Re: [Assp-user] Authenticated???

2009-02-02 Thread Dave Emory
Phil Cook wrote: I hope someone can help me out here and point me in the right direction to fix this problem. I had a spammer that authenticated against my mail server. How did this happen? I'm running version 1.2.4(2). They probably got your email account password by hacking your server, or

Re: [Assp-user] ASSP 1.4.3.1 released on SF

2008-12-01 Thread Dave Emory
Matti Haack wrote: Alex, - try uninstalling perl completely, - delete the perl folder - Install latest activestate perl - run the script If there are any failures (maybe there are 4 or 5) install them with ppm This worked for me Matti Repositories must be added (edit, preferences,

Re: [Assp-user] Blocking sender completely

2008-01-25 Thread Dave Emory
Original Message From: Daniel K. Du Vall To: assp-user@lists.sourceforge.net Sent: Friday, January 25, 2008 11:38 AM Subject: [Assp-user] Blocking sender completely Is there a way to block a sender completely Like [EMAIL PROTECTED] ? I don’t want to even see this marked as SAPM

Re: [Assp-user] Blocking sender completely

2008-01-25 Thread Dave Emory
Original Message From: Daniel K. Du Vall To: assp-user@lists.sourceforge.net Sent: Friday, January 25, 2008 11:38 AM Subject: [Assp-user] Blocking sender completely Is there a way to block a sender completely Like [EMAIL PROTECTED] ? I don’t want to even see this marked as SAPM and

Re: [Assp-user] Assp Problem with ClamAV

2007-10-14 Thread Dave Emory
Dickie Bradford wrote: I have clamav installed as instructed with clavav.msi (running as a service) runclamd (also running as a service) both are started and running and I have all the modules installed as required, but i am getting this error: Oct-13-07 16:11:34 File::Scan::ClamAV

Re: [Assp-user] Refused Connections

2007-10-06 Thread Dave Emory
Norbert Doeberlein wrote: - Original Message - From: Charles Marcus [EMAIL PROTECTED] To: Questions and Answers for users of ASSP Anti-Spam SMTP Proxy assp-user@lists.sourceforge.net Sent: Saturday, October 06, 2007 15:50 Subject: Re: [Assp-user] Refused Connections I was under

Re: [Assp-user] Disallow several users to contribute to spamcorpus

2007-09-11 Thread Dave Emory
Josef Schmitz wrote: I have some VIP users that want spam proctection via assp but does not want to contribute to bayes spam corpus for privacy reasons. Is it possible to omit saving to spam and notspam for several users. These local users on the other side wants to use automatic

Re: [Assp-user] how u handle these things?

2007-09-10 Thread Dave Emory
Christian Rehkopf wrote: A custumor of mine cries around because one of his customers cant mail him from an AOL address - and a quick view in the logs shows 205.188.144.208 as sending server http://moensted.dk/spam/?addr=205.188.144.208Submit=Submit shows that this server is on 4 of my

Re: [Assp-user] how u handle these things?

2007-09-10 Thread Dave Emory
Dave Emory wrote: Christian Rehkopf wrote: A custumor of mine cries around because one of his customers cant mail him from an AOL address - and a quick view in the logs shows 205.188.144.208 as sending server http://moensted.dk/spam/?addr=205.188.144.208Submit=Submit shows

Re: [Assp-user] logging question 1.3.3.3(9)

2007-08-27 Thread Dave Emory
1) wrong list. use the 'test' list for beta versions, OK. Everything newer than 1.3.1 is beta, correct? 2) update your beta, thats an old one. Just got (10). Thanks. 3) is Bayesian in scoring mode? No, it's activated (mode 1).

Re: [Assp-user] logging question 1.3.3.3(9)

2007-08-27 Thread Dave Emory
Dave Emory wrote: 1) wrong list. use the 'test' list for beta versions, OK. Everything newer than 1.3.1 is beta, correct? 2) update your beta, thats an old one. Just got (10). Thanks. 3) is Bayesian in scoring mode? No, it's activated (mode 1). version (10) fixed it. Dave

[Assp-user] logging question 1.3.3.2(9)

2007-08-27 Thread Dave Emory
My log shows lines like these: Aug-27-07 10:01:35 66.35.250.225 [EMAIL PROTECTED] to: [EMAIL PROTECTED] recipient accepted: [EMAIL PROTECTED] Aug-27-07 10:01:35 66.35.250.225 [EMAIL PROTECTED] to: [EMAIL PROTECTED] Regex:Redlist

[Assp-user] 1.3.3.3() noPB allowable values

2007-08-22 Thread Dave Emory
Can the noPB contain values such as 66..35.250. so any blacklisted IP addresses (including 66.35.250.0) will be removed from the blacklist? Dave - This SF.net email is sponsored by: Splunk Inc. Still grepping through

