lists.mailscanner.infolists.mailscanner.info/pipermail/mailscanner/2010-january.txtseems to me (and...

Dear all,

Happy New Year!

Just a quick note about a bug noted on the SpamAssassin list: you mightwant to set FH_DATE_PAST_20XX to have a score of zero, or edit the rule,as it currently applies to all mail sent in 2010. The rule adds a score of3.19 to messages by default, so could easily cause false positives forslightly-spammy messages sent this year.

Best wishes,

Anthony-- www.fonant.com - Quality web sitesFonant Ltd is registered in England and Wales, company No. 7006596Registered office: Grafton Lodge, 15 Grafton Road, Worthing, West Sussex,BN11 1QR

-----BEGIN PGP SIGNED MESSAGE-----Hash: SHA1

Best wishes to everyone,

I just got quite a few messages with this extra tag:FH_DATE_PAST_20XX 3.19

So if you miss some messages today they may have baen shot down due tothe extra 3.19 points.

Hugo.

- -- [email protected] http://hugo.vanderkooij.org/PGP/GPG? Use: http://hugo.vanderkooij.org/0x58F19981.asc

A: Yes.>Q: Are you sure?>>A: Because it reverses the logical flow of conversation.>>>Q: Why is top posting frowned upon?

Bored? Click on http://spamornot.org/ and rate those images.-----BEGIN PGP SIGNATURE-----Version: GnuPG v1.4.10 (GNU/Linux)Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAks9yfoACgkQBvzDRVjxmYE8VgCfU+C/80vPtOIF4IDd2Krxp3Bsl2AAoKMuXm9TGozciuQXUw2J6dN9+ULN=e3cA-----END PGP SIGNATURE-----

La data 2010 non viene rilevata correttamente da Spamassassin, quindi ? stato necessario eseguire una riconfigurazione dei server SMTP in attesa del fix definitivo

Saluti

AB--

*SKYNET S.r.l.* - *Piazza XXV Aprile 14 - 28021 Borgomanero (No)*

*tel. +39 0322-836487/834765 - fax +39 0322-836608 - www.skynet-srl.com*

Autorizzazione Ministeriale n.197

Le informazioni contenute in questo messaggio sono riservate e confidenziali ed ? vietata la diffusione in qualunque modo eseguita. Qualora Lei non fosse la persona a cui il presente messaggio ? destinato, La invitiamo ad eliminarlo e a non leggerlo, dandocene gentilmente comunicazione. Per qualsiasi informazione si prega di contattare (e-mail dell'azienda). Rif. D.L. 196/2003

-------------- next part --------------An HTML attachment was scrubbed...URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20100101/63501e26/attachment.html

On 01/01/10 04:05, Alessandro Bianchi wrote:> La data 2010 non viene rilevata correttamente da Spamassassin, quindi ? > stato necessario eseguire una riconfigurazione dei server SMTP in attesa > del fix definitivo> > Saluti> > AB>

Google translate said:

"The date 2010 is not detected correctly by SpamAssassin, so it was necessary to perform a reconfiguration of the SMTP server waiting for final fix"

in local.cf :

score FH_DATE_PAST_20XX 0.0

that should fix the problem / che dovrebbe risolvere il problema

that rule will be fixed/replaced but don't wait for it -score to 0 asap.

Alex

-----BEGIN PGP SIGNED MESSAGE-----Hash: SHA1

On 01/01/10 16:05, Alessandro Bianchi wrote:> La data 2010 non viene rilevata correttamente da Spamassassin, quindi ?> stato necessario eseguire una riconfigurazione dei server SMTP in attesa> del fix definitivo

Any change of posting this in plain English?

Hugo.

- -- [email protected] http://hugo.vanderkooij.org/PGP/GPG? Use: http://hugo.vanderkooij.org/0x58F19981.asc

A: Yes.>Q: Are you sure?>>A: Because it reverses the logical flow of conversation.>>>Q: Why is top posting frowned upon?

Bored? Click on http://spamornot.org/ and rate those images.-----BEGIN PGP SIGNATURE-----Version: GnuPG v1.4.10 (GNU/Linux)Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAks+EuMACgkQBvzDRVjxmYF7ZACcDPDLgF/p6/vc08MCWeo+L+g4t44Anii2lKqpF/9yxcwoYOo025O1ihOz=AM5F-----END PGP SIGNATURE-----

Alex Broens wrote:> On 01/01/10 04:05, Alessandro Bianchi wrote:>> La data 2010 non viene rilevata correttamente da Spamassassin, quindi >> ? stato necessario eseguire una riconfigurazione dei server SMTP in >> attesa del fix definitivo>>>> Saluti>>>> AB>>>> Google translate said:>> "The date 2010 is not detected correctly by SpamAssassin, so it was > necessary to perform a reconfiguration of the SMTP server waiting for > final fix">> in local.cf :>> score FH_DATE_PAST_20XX 0.0>> that should fix the problem / che dovrebbe risolvere il problema>> that rule will be fixed/replaced but don't wait for it -> score to 0 asap.>> Alex

Note: I was still seeing some of these after applying the above fix. It turns out that I also had to remove the spamassassin cache used by MailScanner. I issued the following while MailScanner was down.

> rm -fr /var/spool/MailScanner/incoming/SpamAssassin*

--Rich

--

Obstacles are those frightening things we see when we takeour eyes off our goal.

Henry Ford

Just Run

sa-update and it will be fixed

Lance

On 01/01/2010 03:48 PM, Richard Lynch wrote:> Alex Broens wrote:>> On 01/01/10 04:05, Alessandro Bianchi wrote:>>> La data 2010 non viene rilevata correttamente da Spamassassin, quindi>>> ? stato necessario eseguire una riconfigurazione dei server SMTP in>>> attesa del fix definitivo>>>>>> Saluti>>>>>> AB>>>>>>> Google translate said:>>>> "The date 2010 is not detected correctly by SpamAssassin, so it was>> necessary to perform a reconfiguration of the SMTP server waiting for>> final fix">>>> in local.cf :>>>> score FH_DATE_PAST_20XX 0.0>>>> that should fix the problem / che dovrebbe risolvere il problema>>>> that rule will be fixed/replaced but don't wait for it ->> score to 0 asap.>>>> Alex>> Note: I was still seeing some of these after applying the above fix. It> turns out that I also had to remove the spamassassin cache used by> MailScanner. I issued the following while MailScanner was down.>> > rm -fr /var/spool/MailScanner/incoming/SpamAssassin*>>> --Rich>

-- This message has been scanned for viruses anddangerous content by MailScanner, and isbelieved to be clean.

Hello,

There seems to be more taint mode related problems in the latest versionof MS. As of now, most of emails with attachments are unable to processand I'm at a loss on how to fix this as i am not a perl programmer.

When running in debug mode the following error is shown.

This is perl, v5.8.9 built for amd64-freebsd

---Building a message batch to scan...Have a batch of 1 message.Insecure dependency in open while running with -T switch at/usr/local/lib/perl5/site_perl/5.8.9/mach/IO/File.pm line 185./usr/local/etc/rc.d/mailscanner: WARNING: failed to start mailscanner---

I tried to manually hack File.pm and added a function to untaint the fileopen function. This worked, however it triggered another taint mode errorinside of MS itself.

---Insecure dependency in chown while running with -T switch at/usr/local/lib/MailScanner/MailScanner/Message.pm line 2505.---

If someone could help i would greatly appreciate it, I'm sure otherFreeBSD users will be experiencing this too.

Thanks.

Ok guys I really need help with this one. I have 7 boxes running the old 4.78 with out an issue and clamd the newest clamd on ubuntu 9.04 and now also 1 box running 7.49 on ubuntu 9.10 with newest clamd. I have made all sorts of changes to clamd permissions. As of right now I have clamd using the Unix socket (same as the other 7 boxes, but the rest of the prefences are not) running as primary group under root, also with /var/spool/Mailscanner/incoming permissions set in the Mailscanner.conf as user=postfix group=clamav and permissions=0777 now i know i shouldn't have permissions set to 0777 for security issues, but every time I run Mailscanner --lint on the ubuntu 9.10 box i get clamd permission denied error when it scans the file. I am hoping someone has an idea as to what is causing this. I have also restarted both services.

Garrod M. AlwoodConsultantgarrod.alwood@lorodoes.com904.738.4988-------------- next part --------------An HTML attachment was scrubbed...URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20100104/76c90521/attachment.html

Please repost this as a new message and not as a reply. No, replying with a changed subject is *not* a new message.When you do this, you may want to consider enhancing readability of your message.

Kai

-- Kai Sch?tzl, Berlin, GermanyGet your web at Conactive Internet Services: http://www.conactive.com


Garrod M. AlwoodConsultantgarrod.alwood@lorodoes.com904.738.4988-------------- next part --------------An HTML attachment was scrubbed...URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20100104/3d09baf6/attachment.html

cancel that. I found the issue. It was apparmor stopping it. I thought I had removed it but I guess not. Thank all of you for your help.

