Denial of Service attack Messages Constantly

Andy Southgate andy at z00b.com
Mon Aug 22 14:15:22 UTC 2016


It still happens for me, AFAIK all that was worked out was that for some reason there is an intermittant permission problem that occasionally causes the spawned child process to fail to run causing that error on the message, but there was never any insight as to why that should be.

 

From: MailScanner [mailto:mailscanner-bounces+andy=z00b.com at lists.mailscanner.info] On Behalf Of Aaron Pursell
Sent: 22 August 2016 15:01
To: mailscanner at lists.mailscanner.info
Subject: Re: Denial of Service attack Messages Constantly

 

 

I read pretty much every message and tried everything, most of those messages are years old and it appears it was fixed and now in the new version is the first time I'm experiencing them in many, many years, the fixes worked originally back in a way older versiona. Nothing really changed except the fact there's this new version, too bad it only happens to legitimate messages and not spam.... So who knows. I'll continue to look, the log really never says anything specific.  I

 

---



Regards,

Aaron


Message: 1
Date: Fri, 19 Aug 2016 08:26:31 -0600
From: Steven Jardine <steve at mjnservices.com>
To: MailScanner Discussion <mailscanner at lists.mailscanner.info>
Subject: Re: Denial of Service attack Messages Constantly
Message-ID: <9dbfad5c-651a-3a7f-e9c8-2c623adf51c1 at mjnservices.com>
Content-Type: text/plain; charset=windows-1252; format=flowed

I still haven't found a good solution to this even after trying all of 
the suggestions posted on the previous threads.  If turn off "Dangerous 
Content Scanning" the error goes away but you lose that functionality.

I have had to disable it until a solution can be found.  Its not ideal.

Good luck!
Steve

On 08/18/2016 04:43 PM, Mark Sapiro wrote:

On 08/18/2016 08:49 AM, Aaron Pursell wrote: 

  
The problem is, my users and I keep getting messages like this:
  
" 

MailScanner was attacked by a Denial Of Service attack, and has
therefore deleted this part of the message. Please contact your e-mail
providers for more information if you need it, giving them the whole
of this report. Attack in:
/var/spool/MailScanner/incoming/12835/78C9F481B0DA.ACDF4/nmsg-12835-2.html"
  
  

  
The path doesn't exist when you look and the message never gets
delivered. What can I turn off or adjust to make sure this doesn't happen?


What's in the Mail log associated with this?

There's a long thread on this with Subject: Denial Of Service Attack
Messages in the archives of this list at
<http://lists.mailscanner.info/pipermail/mailscanner/2016-May/thread.html>
and
<http://lists.mailscanner.info/pipermail/mailscanner/2016-June/thread.html>
which may be helpful.




IMPORTANT: This email does not constitute a contract or an offer or acceptance of an offer to enter into a contract.  Further, this email may not be used to modify, supplement, novate, or waive any rights with respect to an existing contract or other binding commercial terms. MJN Services, Inc. conducts business under our service terms and conditions found at www.mjnservices.com unless otherwise agreed to in writing by an officer of MJN Services, Inc. 



------------------------------

Message: 2
Date: Fri, 19 Aug 2016 09:30:29 -0500
From: Jerry Benton <jerry.benton at mailborder.com>
To: MailScanner Discussion <mailscanner at lists.mailscanner.info>
Subject: Re: Denial of Service attack Messages Constantly
Message-ID:
    <CAED3VzD1=fCW8a=t4V_xDX-d=3YX+QLZz2Xkwr05vFWSGMs48w at mail.gmail.com>
Content-Type: text/plain; charset=UTF-8

Steve,

Can you zip the raw source of a message (the file) that triggers this
and email it directly to me?


-
Jerry Benton
www.mailborder.com
+1 - 844-436-6245


-----Original Message-----
From:?Steven Jardine <steve at mjnservices.com>
Reply:?MailScanner Discussion <mailscanner at lists.mailscanner.info>
Date:?August 19, 2016 at 10:27:05 AM
To:?MailScanner Discussion <mailscanner at lists.mailscanner.info>
Subject:? Re: Denial of Service attack Messages Constantly

I still haven't found a good solution to this even after trying all of
the suggestions posted on the previous threads. If turn off "Dangerous
Content Scanning" the error goes away but you lose that functionality.

I have had to disable it until a solution can be found. Its not ideal.

Good luck!
Steve

On 08/18/2016 04:43 PM, Mark Sapiro wrote: 

On 08/18/2016 08:49 AM, Aaron Pursell wrote: 


The problem is, my users and I keep getting messages like this:

" 

MailScanner was attacked by a Denial Of Service attack, and has
therefore deleted this part of the message. Please contact your e-mail
providers for more information if you need it, giving them the whole
of this report. Attack in:
/var/spool/MailScanner/incoming/12835/78C9F481B0DA.ACDF4/nmsg-12835-2.html"


The path doesn't exist when you look and the message never gets
delivered. What can I turn off or adjust to make sure this doesn't happen?


What's in the Mail log associated with this?

There's a long thread on this with Subject: Denial Of Service Attack
Messages in the archives of this list at

and

which may be helpful.




IMPORTANT: This email does not constitute a contract or an offer or acceptance of an offer
to enter into a contract. Further, this email may not be used to modify, supplement, novate,
or waive any rights with respect to an existing contract or other binding commercial
terms. MJN Services, Inc. conducts business under our service terms and conditions
found at www.mjnservices.com unless otherwise agreed to in writing by an officer of
MJN Services, Inc.



--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/listinfo/mailscanner



------------------------------

Subject: Digest Footer



-- 
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/listinfo/mailscanner


------------------------------

End of MailScanner Digest, Vol 128, Issue 16
********************************************


-- 
This message has been scanned for viruses and 
dangerous content by  <http://www.mailscanner.info/> MailScanner, and is 
believed to be clean. 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20160822/273daf0a/attachment.html>


More information about the MailScanner mailing list