Re: [AMaViS-user] RBL Monitoring.

2007-06-27 Thread mouss
Azfar Hashmi wrote:

 thanks guys now where do I get long list of rbl servers to add those in
 script.


Prefer quality over quantity.

but if you insist on quantity, take a look at the lists on dnsstuff site 
or google for check rbl and on the sites that you find, do a lookup of 
an IP and you'll see many lists. spamlink.net has many lists as well.

Note that while it is safe to use any list to lookup your own IP, you 
should only use safe lists to block mail.

you can add 127.0.0.1 and 127.0.0.2 to the list of your IPs.
- 127.0.0.1 should never be listed. This may help detect lists gone 
crazy...
- on many lists, 127.0.0.2 should be listed.





-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


Re: [AMaViS-user] Faster purging of SQL logging database

2007-06-27 Thread Hanne Moa
On 6/27/07, Hanne Moa [EMAIL PROTECTED] wrote:
 On 6/27/07, Mark Martinec [EMAIL PROTECTED] wrote:
  CREATE TEMPORARY TABLE unused AS (
SELECT id FROM maddr LEFT JOIN (
  SELECT sid AS id, 1 AS f FROM msgs UNION ALL
  SELECT rid AS id, 1 AS f FROM msgrcpt)
AS u USING(id) WHERE u.f IS NULL);
 
  DELETE FROM maddr WHERE id IN (SELECT * FROM unused);
 
  Perhaps you had something else in mind?

 I had this in mind, yes (well, a little simpler). This still doesn't
 work very well while FOREIGN KEYS exist on msgrcpt.

I wound up dropping the FOREIGN KEYS linking msgrcpt to maddr, and the
delete took seconds...

Is it guaranteed that, in msgrcpt, the pair mail_id+rid will be
unique? In that case we have a candidate for PRIMARY KEY. The indexes
made might speed things up, I'll experiment a little.


HM

-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


[AMaViS-user] ANNOUNCE amavisd-new-2.5.2 has been released

2007-06-27 Thread Mark Martinec
Version 2.5.2 of amavisd-new is available at:

  http://www.ijs.si/software/amavisd/amavisd-new-2.5.2.tar.gz

The 2.5.2 is primarily a maintenance release over 2.5.1.




amavisd-new-2.5.2 release notes

BUG FIXES

- in a milter setup log_id was left undefined, which resulted in log lines
  without id, and a SQL constraint violation Column 'am_id' cannot be null
  when logging to SQL was enabled. The bug was introduced in 2.5.1;
  problem reported by Martin Svensson; 

- suppress a quarantining attempt if the message also needs to be archived
  to the same location (same sql key or same local filename);
  reported by Wazir Shpoon;

- adjust $socketname in amavisd-release to match its default counterpart
  in amavisd (i.e. /var/amavis/amavisd.sock); reported by Stanley Appel;


NEW FEATURES

- add snmp-like counters for PenPalsSavedFromKill, PenPalsSavedFromTag3
  and PenPalsSavedFromTag2, which correspond to the number of messages
  where spam level would have exceeded a corresponding level had there
  not been for (negative) score points contributed by pen pals lookups.
  Note that for any message only one of the three counters could
  increment, the one corresponding to the highest level crossed.
  To find more information about rescued mail messages, search the log
  for a string 'PenPalsSavedFrom' (available at log level 2 or higher).
  Practical value: mail saved by pen pals from being blocked usually
  indicate false positives by SpamAssassin; examining rules which
  contributed most to the score may indicate these rules need adjustment;

- when preparing a SQL SELECT clause in lookup_sql, provide an additional
  placeholder %a in a clause template, which is much like the existing %k,
  but evaluates to an exact mail address (i.e. the same as the first entry
  in the %k list), which makes it suitable for SQL pattern matching;
  suggested by Daniel Duerr;

- macro supplementary_info can supply information on two additional
  SpamAssassin tags: AUTOLEARNSCORE and LANGUAGES if corresponding plugins
  are enabled in SpamAssassin; see README.customize for the complete list;

- provide two new subroutines available for calling from config files:
  include_config_files() and include_optional_config_files(), each take
  a list of filenames as arguments, and reads  evaluates them just like
  normal configuration files specified on a command line (option -c
  or a default amavisd.conf). This provides a simplified and uniform
  mechanism for 'including' additional configuration files, which formerly
  could be invoked through a perl do() function. The only difference
  between include_config_files and include_optional_config_files is that
  the former aborts if some specified file does not exist, while the later
  silently ignores specified but missing files. Both/each subroutine
  may be called multiple times, recursion is allowed (but some sanity
  limit to recursion is provided); based on a suggestion by Gary V.

  Example line in amavisd.conf:
include_config_files('/etc/amavisd-custom.conf');


OTHER

- provide a workaround for a crashing altermime by removing its leftover
  temporary file which would otherwise cause a temporary failure:
TempDir::check: Unexpected file
  problem reported by Dennis A. Kanevsky;

- add a mapping to 'doc' for a result 'Microsoft Installer' from a file(1)
  utility; it seems like versions 4.20 and 4.21 of file(1) (possibly earlier
  versions too) misclassify all MS Word, Excel, and PowerPoint documents
  as 'Microsoft Installer';  problem investigated and a workaround
  suggested by Noel Jones, Mike Cappella and Michael Scheidell;

- add a mapping to 'asc' for a result 'COM executable for DOS' from a file(1)
  utility; it seems like later versions of file(1) can misclassify a text
  in a GB2312 character set as a COM file; reported by Daniel J McDonald;

