Re[10]: [Declude.JunkMail] declude / spamassassin

[Sanford Whiteman]

> I couldn't get 'external weight' to work, am I missing something?

> SPAMASSASSIN  external weight "e:\imail\declude\spamd\spamc32.exe -d
> 209.215.97.193 -e -et 6 -f" 4  0

Don't  assign  Declude  weights to 'external weight' tests. The weight
comes  from  the external test's result code. Stop the test definition
after the quoted command-line:

 SPAMASSASSIN  external weight "e:\imail\declude\spamd\spamc32.exe
 -d 209.215.97.193 -e -et 6 -f"

--Sandy



Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: [EMAIL PROTECTED]

SpamAssassin plugs into Declude!
  http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release/

Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases!
  
http://www.imprimia.com/products/software/freeutils/exchange2aliases/download/release/
  
http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/release/

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] dnsbl locations explained???

[Scott Fisher]

Here's the options and their highpoints.

Declude is going to test the IP of each hop in the delivery chain (unless 
IPBYPASS specified) through that DNS query.

The maximum number of hops to check defined by the HOPHIGH parameter

XBL  ip4r xbl.spamhaus.org  * 3 0
One DNS query per IP, most efficent.
Fewest scoring options.
Can't get simpler than this.

Or

XBL-SBLip4r sbl-xbl.spamhaus.org 127.0.0.2 3 0
XBL-CBL   ip4r sbl-xbl.spamhaus.org 127.0.0.4 3 0
XBL-NJABL  ip4r sbl-xbl.spamhaus.org 127.0.0.5 2 0
XBL-Blitzed  ip4r sbl-xbl.spamhaus.org 127.0.0.6 3 0
Since the dns name is the same this will still make only one DNS query per 
IP,  also being most efficient.

You could also weight the results differently.
The XBL-NJABL is listed as a "time-expired NJABL open proxy" so it is a 
subset of the full NJABL list.


Or

SBL  ip4r sbl.spamhaus.org  127.0.0.2 3 0
BLITZEDALL  ip4r opm.blitzed.org   *  3 0
CBL  ip4rcbl.abuseat.org   127.0.0.2 3 0
NJABL  dnsbl.njabl.org   *   2 0
4 DNS queries per IP, being less efficient.
You'd get the full NJABL although scoring this at one weight.
In my own opinion, I think using the individual lists offers the best chance 
at getting the most fresh results. I don't know if this can be proven with 
the results.
Also allows for a potential overlap of lists. If somebody is on NJABL and 
Blitzedall they could get scored twice.


Or

SBL  ip4r sbl.spamhaus.org  127.0.0.2 3 0
BLITZEDALL  ip4r opm.blitzed.org   *  3 0
CBL  ip4rcbl.abuseat.org   127.0.0.2 3 0
NJABL-RELAYSip4rdnsbl.njabl.org   127.0.0.2   3 0
NJABL-DULip4r dnsbl.njabl.org  127.0.0.3   2 0
NJABL-SOURCES  ip4rdnsbl.njabl.org   127.0.0.4   3 0
NJABL-MULTISTAGE-RELAY  ip4rdnsbl.njabl.org   127.0.0.5   02 0
NJABL-FORMMAIL_RELAY ip4r  dnsbl.njabl.org   127.0.0.8   2 0
NJABL-PROXIES ip4rdnsbl.njabl.org   127.0.0.9   3 0
4 DNS quries per IP, being less efficient.
You'd get the full NJABL with the ability to score them at different 
weights. Most flexible for scoring.
In my own opinion, I think using the individual lists offers the best chance 
at getting the most fresh results. I don't know if this can be proven with 
the results.
Also allows for a potential overlap of lists. If somebody is on NJABL and 
Blitzedall they could get scored twice.



- Original Message - 
From: "Travis Sullivan" <[EMAIL PROTECTED]>

To: 
Sent: Wednesday, September 21, 2005 11:35 AM
Subject: [Declude.JunkMail] dnsbl locations explained???


 SBL+XBL sbl-xbl.spamhaus.org 127.0.0.2-6 Combined zone to reduce 
queries

 Includes both SBL and XBL zones


I have:

sbl-xbl.spamhaus.org*

But I am wondering on the downside of such a wildcard.  Will the system 
check ANY/ALL IPs belonging to that domain, or just the first response? 
Anyone know?  I am thinking perhaps we should list all IPs to cut down on 
"system hunting"?


Travis
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Way OT: Server Room Cooling

[GlobalWeb.net Webmaster]

We use an Avenger floor unit by ColdAir - works great!

We got the optional pump unit and hooked a flex hose to it, run the
flex-hose up through the ceiling and down to the janitoral sink a couple of
rooms away. 

Randy

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Cris Porter
Sent: Wednesday, September 21, 2005 10:00 AM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] Way OT: Server Room Cooling

Can anyone recommend a portable air conditioner to cool a 8'x10' server
closet ?

I'll have to vent it up thru a drop ceiling and I'm trying to find something
that doesn't require frequent draining.

Thanks,
Cris Porter
JVC America

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] dnsbl locations explained???

