Re: [AMaViS-user] Urgent Help Mails Deferred by Postfix

2006-12-14 Thread Mark Martinec
Andres, Thanks Mark for your answer, my amavisd file has 14938 lines, it does not reach 16290... (amavisd-new from ubuntu packages) The patch is against 2.4.4. It is likely that it will apply to earlier versions, with some line offset, likely to be automatically determined by patch. Try and

Re: [AMaViS-user] Urgent Help Mails Deferred by Postfix

2006-12-14 Thread Mark Martinec
Andres, As you see I do not have proc_status_ok line and some sentences are different. Can you tell me the modifications for my amavisd-new file version? Which version is that? 2.3.3? That's more than a year old. Are you sure you want to bother with it? Make sure you have Net::Server version

Re: [AMaViS-user] Urgent Help Mails Deferred by Postfix

2006-12-14 Thread Mark Martinec
Andres, I appreciate your patience on this. That's a year old from source but from packages is the last ( I do not know why ubuntu package maintainera are not using a more updated version). My choice of OS is FreeBSD :-) In this very conversation thread I patched amavisd-new file to be

Re: [AMaViS-user] time gap between amavis and postfix/smtp in the logs?

2006-12-14 Thread Mark Martinec
Leon, 1) What's the meaning of these lines do_notify_and_quarantine: rec_ccat=(1,0), ccat=(1,1) [EMAIL PROTECTED] ? It comes from: do_log(2,do_notify_and_quarantine: rec_ccat=(%d,%d), ccat=(%d,%s), %s, $rec_ccat, $rec_ccat_min, $ccat, $ccat_min, $rec) if $rec_ccat !=

Re: [AMaViS-user] Urgent Help Mails Deferred by Postfix

2006-12-14 Thread Mark Martinec
Andres, I found perl-net 0.94 and I will try to install it if you guys tell me that this version is compatible with my amavis version. With amavisd-new-2.3.3 or earlier you need Net::Server 0.90 or earlier. With 2.4.0 or later you can use any version of Net::Server (but preferably avoid 0.91,

Re: [AMaViS-user] Hiding headers

2006-12-14 Thread Mark Martinec
Is it possible to hide the following headers in a mail scanned by amavisd-new ? X-Virus-Scanned:amavisd-new at abc.com You mean how not to insert it? $X_HEADER_TAG = ''; or: $X_HEADER_LINE = ''; (no need to disable both) Mark

Re: [AMaViS-user] Urgent Help Mails Deferred by Postfix

2006-12-14 Thread Mark Martinec
Andres, Mark, this is the output of the error with the patch applied: Dec 14 14:12:27 pc009 postfix/smtp[5276]: 5E08039A34D: to=[EMAIL PROTECTED], relay=127.0.0.1[127.0.0.1], delay=22, status=deferred (host 127.0.0.1[127.0.0.1] said: 451 4.5.0 Error in processing, id=05248-01,

Re: [AMaViS-user] time gap between amavis and postfix/smtp in thelogs?

2006-12-15 Thread Mark Martinec
Leon, my postfix is not chrooted. I doubt it. Check the 5-th column in master.cf. cp -p /etc/localtime /var/spool/postfix/etc/ This fixes time zones in chroot jail. Mark - Take Surveys. Earn Cash. Influence the

Re: [AMaViS-user] SA working, but amavis hangs when calling it.

2006-12-15 Thread Mark Martinec
Gregorics, I have a little problem with my amavisd-new installation. I inherited a linux system with postfix, amavis and spamassassin installed. However, SA stopped working for some reason. Unfortunately, the server is a mess, any meddling with it could cause it's entire collapse. I did make

Re: [AMaViS-user] SPAM scores for mails received from a particular domain are high

2006-12-15 Thread Mark Martinec
I have currently got installed Mail-SpamAssassin-3.1.4 and would like to upgrade to Mail-SpamAssassin-3.1.7 from CPAN I also have amavisd-new-2.4.0 installed on the system. Will a normal upgrade to Mail-SpamAssassin-3.1.7 cause any malfunctioning of amavisd-new ? By normal upgrade i mean

Re: [AMaViS-user] disaster recovery backup fo bayesian DB?

2006-12-15 Thread Mark Martinec
Leon, I thought of disaster recovery backup. I've read the man pages but still not clear about backing up Bayesian DB files (I don't use SQL DB for now). 1) Is the following command is legit? sa-learn --sync --showdots --backup backup.txt I guess so. It's been long time since I used it

Re: [AMaViS-user] p0f sql

2006-12-15 Thread Mark Martinec
Alan, In 2.4.4 I've uncommented the # , p0f=? in the sql statement. As this is not logging into the p0f field in msgs I presumed some additional changes are still required? The -execute part of the patch is needed too. Here is the same patch, but made against 2.4.4: --- amavisd~Mon Nov

Re: [AMaViS-user] Bayes autolearn not working?

