Re: [Assp-user] How to split local mail from external mail.
Hi, Matti Haack schrieb: DT So far today (17 hours) ASSP 1.2.7(36) has blocked 400 emails with bad DT attachments, and missed 300 Uuencoded files which were then found to be DT viral by my SMTP AV scanner. Granted I am not using Clamd with ASSP due to DT the prior performance degredation, but... it would be nice for ASSP to DT reject all those Uuencoded emails containing EXE viruses too without the DT overhead of having to scan them. But ASSP (or better ClamAV) fails to filter specially Base64 encrypted eicar mails. You can request such a test virus here: http://www.heise.de/security/dienste/emailcheck/demos/go.shtml?mail=mimet Even whit a second email scanner, using clamd, it is not filtered. So the problem is with clamAV, not with ASSP I did just that yesterday/sunday evening. The bagle_q variant passed clamav, netsky_p was caught. Rainer - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
[Assp-user] [v1.2.7.1(final)] prob with Threshold for Combined Scores per Message
although i've set the threshold to '50' and penalty box is not running in testmode messages with a higher value seems to pass through: Jan-22-07 10:14:22 83.18.1.202 [EMAIL PROTECTED] to: [EMAIL PROTECTED] Sender Validation:scoring + 25: Forged HELO: 'localhost' Jan-22-07 10:14:22 83.18.1.202 [EMAIL PROTECTED] to: [EMAIL PROTECTED] Sender Validation:scoring + 15: Valid HELO check: 'localhost' Jan-22-07 10:14:22 83.18.1.202 [EMAIL PROTECTED] to: [EMAIL PROTECTED] Sender Validation:scoring + 15: Invalid HELO: 'localhost' Jan-22-07 10:14:33 83.18.1.202 [EMAIL PROTECTED] to: [EMAIL PROTECTED] Sender Validation:scoring + 5: blacklisted HELO: 'localhost' Jan-22-07 10:15:05 83.18.1.202 [EMAIL PROTECTED] to: [EMAIL PROTECTED] Bayesian Check Prob: 1.0 Jan-22-07 10:15:05 83.18.1.202 [EMAIL PROTECTED] to: [EMAIL PROTECTED] passing if safe because testmode, otherwise Bayesian spam Jan-22-07 10:15:08 83.18.1.202 [EMAIL PROTECTED] to: [EMAIL PROTECTED] spam determined to be safe, passing on to recipient Why_be_an_average_guy_any_longer_ note: as you can see bayesian spam is running in testmode but imho the mail should be blocked due to the PB results, shouldn't it? -- View this message in context: http://www.nabble.com/-v1.2.7.1%28final%29--prob-with-%22Threshold-for-Combined-Scores-per-Message%22-tf3052590.html#a8485755 Sent from the assp-user mailing list archive at Nabble.com. - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] What does the RBL / URIBL check?
Andreas Krüger wrote: on 22-01-2007 01:01 Fritz Borgstedt wrote: [EMAIL PROTECTED] schreibt: I am curious, does the RBL/URIBL function make a lookup to the lists with the ip address of the client connected or the ip address of the domain which is given in the mail from command? RBL does a lookup with the real incoming ip-connection. URIBL looks in the body of mails for spammy urls and uses the domain from this url for a lookup. What do you define as spammy urls and users? - Do you just check the body for all domain names there is, either if they're from a url or an email? spammy URLs are defined by the URIBL providers not by ASSP. ASSP queries the providers to see if they list any of the urls contained in the message body (I don't believe we check the from/to/cc address). If they do list the URL it is a positive hit, if they do not it is a negative hit. More Info: http://www.uribl.com/about.shtml http://www.surbl.org/ Kevin - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] [v1.2.7.1(final)] prob with Threshold for Combined Scores per Me
Questions and Answers for users of ASSP Anti-Spam SMTP Proxy assp-user@lists.sourceforge.net schreibt: Validation:scoring Penalty Box is running in learn modus (2). - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] [v1.2.7.1(final)] prob with Threshold for Combined Scores per Me
Questions and Answers for users of ASSP Anti-Spam SMTP Proxy assp-user@lists.sourceforge.net schreibt: note: as you can see bayesian spam is running in testmode but imho the mail should be blocked due to the PB results, shouldn't it? I see no logging from PB activity besides scoring drom the various tests fritz - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] Stats from local senders...