[Travis Sullivan]

 SBL+XBL sbl-xbl.spamhaus.org 127.0.0.2-6 Combined zone to reduce 
queries

 Includes both SBL and XBL zones


I have:

sbl-xbl.spamhaus.org*

But I am wondering on the downside of such a wildcard.  Will the system 
check ANY/ALL IPs belonging to that domain, or just the first response? 
Anyone know?  I am thinking perhaps we should list all IPs to cut down on 
"system hunting"?


Travis 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: Re[8]: [Declude.JunkMail] declude / spamassassin

[Travis Sullivan]

'returnvalue'  would  be  better  written  ,  i.e. it's a
variable  --  the  the return value you're watching for. But you don't
want  an  'external  retunvalue'  type.  You want an 'external weight'
type.


I couldn't get 'external weight' to work, am I missing something?

SPAMASSASSIN  external weight "e:\imail\declude\spamd\spamc32.exe -d 
209.215.97.193 -e -et 6 -f" 4  0


Travis 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] critique my global.cfg file with regards to blacklist use

[Travis Sullivan]

Thank you so much Scott for taking the time with my global.cfg file.  Your 
help/advise was very appreciated.


Travis 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Way OT: Server Room Cooling

[John Tolmachoff \(Lists\)]

Sunpentown units are very good, and are supposed to be efficient on water
collection, meaning there is not supposed to be as much drainage. They do
have a tank and a drain.

www.spt-usa.com

You can usually get them at a discounted price on eBay from a reseller, but
they are all shipped directly from the manufacturers warehouse here in City
of Industry, CA. Also, if you are in Southern California, you can then will
call them.

John T
eServices For You


> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Cris Porter
> Sent: Wednesday, September 21, 2005 7:00 AM
> To: Declude.JunkMail@declude.com
> Subject: [Declude.JunkMail] Way OT: Server Room Cooling
> 
> Can anyone recommend a portable air conditioner to
> cool a 8'x10' server closet ?
> 
> I'll have to vent it up thru a drop ceiling and I'm
> trying to find something that doesn't require frequent
> draining.
> 
> Thanks,
> Cris Porter
> JVC America
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] UPGRADE REPEAT

[John Tolmachoff \(Lists\)]

FYI, it appears the Beta may be wrapping up soon. So if you can, maybe wait
a week or two for version 3.x.

John T
eServices For You


> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
> [EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED])
> Sent: Wednesday, September 21, 2005 6:20 AM
> To: Declude.JunkMail@declude.com
> Subject: Re: [Declude.JunkMail] UPGRADE REPEAT
> 
> Kevin,
> 
> The version that is compatible with 8.2x is going to be Declude version
3.0
> which is still in beta testing.  Although others have ran the 2.0.6 train
> with no issues under 8.2x - however others have not been so fortunate.
> Upgrading to the 2.0.6 install is fairly easy.  Just run a manual install
> and copy over the new declude.exe to the imail directory.  You might also
> want to go through the global.cfg for 2.0.6 and add any of the tests to
your
> global.cfg that are missing.  The installation for 3.0 is a little more
> involved.  If you wanted to go that route you would need to sign up for
the
> beta program.  However, from reading your post it sounds like you might
not
> be interested in the beta program.
> 
> Let us know if you need anymore help,
> Darrell
>  -
> DLAnalyzer - Comprehensive reporting for Declude Junkmail and Virus.
> http://www.invariantsystems.com
> 
> Kevin Shimwell writes:
> 
> > Declude Teammates
> >
> > Well after several month of not wanting to upgrade. Here goes.
> >
> > Current Imail version  8.21. running 1 month inluding beta.
> > Colaberation Suite IM running also. ( only the IM service portion)
> >
> >
> > Currrent declude version Declude 1.79 (C) Copyright 2000-2004
Computerized
> > Horizons.
> >
> > I also have Processor issues but have been manageable.
> >
> > I have a current service agreement with declude and want to upgrade to
the
> > most current declude.exe version.
> > What should  my procedure be? and what to look out for.
> > Any helpful links or documentation including wise declude professional
> > opinions welcome.
> >
> > I'm running window 2000 server latest patches and I wan to upgrade my
> > declude.
> > I'm running version:
> > E:\IMail>declude -diag
> > Declude 1.79 (C) Copyright 2000-2004 Computerized Horizons.
> > Diagnostics ON (Declude v1.79).
> > Declude JunkMail:  Config file found (E:\IMail\Declude\global.CFG).
> > Declude Virus: Config file found (E:\IMail\Declude\Virus.CFG).
> > Declude Hijack:Not installed (no E:\IMail\Declude\Hijack.CFG file).
> > Declude Confirm:   Not installed (no E:\IMail\Declude\Confirm.CFG file).
> > 50 spam tests defined: AHBL BLITZEDALL CBL DSBL ORDB SBL SORBS-HTTP
> > SORBS-SOCKS
> > SORBS-MISC SORBS-SMTP SORBS-SPAM SORBS-WEB SORBS-BLOCK SORBS-
> ZOMBIE
> > SORBS-DUHL S
> > PAMCOP DSN NOABUSE NOPOSTMASTER BONDEDSENDER BADHEADERS BASE64
> CMDSPACE
> > COMMENTS
> >  HELOBOGUS IPNOTINMX MAILFROM NOLEGITCONTENT PERCENT REVDNS
> ROUTING
> > SPAMHEADERS
> > IPLINKED IPLINKED2 MYFILTER KILLFROM SUBJECTFILTER BODYFILTER GIBBERISH
> > ANTI-GIB
> > BERISH SNIFFER WEIGHT10 WEIGHT20 WEIGHT1-10 WEIGHT11-20 WEIGHT21-34
> > WEIGHT35-45
> > WEIGHT46-200 CATCHALLMAILS WHITLIST
> >
> > IMail reports Official Host Name as: "scooby.linkbrokers.com".
> > IMail's SendName registry seems OK:  "E:\IMail\declude.exe".
> > DNS Server: 66.153.205.8
> >
> > Declude JunkMail Status: PRO version registered.
> > Declude Virus Status:Pro Version Registered.
> > Declude Hijack Status:   NOT REGISTERED: No activation code.
> >
> >
> > Kevin Shimwell
> > Link Brokers Group, LLC  ( Support )
> > 1600 Hwy 17 South
> > North Myrtle Beach, SC 29582
> > Phone: 843-663-1004
> > Fax: 843-663-1007
> > Email:  [EMAIL PROTECTED]
> > 24/7 Help : 
> > http://www.linkbrokers.com/help_ticket.cfm
> > Support Forum:
> > http://www.linkbrokers.com/chatboard/index.cfm?CFB=1
> > Support M-F  1-888-546-5631
> >
> > This message is intended only for the use of the individual or entity
> > towhich it is addressed and may contain information that is privileged,
> > confidential and exempt from disclosure under applicable law. If the
reader
> > of this message is not the intended recipient or the employee or agent
> > responsible for delivering the message to the intended recipient, you
are
> > hereby notified that any dissemination, distribution or copying of this
> > communication is strictly prohibited. If you have received this
> > communication in error, please notify us immediately by telephone and/or
> > e-mail.
> >
> >
> 
> 
> 
>  
> Check out http://www.invariantsystems.com for utilities for Declude And
> Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration,
MRTG
> Integration, and Log Parsers.
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> 

