[Assp-test] ASSP version 2.8.2 *SPAM-Eliminator* build 24031

2024-02-25 Thread Doug Lytle via Assp-test
Thomas, I'm seeing the below log entries in assp:     Encountered a 500 error         An error has been encountered in accessing this page.     1. Server: assp.sourceforge.net     2. URL path: /cgi-bin/assp_griplist     3. Error notes: End of script output before

[Assp-test] TLDlist download failed

2023-04-26 Thread Doug Lytle via Assp-test
Thomas, I've started seeing the below errors in my logs today.  Reviewing further back, it started on the 23rd. 26-04-2023 04:47:40 [Worker_1] AdminInfo: level-2-TLDlist download failed: HTTP/1.1 404 Not Found 26-04-2023 04:47:40 [Worker_1] AdminInfo: level-3-TLDlist download

Re: [Assp-test] Timeout for 3rd DNS?

2021-12-31 Thread Doug Lytle
On 12/31/21 9:24 AM, Dirk Kulmsee wrote: sourceforge.net and got an answer, thus DNS not failing. Now I understand! Doug ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test

Re: [Assp-test] Timeout for 3rd DNS?

2021-12-31 Thread Doug Lytle
On 12/31/21 7:25 AM, Dirk Kulmsee wrote: sourceforge.net.146 IN A 204.68.111.105 Dirk, As far as I an aware, sourceforge.net does not provide a public DNS. Doug ___ Assp-test mailing list Assp-test@lists.sourceforge.net

Re: [Assp-test] No more update to the "http" repository ?

2021-11-15 Thread Doug Lytle
>>> Sorry to bother you but it seems that the http repository on sourceforge >>> for assp.pl is not updated (18 Aug 2021) Davide, I belive Thomas uses Sourceforge for stable releases and only gets updated periodically. Doug ___ Assp-test mailing

Re: [Assp-test] Rebuild SpamDB worker thread at startup hangs

2021-10-04 Thread Doug Lytle
On 10/3/21 7:53 PM, K Post wrote: Thanks Doug.  How long does it take to start the rebuild SpamDB worker though?  Mine also runs 11, and seemingly fine, it just takes a long time to start.  I don't know why it starts before the GUI or SMTP, but suspect that it needs to be running if it's

Re: [Assp-test] Rebuild SpamDB worker thread at startup hangs

2021-10-01 Thread Doug Lytle
>>> I've been messing around (I don't think I broke anything), but at command >>> line "starting rebuild SpamDB worker thread" sits for 3+ minutes. Kevin, Restarting my install shows Starting rebuild SpamDB worker thread [10001] - ThreadCycleTime is set to 30 microseconds I'm running under

Re: [Assp-test] SMTP auth errors - block only on main port?

2021-03-09 Thread Doug Lytle
>> Summary question: is there a way to immediately ban IP's that try SMTP auth >> on a specific port, but not on other ports? Allow SMTP auth on listenPort2, >> but immediately ban any IP that fails SMTP auth on port 25? I don't think that is currently an option with ASSP, but I currently do

Re: [Assp-test] ResendMail folder

2020-09-22 Thread Doug Lytle
I tested this under Linux. Copied an old email to resend at 11:54am It was resent at 11:56am Doug ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test

Re: [Assp-test] SPF Override issue

2020-09-10 Thread Doug Lytle
Thanks Thomas, none of their DNS entries show the incoming IP Address. I went back to keeping a list of addresses. On a positive note, it appears they only have 2 addresses. Once I cleared the SPFCache, the inbound checks passed. Doug ___

[Assp-test] SPF Override issue

2020-09-10 Thread Doug Lytle
First about my system: lsb_release -a No LSB modules are available. Distributor ID: Devuan Description:    Devuan GNU/Linux 2.1 (ascii) perl -v This is perl 5, version 24, subversion 1 (v5.24.1) built for x86_64-linux-gnu-thread-multi (with 90 registered patches, see perl -V for more

[Assp-test] ASSP version 2.6.4 *SPAM-Evaporator* build 20182

2020-07-06 Thread Doug Lytle
Running under Devuan ascii. I have a user that is getting falsified fedex.com email.  The ASSP analyzer is throwing red flags everywhere. User is a SPAMLOVER, but with filter rules that move anything tagged with spam to move to the junk folder, but this version of ASSP is not tagging as

Re: [Assp-test] 20161 - relay auth failures after update - no auth used

2020-06-27 Thread Doug Lytle
On 6/27/20 8:17 AM, K Post wrote: Is anyone else seeing this? I'm not, all 535 messages are from outside my home network. Searching for unauthenticated results in no hits. This, though is only a small setup for my home mail server. Doug ___

Re: [Assp-test] Missing MX, A, and FROM for specific sender. Unicode problem?