Questions and Answers for users of ASSP Anti-Spam SMTP Proxy assp-user@lists.sourceforge.net schreibt: Messages from local containing bad attachments appear duplicated in info-stats adding to both Messages Passed (via 'local') and Messages Blocked. Regards, I do not get that. - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
[Assp-user] Assp stops with a specific messsage
hi all, running v1.2.7.1(47) this week-end, my 2 servers are shutdow with an email after looking at the logs i put this email in non-processing because after reboot, this email recrash and recrash my 2 assp server my logs shows always the same : Jan-21-07 21:41:50 Connected: 193.54.67.73:54769 - 192.168.52.212:25 - 192.168.52.202:25 Jan-21-07 21:41:50 193.54.67.73 [EMAIL PROTECTED] renewing tuplet: (193.54.67.0,sciences-po.org) age: 1h 23m 21s Jan-21-07 21:41:50 193.54.67.73 [EMAIL PROTECTED] to: [EMAIL PROTECTED] recipient accepted: [EMAIL PROTECTED] Jan-21-07 21:41:50 Commencing DNSBL checks on 193.54.67.73 Jan-21-07 21:41:50 Completed DNSBL checks on 193.54.67.73 Jan-21-07 21:41:50 193.54.67.73 [EMAIL PROTECTED] to: [EMAIL PROTECTED] Received-RBL: pass Jan-21-07 21:56:06 Starting as a service Jan-21-07 21:56:07 ASSP version 1.2.7.1(47) (Perl 5.008008) initializing Jan-21-07 21:56:07 File::Scan::ClamAV module not installed I suspect URIBL ??? perhaps... because there is an url in this message http://www.ingridbetancourt-idf.com http://www.ingridbetancourt-idf.com/=20 _ =20 = -- Ce message et toutes les pi=E8ces jointes qu'il contient sont confidentiels et =E9tablis =E0 l'intention exclusive de ses = destinataires. Toute utilisation de ce message non conforme =E0 sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite. Si vous recevez ce message par erreur, merci d'en avertir imm=E9diatement l'exp=E9diteur et de le d=E9truire. Sciences Po d=E9cline toute = responsabilit=E9 au titre de ce message s'il a =E9t=E9 alt=E9r=E9, d=E9form=E9 ou = falsifi=E9 ou si son =E9metteur a falsifi=E9 son identit=E9 ou son statut au sein de = Sciences Po. This message and all attachments are confidential and intended solely for the addressees. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited. If you receive this message in error, please immediately notify the sender and delete it. Sciences Po shall not be liable for this message if altered, changed or falsified or if the sender has falsified his identity or his statute within Sciences Po.=20 Have you an idea ? I'm running assp with RBL,URIBL,PB,Delaying,Helo Thanks - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] [v1.2.7.1(final)] prob with Threshold for Combined Scores per Me
Fritz Borgstedt wrote: Penalty Box is running in learn modus (2). it *should* run in full mode: DoPenalty:=1 DoPenaltyMessage:=1 PenaltyExtreme:=150 PenaltyLimit:=50 PenaltyLog:=1 PenaltyMessageLimit:=50 i'll wait for the next entry - since most often bombre blocks the mail it seems only those with penalty score *and* bayesian spam (maybe due to testmode) seems to pass through (if i remember right they are correctly blocked if there is no bayesian spam detected). anyway: thx for your fast reply ;-) -- View this message in context: http://www.nabble.com/-v1.2.7.1%28final%29--prob-with-%22Threshold-for-Combined-Scores-per-Message%22-tf3052590.html#a8486704 Sent from the assp-user mailing list archive at Nabble.com. - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] Assp stops with a specific messsage