Garrod M. [email protected]________________________________From: [email protected] [[email protected]] On Behalf Of Garrod M. Alwood [[email protected]]Sent: Monday, January 04, 2010 12:54 PMTo: MailScanner discussionSubject: Clamd issue


Garrod M. AlwoodConsultantgarrod.alwood@lorodoes.com904.738.4988-------------- next part --------------An HTML attachment was scrubbed...URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20100104/64e8fe46/attachment.html

Anthony Cartmell wrote:> Dear all,> > Happy New Year!> > Just a quick note about a bug noted on the SpamAssassin list: you> might want to set FH_DATE_PAST_20XX to have a score of zero, or edit> the rule, as it currently applies to all mail sent in 2010. The rule> adds a score of > 3.19 to messages by default, so could easily cause false positives> for slightly-spammy messages sent this year.

As noted, sa_update will cure those ills, but a manual fix is easy too. Just cd to/var/lib/spamassassin/3.002005/updates_spamassassin_org/ then in 72_active.cf change: 72_active.cf:header FH_DATE_PAST_20XX Date =~ /20[1-9][0-9]/ [if-unset: 2006]To: 72_active.cf:header FH_DATE_PAST_20XX Date =~ /20[2-9][0-9]/ [if-unset: 2006]

Watch the line wrap. In short, change the [1-9] to [2-9]...

...Kevin-- Kevin Miller Registered Linux User No: 307357CBJ MIS Dept. Network Systems Admin., Mail Admin.155 South Seward Street ph: (907) 586-0242Juneau, Alaska 99801 fax: (907 586-4500

> As noted, sa_update will cure those ills, but a manual> fix is easy too. Just cd to> /var/lib/spamassassin/3.002005/updates_spamassassin_org/> then in 72_active.cf change:> 72_active.cf:header FH_DATE_PAST_20XX Date =~> /20[1-9][0-9]/ [if-unset: 2006]> To:> 72_active.cf:header FH_DATE_PAST_20XX Date =~> /20[2-9][0-9]/ [if-unset: 2006]

> Watch the line wrap. In short, change the [1-9] to> [2-9]...

Seems to me (and I'm not a programming in any sense of the word) that this fix is incomplete. the 2-9 means anything in this decade will be considered ok. Seems like a second rule to include 201[1-9] is needed.

-- This message has been scanned for viruses anddangerous content by MailScanner, and isbelieved to be clean.

Alternatively, you may want to try the method described here:

http://www.heise.de/newsticker/foren/S-Das-Peinliche-daran-ist/forum-171865/msg-17874835/read/

The post is in German, but the code is pretty self explanatory

Patrick

Kevin Miller wrote, On 04/01/10 20:15:> Anthony Cartmell wrote:> >> Dear all,>>>> Happy New Year!>>>> Just a quick note about a bug noted on the SpamAssassin list: you>> might want to set FH_DATE_PAST_20XX to have a score of zero, or edit>> the rule, as it currently applies to all mail sent in 2010. The rule>> adds a score of >> 3.19 to messages by default, so could easily cause false positives>> for slightly-spammy messages sent this year. >> > As noted, sa_update will cure those ills, but a manual fix is easy too. Just cd to> /var/lib/spamassassin/3.002005/updates_spamassassin_org/ then in 72_active.cf change:> 72_active.cf:header FH_DATE_PAST_20XX Date =~ /20[1-9][0-9]/ [if-unset: 2006]> To:> 72_active.cf:header FH_DATE_PAST_20XX Date =~ /20[2-9][0-9]/ [if-unset: 2006]>> Watch the line wrap. In short, change the [1-9] to [2-9]...>>> ...Kevin>

Actually, the rule will get removed.

Kai

-- Kai Sch?tzl, Berlin, GermanyGet your web at Conactive Internet Services: http://www.conactive.com

Is there an easy way to tell what directory SpamAssassin / MailScanner is using for rules? I have two copies of that particular rule file with the version under /var/lib/spamassassin/3.002004/updates_spamassassin_org being updated and a version under /usr/share/spamassassin not being updated. MailScanner services have been restarted, SpamAssassin caches dumped and multiple sa-updates have been run.

-Norman

-----Original Message-----From: [email protected] [mailto:[email protected]] On Behalf Of Kevin MillerSent: Monday, January 04, 2010 1:15 PMTo: 'MailScanner discussion'Subject: RE: FH_DATE_PAST_20XX false positives

Anthony Cartmell wrote:> Dear all,> > Happy New Year!> > Just a quick note about a bug noted on the SpamAssassin list: you> might want to set FH_DATE_PAST_20XX to have a score of zero, or edit> the rule, as it currently applies to all mail sent in 2010. The rule> adds a score of > 3.19 to messages by default, so could easily cause false positives> for slightly-spammy messages sent this year.

As noted, sa_update will cure those ills, but a manual fix is easy too. Just cd to/var/lib/spamassassin/3.002005/updates_spamassassin_org/ then in 72_active.cf change: 72_active.cf:header FH_DATE_PAST_20XX Date =~ /20[1-9][0-9]/ [if-unset: 2006]To: 72_active.cf:header FH_DATE_PAST_20XX Date =~ /20[2-9][0-9]/ [if-unset: 2006]

Watch the line wrap. In short, change the [1-9] to [2-9]...

...Kevin-- Kevin Miller Registered Linux User No: 307357CBJ MIS Dept. Network Systems Admin., Mail Admin.155 South Seward Street ph: (907) 586-0242Juneau, Alaska 99801 fax: (907 586-4500-- MailScanner mailing [email protected]://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!

"MailScanner --debug-sa" will tell you what SpamAssassin is up to. You can also run --debug with spamassassin command-line tool, but to be really sure what MailScanner is doing, use the MailScanner command. I just found out that I had messed up my MailScanner config and it was doing things differently than the command-line issued spamassassin command.

-- Derek

On Jan 4, 2010, at 2:41 PM, Laskie, Norman wrote:> Is there an easy way to tell what directory SpamAssassin / MailScanner is using for rules? I have two copies of that particular rule file with the version under /var/lib/spamassassin/3.002004/updates_spamassassin_org being updated and a version under /usr/share/spamassassin not being updated. MailScanner services have been restarted, SpamAssassin caches dumped and multiple sa-updates have been run.> > -Norman> > > -----Original Message-----> From: [email protected] [mailto:[email protected]] On Behalf Of Kevin Miller> Sent: Monday, January 04, 2010 1:15 PM> To: 'MailScanner discussion'> Subject: RE: FH_DATE_PAST_20XX false positives> > Anthony Cartmell wrote:>> Dear all,>> >> Happy New Year!>> >> Just a quick note about a bug noted on the SpamAssassin list: you>> might want to set FH_DATE_PAST_20XX to have a score of zero, or edit>> the rule, as it currently applies to all mail sent in 2010. The rule>> adds a score of >> 3.19 to messages by default, so could easily cause false positives>> for slightly-spammy messages sent this year. > > As noted, sa_update will cure those ills, but a manual fix is easy too. Just cd to> /var/lib/spamassassin/3.002005/updates_spamassassin_org/ then in 72_active.cf change:> 72_active.cf:header FH_DATE_PAST_20XX Date =~ /20[1-9][0-9]/ [if-unset: 2006]> To:> 72_active.cf:header FH_DATE_PAST_20XX Date =~ /20[2-9][0-9]/ [if-unset: 2006]> > Watch the line wrap. In short, change the [1-9] to [2-9]...> > > ...Kevin> -- > Kevin Miller Registered Linux User No: 307357> CBJ MIS Dept. Network Systems Admin., Mail Admin.> 155 South Seward Street ph: (907) 586-0242> Juneau, Alaska 99801 fax: (907 586-4500-- > MailScanner mailing list> [email protected]> http://lists.mailscanner.info/mailman/listinfo/mailscanner> > Before posting, read http://wiki.mailscanner.info/posting> > Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list> [email protected]> http://lists.mailscanner.info/mailman/listinfo/mailscanner> > Before posting, read http://wiki.mailscanner.info/posting> > Support MailScanner development - buy the book off the website! >

2010/1/4 Laskie, Norman :> Is there an easy way to tell what directory SpamAssassin / MailScanner is using for rules? ?I have two copies of that particular rule file with the version under /var/lib/spamassassin/3.002004/updates_spamassassin_org being updated and a version under /usr/share/spamassassin not being updated. ?MailScanner services have been restarted, SpamAssassin caches dumped and multiple sa-updates have been run.>> -Norman>As Derek notes there is a "MailScanner --debug --debug-sa" that willtell you *everything*;-). If it still scores the bad rule, perhapsyou've been running sa-update by hand and either forgot to sa-compileafter the sa-update, or perhaps forgot to do "service MailScannerreload" to make MS copy of SA aware of the changes ... All this isdone by Jules update_spamassassin tool...;)

Cheers-- -- Glennemail: glenn < dot > steen < at > gmail < dot > comwork: glenn < dot > steen < at > ap1 < dot > se

On 04/01/2010 15:59, Mike Jakubik wrote:> Hello,>> There seems to be more taint mode related problems in the latest version> of MS. As of now, most of emails with attachments are unable to process> and I'm at a loss on how to fix this as i am not a perl programmer.>> When running in debug mode the following error is shown.>> This is perl, v5.8.9 built for amd64-freebsd>> ---> Building a message batch to scan...> Have a batch of 1 message.> Insecure dependency in open while running with -T switch at> /usr/local/lib/perl5/site_perl/5.8.9/mach/IO/File.pm line 185.> /usr/local/etc/rc.d/mailscanner: WARNING: failed to start mailscanner> --->> I tried to manually hack File.pm and added a function to untaint the file> open function. This worked, however it triggered another taint mode error> inside of MS itself.>> ---> Insecure dependency in chown while running with -T switch at> /usr/local/lib/MailScanner/MailScanner/Message.pm line 2505.> --->> If someone could help i would greatly appreciate it, I'm sure other> FreeBSD users will be experiencing this too.>> Thanks.>

Hi,

Try upgrading perl to 'perl-5.10.1' and make sure you are using at least MailScanner version 'MailScanner-4.79.4' (both from ports). You should find that the taint mode problem goes away.