- updated AV entry for ESET NOD32 Linux Mail Server again - command line
  interface (nod32cli): added a status 3 (e.g. corrupted archive) back to
  the list of clean statuses;  the 3 was removed in 2.5.1 as the entry
  was substituted with the one from a NOD32 documentation; reported by
  Tamás  Gregorics;

- updated AV entry for 'F-Secure Antivirus for Linux servers' to cope
  with version 5.5 and later; a new entry provided by Peter Bieringer;

- when a command line option -g requests changing of group ID, do so
  by calling POSIX::setgid, after also attempting to assign to perl
  variables $( and $), which may not work correctly on systems where
  group ID can be negative (like group 'nobody' being -2 on Mac OS X);
  follows a SpamAssassin problem report 3994, investigated
  by Sidney Markowitz;

- when an AUTH command parameter (RFC 2554) is supplied on a MAIL FROM
  SMTP command but AUTH support has not been previously offered
  (like when authentication is disabled by an empty @auth_mech_avail),
  no longer treat the situation as a fatal error:
503 5.7.4 Error: authentication disabled
  but mercifully ignore 

[AMaViS-user] Subject_tag with AM.PDP

2007-06-27 Thread Peter Huetmannsberger

Hi, 

is it possible to modify the subject at all, using sendmail-milter with 
AM.PDP. 

I setup a test system using the new amavisd-milter and AM.PDP seems to 
work quite well. However I don't seem to manage to haveth esubject 
changed. 

Relevant entries in amavisd.conf look like this: 

$undecipherable_subject_tag = '***UNCHECKED*** ';
$sa_spam_subject_tag = undef;
$sa_spam_level_char = '*';
$sa_spam_modifies_subj = 1;
@spam_modifies_subj_maps= (\$sa_spam_modifies_subj);
@spam_subject_tag_maps  = (\$sa_spam_subject_tag1); # N.B.: inconsistent 
name
@spam_subject_tag2_maps = (\$sa_spam_subject_tag);  # N.B.: inconsistent 
name
@spam_subject_tag3_maps = ();

%subject_tag_maps_by_ccat = (
  CC_VIRUS,  [ '***INFECTED*** ' ],
  CC_BANNED, undef,
  CC_UNCHECKED,  sub { [ c('undecipherable_subject_tag') ] }, # not 
by-recip
  CC_SPAM,   [ ' SPAM ' ],
  CC_SPAMMY.',1',sub { ca('spam_subject_tag3_maps') },
  CC_SPAMMY, sub { ca('spam_subject_tag2_maps') },
  CC_CLEAN.',1', sub { ca('spam_subject_tag_maps') },
);

Is there anything else I need to change, possibly in connection with 
spamassassin, or ddo I need to define a poliyc that is relevant for all 
mails going through?

I tried to find out by reading the various readme'S but I must be too 
stupid to find out for myself. 

OT: How do you test spam, other than sending the included sample-spam. Is 
there aservice ( ;) ) one could subscribe to to actually get real spam. I 
would raher test everything on my testmachine first than change my 
production servers. 

Many thanks in advance, 

.peter

-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


Re: [AMaViS-user] Subject_tag with AM.PDP

2007-06-27 Thread Mark Martinec
Peter,


 is it possible to modify the subject at all, using sendmail-milter with
 AM.PDP.

Yes, I believe it should work.
Make sure the recipient is local - @local_domains_maps must
be configured correctly.

 I setup a test system using the new amavisd-milter and AM.PDP seems to
 work quite well. However I don't seem to manage to haveth esubject
 changed.

Do you get X-Spam-* header fields inserted? If yes, the @local_domains_maps
is probably correct. If no, then Subject is not modified for the same
reason as X-Spam-* headers are not inserted: recipient not considered local.

 Relevant entries in amavisd.conf look like this:

 $undecipherable_subject_tag = '***UNCHECKED*** ';
 $sa_spam_subject_tag = undef;
 $sa_spam_level_char = '*';
 $sa_spam_modifies_subj = 1;
 @spam_modifies_subj_maps= (\$sa_spam_modifies_subj);
 @spam_subject_tag_maps  = (\$sa_spam_subject_tag1); # N.B.: inconsistent
 name
 @spam_subject_tag2_maps = (\$sa_spam_subject_tag);  # N.B.: inconsistent
 name
 @spam_subject_tag3_maps = ();

 %subject_tag_maps_by_ccat = (
   CC_VIRUS,  [ '***INFECTED*** ' ],
   CC_BANNED, undef,
   CC_UNCHECKED,  sub { [ c('undecipherable_subject_tag') ] },
   CC_SPAM,   [ ' SPAM ' ],
   CC_SPAMMY.',1',sub { ca('spam_subject_tag3_maps') },
   CC_SPAMMY, sub { ca('spam_subject_tag2_maps') },
   CC_CLEAN.',1', sub { ca('spam_subject_tag_maps') },
 );

It is more usual that ' SPAM 'is inserted at tag2
level (=spammy), and not at kill level (whose primary purpose
is to block mail in most cases). The above can be simplified
to a single:

  $sa_spam_subject_tag = ' SPAM ';

and leaving out the assignment to %subject_tag_maps_by_ccat,
the default usually suffices, also other values are the
same as defaukt, so need not be reasserted again
(see amavisd.conf-default).

 OT: How do you test spam, other than sending the included sample-spam. Is
 there aservice ( ;) ) one could subscribe to to actually get real spam. I
 would raher test everything on my testmachine first than change my
 production servers.