Re: [Assp-user] 1.3.3.3() noPB allowable values

2007-08-22 Thread Dave Emory
Fritz Borgstedt wrote: Can the noPB contain values such as 66..35.250. so any blacklisted IP addresses (including 66.35.250.0) will be removed from the blacklist? did you try it? Yes, but I couldn't tell which address actually worked to remove both lines because of the delay before the file

Re: [Assp-user] archiving mail with ASSP

2007-08-15 Thread Dave Emory
: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Emory Sent: Tuesday, August 14, 2007 9:16 PM To: assp-user@lists.sourceforge.net Subject: [Assp-user] archiving mail with ASSP Has anyone devised an elegant way to use ASSP on a Windows server to meet the U.S. records retention

Re: [Assp-user] Spam Trap Addreses.txt and the pipe

2007-08-15 Thread Dave Emory
Fritz Borgstedt wrote: Questions and Answers for users of ASSP Anti-Spam SMTP Proxy assp-user@lists.sourceforge.net schreibt: Nearly 17% of the spam I see is to addresses that have never or will never be valid on my system. As a result of this I have a relatively large SpamTrapAdddresses.txt

[Assp-user] archiving mail with ASSP

2007-08-14 Thread Dave Emory
Has anyone devised an elegant way to use ASSP on a Windows server to meet the U.S. records retention requirements? I need to archive the not-spam mail for at least one domain name for legal purposes. I'm wondering if hMailServer can facilitate this? If we weren't trying to stabilize the

Re: [Assp-user] 1.3.3.2(15) pbextreme.txt question

2007-08-12 Thread Dave Emory
Fritz Borgstedt wrote: The answer is in test-user maillist )). All I see are some subscribe and test messages. Dave - This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems?

[Assp-user] 1.3.3.2(15) pbextreme.txt question

2007-08-11 Thread Dave Emory
I have exportExtremeFileDeny checked, but nothing is getting denied because the exported file has only 1 line in it right now. It should have over 7000 addresses in it. The log has lines like this: Aug-11-07 16:49:36 [PBextreme][monitoring] 66.97.166.187 [EMAIL PROTECTED]

[Assp-user] IP address blocking question in 1.3.4(28)

2007-08-05 Thread Dave Emory
I just saw these in the log: Aug-5-07 10:52:48 64.209.223.35 [EMAIL PROTECTED] to: [EMAIL PROTECTED] recipient accepted: [EMAIL PROTECTED] Aug-5-07 10:52:54 64.209.223.35 [EMAIL PROTECTED] to: [EMAIL PROTECTED] ClamAV: scanning 3495 bytes done OK Aug-5-07

Re: [Assp-user] Spam server won't be denied!!!

2007-07-30 Thread Dave Emory
Daniel L. Miller wrote: I may have perhaps found the answer. My exportExtremeFileAppend was checked, and the exportextreme file was ... a trifle large. A sort -u shrunk it to a manageable size, and ASSP is blocking connections again. Hi, perl people. I'm a bit concerned that the large

[Assp-user] More log oddities, 1.3.4(12)

2007-07-24 Thread Dave Emory
BlackHelo scoring tags on a message from this forum: Jul-24-07 15:30:19 66.35.250.225 [EMAIL PROTECTED] to: [EMAIL PROTECTED] recipient accepted: [EMAIL PROTECTED] Jul-24-07 15:30:20 66.35.250.225 [EMAIL PROTECTED] to: [EMAIL PROTECTED] Regex:Redlist

[Assp-user] 1.3.3 whitelist issue?

2007-07-23 Thread Dave Emory
From the 1.3.3 () maillog: Jul-23-07 08:34:07 Email whitelist addition: [EMAIL PROTECTED] A while later: Jul-23-07 08:52:30 207.243.180.183 [EMAIL PROTECTED] Regex:WildCardDomain '1076' Jul-23-07 08:52:30 207.243.180.183 [EMAIL PROTECTED] adding new triplet: (207.243.180.0,

Re: [Assp-user] 1.3.3 whitelist issue?

2007-07-23 Thread Dave Emory
Fritz Borgstedt wrote: Did I do something wrong, or is this a bug? what is the setting for delaying whitelisted? Delay Whitelisted is not checked. assp.cfg has this: DelayWL:= Dave - This SF.net email is

Re: [Assp-user] BombHeaderRe:''

2007-07-22 Thread Dave Emory
Set DoBombHeaderRe = 0. - Original Message - From: James Brown To: Questions and Answers for users of ASSP Anti-Spam SMTP Proxy Sent: Sunday, July 22, 2007 6:07 PM Subject: [Assp-user] BombHeaderRe:'' I am getting lots of emails blocked by BombHearderRe: Jul-23-07 09:47:49

[Assp-user] Two denysmtpconnections settings?

