Re: [Assp-user] Discard emails from sender

2017-07-28 Thread Grayhat
:: On Thu, 27 Jul 2017 13:23:08 -0400 :: :: "William L. Thomson Jr." wrote: > As a long time user I should know this. Though to my knowledge I am > not sure if this is possible or not. I know emails can be set to be > rejected via redlist, etc. But this causes the emails to be > rejected, bounce

Re: [Assp-user] HMM Bayes and training

2017-07-25 Thread Grayhat
:: On Tue, 25 Jul 2017 14:22:01 +0100 :: :: cw wrote: > So how have other people got their databases to be accurate? > All the best, A decent approach is using the default regexp and some good and reliable DNSBLs/URIBLs to catch "surefire spam", that will help training the bayes/hmm which, af

Re: [Assp-user] Provide package list instead of CPAN modules (Debian/Ubuntu)

2017-04-05 Thread Grayhat
:: On Sun, 19 Mar 2017 08:53:50 +0100 :: :: Thomas Eckardt wrote: > I don't want to maintain these modules on CPAN. They are provided as > assp package at SF and they are included in the assp module > installer. Possibly I'll include them in the assp/lib folder in > future. Another way to solve

Re: [Assp-user] RBL_not_checked_for_some_ema ils?

2016-07-18 Thread Grayhat
:: On Mon, 18 Jul 2016 11:20:51 +0200 :: <20160718092051.830ff...@mx02.sygmanet.be> :: "Andy Knuts" wrote: > So, all a spammer has to do is add a DKIM record to his domain, in > order to avoid getting blocked by RBL's? sure, then he'll be rejected due to DKIM failure LOL !

Re: [Assp-user] SAN ssl suport

2016-06-17 Thread Grayhat
:: On Thu, 16 Jun 2016 08:52:09 -0400 :: <072801d1c7cd$e522a0d0$af67e270$@ca> :: "Ethical Host - John MacKenzie" wrote: > Have support for SAN wildcard ssl certificates? I tried using it but > assp seemed to only pull the first domain listed on the certificate > for validation which doesn't wor

Re: [Assp-user] A few questions on ASSP.....

2016-03-18 Thread Grayhat
:: On Wed, 16 Mar 2016 13:30:45 -0400 :: <56e99845.4080...@herodata.com> :: Jay wrote: > Here's the machine's specs: Windows 7 Pro 64bit, 16GB ram and Core-i7 > 3770 8core 3.4Ghz processor. windows 7 isn't a server OS -

Re: [Assp-user] ASSP Development was -> ASSP effectiveness

2016-03-03 Thread Grayhat
:: On Fri, 4 Mar 2016 08:17:54 +0100 :: :: Thomas Eckardt wrote: > >You cannot go > >download each previous version that was released. > > This is simply NOT true. > > https://sourceforge.net/projects/assp/files/OldFiles/ > > But you need a SF account and you have to login to see the old

Re: [Assp-user] "timeout exceeded" although the smtp sender did send the final CRLF.CRLF after sending the DATA

2016-02-26 Thread Grayhat
:: On Thu, 25 Feb 2016 20:50:13 +0100 :: :: Johannes Wissen wrote: > here you can see the debug log of the last transmits to the assp > server, really good for debugging: > I am not an expert in reviewing this, but I would assume that assp is > missing the [CR][LF].[CR][LF] which is splitted

Re: [Assp-user] ClamAv Up / ClamAv Down

2016-02-17 Thread Grayhat
:: On Wed, 17 Feb 2016 13:01:06 +0100 :: <20160217130106.2...@gmx.net> :: Grayhat wrote: > :: On Wed, 17 Feb 2016 12:55:08 +0100 > > No, and it doesn't really make sense; the issue is due to the way > > ClamAV reloads signatures and not to the way ASSP check

Re: [Assp-user] ClamAv Up / ClamAv Down

2016-02-17 Thread Grayhat
:: On Wed, 17 Feb 2016 12:55:08 +0100 :: <20160217125508.7...@gmx.net> :: Grayhat wrote: > :: On Wed, 17 Feb 2016 12:27:58 +0100 > :: > :: > "Raynaud Alexandre" wrote: > > > > Is there a way to force ASSP to imperatively wait clamd to be up > &g

Re: [Assp-user] ClamAv Up / ClamAv Down

2016-02-17 Thread Grayhat
:: On Wed, 17 Feb 2016 12:27:58 +0100 :: :: "Raynaud Alexandre" wrote: > Is there a way to force ASSP to imperatively wait clamd to be up > before proceed any emails (even if it slows mail delivery) and a > trick to make it realise clamd is up as soon clamd finished reload > its database (25s)?

