Re: [Assp-test] Senderbase

2014-01-28 Thread Grayhat
> Hey Grayhat- been a while... Thanks for your followup. Hi there, yes, been (and being ) busy > I'm using our internal dns servers, without forwarders. I see DNSBL > messages, RWL, etc as expected. ok, one thing less to check (I hope) :) > Could a format error in the w

Re: [Assp-test] Senderbase

2014-01-28 Thread Grayhat
:: On Tue, 28 Jan 2014 09:02:50 -0500 :: :: K Post wrote: > Confirmed that it seems like only the cached entries are working. > Every one of the 300+ senderbase matches from today, are from the > cache. For example: > 199.101.162.46 couple questions: 1: are there any DNS-related messages in yo

Re: [Assp-test] upgrading from ASSP version 2.3.3(13276) to 2.3.4(latest)

2013-11-12 Thread Grayhat
> hi all. > is there any caveat or recommendation or special modules/packages > requirements for upgrading from ASSP version 2.3.3(13276) to version > 2.3.4(latest)? > i'm running a 2 hosts production system on Linux, perl 5.14, all > databases as tables on Mysql. upgrade your Perl runtime and al

Re: [Assp-test] Virus scanners

2013-09-27 Thread Grayhat
> So far I have identified two domains that most mail claims as the from > address. Both publish SPF records but define ~all so I have added > them to strictSPFRe. Hmmm... now I'm becoming curious; you're running ASSP, so, which filters did you enable (set aside SPF and AV scanning) ? See, it so

Re: [Assp-test] Virus scanners

2013-09-27 Thread Grayhat
> We have ClamAV running on our mailserver and are currently suffering a > significant number of Trojans getting past. ClamAV is a more than decent mail AVscanner but you'll need to feed it with some additional signatures, namely the ones available here http://www.sanesecurity.co.uk/databases

Re: [Assp-test] assp dying

2013-09-20 Thread Grayhat
> I have a cron job for this (attached). It opens a connection to both > the SMTP and Web interface ports and makes sure it gets a connection hmm... not bad, but before that, I think you'd better check if the ASSP process is running, then, if it's running (and only if it's running) you may go on

Re: [Assp-test] Need guide on how to do upgrade to the latest version of assp Re: assp spawning spam

2013-05-22 Thread Grayhat
> > Subj: assp spawning spam > > on an installation of mine > >they managed to get hold of the boss address (of all addresses) > >and they send spam to the outside world. > > "they" -- is who? > Computer with antispam? > Or computers of internal users? I suspect that someone "bruteforced"

Re: [Assp-test] asap behind NAT router

2013-05-08 Thread Grayhat
> >not exactly, ASSP will deal with the "received" headers and ... > No. You do not understand the feature. sure, sure, ok -- Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive ne

Re: [Assp-test] asap behind NAT router

2013-05-08 Thread Grayhat
> Never happened, an appliance which receive mails and forward it to > any server (including ASSP) should add a receive header. exactly, "should" is the point here; what if it doesn't ? And there *are* critters which, pretending to work "in a transparent way" won't add whatever header ... > If

Re: [Assp-test] asap behind NAT router

2013-05-08 Thread Grayhat
> ASSP will use the receive header with the hostname set in > ispHostnames. This header contains the originating IP and which will > be used for IP-based checks if set in ispip. > This header contains also the originating HELO which will be used for > HELO- based checks. assuming (and it isn't a

Re: [Assp-test] asap behind NAT router

2013-05-06 Thread Grayhat
> >you'd loose the real sender IP, that is, the one which > >*is* sending you the message, > Why? Suppose someone from 31.11.43.121 tries to send to you an email pretending to be "mail.example.com" and using "example.com" as the sending domain (in email); ASSP sits behind the "proxy" so it only

Re: [Assp-test] asap behind NAT router

2013-05-06 Thread Grayhat
> ASSP can use those checks, even if there is only one IP if front of > all senders. not exactly; you'd loose the real sender IP, that is, the one which *is* sending you the message, this in turn will defeat SPF/DKIM and DNSBL checks, sure, one may still play tricks and check the "received" heade

Re: [Assp-test] asap behind NAT router

2013-05-06 Thread Grayhat
> I am working on a setup and situation dictates that every server here > is behind a NAT firewall. The problem now of course is, that > connections to SMTP daemon are translated to the internal IP of the > firewall, therefor SPF, and a whole lot other checks fail because > ASSP sees them coming