- Original Message - From: Jérôme PHILIPPE running v1.2.7.1(47) his week-end, my 2 servers are shutdow with an email I suspect URIBL ??? perhaps... because there is an url in this message same here with (56), but i don't use uribl. Testing the final (candidate) . No problems so far - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] Assp stops with a specific messsage
I have pasted the mail and the attachment in the new one and it's ok so i can't reproduce this problem. I've disable URIBL cache too Connected: 65.54.246.84:41854 - 192.168.52.212:25 - 192.168.52.202:25Jan-22-07 11:47:26 65.54.246.84 [EMAIL PROTECTED] renewing tuplet: (65.54.246.0,hotmail.com) age: 6m 31sJan-22-07 11:47:26 65.54.246.84 [EMAIL PROTECTED] to: me recipient accepted: meJan-22-07 11:47:26 Commencing DNSBL checks on 65.54.246.84Jan-22-07 11:47:26 Completed DNSBL checks on 65.54.246.84Jan-22-07 11:47:26 65.54.246.84 [EMAIL PROTECTED] to: me Received-RBL: passJan-22-07 11:47:26 Commencing DNSBL checks on ingridbetancourt-idf.comJan-22-07 11:47:26 Completed DNSBL checks on ingridbetancourt-idf.comJan-22-07 11:47:26 65.54.246.84 [EMAIL PROTECTED] to: me Received-URIBL: passJan-22-07 11:47:27 65.54.246.84 [EMAIL PROTECTED] to: me Bayesian Check Regex:White 'COMMUNIQUE DE PRESSE'Jan-22-07 11:47:27 65.54.246.84 [EMAIL PROTECTED] to: me Bayesian Check: message ok Jan-22-07 11:47:29 65.54.246.84 [EMAIL PROTECTED] to: me is disconnected _ Essayez Live.com, votre nouvelle page d'accueil ! Personnalisez-la en quelques clics pour retrouver tout ce qui vous intéresse au même endroit. http://www.live.com/getstarted- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] Assp stops with a specific messsage
same here with (56), but i don't use uribl. Testing the final (candidate) . No problems so far yes, with my tests it's not en uribl problem... _ Essayez Live.com, votre nouvelle page d'accueil ! Personnalisez-la en quelques clics pour retrouver tout ce qui vous intéresse au même endroit. http://www.live.com/getstarted- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] [v1.2.7.1(final)] prob with Threshold for Combined Scores per Me
2007/1/22, larsneo [EMAIL PROTECTED]: PenaltyLog:=1 best set this to 2 for now to help clarify this issue... - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] Assp stops with a specific messsage
I put an option against these types of crashes in. Is it activated ? - Header MaxBytes -section message verification Maximum allowed header length. Set to 0 to deactivate. Put it to 50 k or so. - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] Assp stops with a specific messsage
From: Fritz Borgstedt [EMAIL PROTECTED] I put an option against these types of crashes in. Is it activated ? - Header MaxBytes -section message verification Maximum allowed header length. Set to 0 to deactivate. Put it to 50 k or so. activated, 22k here. but i had just a single crash with (56). With 1.2..7.1 final (this morning) everything seems fine again. - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] Assp stops with a specific messsage
I put an option against these types of crashes in. Is it activated ? - Header MaxBytes -section message verification Maximum allowed header length. Set to 0 to deactivate. Put it to 50 k or so. thanks for your reply, yes it's actived, for me my conf : MsgRelay:= HeaderMaxLength:=10 MsgVerifyLineLength:=1000 best regards - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] Stats from local senders...