The sample-spam-GTUBE-junk.txt test message contains a GTUBE
test pattern, which should score very highly by SA,
see  http://spamassassin.apache.org/gtube/

  Mark

-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


Re: [AMaViS-user] sendmail_wrapper for amavisd-new

2007-06-27 Thread Jens Strohschnitter

  I have updated some of our servers running the old
  amavisd-0.3.13 up to amavisd-new-2.4.5.
  Anything works very fine, but in my old amavisd-file
  I have the entries:
  
  # What sendmail wrapper to use
  $sendmail_wrapper = /usr/lib/sendmail;
  $sendmail_wrapper_args = -oMr scanned-ok -i -t;
  
  But in amavid-new I can't find any similar entry
  that adds scanned-ok to any scanned mail.
  
  Is it possible to activate the wrapper-command in
  amavisd-new ?
 
 Das braucht man gar nicht mehr, amavisd-new spricht SMTP.
 scanned-ok? Amavisd-new fügt einen Header ein.

Hi

this parameter is needed by our installation, that freeze 
mails  than 1 MB and release them every night at 20 o'clock.

The global-system-filter of exim looks like:

if $received_protocol is not scanned-ok and $message_size above 
500K then freeze Message war
groesser 500K und wurde eingefroren 
endif

This parameter is needed for the global-system-filter. 

-- 
Regards,

 Jens Strohschnitter

-
*!!!LINUX LINUX LINUX LINUX LINUX!!!*
 
* http://www.jens-strohschnitter.de *
-
Set the controls for 
 the heart of the sun
-
__

Raiffeisen Waren-Zentrale Rhein-Main eG
50668 Koeln, Altenberger Str. 1a

Tel: 0221/1638-0
Fax: 0221/1638-254

Sitz: Koeln

Amtsgericht Koeln, GnR 728

Vorstand: 
Hans-Josef Hilgers (Sprecher)
Markus Stuettgen
Dr. Karl-Heinrich Suemmermann
Friedhelm Decker (Vorsitzender)
Ingo Steitz

Vorsitzender des Aufsichtsrates: 
Peter Bleser (MdB)

St.Nr.: 215/5938/0152

Bankverbindung:
WGZ Bank AG, Duesseldorf
(BLZ 300 600 10) Konto-Nr.: 300 011



-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/

Re: [AMaViS-user] sendmail_wrapper for amavisd-new

2007-06-27 Thread Mark Martinec
Jens,

 I have updated some of our servers running the old
 amavisd-0.3.13 up to amavisd-new-2.4.5.
 Anything works very fine, but in my old amavisd-file
 I have the entries:

 # What sendmail wrapper to use
 $sendmail_wrapper = /usr/lib/sendmail;
 $sendmail_wrapper_args = -oMr scanned-ok -i -t;

 But in amavid-new I can't find any similar entry
 that adds scanned-ok to any scanned mail.

 Is it possible to activate the wrapper-command in
 amavisd-new ?

The amavisd.conf-sample contains an example, the
relevant configuration variable is $forward_method
(and $notify_method, which is usually the same value):

# SENDMAIL (old non-milter setup, as relay, deprecated):

$forward_method =
 'pipe:flags=q argv=/usr/sbin/sendmail -C/etc/sendmail.orig.cf -i -f ${sender} 
-- ${recipient}';

$notify_method = $forward_method;


Which MTA are you using?
With Exim take a look at: README_FILES/README.exim*

  Mark

-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


Re: [AMaViS-user] sendmail_wrapper for amavisd-new

2007-06-27 Thread Mark Martinec
Jens,

   $sendmail_wrapper_args = -oMr scanned-ok -i -t;

P.S., *NEVER* use option -t to a sendmail (or its lookalike)
submission program when invoked from a content filter.
You *MUST* pass actual envelope recipients to it, and
not let it guess them (incorrectly) from a mail header!

  Mark

-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


Re: [AMaViS-user] Subject_tag with AM.PDP

2007-06-27 Thread Peter Huetmannsberger


Hello Marc, 

thank you for your answer. 
 
 Yes, I believe it should work.
 Make sure the recipient is local - @local_domains_maps must
 be configured correctly.
 
 Do you get X-Spam-* header fields inserted? If yes, the @local_domains_maps
 is probably correct. If no, then Subject is not modified for the same
 reason as X-Spam-* headers are not inserted: recipient not considered local.


I do get the header inserts done: 

Return-Path: [EMAIL PROTECTED]
X-Virus-Scanned: amavisd-new at test.bruckneruni.at
X-Spam-Flag: NO
X-Spam-Score: 2.899
X-Spam-Level: **
X-Spam-Status: No, score=2.899 tagged_above=2 required=6.31
tests=[TVD_SPACE_RATIO=2.899]



However the subject does not change, even after changing it to the 
oneliner you have sent. 

   $sa_spam_subject_tag = ' SPAM ';

 The sample-spam-GTUBE-junk.txt test message contains a GTUBE
 test pattern, which should score very highly by SA,
 see  http://spamassassin.apache.org/gtube/

I have tried the GTUBE message, and it catches it right away. However it 
is way above my cutoff level, thus notchanging the subject. However the 
above message should show up in the Subject, as it does in the headers, 
right?

Greetings and thanks, 

.peter

-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


Re: [AMaViS-user] Subject_tag with AM.PDP

2007-06-27 Thread Mark Martinec
Peter,

 I do get the header inserts:

 Return-Path: [EMAIL PROTECTED]
 X-Virus-Scanned: amavisd-new at test.bruckneruni.at
 X-Spam-Flag: NO
 X-Spam-Score: 2.899
 X-Spam-Level: **
 X-Spam-Status: No, score=2.899 tagged_above=2 required=6.31
 tests=[TVD_SPACE_RATIO=2.899]

Ok, so @local_domains_maps is correct.
The 'X-Spam-Status: No' tells that spam score was below tag2 level
(where subject modifications start), and above tag level (which
enables adding X-Spam-* header fileds). Si in this case it was
normal that subject was not modified.