Re: [Assp-user] ASSP using too much RAM

2016-01-13 Thread Grayhat
:: On Wed, 13 Jan 2016 08:56:50 -0600 :: <569665b2.3090...@valnet.net> :: Nick Bright wrote: > The RAM usage of the ASSP processes reaches 35GB or higher, causing > the machine to go to swap; and the server to randomly kill other > processes to satiate the RAM demands of ASSP. Obviously, this can

Re: [Assp-user] strange issue - spamdb/helo deleted

2015-12-16 Thread Grayhat
:: On Wed, 16 Dec 2015 06:43:58 -0500 :: <56714e7e.3070...@datapacket.net> :: Data Packet Networks wrote: > The spamdb does load on start-up. After running for a few hours the > spamdb and spam helo files go missing until i restore from backup and > restart assp. > > Any idea on what might cau

Re: [Assp-user] Weird characters in maillog.txt

2015-11-11 Thread Grayhat
:: On Wed, 11 Nov 2015 10:12:00 -0500 :: <56435ac0.3040...@herodata.com> :: Jay wrote: > Also we are using ASSP version 2.4.5(15162) with Perl 5.16.3 32bit. I think you'd better upgrade to a newer version (latest one is 2.4.6 build 15314); that said, I suspect that the strange chars found into t

Re: [Assp-user] 0.0.0.0/8 IPs in header?

2015-04-21 Thread Grayhat
:: On Tue, 21 Apr 2015 18:11:35 +0200 :: :: Thomas Eckardt wrote: > At least assp should know that 0.x.x.x is nonroutable - it currently > does NOT. This will be fixed in next build! > Scott, this change will make 0.x.x.x obsolet in every IP address > definition !!! Thomas, the problem is tha

Re: [Assp-user] 0.0.0.0/8 IPs in header?

2015-04-21 Thread Grayhat
:: On Tue, 21 Apr 2015 11:07:02 -0400 :: :: Scott MacLean wrote: > I have a couple users who have valid emails coming from clients that > are being outright rejected by my server. One of them is using > outlook.com (Microsoft web email) to send the email that is being > rejected. > > The proble

Re: [Assp-user] STARTTLS on port 25

2015-04-21 Thread Grayhat
:: On Tue, 21 Apr 2015 07:56:40 +0200 :: > Have you ever read the 'SSL Proxy and TLS Support' section in the > GUI- for example 'DoTLS'? I was about to write the same :) getting back to Jay's message... > Thank you for correcting me. I had thought that the difference > between port 587 and port

Re: [Assp-user] STARTTLS on port 25

2015-04-20 Thread Grayhat
:: On Sun, 19 Apr 2015 22:27:16 + (WET DST) :: <14295004370.efee9aa.5...@m5.chicago.il.us> :: "Jay F. Shachter" wrote: > This is, in a sense, the right thing to do, because even if my Postfix > accepted the STARTTLS command (it does not), port 25 is not the > appropriate port on which to send

Re: [Assp-user] Application for nodelay / whitelist + redlist bug

2014-12-30 Thread grayhat
It was Tue, 30 Dec 2014 18:02:05 +0200 when Gil Bahat wrote: > because (afaik) BATV doesn't quiesce automatic responses oh, but if "automatic responses" are valid, that is come from a legit message "you" sent then they should come through; on the other hand, an automatic response generated by a

Re: [Assp-user] Application for nodelay / whitelist + redlist bug

2014-12-30 Thread grayhat
It was Tue, 30 Dec 2014 17:46:07 +0200 when Gil Bahat wrote: > it's the lesser of evils when it comes to e-mail backscatter, imho... > but turns out quite a few webmail providers respect it: sapo.pt, > rediffmail, outlook.com, possibly even gmail. we are petitioning > yahoo, mail.ru, yandex.ru an

Re: [Assp-user] Application for nodelay / whitelist + redlist bug

2014-12-30 Thread grayhat
It was Tue, 30 Dec 2014 16:47:33 +0100 when Thomas Eckardt wrote: > Thank you Andrea. Oh, you're welcome, and since we're at it... you may be interested in reading this https://github.com/geerlingguy/Imap/issues/6 > Who else than MS ... :( heh :/ -

Re: [Assp-user] Application for nodelay / whitelist + redlist bug

2014-12-30 Thread grayhat
It was Tue, 30 Dec 2014 16:09:47 +0100 when Thomas Eckardt wrote: > X-Auto-Response-Suppress that one comes directly from the source of all evils :D http://msdn.microsoft.com/en-us/library/ee219609%28v=EXCHG.80%29.aspx --

Re: [Assp-user] Application for nodelay / whitelist + redlist bug

2014-12-30 Thread grayhat
It was Tue, 30 Dec 2014 10:59:10 +0200 when Gil Bahat wrote: > 2. we are using VERP to track distinct bounces and have a very high > volume (clause #6) http://en.wikipedia.org/wiki/Variable_envelope_return_path#Disadvantages -