2020-01-31 Thread Doug Lytle
>>> Interesting idea Doug. Do any of your users happen to get any SurveyMonkey >>> notifications? These are sent to the owners of surveys. I'm curious if >>> you're seeing the same malformed info in the headers. I'm no longer with that company and do not recall, Doug

Re: [Assp-test] Missing MX, A, and FROM for specific sender. Unicode problem?

2020-01-30 Thread Doug Lytle
This is not a necessarily resolution, but possibly a workaround for you. In a past life, I've had some mail servers that just caused more issues then they were worth, so I ended up identifying their mail server(S) range of IP Addresses and placed those in an alias on the firewall and did a NAT

Re: [Assp-test] Put user ID in warning message of failed smtp auth

2019-12-08 Thread Doug Lytle
On 12/8/19 7:11 AM, Thomas Eckardt wrote: Is there anyone else, who needs permanently to show authentication information multiple times in unsecured plain text? At a previous employer and currently on my home mail server, I generate Authentication Failure reports daily.  And like Mr. Post, I

Re: [Assp-test] Testing new server - everybody timeout with TLS

2019-04-22 Thread Doug Lytle
Daniel, The contents that are marked REDACTED are strings that look to be internally generated by ASSP. Sorta like an MD5SUM. Doug ___ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test

Re: [Assp-test] Testing new server - everybody timeout with TLS

2019-04-22 Thread Doug Lytle
On 4/22/19 12:07 AM, Daniel Miller via Assp-test wrote: Do I need to add anything to smtpDestinationSSL - even though I'm not using listenPortSSL? My TLS and SSL settings below.  Just to also make sure, that your DNS destination matches your certificate.  For example, smtp.yourdomain.com

Re: [Assp-test] Testing new server - everybody timeout with TLS

2019-04-21 Thread Doug Lytle
On 4/21/19 10:51 AM, Robert K Coffman Jr. -Info From Data Corp. wrote: cert.pem is used for SSLCertFile privkey.pem is used for SSLKeyFile fullchain.pem is used for SSLCAFile I am doing this as well. Since moving to LetsEncrypt, I haven't had issues with SSL/TLS on ASSP Doug

Re: [Assp-test] Help blocking images of text spam

2019-04-04 Thread Doug Lytle
On 4/4/19 12:13 PM, K Post wrote: Hi Doug, Haven't heard from in a while  Hope all is well! I've been around, lurking, but no longer manage an ASSP installation, other then my home system. I don't think that'll work for our environment.  We see tons of jpgs as attachments / embedded in

Re: [Assp-test] Help blocking images of text spam

2019-04-04 Thread Doug Lytle
Depending on the size of the client, I temporarily would ban jpg and jpeg. I would announce company wide as to why. I'd have them stored in the quarantine folder for daily review On a valid blocked email, I would discuss with the recipient Doug

Re: [Assp-test] ASSP filtering EHLO responses?

2019-04-01 Thread Doug Lytle
On 4/1/19 4:42 PM, James Moe via Assp-test wrote: Two EHLO responses are show below. The first is the response through ASSP from port 587. The second is the response directly from port 587. STARTTLS is missing from the response through ASSP! Why are they different? What settings affect

Re: [Assp-test] ASSP and Perl 5.28?

2018-11-12 Thread Doug Lytle
>>> starting 5 communication worker threads .Thread 6 terminated >>> abnormally: error: AsspSelfLoader is unable to load code from file >>> /opt/assp/sl-cache/main-ThreadStart.sl - Too many open files >>> After that assp.cfg is scrambled again, containing values like >>>

Re: [Assp-test] fail2ban ASSP filter

2018-07-01 Thread Doug Lytle
On 07/01/2018 07:08 AM, James Brown via Assp-test wrote: Does any have a good fail2ban filter for ASSP? I have this filter: /# Fail2Ban filter for Anti-Spam SMTP Proxy Server also known as ASSP/ I had to change the logging format in ASSP to get fail2ban to work, please modify to your

Re: [Assp-test] fail2ban ASSP filter

2018-07-01 Thread Doug Lytle
On 07/01/2018 07:31 AM, Doug Lytle wrote: Date/Time Format in LogDate /(LogDateFormat)/ That didn't work well. The format for date: DD-MM- hh:mm:ss Doug -- Check out the vibrant tech community on one