 I have tried the GTUBE message, and it catches it right away. However it
 is way above my cutoff level, thus notchanging the subject. However the
 above message should show up in the Subject, as it does in the headers,
 right?

Only if score is above tag2 level (and mail still pasess).

Try setting kill level very high (or $final_spam_destiny=D_PASS,
which lets mail pass even if it scores above kill level),
then set tag2 level at 5, and try with a test-messages/sample-spam.txt
test message.

  Mark

-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


Re: [AMaViS-user] sendmail_wrapper for amavisd-new

2007-06-27 Thread Mark Martinec
Jens,

 thanx for the quick reply. I'm running exim 4.3x as MTA.
 README.exim.v3app views me something about forward_method.
 Added the following entries to my amavisd.conf:
   $forward_method = 'pipe:flags=q argv=/usr/sbin/exim
-oMr scanned-ok -i -f ${sender} -- ${recipient}';
   $notify_method = $forward_method;
 Taken from REAMDE.exim.v3app

Yes, that looks about right, if you insist on passing mail
through pipes instead of the more universal SMTP.

 I have set it in amavisd.conf, but got an error like:

 2007-06-27 17:33:18 1I3ZWA-0002Qq-A0 =  U=vscan P=scanned-ok S=13352
 [EMAIL PROTECTED]
 2007-06-27 17:33:18 1I3ZWA-0002Qq-A0 ** [EMAIL PROTECTED]: Too
 many Received headers - suspected mail loop

It looks as if mail got caught in a loop. The key issue is
that MTA must know that a message coming from amavisd via $forward_method
or $notify_method must not be scanned again. How to achieve this depends
on MTA, and I don't know much about Exim, sorry. Seems like the presence
of '-oMr scanned-ok' on a command line and an associated conditional
in MTA config should take care of it. I believe you know you ways
around Exim better than most folks on this mailing list do.

Btw, since you are using exim 4.*, passing messages between MTA and
amavisd through SMTP is easier than with previous versions, and
is a preferred method, allowing a content filter to pass
more informative status messages back to MTA.

  Mark

-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


Re: [AMaViS-user] ANNOUNCE amavisd-new-2.5.2 has been released

2007-06-27 Thread Gary V
Mark wrote:

 Version 2.5.2 of amavisd-new is available at:

   http://www.ijs.si/software/amavisd/amavisd-new-2.5.2.tar.gz

 The 2.5.2 is primarily a maintenance release over 2.5.1.

   Adding the following two lines to amavisd.conf adds the directory name
   containing modules with compiled rules to Perl modules search path and
   allows Perl to find the listed module(s):
 my($sa_instdir) = '/var/db/spamassassin/compiled/3.002001';
 unshift(@INC, $sa_instdir, $sa_instdir.'/auto');

The majority would use /var/lib/spamassassin/compiled/3.002001

 Mark

Gary V



-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


Re: [AMaViS-user] How to block ALL attachments except some?

2007-06-27 Thread Mark Martinec
Živjo Danilo,

 I need to block all attachments except those specificly
 listed (.pdf, .odt, ...).
 How can I achieve that with amavisd-new 2.4.3?

Sorry for a later reply.

The $banned_filename_re is a list of rules, each granting or blocking
mail if it matches. The list is traversed sequentially (for each
mail part individually), the first rule that matches decides fate
for this mail part. If no mail parts are blocked by this procedure,
entire mail message is not banned.

So in order to achieve what you would like, you'd need to place
rules explicitly allowing each permissible type first, then
have a block-all rule by the end of the list.

Something like:

$banned_filename_re = new_RE(
  # explicitly allow the following file(1) types:
  [ qr'^\.(txt|asc|html|empty)$' = 0 ],
  [ qr'^\.(pdf|odt|ps)$'   = 0 ],
  [ qr'^\.(rpm|cpio|tar)$' = 0 ],
  # block all other file(1) types:
  [ qr'^\.[a-zA-Z0-9]*$'   = 1 ],
);

The above rules only apply to short content type names
as obtained by mapping a result from a file(1) utility
through $map_full_type_to_short_type_re mapping
(check the source for a default value of this list).

It would be possible to add rules on MIME types and
on file names to the above, although things may quickly
become unmanagable. Keep in mind that a MIME message
is a tree structure, all nodes are quivalent in principle,
the term 'attachment' is just a commonly (mis)used term
for any MIME type beyond the first one. Checking on
$banned_filename_re rules does not distinguish between
positions of mail parts in a MIME tree, all are treated
equally, including the first part. I would not be surprised
if it turns out the approach given by the example above
tuns out to be less useful than expected.

Pozdrav
   Mark

-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


Re: [AMaViS-user] Give message back from maildrop to amavis

2007-06-27 Thread Renato Botelho
On 6/27/07, Mark Martinec [EMAIL PROTECTED] wrote:
 Renato,

2) Configure maildrop to add a mark on message header sayng it needs
to be quarantined, and give the message back to amavisd-new, and
amavisd-new quarantine this one.
   
I would like to implement the second solution, is it possible? I have
no idea how to configure amavisd-new to figure out that message need
to be quarantined based on an custom header.
 [...]
  Nice idea, but in this case message will have a score, isn't there a
  way to tell amavis to just quarantine a message if a custom header is
  found? Without scoring it with SA.