2006-12-18 Thread Mark Martinec
Jef, The high number of messages with autolearn=no is probably explained in you link (e.g. already learned or too few body/header points). I'm sure some of my messages are not scanned by SA for the reasons you mention. But I almost can't believe that explains all my 'missing' messages. At

Re: [AMaViS-user] amavisd-new filling /var/amavis/tmp because of file dumping core

2006-12-18 Thread Mark Martinec
Peter, We use FreeBSD 6.1-RELEASE-p11, with amavisd-new-2.4.4,1. Today one of our antispam servers had its /var partition overfilled. The problem was due to file dumping core on the p001 text part of a spam email (I have reported this as a bug to FreeBSD), The file(1) that comes with the

Re: [AMaViS-user] can't flush: / Unknown error ( 112) [auf Viren überprüft]

2006-12-18 Thread Mark Martinec
Hans, so it seems the Sophos SAVI hit the same problem as your MIME::Parser, namely a disk partition running out of space or inodes. This looks like a very small 1 GB disk. The errors are still there: # more mail_err.log Dec 18 08:41:34 rzhs098 mail:err|error amavis[426220]:

Re: [AMaViS-user] Duplicate mails: archive retained and clamav time out

2006-12-19 Thread Mark Martinec
Nicklas, I need help figuring out why some of my users are getting the same mail over and over again (with a 15 min delay most of the time). So far I've narrowed it down to this: It only happens with attachements and ClamAV seems to time out: do_unzip: p003, zero length members, archive

Re: [AMaViS-user] Duplicate mails: archive retained and clamav time out

2006-12-19 Thread Mark Martinec
Nicklas, P.S. do_unzip: p003, zero length members, archive retained Dec 19 15:56:31 example.com /usr/local/sbin/amavisd[8972]: (08972-13) ClamAV-clamd: timed out, retrying (1) There is a bug in amavisd client code to sophie and clamd where after one attempt to connect to these virus

Re: [AMaViS-user] Duplicate mails: archive retained and clamav timeout

2006-12-20 Thread Mark Martinec
Nicklas, Do you know when you will have a chance to release 2.4.5 or at least a patch for this specific problem? Will post a patch in a day or two (it is one of the two things holding back 2.4.5). The 2.4.5 pre-release is expected in a week. In your case where you know that clamd is actually

Re: [AMaViS-user] error when sending test mail

2006-12-20 Thread Mark Martinec
(!)ESMTP: 501 5.5.2 Syntax: MAIL FROM: address; PENALIZE: mail from:[EMAIL PROTECTED] (I have changed the email address). Please help. I believe it's telling you to surround the address with and . Indeed. amavisd-new-2.4.0 release notes: - SMTP server side: no longer allow e-mail

Re: [AMaViS-user] Duplicate mails: archive retained and clamav timeout

2006-12-20 Thread Mark Martinec
Nicklas, It seems like this problem is not only locally affected. The buggy client code in amavisd seems to make some mail servers goes a bit crazy when they try to deliver a mail and the loop starts in amavisd/clamd. This does not sound as being related to the clamd/sophie/trophie client

Re: [AMaViS-user] trouble setting up OS fingerprinting

2006-12-20 Thread Mark Martinec
Peter, I have p0f OS fingerprinting set up on one box. When setting up on another I am not seeing results in the logs. I must have missed a step somewhere. This is what I did: release notes: * the program p0f-analyzer.pl reads ... ... only queries from allowed IP addresses are

Re: [AMaViS-user] trouble setting up OS fingerprinting

2006-12-20 Thread Mark Martinec
Peter, But the default looks fine (localhost). I thought you were trying to run p0f on a different host than amavisd, in which case it would have to listen on an ethernet IP address. The maillog shows: OS_Fingerprint code loaded but no other instance of fingerprint in there. At log level

Re: [AMaViS-user] Place taged spam in users Junk-folder

2006-12-20 Thread Mark Martinec
Christopher, I have been trying to find out how I can get amavis configured so messages tagged as spam gets delivered to a 'Junk'-folder for that particular recipient. After some googling I've come to believe that is achieved using plus-addressing, but I have found no clear description of

Re: [AMaViS-user] trouble setting up OS fingerprinting

2006-12-20 Thread Mark Martinec
Peter, I am getting logging from p0f when run alone. That's all. I see neither query or collect messages in my logs (at log level 5). My other (working system) is running OpenBSD 4.0. The broken one has an almost identical config but is running OpenBSD 3.9. Any more hints? Perhaps

Re: [AMaViS-user] Duplicate mails: archive retained and clamavtimeout

2006-12-21 Thread Mark Martinec
Nicklas, I can reproduce this by sending a 1MB zip archive containing some random files and one empty (zero byte sized) file. It seems like something goes nuts when the clamd scanning not finishing as expected. In this case I get do_unzip: p003, zero length members, archive retained. Seems

Re: [AMaViS-user] MySQL and local_domains_maps

2006-12-21 Thread Mark Martinec
Leonardo, Is it possible to have @local_domains_maps variable stored in MySQL database ? I wanna host several domains and dont want to alter some external file for having all domains listed . i already does that with read_hash, but i would like to have it fetch from MySQL ..