[Assp-test] ASSP Downloads

2018-02-15 Thread Doug Lytle
I currently have ASSP to download new versions, but I manually install them. Reviewing the download directory today shows the current assp.pl of 652 bytes? The time stamp was Feb 13, 20:40 EST; examining the contents show: SourceForge https://code.jquery.com/jquery-1.11.0.min.js";>

Re: [Assp-test] Postfix (or probably any SMTP server) logs

2017-07-26 Thread Doug Lytle via Assp-test
>>> Is there something I can adjust to have the "true" external sender IP >>> and the attempt login name exposed in my mail server logs? I run fail2ban on the ASSP server and it drops the connections Doug -- Check out

[Assp-test] ASSP SPF Failures

2017-07-20 Thread Doug Lytle via Assp-test
I'm receiving reports of email failures from rackspace.com. Their SPF record is HUGE, but passes testing from mxtoolbox.com and kitterman.com testing tools, I've temporarily had to use SPF override to accept all mail from them. Is this a bug? The logs are showing: 19-07-2017 14:37:47

Re: [Assp-test] Possible feature requests

2017-06-28 Thread Doug Lytle via Assp-test
>>> but I don't know how to implement immediate blocking after multiple >>> different IPs fail. I should elaborate a little. I don't track ASSP logs for failures of any particular email address, I look for any auth failures on a per IP Address basis and ban accordingly Doug

Re: [Assp-test] Possible feature requests

2017-06-28 Thread Doug Lytle via Assp-test
[assp_auth_failure] # Ignore failures on our local networks ignoreip = 127.0.0.1 172.21.0.0/16 192.168.0.0/16 10.0.0.0/24 enabled = true port = smtp,ssmtp filter = assp_auth_failure action = iptables-multiport[name=ASSP_AUTH, port="25,587", protocol=tcp]

Re: [Assp-test] Possible feature requests

2017-06-28 Thread Doug Lytle via Assp-test
>>> My initial reaction to this was "cool idea!", but then I thought about the >>> implications to valid users. I currently do this with Fail2Ban with an expire time. Doug -- Check out the vibrant tech community on

Re: [Assp-test] SMTP Timeouts [SOLVED]

2017-05-01 Thread Doug Lytle
>>> On Dec 19, 2015, at 2:39 PM, support supp...@drdos.info wrote: Thomas Eckardt wrote: >> Would setting it to 2, 3 or even 4 be of help? > At least 3 would be required. So we can see, if there is a renegotiating > problem. > Thomas, > I have a Postfix loglevel 3 on a TLS timeout, would you

Re: [Assp-test] fixes in assp 2.5.6 build 17036

2017-02-05 Thread Doug Lytle
On 02/05/2017 09:50 AM, Thomas Eckardt wrote: > At the end - is this really a problem? Yes; non-executable file type should not have it's execute bit set. Scripts and programs, yes, but not the .bak nor .txt or even the .db Code accidentally or maliciously being entered would run. Just my

Re: [Assp-test] fixes in assp 2.5.6 build 17036

2017-02-05 Thread Doug Lytle
On 02/05/2017 06:34 AM, Thomas Eckardt wrote: > Hi all, > > fixed in assp 2.5.6 build 17036: Thomas, I've just noted that in build 2.5.6(17026) under Linux, ASSP is setting the execute bit on all files in the ASSP directory. Doug

Re: [Assp-test] LetsEncrypt SSL Certs with ASSP

2017-01-22 Thread Doug Lytle
On 01/22/2017 08:06 AM, Thomas Eckardt wrote: > As long as you provide the certificate(s) and privat key(s) in PEM > format, this should be possible. > > Thomas > Indeed it does, Thanks Thomas! Doug -- Check out the

[Assp-test] LetsEncrypt SSL Certs with ASSP

2017-01-22 Thread Doug Lytle
Hey guys, I just followed and setup LetsEncrypt SSL Certificates for my Zimbra mail server following the below link: https://forums.zimbra.org/viewtopic.php?f=15=60781 I wanted to know if this could also be used for SSL/TLS communications with ASSP? We have problems with our MACs not liking

Re: [Assp-test] fixes in assp 2.5.4 build 16358

2016-12-27 Thread Doug Lytle
On 12/23/2016 07:49 AM, Thomas Eckardt wrote: > The GUI got a new design. ASSP will try to download and to install the > updates contained in the images folder. Thomas, I've just installed the new version of ASSP on my home system and I just LOVE the re-designed GUI! Thanks for all you do for