Re: [Assp-user] 100% CPU

2014-11-11 Thread Grayhat
:: On Tue, 11 Nov 2014 14:20:04 + :: :: Matt Brown wrote: > Thanks for the heads up on AsADaemon - set this to 0 and > retried ./assp.pl y/w > I got the following over and over and over - looped. [...] > Not quite sure why this was even in the assp directory it must of > been unzipped/ta

Re: [Assp-user] 100% CPU

2014-11-11 Thread Grayhat
:: On Tue, 11 Nov 2014 08:17:55 + :: :: Matt Brown wrote: > starting as daemon[OK] > forked a new silent process [OK] > Not knowing a huge amount about perl, is there a way to stop the fork > and monitor what happens at this point? or a debug switch? you shoul

Re: [Assp-user] 100% CPU

2014-11-10 Thread Grayhat
:: On Mon, 10 Nov 2014 15:53:32 + :: :: Matt Brown wrote: > Hi, > > I have been running V2 of ASSP for over 2 years - which I must say > has been excellent at stopping spam on my server and my vm colo > (mxbackup) and extremely reliable. It would appear since the latest > update 2.4.3 (1431

Re: [Assp-user] change a badword to a goodword

2014-09-24 Thread Grayhat
:: On Wed, 24 Sep 2014 15:28:43 + :: <5ccb67a6fa6f8244bed9f1a68b59fec00198149...@newman.corp.necomm.com> :: Jay Tarbox wrote: > I've got a word being scored as a high probablility spam bad word, > how can I change that to a good word? The ASSP bayesian engine does NOT work that way, that is

Re: [Assp-user] SPF Failures

2014-09-19 Thread Grayhat
:: On Fri, 19 Sep 2014 14:58:16 + :: :: Tim Evans wrote: > I didn't know about that tool, but I suspect it suffers from the same > bug (or a similar one) as I am running into. When I check it > manually, it looks OK C:\>nslookup Default Server: .sparling.com > Address: 1.1.1.1 Sorry,

Re: [Assp-user] SPF Failures

2014-09-19 Thread Grayhat
:: On Fri, 19 Sep 2014 14:31:26 + :: :: Tim Evans wrote: > Sep-17-14 10:07:02 73622-03566 [Worker_2] 173.160.199.113 > to: us...@sparling.com [scoring] > SPF: permerror ip=173.160.199.113 > mailfrom=us...@pacificlightingsystems.com > helo=glaze.pacificlightingsystems.com interesting, the

Re: [Assp-user] Where is rebuildspamdb.pl?

2014-09-16 Thread Grayhat
:: On Tue, 16 Sep 2014 10:01:06 -0300 (BRT) :: :: anah...@anahuac.eu wrote: > I found it! > > But there is no rebuildspamdb.pl script anymore? no, in v2 it's a module and it runs in its own thread from the main app; you schedule it from the GUI. As a note, trying to manually run an older vers

Re: [Assp-user] Upgrade from 1.x to 2.x

2014-09-16 Thread Grayhat
:: On Mon, 15 Sep 2014 13:55:40 -0400 (EDT) :: :: Doug Lytle wrote: > >> Should I upgrade inplace or load up a new server (virtual)? > > If you'd like a quick way to revert, then I'd roll a new VM. agreed; setup a new, clean VM, install the needed prerequisites then proceed setting up Perl and

Re: [Assp-user] Upgrade from 1.x to 2.x

2014-09-15 Thread Grayhat
:: On Mon, 15 Sep 2014 18:53:45 +0300 :: :: "Victor Miasnikov" wrote: > Best use Perl v5.16.3 ( or one of higher versions: 5.18 / 5.20) warning, I'm not sure all the needed modules are available for 5.20; also, if installing on an x64 platform, use the x32 perl since using the x64 won't give

Re: [Assp-user] ASSP V2 / Perl crash

2014-08-04 Thread Grayhat
:: On Mon, 04 Aug 2014 09:33:54 -0400 :: <53df8bc2.9090...@herodata.com> :: Jay Altemoos wrote: > Has anyone else run into this issue? not lately; at any rate, using ASSP in production on a "windows 7" box isn't exactly a good idea; Win7 has a number of limitations related to sockets and other s

Re: [Assp-user] Inconsistent DNSBL scoring

2014-07-21 Thread Grayhat
:: On Tue, 15 Jul 2014 07:45:51 +0200 :: :: Thomas Eckardt wrote: > NEVER NEVER !!! !NEVER use public DNS-servers with ASSP , > if you use any of RWL,DNSBL, URIBL or Backscatter-DNS checks !! > > this includes also 8.8.8.8 and 8.8.4.4 > > install and configure at least TWO local