Regards,mog

Hello,

I'm using FreeBSD, and I had the same error, after some days on themailwatch list they solved it.

You need perl 5.8.8 < this is what I'm using right now and it's workingOr perl 5.10.0

I tried 5.10.1 but it wasn't working!

Regards,

Bal?zs.

2010/1/5 mog

> On 04/01/2010 15:59, Mike Jakubik wrote:>>> Hello,>>>> There seems to be more taint mode related problems in the latest version>> of MS. As of now, most of emails with attachments are unable to process>> and I'm at a loss on how to fix this as i am not a perl programmer.>>>> When running in debug mode the following error is shown.>>>> This is perl, v5.8.9 built for amd64-freebsd>>>> --->> Building a message batch to scan...>> Have a batch of 1 message.>> Insecure dependency in open while running with -T switch at>> /usr/local/lib/perl5/site_perl/5.8.9/mach/IO/File.pm line 185.>> /usr/local/etc/rc.d/mailscanner: WARNING: failed to start mailscanner>> --->>>> I tried to manually hack File.pm and added a function to untaint the file>> open function. This worked, however it triggered another taint mode error>> inside of MS itself.>>>> --->> Insecure dependency in chown while running with -T switch at>> /usr/local/lib/MailScanner/MailScanner/Message.pm line 2505.>> --->>>> If someone could help i would greatly appreciate it, I'm sure other>> FreeBSD users will be experiencing this too.>>>> Thanks.>>>>>>> Hi,>> Try upgrading perl to 'perl-5.10.1' and make sure you are using at least> MailScanner version 'MailScanner-4.79.4' (both from ports). You should find> that the taint mode problem goes away.>> Regards,> mog>> --> MailScanner mailing list> [email protected]> http://lists.mailscanner.info/mailman/listinfo/mailscanner>> Before posting, read http://wiki.mailscanner.info/posting>> Support MailScanner development - buy the book off the website!>-------------- next part --------------An HTML attachment was scrubbed...URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20100105/73a8b5ba/attachment.html

Patrick Vande Walle wrote:> Alternatively, you may want to try the method described here:> > http://www.heise.de/newsticker/foren/S-Das-Peinliche-daran-ist/forum-171865/msg-17874835/read/> > The post is in German, but the code is pretty self explanatory> > Patrick>

It strikes me as a bad idea to use the FH_DATE_PAST_20XX rule name for a completely different rule. I think it would be better to score the official FH_DATE_PAST_20XX to zero in your local.cf and just define a new rule using the better algorithm. That should avoid problems with sa-update overwriting your new version too.

Regards,

Richard Siddall

Thanks for the info. We are using the update_spamassassin tool via cron, but after running MailScanner --debug --debug-sa to me it appears that MailScanner / SpamAssassin isn't picking up the updated rules from /var/lib/spamassassin/3.002004/updates_spamassassin_org. Running spamassassin in debug mode shows that it is using the updates directory.

MailScanner --debug --debug-sa:06:36:33 [14115] dbg: config: using "/usr/share/spamassassin" for sys rules pre files06:36:33 [14115] dbg: config: using "/usr/share/spamassassin" for default rules dir

spamassassin -D --lint 2>&1:[1032] dbg: config: using "/var/lib/spamassassin/3.002004" for sys rules pre files[1032] dbg: config: using "/var/lib/spamassassin/3.002004" for default rules dir

As a disclaimer we are running an older version of MailScanner (This is Red Hat Enterprise Linux Server release 5.3 (Tikanga), This is Perl version 5.008008 (5.8.8), This is MailScanner version 4.69.9)

-Norman

-----Original Message-----From: [email protected] [mailto:[email protected]] On Behalf Of Glenn SteenSent: Tuesday, January 05, 2010 2:06 AMTo: MailScanner discussionSubject: Re: FH_DATE_PAST_20XX false positives


Cheers-- -- Glennemail: glenn < dot > steen < at > gmail < dot > comwork: glenn < dot > steen < at > ap1 < dot > se-- MailScanner mailing [email protected]://lists.mailscanner.info/mailman/listinfo/mailscanner



On 05/01/2010 12:49, Bal?zs M?t?ffy wrote:> Hello,>> I'm using FreeBSD, and I had the same error, after some days on the > mailwatch list they solved it.>> You need perl 5.8.8 < this is what I'm using right now and it's working> Or perl 5.10.0>> I tried 5.10.1 but it wasn't working!>>> Regards,>> Bal?zs.

Hi,

When you tried 5.10.1, what version of MailScanner were you using?

mog

Hi,

The Latest stable from the freebsd ports tree at that time.

MailScanner-4.78.17

2010/1/5 mog

> On 05/01/2010 12:49, Bal?zs M?t?ffy wrote:>>> Hello,>>>> I'm using FreeBSD, and I had the same error, after some days on the>> mailwatch list they solved it.>>>> You need perl 5.8.8 < this is what I'm using right now and it's working>> Or perl 5.10.0>>>> I tried 5.10.1 but it wasn't working!>>>>>> Regards,>>>> Bal?zs.>>>>> Hi,>> When you tried 5.10.1, what version of MailScanner were you using?>> mog>-------------- next part --------------An HTML attachment was scrubbed...URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20100105/67d7a228/attachment.html

Hi

I got troubles with this filename/-type checking.

What I want is, that simple .exe or .dll files are not delivered. But IfI put them into a ZIP or RAR file they should pass.

I tried setting the path to the rar and gzip commands to "empty", Itried setting the filetype "executable" in the rules file to allowed....Useless, I can't send my mail.

Can somebody tell me how to configure MailScanner like that ?

Thank you

-------------- next part --------------An HTML attachment was scrubbed...URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20100105/f7692ce7/attachment.html

Ya, you need to use MailScanner-4.79.4 which was available a couple weeks ago from ports. It will work then.

mog

On 05/01/2010 13:44, Bal?zs M?t?ffy wrote:> Hi,>> The Latest stable from the freebsd ports tree at that time.>> MailScanner-4.78.17>> 2010/1/5 mog >> On 05/01/2010 12:49, Bal?zs M?t?ffy wrote:>> Hello,>> I'm using FreeBSD, and I had the same error, after some days> on the mailwatch list they solved it.>> You need perl 5.8.8 < this is what I'm using right now and> it's working> Or perl 5.10.0>> I tried 5.10.1 but it wasn't working!>>> Regards,>> Bal?zs.>>>> Hi,>> When you tried 5.10.1, what version of MailScanner were you using?>> mog>>-------------- next part --------------An HTML attachment was scrubbed...URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20100105/96c856eb/attachment.html

Thanks for the info!

2010/1/5 mog

> Ya, you need to use MailScanner-4.79.4 which was available a couple weeks> ago from ports. It will work then.>> mog>>>> On 05/01/2010 13:44, Bal?zs M?t?ffy wrote:>> Hi,>> The Latest stable from the freebsd ports tree at that time.>> MailScanner-4.78.17>> 2010/1/5 mog >>> On 05/01/2010 12:49, Bal?zs M?t?ffy wrote:>>>>> Hello,>>>>>> I'm using FreeBSD, and I had the same error, after some days on the>>> mailwatch list they solved it.>>>>>> You need perl 5.8.8 < this is what I'm using right now and it's working>>> Or perl 5.10.0>>>>>> I tried 5.10.1 but it wasn't working!>>>>>>>>> Regards,>>>>>> Bal?zs.>>>>>>>>> Hi,>>>> When you tried 5.10.1, what version of MailScanner were you using?>>>> mog>>>>> --> MailScanner mailing list> [email protected]> http://lists.mailscanner.info/mailman/listinfo/mailscanner>> Before posting, read http://wiki.mailscanner.info/posting>> Support MailScanner development - buy the book off the website!>>-------------- next part --------------An HTML attachment was scrubbed...URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20100105/5200da63/attachment.html

I have located and corrected the problem. The SpamAssassin Local State Dir wasn't defined properly.