 You could let amavisd listen on an additional dedicated tcp port number,
 and attach a policy bank to that port which enables archive_quarantine
 (available since 2.4.3, check release notes). Then a mail delivery filter
 could submit mail back to amavisd on this port via SMTP, and it will
 unconditionally be quarantined. All checks may be disabled, and mail
 forwarding should probably be disabled too on this policy bank so that
 mail sent to this port will effectively be lost (and quarantined).

 Something like this:


 $inet_socket_port = [10024,10099];
 $interface_policy{'10099'} = 'ARCHIVER';

 $policy_bank{'ARCHIVER'} = {
   archive_quarantine_method = 'sql:',
   forward_method = undef,  # lose mail!
   bypass_decode_parts = 1,
   bypass_virus_checks_maps  = [1],
   bypass_spam_checks_maps   = [1],
   bypass_banned_checks_maps = [1],
   bypass_header_checks_maps = [1],
 };

Great solution, worked like a dream!!

Just one thing, it still show this on log

Jun 27 15:14:48 sm3500 amavis[24266]: (24266-02) p003 1 Content-Type:
multipart/alternative
Jun 27 15:14:48 sm3500 amavis[24266]: (24266-02) p001 1/1
Content-Type: text/plain, size: 37 B, name:
Jun 27 15:14:48 sm3500 amavis[24266]: (24266-02) p002 1/2
Content-Type: text/html, size: 274 B, name:

Does it mean bypass_decode_parts is not working?

Thanks in advance
-- 
Renato Botelho

-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


Re: [AMaViS-user] Give message back from maildrop to amavis

2007-06-27 Thread Renato Botelho
On 6/27/07, Mark Martinec [EMAIL PROTECTED] wrote:
 Renato,

  Great solution, worked like a dream!!
 
  Just one thing, it still show this on log
 
  Jun 27 15:14:48 sm3500 amavis[24266]: (24266-02) p003 1 Content-Type:
  multipart/alternative
  Jun 27 15:14:48 sm3500 amavis[24266]: (24266-02) p001 1/1
  Content-Type: text/plain, size: 37 B, name:
  Jun 27 15:14:48 sm3500 amavis[24266]: (24266-02) p002 1/2
  Content-Type: text/html, size: 274 B, name:
 
  Does it mean bypass_decode_parts is not working?

 It probably means that your amavisd-new is older than 2.5.1.
 (btw, 2.5.2 just came out).

Bingo, it's 2.5.0. I'm providing update to 2.5.2 right now :)

Thanks again
-- 
Renato Botelho

-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


Re: [AMaViS-user] Give message back from maildrop to amavis

2007-06-27 Thread Renato Botelho
On 6/27/07, Mark Martinec [EMAIL PROTECTED] wrote:
 Renato,

  Great solution, worked like a dream!!
 
  Just one thing, it still show this on log
 
  Jun 27 15:14:48 sm3500 amavis[24266]: (24266-02) p003 1 Content-Type:
  multipart/alternative
  Jun 27 15:14:48 sm3500 amavis[24266]: (24266-02) p001 1/1
  Content-Type: text/plain, size: 37 B, name:
  Jun 27 15:14:48 sm3500 amavis[24266]: (24266-02) p002 1/2
  Content-Type: text/html, size: 274 B, name:
 
  Does it mean bypass_decode_parts is not working?

 It probably means that your amavisd-new is older than 2.5.1.
 (btw, 2.5.2 just came out).

I've upgraded to 2.5.2 and everything is working really fine now.

Thanks a lot!
-- 
Renato Botelho

-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


[AMaViS-user] TROUBLE in check_mail

2007-06-27 Thread Peter Huetmannsberger

Hi, 

TROUBLE in check_mail: mime_decode-1 FAILED: Can't locate object method 
max_parts via package MIME::Parser at /usr/sbin/amavisd line 5933, 
GEN20 line 17.

This is using anything higher than amavisd-new.2.4.3

As sson as I update to 2.4.4 this problem appears. 

My perl-MIME-tools is 5.420

perl is 5.8.3

OS is FC1 

I have tried amavisd-new-2.5.1 and the result is the same. 

Does anyone have a hint, what might be the problem. 

Thanks, 

.peter


-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


Re: [AMaViS-user] TROUBLE in check_mail

2007-06-27 Thread Mark Martinec
Peter,

 TROUBLE in check_mail: mime_decode-1 FAILED: Can't locate object method
 max_parts via package MIME::Parser at /usr/sbin/amavisd line 5933,
 GEN20 line 17.
 This is using anything higher than amavisd-new.2.4.3

 As soon as I update to 2.4.4 this problem appears.
 My perl-MIME-tools is 5.420
 perl is 5.8.3
 OS is FC1
 I have tried amavisd-new-2.5.1 and the result is the same.

amavisd-new-2.4.4 release notes

- limit recursion in MIME::Parser to $MAXFILES to prevent MIME parser from
  fully traversing degenerate cases of broken MIME messages which can take
  excessive amount of time and memory; reported and a sample provided by
  Joshua Goodall, solution suggested by David F. Skoll;

This requires MIME::Parser 5.420.

 My perl-MIME-tools is 5.420

Are you sure that amavisd finds this version? Check its log at startup
(or start with 'amavisd debug' and abort after few screenfuls),
check for:

  amavis[62710]: Module MIME::Entity5.420
  amavis[62710]: Module MIME::Parser5.420
  amavis[62710]: Module MIME::Tools 5.420

It could be that you have two versions of MIME-Tools installed.

  Mark

-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


Re: [AMaViS-user] Amavis/SA configured but not processing mail

2007-06-27 Thread Joshua J. Kugler
On Tuesday 26 June 2007 18:13, Gary V wrote:
 You won't see X-Virus-Scanned unless you are doing virus scans, but
 that is another matter.