Re: [AMaViS-user] MySQL and local_domains_maps

2006-12-21 Thread Mark Martinec
complicated clause to look up into an UNION of two tables for those that can afford the straightforward solution, ... can - can't Mark - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay

Re: [AMaViS-user] OT? trying to get lock

2006-12-21 Thread Mark Martinec
[18829] dbg: locker: safe_lock: trying to get lock on /var/amavis/.spamassassin/auto-whitelist with 19 retries lock_method flock and see if that cures the problem. If flock does not solve it, try rebuilding the awl database while discarding entries with few hits. If that does not help,

Re: [AMaViS-user] Assistance with Razor in a chrooted environment

2006-12-21 Thread Mark Martinec
Andy, Dec 21 13:45:17.919508 check[63222]: [ 3] Unable to connect to discovery.spamnet.com:2703; Reason: Invalid argument. Not sure if it is applicable, but Invalid argument often appears as a mis-diagnose for unable to connect. The culprit is a sloppy error handling in Perl socket-IO module.

Re: [AMaViS-user] Duplicate mails: archive retained andclamavtimeout

2006-12-21 Thread Mark Martinec
Nicklas, Here is level 5 amavisd logs from both sending and receiving MTA. ... I'm sorry but the qmail MTA logs didn't say much. ... you can't see message id's in those logs. What you want to do is tracing the id from amavisd-MTA logs. Thanks, that is more helpful. The mail size is 4.9 MB,

Re: [AMaViS-user] change in $forward_method from amavisd-new-2.4.2_3, 1 to amavisd-new-2.4.3 trying to understand

2006-12-22 Thread Mark Martinec
My setup is sendmail-milter and the desired effect was to have all the incoming mail that passed forwarded to another less-able box. What I used to have was this: $forward_method = 'smtp:192.168.1.1:25'; # where to forward checked mail The new config file has this form: $forward_method =

Re: [AMaViS-user] Duplicate mails: archive retained andclamavtimeout [TIMEOUT RESOLVED]

2006-12-22 Thread Mark Martinec
Nicklas, I finally found the root of the problem. The QMQP code in qmail have hardcoded timeouts set. 10 seconds for connect and 60 seconds for read/write. If amavisd processing takes longer than 60 secs you get the early MTA connection drop. I found the following patch by Eric Hess on the

Re: [AMaViS-user] amavis 2.4.4, spamassassin 3.1.7 Problem on report format of the X-Spam-Report header

2006-12-22 Thread Mark Martinec
Walter, $spam_summary = $per_msg_status-get_report; # taints $1 and $2 # $spam_summary = $per_msg_status-get_tag('SUMMARY'); $spam_report = $per_msg_status-get_tag('REPORT'); Okay... it's late and I haven't noticed before: $spam_report is set to $per_msg_status-get_tag('REPORT')

Re: [AMaViS-user] external plugins in SA (WAS: Custom CRM114 plugin in Spamassassin gives allways same score)

2006-12-22 Thread Mark Martinec
Ondrej, When is Spamassassin called from amavisd-new, allways give examined email same score -- CRM114_SPAM_00; after some tries to debug I noticed that when amavisd starts, loads crm114.pm as plugin, SA after registering glue method for check_crm gets CRM114 score -7.1548, which evals

Re: [AMaViS-user] (!)AM.PDP: CLIENTS REQUIRE DIFFERENT HEADERS

2006-12-23 Thread Mark Martinec
MK, amavis.log is telling me (!)AM.PDP: CLIENTS REQUIRE DIFFERENT HEADERS sendmail log is fine, nothing special... setup is sendmail/amavisd-milter/amavisd-new (each newest). what does it mean? is it an amavisd-milter problem? It is an informational message, and reminds you of a deficiency

Re: [AMaViS-user] external plugins in SA

2006-12-23 Thread Mark Martinec
Ondrej, I tried both -- *.cf (or user_prefs) and *.pre -- works OK under right command-line user amavis, but with amavisd-new it really runs only once -- on message with I need to make this message body somewhat long so TextCat preloads and to all other messages just put same score. I'm not

Re: [AMaViS-user] locker entries

2007-01-03 Thread Mark Martinec
Pavel, when I've tried to raise the limit of amavisd-new processes to some insane value (128 I think) I've encountered this problem: amavis[1170]: (!!)TROUBLE in child_init_hook: BDB no dbS: Lock table is out of available locker entries What exactly am I running out of? :-) And what

Re: [AMaViS-user] Internal vs. external decoders.