-Norman

-----Original Message-----From: [email protected] [mailto:[email protected]] On Behalf Of Laskie, NormanSent: Tuesday, January 05, 2010 7:15 AMTo: 'MailScanner discussion'Subject: RE: FH_DATE_PAST_20XX false positives

Thanks for the info. We are using the update_spamassassin tool via cron, but after running MailScanner --debug --debug-sa to me it appears that MailScanner / SpamAssassin isn't picking up the updated rules from /var/lib/spamassassin/3.002004/updates_spamassassin_org. Running spamassassin in debug mode shows that it is using the updates directory.

MailScanner --debug --debug-sa:06:36:33 [14115] dbg: config: using "/usr/share/spamassassin" for sys rules pre files06:36:33 [14115] dbg: config: using "/usr/share/spamassassin" for default rules dir

spamassassin -D --lint 2>&1:[1032] dbg: config: using "/var/lib/spamassassin/3.002004" for sys rules pre files[1032] dbg: config: using "/var/lib/spamassassin/3.002004" for default rules dir

As a disclaimer we are running an older version of MailScanner (This is Red Hat Enterprise Linux Server release 5.3 (Tikanga), This is Perl version 5.008008 (5.8.8), This is MailScanner version 4.69.9)

-Norman

-----Original Message-----From: [email protected] [mailto:[email protected]] On Behalf Of Glenn SteenSent: Tuesday, January 05, 2010 2:06 AMTo: MailScanner discussionSubject: Re: FH_DATE_PAST_20XX false positives


Cheers-- -- Glennemail: glenn < dot > steen < at > gmail < dot > comwork: glenn < dot > steen < at > ap1 < dot > se-- MailScanner mailing [email protected]://lists.mailscanner.info/mailman/listinfo/mailscanner


Support MailScanner development - buy the book off the website! -- MailScanner mailing [email protected]://lists.mailscanner.info/mailman/listinfo/mailscanner



I've got a couple sendmail/mailscanner boxes that we use to front endour exchange boxes inbound and outbound. We've run into a problem withany email going to mxlogic.net's clients as they do a deep headeranalysis and find private IPs in the headers and then the block based onthat.

This has happened multiple times and we always have to involve thereceiving customer in the conversation with mxlogic to get it fixed on aper domain basis, and then months later it just comes back. They knowthey're not supposed to block based on that, but they really don't care.

So, what I'd like to do is find a way to rip out the private IPs of themessage headers when we send them, or massage them into public IPs. Isthere any way to do this with sendmail?

Steven R. Andrews, President Andrews Companies Incorporated Small Business Information Technology Consultants [email protected] Phone: 317.536.1807

"If your only tool is a hammer, every problem looks like a nail."

-------------- next part --------------An HTML attachment was scrubbed...URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20100105/08641466/attachment.html

>>2010/1/4 Laskie, Norman :>> Is there an easy way to tell what directory SpamAssassin / MailScanner isusing for rules? I have two copies of that particular rule file with theversion under >>/var/lib/spamassassin/3.002004/updates_spamassassin_orgbeing updated and a version under /usr/share/spamassassin not being updated. MailScanner services >>have been restarted, SpamAssassin caches dumped andmultiple sa-updates have been run.>>>> -Norman>>>As Derek notes there is a "MailScanner --debug --debug-sa" that will>tell you *everything*;-). If it still scores the bad rule, perhaps>you've been running sa-update by hand and either forgot to sa-compile>after the sa-update, or perhaps forgot to do "service MailScanner>reload" to make MS copy of SA aware of the changes ... All this is>done by Jules update_spamassassin tool...;)>>Cheers>-->-- Glenn>email: glenn < dot > steen < at > gmail < dot > com>work: glenn < dot > steen < at > ap1 < dot > se

So when you run MailScanner --debug-sa and it shows that it's loading the72_active.cf from multiple SA versions, what do you do? I have SA in/var/lib/spamassassin/3.002003 and 3.00.2.004 and only the newer versiongot updated. Am I supposed to remove the previous versions of rules? I amstill getting hits on the rule so I have had to score it as 0 until I getthis fixed.

Dave-------------- next part --------------An HTML attachment was scrubbed...URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20100105/a5c967ef/attachment.html

On Tue, 5 Jan 2010, Steven Andrews wrote:

> I've got a couple sendmail/mailscanner boxes that we use to front end > our exchange boxes inbound and outbound. We've run into a problem with > any email going to mxlogic.net's clients as they do a deep header > analysis and find private IPs in the headers and then the block based on > that.> > This has happened multiple times and we always have to involve the > receiving customer in the conversation with mxlogic to get it fixed on a > per domain basis, and then months later it just comes back. They know > they're not supposed to block based on that, but they really don't care.

Suggest informing the clients of mxlogic's broken attitude. What an ironic name for a company. Can't say I would have much faith in their services.

You might have more luck asking your question on a sendmail list though.

Jethro.

. . . . . . . . . . . . . . . . . . . . . . . . .Jethro R BinksComputing Officer, IT Services, University Of Strathclyde, Glasgow, UK

Be careful.... If you start removing Sendmail's "Received" headersyou're likely to break Sendmail's mail loop detection. Been there, done it, got the t-shirt :-) Cheers, Phil

________________________________

From: [email protected][mailto:[email protected]] On Behalf Of StevenAndrewsSent: 05 January 2010 15:53To: MailScanner discussionSubject: sendmail header removal

I've got a couple sendmail/mailscanner boxes that we use to front endour exchange boxes inbound and outbound. We've run into a problem withany email going to mxlogic.net's clients as they do a deep headeranalysis and find private IPs in the headers and then the block based onthat.

This has happened multiple times and we always have to involve thereceiving customer in the conversation with mxlogic to get it fixed on aper domain basis, and then months later it just comes back. They knowthey're not supposed to block based on that, but they really don't care.

So, what I'd like to do is find a way to rip out the private IPs of themessage headers when we send them, or massage them into public IPs. Isthere any way to do this with sendmail?

Steven R. Andrews, President Andrews Companies Incorporated Small Business Information Technology Consultants [email protected] Phone: 317.536.1807

"If your only tool is a hammer, every problem looks like a nail."

Any opinion expressed in this e-mail or any attached files are those of the individual and not necessarily those of Herefordshire Council.You should be aware that Herefordshire Council monitors its email service.This e-mail and any attached files are confidential and intended solely for the use of the addressee. This communication may contain material protected by law from being passed on. If you are not the intended recipient and have received this e-mail in error, you are advised that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender immediately and destroy all copies of it.-------------- next part --------------An HTML attachment was scrubbed...URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20100105/7b3f15e2/attachment.html

Am 05.01.2010 16:53, schrieb Steven Andrews:> I?ve got a couple sendmail/mailscanner boxes that we use to front end> our exchange boxes inbound and outbound. We?ve run into a problem with> any email going to mxlogic.net?s clients as they do a deep header> analysis and find private IPs in the headers and then the block based on> that.[ ...] > So, what I?d like to do is find a way to rip out the private IPs of the> message headers when we send them, or massage them into public IPs. Is> there any way to do this with sendmail?

I had a similar problem (I believe it was some Barracuda Spam Firewall) months ago.

What helped in the end was to hide the client IP on my SMTP (SM/MS). Try adding this (or similar) to the sendmail.mc and rebuild your sendmail.cf:

dnl #dnl # Hide client IPdefine(`confRECEIVED_HEADER',`by $j $?r with $r$. id $i; $b')dnl

Well... If it is the received header which is your problem.

Please note: Under some circumstances this *could* cause your troubles when trying to debug other kind of mail delivery problems; however none come to my mind immediately. :-)

BR, -of

>From what I remember you cannot remove headers in cf code, in a normal sendmail.

There are some source code edits in google YMMV but I would go about this.

If I had to do it and bend a few RFCs as a result, I'd do it via a milter, MIMEdefang using a bit of perl is probably simplest.

Gary

-----Original Message-----From: [email protected] [mailto:[email protected]] On Behalf Of Jethro R BinksSent: 05 January 2010 16:01To: MailScanner discussionSubject: Re: sendmail header removal

On Tue, 5 Jan 2010, Steven Andrews wrote:

> I've got a couple sendmail/mailscanner boxes that we use to front end > our exchange boxes inbound and outbound. We've run into a problem with > any email going to mxlogic.net's clients as they do a deep header > analysis and find private IPs in the headers and then the block based on > that.> > This has happened multiple times and we always have to involve the > receiving customer in the conversation with mxlogic to get it fixed on a > per domain basis, and then months later it just comes back. They know > they're not supposed to block based on that, but they really don't care.

Suggest informing the clients of mxlogic's broken attitude. What an ironic name for a company. Can't say I would have much faith in their services.

You might have more luck asking your question on a sendmail list though.

Jethro.

. . . . . . . . . . . . . . . . . . . . . . . . .Jethro R BinksComputing Officer, IT Services, University Of Strathclyde, Glasgow, UK-- MailScanner mailing [email protected]://lists.mailscanner.info/mailman/listinfo/mailscanner



Am 05.01.2010 17:13, schrieb Randal, Phil:> Be careful.... If you start removing Sendmail's "Received" headers> you're likely to break Sendmail's mail loop detection.> Been there, done it, got the t-shirt :-)

Ah. Good point. I knew there was some trouble involved :-)However, if you have a working installation it shouldn't be too bad, since you shouldn't have any mail loops, right?

