Re: [AMaViS-user] Forged 'X-Virus-Scanned' header bypasses Amavis-new scanning

2008-02-18 Thread Cernohorsky Wolfgang
Hi Christopher, I've still got the mystery of how his email gets in without being scored by Amavis. When I run spamassassin on it, it gets a very high score. Other spam gets filtered just fine. Somehow, this one spammer avoids it. Message larger than sa_mail_body_size_limit? HTH,

Re: [AMaViS-user] Forged 'X-Virus-Scanned' header bypasses Amavis-new scanning

2008-02-18 Thread mouss
Christopher J Shaker wrote: Clifton: I am pretty sure amavisd-new does *not* work this way. It has an implicit list of checks to run on each incoming mail, starting with virus scanning, and works its way through them. If it's working this way for you, it may be the result of something

[AMaViS-user] sql based management interface

2008-02-18 Thread James Bourne
Hi all, We're starting to use the sql policy stuff for amavisd-new and not being able to find a simple admin management interface I've created one. It's really crude right now, does very limited checking on user input but should be good for a base to work up from. I wanted something that works

Re: [AMaViS-user] Forged 'X-Virus-Scanned' header bypasses Amavis-new scanning

2008-02-18 Thread Christopher J Shaker
Here is the /var/log/mail entry from the email that leaked past Amavis-new: Feb 18 15:07:11 linux postfix/smtpd[19386]: connect from unknown[121.27.33.247] Feb 18 15:07:12 linux postfix/smtpd[19386]: 3BFD9404B1: client=unknown[121.27.33.247] Feb 18 15:07:13 linux postfix/cleanup[19387]:

Re: [AMaViS-user] Forged 'X-Virus-Scanned' header bypasses Amavis-new scanning

2008-02-18 Thread Christopher J Shaker
[Sending again as ASCII] Here is the /var/log/mail entry from the email that leaked past Amavis-new: Feb 18 15:07:11 linux postfix/smtpd[19386]: connect from unknown[121.27.33.247] Feb 18 15:07:12 linux postfix/smtpd[19386]: 3BFD9404B1: client=unknown[121.27.33.247] Feb 18 15:07:13 linux

Re: [AMaViS-user] Forged 'X-Virus-Scanned' header bypasses Amavis-new scanning

2008-02-18 Thread MrC
Christopher J Shaker wrote: Feb 18 15:07:33 linux amavis[17984]: (17984-09) Passed CLEAN, [121.27.33.247] [EMAIL PROTECTED] - [EMAIL PROTECTED], Message-ID: [EMAIL PROTECTED], mail_id: If831cHwmATq, Hits: -222.952, size: 3510, queued_as: 7C4FA404B4, 20009 ms Looks to me like it is