[Declude.JunkMail] per-userl configuration
We have a distribution list that emails all employees. Can I specific by domain who can post to this list such as @clarksoncollege.edu users only? I am looking at the online help but vaguely remember seeing something like that sometime ago. ## Roger Schmeits Sr. Network Engineer 101 South 42nd St. Omaha, NE 68131 http://www.clarksoncollege.edu (402) 552-2542 Office (800) 647-5500 Toll Free ## Disclaimer: The information contained in this e-mail is privileged and confidential and is intended only for the use of the addressee(s) indicated above. Use or disclosure of information e-mailed in error is respectfully prohibited. If you have received this e-mail in error, please contact the sender and immediately delete the original message. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] phishing
What are people doing for phishing scams? We seem to be getting quite a few and was wondering what people do. Running declude 3.1.0 Imail 8.05 as a gateway. I have McAffee, f-prot Clamwin as scanners. Thanks. I heard some talk about clamdev ? or something like that -- did not pay much attention then , was not on the radar screen at the moment.. ## Roger Schmeits Sr. Network Engineer 101 South 42nd St. Omaha, NE 68131 http://www.clarksoncollege.edu (402) 552-2542 Office (800) 647-5500 Toll Free ## Disclaimer: The information contained in this e-mail is privileged and confidential and is intended only for the use of the addressee(s) indicated above. Use or disclosure of information e-mailed in error is respectfully prohibited. If you have received this e-mail in error, please contact the sender and immediately delete the original message. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
[Declude.JunkMail] vary large large files
We are getting very large dec.log logfiles on the spooler dir. In the neighborhood of 750 meg. Anybody seen this? The debug mode is not on and log level is set to low. LOGFILE e:\imail\spool\dec.log LOGLEVEL LOW #PID / PID DEBUG #EVENTLOG ON #LOG_OK NONE ## Roger Schmeits Sr. Network Engineer 101 South 42nd St. Omaha, NE 68131 http://www.clarksoncollege.edu (402) 552-2542 Office (800) 647-5500 Toll Free ## Disclaimer: The information contained in this e-mail is privileged and confidential and is intended only for the use of the addressee(s) indicated above. Use or disclosure of information e-mailed in error is respectfully prohibited. If you have received this e-mail in error, please contact the sender and immediately delete the original message.
RE: [Declude.JunkMail] vary large large files
We found it. There were some wrong paths in the global.cfg for some filters. It keet writing errors out to the decxxx.log file continuously hence the large log files. Thanks to David B. we came to a quick resolution. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Thursday, June 01, 2006 8:47 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] vary large large files Roger, Are you getting a lot of mail inbound (Dictionary attack, etc)? What is being shown in the logs? Can you post a snippet? Is anything else out of the norm(CPU, etc)? To generate 750MB logs on log level low something has to be going on.. Darrell --- fpReview - The easy way to review false positives for Declude... http://www.invariantsystems.com Schmeits, Roger writes: We are getting very large dec.log logfiles on the spooler dir. In the neighborhood of 750 meg. Anybody seen this? The debug mode is not on and log level is set to low. LOGFILE e:\imail\spool\dec.log LOGLEVEL LOW #PID / PID DEBUG #EVENTLOG ON #LOG_OK NONE ## Roger Schmeits Sr. Network Engineer 101 South 42nd St. Omaha, NE 68131 http://www.clarksoncollege.edu (402) 552-2542 Office (800) 647-5500 Toll Free ## Disclaimer: The information contained in this e-mail is privileged and confidential and is intended only for the use of the addressee(s) indicated above. Use or disclosure of information e-mailed in error is respectfully prohibited. If you have received this e-mail in error, please contact the sender and immediately delete the original message. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Left over D*.SM$ files in proc\work