-Original Message- Date: Mon, 22 Jan 2007 11:09:22 +0100 From: Fritz Borgstedt [EMAIL PROTECTED] Messages from local containing bad attachments appear duplicated in info-stats adding to both Messages Passed (via 'local') and Messages Blocked. Regards, I do not get that. I am assuming that you mean that you did not understand my statement (if you mean that you don't see this then ignore me please). For messages that are from local senders outgoing, that fail attachment tests, the stats are incremented for both Messages Passed and Messages Blocked. This seems illogical to me. Eg Jan-22-07 11:03:39 192.168.0.130 [EMAIL PROTECTED] to: [EMAIL PROTECTED] bad attachment (local/white): Content-Disposition: attachment; filename=file.exe $Stats{locals} is incremented on the test of the header $Stats{viri} is incremented on the bad attachment fail on the body I think it also applies to whitelisted senders given what I make of the code. Simply, I think it would make more sense to increment the stats variables $Stats{locals}, $Stats{whites} after successfully passing a message, not during the header test. A quick look gives me the impression that $Stats{noprocessing} does however work okay. I only noticed this after a restart installing 1.2.7.1 (final) and had a run of bad attachments straight away. I am sure that it has been the case for quite some time and don't consider it critical in any way. Regards, Nick - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
[Assp-user] ASSP Crashing
Late night i downloaded the 1.27.1 (final) version. It is crashing every time there is an Exported Black Box Extreme IP's I went back to (64) which is running fine ! - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
[Assp-user] Obfuscated URIs
Regarding Disallow Obfuscated URIs I have noticed that this function does not block all types of obfuscated URIs. While my perl is not quite good enough to get right to the bottom of it, may I suggest that the description text outline briefly what types the check does cover. Eg currently, When enabled messages with obfuscated uri's in the body will receive URIBLPolicyError SMTP error code. To When enabled messages with obfuscated uri's of types [integer/octal/hex ip, other things!] in the body will receive URIBLPolicyError SMTP error code. Regards, Nick - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] How to split local mail from external mail.
I have a tough time believing no-one has run into this problem before - if you run a separate virus/spam filter that sits between your ASSP and mail servers, virus checking will continue to function, but spam filtering will suffer (on the separate spam filter) due to the changed source IP (ASSP's) of the connection, right? My internal email does not go to ASSP. All my internal clients, including from VPN traffic, goes directly to our email server application. Only email that is routed to the outside or from the outside goes through ASSP and my AV layers. I have very strict rules in place for incoming external email that would not be acceptable for internal to internal mail. Doug Traylor - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
[Assp-user] changing default directory
Hi all. I'am changing the current directory of where ASSP run to /usr/bin/assp.pl and remaining portion in /etc/assp/ In assp.pl I have changed $base to $base=/etc/assp; I dont know if is necessary change in this line. if ($Config{$f} =~ /^\s*file:\s*(.+)\s*$/i fileUpdated($1)){ for this: if ($Config{$f} =~ /^\s*file:\/etc\/assp\/\s*(.+)\s*$/i fileUpdated($1)){ Does Someone knows if it correct? Thanks in advanced. smime.p7s Description: S/MIME Cryptographic Signature - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] changing default directory
Questions and Answers for users of ASSP Anti-Spam SMTP Proxy assp-user@lists.sourceforge.net schreibt: In assp.pl I have changed $base to $base=/etc/assp; I think it is enough to change to this: foreach ('.','assp','/usr/local/assp','/home/assp','/etc/assp','/usr/assp','/applications/assp','/assp','.') { $base=$_; last if -e $base/assp.cfg; } - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] [Spam] ASSP Crashing
