On 26/07/2007, at 5:40 AM, Kevin wrote:
James Brown wrote:
Using 1.3.4 (12)
A local user (but sending from outside our network) sending to
another local user (also outside our network) is getting an email
blocked because of bomb regex.
Log says:
Jul-25-07 23:02:11 id-8524c13804 68.142.202.140 <[EMAIL PROTECTED]>
to: [EMAIL PROTECTED] Regex:BombRaw 'STOX'
Jul-25-07 23:02:11 [BombRaw] id-8524c13804 68.142.202.140
<[EMAIL PROTECTED]> to: [EMAIL PROTECTED] BombRe: 'STOX'
Fwd_How_LUCKY_is_this_bloke_
bombReWL is set to 1
Shouldn't this mean that whitelisted or local users are not checked
for any regex, including BombRaw?
bombReWL, Do Regular Expressions Checks for Whitelisted.
If it's set to 1 it means that local users ARE checked.
Kevin
Sorry, I mean it is not checked. From changed defaults:
S e c t i o n: Regex Filters / Spambomb
bombReWL -- Do Regular Expressions Checks for Whitelisted:
BOMBRENP -- Do Regular Expressions Checks for No Processing: 1
(Default: 0)
bombReLocal -- Do Regular Expressions Checks for Local Mails:
DOBOMBSENDERRE -- Use BombSender Regular Expression: 2 (Default: 0)
bombSenderRe -- BombSender Blocking Regular Expression *: \d\d\d\d\d
[EMAIL PROTECTED]
DoBombHeaderRe -- Use BombHeader Regular Expressions on Header: 0
bombHeaderRe -- Regular Expression to Identify Spam in Header*: \d\s+
(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+\d\d\d\d\s+\d\d:\d
\d(:\d\d)?\s+[+\-]\d\d[6-9]\d
bombSubjectRe -- Regular Expression to Identify Spam in Subject*:
bombCharSets -- Regular Expression to Identify Spam in
Characterset* : BIG5|CHINESEBIG|GB2312|KS_C_5601|KOI8-R|EUC-KR|
ISO-2022-JP|ISO-2022-KR|ISO-2022-CN|WINDOWS-1251|WINDOWS-1250
DOBOMBRE -- : 1 (Default: 0)
bombRe -- BombRaw Regular Expression in Header and Data*: file:bombs.txt
bombSuspiciousRe -- Regular Expression for Message Scoring Only*:
bombDataRe -- BombData Regular Expression in Data*: file:files/
bombre.txt
noBombScript -- Don't Check Messages from these Addresses*:
DoTestRe -- BombTest Regular Expression:
testRe -- BombTest Regular Expression*:
BOMBERROR -- Spam Bomb Error: 500 Your message was rejected because
it appears to be part of a spam bomb -- rephrase your message and try
sending it again. REASON (Default: 554 5.7.1 Delivery not authorized,
message refused -- .)
bombErrorReason -- Add Reason: 1
DOSCRIPTRE -- Use Regular Expression to Identify Mobile Scripts: 1
(Default: 0)
scriptRe -- Regular Expression to Identify Mobile Scripts*:
SCRIPTERROR -- Script Error: 500 Your email contains html scripting
code -- please resend as plain text. (Default: 554 5.7.1 Your email
contains html scripting code -- please resend as plain text.)
James.
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Assp-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-user