OK

 With $sa_tag_level_deflt  = -999; and
 @local_domains_maps = ( [ .example.com ] );

Those are set.

 and spam checks are not bypassed, it should work.

That's what I'd think...I have no idea what I'm missing.  It seems like there 
would be some config option to say Pass all message through SA.  Or is that 
he implicit default, unless disabled?

 Is there another 
 server downstream removing X-Spam headers?

No, the messages are arriving on the server and delivered locally.

 At this point you probably 
 are going to have to raise $log_level to 5 long enough for a message
 to go through. Alternately, you can send yourself a message with your
 sender address in @debug_sender_maps:

 # If sender matches ACL, turn debugging fully up, just for this one message
 @debug_sender_maps = ( ['[EMAIL PROTECTED]'] );

I put this line in the conf file:

@debug_sender_maps = ( ['[EMAIL PROTECTED]']);

restarted amavis, and sent my user on that system an e-mail.

 In your log look for something like:

 Jun 26 20:07:19 sfa amavis[4225]: (04225-01) headers CLUSTERING: NEW
 CLUSTER [EMAIL PROTECTED]: score=-0.155, tag=1, tag2=0, local=1, bl=, s=,
 mangle=

I got:

amavis[31807]: (31807-01) Passed CLEAN, [216.115.115.245] [216.115.115.226] 
[EMAIL PROTECTED] - [EMAIL PROTECTED], Message-ID: 
[EMAIL PROTECTED], mail_id: 3gBKzLCipUuC, Hits: -, 
212 ms

So the debug sender maps weren't taking effect.

 maybe something like this to narrow it down:
 grep header /var/log/maillog

Returns nothing.

There is a file in /etc/amavis/conf.d that has the following confusing 
language:

# You can modify this file to re-enable SPAM checking through spamassassin
# and to re-enable antivirus checking.
.
.
.
#
# Default SPAM checking mode
# Uncomment the two lines below to enable it back
#

@bypass_spam_checks_maps = (
   \%bypass_spam_checks, [EMAIL PROTECTED], \$bypass_spam_checks_re);

Those two lines were commented out.  So I uncommented them.  Still no change 
in behavior.  My config file doesn't have %bypass_spam_checks, 
@bypass_spam_checks_acl, or $bypass_spam_checks_re.  I guess that means 
they're undefined, and thus not affecting anything?

I'm sorry for all this hassle...I really don't see what I have configured 
incorrectly.  Do you want me to post my entire Amavis config?  I can't see 
why this would be so difficult. :)  Should I just connect Spamd directly with 
Postfix and take out Amavis completely?

j

-- 
Joshua Kugler   
Lead System Admin -- Senior Programmer
http://www.eeinternet.com
PGP Key: http://pgp.mit.edu/  ID 0xDB26D7CE
PO Box 80086 -- Fairbanks, AK 99708 -- Ph: 907-456-5581 Fax: 907-456-3111

-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


Re: [AMaViS-user] Amavis/SA configured but not processing mail

2007-06-27 Thread Joshua J. Kugler
On Wednesday 27 June 2007 16:43, Mark Martinec wrote:
  I'm sorry for all this hassle...I really don't see what I have configured
  incorrectly.  Do you want me to post my entire Amavis config?  I can't
  see why this would be so difficult. :)

 Perhaps we should see the full log now (at log level 5, or: 'amavid debug'
 ) if the above does not help.

Attached is a debug output from one message (I think) using /etc/init.d/amavis 
debug.

A couple troubling things catch my eye:

Jun 27 16:49:49 mail.warbelows.com /usr/sbin/amavisd-new[32498]: (32498-01) 
lookup (debug_sender) = undef, [EMAIL PROTECTED] does not match

But I have this line in my config file: @debug_sender_maps = ( 
['[EMAIL PROTECTED]']);

At line 193, there is this:
Jun 27 16:49:49 mail.warbelows.com /usr/sbin/amavisd-new[32498]: (32498-01) 
calling SA parse, SA version 3.1.0
Jun 27 16:49:49 mail.warbelows.com /usr/sbin/amavisd-new[32498]: (32498-01) 
CALLING SA check
Jun 27 16:49:51 mail.warbelows.com /usr/sbin/amavisd-new[32498]: (32498-01) 
RETURNED FROM SA check, time left: 30 s
Jun 27 16:49:51 mail.warbelows.com /usr/sbin/amavisd-new[32498]: (32498-01) 
prolong_timer after spam_scan_SA: remaining time = 480 s
Jun 27 16:49:51 mail.warbelows.com /usr/sbin/amavisd-new[32498]: (32498-01) 
spam_scan: score=0 tests=[none]

So it called SA...but it gives no results from the call?

I don't think it has to do with message size...even my small test messages 
aren't getting any headers.

Thank again for all your help!

j

-- 
Joshua Kugler   
Lead System Admin -- Senior Programmer
http://www.eeinternet.com
PGP Key: http://pgp.mit.edu/  ID 0xDB26D7CE
PO Box 80086 -- Fairbanks, AK 99708 -- Ph: 907-456-5581 Fax: 907-456-3111
-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/

Re: [AMaViS-user] Subject_tag with AM.PDP

2007-06-27 Thread Mark Martinec
Peter,

 I had the tag2_level and the kill_level set at the same number, which made
 it impossible to get a mail with an altered subject line. It does work
 quite well, thanks again.

Yes, setting tag2_level and kill_level at the same value is one
of the common approaches. Still, mail above kill level can reach
recipients which are spam lovers, or when $final_spam_destiny = D_PASS

 Are there any recommendations at what level one should set the tag2_level
 in relation to the cut-off level. I have had a very strict setting of 5.5
 for both of these, but the number of false positives had increased to an
 unbearable level for the users. Maybe 2-3 a week.