Id turn on verbose logging in imail and declude. In the Declude log file something did not go quite right at 17:14:34:513. It looks like Imail is functioning ok but declude miss handled the email\attachment in question. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic Sent: Monday, January 23, 2006 4:30 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Left over D*.SM$ files in proc\work OK it finally happened. I got another leftover D*.SM$ file in the proc\work directory while I was running the logs on debug. Any thoughts? I think the following is the important part from various log files. I can post the whole thing if this is not enough. DECLUDE.LOG . . . 01/23/2006 17:14:34.497 q552537e400a4261c.smd Msg failed WEIGHT10 (Weight of 65 reaches or exceeds the limit of 10.). Action=""> 01/23/2006 17:14:34.497 q552537e400a4261c.smd Turning spam into an attachment 01/23/2006 17:14:34.513 q552537e400a4261c.smd Wrote 2025 bytes of attachment header 01/23/2006 17:14:34.513 q552537e400a4261c.smd Wrote 3142 (3142)bytes of attachment header 01/23/2006 17:14:34.513 q552537e400a4261c.smd Set process priority back to 38273056. 01/23/2006 17:14:34.513 q552537e400a4261c.smd Couldn't move/copy ATTACH data file [183] . . . 01/23/2006 17:14:34.935 q552537e400a4261c.smd MoveFile in AlterMessage - datafile = [D:\spool\proc\work\D552537e400a4261c.smd] TempFile = [D:\spool\proc\work\D552537e400a4261c.sm$] 01/23/2006 17:19:40.456 q552537e400a4261c.smd Couldn't rename SMD to SM$ [183]. Priority back to 32. Error String: [Cannot create a file when that file already exists.] [D:\spool\proc\work\D552537e400a4261c.smd] [D:\spool\proc\work\D552537e400a4261c.sm$] 01/23/2006 17:19:40.456 q552537e400a4261c.smd Data File [D:\spool\proc\work\D552537e400a4261c.smd] deleted. 01/23/2006 17:19:40.456 q552537e400a4261c.smd Recipient File [D:\spool\proc\work\q552537e400a4261c.smd] deleted. VIRUS.LOG . . . 01/23/2006 17:19:40.456 q552537e400a4261c.smd Couldn't rename SMD to SM$ [183]. Priority back to 32. Error String: [Cannot create a file when that file already exists.] [D:\spool\proc\work\D552537e400a4261c.smd] [D:\spool\proc\work\D552537e400a4261c.sm$] IMAIL.LOG 01:23 17:13 SMTPD(552537e400a4261c) [192.168.69.4] connect 85.182.54.161 port 1447 01:23 17:13 SMTPD(552537e400a4261c) [85.182.54.161] HELO e182054161.adsl.alicedsl.de 01:23 17:13 SMTPD(552537e400a4261c) [85.182.54.161] MAIL FROM: [EMAIL PROTECTED] 01:23 17:13 SMTPD(552537e400a4261c) [85.182.54.161] RCPT TO: [EMAIL PROTECTED] 01:23 17:14 SMTPD(552537e400a4261c) [85.182.54.161] RCPT TO: [EMAIL PROTECTED] 01:23 17:14 SMTPD(552537e400a4261c) [85.182.54.161] RCPT TO: [EMAIL PROTECTED] 01:23 17:14 SMTPD(552537e400a4261c) [85.182.54.161] RCPT TO: [EMAIL PROTECTED] 01:23 17:14 SMTPD(552537e400a4261c) [85.182.54.161] D:\spool\D552537e400a4261c.SMD 3142 Goran Jovanovic Omega Network Solutions From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (Lists) Sent: Saturday, January 21, 2006 2:10 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Left over D*.SM$ files in proc\work How often is this happening? Are you using Hijack? Put both the Junkmail and Virus logs into Debug until a couple of these occur, then extract from the log files ALL lines pertaining to the files in question into one file in exact time sequence along with the log lines from Imail SMTP. John T eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic Sent: Saturday, January 21, 2006 10:45 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] Left over D*.SM$ files in proc\work Hi, I have noticed that I am getting left over D*.SM$ files in the proc\work directory. I am getting 2 to 4 of these per day on a volume of 15-20K messages a day. Windows Server 2003 IMail 8.15 HF2 Declude 3.0.5.23 Sniffer, invURUBL, F-Prot, McAfee No on access Virus Scanner When I check the logs I find In the DECLUDE Log 01/21/2006 06:56:32.233 q1ffa301900405c91.smd Couldn't move/copy ATTACH data file [183] 01/21/2006 07:01:37.778 q1ffa301900405c91.smd Couldn't rename SMD to SM$ [183]. Priority back to 32. Error String: [Cannot create a file when that file already exists.] [D:\spool\proc\work\D1ffa301900405c91.smd] [D:\spool\proc\work\D1ffa301900405c91.sm$] And in the Virus log 01/21/2006 07:01:37.778 q1ffa301900405c91.smd Couldn't rename SMD to SM$ [183]. Priority back to 32. Error String: [Cannot create a file when that file already exists.] [D:\spool\proc\work\D1ffa301900405c91.smd] [D:\spool\proc\work\D1ffa301900405c91.sm$] Other times I will only find this message in the DECLUDE.LOG file. 01/15/2006 19:21:39.160 qe70539e800a6f12a.smd Couldn't move/copy ATTACH data file [32] Anyone have any ideas about this? Thanks Goran