[Assp-test] GTUBE

2013-04-09 Thread Grayhat
Let me start with this email which appeared on the "SaneSecurity" ML <===> From: "Steve Basford" To: sanesecurity@y Subject: [sanesecurity] GTUBE support Date: Tue, 9 Apr 2013 20:15:07 +0100 Hi All, GTUBE (the Generic Test for

Re: [Assp-test] Antwort: Re: Antwort: Re: fixes in assp 2.2.2 build 13080:

2013-03-26 Thread Grayhat
> Andrea, > > try to fix it - add the following line to 'lib/CorrectASSPcfg.pm' > > $main::DoSyncBDB = 0; > > Thomas Hmm... it doesn't seem the case; tried that and also tried 13081 but made no difference; whenever I issue an "sc stop asspsmtp" keeping the "dbgview" open, ASSP logs some messag

Re: [Assp-test] Antwort: Re: fixes in assp 2.2.2 build 13080:

2013-03-22 Thread Grayhat
> Just checked it on my prod system (13081) - works perfect. No > process, no pid file, no error or warning in assp. > > Active Perl 5.16.1 on W2K3Sp2 > Win32::Daemon 20110117 > > Just checked it on Active Perl 5.12.4 (32Bit) on > W2K8 > W2K8R2 > W2K12 > > >time ago you released a fix for the

Re: [Assp-test] fixes in assp 2.2.2 build 13080:

2013-03-22 Thread Grayhat
> >will update to 13080 in minutes > > wait for 13081 - in some minutes ! too late, already updated :) See, I was on the box to update ClamAV to 0.97.7 <===> ClamAV 0.97.7 addresses several reported potential security bugs. Thanks to

Re: [Assp-test] Antwort: Re: Antwort: Re: fixes in assp 2.2.2 build 13080:

2013-03-22 Thread Grayhat
> >Will there be new stable releases of V2 anytime soon > > in the next 4 weeks > > is this beta release intended for production use too? > > yes - how ever there are changes and new features which have to be > tested > - bugs in the stabil release are fixed in the 'beta' first > > Thomas Tho

Re: [Assp-test] Antwort: Setting up assp 2.1.2 LDAP for Mac OS X Open Directory

2013-02-11 Thread Grayhat
> First use a LDAP client of your choice (commandline based are the > best - helps learning the LDAP language/syntax) and test the LDAP > queries for domains and email addresses. The docu of your LDAP server > will help you in first place. As a note, having a windows box handy, the free LDAP bro

Re: [Assp-test] See example, how work ISPIP Re: Moving to 3rd party email archiving service - What settings should I change?

2013-01-11 Thread Grayhat
> See example, how work ISPIP : > > 999.99.99.9 -- my secondary MX IP > mailserver.good.net -- my secondary MX Correct; that's also why I play a little trick with my MX records; nothing "magic" nor really new, mind me, the whole thing is called "MX sandwich" or "nolisting" and is explained

Re: [Assp-test] Antwort: Re: Moving to 3rd party email archiving service - What settings should I change?

2013-01-11 Thread Grayhat
> Andrea , this is not 100% correct. If assp receives a mail from an > ISPIP and the 'ispHostNames' is defined, assp will lookup the IP that > was connected to the ISP from the header and will process this IP > instead of the ISPIP. *FACEPALM* *D'OH!!* You're totally right, Thomas, I forgot a

Re: [Assp-test] Moving to 3rd party email archiving service - What settings should I change?

2013-01-11 Thread Grayhat
> It is similar to Exchangedefender. I've got it set in ispip now. It > seems to be working well so far. However, I don't know that it's > caught any spam yet. I'm trying to clear out my ccspam mailbox so I > can get a good idea of what's going on. forgot; if your ASSP is now ONLY receiving e

Re: [Assp-test] Moving to 3rd party email archiving service - What settings should I change?

2013-01-11 Thread Grayhat
> My company is moving to a 3rd party email archiving service. Our MX > records will be changed to point to that service. They will run their > anti-spam checks on incoming email and then pass through the emails > that pass the checks (sounds like a store and forward type service). Hmm... from

Re: [Assp-test] Assp Hanging

2013-01-10 Thread Grayhat
> ASSP version 2.2.2(13006) is hanging and showing errors in the > connection screen. It is a total of 128 connection (32 are allowed in > in the Setup) Same here... and after a while it "commits suicide" and needs to be restarted rolled back to a previous (12366) version and the issue

Re: [Assp-test] Feature question/request

2013-01-07 Thread Grayhat
> Does either 2.x or 1.9x provide for the capability to reroute mail? > eg sento: x...@y.com deliveredto: a...@b.com > > If not is it possible to add? Sincerely, I think this isn't a task for ASSP; such a thing should be handled by whatever mailserver sits "behind" ASSP, not by ASSP itself; all

Re: [Assp-test] Antwort: No answering DNS v2.0 build 12313

2012-11-28 Thread Grayhat
> I have UseLocalDNS enabled, and I have five system local DNS servers > defined. One of the five is running on the same box as ASSP, so it > should always be available. Five seems quite a bit, given that you wrote you're using external resolvers; now I'm curious; do your local resolvers (inclu

Re: [Assp-test] Antwort: Re: Antwort: Perl question...