Re: [Assp-test] Password Protected "RTF" Files Slipping Through

2016-10-18 Thread Doug Lytle
>>> On Oct 18, 2016, at 11:20 AM, K Post nntp.p...@gmail.com wrote: >>> Doug, >>> So you're seeing this too! Did it just start this morning? Yes and that it did. Doug -- Check out the vibrant tech community on one of

Re: [Assp-test] Password Protected "RTF" Files Slipping Through

2016-10-18 Thread Doug Lytle
>>> On Oct 18, 2016, at 11:12 AM, K Post nntp.p...@gmail.com wrote: >>> organizations (some really big ones too) are seeing this on their mail >>> systems this morning too. I took the hammer approach and temporarily put it in the blocked attachment list. Doug

Re: [Assp-test] Blockreports still not working

2016-04-11 Thread Doug Lytle
Thomas Eckardt wrote: > Doug, > > please download and test ass.pl from > > http://assp.cvs.sourceforge.net/viewvc/assp/assp2/test/ > > tell me if it works. Thomas, This fixed the issue. Doug -- Find and fix

Re: [Assp-test] Blockreports still not working

2016-04-11 Thread Doug Lytle
Thomas, I'll have to do that after hours. I'll put it into place tonight and report then. Thank for looking into this! Doug -- Find and fix application performance issues faster with Applications Manager Applications

Re: [Assp-test] Blockreports still not working

2016-04-11 Thread Doug Lytle
>> Do you use any symlink, hardlink or network filesystem for the 'logs' >> folder or the files? No sir. And, Reverting back to 16080 fixes the issue. -- Find and fix application performance issues faster with

Re: [Assp-test] Blockreports still not working

2016-04-11 Thread Doug Lytle
I guess it does not. Just a side note, to be able to get Fail2Ban to work, I've changed the default log format to: DD-MM- hh:mm:ss Doug -- Find and fix application performance issues faster with Applications

Re: [Assp-test] Blockreports still not working

2016-04-11 Thread Doug Lytle
Yes. Hopefully the list supports small images: -- Find and fix application performance issues faster with Applications Manager Applications Manager provides deep performance insights into multiple tiers of your business

Re: [Assp-test] Blockreports still not working

2016-04-11 Thread Doug Lytle
Thomas Eckardt wrote: > set 'ReportLog' to diagnostic - post the log the request. > > 11-04-2016 05:12:09 [Main_Thread] Admin connection from user root on host 192.168.200.2:51415; page:/; session-ID:149029aec879d1ac7fb25f35c1720f67; 11-04-2016 05:12:09 [Main_Thread] AdminUpdate: [root

[Assp-test] Blockreports still not working

2016-04-10 Thread Doug Lytle
I had time to upgrade ASSP from 16080 to ASSP version 2.5.2(16100) today, running on Debian Wheezy. When I send an email to blockreport@assp.local requesting a report for the last 5 days, from an account that I know has blocked email I get: no blocked email found in the last 5 day(s) lines

[Assp-test] MySQL Database question

2016-04-02 Thread Doug Lytle
Thomas, I'm currently running ASSP on a Debian Virtual Machine using flat files. I've got scripts in place that, when I do a snapshot for backups, I TERM the assp process, get the snapshot and then restart ASSP. This morning, I've moved this to MySQL for my databases. My questions is, Does

Re: [Assp-test] fixes in assp 2.5.2 build 16083

2016-03-24 Thread Doug Lytle
>>> On Mar 23, 2016, at 11:25 AM, Thomas Eckardt thomas.ecka...@thockar.com >>> wrote: >>> Hi all, >>> fixed in assp 2.5.2 build 16083: Block reports are still broken under this build, returning to 16080 brings them back. Doug

Re: [Assp-test] urgent: after assp 16081 all mails older than 1 day are deleted from spam folder

2016-03-23 Thread Doug Lytle
>> It would also appear that block reports are broken. Reverting back to 16080 fixed this. Doug -- Transform Data into Opportunity. Accelerate data analysis in your applications with Intel Data Analytics Acceleration

Re: [Assp-test] urgent: after assp 16081 all mails older than 1 day are deleted from spam folder

2016-03-23 Thread Doug Lytle
>> my mistake - what else!? It would also appear that block reports are broken. Ran a report for someone that I saw had several spams in the last 2 days and the report came back as: no blocked email found in the last 2 day(s) lines with 0.0B analysed in logfiles on host assp.ourdomain.inet