-of

you never know about the future :-)

Lance

On 5 Jan 2010, at 16:23, Oliver Falk wrote:

> Am 05.01.2010 17:13, schrieb Randal, Phil:>> Be careful.... If you start removing Sendmail's "Received" headers>> you're likely to break Sendmail's mail loop detection.>> Been there, done it, got the t-shirt :-)> > Ah. Good point. I knew there was some trouble involved :-)> However, if you have a working installation it shouldn't be too bad, since you shouldn't have any mail loops, right?> > -of> -- > MailScanner mailing list> [email protected]> http://lists.mailscanner.info/mailman/listinfo/mailscanner> > Before posting, read http://wiki.mailscanner.info/posting> > Support MailScanner development - buy the book off the website! > --> This message was scanned by Better Hosted and is believed to be clean.> Click here to report this message as spam. http://mx1.betterhosted.com/cgi-bin/learn-msg.cgi?id=D49E39F9F8.A3945> >

--This message was scanned by Better Hosted and is believed to be clean.http://www.betterhosted.com

Indeed, but one misconfigured box somewhere is all it takes...

Phil

-----Original Message-----From: [email protected][mailto:[email protected]] On Behalf Of OliverFalkSent: 05 January 2010 16:24To: [email protected]: Re: sendmail header removal

Am 05.01.2010 17:13, schrieb Randal, Phil:> Be careful.... If you start removing Sendmail's "Received" headers > you're likely to break Sendmail's mail loop detection.> Been there, done it, got the t-shirt :-)

Ah. Good point. I knew there was some trouble involved :-) However, ifyou have a working installation it shouldn't be too bad, since youshouldn't have any mail loops, right?

-of--MailScanner mailing [email protected]://lists.mailscanner.info/mailman/listinfo/mailscanner


Support MailScanner development - buy the book off the website! Any opinion expressed in this e-mail or any attached files are those of the individual and not necessarily those of Herefordshire Council.You should be aware that Herefordshire Council monitors its email service.This e-mail and any attached files are confidential and intended solely for the use of the addressee. This communication may contain material protected by law from being passed on. If you are not the intended recipient and have received this e-mail in error, you are advised that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender immediately and destroy all copies of it.

Am 05.01.2010 17:37, schrieb Randal, Phil:> Indeed, but one misconfigured box somewhere is all it takes...

OK. Let's pretend we're perfect and never make any configuration mistakes :-)

-of

We have found a nasty PDF attachment (targeted specifically against aclient of mine) and we would like to archive all PDF's passing throughMailScanner for analysis.

I don't know how to do this in a simple and transparent way. If I usethe filename/type rules it either blocks the PDF's or replaces theoriginal recipients, this won't fly as most PDF's are going to be OK,the users shouldn't notice this.

The only way I can think of is to archive *all* mail and then findwhich df-files (Sendmail) contains PDF's and extract them and deletethe rest. Is this how I should collect the samples? Or is there abetter way?

-- /peter

What about MCP?

On Jan 5, 2010, at 11:58 AM, shuttlebox wrote:

> We have found a nasty PDF attachment (targeted specifically against a> client of mine) and we would like to archive all PDF's passing through> MailScanner for analysis.>> I don't know how to do this in a simple and transparent way. If I use> the filename/type rules it either blocks the PDF's or replaces the> original recipients, this won't fly as most PDF's are going to be OK,> the users shouldn't notice this.>> The only way I can think of is to archive *all* mail and then find> which df-files (Sendmail) contains PDF's and extract them and delete> the rest. Is this how I should collect the samples? Or is there a> better way?>> -- > /peter> -- > MailScanner mailing list> [email protected]> http://lists.mailscanner.info/mailman/listinfo/mailscanner>> Before posting, read http://wiki.mailscanner.info/posting>> Support MailScanner development - buy the book off the website!

> > So when you run MailScanner --debug-sa and it shows that it's loading the> 72_active.cf from multiple SA versions, what do> you do? ?I have SA in?> /var/lib/spamassassin/3.002003 and 3.00.2.004 and only the newer version> got updated. ?Am I supposed to remove the previous versions of rules? ?I am> still getting hits on the rule so I have had to score it as 0 until I> get this fixed.> > Dave> I try and remove the old ones after an upgrade... They just take space.

-------------- next part --------------A non-text attachment was scrubbed...Name: signature.ascType: application/pgp-signatureSize: 259 bytesDesc: OpenPGP digital signatureUrl : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20100105/c418bab1/signature.bin

Write a spamassassin rule to detect PDF attachments, and then useMailScanner's "Spamassassin Rule Action" functionality to archive allhits.

Cheers,

Phil

-----Original Message-----From: [email protected][mailto:[email protected]] On Behalf OfshuttleboxSent: 05 January 2010 16:59To: MailScanner discussionSubject: Possible to archive based on attachments?

We have found a nasty PDF attachment (targeted specifically against aclient of mine) and we would like to archive all PDF's passing throughMailScanner for analysis.

I don't know how to do this in a simple and transparent way. If I usethe filename/type rules it either blocks the PDF's or replaces theoriginal recipients, this won't fly as most PDF's are going to be OK,the users shouldn't notice this.

The only way I can think of is to archive *all* mail and then find whichdf-files (Sendmail) contains PDF's and extract them and delete the rest.Is this how I should collect the samples? Or is there a better way?

--/peter--MailScanner mailing [email protected]://lists.mailscanner.info/mailman/listinfo/mailscanner



Good call Phil. What do you think would be a good way to catch all the different ways PDF files can be attached?On Jan 5, 2010, at 12:07 PM, Randal, Phil wrote:

> Write a spamassassin rule to detect PDF attachments, and then use> MailScanner's "Spamassassin Rule Action" functionality to archive all> hits.

Richard Siddall wrote, On 05/01/10 13:53:> Patrick Vande Walle wrote:>> Alternatively, you may want to try the method described here:>>>> http://www.heise.de/newsticker/foren/S-Das-Peinliche-daran-ist/forum-171865/msg-17874835/read/>>>> It strikes me as a bad idea to use the FH_DATE_PAST_20XX rule name for> a completely different rule. I think it would be better to score the> official FH_DATE_PAST_20XX to zero in your local.cf and just define a> new rule using the better algorithm. That should avoid problems with> sa-update overwriting your new version too.Richard,

You are, of course, absolutely right that one should avoid reusing oneof the default rules with another algorithm.

It is just that testing messages with dates in the future is useful forscoring. Setting the FH_DATE_PAST_20XX rule with a score of 0 is only apartial solution. Hence, I created a new rule based on theabove-mentioned post.

Kind regards,

Patrick Vande Walle

You could use a rule like (off the top of my head, so don't shoot me ifit isn't correct):

ifplugin Mail::SpamAssassin::Plugin::MIMEHeadermimeheader LOCAL_ATTACHED_PDF Content-Disposition =~/filename=\".{1,32}\.pdf\"/iscore LOCAL_ATTACHED_PDF 0.01endif

Cheers,

Phil-----Original Message-----From: [email protected][mailto:[email protected]] On Behalf Of AlexNeumanSent: 05 January 2010 17:23To: MailScanner discussionSubject: Re: Possible to archive based on attachments?

Good call Phil. What do you think would be a good way to catch all thedifferent ways PDF files can be attached?On Jan 5, 2010, at 12:07 PM, Randal, Phil wrote:

> Write a spamassassin rule to detect PDF attachments, and then use > MailScanner's "Spamassassin Rule Action" functionality to archive all > hits.

--MailScanner mailing [email protected]://lists.mailscanner.info/mailman/listinfo/mailscanner



Would this work with some otherwise braindead and/or broken mailers like, I dunno, Outlook Express or whatever?

On Jan 5, 2010, at 12:37 PM, Randal, Phil wrote:

> You could use a rule like (off the top of my head, so don't shoot me if> it isn't correct):> > ifplugin Mail::SpamAssassin::Plugin::MIMEHeader> mimeheader LOCAL_ATTACHED_PDF Content-Disposition =~> /filename=\".{1,32}\.pdf\"/i> score LOCAL_ATTACHED_PDF 0.01> endif

On Tue, Jan 5, 2010 at 6:37 PM, Randal, Phil wrote:> You could use a rule like (off the top of my head, so don't shoot me if> it isn't correct):>> ifplugin Mail::SpamAssassin::Plugin::MIMEHeader> mimeheader LOCAL_ATTACHED_PDF ?Content-Disposition =~> /filename=\".{1,32}\.pdf\"/i> score LOCAL_ATTACHED_PDF 0.01> endif

Thanks! This together with a rule action should do what I want.