2012-09-27 Thread Grayhat
> > If you run 64bit win, use 5.14 32 bit. > aye, I already downloaded it (x32) will install it (and no, not going > to install the x64 one, no need to waste resource w/o benefits :-D) since we're at it; I'm planning to try installing ASSP on MariaDB (ok, MySQL if you prefer); are there any spec

Re: [Assp-test] Antwort: Re: Antwort: Perl question...

2012-09-27 Thread Grayhat
> If you run 64bit win, use 5.14 32 bit. aye, I already downloaded it (x32) will install it (and no, not going to install the x64 one, no need to waste resource w/o benefits :-D) -- Everyone hates slow websites. So do w

Re: [Assp-test] Antwort: Perl question...

2012-09-27 Thread Grayhat
> There are still some Perl modules missing for Perl 5.16. > The internal auto-perl-module-upgrade procedure is still unable to > handle Perl 5.16. ok... better going for 5.12 or 5.14 ? -- Everyone hates slow websites. S

[Assp-test] Perl question...

2012-09-25 Thread Grayhat
I'm about to install an instance of ASSPv2 on a fresh new box (ok, VM) so I fired up a browser and went to activestate... to find that they're now recommending to pick Perl v-5.16 ! At this point I wonder... do I need to pick that one (I want a *stable* setup, at least from the perl runtime standp

Re: [Assp-test] fixes in assp 2.2.2 build 12265

2012-09-21 Thread Grayhat
> I use the latest ASSP 1.9.x version. I haven't used Griplist in > probably two years. I stopped using it because I found that there > were way too many false-positives causing legit emails to score > higher and get blocked. Is that still the case or is it working any > better now? Not sure

Re: [Assp-test] Antwort: Backscatter problem

2012-09-18 Thread Grayhat
> The junk emails are nothing to do with our servers. Ah ok; so setting up the message ID checks should suffice, still, I do believe that using the "rate limiter" may be useful to find out if some of your folks are spitting out bunches of messages ... and to possibly take action :) -

Re: [Assp-test] Antwort: Backscatter problem

2012-09-18 Thread Grayhat
> has you set 'MSGIDpreTag' and 'MSGIDSec' ? > > Both have to be set! The default value is NOT valid for 'MSGIDSec'! good point; also, if the customer is also *sending* out emails through ASSP, it may be a good idea enabling the outbound rate limiter, that is setting appropriate values for Loc

Re: [Assp-test] Antwort: FW: RebuildSpamDB - report from assp.isp.bm

2012-09-14 Thread Grayhat
> - The automatic corpus correction in the rebuildspamdb task was not > working as expected in every case. > There is one rebuild task required to enable this feature in > future. Now I'm curious, Thomas, I wonder how comes that nobody ever noticed this issue before; I had this floating aroun

Re: [Assp-test] Antwort: Re: Antwort: strange ASSP behavior

2012-09-14 Thread Grayhat
> >ASSP will extract the headers and body and perform > some checks to see if it already "saw" that file > Exactly this way it works for years now - I think we had this topic > some months ago Andrea - how ever, good ideas comes back in mind > every time! :):):). LOL, probably it's a sign that

Re: [Assp-test] Antwort: strange ASSP behavior

2012-09-11 Thread Grayhat
> I'll explain a bit more: > > - all folders are processed : "the youngest files first" > - both error folders are fully processed up to MaxFiles > > As the result of processing the first two folders we get a weight > (spam/ham). Now we know were we are: we have a current weight, a > wanted we

Re: [Assp-test] Antwort: Re: Antwort: strange ASSP behavior

2012-09-11 Thread Grayhat
> >I see, so, basically, you're saying that the weight reported in the > "rebuild report" isn't correct ? > No - the values were correctly shown. But ASSP has used all files (up > to MaxFiles) even it was better to use some less ( from here or > there) to get a better corpusnorm. Hmm... I see n

Re: [Assp-test] Antwort: strange ASSP behavior

2012-09-11 Thread Grayhat
> Andrea, Hi there, Thomas, we are on the public list, aren't we :) ? > your request was very logical. Well... to tell it all, I reported about such a behavior here and there, but then, I didn't really pay attention to it... until I was forced to setup a script, scheduled at intervals, to "tri