Re: [Assp-user] V1 development

2014-05-20 Thread grayhat
Il giorno Mon, 19 May 2014 18:34:41 +0200 Thomas Eckardt ha scritto: > Hi all, > > V1 development has been stopped in May 2014. Possibly there will be > done some bugfixing until end of 2014. > EOL of V1 is anounced for the 31 December 2014. > > Please upgrade to V2, which is and will be active

Re: [Assp-user] very bad news

2014-05-12 Thread grayhat
> Hi all, > > Fritz Borgstedt (15. April 1945 - 8. Mai 2014) is no longer with us. > He lost the battle with cancer. > > Fritz may no longer be with us, but his legacy lives on. this is bad, bad news, but for sure you're right, his legacy will live on ! Thomas, do you, by chance, know if Fritz

Re: [Assp-user] Malformed UTF-8 character

2014-04-11 Thread Grayhat
:: On Thu, 10 Apr 2014 10:34:02 +0200 :: :: mailingl...@modernbiztonsag.org wrote: > If i delete the "bad" email according to the rebuilddebug.txt the > process finishes just fine. instead of deleting the "bad" email, (g)zip it up and send the sample to Thomas, that may help him finding out what

Re: [Assp-user] me.com considered local? [1.9.9(14065)]

2014-03-10 Thread Grayhat
> > Check the "ldaplistdb", delete any "@me.com" reference in there > > thx a lot, seems to be fixed! although we don't use ldap there were > corresponding entries... > is there anything i can do to avoid this kind of 'false positives'? AYUP, the issue is caused by a BUG in some older ASSP vers

Re: [Assp-user] me.com considered local? [1.9.9(14065)]

2014-03-10 Thread Grayhat
:: On Mon, 10 Mar 2014 02:50:34 -0700 (PDT) :: <1394445034388-38189.p...@n3.nabble.com> :: larsneo wrote: > adresses @me.com seem to be recogniced as 'local' - resulting in > delivery problems. they even can't be manually whitelisted via > 'White/Redlist/Tuplets'. me.com is *not* within > 'file:f

Re: [Assp-user] Antwort: Re: Senderbase not working?

2013-10-04 Thread Grayhat
> >the senderbase service is free only up to a given number of queries, > > after that, any further DNS query coming from a given IP won't get a > > valid answer > 2.3.3 and 2.3.4 build 13276 don't have that problem Thomas... it isn't an ASSP issue; ASSP can do its better to cache answers and s

Re: [Assp-user] Senderbase not working?

2013-10-04 Thread Grayhat
> I am running Assp v2.3.3(13217) with Net::SenderBase 1.01 > > I have DoCountryBlocking = Block. I have a list of countries in a > file, file:files/blockcountry.txt, and CountryCodeBlockedRe. > The format of the file is like this: > AE > AR > BF > > It used to work, but for some reason, it doe

Re: [Assp-user] Canonical Domains

2013-10-03 Thread Grayhat
> I have a ASSP installed connecting to a OpenLDAP server to check > Local Addresses. On the Postfix Server I got canonical domains like > original.foo and originalcan.foo is the canonical domain to > original.foo. So messages coming to originalcan.foo should be > redirected to original.foo, but t

Re: [Assp-user] Antwort: incomplete good mail

2013-09-18 Thread Grayhat
> There is nothing wrong ! > > Why such a lot of excitement ? uh... no, you misunderstood (or I was unclear); I was just saying that a message is accepted (or rejected) by the SMTP as long as it sees the ending dot; the QUIT isn't required for it... then, sure, a well behaved client should send

Re: [Assp-user] Antwort: Re: Antwort: incomplete good mail

2013-09-16 Thread Grayhat
> > This depends on your MTA. If the DATA part was done (\r\n.\r\n was > > sent), some mail server deliver the mail even a 'QUIT' was not > > received. > Thomas... maybe I'm wrong (or not completely awake ) but most > (all ?) MTAs will accept a message as long as, after the data part > they recei

Re: [Assp-user] Antwort: Re: Antwort: incomplete good mail

2013-09-16 Thread Grayhat
> This depends on your MTA. If the DATA part was done (\r\n.\r\n was > sent), some mail server deliver the mail even a 'QUIT' was not > received. Thomas... maybe I'm wrong (or not completely awake ) but most (all ?) MTAs will accept a message as long as, after the data part they receive the final

Re: [Assp-user] Trusted port to accept all mail on?