RE: [Declude.JunkMail] Problem with a per domain filter file

[John Tolmachoff \(Lists\)]

Responding to 3 responses:

Thanks, I had a feeling it was the ALLRECIPS, but it appears there is no
other variable to use for the recipient. I guess I could use NOTCONTAINS
instead of NOTENDSWITH.

I was hoping for an exact match as possible.

John T
eServices For You


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] Problem with a per domain filter file

[Colbeck, Andrew]

John, you may be reading too much into ALLRECIPS.  It's just a string
match like any other filter test.

In this case, the debug line shows that the ALLRECIPS string looks
something like (some of it is cut off because the debug shows a fixed
length):

<[EMAIL PROTECTED]>, <[EMAIL PROTECTED] 

The last few characters certainly do not match:

local-domain.com

So the NOTENDSWITH is true.  Therefore, the END was triggered.

... It may also be useful to point out things that ALLRECIPS is and
isn't.

- It's a single text string that is a comma separated list of literal
mailto and their local alias*.
- It isn't a logical AND test of the members of any of the pairings 
- It doesn't have a special grammar so that you can do a CONTAINS match
on a member of the list.  That means CONTAINS will still do a substring
match, finding [EMAIL PROTECTED] inside of [EMAIL PROTECTED]

* There's a wrinkle there regarding SWITCHRECIPS, but in my gateway
scenario, I haven't had to pay attention to it.

Andrew 8)


> -Original Message-
> From: [EMAIL PROTECTED] 
> [mailto:[EMAIL PROTECTED] On Behalf Of John 
> Tolmachoff (Lists)
> Sent: Wednesday, September 21, 2005 12:49 AM
> To: Declude.JunkMail@declude.com
> Subject: [Declude.JunkMail] Problem with a per domain filter file
> 
> I have created filter files for each domain that warrants 
> them to counteract tests failed because of keywords or other 
> things some what unique to that domain.
> 
> Here is the END line in the filter:
> 
> ALLRECIPS END NOTENDSWITH local-domain.com
> 
> However, in the log lines below, you can see that the 
> processing of the filter file ended saying the END condition 
> was meet, but it was not.
> 
> 09/21/2005 00:21:41.306 q09ef03ec22c5.smd Doing filter 
> file C:\Imail\Declude\filters\A_Local_Domain.txt.
> 09/21/2005 00:21:41.306 q09ef03ec22c5.smd Triggered 
> ALLRECIPS !ENDSWITH filter DOMAIN_C on local-domain.com 
> [weight->0; <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]
> 09/21/2005 00:21:41.306 q09ef03ec22c5.smd Filter: END 
> command conditions met; ending this filter.
> 
> Can some one see where I am doing something wrong?
> 
> John T
> eServices For You
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and 
> type "unsubscribe Declude.JunkMail".  The archives can be 
> found at http://www.mail-archive.com.
> 
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Way OT: Server Room Cooling

[Dave Doherty]

Hi Chris-

I use a rollabout unit in my office at home. The collector tank has a drain, 
so I let it flow into a bucket in which I put a mini sump pump. It's kind of 
a kludge, but it works great.


The unit I use is called a "Roam Air" but there are many manufacturers of 
similar devices.