[Assp-test] strange ASSP behavior

2012-09-10 Thread Grayhat
I'm running the latest ASSP 2.2.2 build 12248 (Win2k8, ActivePerl, MSSQL), but I observed the same behavior with previous versions as well; in short, if I manually "trim" the spam/notspam folders down to 14000 files (or less, but same count for both) and start a rebuild, the rebuild report tells m

Re: [Assp-test] Antwort: Perl Module

2012-09-07 Thread Grayhat
> >Is Unicode::GCString a new dependency? > > Yes, if you want assp to process all words as a sequence of UAX #29 > Grapheme Clusters (Unicode 6.1.0) for Bayes and HMM. > > http://unicode.org/reports/tr29/ > here's the PPM search result (just in case) 1: Unicode-LineBreak UAX #14 Unicode

Re: [Assp-test] Antwort: DNSBL reject msg...

2012-09-06 Thread Grayhat
> RBLError > AvError > ÜRIBLError > ??? . yes... those as well, the idea is to add an option to ASSP so that "checking" a box will turn the "fail" message into a "tempfail" one and having entry fields (text) for both messages, this would allow one to fine tune ASSP to match certain conditions

Re: [Assp-test] DNSBL reject msg...

2012-09-04 Thread Grayhat
> Is the theory that a given sender will be mistakenly added to a > DNSBL, and during that server's retry period it will be removed? > Maybe... I know, it doesn't happen often, but it *may* happen, believe me or not :) > I guess it depends on the DNSBL's being used. ASSP's defaults are > prett

Re: [Assp-test] DNSBL reject msg...

2012-09-04 Thread Grayhat
> option so that, instead of emitting a reject, ASSP could emit a > "tempfail", that is, something like (e.g.) > > 442 Connection from $IP temporarily refused, host listed by $LIST notice that the very same kind of option may be added to the AV scanning as well; this way, in case you have a too "

[Assp-test] DNSBL reject msg...

2012-09-04 Thread Grayhat
I've been reading some stuff and found that there are pros and cons to what I'm suggesting... let me go straight to the ball; at the moment, if ASSP uses DNS blacklists (or URIBLs for that) and if an IP (or URL or domain) is listed (or at least the list score goes "over limit") the result is a 5xx

Re: [Assp-test] too old installed dev versions

2012-08-14 Thread Grayhat
From: "Fritz Borgstedt" > I propose a retention period for developer versions, after nn days it > will warn , after nn+10 it will stop working. uh... turn ASSP into some kind of time-bombed kids game ? Are you serious ? -

Re: [Assp-test] no running worker Restart ASSP! error (2.2.2 12169)

2012-07-02 Thread Grayhat
> I left my thread status window open, as well as tailing the log in > hopes that I would see what might be causing it. I missed it > happening twice, but the third time I caught it. Here's what I saw > while it was happening: > 5 562 s SenderBaseOK (stuck) > 6 658 s SenderBaseOK (stuck) Noti

Re: [Assp-test] HMM - fixes in assp 2.1.2 build 12131

2012-05-15 Thread Grayhat
> Thomas, > > could you please have a look on HMM again? > After testing with different options, I found that HMM does not work > if HMMusesBDB is enabled. > > Rebuildspamdb reports HMM will be generated but when finished, the > database is reported as empty. I have a RAM disk for tmpDB but

[Assp-test] ASSP "12123"

2012-05-03 Thread Grayhat
Apparently it fixed some issues; I had problems rebuilding the spamDB (Thomas knows that) and suddenly, w/o doing anything else, after updating ASSP to the 12123 the rebuild worked and I got back the "usual" (not so usual for the last *several* months) report so... Whatever you did, Thomas, WELL

Re: [Assp-test] SPF lookup timed out

2012-04-11 Thread Grayhat
> Just using M$ 2003 Server DNS. All it does is provide DNS lookup for > ASSP, nothing more (1000-2000 messages per day). It doesn't seem (to > me) that that many lookups per day would be more than it could handle. Well... it should deal with those just fine as long as the box has enough bandw

Re: [Assp-test] SPF lookup timed out

2012-04-11 Thread Grayhat
> What would cause an SPF lookup to timeout? For example: > Apr-10-12 17:53:25 id-33409-03026 178.20.64.93 > to: some...@mydomain.com SPF: timed out after 21 secs.; > > The above sender is not actually from valid Microsoft.com servers. Hm... probably slow resolvers, by the way, it could be u