2007-07-16 Thread Dave Emory
What's the difference between these two options? Deny SMTP Connections from these IP's* Manually maintained list of IP's which should be denied. For example: file:files/denysmtp.txt Internal Name: denySMTPConnectionsFrom Always Deny SMTP Connections from these IP's* Manually maintained list of

Re: [Assp-user] Two denysmtpconnections settings?

2007-07-16 Thread Dave Emory
Excellent! Thanks for th explanation. Dave Fritz Borgstedt wrote: What's the difference between these two options? Deny SMTP Connections from these IP's* Manually maintained list of IP's which should be denied. For example: file:files/denysmtp.txt Internal Name:

Re: [Assp-user] Spam pattern - can it be detected?

2007-07-14 Thread Dave Emory
Marrco wrote: Thanks! I'll be working on some scripting to maintain a good spamtrap list using yours as a starting point. The list I use now was tediously created Don't hesitate to ask, should any need arise. But don't forget to share you findings and you improved scripts with the list.

Re: [Assp-user] Spam pattern - can it be detected?

2007-07-14 Thread Dave Emory
Hmmmit looks like I'm not finding all of the invalid addresses. I'll keep working on it. Dave Dave Emory wrote: Marrco wrote: Thanks! I'll be working on some scripting to maintain a good spamtrap list using yours as a starting point. The list I use now was tediously created

Re: [Assp-user] Spam pattern - can it be detected?

2007-07-14 Thread Dave Emory
Dave Emory wrote: Hmmmit looks like I'm not finding all of the invalid addresses. I'll keep working on it. Dave Messy, but it all seems to work now. If I were a perl programmer, it would be a lot better (hint hint). There must be a way to do the windows findstr function in perl

Re: [Assp-user] Spam pattern - can it be detected?

2007-07-14 Thread Dave Emory
Dave Emory wrote: In de-dupe.pl, put this: X--- #!/usr/bin/perl -w use strict; sub ltrim($); # Set to filename of text file my $infile = 'invalid.txt'; # Set $finalfile to filename of de-duped file my $newfile = 'recipients.txt'; my $tempfile = 'temp.txt

Re: [Assp-user] Spam pattern - can it be detected?

2007-07-13 Thread Dave Emory
Thanks! I'll be working on some scripting to maintain a good spamtrap list using yours as a starting point. The list I use now was tediously created using Excel some time ago. I just caught a batch of them using that old list: Jul-13-07 08:47:03 193.69.160.86 [EMAIL PROTECTED] PB:

Re: [Assp-user] Spam pattern - can it be detected?

2007-07-13 Thread Dave Emory
Fritz Borgstedt wrote: Thanks! I'll be working on some scripting to maintain a good spamtrap list using yours as a starting point. The list I use now was tediously created using Excel some time ago. I just caught a batch of them using that old list: What is here the difference from

[Assp-user] Spam pattern - can it be detected?

2007-07-12 Thread Dave Emory
Hi, all. I sometimes see a flurry of attempted connections such as these from the mail log: Jul-11-07 06:38:54 Connected: 58.224.155.140:1176 - 192.168.0.5:25 - 192.168.0.1:25 Jul-11-07 06:38:55 c1775 58.224.155.140 [EMAIL PROTECTED] invalid address rejected: [EMAIL PROTECTED] Jul-11-07

Re: [Assp-user] ClamAV install problem

2007-07-12 Thread Dave Emory
8-) me, too! Dickson, Paul wrote: I hate it when PEBKAC rears its' ugly head:-P -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Emory Sent: Thursday, July 12, 2007 2:50 PM To: Matti Haack; Questions and Answers for users of ASSP Anti-Spam

Re: [Assp-user] Spam pattern - can it be detected?

2007-07-12 Thread Dave Emory
Kevin wrote: Dave Emory wrote: Hi, all. I sometimes see a flurry of attempted connections such as these from the mail log: --snip-- The messages come from different IP addresses and different senders, but are the invalid addresses are repeated. Does anyone know of a way to detect

[Assp-user] Spam pattern

2007-07-11 Thread Dave Emory
Hi, all. I often see a flurry of attempted connections such as these from the mail log: Jul-11-07 06:38:54 Connected: 58.224.155.140:1176 - 192.168.0.5:25 - 192.168.0.1:25 Jul-11-07 06:38:55 c1775 58.224.155.140 [EMAIL PROTECTED] invalid address rejected: [EMAIL PROTECTED] Jul-11-07 06:38:55