I don't know anything about your physical setup, but if you can isolate the 
front of the servers from the back in some way, you could put a exhaust fan 
in the ceiling in back. That would let the servers do most of the work for 
you.


When you size the unit, you need about 3.5 BTU / Watt. A 300W server needs 
about 1,000 BTU to get the room under control.


-Dave


- Original Message - 
From: "Cris Porter" <[EMAIL PROTECTED]>

To: 
Sent: Wednesday, September 21, 2005 10:00 AM
Subject: [Declude.JunkMail] Way OT: Server Room Cooling


Can anyone recommend a portable air conditioner to
cool a 8'x10' server closet ?

I'll have to vent it up thru a drop ceiling and I'm
trying to find something that doesn't require frequent
draining.

Thanks,
Cris Porter
JVC America

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] critique my global.cfg file with regards to blacklist use

[Scott Fisher]

You are duplicating effort and doubling the results here::
sbl-xbl.spamhaus.org contains the SBL, CBL, Blitzedall and subset of the 
NJABL data

http://www.spamhaus.org/xbl/index.lasso

BLITZEDALL  ip4r  opm.blitzed.org *  3 0
CBL   ip4r  cbl.abuseat.org 127.0.0.2 3 0
SBL   ip4r sbl-xbl.spamhaus.org*  3 0
NJABL   ip4r  dnsbl.njabl.org 127.0.0.2 3 0
NJABLFORMS   ip4r  dnsbl.njabl.org 127.0.0.8 2 0
NJABLPROXYS  ip4r  dnsbl.njabl.org 127.0.0.9 2 0
NJABLSOURCES ip4r  dnsbl.njabl.org 127.0.0.4 2 0


I certainly wouldn't weight these two tests the same:
You'll find lots of false positives on the suspicious test
MXRATE-BLOCK   ip4r   pub.mxrate.net  127.0.0.2  3 0 MXRATE-SUSPICIOUS 
ip4r   pub.mxrate.net  127.0.0.4  3 0


I'd be leary of the weights here:
This returns 25% spam, 75% ham here.

FIVETENOPTIN  ip4r  blackholes.five-ten-sg.com   127.0.0.4 2 0

75% spam, 25% ham for this one:

FIVETENIGNORE  ip4r  blackholes.five-ten-sg.com   127.0.0.7 2 0


these could be interesting additions:
UCEPROTECT-LEVEL1 ip4r dnsbl-1.uceprotect.net  *   yourweight  0
UCEPROTECT-LEVEL2- ip4r dnsbl-2.uceprotect.net  *   yourweight  0
WHOIS-BOGONS-DYNA ip4r combined-HIB.dnsiplists.completewhois.com 127.0.0.2 
yourweight  0
WHOIS-HIJACKED-DYNA ip4r combined-HIB.dnsiplists.completewhois.com 127.0.0.3 
yourweight  0
WHOIS-INVALID-DYNA ip4r combined-HIB.dnsiplists.completewhois.com 127.0.0.4 
yourweight  0


In general looking at your weighting,
I see very effective tests SBL, SPamcop, CBL with a weight of only one point 
more than less effective tests.
You didn't mention how much weight it takes for your subject 
tag/hold/delete, so it's hard to comment on the weights.
I have the SBL & CBL at 100% of my subject tag weight and Spamcop at 70% of 
my subject tage weight.


blackholes.intersil.net has a very low hit rate. Is it worth running?


- Original Message - 
From: "Travis Sullivan" <[EMAIL PROTECTED]>

To: 
Sent: Tuesday, September 20, 2005 6:51 PM
Subject: [Declude.JunkMail] critique my global.cfg file with regards to 
blacklist use




DSBL   ip4r  list.dsbl.org *  3 0
ORDB   ip4r  relays.ordb.org *  3 0
SPAMCOP   ip4r  bl.spamcop.net 127.0.0.2 3 0
SERVICESNET  ip4r  korea.services.net*  3 0
ORID   ip4r  dnsbl.antispam.or.id127.0.0.2  3 0
FABELSOURCES  ip4r  spamsources.fabel.dk127.0.0.2 3 0
AHBL   ip4r  dnsbl.ahbl.org *  3 0
BLITZEDALL  ip4r  opm.blitzed.org *  3 0
CBL   ip4r  cbl.abuseat.org 127.0.0.2 3 0
SBL   ip4r sbl-xbl.spamhaus.org*  3 0
NJABL   ip4r  dnsbl.njabl.org 127.0.0.2 3 0
NJABLDUL   ip4r  combined.njabl.org127.0.0.3 3 0
NJABLFORMS   ip4r  dnsbl.njabl.org 127.0.0.8 2 0
NJABLPROXYS  ip4r  dnsbl.njabl.org 127.0.0.9 2 0
NJABLSOURCES ip4r  dnsbl.njabl.org 127.0.0.4 2 0
SORBS-HTTP  ip4r  dnsbl.sorbs.net 127.0.0.2 2 0
SORBS-SOCKS  ip4r  dnsbl.sorbs.net 127.0.0.3 2 0
SORBS-MISC  ip4r  dnsbl.sorbs.net 127.0.0.4 2 0
SORBS-SMTP  ip4r  dnsbl.sorbs.net 127.0.0.5 2 0
SORBS-SPAM  ip4r  dnsbl.sorbs.net 127.0.0.6 2 0
SORBS-WEB  ip4r  dnsbl.sorbs.net 127.0.0.7 2 0
SORBS-BLOCK  ip4r  dnsbl.sorbs.net 127.0.0.8 2 0
SORBS-ZOMBIE  ip4r  dnsbl.sorbs.net 127.0.0.9 2 0
SORBS-DUHL  ip4r  dnsbl.sorbs.net 127.0.0.10 2 0
FIVETENDUL  ip4r  blackholes.five-ten-sg.com   127.0.0.3 2 0
FIVETENFREE  ip4r  blackholes.five-ten-sg.com   127.0.0.12 2 0
FIVETENIGNORE  ip4r  blackholes.five-ten-sg.com   127.0.0.7 2 0
FIVETENKLEZ  ip4r  blackholes.five-ten-sg.com   127.0.0.10 2 0
FIVETENMULTI  ip4r  blackholes.five-ten-sg.com   127.0.0.5 2 0
FIVETENOPTIN  ip4r  blackholes.five-ten-sg.com   127.0.0.4 2 0
FIVETENOTHER  ip4r  blackholes.five-ten-sg.com   127.0.0.9 2 0
FIVETENSINGLE  ip4r  blackholes.five-ten-sg.com   127.0.0.6 2 0
FIVETENSRC  ip4r  blackholes.five-ten-sg.com   127.0.0.2 2 0
FIVETENTCPA  ip4r  blackholes.five-ten-sg.com   127.0.0.11 2 0
FIVETENWEBFORM  ip4r  blackholes.five-ten-sg.com   127.0.0.8 2 0