2007-01-03 Thread Mark Martinec
Shaun, I notice that my amavisd (latest) uses internal decoders for the following: .mail .asc .uue .hqx .ync .zip Is there any benefit to using external decoders for these, and if so, what programs should I be looking for, to install? Some internal decoders (like the ones listed) have no

Re: [AMaViS-user] New AV Scanner

2007-01-03 Thread Mark Martinec
Otávio, I want to put an perl script to do e-mail auditing and filtering, based in some user's rules (including e-mails forwarding, blocking, etc), inside amavisd-new process. Is a good choice put this script like an AV in @av_scanners ? Someone did something like this ? It is a reasonably

Re: [AMaViS-user] Connection refused (no pid problem)

2007-01-04 Thread Mark Martinec
[EMAIL PROTECTED] ~]# su - amavis /usr/sbin/amavisd /usr/sbin/amavisd: line 105: package: command not found /usr/sbin/amavisd: line 106: use: command not found /usr/sbin/amavisd: line 107: use: command not found /usr/sbin/amavisd: line 114: syntax error near unexpected token `('

Re: [AMaViS-user] Connection refused (no pid problem)

2007-01-04 Thread Mark Martinec
# su - amavis /usr/sbin/amavisd Should be: # su - amavis -c /usr/sbin/amavisd Mark - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your

Re: [AMaViS-user] Connection refused (no pid problem)

2007-01-04 Thread Mark Martinec
Salvatore, # su - amavis -c /usr/sbin/amavisd I haven't anybody error message but in log file I have always: (delivery temporarily suspended: connect to 127.0.0.1[127.0.0.1]: Connection refused) ..and after a few seconds: [EMAIL PROTECTED] ~]# ps -ax|grep amavisd # su - amavis -c

Re: [AMaViS-user] Connection refused (no pid problem)

2007-01-04 Thread Mark Martinec
Salvatore, ..this is output: [EMAIL PROTECTED] ~]# su - amavis -c '/usr/sbin/amavisd debug' Jan 4 16:29:21 mail /usr/sbin/amavisd[5336]: starting. /usr/sbin/amavisd at mail amavisd-new-2.3.1 (20050509), Unicode aware, LANG=it_IT.UTF-8 ... Jan 4 16:29:22 mail /usr/sbin/amavisd[5336]:

Re: [AMaViS-user] Amavisd-new: Why PRESERVING EVIDENCE for mail with inexistent domain of sender address?

2007-01-05 Thread Mark Martinec
Roberto, I have installed amavsid-new 2.4.4 with dual-instance sendmail (8.12.10). The configurations file of sendmail(rx and tx) istances are the same as described in README.sendmail-dual.txt document. My problem are incoming mail with domain of sender address nonexistent. I think that

Re: [AMaViS-user] New AV Scanner

2007-01-05 Thread Mark Martinec
Otávio, It is a reasonably good place for such a piece of code, the advantage is that it does not require any modifications to amavisd code. Drawback is that its status returns will be interpreted along the same rules as for other virus scanners (e.g. SA is not called for infected mail).

Re: [AMaViS-user] amavis: SA TIMED OUT

2007-01-05 Thread Mark Martinec
Oliver, Recently I get the following error message in my mail logs stating that SA TIMED OUT. Googeling for it I found messages dating from late 2005 mentioning a performance issue with the default database and they recommend a switch to mysql. Is this still the case? What are other

Re: [AMaViS-user] Error with bind address line 79 p0f-analyzer.pl

2007-01-06 Thread Mark Martinec
Jim, I starting p0f-analyzer.pl (and p0f) with runit (hint from ralph hildebrandt). I get these error. /usr/sbin/p0f-analyzer.pl line 79.?bind: Address already in use at Looks like one process with p0f-analyzer.pl is already running and you are trying to start another one? I`ve patched

Re: [AMaViS-user] REGEX bad on p0f rules. Causes FP

2007-01-08 Thread Mark Martinec
Michael, P0f is right, but regexp on sample rule causes false positive. Number is high enough that it almost always pushes total score 5. X-Amavis-OS-Fingerprint: Windows XP SP1+, 2000 SP3, (distance 11, link: System is confirmed to be a windows 2000 server, SP3. This rule is too broad:

Re: [AMaViS-user] Error with bind address line 79 p0f-analyzer.pl

2007-01-08 Thread Mark Martinec
Jim, Then there must be some other process using port 2345 for its own purpose. Search for it with netstat of lsof, e.g.: netstat -n -a | awk '$4~/[.:]2345$/' udp0 0 0.0.0.0:23450.0.0.0:* See! There is some process already sitting on port 2345. There can only

Re: [AMaViS-user] Net::Server: Accept failed

2007-01-08 Thread Mark Martinec
Shane, I've been using amavisd-new for quite some time and loving it. Today, I noticed that I wasn't receiving any e-mail. The outage started around noon my time. After some panicking, I think I've isolated it to amavisd-new and I think it has something to do with net::server. When I

Re: [AMaViS-user] Net::Server: Accept failed

2007-01-08 Thread Mark Martinec
Shane, I sure did. And, I'm not sure why. It's clearly labelled in the config that it isn't necessary. I think the problem was that I amavis had died previously and left an old socket file around? I set $unix_socketname = undef; $unix_socketname may be useful for amavisd-release. If you

Re: [AMaViS-user] what do you think of these queries?