-- /peter

Le 2010-01-05 08:53, Marco Rebsamen a ?crit :>> Hi>> I got troubles with this filename/-type checking.>> What I want is, that simple .exe or .dll files are not delivered. But > If I put them into a ZIP or RAR file they should pass.>> I tried setting the path to the rar and gzip commands to ?empty?, I > tried setting the filetype ?executable? in the rules file to allowed?. > Useless, I can?t send my mail.>> Can somebody tell me how to configure MailScanner like that ?>> Thank you>Marco,

Look at:# The maximum depth to which zip archives, rar archives and Microsoft Office# documents will be unpacked, to allow for checking filenames and filetypes# within zip and rar archives and embedded within Office documents.## Note: This setting does *not* affect virus scanning in archives at all.## To disable this feature set this to 0.# A common useful setting is this option = 0, and Allow Password-Protected# Archives = no. That block password-protected archives but does not do# any filename/filetype checks on the files within the archive.# This can also be the filename of a ruleset.Maximum Archive Depth = 0

Denis

-- _ ?v? Denis Beauchemin, analyste /(_)\ Universit? de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x62252 F: 819.821.8045

----Original Message----From: [email protected][mailto:[email protected]] On Behalf Of DenisBeauchemin Sent: Tuesday, January 05, 2010 4:16 PM To: MailScannerdiscussion Subject: Re: Filename/-type Checking

> Le 2010-01-05 08:53, Marco Rebsamen a ?crit :>> >> Hi>> >> I got troubles with this filename/-type checking.>> >> What I want is, that simple .exe or .dll files are not delivered. But>> If I put them into a ZIP or RAR file they should pass.>> >> I tried setting the path to the rar and gzip commands to ?empty?, I>> tried setting the filetype ?executable? in the rules file to allowed.>> Useless, I can?t send my mail.>> >> Can somebody tell me how to configure MailScanner like that ?>> >> Thank you>> > Marco,> > Look at:> # The maximum depth to which zip archives, rar archives and Microsoft> Office # documents will be unpacked, to allow for checking filenames and> filetypes # within zip and rar archives and embedded within Office> documents. #> # Note: This setting does *not* affect virus scanning in archives at all.> #> # To disable this feature set this to 0.> # A common useful setting is this option = 0, and Allow Password-Protected> # Archives = no. That block password-protected archives but does not do> # any filename/filetype checks on the files within the archive.> # This can also be the filename of a ruleset.> Maximum Archive Depth = 0>

Should be able to use the archive.filename.rules/types to handle this. Inthe archive related just put an allow line at the top. If using a laterversion then look for "Archives: Allow Filenames =" in the config file anduse the rule file or just make it

Archives: Allow Filenames = \.exe$ \.dll$

--This message has been scanned for viruses anddangerous content by MailScanner, and isbelieved to be clean.

Hello all,

Thanks for taking the time to read this.

Basically just did a clean install of Ubuntu 9.10 server withMailScanner w/ Mailwatch but when starting up I see the following inthe mail.log "Could not use Custom Functioncode........SQLBlackWhiteList.pm, it could not be "require"d. Makesure the last line of the file says "1;"" Same error with theMailWatch.pm

Anybody have any iders?

Ubuntu 9.10Perl 5.10.0

Summary of my perl5 (revision 5 version 10 subversion 0) configuration: Platform: osname=linux, osvers=2.6.24-23-server,archname=x86_64-linux-gnu-thread-multi uname='linux crested 2.6.24-23-server #1 smp wed apr 1 22:14:30utc 2009 x86_64 gnulinux ' config_args='-Dusethreads -Duselargefiles -Dccflags=-DDEBIAN-Dcccdlflags=-fPIC -Darchname=x86_64-linux-gnu -Dprefix=/usr-Dprivlib=/usr/share/perl/5.10 -Darchlib=/usr/lib/perl/5.10-Dvendorprefix=/usr -Dvendorlib=/usr/share/perl5-Dvendorarch=/usr/lib/perl5 -Dsiteprefix=/usr/local-Dsitelib=/usr/local/share/perl/5.10.0-Dsitearch=/usr/local/lib/perl/5.10.0 -Dman1dir=/usr/share/man/man1-Dman3dir=/usr/share/man/man3 -Dsiteman1dir=/usr/local/man/man1-Dsiteman3dir=/usr/local/man/man3 -Dman1ext=1 -Dman3ext=3perl-Dpager=/usr/bin/sensible-pager -Uafs -Ud_csh -Ud_ualarm -Uusesfio-Uusenm -DDEBUGGING=-g -Doptimize=-O2 -Duseshrplib-Dlibperl=libperl.so.5.10.0 -Dd_dosuid -des' hint=recommended, useposix=true, d_sigaction=define useithreads=define, usemultiplicity=define useperlio=define, d_sfio=undef, uselargefiles=define, usesocks=undef use64bitint=define, use64bitall=define, uselongdouble=undef usemymalloc=n, bincompat5005=undef

MailScanner E-Mail Virus Scanner version 4.74.16 starting...

Could not use Custom Function code/etc/MailScanner/CustomFunctions/SQLBlackWhiteList.pm, it could not be"require"d. Make sure the last line of the file says "1;"Could not use Custom Function code/etc/MailScanner/CustomFunctions/MailWatch.pm, it could not be"require"d. Make sure the last line of the file says "1;"

Read 848 hostnames from the phishing whitelistRead 4278 hostnames from the phishing blacklistConfig: calling custom init function SQLBlacklistConfig: calling custom init function MailWatchLoggingConfig: calling custom init function SQLWhitelistUsing SpamAssassin results cacheConnected to SpamAssassin cache databaseEnabling SpamAssassin auto-whitelist functionality...Using locktype = flock

Thanks,Eric

seen that... what was it?permissions?

On 01/05/10 11:54, Eric Peters wrote:> Hello all,> > Thanks for taking the time to read this.> > Basically just did a clean install of Ubuntu 9.10 server with> MailScanner w/ Mailwatch but when starting up I see the following in> the mail.log "Could not use Custom Function> code........SQLBlackWhiteList.pm, it could not be "require"d. Make> sure the last line of the file says "1;"" Same error with the> MailWatch.pm> > Anybody have any iders?> > Ubuntu 9.10> Perl 5.10.0> > Summary of my perl5 (revision 5 version 10 subversion 0) configuration:> Platform:> osname=linux, osvers=2.6.24-23-server,> archname=x86_64-linux-gnu-thread-multi> uname='linux crested 2.6.24-23-server #1 smp wed apr 1 22:14:30> utc 2009 x86_64 gnulinux '> config_args='-Dusethreads -Duselargefiles -Dccflags=-DDEBIAN> -Dcccdlflags=-fPIC -Darchname=x86_64-linux-gnu -Dprefix=/usr> -Dprivlib=/usr/share/perl/5.10 -Darchlib=/usr/lib/perl/5.10> -Dvendorprefix=/usr -Dvendorlib=/usr/share/perl5> -Dvendorarch=/usr/lib/perl5 -Dsiteprefix=/usr/local> -Dsitelib=/usr/local/share/perl/5.10.0> -Dsitearch=/usr/local/lib/perl/5.10.0 -Dman1dir=/usr/share/man/man1> -Dman3dir=/usr/share/man/man3 -Dsiteman1dir=/usr/local/man/man1> -Dsiteman3dir=/usr/local/man/man3 -Dman1ext=1 -Dman3ext=3perl> -Dpager=/usr/bin/sensible-pager -Uafs -Ud_csh -Ud_ualarm -Uusesfio> -Uusenm -DDEBUGGING=-g -Doptimize=-O2 -Duseshrplib> -Dlibperl=libperl.so.5.10.0 -Dd_dosuid -des'> hint=recommended, useposix=true, d_sigaction=define> useithreads=define, usemultiplicity=define> useperlio=define, d_sfio=undef, uselargefiles=define, usesocks=undef> use64bitint=define, use64bitall=define, uselongdouble=undef> usemymalloc=n, bincompat5005=undef> > MailScanner E-Mail Virus Scanner version 4.74.16 starting...> > Could not use Custom Function code> /etc/MailScanner/CustomFunctions/SQLBlackWhiteList.pm, it could not be> "require"d. Make sure the last line of the file says "1;"> Could not use Custom Function code> /etc/MailScanner/CustomFunctions/MailWatch.pm, it could not be> "require"d. Make sure the last line of the file says "1;"> > Read 848 hostnames from the phishing whitelist> Read 4278 hostnames from the phishing blacklist> Config: calling custom init function SQLBlacklist> Config: calling custom init function MailWatchLogging> Config: calling custom init function SQLWhitelist> Using SpamAssassin results cache> Connected to SpamAssassin cache database> Enabling SpamAssassin auto-whitelist functionality...> Using locktype = flock> > > Thanks,> Eric

Don't know yet. Can't seem to find the issue? Have you seen thisbefore? I searched the list here at most of the problems that peoplebeen experiencing with the/etc/MailScanner/CustomFunctions/SQLBlackWhiteList.pm, it could not be"require"d. Make sure the last line of the file says "1; error aremostly on the FreeBSD side...

Permissions on the the SQLBlackWhiteList .pm are the following-rw-r--r-- 1 root root I'll change it to postfix:postfix same asmailscanner let ya know if that worked.