Re: [Assp-user] Bug: redRe/scriptRe cross-over issue

2007-07-11 Thread Dave Emory
Micheal Espinola Jr wrote: ASSP v1.3.2(33) I've seen this a few times now, so it appears to be reproducible (a real issue). Each time I have seen it, it has happened with a redRe match: What I am seeing are emails that have matched the redRe, and then being handled and post-processed by

[Assp-user] ClamAV install problem

2007-07-11 Thread Dave Emory
I switched my ASSP installation from an XP box to a Win2K server box. All is working except ClamAv (worked great under XP). I get this in the log: File::Scan::ClamAV module version 1.8 installed but not available, error: Cannot connect to 'localhost:3310': IO::Socket::INET: connect: Unknown

Re: [Assp-user] ClamAV install problem

2007-07-11 Thread Dave Emory
Kevin wrote: Dave Emory wrote: I switched my ASSP installation from an XP box to a Win2K server box. All is working except ClamAv (worked great under XP). I get this in the log: File::Scan::ClamAV module version 1.8 installed but not available, error: Cannot connect to 'localhost:3310': IO

Re: [Assp-user] Where are the whitelist addresses stored?

2007-07-05 Thread Dave Emory
PROTECTED] email whitelist addition Jul-5-07 13:34:39 87.194.120.42 is disconnected Here's an old thread about this issue; maybe you have the same problem that I did: Kevin wrote: Dave Emory wrote: Dave Emory wrote: Version 1.3.0 has these lines in the log when it receives a whitelist addition

Re: [Assp-user] Invalid address rejected - But only when relayingthrough authenticated SMTP

2007-07-03 Thread Dave Emory
Tony Freeman @ TnTFam wrote: Version 1.3.1 All features are in test mode. Using only Bayesian scoring with my server processing from there. Every option in Validate Sender and Validate Local Addresses Mail to same user from inside network (192.168.1.*) passes to server and is handled.

Re: [Assp-user] Server Breach?

2007-07-02 Thread Dave Emory
Micheal Espinola Jr wrote: Dave Emory wrote: A bit broader question is why any of these lines are in the /files/redre.txt (dated 5/11/2007 here)? I got the file from the 1.3.2 directory on Fritz's site. It's not there now. Amy apparently has the same redre.txt as me. BIG5 CHINESEBIG

Re: [Assp-user] Server Breach?

2007-07-02 Thread Dave Emory
Micheal Espinola Jr wrote: Fritz Borgstedt wrote: It was not a mistake, I run exactly that. In addition to the bombRe it makes perfect sense. Thanks again for turning me on to that. It still doesn't make sense to me. If the regex is for catching spam, why do you want the spammer to be

Re: [Assp-user] Server Breach?

2007-07-02 Thread Dave Emory
Fritz Borgstedt wrote: If the regex is for catching spam, why do you want the spammer to be treated as redlisted? Because of COLLECTION. For me, it does not make sense to have a lot of Japanese Spam Mail in my collection. OK, let's see if I understand now; BombRe failures would be scored

Re: [Assp-user] Server Breach?

2007-07-01 Thread Dave Emory
Micheal Espinola Jr wrote: Are you sure you want to redlist Windows-1251? Thats Cryllic/Russian: A bit broader question is why any of these lines are in the /files/redre.txt (dated 5/11/2007 here)? I got the file from the 1.3.2 directory on Fritz's site. It's not there now. Amy apparently

Re: [Assp-user] virus detected: 'HTML.Phishing.Pay-180'

2007-06-29 Thread Dave Emory
What does this mean? ASSP wrote: Message ID: Remote IP: 66.35.250.225 Subject: Re_Assp_user_Server_Breach_ Sender: [EMAIL PROTECTED] Recipient(s): [EMAIL PROTECTED] Virus Detected: 'HTML.Phishing.Pay-180'. - This

Re: [Assp-user] virus detected: 'HTML.Phishing.Pay-180'

2007-06-29 Thread Dave Emory
Kevin wrote: Dave Emory wrote: What does this mean? ASSP wrote: Message ID: Remote IP: 66.35.250.225 Subject: Re_Assp_user_Server_Breach_ Sender: [EMAIL PROTECTED] Recipient(s): [EMAIL PROTECTED] Virus Detected: 'HTML.Phishing.Pay-180'. I'll bet it was because Amy posted a copy

Re: [Assp-user] virus detected: 'HTML.Phishing.Pay-180'

2007-06-29 Thread Dave Emory
Kevin wrote: Dave Emory wrote: Kevin wrote: Dave Emory wrote: What does this mean? ASSP wrote: Message ID: Remote IP: 66.35.250.225 Subject: Re_Assp_user_Server_Breach_ Sender: [EMAIL PROTECTED] Recipient(s): [EMAIL PROTECTED] Virus Detected: 'HTML.Phishing.Pay-180'. I'll bet

[Assp-user] Request for expanded SPF result handling

2007-06-07 Thread Dave Emory
These are examples of SPF query responses that are not comprehended by ASSP: Received-SPF: permerror -extension:foo (mybox.example.org: domain of [EMAIL PROTECTED] uses mechanism not recognized by this client) Received-SPF: temperror (mybox.example.org: error in processing during lookup

Re: [Assp-user] Whitelist entries being removed???