2007-01-10 Thread Mark Martinec
Jeff, My question concerns the priority field. Based on my reading of a few README's it seems like the only purpose is as convenience to indicate how specific (or complete) the email address of interest is. Yes. It allows to consistently stick to a 'first match wins' paradigm (and the

Re: [AMaViS-user] /dev/null: Permission denied in 'file' calls

2007-01-10 Thread Mark Martinec
Anthony, Jan 10 09:44:42 panther amavis[16260]: (26708-17) (!!)run_command: child process [16260]: Can't open /dev/null: Permission denied at /.../amavisd line 2354. At the time that this happened, /dev/null was showing permissions of 0660. A temporary fix (and the one I employed in

Re: [AMaViS-user] Rejected count is wrong with mailgraph

2007-01-10 Thread Mark Martinec
Leon, I'm monitoring my system (Postfix+Cyrus+Amavisd-new: SA+ClamAV) with mailgraph, amavis-stats and pflogsumm (preprocessing logs before handing them to pflogsumm with prepflog.pl - http://web.tiscali.it/postfix/ to get more accurate results). My findings are: I don't have much experience

Re: [AMaViS-user] Mail Tagged SPAM with log stating Passed CLEAN !?

2007-01-11 Thread Mark Martinec
Some mail are tagged as Spam (in the header) BUT are not considered as spam when we have a look at amavisd log ?? They seemed to be marked as non spam mail. The choice between 'CLEAN' and 'SPAM' in the Passed CLEAN log entry is determined by kill_level of recipients (if any recipient of the

Re: [AMaViS-user] Mail Tagged SPAM with log stating Passed CLEAN !?

2007-01-11 Thread Mark Martinec
- just to make certain: the version of amavisd-new is 2.4.4 and comes from ports? - make doubly sure the subject tag was not already present on incoming mail; the to-level log entry can include original Subject string in the log entry, uncomment the line (remove first #) near the end of

Re: [AMaViS-user] Mail Tagged SPAM with log stating Passed CLEAN !?

2007-01-16 Thread Mark Martinec
bsd, This mail is sent from inside our network with a destination [EMAIL PROTECTED] // our client says that mail is tagged 2 times out of three wether sent from his local computer using Outlook or Mutt… This message went through two instances of amavisd, first at host mail1.ensta.fr (alias

Re: [AMaViS-user] spam_quarantine_to problem

2007-01-16 Thread Mark Martinec
Detlev, I'm trying something like: $spam_quarantine_to = new_RE( [EMAIL PROTECTED] = [EMAIL PROTECTED] [EMAIL PROTECTED] = [EMAIL PROTECTED] [EMAIL PROTECTED] = [EMAIL PROTECTED] ); While Gary's post does reply exactly to your question, I believe the original

Re: [AMaViS-user] amavis stops accepting connections

2007-01-18 Thread Mark Martinec
friiz, After 1 minutes of processing mail my amavis stops accepting connections nanny reports this PID 08733: A 0:02:08 =:=:=:= PID 19839: 19839-10 0:03:46 =:=:=:= PID 27980: A 0:03:29

Re: [AMaViS-user] amavis stops forwarding mail

2007-01-18 Thread Mark Martinec
friiz, PID 08733: A 0:02:08 =:=:=:= The indication above shows a stall during receiving of message by amavisd, between accepting a connection and start of processing... ... while the log below shows a stall during sending a message from amavisd back to Postfix.

Re: [AMaViS-user] local email marked as spam

2007-01-22 Thread Mark Martinec
Elvar, Gary's reply is to the point, unknown client IP address can currently not match any network in @mynetworks list, so loading a policy bank MYNETS is not available for mail submitted on the MTA host through sendmail/pickup. As the solution is a bit cumbersome (involving amavisd listening on

[AMaViS-user] First public pre-release (-pre2) of amavisd-new-2.4.5

2007-01-23 Thread Mark Martinec
A pre-release of amavisd-new-2.4.5 is available at: http://www.ijs.si/software/amavisd/amavisd-new-2.4.5-pre2.tar.gz The 2.4.5 is primarily a maintenance release, fixing known bugs and deficiencies of 2.4.4. It is expected to be the last release in the 2.4.x chain, and 2.5.0 is to follow