RE: [Declude.JunkMail] OT: Imail / Declude as a front end for Exchange
Sounds like you need to dig thru the Internet Mail Connector on the Exch2003 box and set up routing for your domain. Look in routing groups. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Shadix Sent: Wednesday, July 20, 2005 11:02 AM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] OT: Imail / Declude as a front end for Exchange I have an Exchange 2003 server setup using my domain name trhs.org. I added an SMTP recipient policy for email.trhs.org and created an alias on the Imail server to forward mail to email.trhs.org. I also added email.trhs.org to the hosts file. The Imail server sends the message to the Exchange server but Exchange rejects it unless the primary SMTP address is email.trhs.org. If anyone can help me figure out what I'm missing I'd appreciate it greatly. Dan Shadix --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] user settings
I have an email address that constantly get spam. The former owner is no longer with us. Currently Imail Declude are acting as a gateway to a back-end Imail and Exchange server. How does one go about killing this email address at the gateway level? Please note that we handle a couple different domains, mainly clarksoncollege.edu and one for the students and alumni members. Thanks. RS
RE: [Declude.JunkMail] Any word on the 2.06 release?
Unless I missed (which I may have) I never heard any news about that hand off other that Scott was leaving. I guess my main concern is there enough personal in the company to keep the energy going and keep the fires lit. I like Declude and this it's a very good product . Thanks for the info. -Original Message- From: John Tolmachoff (Lists) [mailto:[EMAIL PROTECTED] Sent: Thursday, March 17, 2005 1:56 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Any word on the 2.06 release? Can we assume the company you started is in good hands? How is there developer staff? To they understand the process? While I am not Scott (don't have big enough shoes) I know that Scott cares way too much about Declude and SPAM and e-mail to trust the company to someone without knowing it is in good hands. We had all gotten use to Scott being able to jump in there and do this or that in record time. However, there is an inherent problem with that, which is not to say anything against Scott. Things can get messy. Sometimes even in our own work we do things for a period of time by fix this and fix that and add this and that and so forth that a time comes when we have to sit back and say whoa, it now looks like a birds nest and you have to almost pull everything apart and clean it from the bottom up or visa versa. Declude grew way beyond I think what Scott originally envisioned, and that is too his credit. I have known for some time that the base code was getting to a point that it was either going to be rebuilt or pull all the wires out and start with new wires. That is essentially IMO what version 2.0 did. Now, I am nobody compared to some of the others on this list, but I think a lot of credit has to go to Scott for not only leading Declude to what it is today, but for also bringing in new help and ideas. Although I have never meet Scott personally, I have to say that he is a very big man for passing the responsibility of maintaining, improving and building upon the foundation he has laid to others. I have full confidence in Barry on down in that they will continue to make Declude the best SPAM and VIRUS filtering software there is for e-mail. Thanks Scott for all your hard work. (And thanks to those interns as well. [Inside joke some may remember.]) John Tolmachoff Engineer/Consultant/Owner eServices For You --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Any word on the 2.06 release?