2013-09-13 Thread Grayhat
> > Outgoing: mail client -> postfix(587) -> ASSP(10587) -> > postfix(10026) -> internet > Incoming: Internet -> postfix(25) > -> ASSP(10025) -> postfix(10026) -> dovecot -> mail client well.. it can be configured this way, but such a config will forbid you from using some of the ASSP f

Re: [Assp-user] how to change the SSL cipher to mitigate beast

2013-06-11 Thread Grayhat
> Q: how do I go about adjusting the SSL cipher that assp uses for the > web interface (re here just setup the ASSP web interface to listen on "local" (127.whatever) and then use (e.g.) STunnel to expose the interface to the WAN ---

Re: [Assp-user] reply-to address gets interpreted as mail-from address

2013-05-31 Thread Grayhat
> The spf check failed, because the remote service (icloud in this > case) used the reply-to field, to specify the user's own address the SPF check, if I'm not wrong, checks the "MAIL FROM" (that is the *envelope* from), so, if the "iWhatever" is screwing things, you can't blame it for doing what

Re: [Assp-user] Barracuda RBL

2013-05-30 Thread Grayhat
> I'm fairly new to ASSP, and looking to add Barracuda to the DNSBL. > The RBl is located at b.barracudacentral.org > > My current setting, which is the default looks like this... > > zen.spamhaus.org=>0.84|cbl.abuseat.org=>0.94|bl.mailspike.net=>0.84| > ix.dnsbl.manitu.net=>0.98|dnsbl-1.uceprot

Re: [Assp-user] Dowgrading from V2 to V1

2013-05-21 Thread Grayhat
> There is one more thing I would like to try. I don’t really need the > ‘pro’ functions of V2 so would be happy to downgrade to V1. I asked > someone this question several times but got no reply that made any > sense so am asking the rest of this community. First of all, you should understand th

Re: [Assp-user] Assp hmailserver cannot send emails

2013-04-23 Thread Grayhat
> Nice setup but wouldn't that mean that all clients would have to > change their outbound port to 125? Nope, reread what I wrote; ASSP will be listening on port 25 so clients will just connect to that port where ASSP will proxy connections to hMS so the client won't need to change their SMTP por

Re: [Assp-user] Assp hmailserver cannot send emails

2013-04-22 Thread Grayhat
> Before installing assp, hmailserver sends and receives email just > fine. > > After installing assp, I cannot send but can receive emails. hm... sounds like there may be some problem with the config; didn't check your config (also since the ML strips off attachments - and in any case, better

Re: [Assp-user] Antwort: Re: SPF is useless this days (MAIL FROM notFrom)

2012-12-08 Thread Grayhat
> >However assp does not support such verification, right? -> NO > > it does. Thomas... don't feed the trolls :) -- LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial Remotely access PCs and mobile d

Re: [Assp-user] SMTP 'backtrace' function

2012-11-29 Thread Grayhat
> Similar but more sane idea is SPF, but it also breaks many things like > forwarding messages. Uh... "breaks forwarding" ?!? Yes, it does, but only if you implement SPF and don't implement SRS, otherwise it won't break anything --

Re: [Assp-user] SMTP 'backtrace' function

2012-11-29 Thread Grayhat
> Does ASSP have the ability to 'check' an SMTP connection is actually > coming from a real server and not a botnetted PC? By this I mean to > suspend processing an incoming connection and call back to the > originating IP address on port 25 seeing if a real server answers? BAD idea; a lot of

Re: [Assp-user] Antwort: Re: Antwort: Early Talker

2012-05-06 Thread Grayhat
> Sorry, that's right. The host make two mistakes. First, the host > talks early and second, the host is sending non-ASCII data. The > second mistake is subject to kill assp. Thomas... that "hex data" issue resembles something I've observed too; and if I'm not wrong it's due to clients try to t

Re: [Assp-user] New to ASSP - Need to setup ASSP to filter incoming andalso act as SMTP Relay

2011-12-09 Thread GrayHat
> We have been using ASSP for a short time, and we are in need of > having ASSP relay our outgoing email as well as filter incoming email. > I can't seem to get the outgoing to work. I have been making changes > under Network Setup and Relaying sections. What am I missing? > We are using Groupwis

[Assp-user] Perl 5.14

2011-09-07 Thread GrayHat
Hello all I think that sooner or later I'll have to do the move and upgrade the current ActivePerl to version 5.14.x - now, before jumping barefoot into such a task, I'd like some more "insider infos" ... but let me detail the current setup of a system I'm planning to use as the migration "victim"

Re: [Assp-user] antispam tester

2011-05-26 Thread GrayHat
> Do you know a tool to test my antispam infrastructure? Could you please expand your question a little bit ? What do you mean by "a tool to test..." - do you mean some app which will send you some ton of spam ? In such a case, notice that it won't be so effective since many checks are perform

Re: [Assp-user] unsolicited email

2011-03-25 Thread GrayHat
> My ASSP keeps rejecting a lot of email as unsolicited. > > Even to my own email. Where would I look for this configuration error? You'd better start from the reject messages you get back and from the ASSP logs, those, together may give you (and possibly us, if you'll post details here) some trac