Re: [AMaViS-user] First public pre-release (-pre2) of amavisd-new-2.4.5

2007-01-23 Thread Mark Martinec
Gary, For those using Debian stable: Looks like I will have to upgrade Perl and therefore break out of 'stable' on my Debian Sarge system(s): Thanks for trying it out. ~# amavisd-new reload Problem in Amavis::Unpackers code: Convert::UUlib version 1.06 required--this is only version

Re: [AMaViS-user] [OT] Convert:UUlib on Debian

2007-01-24 Thread Mark Martinec
On Wednesday January 24 2007 06:36, Gary V wrote: [...], but at some point in the near future (when etch goes stable) we are all going to have to move to etch in order to keep our systems updated. ... or to some other OS or distribution that won't be giving you such headaches ... :) Mark

Re: [AMaViS-user] First public pre-release (-pre2) ofamavisd-new-2.4.5

2007-01-24 Thread Mark Martinec
Leon, Sometimes I wonder why we bother and keep writing software and preparing patches, especially with security-related stuff... You're right here. The problem is that it takes so much long for OS maintainers to release a new ver. For Suse for example, the latest version available is

Re: [AMaViS-user] Brand-new viruses, banned content and spamassassin

2007-01-24 Thread Mark Martinec
Giampaolo, What if I put PASS as the final destiny of banned content? Is the banned content checked against SA *and* defanged (in this order) before delivery? My setup specifies defanging for banned content. So, instead of using banned_file_lover setting, I should put D_PASS in the banned

Re: [AMaViS-user] add customer tag to Subject for $banned_quarantine_to mails?

2007-01-24 Thread Mark Martinec
Christian, Is it possible to add a customer tag in the subject for $banned_quarantine_to mails? My setup is: $banned_quarantine_to = [EMAIL PROTECTED]; Subject header fields in quarantined messages are never modified. Editing of Subject is only done on passed mail (and only to local

Re: [AMaViS-user] amavis and postfix policy

2007-01-24 Thread Mark Martinec
Rob, I noticed there's bits of code in amavis to allow it to act as a tcp_access map for postfix, but I'm not sure if this is complete. I was wondering if there's any chance that this might be developed to allow amavis to act as a policy server for postfix. In particular, I'd like to be

Re: [AMaViS-user] Brand-new viruses, banned content and spamassassin

2007-01-24 Thread Mark Martinec
Giampaolo, With 2.5.0 yes. I want it. No, I need it! :) Ok, tomorrow or maybe even today... Oh, by the way. Is it a per-user config, right? Which? Enabling defanging, *_lovers, blocking_ccat and such is per-user, but when defanging strikes it, it still currently applies the same message

Re: [AMaViS-user] amavis and postfix policy

2007-01-24 Thread Mark Martinec
Rob, I assume when you say there are no semantics you mean it's going to be hard to get AM.PDP to give the answers to Postfix I am looking for? The current code is very simple: sub postfix_policy($$$) { my($conn,$msginfo,$attr_ref) = @_; my(@response); if ($attr_ref-{'request'} ne

Re: [AMaViS-user] [SPAM] First public pre-release (-pre2) of amavisd-new-2.4.5

2007-01-24 Thread Mark Martinec
Vincent, If using p0f-analyzer, please switch soon to a version of p0f-analyzer.pl as supplied with 2.4.5-pre2 (or later). It fixes an endless-loop in p0f-analyzer.pl which happens if a p0f daemon crashes (piped to stdin of p0f-analyzer) or is manually terminated without also

Re: [AMaViS-user] First public pre-release (-pre2) of amavisd-new-2.4.5

2007-01-24 Thread Mark Martinec
myself writes: which may pose a small risk of DoS. Such attack is only possible from within your own networks, as a firewall or a router should already be discarding packets with your own network address coming from outside. Actually I'll be adding one more obstacle, just in case: -

Re: [AMaViS-user] First public pre-release (-pre2) of amavisd-new-2.4.5

2007-01-24 Thread Mark Martinec
Alan, Could you post a download link for p0f-analyzer? Then those who use it independently of amavisd-new (as if there would be any such person) or those where it is not included in an amavisd-new package e.g. Fedora rpm's, can easily get it. Ok, here it is:

Re: [AMaViS-user] First public pre-release (-pre2) of amavisd-new-2.4.5

2007-01-24 Thread Mark Martinec
Vincent, You mean like: --- p0f-analyzer.pl.orig2007-01-24 15:06:53.585900184 -0800 +++ p0f-analyzer.pl 2007-01-24 15:06:24.257358800 -0800 Yes, almost. See: http://www.ijs.si/software/p0f-analyzer.pl Mark

[AMaViS-user] A pre-release of amavisd-new-2.5.0

2007-01-25 Thread Mark Martinec
A pre-release of amavisd-new-2.5.0 is available at: http://www.ijs.si/software/amavisd/amavisd-new-2.5.0-pre1.tar.gz COMPATIBILITY WITH 2.4.5 The 2.5.0 is upwards compatible with 2.4.* versions. Nevertheless, default notification and logging templates are enhanced to take advantage of new