[Assp-test] ASSP whitelist locking issue

2012-03-24 Thread Grayhat
Sounds like I probably spotted a bug sitting inside ASSP from some versions (including the latest 12080) here's what I noticed; if, for whatever reason ASSP crashes and gets restarted, upon startup it applies a lock to the "whitelist" database table (yes, I'm using a DB:) and never releases it, so

Re: [Assp-test] ASSP V2 problem Worker_x accept to client failed

2012-03-21 Thread Grayhat
> ... > Mar-20-2012 19:09:31 [Worker_1] Error: MainThread stuck for 64 > seconds after: MainLoop get the best worker = 1 (0 sockets) - last > debug step was: servicecheck! > ... same here, workers seem to get "stuck" after a while; had to rollback ASSP to "12058" to fix the issue otherwise, a

[Assp-test] ClamAV 0.97.4 (windows)

2012-03-16 Thread Grayhat
to anyone interested http://permalink.gmane.org/gmane.comp.security.virus.clamav.announce/148 -- This SF email is sponsosred by: Try Windows Azure free for 90 days Click Here http://p.sf.net/sfu/sfd2d-msazure _

Re: [Assp-test] Antwort: Assp hanging durig startup

2012-03-15 Thread Grayhat
> - stop assp > - remove the 'tmpDB' folder > - remove all griplist files in the assp-base folder > - start assp > > If assp crashes - some times the griplist files (e.g. BDB) are > destroyed . ASSP will redownload the griplist after the startup. Thomas... given my own "been there done that", I

Re: [Assp-test] whitelist attack against assp

2012-03-14 Thread Grayhat
> How is this configured, Thomas? I don't see an option to restrict > email interface addresses by network or authentication. "only local or authenticated users contribute to the whitelist" -- Virtualization & Cloud Man

Re: [Assp-test] ASSP configuration issue - dual homed

2012-03-13 Thread Grayhat
> > · SMTP Listen Port (listenPort) > (External IP and Internal IP) > > · SMTP Destination (smtpDestination) > (Internal Mail Server) > > IN: Internet --> ASSP (IP External) --> ASSP (IP Internal) --> > Internal Mail Server Out: Internal Mail Server --> ASSP (IP Internal) > --> A

Re: [Assp-test] Assp 2.0 12068 Crashing very freqent

2012-03-11 Thread Grayhat
> Matti... given that I'm facing the very same kind of issues; could you > please > (please !!! :D) detail the steps you took to solve this ? Different experience here; the rebuild "randomly" crashes if the corpus (spam/notspam folders) contains more than 14000 files and/or contains files w/o sub

Re: [Assp-test] Assp 2.0 12068 Crashing very freqent

2012-03-11 Thread Grayhat
> After disabling Bayes & HMM checks, I was able to do a complete > rebuild during the uptime. > So I truncated spamDB., made anaother rebuild and switched on HMM. > ASSP is fine for hours. Now I enabled Baysian and it seems as assp is > still stable. > > So I hope this issues is solve

Re: [Assp-test] fixes in assp 2.1.2 build 12068

2012-03-08 Thread Grayhat
> Error: rebuildspamdb failed - Database delete all statement failed: > Can't Execute Command 'delete from spamdb' INFO: RebuildSpamdb removed > from queue Info: RebuildSpamdb Scheduler stopped > Info: starting RebuildSpamdb Scheduler with '15 1 * * *' > > I'll now try wiping (truncate) the spam

Re: [Assp-test] fixes in assp 2.1.2 build 12068

2012-03-08 Thread Grayhat
> Thanks, Thomas, running the rebuild right now (from console, so in > case of errors I'll see them all); at the moment the process is > sweeping the "./notspam" folder; will report back in a while went on to 2012-03-08 00:20:26 Generating weighted Bayesian tuplets 2012-03-08 00:21:18 start popu

Re: [Assp-test] fixes in assp 2.1.2 build 12068

2012-03-08 Thread Grayhat
> fixed in assp 2.1.2 build 12068: > > - assp dies in the rebuild task > - assp stucks in the rebuild task > - Bayesian values are calculated too high > - reference error in Win32::Unicode::File.pm line 408 Thanks, Thomas, running the rebuild right now (from console, so in case of errors I'll see

Re: [Assp-test] RebuildSpamDB and ASSP dying

2012-03-07 Thread Grayhat
> Mär-07-12 12:42:11 Generating weighted Bayesian tuplets Same here, the rebuild stops exactly there, no error message, nothing at all, it just "dies"; this doesn't happen if I totally empty the spamdb (and the various temp files) but I don't think this is a solution -

Re: [Assp-test] How to unblock messages ?

