Hi guys, I'm running on ASSP 2.8.2 (26204). I have spiced up my ClamAV with unofficial sigs from Securiteinfo. This sometimes triggers a virus alert, which rather means the unofficial sigs have recognized something spammy. I saw this with newsletters coming in and decided to except these from virus scanning.
I set noScan:[email protected]<mailto:[email protected]>|@haulix.com<mailto:|@haulix.com> but those mails are still checked by the virus scanners: Aug 19 00:24:28 localhost assp.pl[9947]: m1-91865-11737 [Worker_1] [TLS-in] 167.89.8.50 <[email protected]<mailto:[email protected]>> to: myuser@mydomain Whitelisted sender Domain: @email.haulix.com Aug 19 00:24:28 localhost assp.pl[9947]: m1-91865-11737 [Worker_1] [TLS-in] 167.89.8.50 <[email protected]<mailto:[email protected]>> to: myuser@mydomain Whitelisted sender Domain: @haulix.com Aug 19 00:24:28 localhost assp.pl[9947]: m1-91865-11737 [Worker_1] [TLS-in] 167.89.8.50 <[email protected]<mailto:[email protected]>> to: myuser@mydomain DKIM-Signature found Aug 19 00:24:28 localhost assp.pl[9947]: m1-91865-11737 [Worker_1] [TLS-in] 167.89.8.50 <[email protected]<mailto:[email protected]>> to: myuser@mydomain info: enhanced Originated IP detection ignored IP's: 167.89.8.50 (connected IP) Aug 19 00:24:28 localhost assp.pl[9947]: m1-91865-11737 [Worker_1] [TLS-in] 167.89.8.50 <[email protected]<mailto:[email protected]>> to: myuser@mydomain info: found known good HELO 'o3.email.haulix.com' - weight is -1.9 Aug 19 00:24:28 localhost assp.pl[9947]: m1-91865-11737 [Worker_1] [TLS-in] 167.89.8.50 <[email protected]<mailto:[email protected]>> to: myuser@mydomain Message-Score: added -38 for KnownGoodHelo, total score for this message is now -38 Aug 19 00:24:28 localhost assp.pl[9947]: m1-91865-11737 [Worker_1] [TLS-in] 167.89.8.50 <[email protected]<mailto:[email protected]>> to: myuser@mydomain info: DKIM-signature precheck is skipped - DKIM result is 'pass' Aug 19 00:24:28 localhost assp.pl[9947]: m1-91865-11737 [Worker_1] [TLS-in] 167.89.8.50 <[email protected]<mailto:[email protected]>> to: myuser@mydomain info: domain haulix.com has published a DMARC record Aug 19 00:24:28 localhost assp.pl[9947]: m1-91865-11737 [Worker_1] [TLS-in] 167.89.8.50 <[email protected]<mailto:[email protected]>> to: myuser@mydomain Message-Score: added -10 (spfpValencePB) for SPF pass, total score for this message is now -48 Aug 19 00:24:28 localhost assp.pl[9947]: m1-91865-11737 [Worker_1] [TLS-in] 167.89.8.50 <[email protected]<mailto:[email protected]>> to: myuser@mydomain Message-Score: added -15 (pbwValencePB) for In Penalty White Box, total score for this message is now -63 Aug 19 00:24:29 localhost assp.pl[9947]: m1-91865-11737 [Worker_1] [TLS-in] 167.89.8.50 <[email protected]<mailto:[email protected]>> to: myuser@mydomain [Plugin] calling plugin ASSP_AFC Aug 19 00:24:29 localhost assp.pl[9947]: m1-91865-11737 [Worker_1] [TLS-in] 167.89.8.50 <[email protected]<mailto:[email protected]>> to: myuser@mydomain whitelisted (no bad attachments) Aug 19 00:24:29 localhost assp.pl[9947]: m1-91865-11737 [Worker_1] [TLS-in] 167.89.8.50 <[email protected]<mailto:[email protected]>> to: myuser@mydomain [Plugin] calling plugin ASSP_DCC Aug 19 00:24:29 localhost assp.pl[9947]: m1-91865-11737 [Worker_1] [TLS-in] [MessageOK] 167.89.8.50 <[email protected]<mailto:[email protected]>> to: myuser@mydomain message ok - (whiteListedDomains '@email.haulix.com') - [Coverage for Perpetual Paradox] -> /opt/assp/notspam/Coverage_for_Perpetual_Paradox--219085.eml Aug 19 00:24:29 localhost assp.pl[9947]: m1-91865-11737 [Worker_1] [TLS-in] 167.89.8.50 <[email protected]<mailto:[email protected]>> to: myuser@mydomain finished message - received DATA size: 39.96 kByte - sent DATA size: 41.58 kByte Aug 19 00:24:29 localhost assp.pl[9947]: m1-91865-11737 [Worker_1] [TLS-in] 167.89.8.50 <[email protected]<mailto:[email protected]>> to: myuser@mydomain disconnected: session:7FC3326216A8 167.89.8.50 - processing time 6 seconds Aug 19 00:24:29 localhost assp.pl[9947]: m1-91865-11737 [Worker_1] [TLS-in] 167.89.8.50 <[email protected]<mailto:[email protected]>> to: myuser@mydomain info: scanning stored file /opt/assp/notspam/Coverage_for_Perpetual_Paradox--219085.eml for virus ( forced by ClamAVLogScan and/or FileLogScan ) Aug 19 00:24:29 localhost assp.pl[9947]: m1-91865-11737 [Worker_1] [TLS-in] 167.89.8.50 <[email protected]<mailto:[email protected]>> to: myuser@mydomain ClamAV: scanned 41583 bytes in file /opt/assp/notspam/Coverage_for_Perpetual_Paradox--219085.eml - OK Aug 19 00:24:29 localhost assp.pl[9947]: m1-91865-11737 [Worker_1] [TLS-in] 167.89.8.50 <[email protected]<mailto:[email protected]>> to: myuser@mydomain diagnostic: FileScan will scan file - /opt/assp/virusscan/a.1.97710.eml Aug 19 00:24:29 localhost assp.pl[9947]: m1-91865-11737 [Worker_1] [TLS-in] 167.89.8.50 <[email protected]<mailto:[email protected]>> to: myuser@mydomain diagnostic: FileScan will run command - /usr/bin/gdavclientc scan:/opt/assp/virusscan/a.1.97710.eml 2>&1 Aug 19 00:24:29 localhost assp.pl[9947]: m1-91865-11737 [Worker_1] [TLS-in] 167.89.8.50 <[email protected]<mailto:[email protected]>> to: myuser@mydomain diagnostic: FileScan returned /opt/assp/virusscan/a.1.97710.eml OK Aug 19 00:24:29 localhost assp.pl[9947]: m1-91865-11737 [Worker_1] [TLS-in] 167.89.8.50 <[email protected]<mailto:[email protected]>> to: myuser@mydomain FileScan: scanned 41583 bytes in file /opt/assp/notspam/Coverage_for_Perpetual_Paradox--219085.eml - OK
_______________________________________________ Assp-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/assp-user