Re: [AMaViS-user] A pre-release of amavisd-new-2.5.0

2007-01-26 Thread Mark Martinec
friiz, i think i would be good to see an average timing of mail processing in amavisd-agent Indeed. I wanted to do this earlier, but the opportunity never came. Now with a jump to 2.5.0 I can afford to introduce 64-bit counters type in a snmp-like database (to cope with a millisecond time

Re: [AMaViS-user] Convert::UUlib 1.08 on Debian Sarge

2007-01-26 Thread Mark Martinec
Gary, uulib.c In file included from uulib.c:81: fptools.h:71: error: conflicting types for `FP_tempnam' /usr/include/stdio.h:197: error: previous declaration of `FP_tempnam' Does your system have a function mkstemp (a 'make temporary file name', in standard C library, declared probably in

[AMaViS-user] A release candidate of amavisd-new-2.4.5 is available

2007-01-26 Thread Mark Martinec
A release candidate of amavisd-new-2.4.5 is available at: http://www.ijs.si/software/amavisd/amavisd-new-2.4.5-rc1.tar.gz The 2.4.5 is a maintenance release, fixing known bugs and deficiencies in 2.4.4. Differences from 2.4.5-pre2 are minor: updated p0f-analyzer.pl, updated documentation

Re: [AMaViS-user] Convert::UUlib 1.08 on Debian Sarge

2007-01-27 Thread Mark Martinec
Btw, the main change from 1.06 to 1.08 is pretty much trivial: --- Convert-UUlib-1.06/uulib/uucheck.c Thu Mar 3 17:57:31 2005 +++ Convert-UUlib-1.08/uulib/uucheck.c Sat Dec 16 23:26:16 2006 @@ -1193,2 +1193,7 @@ + { +static uulist uulist_new; +*unew = uulist_new; /* zero-initialise

Re: [AMaViS-user] A release candidate of amavisd-new-2.4.5 is available

2007-01-27 Thread Mark Martinec
Martin, Problem in Amavis::Out::Pipe code: Bareword ESRCH not allowed while strict subs in use at (eval 42) line 133. You need use Errno qw(ESRCH); in Amavis::Out::Pipe. Thanks a lot, I'm glad you are protecting my back! Mark

Re: [AMaViS-user] Amavis and FuzzyOcr

2007-01-29 Thread Mark Martinec
Jeff, Done, and this did produce more output. FuzzyOcr is being called by the vscan user, and produces exactly the same log output as other users, with no errors. Still no scores from it in the headers for the vscan user. Does that give a clue? Is this the FuzzyOcr 2.3b from ports

Re: [AMaViS-user] how to retrieve a false positive spam

2007-01-29 Thread Mark Martinec
Troy, Aah, amavisd-release - that looks like what I am after. I'll look into that. Thanks. Your example would then be: amavisd-release spam-.gz ...assuming you have: $auth_required_release=0; See RELEASE_NOTES, search for: release from quarantine functionality is now a built-in

Re: [AMaViS-user] A release candidate of amavisd-new-2.4.5 is available

2007-01-30 Thread Mark Martinec
Ralf, Problem in Amavis::Out::Pipe code: Bareword ESRCH not allowed while strict subs in use at (eval 42) line 133. You need use Errno qw(ESRCH); in Amavis::Out::Pipe. Sorry, but I can't seem to find that. Has it already been fixed in today's download? ---

Re: [AMaViS-user] A release candidate of amavisd-new-2.4.5 is available

2007-01-30 Thread Mark Martinec
It only affects sites which use pipe on output, i.e. sendmail milter and courier setups. Ah, so this explains why amavisd-new didn't explode in my face :) ...and it also explains why I didn't notice it in the first place... Mark

Re: [AMaViS-user] amavisd-agent

2007-01-30 Thread Mark Martinec
Jan, I am trying to get some statistics from amavisd. Found amavisd-agent in my test-install. Is there a man page or documentation that describe this command? Especially the output? It seems some SNMP oid. Indeed SNMP oid lookalikes, these are statistics counters collected by amavisd child

Re: [AMaViS-user] amavisd-agent

2007-01-30 Thread Mark Martinec
...constantly being updated in a bsb database. (a typo) a bdb database that is, a Berkeley db, usually at /var/amavis/db/snmp.db Mark - Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay

Re: [AMaViS-user] nanny output

2007-01-30 Thread Mark Martinec
Hans, What do the columns of amavisd-nanny's output mean? PID 659604: 659604-01 0:00:00 PID xx Right, the process id of each amavisd child process. message-id? Right. The task id the process is currently working on, the same id also appears in the log. used time? Yes, elapsed

[AMaViS-user] ANNOUNCE: amavisd-new-2.4.5 RELEASED

2007-01-30 Thread Mark Martinec
amavisd-new-2.4.5 has been released, it is available at: http://www.ijs.si/software/amavisd/amavisd-new-2.4.5.tar.gz The 2.4.5 is primarily a maintenance release, fixing known bugs and deficiencies in 2.4.4. It is expected to be the last release in the 2.4.x chain, and 2.5.0 is to follow

Re: [AMaViS-user] can we get sql scores to match for virtusers?