Re: [Assp-test] Stopping repeated auth logon connection attempts

2016-01-26 Thread Doug Lytle
>>> On Jan 26, 2016, at 7:14 AM, Charles Marcus cmar...@media-brokers.com wrote: >>> Use the right tool for the job... >>> In this case, fail2ban (or something like it) is what you need. I agree with Charles here and I use fail2ban for these occurrences. Doug

Re: [Assp-test] fixes in assp 2.4.6 build 15362

2015-12-29 Thread Doug Lytle
>>> On Dec 29, 2015, at 8:21 AM, Thomas Eckardt thomas.ecka...@thockar.com >>> wrote: >>> Doug, what is your setting of 'OutgoingBufSizeNew' ? >>> Thomas The default: 1024 Doug --

Re: [Assp-test] SMTP Timeouts

2015-12-19 Thread Doug Lytle
Thomas Eckardt wrote: >> Would setting it to 2, 3 or even 4 be of help? > At least 3 would be required. So we can see, if there is a renegotiating > problem. Thomas, I have a Postfix loglevel 3 on a TLS timeout, would you like me to send the archive directly to you? It's 165KB compressed.

Re: [Assp-test] SMTP Timeouts

2015-12-18 Thread Doug Lytle
Thomas Eckardt wrote: > Doug, please upgrade IO::Socket::SSL to the latest version (possibly also > Net::SSLeay) and tryout the latest assp v2 dev build. > Tell me if the issue (timeouts) is gone. Thanks Thomas, I'm on vacation starting Monday and will put those into place and let you know.

Re: [Assp-test] SMTP Timeouts

2015-12-18 Thread Doug Lytle
I found some time this AM to upgrade our work ASSP: ASSP version 2.4.6(15351) IO::Socket::SSL 2.022 / 2.020 Net::SSLeay 1.72 / 1.72 I've had 30 timeouts in the last hour I'm planning on doing a TCP dump on my home mail server this upcoming Monday (running Zimbra at work

Re: [Assp-test] SMTP Timeouts

2015-12-18 Thread Doug Lytle
>>> On Dec 18, 2015, at 8:22 AM, Thomas Eckardt thomas.ecka...@thockar.com >>> wrote: >>>I've had 30 timeouts in the last hour bad news! Thank you for testing. Postfix manual for TLS logging gives: Server-side TLS activity logging To get additional information about Postfix SMTP server

[Assp-test] SMTP Timeouts

2015-12-06 Thread Doug Lytle
I am running ASSP version 2.4.6(15334) on Debian GNU/Linux 7.9 (wheezy), Perl version: perl -v This is perl 5, version 18, subversion 0 (v5.18.0) built for x86_64-linux-thread-multi I've noted that when ASSP's 'do TLS' module is enabled on port 25, I get lots of SMTP timeouts, when it's only

Re: [Assp-test] Perl's path

2015-11-28 Thread Doug Lytle
Thomas Eckardt wrote: > What about making a symlink in /usr/bin/perl to /usr/local/bin/perl ? This makes more sense, Thank you for the suggestion, I'll do that. Doug -- ___

Re: [Assp-test] blacklisted domin/address

2015-11-05 Thread Doug Lytle
>>> On Nov 5, 2015, at 9:39 AM, anders westin anders.wes...@dometic.com wrote: >>> is it possible to "lock" a incoming mail address to a certain ip address What I would probably do is to verify if they have a valid SPF record and if so, set their domain to SPF Strict. If they do not, then

Re: [Assp-test] ASSP version 2.4.6(15283)

2015-10-15 Thread Doug Lytle
>>> On Oct 15, 2015, at 8:19 AM, Thomas Eckardt thomas.ecka...@thockar.com >>> wrote: >>> Switch on debugging for such mails. >>> debugRe: automated_email\@dell\.com Debugging turned on and test quote sent. The email address and domain name have been modified to prevent spam.

[Assp-test] ASSP version 2.4.6(15283)

2015-10-15 Thread Doug Lytle
Maybe someone can suggest a way for me to diagnose the below problem. I've noted for a few months now, that when receiving an automated confirmation email from Dell, that I don't receive them on our Zimbra mail server. Reviewing the logs show that the email was received, the email domain was

Re: [Assp-test] ASSP version 2.4.6(15283)

2015-10-15 Thread Doug Lytle
Thanks for taking the time to Look Thomas, I'll look into the Zimbra side of things. Doug -- ___ Assp-test mailing list Assp-test@lists.sourceforge.net

Re: [Assp-test] Logging of Failed SMTP Auth?