2012-03-07 Thread Grayhat
> I am trying to give users the option to > send a mail message to assp and then the assp > can answer back to them with a list of blocked  > messages. Have a look at the "block reporting" section in ASSP GUI, there's the place to start when configuring the feature you're seeking for; ensure to co

Re: [Assp-test] Don't empty _all_ records in spamdb table <= see rebuild spamdb algoritm Re: fixes in assp 2.1.2 build 12067

2012-03-07 Thread Grayhat
> > May I humbly suggest to replace that "delete from spamdb" with a > > (faster) "truncate table spamdb" ? > Don't empty _all_ records in spamdb table <= see rebuild spamdb > algoritm I know, but that was the ONLY way to allow the rebuild to complete :P otherwise it either crashed or timed-ou

Re: [Assp-test] fixes in assp 2.1.2 build 12067

2012-03-07 Thread Grayhat
> and, by the way, crashing the perl process retried and it worked... until it reached the point in which it imports the spamdb data into the DB, at that point the rebuild bombed again (but this time assp kept running) with the following <> 2012

Re: [Assp-test] fixes in assp 2.1.2 build 12067

2012-03-07 Thread Grayhat
> fixed in assp 2.1.2 build 12067: Running it right now, tried a rebuild and it bombed after a while emitting the following message on the console Free to wrong pool 3e3c68 not 32313032 at sub main::mlog line 30. and, by the way, crashing the perl process ---

Re: [Assp-test] How to avoid multiple duplicates in corpus

2012-03-05 Thread Grayhat
> http://en.wikipedia.org/wiki/Locality-sensitive_hashing > corpus, now, the above may represent a solution, in such a case, the > rebuild may just "skip" messages if they're repeated too often, so > allowing to keep the corpus balanced > also say that the email was recognized as "spam" (or h

[Assp-test] How to avoid multiple duplicates in corpus

2012-03-05 Thread Grayhat
I was reading a document describing the so called "Locality Sensitive Hashing" http://www.stanford.edu/class/cs345a/slides/05-LSH.pdf http://en.wikipedia.org/wiki/Locality-sensitive_hashing and, while going through it, I started thinking at the ASSP spam and notspam corpus; as it was discussed

[Assp-test] Graylisting issues

2012-03-05 Thread Grayhat
Hi there; just stumbled upon what I see as a bug and a source of issues; here's what I noticed Sometimes, under certain conditions ASSP emits both a reject message (message score over limit), that is a "550 ..." *followed* by another SMTP tempfail "451 retry later" which comes from the graylistin

Re: [Assp-test] Antwort: Re: fixes in assp 2.1.2 build 12058

2012-03-04 Thread Grayhat
> Quickly assembled a script to scan the spam/notspam folders and > remove files older than 15 days or greater than 1 bytes or either > above the 14000 files limit, reran the rebuild and it's going on now, so, > apparenly you were exactly "on the ball" :) what puzzles me is the fact > that the

Re: [Assp-test] Antwort: Re: fixes in assp 2.1.2 build 12058

2012-03-03 Thread Grayhat
> Andrea, Hi there, Thomas !! > check the errors/notspam folder for too large files - remove them. > I never got any issue in the rebuild task. > My largest file is 5.7 MB. Quickly assembled a script to scan the spam/notspam folders and remove files older than 15 days or greater than 1 byte

Re: [Assp-test] fixes in assp 2.1.2 build 12058

2012-03-01 Thread Grayhat
Sounds like ASSP is constantly *crashing* during the rebuild, it processes the errors folder, the spam one and, once it starts processing the notspam folder, it suddenly *crashes* w/o any kind of notice or error (also tried that running ASSP from cmdline); I also tried trimming the spam/notspam fo

Re: [Assp-test] smtp connection list

2012-03-01 Thread Grayhat
> - could be useful having from contact which are local in > "green" (i.e.) color remote senders in "black" color (i.e.) > - an icon near each Helo value to add the helo value in Suspicious > HELO > - an icon near each ip address value to add the ip address in > denySMTPConnectionsFromAlways Uh...

