RE: [Declude.JunkMail] Hijack: Blocklist feature request
Mike, The operation of Hijack is under review, thank you for your suggestions. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mike N Sent: Thursday, July 20, 2006 12:46 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Hijack: Blocklist feature request Product: Declude Security Suite 4.x Function: Hijack Hijack is critical to ISPs today because viruses can show up at any time and get your server on a blacklist before you can detect and react. Problem #1 - After a customer has cleaned out their PC and removed the virus, there must be a method to allow them to send mail again but keep watching for a new virus infection. Currently the only solution is A to restart the Declude service or B put them in an allow section of the HIJACK.CFG file. Neither method is acceptable because A clears out other Hijack'd customers who you haven't yet been able to contact but are still spewing spam. B Allows them to resume sending real mail, but disables monitoring for future infections. Problem #2 - If the DecludeProc service crashes, or it is necessary to reboot, all Hijack entries are cleared. This is not acceptable because it clears out Hijack'd customer(s) still spewing spam. Some spams can get out before they reblacklist themselves. Suggestions- The Hijack function should periodically save out the blacklist state to a file - on IP address addition / change? Add a method of informing DecludeProc to remove an IP address from the blacklist entry. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Hijack: Blocklist feature request
Mike, on problem 2, have you verified this? Decludeproc does indeed create a file in the Imail\Declude directory for use with Hijack. As for clearing an IP, I wonder if editing that file by removing the IP would clear it. Declude? John T eServices For You Seek, and ye shall find! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mike N Sent: Thursday, July 20, 2006 9:46 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Hijack: Blocklist feature request Product: Declude Security Suite 4.x Function: Hijack Hijack is critical to ISPs today because viruses can show up at any time and get your server on a blacklist before you can detect and react. Problem #1 - After a customer has cleaned out their PC and removed the virus, there must be a method to allow them to send mail again but keep watching for a new virus infection. Currently the only solution is A to restart the Declude service or B put them in an allow section of the HIJACK.CFG file. Neither method is acceptable because A clears out other Hijack'd customers who you haven't yet been able to contact but are still spewing spam. B Allows them to resume sending real mail, but disables monitoring for future infections. Problem #2 - If the DecludeProc service crashes, or it is necessary to reboot, all Hijack entries are cleared. This is not acceptable because it clears out Hijack'd customer(s) still spewing spam. Some spams can get out before they reblacklist themselves. Suggestions- The Hijack function should periodically save out the blacklist state to a file - on IP address addition / change? Add a method of informing DecludeProc to remove an IP address from the blacklist entry. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Hijack: Blocklist feature request
When Decludeproc is restart the list of IP's maintained my hijack are reset. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Thursday, July 20, 2006 1:00 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Hijack: Blocklist feature request Mike, on problem 2, have you verified this? Decludeproc does indeed create a file in the Imail\Declude directory for use with Hijack. As for clearing an IP, I wonder if editing that file by removing the IP would clear it. Declude? John T eServices For You Seek, and ye shall find! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mike N Sent: Thursday, July 20, 2006 9:46 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Hijack: Blocklist feature request Product: Declude Security Suite 4.x Function: Hijack Hijack is critical to ISPs today because viruses can show up at any time and get your server on a blacklist before you can detect and react. Problem #1 - After a customer has cleaned out their PC and removed the virus, there must be a method to allow them to send mail again but keep watching for a new virus infection. Currently the only solution is A to restart the Declude service or B put them in an allow section of the HIJACK.CFG file. Neither method is acceptable because A clears out other Hijack'd customers who you haven't yet been able to contact but are still spewing spam. B Allows them to resume sending real mail, but disables monitoring for future infections. Problem #2 - If the DecludeProc service crashes, or it is necessary to reboot, all Hijack entries are cleared. This is not acceptable because it clears out Hijack'd customer(s) still spewing spam. Some spams can get out before they reblacklist themselves. Suggestions- The Hijack function should periodically save out the blacklist state to a file - on IP address addition / change? Add a method of informing DecludeProc to remove an IP address from the blacklist entry. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Hijack: Blocklist feature request