CSMA-SBL   ip4r   sbl.csma.biz  127.0.0.2  2 0 JAMMDNSBL   ip4r 
dnsbl.jammconsulting.com127.0.0.2  2 0 INTERSIL   ip4r 
blackholes.intersil.net 127.0.0.2  2 0 MXRATE-BLOCK   ip4r 
pub.mxrate.net  127.0.0.2  3 0 MXRATE-SUSPICIOUS  ip4r 
pub.mxrate.net  127.0.0.4  3 0 SPAMBAG   ip4r   blacklist.spambag.org 
127.0.0.2  2 0

DSN   rhsbl  dsn.rfc-ignorant.org127.0.0.2 3 0
NOABUSE   rhsbl  abuse.rfc-ignorant.org127.0.0.4 1 0
NOPOSTMASTER  rhsbl  postmaster.rfc-ignorant.org   127.0.0.3 1 0
BOGUSMX   rhsbl  bogusmx.rfc-ignorant.org   127.0.0.8 3 0
DNSILLEGAL  rhsbl  in.dnsbl.org 127.0.0.5 3 0
DNSFRAUD  rhsbl  in.dnsbl.org 127.0.0.3 3 0
DNSMAILLIST  rhsbl  in.dnsbl.org 127.0.0.6 3 0
DNSPROMO  rhsbl  in.dnsbl.org 127.0.0.4 3 0
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archi

[Declude.JunkMail] Way OT: Server Room Cooling

[Cris Porter]

Can anyone recommend a portable air conditioner to 
cool a 8'x10' server closet ?

I'll have to vent it up thru a drop ceiling and I'm
trying to find something that doesn't require frequent
draining.

Thanks,
Cris Porter
JVC America

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Problem with a per domain filter file

[Kim Premuda]

That was my guess as well. That is, the ALLRECIPS test is a logical AND 
function and requires that ALL ending domains be the same for the test to be 
true. Any one domain not matching the requisite domain (the one you are testing 
for) will cause the test to fail.


-- Original Message --
From: "Darrell \([EMAIL PROTECTED])" <[EMAIL PROTECTED]>
Reply-To: Declude.JunkMail@declude.com
Date:  Wed, 21 Sep 2005 09:15:09 -0400

>I am going to take a stab at this... 
>
>The line shows this ->
>filter DOMAIN_C on local-domain.com [weight->0; <[EMAIL PROTECTED]>,
>> <[EMAIL PROTECTED]
>
>With the allrecips being a comma value of all recipients I would suspect the 
>[EMAIL PROTECTED] came after the local-domain.com hence meeting the 
>"NOTENDSWITH" tag. 
>
>Darrell
> 
>Check out http://www.invariantsystems.com for utilities for Declude And 
>Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG 
>Integration, and Log Parsers. 
>
>
>John Tolmachoff (Lists) writes: 
>
>> I have created filter files for each domain that warrants them to counteract
>> tests failed because of keywords or other things some what unique to that
>> domain. 
>> 
>> Here is the END line in the filter: 
>> 
>> ALLRECIPSEND NOTENDSWITH local-domain.com 
>> 
>> However, in the log lines below, you can see that the processing of the
>> filter file ended saying the END condition was meet, but it was not. 
>> 
>> 09/21/2005 00:21:41.306 q09ef03ec22c5.smd Doing filter file
>> C:\Imail\Declude\filters\A_Local_Domain.txt.
>> 09/21/2005 00:21:41.306 q09ef03ec22c5.smd Triggered ALLRECIPS !ENDSWITH
>> filter DOMAIN_C on local-domain.com [weight->0; <[EMAIL PROTECTED]>,
>> <[EMAIL PROTECTED]
>> 09/21/2005 00:21:41.306 q09ef03ec22c5.smd Filter: END command conditions
>> met; ending this filter. 
>> 
>> Can some one see where I am doing something wrong? 
>> 
>> John T
>> eServices For You 
>> 
>>  
>> 
>> ---
>> This E-mail came from the Declude.JunkMail mailing list.  To
>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> type "unsubscribe Declude.JunkMail".  The archives can be found
>> at http://www.mail-archive.com.
> 
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>---
>[This E-mail scanned for viruses by Declude Virus]
>
>