2007-06-07 Thread Dave Emory
Dickson, Paul wrote: In reverse order, you can see by this log that [EMAIL PROTECTED] was whitelisted back in apr. A message from her was tagged as spam and when re-submitted to whitelist, was whitelisted again, thus it was some how removed from whitelist. Usually, when I see a whitelist

Re: [Assp-user] Request for expanded SPF result handling

2007-06-07 Thread Dave Emory
Options for temperror and permerror like the ones ASSP has for softfail and neutral would be good to have. Every instance of a permerror I've seen has been spam here, so I would use Fail SPF PermError Validations if we had that option. Fritz Borgstedt wrote: These are examples of SPF query

Re: [Assp-user] Request for expanded SPF result handling

2007-06-07 Thread Dave Emory
Fritz Borgstedt wrote: May be, I do it. But first things first. I replaced with the help of Nate the older SPF module by the newest one. Please test this. You have to install Mail::SPF and see then: Mail::SPF module version v2.005 installed and available Will version 2.00 work? That's

Re: [Assp-user] Request for expanded SPF result handling

2007-06-07 Thread Dave Emory
Morris, Nate wrote: ActiveState's v2.00 does NOT work. The interfaces are totally different. I'm working on instructions for installing it from CPAN because in my experience, it didn't go so smooth. Nate Yes, I found out quickly that 2.00 does not work -- ASSP crash after a few messages.

Re: [Assp-user] Request for expanded SPF result handling

2007-06-07 Thread Dave Emory
Fritz Borgstedt wrote: Will version 2.00 work? That's the newest Activestate version. I am really tired of this. Is it not possible to test this without asking? Should I know, if Activestate 2.00 work? No, I don't expect you to know everything about CPAN versus Activestate modules. I won't

Re: [Assp-user] ASSP crashes, resolved. FYI

2007-06-05 Thread Dave Emory
Kevin wrote: Dickson, Paul wrote: We had a problem with assp crashing every few hours. I noticed after a couple days of trying to figure it out that the server time had walked off by 2~3 min. It has been rock solid for a week since syncing w/ an NTP server. Intresting. I'll have to make

Re: [Assp-user] ASSP crashes, resolved. FYI

2007-06-05 Thread Dave Emory
Fritz Borgstedt wrote: What in perl or the ASSP code itself would have caused the crash? I think this failure mode still needs some investigation/verification. Dave I doubt, that a clock out of sync for some seconds would cause a crash in assp. May be, there is a reason why the

[Assp-user] wild idea - feature request

2007-05-29 Thread Dave Emory
Is it possible to put a debug option in ASSP that logs debug details to a *.dbg file for a specific IP address, domain, etc.? I think most problems that need to be debugged are address or domain specific, so the data would be most helpful if it only contained the interesting stuff. Dave

Re: [Assp-user] Response Delay After Greeting

2007-05-22 Thread Dave Emory
Does ASSP check for packets received during the delay period (before the 220 command is sent)? If so, does it do anything to block the offender when it tries again? Marrco wrote: I'm anxious to try this in ASSP. I've used Response Delays with other software and found it very effective. But

Re: [Assp-user] Response Delay After Greeting

2007-05-22 Thread Dave Emory
Fritz Borgstedt wrote: Does ASSP check for packets received during the delay period (before the 220 command is sent)? If so, does it do anything to block the offender when it tries again? I answered that already twice. I saw this response from you in an earlier message:

Re: [Assp-user] Response Delay After Greeting

2007-05-22 Thread Dave Emory
Fritz Borgstedt wrote: That's not what I was asking. I was asking if the offending address went into the blacklist, graylist, or other blocking mechanism. No. fritz Would it not be better if addresses that disregard the greeting delay time could add to the PB score, be blacklisted for

Re: [Assp-user] email whitelist addition is not working in 1.3.2(52)

2007-05-21 Thread Dave Emory
Dave Emory wrote: Version 1.3.0 has these lines in the log when it receives a whitelist addition message: May-20-07 12:30:58 Connected: 192.168.0.6:2210 - 192.168.0.5:25 - 192.168.0.1:25 May-20-07 12:30:59 192.168.0.6 [EMAIL PROTECTED] email whitelist addition May-20-07 12:30:59 Email