Re: [Assp-user] the install perl does not support multithread

2011-03-23 Thread GrayHat
> Hello Grayhat, > Any suggestion on what I should do? My suggestion... well... is to try the following setup a virtual machine (e.g. VMware or what fits your heart's contents) with whatever O/S you want (assuming it's one of the "supported" ones for ASSP) Install Per

Re: [Assp-user] the install perl does not support multithread

2011-03-23 Thread GrayHat
> # bunzip2 perl-5.12.2.tar.bz2 DO NOT USE PERL 5.12 ! Or, if you do that, you'll be on your own -- Enable your software for Intel(R) Active Management Technology to meet the growing manageability and security demands of

Re: [Assp-user] the install perl does not support multithread

2011-03-23 Thread GrayHat
> # bunzip2 perl-5.12.2.tar.bz2 DO NOT USE PERL 5.12 ! Or, if you do that, you'll be on your own -- Enable your software for Intel(R) Active Management Technology to meet the growing manageability and security demands of

Re: [Assp-user] the install perl does not support multithread

2011-03-19 Thread Grayhat
> I need help on the issue below We aren't *working* here, just volunteering our time, so, please DO NOT EXPECT immediate answers and, by the way, telling "it's urgent" won't help - either That said, if you're willing to upgrade from v1 to v2 my suggestion is to ensure you have Perl 5.10 installe

Re: [Assp-user] Win2008-64bits

2011-02-16 Thread GrayHat
> Use the 32bits version of Perl, pick version 5.10 since > the 5.12 may still have some "glitches" and, if possible, forgot... whatever version of ASSP you'll decide to use, before going into production, test it by setting up a VM (use whatever virtualization platform you prefer) and fiddle wi

Re: [Assp-user] Win2008-64bits

2011-02-15 Thread GrayHat
> I will try it. > But, it seems that ASSP v2 is not so popular... > All the messages in the list are about 1.8.x.x Try joining the list :) -- The ultimate all-in-one performance toolkit: Intel(R) Parallel Studio XE:

Re: [Assp-user] Win2008-64bits

2011-02-14 Thread GrayHat
> I am plannig this installation: > > Windows 2008 Server R2 64bits > ActivePerl-5.12.2.1203-MSWin32-x64-294165 > ASSP_1.8.5.3 > > Is this possible and stable? > If not, which Perl-ASSP combination is stable to run over MSWin-x64? Use the 32bits version of Perl, pick version 5.10 since the 5.1

Re: [Assp-user] NOOP flood

2011-01-15 Thread Grayhat
> Maximum Errors Per Session 5 > Maximum Sessions 32 > Maximum Sessions Per IP Number 5 Wasn't referring to THOSE, see my original email about "noop" limits -- Protect Your Site and Customers from Malware Attacks Learn

Re: [Assp-user] NOOP flood

2011-01-14 Thread GrayHat
> Thanks for advise. sendNoopInfo was unchecked and smtpNOOP.. > settings were more or less the same. unfortunately no avail. What about the OTHER settings (smtp session limits ?) not sure there exist in v1 - I'm using v2 and they are there for a reason :D ---

Re: [Assp-user] NOOP flood

2011-01-14 Thread GrayHat
> since recent 2(?) updates i see in MTA SMTP log the > following while copying spam to sendAllSpam: > (ASSP + MTA on same box) [...] try the following * In SMTP Session Limits: set smtpNOOPIdleTimeout to 5 set smtpNOOPIdleTimeoutCount to 3 * In Logging uncheck sendNoopInfo --

Re: [Assp-user] ASSP v2: no ASSP-Tags for mails To: Undisclosedrecipients:;

2010-10-20 Thread GrayHat
> To: Undisclosed recipients:; > > There is no ASSP-Tag in the Header. Ensure to check the "AddIntendedForHeader" in ASSP (you'll find it under the "spam control" section of the GUI enabling that will tell ASSP to insert an additional header (i.e. X-Assp-Intended-For) containing the envelope RC

Re: [Assp-user] Image spam

2010-09-02 Thread GrayHat
> Gotcha, I have done that. Hmmm... then something went wrong :/ > Just wonder how many years it takes to get it "even" It depends from your email volume; on a low volume box it may take a month or so; just ensure that ASSP sees all the traffic (inbound and outbound) and run the rebuildspamdb

Re: [Assp-user] Image spam

2010-09-02 Thread GrayHat
> well this ASSP has been in production for 1305 days > > Spam Weight:1,747,324 > Not-Spam Weight: 4,836,427 > > Corpus norm: 0.3613 (warning: ham heavy) > Corpus correction settings - low:"0.5 > high:1.5 minimum files:1 minimum > days:14" It also depends from HOW you built your