--
Kim W. Premuda
FastWave Internet Services
San Diego, CA

--
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] declude / spamassassin - topic change

[Nick Hayer]

Hi Sandy,

Sanford Whiteman wrote:


So what you're asking
for  is  a switch like -e, but which is more conditional, allowing the
possible result codes:

-  0,  if  -lt  not  met

- , if -lt met and  <= -et value

- -et value, if  > -et value
 


Exactly.


Sounds like a good option, and I can't think of a way of kludging that
in  one  external  test  instance with the current switches (you could
actually do it with multiple SPAMC32 runs -- don't!). I'll add it in.
 

Excellent. It will really allow me to further punish email that SA 
considers blatant spam. Thanks!


-Nick

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] UPGRADE REPEAT

[Darrell \([EMAIL PROTECTED])]

Kevin, 

The version that is compatible with 8.2x is going to be Declude version 3.0 
which is still in beta testing.  Although others have ran the 2.0.6 train 
with no issues under 8.2x - however others have not been so fortunate.  
Upgrading to the 2.0.6 install is fairly easy.  Just run a manual install 
and copy over the new declude.exe to the imail directory.  You might also 
want to go through the global.cfg for 2.0.6 and add any of the tests to your 
global.cfg that are missing.  The installation for 3.0 is a little more 
involved.  If you wanted to go that route you would need to sign up for the 
beta program.  However, from reading your post it sounds like you might not 
be interested in the beta program. 


Let us know if you need anymore help,
Darrell
-
DLAnalyzer - Comprehensive reporting for Declude Junkmail and Virus.  
http://www.invariantsystems.com 

Kevin Shimwell writes: 

Declude Teammates 

Well after several month of not wanting to upgrade. Here goes. 


Current Imail version  8.21. running 1 month inluding beta.
Colaberation Suite IM running also. ( only the IM service portion) 



Currrent declude version Declude 1.79 (C) Copyright 2000-2004 Computerized
Horizons. 

I also have Processor issues but have been manageable. 


I have a current service agreement with declude and want to upgrade to the
most current declude.exe version.
What should  my procedure be? and what to look out for.  
Any helpful links or documentation including wise declude professional

opinions welcome.
 
I'm running window 2000 server latest patches and I wan to upgrade my

declude.
I'm running version:
E:\IMail>declude -diag
Declude 1.79 (C) Copyright 2000-2004 Computerized Horizons.
Diagnostics ON (Declude v1.79).
Declude JunkMail:  Config file found (E:\IMail\Declude\global.CFG).
Declude Virus: Config file found (E:\IMail\Declude\Virus.CFG).
Declude Hijack:Not installed (no E:\IMail\Declude\Hijack.CFG file).
Declude Confirm:   Not installed (no E:\IMail\Declude\Confirm.CFG file).
50 spam tests defined: AHBL BLITZEDALL CBL DSBL ORDB SBL SORBS-HTTP
SORBS-SOCKS
SORBS-MISC SORBS-SMTP SORBS-SPAM SORBS-WEB SORBS-BLOCK SORBS-ZOMBIE
SORBS-DUHL S
PAMCOP DSN NOABUSE NOPOSTMASTER BONDEDSENDER BADHEADERS BASE64 CMDSPACE
COMMENTS
 HELOBOGUS IPNOTINMX MAILFROM NOLEGITCONTENT PERCENT REVDNS ROUTING
SPAMHEADERS
IPLINKED IPLINKED2 MYFILTER KILLFROM SUBJECTFILTER BODYFILTER GIBBERISH
ANTI-GIB
BERISH SNIFFER WEIGHT10 WEIGHT20 WEIGHT1-10 WEIGHT11-20 WEIGHT21-34
WEIGHT35-45
WEIGHT46-200 CATCHALLMAILS WHITLIST
 
IMail reports Official Host Name as: "scooby.linkbrokers.com".

IMail's SendName registry seems OK:  "E:\IMail\declude.exe".
DNS Server: 66.153.205.8
 
Declude JunkMail Status: PRO version registered.

Declude Virus Status:Pro Version Registered.
Declude Hijack Status:   NOT REGISTERED: No activation code. 
  


Kevin Shimwell
Link Brokers Group, LLC  ( Support )
1600 Hwy 17 South
North Myrtle Beach, SC 29582
Phone: 843-663-1004
Fax: 843-663-1007
Email:  [EMAIL PROTECTED]
24/7 Help : 
http://www.linkbrokers.com/help_ticket.cfm
Support Forum:
http://www.linkbrokers.com/chatboard/index.cfm?CFB=1
Support M-F  1-888-546-5631  


This message is intended only for the use of the individual or entity
towhich it is addressed and may contain information that is privileged,
confidential and exempt from disclosure under applicable law. If the reader
of this message is not the intended recipient or the employee or agent
responsible for delivering the message to the intended recipient, you are
hereby notified that any dissemination, distribution or copying of this
communication is strictly prohibited. If you have received this
communication in error, please notify us immediately by telephone and/or
e-mail. 