Re: [Assp-user] email whitelist addition is not working in 1.3.2(52)

2007-05-21 Thread Dave Emory
Kevin wrote: Dave Emory wrote: Dave Emory wrote: Version 1.3.0 has these lines in the log when it receives a whitelist addition message: May-20-07 12:30:58 Connected: 192.168.0.6:2210 - 192.168.0.5:25 - 192.168.0.1:25 May-20-07 12:30:59 192.168.0.6 [EMAIL PROTECTED] email whitelist

[Assp-user] email whitelist addition is not working in 1.3.2(51)

2007-05-20 Thread Dave Emory
Version 1.3.0 has these lines in the log when it receives a whitelist addition message: May-20-07 12:30:58 Connected: 192.168.0.6:2210 - 192.168.0.5:25 - 192.168.0.1:25 May-20-07 12:30:59 192.168.0.6 [EMAIL PROTECTED] email whitelist addition May-20-07 12:30:59 Email whitelist addition: [EMAIL

Re: [Assp-user] SPF

2007-05-01 Thread Dave Emory
Fritz Borgstedt wrote: Is there anybody, who is willing to replace Mail::SPF::Query with Mail::SPF ? I'll try it, but I'm not sure if the Activestate Perl is good or not. It installed with no errors using ppm. dave -

Re: [Assp-user] SPF

2007-05-01 Thread Dave Emory
Fritz Borgstedt wrote: Questions and Answers for users of ASSP Anti-Spam SMTP Proxy assp-user@lists.sourceforge.net schreibt: I'll try it, but I'm not sure if the Activestate Perl is good or not. It installed with no errors using ppm. I am talking of replacing the code inside ASSP. fritz

Re: [Assp-user] SPF

2007-05-01 Thread Dave Emory
Fritz Borgstedt wrote: I knew what you meant. I assumed I would have to install the Mail::SPF module to test your code. Is that correct? The Activestate Mail::SPF module may be buggy, but I'll be glad to test your new ASSP version to find out. No. I wanted somebody to change the code

Re: [Assp-user] Limiting IP connection function

2007-04-30 Thread Dave Emory
Fritz Borgstedt wrote: I reduced the frequency test duration due to this issue so the function still helps prevent denial-of-service, but mail isn't blocked for the default 3600 seconds. Is does not help to reduce expiration by reducing duration. I see what you mean. Thanks.

Re: [Assp-user] PB Single message mode with upper and lowerthreshold?

2007-04-27 Thread Dave Emory
Fritz Borgstedt wrote: Questions and Answers for users of ASSP Anti-Spam SMTP Proxy assp-user@lists.sourceforge.net schreibt: Tell me if this is a dumb idea: Would it be possible to have an upper and lower threshold on PB scoring to filter the terribly obvious spam from the not so obvious

Re: [Assp-user] Possible future feature?

2007-04-27 Thread Dave Emory
Elvar wrote: Hello, The majority of my clients prefer to have their spam discarded rather than tagged and passed through, but the problem arises when something legit is blocked. The users can easily store their own spam mail. The {SPAM} tag inserted in the subject and a simple rule in the

Re: [Assp-user] Unanswerd call for help leadstodissatisfiedcustomer.

2007-04-19 Thread Dave Emory
Mauro Lanci wrote: Thank you for the suggestion. How I can install Net::DNS 0.57? Mauro This link http://ppm.activestate.com/PPMPackages/ has the older package versions. Add a local directory to the repository list using the GUI PPM, unzip the old version there, uninstall the problem

Re: [Assp-user] wtf.

2007-04-18 Thread Dave Emory
Yes, the whitelist email function has always added every address in the email file as far as I know. Maybe that should be optional, with a default of adding only the valid sender address to the white list. Fritz, what do you think? Kevin wrote: Dickson, Paul wrote: Apr-18-07 15:41:08 Email

Re: [Assp-user] rebuildspamdb

2007-04-13 Thread Dave Emory
Rick Klinge wrote: Running ASSP v1.3.1(47) on Windows. Fri Apr 13 00:49:22 2007: Analyzing started Fri Apr 13 00:51:27 2007: Analyzing c:\assp/errors/spam 3621 Fri Apr 13 00:51:44 2007: Analyzing c:\assp/errors/notspam 3974 Fri Apr 13 01:00:55 2007: Analyzing c:\assp/spam 21605 Fri Apr 13