2015-07-22 Thread Doug Lytle
On Jul 22, 2015, at 1:00 PM, K Post nntp.p...@gmail.com wrote: Would it be possible to have Log RE email the full line in the log which I just turned this on the other day. Edit the /assp/lib/CorrectASSPcfg.pm file. Uncomment: $main::AUTHLogUser = 1;# (0/1) write the

[Assp-test] Some mail not being passed

2015-06-24 Thread Doug Lytle
I'm currently running ASSP version 2.4.6(15162) under Debian GNU/Linux 7.8 (wheezy) with Perl: perl -v This is perl 5, version 14, subversion 2 (v5.14.2) built for x86_64-linux-gnu-thread-multi (with 89 registered patches, see perl -V for more detail) I've noted problems with email coming in

[Assp-test] Sourceforge problem?

2015-02-25 Thread Doug Lytle
I just checked my ASSP download folder to find an assp.pl file that contained the below: We're sorry -- the Sourceforge site is currently in Disaster Recovery mode, and currently requires the use of javascript to function. Please check back later. Interesting, Doug -- Ben Franklin quote:

Re: [Assp-test] Attachment blocking

2015-02-17 Thread Doug Lytle
K Post wrote: I can't figure this out to save my life. Is there something wrong with the regex? If external is set to level 2 and block, how would mails like this I didn't have reg in my list, but added it just for a test and it was blocked. My setup below: ASSP version 2.4.4(15004)

Re: [Assp-test] Gmail is blocking Emails from my (ASSP) Server

2015-02-12 Thread Doug Lytle
On Feb 12, 2015, at 12:31 PM, Christian Leicht use...@schani.com wrote: Yes, but from Gmail you cant get a answer (since 14 Days) ;-(( Check to see if you're on a blacklist: http://multirbl.valli.org/lookup/ Doug -- Ben Franklin quote: Those who would give up Essential Liberty to purchase

Re: [Assp-test] sending mails seems to be blocked

2015-02-05 Thread Doug Lytle
I am in the same internal lan as my ASSP and Mailserver. And that's where we differ. Internal to our network, I've not experienced this, only when connected remotely. Doug -- Dive into the World of Parallel

Re: [Assp-test] sending mails seems to be blocked

2015-02-05 Thread Doug Lytle
Hi, since a few weeks I have to restart assp two times a day. Sending mails seems to be blocked by assp. I've had the same issue, the only way I've worked around it is to either: 1.) Restart ASSP (Only works for a few hours) 2.) Run OpenVPN and point the outgoing SMTP directly to the

Re: [Assp-test] ClamAV - ASSP version 2.4.4(15004)

2015-01-25 Thread Doug Lytle
Thomas Eckardt wrote: Doug, there is no code in the current assp.pl that calls 'matchSL' with the parameter 'noScanIP'. This was the case in some versions before assp 2.2.2 build 12218. Thomas, I created a new Virtual Machine (Copy of the original ASSP), I deleted the contents of the /assp

Re: [Assp-test] Virus detected

2015-01-21 Thread Doug Lytle
Does anyone know if this headers are written by ASSP? *Virus Detected:* 'Sanesecurity.Jurlbl.6890.UNOFFICIAL' *Full Header:* ClamAV with the SaneSecurity signatures reports back to ASSP and ASSP adds it to the headers. Doug

Re: [Assp-test] ClamAV - ASSP version 2.4.4(15004)

2015-01-21 Thread Doug Lytle
this was a bug in 2.2.2 and was solve in assp 2.2.2 build 12218 and ASSP_AFC version 2.05 Thanks Thomas! Doug -- New Year. New Location. New Benefits. New Data Center in Ashburn, VA. GigeNET is offering a free month

Re: [Assp-test] ClamAV - ASSP version 2.4.4(15004)

2015-01-21 Thread Doug Lytle
this was a bug in 2.2.2 and was solve in assp 2.2.2 build 12218 and ASSP_AFC version 2.05 I guess I'm lost, I just noted the version number. I'm on 2.4.4 (15004) Doug -- New Year. New Location. New Benefits. New

Re: [Assp-test] ClamAV - ASSP version 2.4.4(15004)

2015-01-20 Thread Doug Lytle
Does this mean the senders in question are still in NoProcessingDomains? In this particular case, the 'sender' was my mail server. It was sending the nightly postfix report to me. For some reason, it would randomly match against either lists.digium.com or mythtv.org. Those domains are still

Re: [Assp-test] ClamAV - ASSP version 2.4.4(15004)

2015-01-20 Thread Doug Lytle
If you feel more comfortable, change the option back to ( file:files/noscanav.txt) :):) It wasn't effecting anybody but me. I'll revert my changes when I get home tonight. Doug -- New Year. New Location. New