I have the same problem... -Message d'origine- De : [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] De la part de Pascal Dreissen Envoyé : lundi 22 janvier 2007 14:44 À : Questions and Answers for users of ASSP Anti-Spam SMTP Proxy Objet : [Spam] [Assp-user] ASSP Crashing Late night i downloaded the 1.27.1 (final) version. It is crashing every time there is an Exported Black Box Extreme IP's I went back to (64) which is running fine ! - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] [Spam] ASSP Crashing
I have the same problem... nothing in the log? - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] [Spam] Re: [Spam] ASSP Crashing
Dear Fritz, Is it possible to maintain a changelog between every build like: 22/01/2007 Version 1.2.7.1(66) Write change herebug resolution, change, new features... 21/01/2007 Version 1.2.7.1(65) Write change here With that we can search in the perl code what's append and try to debug in our side that will improve works for everybody... Thanks Armand -Message d'origine- De : [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] De la part de Pascal Dreissen Envoyé : lundi 22 janvier 2007 16:43 À : Questions and Answers for users of ASSP Anti-Spam SMTP Proxy Objet : [Spam] Re: [Assp-user] [Spam] ASSP Crashing As me concers, no only the exporting line and after that nothing more! Fritz Borgstedt schreef: I have the same problem... nothing in the log? - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] Obfuscated URIs
Regarding Disallow Obfuscated URIs I have noticed that this function does not block all types of obfuscated URIs. Please post a real-world example of such URIs. While my perl is not quite good enough to get right to the bottom of it, may I suggest that the description text outline briefly what types the check does cover. Hmm ... to give a hint for a spammers? ;-) - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
[Assp-user] my contribution
Fritz, I just make a donation for your great jobs. Thanks So guys I think if you love ASSP you can contribute to help Fritz to boost this software. Cheers Armand - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] [Spam] Re: [Spam] ASSP Crashing
Questions and Answers for users of ASSP Anti-Spam SMTP Proxy assp-user@lists.sourceforge.net schreibt: Is it possible to maintain a changelog between every build like: 22/01/2007 Version 1.2.7.1(66) Write change herebug resolution, change, new features... 21/01/2007 Version 1.2.7.1(65) Write change here No, is not possible for me. I have set it up i, that automatically on save the code is uploaded to my homepage. So, that was the idea, we develop more or less in the public together. There are are commands like diff, which give you a nice dufference list. fritz - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] whitelisting for large messages possible?
Questions and Answers for users of ASSP Anti-Spam SMTP Proxy assp-user@lists.sourceforge.net schreibt: but for me it's seem that is only for outgoing mail... wrong ? wrong. It is for mails with a SIZE parm. fb - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
[Assp-user] connection frequency + spamtrapaddresses
i got this in my logs, and it doesn't look correct to me : Jan-22-07 16:54:44 82.12.34.56 to: [EMAIL PROTECTED] recipient accepted: [EMAIL PROTECTED] Jan-22-07 16:54:45 82.12.34.56 to: [EMAIL PROTECTED] message ok Jan-22-07 16:54:45 82.12.34.56 to: [EMAIL PROTECTED] recipient accepted: [EMAIL PROTECTED] Jan-22-07 16:54:45 82.12.34.56 to: [EMAIL PROTECTED] recipient accepted: [EMAIL PROTECTED] Jan-22-07 16:54:45 82.12.34.56 to: [EMAIL PROTECTED] message ok Jan-22-07 16:54:45 82.12.34.56 to: [EMAIL PROTECTED] message ok Jan-22-07 16:54:45 82.12.34.56 to: [EMAIL PROTECTED] recipient accepted: [EMAIL PROTECTED] Jan-22-07 16:54:46 82.12.34.56 to: [EMAIL PROTECTED] recipient accepted: [EMAIL PROTECTED] Jan-22-07 16:54:46 82.12.34.56 to: [EMAIL PROTECTED] message ok Jan-22-07 16:54:46 82.12.34.56 to: [EMAIL PROTECTED] message ok Jan-22-07 16:54:46 Limiting 82.12.34.56 connection frequency (8 / 90 secs ) Jan-22-07 16:54:46 82.12.34.56 to: [EMAIL PROTECTED] recipient accepted: [EMAIL PROTECTED] Jan-22-07 16:54:46 