[Assp-user] Unprocessed addresses are being delayed in 1.3.1 v 42

2007-04-07 Thread Dave Emory
I think this just started with v 42. An address (just the user name, no domain) in the unprocessed section is being delayed now. Is a user name listed in unprocessed supposed to skip delaying? It's not a big problem, but it may be an unintended consequence of some other change to ASSP, so

Re: [Assp-user] very strange log

2007-04-04 Thread Dave Emory
Ethan Albone wrote: please look these lines from 1.3.1 (40) Apr-4-07 09:55:06 213.205.33.42 [EMAIL PROTECTED] to: [EMAIL PROTECTED] deleting spamming whitelisted tuplet: (213.205.33.0,linuxquestions.org) age: 2s Apr-4-07 11:22:45 213.205.33.42 [EMAIL PROTECTED] adding new triplet:

Re: [Assp-user] maximum URI counter problem

2007-04-03 Thread Dave Emory
Fritz Borgstedt wrote: I count only about 30 actual URIs. I count much more for : costco.com There are 48 occurences of .com. There are 40 occurences of costco.com. What does the script consider a URI? RFC 3986 section 1.1.2 examples all have a colon after the scheme parameter. The

Re: [Assp-user] maximum URI counter problem

2007-04-03 Thread Dave Emory
Fritz Borgstedt wrote: I count only about 30 actual URIs. I count much more for : costco.com I spent some time trying to understand why the URIs were overcounted. Although I don't know why it makes a difference, a single added space in one line seemed to greatly reduce the extra counts.

Re: [Assp-user] maximum URI counter problem

2007-04-02 Thread Dave Emory
I put a temporary mlog line in the script that wrote the $uri and $ucnt every time the maxuri routine looped. Here's the log for the last iteration: Apr-2-07 12:09:49 206.190.58.212 [EMAIL PROTECTED] to: [EMAIL PROTECTED] URI=yahoo, count is 231 Fritz Borgstedt wrote: ASSP thinks there are

[Assp-user] Caching SPF results

2007-03-29 Thread Dave Emory
We cache RBL and URIBL already, and this mechanism works great. Wouldn't there also be benefits to caching other look-ups such as SPF and PTR? Forgive me if ASSP already does this; I don't see options in the web interface to control caching of SPF if it's being done. Regards, Dave

Re: [Assp-user] Stats on delayed and never came back/tried again?

2007-03-20 Thread Dave Emory
Sure, there's a way. It's just not part of ASSP. I did a quick analysis using Excel of a chunk of the maillog after enabling unique id. Unique id provides a way to group the data lines: Total Count of Delayed 166 Total Count of Accepted 53 Total Count of Whitelisted 38 My

[Assp-user] ASSP configuration interface colors

2007-03-15 Thread Dave Emory
Some setting sections are rendered in blue text, others in green text. Do the different colors signify something? Dave - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and

Re: [Assp-user] Spam Delivery

2007-03-14 Thread Dave Emory
Upgrading should work just as well as a first-time installation. The failure of the ASSP script to properly initialize new variables and rewrite the config file after an upgrade/restart is a significant problem. At the very least, the web interface should have displayed the uriblTestMode

[Assp-user] maintenancelog function

2007-03-02 Thread Dave Emory
Hello, Fritz. I'm using the exportedextreme.txt file as my denysmtpfile (works great!). The only problem is that there's always a log entry when the file changes, which is frequent. I sent this message earlier: Please consider making this change to the code in sub checkOptionList: #

Re: [Assp-user] attachment blocking, default initialization

2007-03-02 Thread Dave Emory
Paul wrote: On 1 Mar 2007 at 11:46, Dave Emory wrote: Hello, all. I moved zip attachment handling from level 3 to level 4: Mar-1-07 11:37:54 Badattach Level 3 updated from 'zip' to '' Mar-1-07 11:37:54 Goodattach Level 4 updated from 'doc|xls|ppt|pdf|zip|rtf|txt|rar' to 'doc|xls|ppt|pdf

Re: [Assp-user] maintenancelog function

2007-03-02 Thread Dave Emory
Fritz Borgstedt wrote: Hello, Fritz. I'm using the exportedextreme.txt file as my denysmtpfile (works great!). This is not necessary if pb is active. All what is exported is already blocked by pb-extreme in a very early stage. If you want to use the exported file, then copy and *add* the

[Assp-user] Request for logging option change

2007-03-01 Thread Dave Emory
Hello, Fritz. Please consider making this change to the code in sub checkOptionList: # mlog(0,option list file '$fil' reloaded ($name)) unless $init; mlog(0,option list file '$fil' reloaded ($name)) unless (($init || !$MaintenanceLog)); That will disable repetitive log lines like this

[Assp-user] (no subject)

2007-03-01 Thread Dave Emory
- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT business topics through brief surveys-and earn cash