Re: [Assp-test] UseTrapToCollect Re: ASSP and spamtraps

2012-02-28 Thread Grayhat
> >> Try UseTrapToCollect : > > DANG !!! Yes, I think that's it; sorry Victor probably I had a > > senior moment :( > No problem ;-) > I'm sow this option today. First time ;-) Since we're at it; to have it working you need to properly set things up, here's what you'll need * create a "spambu

Re: [Assp-test] ASSP and spamtraps

2012-02-28 Thread Grayhat
> Perhaps I misunderstood your question or I took it out of context. No, I think you got it right > If you have "DoPenaltyMakeTraps" set to "use for spamaddresses", then > in any corporate situation where an employee no longer exists with a > valid email address the address should be added to

Re: [Assp-test] ASSP and spamtraps

2012-02-28 Thread Grayhat
> > I wouldn't say that they only receive junk. In a business > > environment previous employees' addresses could eventually make it > > on that list > > No, that list isn't there for such a purpose; there's another one > which deals with the above that is "RejectTheseLocalAddresses"; the spamt

Re: [Assp-test] UseTrapToCollect Re: ASSP and spamtraps

2012-02-28 Thread Grayhat
> Try UseTrapToCollect : DANG !!! Yes, I think that's it; sorry Victor probably I had a senior moment :( -- Keep Your Developer Skills Current with LearnDevNow! The most comprehensive online learning library for Microsoft

Re: [Assp-test] ASSP and spamtraps

2012-02-28 Thread Grayhat
> I wouldn't say that they only receive junk. In a business environment > previous employees' addresses could eventually make it on that list No, that list isn't there for such a purpose; there's another one which deals with the above -

[Assp-test] ASSP and spamtraps

2012-02-28 Thread Grayhat
I was rereading the description related to "DoPenaltyMakeTraps" and "spamtrapaddresses" now, I wonder why ASSP only uses the "traps" to score IPs instead of also using them to improve the bayes/hmm corpus; I mean, given that those addresses *are* traps so they don't belong to any "human" and, by d

[Assp-test] ASSP Wiki

2012-02-25 Thread Grayhat
I was looking at the "browse all articles" here http://www.asspsmtp.org/mw/index.php?title=Special:AllPages and found this http://www.asspsmtp.org/mw/index.php?title=Car_insurance now, maybe I'm just dumb; could someone please explain me what's the relation between ASSP and car insurance :) ?

Re: [Assp-test] Antwort: Re: Antwort: Perl v5.14 "unicode_strings" feature

2012-02-14 Thread Grayhat
> Early Perl versions has used ISO-8859-1 to store internal data - for > example as a result of a decode(...,...). [...] > the resulting string has a mixed enconding. Even if a string is > internaly stored in ISO-8859-1 - if we check the UTF-8 flag of the Hmmm... maybe I'm missing some details

Re: [Assp-test] Antwort: Perl v5.14 "unicode_strings" feature Re: Antwort: need help Or ASSP v2.1.2 build (12043) ( assp_u01.pl.gz)

2012-02-14 Thread Grayhat
> But if it would work - the behavior of assp on 5.10 and 5.12/5.14 > would be different. totally correct (as a note, I'll probably be able to move from 5.10 to 5.14 in a while, pending some "migration" ;-D) > I'll find another workaround for the ISO.8859-1/UTF8 internal > encoding problem of

Re: [Assp-test] Antwort: Re: Antwort: Re: fixes in assp 2.1.2 build 12042

2012-02-14 Thread Grayhat
> >(think to "runas" to get an example) > > This seems not to be possible if the Perl session is started - if > assp is running as service . (???) Well... I referred to "runas" just as an example, there *are* ways to achieve such a result (although I've to admit I never tried that using Perl

Re: [Assp-test] Antwort: Re: fixes in assp 2.1.2 build 12042

2012-02-14 Thread Grayhat
> On nix we can start as root - chmod - and can switch to another > account/group. in windows the approach is opposite; you start as "user", raise your privileges by calling the appropriate functions (think to "runas" to get an example), do whatever you need and then go down to "user" when done .

Re: [Assp-test] fixes in assp 2.1.2 build 12042

2012-02-13 Thread Grayhat
> 'setFilePermOnStart' and 'checkFilePermOnStart' are no longer > available for windows systems. > Perls chmod has no effect on NTFS volumes - so both options are > useless on windows systems. Well... there is a way to achieve the same kind of result, that is http://search.cpan.org/~teverett/Wi

Re: [Assp-test] Antwort: need help

2012-02-13 Thread Grayhat
> This test could be stopped - the version does not start on Perl 5.10 > - 'unsupported feature'. > > So we have to wait until 5.10 is obsolet. You're right, and it seems to be confirmed by this http://docs.activestate.com/activeperl/5.14/lib/feature.html scrolling down to the "unicode_strings"

Re: [Assp-test] Antwort: Re: Antwort: Re: Antwort: Feature - replace attachments with a link?