Re: [Assp-test] ClamAV - ASSP version 2.4.4(15004)

2015-01-20 Thread Doug Lytle
Thomas Eckardt wrote: After moving the 2 IP addresses out of the web interface and into a file configuration - following these steps: 1 - look in to the folder: files/optRE and find the file 'noScanIPs.txt' 2 - make a backup of this file 3 - now change the config back to plain IP - take

Re: [Assp-test] ClamAV - ASSP version 2.4.4(15004)

2015-01-19 Thread Doug Lytle
Thomas Eckardt wrote: noScanIP I can't reproduce this issue - it works for me. After moving the 2 IP addresses out of the web interface and into a file (file:files/noscanav.txt), this problem went away. After removing @lists.digium.com|@mythtv.org from No Processing Addresses (NoProcessing)

[Assp-test] ClamAV - ASSP version 2.4.4(15004)

2015-01-17 Thread Doug Lytle
I'm running ASSP on Debian 7.7 (wheezy) on the current ASSP release. I've specified that IP address 10.10.10.250 should not be scanned because some times the SaneSecurity signatures are triggered on my daily reports. Today, I just noted that I haven't seen a report in a couple days and

Re: [Assp-test] Remote SMTP issues with TLS

2014-12-29 Thread Doug Lytle
Mr. Courtney Creighton wrote: I haven't yet devised how to properly test the software theory, but anecdotally, I've only heard complaints about this from my Thunderbird users, and not Outlook/OE/Mail users. Can I ask what MTA you're using behind ASSP? I'm using Zimbra Version

Re: [Assp-test] I'm sending messages from Yahoo?

2014-12-11 Thread Doug Lytle
James Brown wrote: Dec-11-14 10:23:53 [Worker_2] Connected: session:7FAD1B6519F8 127.0.0.1:51769 127.0.0.1:25 127.0.0.1:10026 Dec-11-14 10:23:56 [Worker_2] 127.0.0.1 info: authentication - plain is used You've got a compromised account on your system. The sender authenticated. A failed

Re: [Assp-test] Remote SMTP issues with TLS

2014-12-08 Thread Doug Lytle
Mr. Courtney Creighton wrote: If you come up with anything better, I'd love to hear it. Soon, I want to disable all user logins via unencrypted protocols, and it would be really nice to have more reliable secure connections to go with that. I'm not 100% sure it isn't the ISP causing the issue.

Re: [Assp-test] Messages getting lost?

2014-12-08 Thread Doug Lytle
James Brown wrote: [spam found] (HMM) [New Arrival Love Get Your Summer Eyewear] - /Applications/assp/spam/1073.eml; Running ASSP 2.4.4(14336), Perl is 5.018002 Am I missing something, or is there a bug that was introduced in 14336? I've seen this as well, but before 14336. Doug --

Re: [Assp-test] fixes in assp 2.4.4 build 14334

2014-12-01 Thread Doug Lytle
Thomas Eckardt wrote: - fixes a thrown exception Prototype mismatch: sub Net::SMTP::assp_starttls (-1) vs none at sub Net::SMTP::assp_starttls line 28. I was hoping this would address my SMTP STARTTLS problem, unfortunately it did not. Doug -- Ben Franklin quote: Those who would give

Re: [Assp-test] Remote SMTP issues with TLS

2014-12-01 Thread Doug Lytle
On Dec 1, 2014, at 9:15 AM, Thomas Eckardt thomas.ecka...@thockar.com wrote: your MTA does not answer after it got the The MTA (Postfix) shows: Dec 1 07:45:13 web postfix/smtpd[31547]: 72E162008D7CD: client=assp.drdos.info[10.10.10.247], sasl_method=PLAIN,

Re: [Assp-test] Remote SMTP issues with TLS

2014-12-01 Thread Doug Lytle
Maybe I need to read up on tcpdump. trace the connection between the client and assp. The client being the end user or the Mail Server? If the end user, this is happening on all of them, including my test laptop on a MiFi wireless service. If that's the case, maybe it's my firewall. I'm

[Assp-test] Remote SMTP issues with TLS

2014-11-30 Thread Doug Lytle
Everybody, I've been having issues with remote users not being able to send email using STARTTLS with SeaMonkey as the MUA on port 587, for the last couple months. The symptoms are: User goes to send email SeaMonkey's status bar indicates email is in the process of being sent. It then just

