-update is run. > > > > Better to put > > > > score DNS_FROM_AHBL_RHSB 0 > > > > in your local.cf > > > > Cheers, > > > > Phil > > -- > > Phil Randal > > Infrastructure Engineer > > Hoople Ltd | Thorn Office Centre | Hereford | HR2 6JT > > Tel : 01432 260415 |Email: phil.randal at hoopleltd.co.uk > General email: enquiries at hoopleltd.co.uk > Website: www.hoopleltd.co.uk > > > > From: mailscanner-bounces at lists.mailscanner.info > [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Mohammed > Ejaz > Sent: 23 March 2015 10:05 > To: 'MailScanner discussion' > Subject: RE: Qurantine. > > > > Thank you, as seen in the article > > > > I opened the 50_scores.cf file and comment the lines from > DNS_FROM_AHBL_RHSB > > > > Ejaz > > > > From: mailscanner-bounces at lists.mailscanner.info > [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jerry > Benton > Sent: Sunday, March 22, 2015 7:29 PM > To: MailScanner discussion > Subject: Re: Qurantine. > > > > See here > > > > http://community.zimbra.com/collaboration/f/1884/t/1137276 > > > > > > > - > > Jerry Benton > > www.mailborder.com > > > > > > > > On Mar 22, 2015, at 11:19 AM, Mohammed Ejaz wrote: > > > > > > Hello All. > > > > Sometimes, Very strangely I noticed that My normal test Emails are being > quarantined from the MailScanner. any help would be highly appreciated. > > > > I am enclosing the my MailScanner configuration file FYR. > > > > > > > > Below are my logs and I can see the my test message in the quarantine spam > folder > > grep -i ejazrom at hotmail.com /var/log/maillog > > Mar 22 16:25:36 mailgate5 postfix/cleanup[4839]: E3A01A504E5: hold: header > Received: from COL004-OMC3S5.hotmail.com (col004-omc3s5.hotmail.com > [65.55.34.143])??by mailgate5.cyberia.net.sa (Postfix) with ESMTP id > E3A01A504E5;??Sun, 22 Mar 2015 16:25:35 +0300 (AST) from > col004-omc3s5.hotmail.com[65.55.34.143]; from= > to= proto=ESMTP helo= > > Mar 22 16:25:45 mailgate5 MailScanner[31920]: Message E3A01A504E5.AA0BD from > 65.55.34.143 (ejazrom at hotmail.com) to cyberia.net.sa is spam, SpamAssassin > (not cached, score=5.453, required 5, BAYES_00 -1.90, DNS_FROM_AHBL_RHSBL > 2.70, FREEMAIL_FROM 0.00, HTML_MESSAGE 0.00, KAM_FROM_URIBL_PCCC 5.00, > RCVD_IN_DNSWL_NONE -0.00, RP_MATCHES_RCVD -0.35, SPF_PASS -0.00) > > > > > > Regards > > Ejaz > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > Hoople Ltd, Registered in England and Wales No. 7556595 > Registered office: Plough Lane, Hereford, HR4 0LE > > "Any opinion expressed in this e-mail or any attached files are those of the > individual and not necessarily those of Hoople Ltd. You should be aware that > Hoople Ltd. monitors its email service. This e-mail and any attached files > are confidential and intended solely for the use of the addressee. This > communication may contain material protected by law from being passed on. If > you are not the intended recipient and have received this e-mail in error, > you are advised that any use, dissemination, forwarding, printing or copying > of this e-mail is strictly prohibited. If you have received this e-mail in > error please contact the sender immediately and destroy all copies of it." > > > -- > MailScanner mailing list > mailscanner at lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From heino.backhaus at fink-computer.de Fri Mar 27 14:03:20 2015 From: heino.backhaus at fink-computer.de (Heino Backhaus) Date: Fri, 27 Mar 2015 15:03:20 +0100 Subject: Does Mailscanner Rename Message-ID: <55156328.5020108@fink-computer.de> Hello All, I enjoy using mailscanner for many years now. Thanks to all. I would realy appreciate your help with a problem i was running across. The first question is. Does Mailscanner rename a file with a CLSID in the filename to something like this: CLIP-%7B8EC58011.bmp ? Now to my problem: An attached bitmap (a companys logo) triggeres the