Having cut-off limit at the same level (or below) as kill level
is equivalent to $final_spam_destiny=D_DISCARD. The later
I believe makes the intention more obvious in a config file.

Some folks keep tag2 at a reasonably good spam threshold, e.g. between
5.5 and 7, but let through the marginal spam, marked as spam, up to
some higher safe kill level, perhaps 8 or 10 or 12, above which delivery
is no longer made (only quarantined).

If quarantine will be readily accessible to users,
set $final_spam_destiny=D_DISCARD and don't bother with
$sa_dsn_cutoff_level. Bounces to spam are bad practice anyway.

 My next step is to try the sql quarantine and then MailZu, so the users
 can take care of the problem themselves. Hopefully!

Have a gap between tag2 and kill levels as narrow or as wide as you like.
Try and see what makes more sense to you and your users.

  Mark

-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


Re: [AMaViS-user] Amavis/SA configured but not processing mail

2007-06-27 Thread Mark Martinec
Joshua.

 Attached is a debug output from one message (I think) using
 /etc/init.d/amavis debug.

Sorry, this mailing list is stripping most attachments.
Either post in-line, or store on some server and provide URL.

 A couple troubling things catch my eye:

 Jun 27 16:49:49 mail.warbelows.com /usr/sbin/amavisd-new[32498]: (32498-01)
 lookup (debug_sender) = undef, [EMAIL PROTECTED] does not match

 But I have this line in my config file: @debug_sender_maps = (
 ['[EMAIL PROTECTED]']);

Most strange.


 At line 193, there is this:
 Jun 27 16:49:49 mail.warbelows.com /usr/sbin/amavisd-new[32498]: (32498-01)
 calling SA parse, SA version 3.1.0
 Jun 27 16:49:49 mail.warbelows.com /usr/sbin/amavisd-new[32498]: (32498-01)
 CALLING SA check
 Jun 27 16:49:51 mail.warbelows.com /usr/sbin/amavisd-new[32498]: (32498-01)
 RETURNED FROM SA check, time left: 30 s
 Jun 27 16:49:51 mail.warbelows.com /usr/sbin/amavisd-new[32498]: (32498-01)
 prolong_timer after spam_scan_SA: remaining time = 480 s
 Jun 27 16:49:51 mail.warbelows.com /usr/sbin/amavisd-new[32498]: (32498-01)
 spam_scan: score=0 tests=[none]

 So it called SA...but it gives no results from the call?
 I don't think it has to do with message size...even my small test messages
 aren't getting any headers.

You are right, the size is not a problem, nor is a bypass*.

Seems to be an issue with spamassassin.

When you were doing your experiments with a command-line 'spamassassin',
did you ensure the program was running under the same UID as amavisd runs 
under?  Something like the following is a common practice:
  # su vscan -c 'spamassassin -t -D test.msg'

If this does work correctly, then compare this SA debug output
with what is reported in the first couple of screenfulls
when you start amavisd as:  amavisd debug-sa
Pay attention to correct paths/directories and possible
access violations to these directories. Check also that
the same version of Perl is in use, in case you have
more than one version installed.

 Amavisd-new 2.3.3
 Spamassassin 3.1.0a

Are you still using these old versions? The current
versions are 2.5.2 (or 2.4.5 if need be), and SA 3.1.8 or 3.2.1.
We are losing details of 2.3.3 from our collective mind,
it is more likely to get a quality help if you stick
to more recent versions.  2.3.3 is from August 2005,
hardly anyone remembers it.

  Mark

-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


[AMaViS-user] Amavisd and clamd

2007-06-27 Thread John Fox
Hello,

  Could you please tell me how to change the calling of clamd from
/var/run/clamav/clamd.sock to 127.0.0.1:3310 in amavisd.conf.
Many thanks.
John Fox



-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


Re: [AMaViS-user] Amavisd and clamd

2007-06-27 Thread Mark Martinec
John,

   Could you please tell me how to change the calling of clamd from
 /var/run/clamav/clamd.sock to 127.0.0.1:3310 in amavisd.conf.

['ClamAV-clamd',
  \ask_daemon, [CONTSCAN {}\n, 127.0.0.1:3310],
  qr/\bOK$/, qr/\bFOUND$/,
  qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],


Mark

-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


[AMaViS-user] p0f, not being queried

2007-06-27 Thread Jason Gauthier
All,

  I've been reading some documentation, and trying to implement p0f
fingerprint checking.
I went ahead and turned it on in my config:
$os_fingerprint_method = 'p0f:127.0.0.1:2345';  # to query
p0f-analyzer.pl

And the resulting amavisd log shows that the fingerprint code is loaded.

I am running this from the command line for testing:
p0f -l 'tcp dst port 25' | p0f-analyzer.pl 2345
(with p0f-analyzer in debug mode)

I'm not getting any queries.  So, I went ahead and fired up tcpdump.
Amavisd does not appear to be attempting to communicate.   I can verify
this is an external host and should not be hitting the MYNETS rules.

Am I missing something obvious here?

Thanks,

Jason

-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


Re: [AMaViS-user] Amavis/SA configured but not processing mail

2007-06-27 Thread Gary V
Mark wrote:

 Joshua.

 Attached is a debug output from one message (I think) using
 /etc/init.d/amavis debug.

 Sorry, this mailing list is stripping most attachments.
 Either post in-line, or store on some server and provide URL.