[Assp-test] Strange SPF failure

2014-10-18 Thread Doug Lytle
Little bit about my system: lsb_release -a No LSB modules are available. Distributor ID: Debian Description:Debian GNU/Linux 7.6 (wheezy) Release:7.6 Codename: wheezy perl -v This is perl 5, version 18, subversion 0 (v5.18.0) built for x86_64-linux-thread-mult SPF module

Re: [Assp-test] Strange SPF failure

2014-10-18 Thread Doug Lytle
Doug Lytle wrote: Little bit about my system: Missed the most important part: ASSP version 2.4.4(14273) -- Comprehensive Server Monitoring with Site24x7. Monitor 10 servers for $9/Month. Get alerted through email

Re: [Assp-test] Strange SPF failure

2014-10-18 Thread Doug Lytle
Doug Lytle wrote: Missed the most important part: ASSP version 2.4.4(14273) Please ignore, we've tracked down the failure. Thanks, Doug -- Comprehensive Server Monitoring with Site24x7. Monitor 10 servers for $9

Re: [Assp-test] Trying to upgrade ASSPv2

2014-07-21 Thread Doug Lytle
Colin wrote: Do you recall what you did to resolve it then? I never did. People were starting to get the perception that our mail server was having issues, having it down so much trying to figure this out, so I left it alone for almost 8 months. Figured I'd give it another try. I'll be

Re: [Assp-test] very bad news

2014-05-12 Thread Doug Lytle
Fritz Borgstedt (15. April 1945 - 8. Mai 2014) is no longer with us Oh my gosh! I didn't even know he was ill! Doug -- Accelerate Dev Cycles with Automated Cross-Browser Testing - For FREE Instantly run your Selenium

Re: [Assp-test] MaxErrors question

2014-02-25 Thread Doug Lytle
Alessandro Cattani wrote: MaxAuthErrors is set to 10 My MTA is Mailenable v. 8.01 So, how can I block these connections? I would suggest you contact Mailenable's support and have them fix their response, it looks to be broken: https://www.mailenable.com/support/step1.asp Doug -- Ben

Re: [Assp-test] Forged spam from btinternet.com

2014-01-29 Thread Doug Lytle
I'm not sure how to block these as btinternet.com publishes no SPF You can use spf override and create them a SPF record in ASSP, then use SPF strict. I believe there are examples in the ASSP GUI. Doug -- WatchGuard

Re: [Assp-test] Links in log

2014-01-21 Thread Doug Lytle
What determines if a link is supposed to be generated vs just text? Good question! I've noted this as well. -- CenturyLink Cloud: The Leader in Enterprise Cloud Services. Learn Why More Businesses Are Choosing

Re: [Assp-test] triggering Redlist reload

2013-10-22 Thread Doug Lytle
Is it possible to reload redlist upon file change (automatically, or by triggering a command) killall -HUP assp.pl Doug -- October Webinars: Code for Performance Free Intel webinars can help you accelerate

Re: [Assp-test] assp dying

2013-09-20 Thread Doug Lytle
Spyros Tsiolis wrote: Is there a way to check if assp is running and if its not start automatically. I use monit to watch ASSP. Doug -- Ben Franklin quote: Those who would give up Essential Liberty to purchase a little Temporary Safety, deserve neither Liberty nor Safety.

Re: [Assp-test] assp dying

2013-09-20 Thread Doug Lytle
However, I will have a thorough look at monit. If you go that route, here is my config: set mail-format { from: assp.monit AT somedomain.com subject: [Monit] $SERVICE $EVENT at $DATE message: Monit $ACTION $SERVICE

Re: [Assp-test] Wrong Whitelist detection?

2013-08-29 Thread Doug Lytle
Now you see in the header that the ASSP said the eMail is Whitelisted because of the hp.com, but the (mhp.com) is in all You need to make sure you have a @ in front of the hp.com, i.e. @hp.com Doug -- Learn the

Re: [Assp-test] Spoofing

2013-08-27 Thread Doug Lytle
Tim Evans wrote: Neither one of these is in my local domains ...Tim I'd suggest searching on one of those addresses in the ASSP 'View Mailog Tail' option. Once it's highlighted, you can click on the entry and have option to act on it. Also, paste the address into the White/Redlist/Tuplets

Re: [Assp-test] Spoofing

2013-08-27 Thread Doug Lytle
Aug-26-13 11:12:58 40778-13666 [Worker_1] [InvalidLocalSender] 8.31.233.118 xx...@sasco.com [spam found] Spoofing Sender in Local Domain This would indicate that the domain(s) in question is/are listed in your Local Domains config file. Doug

  1   2   3   >