Re: [Assp-user] Image spam

2010-09-02 Thread GrayHat
> I have Bayes turned off > it blocks too much Hmm... you probably didn't train it correctly, see, training the bayes filter is tricky and you just CAN'T pick a bunch of spam/nospam emails from someone else and use it to build your corpus since in most cases your email traffic patterns will be d

Re: [Assp-user] Exchange 2003 installation woes

2010-08-30 Thread GrayHat
[...] > checking and adding PPM-repositories for module installation > 'ppm' is not recognized as an internal or external command, > operable program or batch file. Uninstall ActivePerl, reboot (not needed but it's just to stay on the safe side) and ensure to remove the Perl folder, then install A

Re: [Assp-user] Private domain suffix

2010-08-05 Thread GrayHat
> I always set my local domains up as lan.example.com, > with nameserver views to prevent anyone external ever > knowing about the sub-domain. Yes, that's one of the methods I wrote about in my other email and it's pretty flexible too, see, in case one has multiple offices, it's easy to "expand"

Re: [Assp-user] Private domain suffix

2010-08-05 Thread GrayHat
> Ok - I'll rephrase. Since Apple/Zeroconf/Avahi/mDNS/whoever > else blatantly stole the ".local" domain suffix, in express violation > of previous standard practices (if not published standards or RFC's) > preached by various prophets including followers of the mighty Church ... of the swimming

Re: [Assp-user] Private domain suffix

2010-08-04 Thread GrayHat
> Previously I was taught to use .local for my LAN domain suffixes. > But with the new auto-configuration technologies like mDNS and > Avahi .local has now become a reserved namespace. Hm... first of all it's NOT reserved; no DNS server (try running a query like "dig local NS") is serving that T

Re: [Assp-user] Email Interface issues

2010-08-03 Thread GrayHat
> I'm not sure if I should attempt a reinstall? Given that ASSP is working (set aside this feature) I don't think a reinstall may be needed or may cure the issue I'm (or you're) probably missing something I'm not sure what it is though (it has been a looong day here :D) hope someone will jump in a

Re: [Assp-user] Email Interface issues

2010-08-03 Thread GrayHat
> Still no luck unfortunately. > I'm pretty sure there is nothing else required right? > > ASSP Log: > > Aug-03-10 15:57:52 47472-01474 [Whitelisted] 192.168.100.12 > to: assp-s...@example.local whitelisted -- > mym...@example.com on whitelist -- -> notspam/1474.eml; Hmmm... sounds like ASSP

Re: [Assp-user] Email Interface issues

2010-08-03 Thread GrayHat
> 1) invent a "dummy" domain, like "assp-nospam.org" (seems to be an > available domain name) just use a non-existent TLD like (e.g.) ".lan" or ".local" or the like :) in such a case, if your main (real) domain is "example.com" you may have "example.local" > 2) tell ASSP that this domain is one

Re: [Assp-user] Whitlising based on attachment

2010-07-26 Thread GrayHat
> I would like ASSP to not filter mails if they have a specific > attachment in them (pass to the destination SMTP server with no > modifications) you'll need to build your own regular expressions to allow some messages matching it to get through; at any rate the whole idea is quite crazy imHo s

Re: [Assp-user] Image Spam

2010-07-23 Thread GrayHat
> Sorry I forgot the rest, here they are here are the sigs I'm currently using rsync://rsync.sanesecurity.net/sanesecurity/sanesecurity.ftm rsync://rsync.sanesecurity.net/sanesecurity/sigwhitelist.ign2 rsync://rsync.sanesecurity.net/sanesecurity/junk.ndb rsync://rsync.sanesecurity.net/sanesecuri

Re: [Assp-user] Image Spam

2010-07-22 Thread Grayhat
> We are getting a lot of image spam through lately. > > Does anyone else have this issue? > > How did you solve it? http://www.sanesecurity.com/databases.htm -- This SF.net email is sponsored by Sprint What will you

Re: [Assp-user] Yahoo-Like Spam-folder

2010-07-12 Thread GrayHat
> Recently I got some important email that blocked by ASSP. After 2 > days, users complaint to me that they can't receive email from friend. > I Do quick check on the log and turn out the email is blocked. > > So I have an Idea, what if all the email is just flagged, wether is > spam or not spam.