 A couple troubling things catch my eye:

 Jun 27 16:49:49 mail.warbelows.com /usr/sbin/amavisd-new[32498]: (32498-01)
 lookup (debug_sender) = undef, [EMAIL PROTECTED] does not match

 But I have this line in my config file: @debug_sender_maps = (
 ['[EMAIL PROTECTED]']);

 Most strange.

 At line 193, there is this:
 Jun 27 16:49:49 mail.warbelows.com /usr/sbin/amavisd-new[32498]: (32498-01)
 calling SA parse, SA version 3.1.0
 Jun 27 16:49:49 mail.warbelows.com /usr/sbin/amavisd-new[32498]: (32498-01)
 CALLING SA check
 Jun 27 16:49:51 mail.warbelows.com /usr/sbin/amavisd-new[32498]: (32498-01)
 RETURNED FROM SA check, time left: 30 s
 Jun 27 16:49:51 mail.warbelows.com /usr/sbin/amavisd-new[32498]: (32498-01)
 prolong_timer after spam_scan_SA: remaining time = 480 s
 Jun 27 16:49:51 mail.warbelows.com /usr/sbin/amavisd-new[32498]: (32498-01)
 spam_scan: score=0 tests=[none]

 So it called SA...but it gives no results from the call?
 I don't think it has to do with message size...even my small test messages
 aren't getting any headers.

 You are right, the size is not a problem, nor is a bypass*.

 Seems to be an issue with spamassassin.

 When you were doing your experiments with a command-line 'spamassassin',
 did you ensure the program was running under the same UID as amavisd runs 
 under?  Something like the following is a common practice:
   # su vscan -c 'spamassassin -t -D test.msg'

 If this does work correctly, then compare this SA debug output
 with what is reported in the first couple of screenfulls
 when you start amavisd as:  amavisd debug-sa
 Pay attention to correct paths/directories and possible
 access violations to these directories. Check also that
 the same version of Perl is in use, in case you have
 more than one version installed.

 Amavisd-new 2.3.3

The Debian amavisd-new 2.3.3 package probably uses /etc/amavis/amavisd.conf if 
it
is started with 'amavisd-new start' and it will use the files found in
/etc/amavisd/conf.d/ if started with /etc/init.d/amavis start. This
version of amavisd-new on Debian is a mess. What config files are you
changing, and how are you starting amavisd-new? For the moment, to be
consistent, start amavisd-new with '/etc/init.d/amavis start' and use
/etc/amavis/conf.d/50-user as the file you change.

Gary V


-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


Re: [AMaViS-user] Amavis/SA configured but not processing mail

2007-06-27 Thread Gary V

 Amavisd-new 2.3.3

 The Debian amavisd-new 2.3.3 package probably uses /etc/amavis/amavisd.conf 
 if it
 is started with 'amavisd-new start' and it will use the files found in
 /etc/amavisd/conf.d/ if started with /etc/init.d/amavis start. This
 version of amavisd-new on Debian is a mess. What config files are you
 changing, and how are you starting amavisd-new? For the moment, to be
 consistent, start amavisd-new with '/etc/init.d/amavis start' and use
 /etc/amavis/conf.d/50-user as the file you change.

This is outdated and there is advice that is no longer accurate (because etch
is now stable) but if you care to spend the time to read it it will
help you understand the mess the Debian packagers made with 2.3.3:
http://www200.pair.com/mecham/spam/debian-amavisd-new_2.3.3.html

As far as bypassing spam and virus checks goes (provided you start
amavisd-new with '/etc/init.d/amavis start' and not 'amavisd-new start'):

in  /usr/share/amavis/conf.d/20-package spam and virus checks are
disabled (Debian default):
http://www200.pair.com/mecham/debian/20-package

to re-enable them you have to uncomment the settings in 
/etc/amavis/15-content_filter_mode
http://www200.pair.com/mecham/debian/2.4.2/15-content_filter_mode

If you ever upgrade to etch, you can install the Debian amavisd-new
2.4.2 package, then get rid of the Debian package (but keep your
config files):

http://www200.pair.com/mecham/spam/amavisd-new-etch-migration.html

Note that installing the amavisd-new 2.4.2 package on a sarge machine
may upgrade libc6 (and possibly the kernel) and you could end up with
a broken system.

Gary V


-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/


Re: [AMaViS-user] Amavisd and clamd

2007-06-27 Thread John Fox
Thank you you help is gratefully appreciated.

John Fox

- Original Message -
From: Mark Martinec [EMAIL PROTECTED]
To: amavis-user@lists.sourceforge.net
Sent: Thursday, June 28, 2007 10:07 AM
Subject: Re: [AMaViS-user] Amavisd and clamd


 John,

Could you please tell me how to change the calling of clamd from
  /var/run/clamav/clamd.sock to 127.0.0.1:3310 in amavisd.conf.

 ['ClamAV-clamd',
   \ask_daemon, [CONTSCAN {}\n, 127.0.0.1:3310],
   qr/\bOK$/, qr/\bFOUND$/,
   qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],


 Mark

 -
 This SF.net email is sponsored by DB2 Express
 Download DB2 Express C - the FREE version of DB2 express and take
 control of your XML. No limits. Just data. Click to get it now.
 http://sourceforge.net/powerbar/db2/
 ___
 AMaViS-user mailing list
 AMaViS-user@lists.sourceforge.net
 https://lists.sourceforge.net/lists/listinfo/amavis-user
 AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
 AMaViS-HowTos:http://www.amavis.org/howto/


 --
 No virus found in this incoming message.
 Checked by AVG Free Edition.
 Version: 7.5.476 / Virus Database: 269.9.8/869 - Release Date: 25/06/2007
17:32




-
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
___
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/