Can we assume the company you started is in good hands? How is there developer staff? To they understand the process? -Original Message- From: R. Scott Perry [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 16, 2005 3:15 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Any word on the 2.06 release? Agreed on Scott leaving. And what's up with that anyway? There was news article I noticed on their site a few weeks ago stating something about Scott leaving because he wanted to spend more time working for the Red Cross? Correct. :) The new article was http://www.declude.com/Articles.asp?ID=150, and it was short and sweet. Basically, I needed a break. I had been putting so much time into Declude over the past close to 5 years that I didn't have time to do some of the things that I wanted to, such as volunteering at the Red Cross. Before I started Declude, I was a very active volunteer on their local Disaster Action Team, responding to hundreds of local disasters (typically house fires, but occasionally other things such as floods, hazardous materials incidents, even a hostage situation once). It was very rewarding, and while I've managed to go to their monthly meetings over these years, I haven't had a chance to go to the local disasters, and I have really missed it. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] invURIBL 2.0 Released (URI Filtering)
How this compare against micro tech products? Just curious... -Original Message- From: Darrell ([EMAIL PROTECTED]) [mailto:[EMAIL PROTECTED] Sent: Monday, March 14, 2005 10:32 PM To: Declude.JunkMail@declude.com Subject: [Declude.JunkMail] invURIBL 2.0 Released (URI Filtering) We have just released version 2.0 of invURIBL. Version 2.0 extends basic URI filtering functionality by incorporating features that will allow you to check the URI's IP address and name servers against DNS based blacklists. In addition, we have added a unique feature that allows you to check the URI's IP address and remote mail server against Senderbase, the world's leading email traffic monitoring network. We have found that the new features we have added are very effective at catching new sources of spam that would normally go undetected. In addition we have also added many other features like bitmask handling, sender whitelist files, URI skip lists, max weighting, custom skip options, and many other features. For those that are using version 1.0 please look over this release very carefully as everything has changed from the Declude command line that goes into your Global.cfg to the invURIBL.exe.Config file. You can download the new version from http://www.invariantsystems.com/invuribl/default.htm Any questions please let me know, Darrell --- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] tweaking
Greetings: We are new users of junkman man and was looking for friendly advise on how to manage this beast. In running of only one day we have seen a large drop in spam (40%). But I would like to use blacklists and and others features unknown to me. Would people like to post there cfg file for viewing?? Any suggestions? Thanks. ## Roger Schmeits Sr. Network Engineer Clarkson College http://www.clarksoncollege.edu (402) 552-2542 ## Disclaimer: The information contained in this e-mail is privileged and confidential and is intended only for the use of the addressee(s) indicated above. Use or disclosure of information e-mailed in error is respectfully prohibited. If you have received this e-mail in error, please contact the sender and immediately delete the original message. Thank you.
[Declude.JunkMail] tools/weights
http://www.declude.com/Articles.asp?ID=100 There are numerous tools on this page. Are there favorites? Dogs? Question: In the manual it talks about assigning weights for blacklists. Example Testname fromfile c:\imail\declude\badpeople.txt x 5 0 Would some explain the purpose of the placeholder and the two weights? Is this a standard format through declude files? I am the learning mode... ## Roger Schmeits Sr. Network Engineer Clarkson College http://www.clarksoncollege.edu (402) 552-2542 ## Disclaimer: The information contained in this e-mail is privileged and confidential and is intended only for the use of the addressee(s) indicated above. Use or disclosure of information e-mailed in error is respectfully prohibited. If you have received this e-mail in error, please contact the sender and immediately delete the original message. Thank you.