82.12.34.56 to: [EMAIL PROTECTED] recipient accepted: [EMAIL PROTECTED] Jan-22-07 16:54:46 82.12.34.56 to: [EMAIL PROTECTED] recipient accepted: [EMAIL PROTECTED] Jan-22-07 16:54:48 82.12.34.56 to: [EMAIL PROTECTED] message ok Jan-22-07 16:54:48 82.12.34.56 to: [EMAIL PROTECTED] message ok Jan-22-07 16:54:48 82.12.34.56 to: [EMAIL PROTECTED] message ok well, ok, i have 8 recipient accepted (and 8 message ok), but i expected to see the limiting message at the end of the list, so now i'm not sure if this new feature is working or not... Jan-22-07 16:53:59 58.217.168.8 [EMAIL PROTECTED] invalid address rejected: [EMAIL PROTECTED] Jan-22-07 16:54:00 58.217.168.8 [EMAIL PROTECTED] no recipients left -- dropping connection Jan-22-07 16:54:07 58.217.168.8 [EMAIL PROTECTED] invalid address rejected: [EMAIL PROTECTED] Jan-22-07 16:54:08 58.217.168.8 [EMAIL PROTECTED] no recipients left -- dropping connection Jan-22-07 16:54:23 58.217.168.8 [EMAIL PROTECTED] invalid address rejected: [EMAIL PROTECTED] Jan-22-07 16:54:24 58.217.168.8 [EMAIL PROTECTED] no recipients left -- dropping connection Jan-22-07 16:54:33 58.217.168.8 [EMAIL PROTECTED] invalid address rejected: [EMAIL PROTECTED] Jan-22-07 16:54:34 58.217.168.8 [EMAIL PROTECTED] no recipients left -- dropping connection Jan-22-07 16:54:36 Limiting 58.217.168.8 connection frequency (8 / 90 secs ) Jan-22-07 16:54:38 58.217.168.8 [EMAIL PROTECTED] invalid address rejected: [EMAIL PROTECTED] Jan-22-07 16:54:38 58.217.168.8 [EMAIL PROTECTED] no recipients left -- dropping connection here it looks i have only 4 connections, a limit, and one more connection. well, maybe i'm not logging everything, so maybe there have been more connections in the meantime. can you pls confirm that the logs are fine and the feature is working ad espected (i have never seen it in the logs, so i can't tell if this is the normal logging behaviour) PS: i see Spam Bucketed Messages: 0 in the stats, but i can't see spam trap messages anymore (now named Penalty Trap Addresses i suppose) . Allways zero and the logs and stats. Am i missing anything ? - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] connection frequency + spamtrapaddresses
Questions and Answers for users of ASSP Anti-Spam SMTP Proxy assp-user@lists.sourceforge.net schreibt: well, maybe i'm not logging everything, so maybe there have been more connections in the meantime. look for the counters in smtp connection- By IP Frequency Limits we send one entry to the log when the limit is reached, but at the time of logging there are various messages in various state of processing. So e.g. if you have a limit of 10, the log entry will come after 7 and you will see the next 3 ending after the logentry. - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] connection frequency + spamtrapaddresses
Allways zero and the logs and stats. Am i missing anything ? mo. I missed something. - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] connection frequency + spamtrapaddresses
well, maybe i'm not logging everything, so maybe there have been more connections in the meantime. look for the counters in smtp connection- By IP Frequency Limits we send one entry to the log when the limit is reached, but at the time of logging there are various messages in various state of processing. So e.g. if you have a limit of 10, the log entry will come after 7 and you will see the next 3 ending after the logentry. thx, makes sense. in addition i have Reversed Lookup FQDN set to 1 and quite a long Expression to Invalidate Format of PTR* but i see no entries in Invalid PTR: since a few builds. Maybe none of my messages hit that check, su i can't tell for sure if it works. by the way, did you consider dns direct HELO resolution check for 1.2.8 or that doesn't seem a logic check ? - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] changing default directory
I changed in assp.cfg logfile=maillog.txt to logfile:=/var/log/assp/maillog.txt and now log don't work. Someone knows how to solve this? smime.p7s Description: S/MIME Cryptographic Signature - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
[Assp-user] CLAMAV catching phishing but nothing else?