Also it would be nice for it to optionally send an email to the postmaster (or whoever) when hold1 level reached and especially when hold2 level reached. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Thursday, July 20, 2006 12:49 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Hijack: Blocklist feature request Mike, The operation of Hijack is under review, thank you for your suggestions. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mike N Sent: Thursday, July 20, 2006 12:46 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Hijack: Blocklist feature request Product: Declude Security Suite 4.x Function: Hijack Hijack is critical to ISPs today because viruses can show up at any time and get your server on a blacklist before you can detect and react. Problem #1 - After a customer has cleaned out their PC and removed the virus, there must be a method to allow them to send mail again but keep watching for a new virus infection. Currently the only solution is A to restart the Declude service or B put them in an allow section of the HIJACK.CFG file. Neither method is acceptable because A clears out other Hijack'd customers who you haven't yet been able to contact but are still spewing spam. B Allows them to resume sending real mail, but disables monitoring for future infections. Problem #2 - If the DecludeProc service crashes, or it is necessary to reboot, all Hijack entries are cleared. This is not acceptable because it clears out Hijack'd customer(s) still spewing spam. Some spams can get out before they reblacklist themselves. Suggestions- The Hijack function should periodically save out the blacklist state to a file - on IP address addition / change? Add a method of informing DecludeProc to remove an IP address from the blacklist entry. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Hijack: Blocklist feature request
The file Console.txt seems to be write-only; it is useful for finding out what's going on, but I don't think it's possible to edit and have DecludeProc reread it unless it is just not documented some how. [Console.txt is displayed by the WebConfiguration GUI] - Original Message - From: John T (Lists) [EMAIL PROTECTED] Mike, on problem 2, have you verified this? Decludeproc does indeed create a file in the Imail\Declude directory for use with Hijack. As for clearing an IP, I wonder if editing that file by removing the IP would clear it. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Hijack: Blocklist feature request
Check the archives for an old solution for hold notification. There is a vbs script that will do what your looking for. I have scheduled every 15 min. If there are any files in hold2, it emails me. I use something similar for the outgoing queue in case of a backup. The issue of outgoing mail has gotten much more serious over the years. It's getting to the point that it almost rates as much scrutiny and incoming mail. I've gotten burned from lists, bulk mailings and hijacked machinges. It takes days to get unlisted. John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of [EMAIL PROTECTED] Sent: Thursday, July 20, 2006 10:19 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Hijack: Blocklist feature request Also it would be nice for it to optionally send an email to the postmaster (or whoever) when hold1 level reached and especially when hold2 level reached. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Thursday, July 20, 2006 12:49 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Hijack: Blocklist feature request Mike, The operation of Hijack is under review, thank you for your suggestions. David B www.declude.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mike N Sent: Thursday, July 20, 2006 12:46 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Hijack: Blocklist feature request Product: Declude Security Suite 4.x Function: Hijack Hijack is critical to ISPs today because viruses can show up at any time and get your server on a blacklist before you can detect and react. Problem #1 - After a customer has cleaned out their PC and removed the virus, there must be a method to allow them to send mail again but keep watching for a new virus infection. Currently the only solution is A to restart the Declude service or B put them in an allow section of the HIJACK.CFG file. Neither method is acceptable because A clears out other Hijack'd customers who you haven't yet been able to contact but are still spewing spam. B Allows them to resume sending real mail, but disables monitoring for future infections. Problem #2 - If the DecludeProc service crashes, or it is necessary to reboot, all Hijack entries are cleared. This is not acceptable because it clears out Hijack'd customer(s) still spewing spam. Some spams can get out before they reblacklist themselves. Suggestions- The Hijack function should periodically save out the blacklist state to a file - on IP address addition / change? Add a method of informing DecludeProc to remove an IP address from the blacklist entry. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Hijack: Blocklist feature request
Responding to 2 posts. When Decludeproc is restart the list of IP's maintained my hijack are reset. I thought the purpose of the file was to retain IPs even when Decludeproc was restarted or stopped and then started. If not, I would like to suggest this. The file Console.txt seems to be write-only; it is useful for finding out what's going on, but I don't think it's possible to edit and have DecludeProc reread it unless it is just not documented some how. Feature request, a way to remove an IP without having to cycle Decludeproc. [Console.txt is displayed by the WebConfiguration GUI] So far, the hour I spent on my new server to get the Declude Web GUI working was unsuccessful. It also appears to be a bit cumbersome to use. John T eServices For You Seek, and ye shall find! --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