CLSID Filename rule. The MailWatch report says: Report: MailScanner: Files containing CLSID's are trying to hide their real type (CLIP-%7B8EC58011.bmp) The corresponding rule from filename.rules.conf is stated below: # Deny filenames containing CLSID's deny \{[a-hA-H0-9-]{25,}\} Filename trying to hide its real type Files containing CLSID's are trying to hide their real type A strange thing is that this file downloaded from Mailwatch and attached to a new (html) mail will pass the Mailscanner. So i think it's renamed and may not be the original name... But when you try to release the mail from quarantine it triggers the CLSID-Rule again ... I'm a little confused about this and need help. Thanks in advance. My Softwareversions are: MailWatch Version = 1.2.0 - Beta 5 MailScanner Version = 4.84.6 PHP Version = 5.5.9-1ubuntu4.7 MySQL Version = 5.5.41-0ubuntu0.14.04.1 -- "In retrospect it becomes clear that hindsight is definitely overrated!" -Alfred E. Neumann From sylvain at opensource-expert.com Fri Mar 27 14:44:12 2015 From: sylvain at opensource-expert.com (Sylvain Viart) Date: Fri, 27 Mar 2015 15:44:12 +0100 Subject: who match first Filename Rules or Filetype Rules ? In-Reply-To: References: <550AE933.6050109@opensource-expert.com> <550C33DE.7030303@opensource-expert.com> Message-ID: <55156CBC.3000007@opensource-expert.com> Hi, On 25/03/2015 11:10, Glenn Steen wrote: > Sure, I'll bite... IIRC this is exactly true. Unlike with AV and spam > scanning, both tests will occur, so the individual order is not really > that relevant.... Unless you have a problem in one (or the other). > > Cheers! I found it in the doc! So the answer is: The attachment must pass *all four tests before it is allowed* to remain in the message. The filename AND the filetype Rules. From the PDF p.208 Allow Filenames = This contains a space-separated list of regular expressions used as rules which are applied to the original fileames of attachments. If any of these rules matches, then the filename is accepted. This can also be the filename of a ruleset. Deny Filenames = This contains a space-separated list of regular expressions used as rules which are applied to the original filenames of attachments. If any of these rules matches, then the filename is not accepted, and the attachment is blocked. This can also be the filename of a ruleset. Allow Filetypes = This contains a space-separated list of regular expressions. These expressions are matched against the output of the ?file? command. If any of the expressions match, then the attachment is accepted and allowed to remain in the message. This can also be the filename of a ruleset. page 197 Deny Filetypes = This contains a space-separated list of regular expressions, and is used similarly to the ?Allow Filetypes? option above. If and of the expressions match, then the attachment is blocked and removed from the message. This can also be the filename of a ruleset. The attachment must pass *all four tests before it is allowed* to remain in the message. If none of the regular expressions match at all, then the previous system based around ?filename.rules.conf? and ?filetype.rules.conf? is applied to the attachment instead, and all of those tests must pass for it to remain in the message. So I can't allow filename to skip filetype, for a specific filename. Filetype will still deny it. The code doesn't reveal that, for me for now. Still digging. Regards. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20150327/7dd93373/attachment.html From heino.backhaus at fink-computer.de Fri Mar 27 15:10:36 2015 From: heino.backhaus at fink-computer.de (Heino Backhaus) Date: Fri, 27 Mar 2015 16:10:36 +0100 Subject: Filename wrongly triggers CLSID-Rule in Filename.rules.conf Message-ID: <551572EC.1010602@fink-computer.de> Hello All, I've enjoyed using mailscanner for many years now. Thanks to all. I would realy appreciate your help with a problem i was running across. An attached bitmap (a companys logo) triggeres wrongly the CLSID Filename rule. The MailWatch report says: Report: MailScanner: Files containing CLSID's are trying to hide their real type (CLIP-%7B8EC58011.bmp) The corresponding rule from filename.rules.conf is stated below: # Deny filenames containing CLSID's deny \{[a-hA-H0-9-]{25,}\} Filename trying to hide its real type Files containing CLSID's are trying to hide their real type The first question is. Does Mailscanner rename a file with a CLSID in the filename to something like this: CLIP-%7B8EC58011.bmp ? A strange thing is that this file downloaded from Mailwatch and attached to a new (html) mail will pass the Mailscanner. So i think it's renamed... But when you try to release the mail from quarantine it triggers the CLSID-Rule again ... I'm a little confused about this and need help. My Softwareversions are: MailWatch Version = 1.2.0 - Beta 5 MailScanner Version = 4.84.6 PHP Version = 5.5.9-1ubuntu4.7 MySQL Version = 5.5.41-0ubuntu0.14.04.1 Thanks in advance. -Heino -- "In retrospect it becomes clear that hindsight is definitely overrated!" -Alfred E. Neumann From jerry.benton at mailborder.com Sun Mar 29 11:13:05 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Sun, 29 Mar 2015 06:13:05 -0400 Subject: debian 4.85.2-1 RC In-Reply-To: <5509B750.4090907@shout.net> References: <5509B750.4090907@shout.net> Message-ID: /var/lock/MailScanner/mailscanner.off is corrected in the source. - Jerry Benton www.mailborder.com > On Mar 18, 2015, at 1:35 PM, Jim Creason wrote: > > /var/lock/MailScanner/mailscanner.off From jerry.benton at mailborder.com Sun Mar 29 11:24:53 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Sun, 29 Mar 2015 06:24:53 -0400 Subject: debian 4.85.2-1 RC In-Reply-To: <5509B750.4090907@shout.net> References: <5509B750.4090907@shout.net> Message-ID: Moved /var/lock/subsys/mailscanner to /run/lock/MailScanner/mailscanner in the source. - Jerry Benton www.mailborder.com > On Mar 18, 2015, at 1:35 PM, Jim Creason wrote: > > /var/lock/subsys From jerry.benton at mailborder.com Sun Mar 29 12:28:26 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Sun, 29 Mar 2015 07:28:26 -0400 Subject: v4.85.2-1 Released Message-ID: <2E3E8650-A69B-4DCE-AD18-B38B7864D801@mailborder.com> Ok, I made some minor updates based on feedback from testers. The new packages are now available on the MailScanner website. Jules and I are in the process of transferring mailscanner.info domain to my registrar. Once that is completed and I finish up the latest Mailborder development project I am working on I will create a new website for MailScanner and a new mailman server that should remove these big delays we have been seeing. Thanks to everyone that tested the packages and pointed out areas of improvement. Package Downloads: http://www.mailscanner.info/downloads.html Complete Source: https://github.com/MailScanner/v4 - Jerry Benton www.mailborder.com From jerry.benton at mailborder.com Mon Mar 30 10:28:42 2015 From: jerry.benton at mailborder.com (Jerry Benton) Date: Mon, 30 Mar 2015 05:28:42 -0400 Subject: Mailing List Change Message-ID: <5CEFE7A3-511F-408A-B4CA-2F2854C408AF@mailborder.com> I am in the process of creating a new mailman server for this list. For the most part it will be an exact mirror and you won?t even know anything changed. However, there are 34 members that have marked themselves as ?private? on the mailman server. If you are marked as private, your account will not be transferred to the new server. If you don?t know, go check. If you are set as private, email me directly and I will add your email to the import list. Also, everyone?s password will be reset during the import. You will get an email with relevant details when the import happens. - Jerry Benton www.mailborder.com