 





Check out http://www.invariantsystems.com for utilities for Declude And 
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG 
Integration, and Log Parsers. 



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] Problem with a per domain filter file

[Darrell \([EMAIL PROTECTED])]

I am going to take a stab at this... 


The line shows this ->
filter DOMAIN_C on local-domain.com [weight->0; <[EMAIL PROTECTED]>,

<[EMAIL PROTECTED]


With the allrecips being a comma value of all recipients I would suspect the 
[EMAIL PROTECTED] came after the local-domain.com hence meeting the "NOTENDSWITH" tag. 


Darrell

Check out http://www.invariantsystems.com for utilities for Declude And 
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG 
Integration, and Log Parsers. 



John Tolmachoff (Lists) writes: 


I have created filter files for each domain that warrants them to counteract
tests failed because of keywords or other things some what unique to that
domain. 

Here is the END line in the filter: 

ALLRECIPS	END	NOTENDSWITH	local-domain.com 


However, in the log lines below, you can see that the processing of the
filter file ended saying the END condition was meet, but it was not. 


09/21/2005 00:21:41.306 q09ef03ec22c5.smd Doing filter file
C:\Imail\Declude\filters\A_Local_Domain.txt.
09/21/2005 00:21:41.306 q09ef03ec22c5.smd Triggered ALLRECIPS !ENDSWITH
filter DOMAIN_C on local-domain.com [weight->0; <[EMAIL PROTECTED]>,
<[EMAIL PROTECTED]
09/21/2005 00:21:41.306 q09ef03ec22c5.smd Filter: END command conditions
met; ending this filter. 

Can some one see where I am doing something wrong? 


John T
eServices For You 

 


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Re: [Declude.JunkMail] declude / spamassassin

[Nick Hayer]

Keith,

Keith Johnson wrote:

  Travis,
 In your setup, your Declude is running on a Windows 2k/2003 box calling your SA server on a Linux box on the same local network?  I guess the speeds are much the same as quering a local DNS server for lookups.  Sounds great, I will have look into this, my loads are around the same for our three servers.  Thanks again,
  

This what I was trying to recommend - have spamd on a different box -
running on what ever platform you like. With that scenario spamassassin
has nil effect on the imail [declude] box.  Sorry I was not clear on
that!

-Nicko


   
Keith



From: [EMAIL PROTECTED] on behalf of Travis Sullivan
Sent: Tue 9/20/2005 6:31 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] declude / spamassassin



  
  

  Nick,
  If you don't mind, is SA heavy on the CPU?  What kinda load are
you running with SA?
  

  
  
I have 3k plus users getting 300k emails per day... my SA is running on a
linux server, P4 2ghz... no increase in load when I started using SA with
declude today.

The best config I have set is:
SPAMASSASSIN externalnonzero "e:\imail\declude\spamd\spamc32.exe -d
209.215.97.193 -r -lt 4 -et 6 -f" 3  0

I 'think' so far that spamassassin only reports if SA's score is 4 or more,
if so, I score it a 3 on the email test.  I am still playing with the values
to tune the system.

thanks for everyone's help today.  I hope to have MRTG running reports on
declude soon to show some statistics.

Travis

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  

Re: [Declude.JunkMail] declude / spamassassin

[David Franco-Rocha [ Declude ]]

Matt,
 
The BITMASK tests have a limit of 32 individual 
tests, since we expect a 32-bit integer to be returned to Declude.
 
David Franco-Rocha
Declude Technical / Engineering
 

  - Original Message - 
  From: 
  Matt 
  To: Declude.JunkMail@declude.com 
  
  Sent: Tuesday, September 20, 2005 5:32 
  PM
  Subject: Re: [Declude.JunkMail] declude / 
  spamassassin
  Sandy,The latest Declude's support bitmasked result 
  codes.  You might consider creating a user maintained map from tests 
  failed in SA to bitmapped result codes returned to Declude.  I'm not sure 
  what the limit might be in Declude for the number of unique tests, but I have 
  managed to use 16 so far without issue.  It probably is limited to either 
  16 or 32 if it is limited.  It might very well not 
  be.MattSanford Whiteman wrote: 
  
Thanks  guys,  I have it working now! BTW... any way to retrieve any
info from SA with regards to test failed or weight?

This  info  is  not currently used by Declude, though it is accessible
when  you run SPAMC32 against a message from the command line. Declude
Junkmail doesn't support the use of "report" files as in Declude Virus
--  secondary  files  left  behind by external tests whose results can
then  be  parsed by the Declude for insertion in headers or weighting.
If  it  did,  it'd  be  straightforward to drop a report file for each
message and have these integrated into the Declude log.

Anyway,  the  next version of SPAMC32 is coming out very soon with the
ability  to  consult  a  local  SPAMC32 log file (rather than the main
SPAMD  log  file)  to  check which individual SA rules failed for each
message; this is a definite need.