Hello, I hope this hasn't been discussed already, I don't see that it has. I have been able to get clamd running on my server and ASSP is accessing it. However, all I seem to be catching are PHISHING emails. I have sent test EICAR messages and they don't get caught. The ASSP log shows scanning is occurring, but it just says OK for EICAR emails. I have separately run a Perl script I found on the Web to check a text file with EICAR code in it, as well as checking an actual message (in my spool\virus folder) that f-prot (Imail/Declude Virus) caught (and CLAMAV didn't) as EICAR and it is detected this way. Is there something happening differently in the way ASSP is accessing clamd? The clamd log shows reloading of databases (151395 signatures right now) and logs when it finds something. Here is a snip of the clamd.log when it finds PHISHING: Mon Jan 22 11:18:15 2007 - SelfCheck: Database modification detected. Forcing reload. Mon Jan 22 11:18:15 2007 - Reading databases from C:\Program Files\clamAV\data Mon Jan 22 11:18:20 2007 - Database correctly reloaded (151395 signatures) Mon Jan 22 11:34:04 2007 - stream 1025: HTML.Phishing.Pay-38 FOUND And ASSP Maillog shows: Jan-22-07 11:34:04 66.17.34.56 [EMAIL PROTECTED] to: email protected ClamAV: scanning WL=1:0 NP=:0 LOCAL=1: Jan-22-07 11:34:04 66.17.34.56 [EMAIL PROTECTED] to: email protected ClamAV: scanning done FOUND HTML.Phishing.Pay-38 Jan-22-07 11:34:04 66.17.34.56 [EMAIL PROTECTED] to: email protected virus detected 'HTML.Phishing.Pay-38' I'm running: Windows 2003 Server IMail Server 8.22 ASSP 1.2.7.1(66) File::Scan::ClamAV 1.8 clamd daemon devel-20070111 (OS: windows, ARCH: i386, CPU: i686) Thanks for any suggestions. Geoff --- [This E-mail scanned for viruses by Declude Virus] - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] CLAMAV catching phishing but nothing else?
Yes, that makes more sense, of course and is probably a good idea for an account I'd use for testing purposes anyway. I'm still wondering about the apparent failure of ASSP/ClamAV to scan white-listed sender messages though! Thanks, Geoff -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Sent: Monday, January 22, 2007 2:28 PM To: Questions and Answers for users of ASSP Anti-Spam SMTP Proxy Subject: Re: [Assp-user] CLAMAV catching phishing but nothing else? Geoff Varney wrote: HMM, after all the above, I removed [EMAIL PROTECTED] from Whitelist (I had placed there to keep from delaying, instead of DO NOT DELAY THESE IPS...) and now it's catching Eicar. Next time add the receiving email address to the 'Not Delaying Spam-Lover' option. Kevin - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
[Assp-user] Changing default maillog and pid directory
How I can change the default directory of maillog.txt and pid. I want this: /var/log/maillog.txt /var/run/assp/pid I tried put in assp.cfg logfile:=/var/log/assp/maillog.txt and pidfile:=/var/run/assp/pid but this don't work. (Directories is created) Does someone can help me? Thanks in advanced. p.s - Again, very good work in assp. Is very good project. regards, Alex de Oliveira Silva. smime.p7s Description: S/MIME Cryptographic Signature - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] Changing default maillog and pid directory
Alex de Oliveira Silva wrote: How I can change the default directory of maillog.txt and pid. I want this: /var/log/maillog.txt /var/run/assp/pid I tried put in assp.cfg logfile:=/var/log/assp/maillog.txt and pidfile:=/var/run/assp/pid but this don't work. (Directories is created) Does someone can help me? Thanks in advanced. p.s - Again, very good work in assp. Is very good project. The best way to do this is to symlink the directories under the ASSP root to where you want them to be. The source code prevents ASSP from accessing files outside of it's root by design for security reasons. Take a look at the FreeBSD port of ASSP for a idea of how to do this. Oh and you don't want this '/var/log/maillog.txt' you want this '/var/log/assp/maillog.txt', ASSP rotates it's log file by default. Kevin - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] Changing default maillog and pid directory