2012-02-13 Thread Grayhat
> What I mean - the implementation of this step in any available > Web-Server (100 and more version) is not really possible. The session > key must be build by the Web-Server > and as long as I know they are not valid after a server restart (in > most cases). Thomas... let the webserver (whatev

Re: [Assp-test] Block Report Tweaks

2012-02-09 Thread Grayhat
> Not at all. Ok... > This is a small business that manufactures batteries and deals with > many international companies. Often those companies are on the end of > dodgy IP blocks in China, Russia or South America. > > The emails are time sensitive because suppliers change stock levels > and pr

Re: [Assp-test] Block Report Tweaks

2012-02-09 Thread Grayhat
> A customer wants the block reports to run hourly due to the time > sensitive nature of some of the emails. Oh... you're referring to THAT kind of customer; I see, those which feel lost if they don't receive their daily shot of junk email and which don't even understand how the email works nor

Re: [Assp-test] Antwort: Feature - replace attachments with a link?

2012-02-09 Thread Grayhat
> Personally, since there will never be duplicate attachments, keeping > them forever (or at least for many years) shouldn't be a real > problem, and that is what I would do. The simplest way for those who well... that fits your reality, but when it comes to a program (ASSP) used in a number of d

Re: [Assp-test] Antwort: Feature - replace attachments with a link?

2012-02-09 Thread Grayhat
> Charles - this could be done with the ASSP_AFC plugin in V2. Without > the plugin a mail with a bad attachment is blocked - the plugin will > replace the bad attachments with a text part. > Including a download-link to a replaced bad attachment seems not to > be wise. > > Or do you mean a featur

Re: [Assp-test] Antwort: Rebuildspamdb issues - wordstem

2012-02-07 Thread Grayhat
> This is strange - I could understand that, if all (~ 1000) config > settings are set to default because the config file could not be > opened - but 291 - I've no clue. Thomas... just shooting in the dark here, since I wasn't able to reproduce the behaviour (yes, tried it :D) ... I wonder if, fo

Re: [Assp-test] send spam messages to a mail user

2012-02-07 Thread Grayhat
> Is it under "Block Reporting" ? > I tried a couple of things there but nothing happened. Yes, you'll need to use the blockreport option; basically your user will need to send an email to the "assp blockreport" email address, this way ASSP will generate a report containing the blocked emails for

[Assp-test] It was June 2004...

2012-02-03 Thread Grayhat
when, while looking at my issue of "Linux Journal" I found that they quickly reviewed an application I had been already using for some time; it wasn't fancy, just a simple cmdline app, yet it worked very well ... http://www.linuxjournal.com/article/7450#mpart3 :-)

Re: [Assp-test] Switching from files to database, suggestions/guides?

2012-01-24 Thread Grayhat
> > Warning: Spamdb contains 151091 records (allocating at least 35.9MB) > - it is highly recommended to use a database for 'spamdb' > > and same for whitelistdb. I'd also like to experiment with the Hidden > Makrov Model functionality, which requires a database. > > I currently use MySQL for my

Re: [Assp-test] SPF: permerror

2012-01-23 Thread Grayhat
> What exactly causes this? here http://en.wikipedia.org/wiki/Sender_Policy_Framework#Error_handling -- Keep Your Developer Skills Current with LearnDevNow! The most comprehensive online learning library for Microsoft

Re: [Assp-test] changes in assp 2.1.2 build 12021

2012-01-21 Thread Grayhat
> - The 'EarlyTalker' check is now skipped for all IP's > - connected to the 'relayPort' > - include in 'acceptAllMail' > - include in 'whiteListedIPs' > - include in 'ispip' > - include in 'noPB' > - include in 'noDelay' > - include in 'noBlockingIPs' > - include in 'noProcessing

Re: [Assp-test] Hosted ASSP2 SaaS service?

2012-01-19 Thread Grayhat
> Does anyone know of a reliable outsourced antispam service that uses > ASSP2 as the tool of choice? Sorry, no idea, maybe Thomas will have some pointers > I have a client that simply does not want to do it inhouse (no matter > how easy I tell them it will be), but really like the > features

Re: [Assp-test] ASSP 1.9.5.9 cosmetic glitch

2012-01-18 Thread Grayhat
> all I see is "There are no active SMTP ses" hmmm... I see, so are you suggesting to change that to "There is no active SMTP sex" :) ? -- Keep Your Developer Skills Current with LearnDevNow! The most comprehensive online

Re: [Assp-test] fixes in assp 2.1.2 build 12016

2012-01-17 Thread Grayhat
> > Not that I know the answer, but I note that 12017 is now available. Same problem with 12017; setting the value in correctASSPcfg.pm doesn't work, setting it directly inside the ASSP code works -- Keep Your Developer

<    1   2   3   4   5   6   7   8   9   10   >