Cheers,Eric

On Tue, Jan 5, 2010 at 3:03 PM, Alex Broens wrote:> seen that... what was it?> permissions?>> On 01/05/10 11:54, Eric Peters wrote:>>>> Hello all,>>>> ? ? Thanks for taking the time to read this.>>>> Basically just did a clean install of Ubuntu 9.10 server with>> MailScanner w/ Mailwatch but when starting up I see the following in>> the mail.log "Could not use Custom Function>> code........SQLBlackWhiteList.pm, it could not be "require"d. Make>> sure the last line of the file says "1;"" Same error with the>> MailWatch.pm>>>> Anybody have any iders?>>>> Ubuntu 9.10>> Perl 5.10.0>>>> Summary of my perl5 (revision 5 version 10 subversion 0) configuration:>> ?Platform:>> ? ?osname=linux, osvers=2.6.24-23-server,>> archname=x86_64-linux-gnu-thread-multi>> ? ?uname='linux crested 2.6.24-23-server #1 smp wed apr 1 22:14:30>> utc 2009 x86_64 gnulinux '>> ? ?config_args='-Dusethreads -Duselargefiles -Dccflags=-DDEBIAN>> -Dcccdlflags=-fPIC -Darchname=x86_64-linux-gnu -Dprefix=/usr>> -Dprivlib=/usr/share/perl/5.10 -Darchlib=/usr/lib/perl/5.10>> -Dvendorprefix=/usr -Dvendorlib=/usr/share/perl5>> -Dvendorarch=/usr/lib/perl5 -Dsiteprefix=/usr/local>> -Dsitelib=/usr/local/share/perl/5.10.0>> -Dsitearch=/usr/local/lib/perl/5.10.0 -Dman1dir=/usr/share/man/man1>> -Dman3dir=/usr/share/man/man3 -Dsiteman1dir=/usr/local/man/man1>> -Dsiteman3dir=/usr/local/man/man3 -Dman1ext=1 -Dman3ext=3perl>> -Dpager=/usr/bin/sensible-pager -Uafs -Ud_csh -Ud_ualarm -Uusesfio>> -Uusenm -DDEBUGGING=-g -Doptimize=-O2 -Duseshrplib>> -Dlibperl=libperl.so.5.10.0 -Dd_dosuid -des'>> ? ?hint=recommended, useposix=true, d_sigaction=define>> ? ?useithreads=define, usemultiplicity=define>> ? ?useperlio=define, d_sfio=undef, uselargefiles=define, usesocks=undef>> ? ?use64bitint=define, use64bitall=define, uselongdouble=undef>> ? ?usemymalloc=n, bincompat5005=undef>>>> MailScanner E-Mail Virus Scanner version 4.74.16 starting...>>>> Could not use Custom Function code>> /etc/MailScanner/CustomFunctions/SQLBlackWhiteList.pm, it could not be>> "require"d. Make sure the last line of the file says "1;">> Could not use Custom Function code>> /etc/MailScanner/CustomFunctions/MailWatch.pm, it could not be>> "require"d. Make sure the last line of the file says "1;">>>> Read 848 hostnames from the phishing whitelist>> Read 4278 hostnames from the phishing blacklist>> Config: calling custom init function SQLBlacklist>> Config: calling custom init function MailWatchLogging>> Config: calling custom init function SQLWhitelist>> Using SpamAssassin results cache>> Connected to SpamAssassin cache database>> Enabling SpamAssassin auto-whitelist functionality...>> Using locktype = flock>>>>>> Thanks,>> Eric>> --> MailScanner mailing list> [email protected]> http://lists.mailscanner.info/mailman/listinfo/mailscanner>> Before posting, read http://wiki.mailscanner.info/posting>> Support MailScanner development - buy the book off the website!>

Hi,

First thing ... you are using a 1 year old version of MailScanner ... updatewould be the first thing Julian says.

I think ... Debian/Ubuntu package are old ... and its been here many timesbefore. They are ( as I know ) not being maintained.

Install from the source ...:http://mailscanner.info/downloads.html

I'm running a FreeBSD here ... and we have had the same issue I think .. andmany other because of Perl/MailScanner ... so I'm always aware of any issuebefore installing on my production server.This could probably be resolved by downgrading Perl or as above ... updateto newest MailScanner.

mvhMikael Syska

On Tue, Jan 5, 2010 at 11:54 PM, Eric Peters wrote:

> Hello all,>> Thanks for taking the time to read this.>> Basically just did a clean install of Ubuntu 9.10 server with> MailScanner w/ Mailwatch but when starting up I see the following in> the mail.log "Could not use Custom Function> code........SQLBlackWhiteList.pm, it could not be "require"d. Make> sure the last line of the file says "1;"" Same error with the> MailWatch.pm>> Anybody have any iders?>> Ubuntu 9.10> Perl 5.10.0>> Summary of my perl5 (revision 5 version 10 subversion 0) configuration:> Platform:> osname=linux, osvers=2.6.24-23-server,> archname=x86_64-linux-gnu-thread-multi> uname='linux crested 2.6.24-23-server #1 smp wed apr 1 22:14:30> utc 2009 x86_64 gnulinux '> config_args='-Dusethreads -Duselargefiles -Dccflags=-DDEBIAN> -Dcccdlflags=-fPIC -Darchname=x86_64-linux-gnu -Dprefix=/usr> -Dprivlib=/usr/share/perl/5.10 -Darchlib=/usr/lib/perl/5.10> -Dvendorprefix=/usr -Dvendorlib=/usr/share/perl5> -Dvendorarch=/usr/lib/perl5 -Dsiteprefix=/usr/local> -Dsitelib=/usr/local/share/perl/5.10.0> -Dsitearch=/usr/local/lib/perl/5.10.0 -Dman1dir=/usr/share/man/man1> -Dman3dir=/usr/share/man/man3 -Dsiteman1dir=/usr/local/man/man1> -Dsiteman3dir=/usr/local/man/man3 -Dman1ext=1 -Dman3ext=3perl> -Dpager=/usr/bin/sensible-pager -Uafs -Ud_csh -Ud_ualarm -Uusesfio> -Uusenm -DDEBUGGING=-g -Doptimize=-O2 -Duseshrplib> -Dlibperl=libperl.so.5.10.0 -Dd_dosuid -des'> hint=recommended, useposix=true, d_sigaction=define> useithreads=define, usemultiplicity=define> useperlio=define, d_sfio=undef, uselargefiles=define, usesocks=undef> use64bitint=define, use64bitall=define, uselongdouble=undef> usemymalloc=n, bincompat5005=undef>> MailScanner E-Mail Virus Scanner version 4.74.16 starting...>> Could not use Custom Function code> /etc/MailScanner/CustomFunctions/SQLBlackWhiteList.pm, it could not be> "require"d. Make sure the last line of the file says "1;"> Could not use Custom Function code> /etc/MailScanner/CustomFunctions/MailWatch.pm, it could not be> "require"d. Make sure the last line of the file says "1;">> Read 848 hostnames from the phishing whitelist> Read 4278 hostnames from the phishing blacklist> Config: calling custom init function SQLBlacklist> Config: calling custom init function MailWatchLogging> Config: calling custom init function SQLWhitelist> Using SpamAssassin results cache> Connected to SpamAssassin cache database> Enabling SpamAssassin auto-whitelist functionality...> Using locktype = flock>>> Thanks,> Eric> --> MailScanner mailing list> [email protected]> http://lists.mailscanner.info/mailman/listinfo/mailscanner>> Before posting, read http://wiki.mailscanner.info/posting>> Support MailScanner development - buy the book off the website!>-------------- next part --------------An HTML attachment was scrubbed...URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20100106/233cef34/attachment.html

Since you are using ubuntu 9.10 you need MailScanner 4.79.1

Garrod AlwoodOpen Source [email protected] from my iPod

On Jan 5, 2010, at 7:14 PM, "Mikael Syska" wrote:

Hi,

First thing ... you are using a 1 year old version of MailScanner ... update would be the first thing Julian says.

I think ... Debian/Ubuntu package are old ... and its been here many times before. They are ( as I know ) not being maintained.


I'm running a FreeBSD here ... and we have had the same issue I think .. and many other because of Perl/MailScanner ... so I'm always aware of any issue before installing on my production server.This could probably be resolved by downgrading Perl or as above ... update to newest MailScanner.

mvhMikael Syska

On Tue, Jan 5, 2010 at 11:54 PM, Eric Peters wrote:Hello all,









Thanks,Eric--MailScanner mailing [email protected]://lists.mailscanner.info/mailman/listinfo/mailscanner



-------------- next part --------------An HTML attachment was scrubbed...URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20100105/0a13c375/attachment.html

Thanks all,

Found a deb (which I shouldn't of used) that was 4.78 because of a time crunch. I'll roll the newest ver in by hand in the morning.

I have been out of the mailscanner scene for a bit, 2005 was the last time I deployed it. So any issues using mailwatch with the latest greatest mailscanner? Cause mailwatch is looking a bit stale.