Kevin escreveu: Alex de Oliveira Silva wrote: How I can change the default directory of maillog.txt and pid. I want this: /var/log/maillog.txt /var/run/assp/pid I tried put in assp.cfg logfile:=/var/log/assp/maillog.txt and pidfile:=/var/run/assp/pid but this don't work. (Directories is created) Does someone can help me? Thanks in advanced. p.s - Again, very good work in assp. Is very good project. The best way to do this is to symlink the directories under the ASSP root to where you want them to be. The source code prevents ASSP from accessing files outside of it's root by design for security reasons. But, I need to change this security reason. I'm creating the Debian assp package, and I need to change this. Thanks again in the help. smime.p7s Description: S/MIME Cryptographic Signature - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] Changing default maillog and pid directory
Alex de Oliveira Silva escreveu: Kevin escreveu: Alex de Oliveira Silva wrote: How I can change the default directory of maillog.txt and pid. I want this: /var/log/maillog.txt /var/run/assp/pid I tried put in assp.cfg logfile:=/var/log/assp/maillog.txt and pidfile:=/var/run/assp/pid but this don't work. (Directories is created) Does someone can help me? Thanks in advanced. p.s - Again, very good work in assp. Is very good project. The best way to do this is to symlink the directories under the ASSP root to where you want them to be. The source code prevents ASSP from accessing files outside of it's root by design for security reasons. But, I need to change this security reason. I'm creating the Debian assp package, and I need to change this. Thanks again in the help. Solved the problem. :) smime.p7s Description: S/MIME Cryptographic Signature - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] Changing default maillog and pid directory
Alex de Oliveira Silva wrote: Kevin escreveu: Alex de Oliveira Silva wrote: How I can change the default directory of maillog.txt and pid. I want this: /var/log/maillog.txt /var/run/assp/pid I tried put in assp.cfg logfile:=/var/log/assp/maillog.txt and pidfile:=/var/run/assp/pid but this don't work. (Directories is created) Does someone can help me? Thanks in advanced. p.s - Again, very good work in assp. Is very good project. The best way to do this is to symlink the directories under the ASSP root to where you want them to be. The source code prevents ASSP from accessing files outside of it's root by design for security reasons. But, I need to change this security reason. I'm creating the Debian assp package, and I need to change this. Forsaking security for convenience is one of the worst things you can do IMHO. (Actually wouldn't symlinks be easier than creating a patch for the assp.pl?) Changing the code when there is a perfectly non-code solution is a bit reckless, you would be making it impossible for anyone who uses your package to upgrade ASSP by simple downloading the latest version and dropping it in, not to mention possibly opening up security holes by altering the code. end rant Kevin - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
[Assp-user] Interface descrepancy ?
Hi all, I've just upgraded to 1.2.6, and saw something in the Copy All SPAM section. At the bottom (cc ham section) CC for this recipients should this be these, and on the line just below the entry box, should CC HAM to these recipients read CC HAM for these recipients ? This is quite a change (excellent) from where I was (1.1.1), a great many new features. Wonderfully done! Bravo Fritz, and everyone else developing ASSP. -sam - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
Re: [Assp-user] How to split local mail from external mail.
Doug Traylor ([EMAIL PROTECTED]) wrote: My internal email does not go to ASSP. All my internal clients, including from VPN traffic, goes directly to our email server application. Only email that is routed to the outside or from the outside goes through ASSP and my AV layers. I have very strict rules in place for incoming external email that would not be acceptable for internal to internal mail. Doug Traylor It sounds like you have a very similar setup to what we had prior to implementing ASSP - I changed the routing of our local mail to go via ASSP - A/V spam - mail server because the way I understand it is that auto-whitelisting won't work unless you route local mail this way. And I just want to add that this seems to work quite well - it's just a bummer that it leaves whatever you do after ASSP and before your mail server with no way to discern between external and internal mail. What are your thoughts on running two instances of ASSP on the same box though? Francois. - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.phpp=sourceforgeCID=DEVDEV ___ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user