[Assp-user] attachment blocking, default initialization

2007-03-01 Thread Dave Emory
Hello, all. I moved zip attachment handling from level 3 to level 4: Mar-1-07 11:37:54 Badattach Level 3 updated from 'zip' to '' Mar-1-07 11:37:54 Goodattach Level 4 updated from 'doc|xls|ppt|pdf|zip|rtf|txt|rar' to 'doc|xls|ppt|pdf|zip|rtf|txt|rar|zip|dat' The dat extension wasn't in level

Re: [Assp-user] attachment blocking, default initialization

2007-03-01 Thread Dave Emory
Fritz Borgstedt wrote: The dat extension wasn't in level 4 until I added and saved the zip extension. Was the dat extension intended to be added when I upgraded to 1.3.0 and restarted? yes, I added dat because of winmail.dat My point is that dat wasn't added until I manually changed that

Re: [Assp-user] new rebuildspamdb.pl

2007-02-26 Thread Dave Emory
Micheal Espinola Jr wrote: Greg Wright wrote: Spam Log Frequency: Store every n'th spam message. The same as for non spam but helps prevent spam corpuses being skewed by flooding. It is recommended that this be set depending on spam volume. Default value = 1, log every message. An excellent

[Assp-user] DNS Blacklist database

2007-02-26 Thread Dave Emory
Hi, all. Yesterday, I created the file dnsbldb in the ASSP directory and added the file name to the dnsbl section of the config. The description of the file in the interface is The file with the current DNSBL -- make this blank if you don't use it. My log says this today when I restart:

Re: [Assp-user] Frustrated - Forged Helo

2007-02-25 Thread Dave Emory
Patrick Butts wrote: BTW, Fritz.. meant to point this out earlier... small cosmetic thing.. Lookup valid Local Addresses from here* The first addresses is missing a d. There are about six more places in the code with address spelled wrong. There are probably other spelling errors. It would

[Assp-user] new rebuildspamdb.pl

2007-02-23 Thread Dave Emory
Hi, all. I piped the output if the new db rebuild script to a file (using the -notick option). Here's what the file contains: --snip--- mt=288078 [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]

[Assp-user] SPF failure problem

2007-02-23 Thread Dave Emory
Today, this happened: Feb-23-07 16:51:56 202.211.85.21 [EMAIL PROTECTED] to: [EMAIL PROTECTED] Received-SPF: unknown (ASSP: error in processing during lookup of [EMAIL PROTECTED]) client-ip=202.211.85.21; [EMAIL PROTECTED]; helo=C085H021. home05.cable.mecha.ne.jp; I've seen the SPF: unknown

Re: [Assp-user] Invalid HELO format

2007-01-10 Thread Dave Emory
The syntax of a legal Internet host name was specified in RFC-952 [DNS:4]. One aspect of host name syntax is hereby changed: the restriction on the first character is relaxed to allow either a letter or a digit. Host software MUST support this more liberal syntax. Is

Re: [Assp-user] Invalid HELO format

2007-01-10 Thread Dave Emory
Kevin wrote: Dave Emory wrote: The syntax of a legal Internet host name was specified in RFC-952 [DNS:4]. One aspect of host name syntax is hereby changed: the restriction on the first character is relaxed to allow either a letter or a digit. Host software MUST support

Re: [Assp-user] Crashes - question and workaround

2007-01-06 Thread Dave Emory
Eric Carr wrote: WORKAROUND: I whipped up a small windows app - ASSPacemaker - for checking ASSP, then killing and restarting it if it hangs. It's simple and intended for my own use, but if anyone else needs it, feel free to grab it from here: http://carr.no/asspacemaker.zip Screenshot:

Re: [Assp-user] Crashes - question and workaround

2007-01-06 Thread Dave Emory
Fritz Borgstedt wrote: This made me wonder if there's a way to remotely signal ASSP to restart. If there there were, a program like Erics might work across a LAN or the internet. Does anyone know if that capability exists? This made me wonder. fritz Never mind the question, then. I

Re: [Assp-user] bug: CC issue with level 4 attachment allowing

2006-12-23 Thread Dave Emory
Fritz Borgstedt wrote: Does the recipient address match any re or list in the config? I think we found the problem. ASSP did the right thing to see an attachment, which was not allowed. Winmail.dat is generated by MS Exchange if the recipient can not understand RTF.

[Assp-user] Embargo time

2006-11-27 Thread Dave Emory
What's the effect of using various embargo time durations, say, 1 minute, 5 minutes, 60 minutes? Are there any servers known to bounce mail if they don't get a connection in less than a minute? I'm wondering if this parameter should allow fractions of a minute to be entered via the web

  1   2   >