2007-01-31 Thread Mark Martinec
Jo, Our environment = * Sendmail + virtusertable for aliasing * Amavisd + amavisd-milter + sql lookup of reject scores/whitelists/etc As it turns out, if a message comes in for say [EMAIL PROTECTED] which is virtuser(ed) to [EMAIL PROTECTED] then it doesn't match in the

Re: [AMaViS-user] Brand-new viruses, banned content and spamassassin

2007-01-31 Thread Mark Martinec
Henrik, Hi, 2.5.0-pre1 is running fine here. I've been looking this for an hour, but I can't figure it out. What exactly do I need to set to always make SPAM the deciding category over BANNED? It should be automatic. As long as recipient is a banned_lover (or banning checks are disabled

Re: [AMaViS-user] Brand-new viruses, banned content and spamassassin

2007-01-31 Thread Mark Martinec
for being spam. If the recipient is not a spam lover, then the DSN -banned rightfully reports the reject reason is a banned file, not spam. Mark - Using Tomcat but need to do

Re: [AMaViS-user] Keep processing messages when quarantine database is not available

2007-02-01 Thread Mark Martinec
Roy, I would like to know if there is a way to bypass @storage_sql_dsn when the database is offline, maybe a fallback storage method? The @storage_sql_dsn is a list of alternate storage methods. Entries that are not working are skipped, the one that does work is used (even if previous entries

Re: [AMaViS-user] $final_bad_header_destiny = D_BOUNCE still delivered !?!

2007-02-01 Thread Mark Martinec
Jan, Thanks. That worked. And now indeed the result was 'Blocked BAD-HEADER' as i expected it to work. Strange however that yesterday when i received an e-mail via the postfix mailinglist (Precedence: bulk), with exactly the same config as this test message, the result was 'Passed

Re: [AMaViS-user] AMaViS died after sophos ide update

2007-02-01 Thread Mark Martinec
Hans, With amavisd-new-2.4.0 and Sophie I experienced a few amavis break downs after the sophos ide update (eminstall.sh) in the last week. This never happened before. mail.log says: Jan 25 19:07:37 rzhs098 mail:notice amavis[421964]: (421964-08) Requesting process rundown due to stale

Re: [AMaViS-user] Brand-new viruses, banned content and spamassassin

2007-02-01 Thread Mark Martinec
Henrik, So if both CC_SPAM and CC_BANNED are hit, the one with D_DISCARD would be used. Yes, almost. Actually an equivalent of a search through the following list is performed (simplified a little, ignoring minor ccats and exotic values): CC_VIRUS, CC_BANNED, CC_SPAM, CC_SPAMMY, CC_BADH,

Re: [AMaViS-user] Net::Server: Group Not Defined.

2007-02-02 Thread Mark Martinec
after upgrading to amavisd-new version 2.4.5 i see following in amavisd logfile on startup: Net::Server: Group Not Defined. Defaulting to EGID '25 25' Net::Server: User Not Defined. Defaulting to EUID '5749' what is the difference to (of course defined) $daemon_user and

Re: [AMaViS-user] Random TEMPFAIL with amavis-milter postfix

2007-02-02 Thread Mark Martinec
Pedro, i've an AMD64-Debian installation with postfix and amavis-milter. I often obtain random TEMPFAIL errors ... i've tried debuging and googling around but just get an headache. I suspect that amavis passes a wrong parameter to amavis-milter... but i don't why. I have similar installation

Re: [AMaViS-user] blocked emails from msn/hotmail users who us Outlook/OE?

2007-02-02 Thread Mark Martinec
Larry, I just got a report of a blocked duplicate header Message-ID It appears that anyone who uses Microsoft's HTTP setup within Outlook, Outlook Express and Entrouge will get blocked with amavisd-new. My question is there a way to whitelist legit hotmail/msn users who use HTTP login

Re: [AMaViS-user] problem with filtering lists

2007-02-02 Thread Mark Martinec
Gregory, User A has a white list with email address [EMAIL PROTECTED] listed in his whitelist. When User A gets an email from jsmith, the email is sent straight through without a problem just like it should. However, when jsmith sends an email to User C, User B, and User A, the message is

Re: [AMaViS-user] problem with filtering lists

2007-02-02 Thread Mark Martinec
Greg, myself writes: Whitelisting ensures spam gets delivered to a recipient, and it did get delivered. Whitelisting does not turn off spam markings. Actually, whitelisting does also turn off spam markings in later versions of the program, although its primary purpose was just to ensure

<    6   7   8   9   10   11   12   13   14   15   >