Thomas Eckardt wrote: >> After moving the 2 IP addresses out of the web interface and into a file > configuration - following these steps: > > 1 - look in to the folder: files/optRE and find the file 'noScanIPs.txt' > 2 - make a backup of this file > 3 - now change the config back to plain IP - take care: use the same order > for the IP's like in the file noscanav.txt - and apply - this will update > the file files/optRE/noScanIPs.txt
I did the above and ran md5sum on both files. It shows they are both identical. Now, reviewing the logs from this morning shows that I was incorrect. ClamAV is still scanning 10.10.10.250, but didn't hit a SaneSecurity signature. So, what I did was set a debug on the subject "Daily mail report". The debug captured the below. If you'd like the whole .dbg file, I'll zip it up and send it to you off list: >20-01-2015 13:43:46 [Worker_1] <Maillog >20-01-2015 13:43:46 [Worker_1] <SMTPTraffic - read OK >20-01-2015 13:43:46 [Worker_1] <SMTPTraffic - process read >20-01-2015 13:43:46 [Worker_1] <doing line <.[CR][LF] > >20-01-2015 13:43:46 [Worker_1] <Maillog >20-01-2015 13:43:46 [Worker_1] <bodyWrap >20-01-2015 13:43:46 [Worker_1] <bodyWrap >20-01-2015 13:43:46 [Worker_1] <getbody - done:1 maillength:11189 >20-01-2015 13:43:46 [Worker_1] <MsgScoreTooHigh >20-01-2015 13:43:46 [Worker_1] <CheckAttachments >20-01-2015 13:43:46 [Worker_1] <MsgScoreTooHigh >20-01-2015 13:43:46 [Worker_1] <BombOK >20-01-2015 13:43:46 [Worker_1] <matchSL - supp...@drdos.info - noBombScript >20-01-2015 13:43:46 [Worker_1] <MsgScoreTooHigh >20-01-2015 13:43:46 [Worker_1] <MsgScoreTooHigh >20-01-2015 13:43:46 [Worker_1] <BombBlackOK >20-01-2015 13:43:46 [Worker_1] <MsgScoreTooHigh >20-01-2015 13:43:46 [Worker_1] <matchSL - 10.10.10.250 - noScanIP >20-01-2015 13:43:46 [Worker_1] <matchSL - 10.10.10.250 - noScanIP >20-01-2015 13:43:46 [Worker_1] <ClamAV >20-01-2015 13:43:46 [Worker_1] <ClamScanPing - maxwait 10 seconds >20-01-2015 13:43:46 [Worker_1] <ClamScanScan - maxwait 15 seconds >20-01-2015 13:43:46 m1-79426-10118 [Worker_1] [TLS-out] 10.10.10.250 <supp...@drdos.info> to: supp...@drdos.info ClamAV: scanned 11187 bytes in local message - OK 20-01-2015 13:43:46 [Worker_1] <MsgScoreTooHigh >20-01-2015 13:43:46 [Worker_1] <MsgScoreTooHigh >20-01-2015 13:43:46 [Worker_1] <URIBLok >20-01-2015 13:43:46 [Worker_1] <MsgScoreTooHigh >20-01-2015 13:43:46 [Worker_1] <MsgScoreTooHigh Doug -- Ben Franklin quote: "Those who would give up Essential Liberty to purchase a little Temporary Safety, deserve neither Liberty nor Safety." ------------------------------------------------------------------------------ New Year. New Location. New Benefits. New Data Center in Ashburn, VA. GigeNET is offering a free month of service with a new server in Ashburn. Choose from 2 high performing configs, both with 100TB of bandwidth. Higher redundancy.Lower latency.Increased capacity.Completely compliant. http://p.sf.net/sfu/gigenet _______________________________________________ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