Cheers,E

Sent from my iPhone

On Jan 5, 2010, at 6:03 PM, "Garrod M. Alwood" wrote:

> Since you are using ubuntu 9.10 you need MailScanner 4.79.1>> Garrod Alwood> Open Source Consultant> 9047384988> [email protected]> Sent from my iPod>> On Jan 5, 2010, at 7:14 PM, "Mikael Syska" wrote:>>> Hi,>>>> First thing ... you are using a 1 year old version of >> MailScanner ... update would be the first thing Julian says.>>>> I think ... Debian/Ubuntu package are old ... and its been here >> many times before. They are ( as I know ) not being maintained.>>>> Install from the source ...:>> http://mailscanner.info/downloads.html>>>> I'm running a FreeBSD here ... and we have had the same issue I >> think .. and many other because of Perl/MailScanner ... so I'm >> always aware of any issue before installing on my production server.>> This could probably be resolved by downgrading Perl or as above ... >> update to newest MailScanner.>>>> mvh>> Mikael Syska>>>> On Tue, Jan 5, 2010 at 11:54 PM, Eric Peters >> wrote:>> Hello all,>>>> Thanks for taking the time to read this.>>>> Basically just did a clean install of Ubuntu 9.10 server with>> MailScanner w/ Mailwatch but when starting up I see the following in>> the mail.log "Could not use Custom Function>> code........SQLBlackWhiteList.pm, it could not be "require"d. Make>> sure the last line of the file says "1;"" Same error with the>> MailWatch.pm>>>> Anybody have any iders?>>>> Ubuntu 9.10>> Perl 5.10.0>>>> Summary of my perl5 (revision 5 version 10 subversion 0) >> configuration:>> Platform:>> osname=linux, osvers=2.6.24-23-server,>> archname=x86_64-linux-gnu-thread-multi>> uname='linux crested 2.6.24-23-server #1 smp wed apr 1 22:14:30>> utc 2009 x86_64 gnulinux '>> config_args='-Dusethreads -Duselargefiles -Dccflags=-DDEBIAN>> -Dcccdlflags=-fPIC -Darchname=x86_64-linux-gnu -Dprefix=/usr>> -Dprivlib=/usr/share/perl/5.10 -Darchlib=/usr/lib/perl/5.10>> -Dvendorprefix=/usr -Dvendorlib=/usr/share/perl5>> -Dvendorarch=/usr/lib/perl5 -Dsiteprefix=/usr/local>> -Dsitelib=/usr/local/share/perl/5.10.0>> -Dsitearch=/usr/local/lib/perl/5.10.0 -Dman1dir=/usr/share/man/man1>> -Dman3dir=/usr/share/man/man3 -Dsiteman1dir=/usr/local/man/man1>> -Dsiteman3dir=/usr/local/man/man3 -Dman1ext=1 -Dman3ext=3perl>> -Dpager=/usr/bin/sensible-pager -Uafs -Ud_csh -Ud_ualarm -Uusesfio>> -Uusenm -DDEBUGGING=-g -Doptimize=-O2 -Duseshrplib>> -Dlibperl=libperl.so.5.10.0 -Dd_dosuid -des'>> hint=recommended, useposix=true, d_sigaction=define>> useithreads=define, usemultiplicity=define>> useperlio=define, d_sfio=undef, uselargefiles=define, >> usesocks=undef>> use64bitint=define, use64bitall=define, uselongdouble=undef>> usemymalloc=n, bincompat5005=undef>>>> MailScanner E-Mail Virus Scanner version 4.74.16 starting...>>>> Could not use Custom Function code>> /etc/MailScanner/CustomFunctions/SQLBlackWhiteList.pm, it could not >> be>> "require"d. Make sure the last line of the file says "1;">> Could not use Custom Function code>> /etc/MailScanner/CustomFunctions/MailWatch.pm, it could not be>> "require"d. Make sure the last line of the file says "1;">>>> Read 848 hostnames from the phishing whitelist>> Read 4278 hostnames from the phishing blacklist>> Config: calling custom init function SQLBlacklist>> Config: calling custom init function MailWatchLogging>> Config: calling custom init function SQLWhitelist>> Using SpamAssassin results cache>> Connected to SpamAssassin cache database>> Enabling SpamAssassin auto-whitelist functionality...>> Using locktype = flock>>>>>> Thanks,>> Eric>> -->> MailScanner mailing list>> [email protected]>> http://lists.mailscanner.info/mailman/listinfo/mailscanner>>>> Before posting, read http://wiki.mailscanner.info/posting>>>> Support MailScanner development - buy the book off the website!>>>> > -- > MailScanner mailing list> [email protected]> http://lists.mailscanner.info/mailman/listinfo/mailscanner>> Before posting, read http://wiki.mailscanner.info/posting>> Support MailScanner development - buy the book off the website!-------------- next part --------------An HTML attachment was scrubbed...URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20100105/d89d7b50/attachment.html

Well 4.78 wont work on 9.10. I created my 4.79.1 with alien after untarring the rpm I just would use alien to create a very good deb. I have had no problems except for with apparmor. 4.79.1 is working perfect for me. If you want it I'll send it.


On Jan 5, 2010, at 9:10 PM, "Eric" wrote:

Thanks all,

Found a deb (which I shouldn't of used) that was 4.78 because of a time crunch. I'll roll the newest ver in by hand in the morning.

I have been out of the mailscanner scene for a bit, 2005 was the last time I deployed it. So any issues using mailwatch with the latest greatest mailscanner? Cause mailwatch is looking a bit stale.

Cheers,E

Sent from my iPhone

On Jan 5, 2010, at 6:03 PM, "Garrod M. Alwood" wrote:

Since you are using ubuntu 9.10 you need MailScanner 4.79.1


On Jan 5, 2010, at 7:14 PM, "Mikael Syska" wrote:

Hi,

First thing ... you are using a 1 year old version of MailScanner ... update would be the first thing Julian says.

I think ... Debian/Ubuntu package are old ... and its been here many times before. They are ( as I know ) not being maintained.


I'm running a FreeBSD here ... and we have had the same issue I think .. and many other because of Perl/MailScanner ... so I'm always aware of any issue before installing on my production server.This could probably be resolved by downgrading Perl or as above ... update to newest MailScanner.

mvhMikael Syska

On Tue, Jan 5, 2010 at 11:54 PM, Eric Peters wrote:Hello all,









Thanks,Eric--MailScanner mailing [email protected]://lists.mailscanner.info/mailman/listinfo/mailscanner



--MailScanner mailing [email protected]://lists.mailscanner.info/mailman/listinfo/mailscanner



-------------- next part --------------An HTML attachment was scrubbed...URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20100105/750de3e1/attachment-0001.html

Hi,

No problems for me with the latest version ... using the last version 1.0.4of mailwatch.

Its a paid program now ... even though I dont know where to buy it or theprices.

mvh

On Wed, Jan 6, 2010 at 3:14 AM, Eric wrote:

> Thanks all,>> Found a deb (which I shouldn't of used) that was 4.78 because of a time> crunch. I'll roll the newest ver in by hand in the morning.>> I have been out of the mailscanner scene for a bit, 2005 was the last time> I deployed it. So any issues using mailwatch with the latest greatest> mailscanner? Cause mailwatch is looking a bit stale.>> Cheers,> E>> Sent from my iPhone>> On Jan 5, 2010, at 6:03 PM, "Garrod M. Alwood" > wrote:>> Since you are using ubuntu 9.10 you need MailScanner 4.79.1>> Garrod Alwood> Open Source Consultant> 9047384988> [email protected]> Sent from my iPod>> On Jan 5, 2010, at 7:14 PM, "Mikael Syska" < > [email protected]> wrote:>> Hi,>> First thing ... you are using a 1 year old version of MailScanner ...> update would be the first thing Julian says.>> I think ... Debian/Ubuntu package are old ... and its been here many times> before. They are ( as I know ) not being maintained.>> Install from the source ...:> > http://mailscanner.info/downloads.html>> I'm running a FreeBSD here ... and we have had the same issue I think ..> and many other because of Perl/MailScanner ... so I'm always aware of any> issue before installing on my production server.> This could probably be resolved by downgrading Perl or as above ... update> to newest MailScanner.>> mvh> Mikael Syska>> On Tue, Jan 5, 2010 at 11:54 PM, Eric Peters < > [email protected]> wrote:>>> Hello all,>>>> Thanks for taking the time to read this.>>>> Basically just did a clean install of Ubuntu 9.10 server with>> MailScanner w/ Mailwatch but when starting up I see the following in>> the mail.log "Could not use Custom Function>> code........SQLBlackWhiteList.pm, it could not be "require"d. Make>> sure the last line of the file says "1;"" Same error with the>> MailWatch.pm>>>> Anybody have any iders?>>>> Ubuntu 9.10>> Perl 5.10.0>>>> Summary of my perl5 (revision 5 version 10 subversion 0) configuration:>> Platform:>> osname=linux, osvers=2.6.24-23-server,>> archname=x86_64-linux-gnu-thread-multi>> uname='linux crested 2.6.24-23-server #1 smp wed apr 1 22:14:30>> utc 2009 x86_64 gnulinux '>> config_args='-Dusethreads -Duselargefiles -Dccflags=-DDEBIAN>> -Dcccdlflags=-fPIC -Darchname=x86_64-linux-gnu -Dprefix=/usr>> -Dprivlib=/usr/share/perl/5.10 -Darchlib=/usr/li

lists.mailscanner.infolists.mailscanner.info/pipermail/mailscanner/2010-january.txtseems to me (and...

Documents