As for SPAMC32 inserting headers directly, this is technically simple,
but  I  have purposely avoided implementing this functionality because
it  will  add  significant  extra  disk  I/O  to  reread and alter the
original  message,  rather than letting Declude add all of its headers
at  once  when  done  processing. Plus, adding the names of 10, 20, or
more SA rules to the message headers can be pretty sloppy. So, in sum,
header  insertion  will  likely  be  added as an optional command-line
switch,  but  it's  not  as  much  of  a priority as the local logging
function. I will keep the list posted, as always.

--Sandy



Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: [EMAIL PROTECTED]

SpamAssassin plugs into Declude!
  http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release/

Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases!
  http://www.imprimia.com/products/software/freeutils/exchange2aliases/download/release/
  http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/release/

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  

[Declude.JunkMail] UPGRADE REPEAT

[Kevin Shimwell]

Title: Message



Declude 
Teammates
Well after several 
month of not wanting to upgrade. Here goes.Current Imail 
version  8.21. running 1 month inluding beta.Colaberation Suite IM 
running also. ( only the IM service portion)Currrent declude 
version Declude 1.79 (C) Copyright 2000-2004 Computerized Horizons.I 
also have Processor issues but have been manageable.I have a current 
service agreement with declude and want to upgrade to the most current 
declude.exe version.What should  my procedure be? and what to look out 
for.  Any helpful links or documentation including wise declude 
professional opinions welcome.
 

I'm running window 
2000 server latest patches and I wan to upgrade my declude.
I'm running 
version:
E:\IMail>declude 
-diagDeclude 1.79 (C) Copyright 2000-2004 Computerized 
Horizons.
Diagnostics ON 
(Declude v1.79).
Declude JunkMail:  Config file found 
(E:\IMail\Declude\global.CFG).Declude Virus: Config 
file found (E:\IMail\Declude\Virus.CFG).Declude Hijack:    
Not installed (no E:\IMail\Declude\Hijack.CFG file).Declude 
Confirm:   Not installed (no E:\IMail\Declude\Confirm.CFG file).
50 spam tests defined: AHBL BLITZEDALL CBL DSBL ORDB SBL SORBS-HTTP 
SORBS-SOCKSSORBS-MISC SORBS-SMTP SORBS-SPAM SORBS-WEB SORBS-BLOCK 
SORBS-ZOMBIE SORBS-DUHL SPAMCOP DSN NOABUSE NOPOSTMASTER BONDEDSENDER 
BADHEADERS BASE64 CMDSPACE COMMENTS HELOBOGUS IPNOTINMX MAILFROM 
NOLEGITCONTENT PERCENT REVDNS ROUTING SPAMHEADERSIPLINKED IPLINKED2 MYFILTER 
KILLFROM SUBJECTFILTER BODYFILTER GIBBERISH ANTI-GIBBERISH SNIFFER WEIGHT10 
WEIGHT20 WEIGHT1-10 WEIGHT11-20 WEIGHT21-34 WEIGHT35-45WEIGHT46-200 
CATCHALLMAILS WHITLIST
 
IMail reports Official Host Name as: "scooby.linkbrokers.com".IMail's 
SendName registry seems OK:  "E:\IMail\declude.exe".DNS Server: 
66.153.205.8
 
Declude JunkMail 
Status: 
PRO version registered.Declude Virus 
Status:    
Pro Version Registered.Declude Hijack 
Status:   
NOT REGISTERED: No activation code. 
 
Kevin ShimwellLink Brokers Group, 
LLC  ( Support )1600 Hwy 17 SouthNorth Myrtle Beach, SC 
29582Phone: 843-663-1004Fax: 843-663-1007Email:  
[EMAIL PROTECTED]24/7 Help :http://www.linkbrokers.com/help_ticket.cfmSupport Forum:http://www.linkbrokers.com/chatboard/index.cfm?CFB=1Support M-F  1-888-546-5631 

This message is intended only for the use of the individual or entity towhich 
it is addressed and may contain information that is privileged, confidential and 
exempt from disclosure under applicable law. If the reader of this message is 
not the intended recipient or the employee or agent responsible for delivering 
the message to the intended recipient, you are hereby notified that any 
dissemination, distribution or copying of this communication is strictly 
prohibited. If you have received this communication in error, please notify us 
immediately by telephone and/or e-mail.
 

[Declude.JunkMail] Problem with a per domain filter file

[John Tolmachoff \(Lists\)]

I have created filter files for each domain that warrants them to counteract
tests failed because of keywords or other things some what unique to that
domain.

Here is the END line in the filter:

ALLRECIPS   END NOTENDSWITH local-domain.com

However, in the log lines below, you can see that the processing of the
filter file ended saying the END condition was meet, but it was not.

09/21/2005 00:21:41.306 q09ef03ec22c5.smd Doing filter file
C:\Imail\Declude\filters\A_Local_Domain.txt.
09/21/2005 00:21:41.306 q09ef03ec22c5.smd Triggered ALLRECIPS !ENDSWITH
filter DOMAIN_C on local-domain.com [weight->0; <[EMAIL PROTECTED]>,
<[EMAIL PROTECTED]
09/21/2005 00:21:41.306 q09ef03ec22c5.smd Filter: END command conditions
met; ending this filter.

Can some one see where I am doing something wrong?

John T
eServices For You



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.