Re: [Assp-user] Postmaster spamlover

2010-07-12 Thread GrayHat
>> Why is postmaster a default spamlover? Is there a circumstance >> where I would want to have the postmaster account receive spam >> mail? > My understanding is, according to the RFCs, postmaster and abuse > addresses should never be spam filtered... Right; the postmaster and abuse addresses

Re: [Assp-user] Automatic reply Re: Re: ASSP and Backup MTA

2010-06-29 Thread Grayhat
> Paul Dickson is the list administrator as far as I know. It is the > steven_rutherf...@pap.state.ga.us address that you want removed, > correct? Well... I'm /suggesting/ to remove the address since it isn't active anymore ---

Re: [Assp-user] Automatic reply Re: Re: ASSP and Backup MTA

2010-06-25 Thread GrayHat
steven_rutherf...@pap.state.ga.us on Fri, 25 Jun 2010 06:05:57 -0400 wrote to "GrayHat" to whoever handles this list; please REMOVE the above address from the list; every time I mail to the list I get back a message like the following one (headers included) Return-Path: X-F

Re: [Assp-user] Need help

2010-06-23 Thread GrayHat
> Well yes it was happening. Had a user with > a very weak password, but no longer. Uhm... does that "no longer" refer to the weak password or to... the user ? -- ThinkGeek and WIRED's GeekDad team up for the Ultimate

Re: [Assp-user] Need help

2010-06-22 Thread Grayhat
> That ip is not Local to us, so why is assp thinking it is? stolen credentials -- ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit.

Re: [Assp-user] use Regex / Bombs, DNSBL, URIBL, ClamAV with additional signature

2010-06-17 Thread GrayHat
>> after upgrade to ASSP v2.X you can as wrote Grayhat: >> use ClamAV with additional signatures from SaneSecurity >> and Co > "ClamAV with additional signatures from SaneSecurity > and Co" can be used in ASSP Version 1 too. right; it's not an ASSP relat

Re: [Assp-user] 419 scams

2010-06-15 Thread Grayhat
> Hello, > ASSP is good, ASSP is great. Because of ASSP the nearly 98% of mail we > receive that is spam is blocked. (98%. That is just wrong.) > Except for the "419" scams. > What is it about those types of messages the ASSP cannot get any > traction to reject them? Strange, I don't get any 419

Re: [Assp-user] ASSP and Backup MTA

2010-06-15 Thread GrayHat
> We filter mail for several sub-organizations across the state and > currently the only mail ingress point is our current ASSP server. > Any other server I'd set up for this project I would have total > control over. I'm curious why I've gotten two responses that a > backup MTA was a bad idea

Re: [Assp-user] assp add outgoing as notspam

2010-06-11 Thread GrayHat
> However, I've read that it is possible that all *outgoing emails* send > by qmail will be added to notspam folder of assp. What option should I In your case, assuming all the emails either from external MTAs or from authenticated clients are hitting ASSP before being proxied to qMail your setup

Re: [Assp-user] Can ASSP restart if run as unprivileged user?

2010-06-10 Thread GrayHat
> The default debian script has this functionality, that's no issue. > What I'm saying is that, by the time AutoRestartCmd is triggered, > the assp process is no longer running. If a kill step is included it > just generates an error that there is nothing to kill, at least on > Linux. Well that

Re: [Assp-user] ASSP and Backup MTA

2010-06-10 Thread GrayHat
> What is the most reliable way to handle mail from a backup MTA in > ASSP? I'd like to have our offsite MTA send mail to ASSP where it's > filtered and sent downstream, but what is the best way to accomplish > this without punishing the MTA? Or are people doing something > different altogether?

Re: [Assp-user] Can ASSP restart if run as unprivileged user?

2010-06-10 Thread GrayHat
> Sorry, hit send accidentally. It seems like assp is designed so that > only a start command makes sense in AutoRestartCmd, but perhaps > there's a point to including kill and pid-removal stages as well? imHo yes; I mean, a restart script should take care of stopping assp, waiting for it to co

Re: [Assp-user] Pop Email Collection

2010-06-10 Thread GrayHat
> I am currently using a program called EFS http://www.chimera.co.nz/ > which works fine..don't know how it works EFS is just a "pop3 retriever" all it does is use the supplied informations (pop3 server, user, pass, smtp server) to fetch emails from the POP3 server and forward them to the SMTP on

Re: [Assp-user] Can ASSP restart if run as unprivileged user?

2010-06-10 Thread GrayHat
> Okay, so I have unchecked "Run ASSP as a Daemon", removed the > UID and GID so it is running as root, and I still cannot get ASSP to > restart itself. I've tried leaving the AutoRestartCmd blank, and > setting it to the following values: > > "/usr/bin/perl" "assp.pl" "/usr/share/assp" & >

Re: [Assp-user] Can ASSP restart if run as unprivileged user?

2010-06-09 Thread GrayHat
>> If ASSP runs as a daemon or a service ASSP cannot restart it. exact; so, in case ASSP is running as a windows service it would be a good idea to create a script like (e.g.) @echo off pushd c:\assp if exist pid del pid net start asspsmtp popd exit and setup the service recovery action to "ru

  1   2   3   4   5   >