Re: regex guru needed...

2006-06-27 Thread Hadley Rich
On Wednesday 28 June 2006 12:32, Jim Cheetham wrote: > It's probably a notifiable security condition if someone connects to > your SMTP and tries to VRFY addresses; so don't just remove the > condition, but try refining them so they don't trigger when seeing your > normal log (i.e. make it alert at

Re: regex guru needed...

2006-06-27 Thread Steve Holdoway
On Wed, 28 Jun 2006 12:28:09 +1200 Hadley Rich <[EMAIL PROTECTED]> wrote: > On Wednesday 28 June 2006 12:06, Steve Holdoway wrote: > > That was the answer! The keywords VRFY and EXPN were in the file > > /etc/logcheck/violations.d/logcheck. You'll probably find SMART in there, > > Hads (: > > Woo

Re: regex guru needed...

2006-06-27 Thread Jim Cheetham
On Wed, Jun 28, 2006 at 12:06:33PM +1200, Steve Holdoway wrote: > On Tue, 27 Jun 2006 23:00:42 +0100 Jim Cheetham <[EMAIL PROTECTED]> wrote: > > On Wed, Jun 28, 2006 at 07:23:49AM +1200, Steve Holdoway wrote: > > > Jun 28 06:02:18 server sm-mta[7813]: k5RI2I6g007813: > > > 23-52-175-62.user.auna.n

Re: regex guru needed...

2006-06-27 Thread Hadley Rich
On Wednesday 28 June 2006 12:06, Steve Holdoway wrote: > That was the answer! The keywords VRFY and EXPN were in the file > /etc/logcheck/violations.d/logcheck. You'll probably find SMART in there, > Hads (: Woo! It was picking up on the 'failure' in the middle of Prefailure. Thanks Jim and Steve

Re: regex guru needed...

2006-06-27 Thread Steve Holdoway
On Tue, 27 Jun 2006 23:00:42 +0100 Jim Cheetham <[EMAIL PROTECTED]> wrote: > On Wed, Jun 28, 2006 at 07:23:49AM +1200, Steve Holdoway wrote: > > Jun 28 06:02:18 server sm-mta[7813]: k5RI2I6g007813: > > 23-52-175-62.user.auna.net [62.175.52.23] (may be forged) did not issue > > MAIL/EXPN/VRFY/ETR

Re: regex guru needed...

2006-06-27 Thread Jim Cheetham
On Wed, Jun 28, 2006 at 07:23:49AM +1200, Steve Holdoway wrote: > Jun 28 06:02:18 server sm-mta[7813]: k5RI2I6g007813: > 23-52-175-62.user.auna.net [62.175.52.23] (may be forged) did not issue > MAIL/EXPN/VRFY/ETRN during connection to MTA > > I added the following line to /etc/logcheck/ignore.d

Re: regex guru needed...

2006-06-27 Thread Marek Kuziel
this rule works for me: .*did not issue MAIL\/EXPN\/VRFY\/ETRN during connection to MTA$ sample testing script in php: 'Jun 28 06:02:18 server sm-mta[7813]: k5RI2I6g007813: 23-52-175-62.user.auna.net [62.175.52.23] (may be forged) did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA',

Re: regex guru needed...

2006-06-27 Thread Neil Stockbridge
this rule looks like it must match doesn't it? .*did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA$ the only thing i can think of is trailing space (as Hadley already said), escaping those slashes and maybe some of those spaces are really tabs even though it seems unlikely. does logc

Re: regex guru needed...

2006-06-27 Thread Hadley Rich
On Wednesday 28 June 2006 09:17, Steve Holdoway wrote: > 'cos it doesn't work! > > And I really don't understand why. > > Grrr. > > On Wed, 28 Jun 2006 08:30:35 +1200 > > Carl Cerecke <[EMAIL PROTECTED]> wrote: > > Why not just: > > > > .*did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA$

Re: regex guru needed...

2006-06-27 Thread Steve Holdoway
'cos it doesn't work! And I really don't understand why. Grrr. On Wed, 28 Jun 2006 08:30:35 +1200 Carl Cerecke <[EMAIL PROTECTED]> wrote: > Why not just: > > .*did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA$ > > Cheers, > Carl. > > On 28/06/06, Steve Holdoway <[EMAIL PROTECTED]>

Re: regex guru needed...

2006-06-27 Thread Carl Cerecke
Why not just: .*did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA$ Cheers, Carl. On 28/06/06, Steve Holdoway <[EMAIL PROTECTED]> wrote: To preserve what's left of my sanity, can anyone help me with this logcheck rule? To ignore messages like this, Jun 28 06:02:18 server sm-mta[7813]

regex guru needed...

2006-06-27 Thread Steve Holdoway
To preserve what's left of my sanity, can anyone help me with this logcheck rule? To ignore messages like this, Jun 28 06:02:18 server sm-mta[7813]: k5RI2I6g007813: 23-52-175-62.user.auna.net [62.175.52.23] (may be forged) did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA I added the

Re: Why is my mail ending up in the wrong place? Procmailrc problem

2006-06-27 Thread Hadley Rich
On Tuesday 27 June 2006 22:36, Don Gould wrote: > Why are your folders hidden? . (dot) is a hierarchy separator for folders in some IMAP servers. They aren't hidden if you access it via the IMAP protocol, which you should be. -- I used to think romantic love was a neurosis shared by two, a supr

Re: Why is my mail ending up in the wrong place? Procmailrc problem

2006-06-27 Thread Steve Holdoway
On Tue, 27 Jun 2006 22:36:51 +1200 Don Gould <[EMAIL PROTECTED]> wrote: > Thanks Steve > > Steve Holdoway wrote: > > > > >1. Are you using maildir format? (Yes, I answered my own question further > >down ) If so, the slashes are going the wrong way. > > > > > > > I took them off. > > >:0 > >

Re: Why is my mail ending up in the wrong place? Procmailrc problem

2006-06-27 Thread Lee Begg
On Tuesday 27 June 2006 22:16, Steve Holdoway wrote: > :0 > * ^Subject:.*\[Soekris\] > .Soekris/ > > :0 > * ^Subject:.*\[GNUz\] > .GNUz/ Just a handy hint for those that get a lot of email, and offlist replies. Almost all *good* mailing list software (ie, not the one running this list) sets the

Re: Why is my mail ending up in the wrong place? Procmailrc problem

2006-06-27 Thread Don Gould
Thanks Steve Steve Holdoway wrote: 1. Are you using maildir format? (Yes, I answered my own question further down ) If so, the slashes are going the wrong way. I took them off. :0 * ^(To|Cc):.* CLUG\ This rule *should* match everything with a To: or Cc: line in it, making the rest of

Re: Why is my mail ending up in the wrong place? Procmailrc problem

2006-06-27 Thread Volker Kuhlmann
Where did you get the idea of using backslashes on folder names from? Use forward slashes instead if you mean maildir format. Your problem is with treating the regular expressions procmail is expecting in your filter lines (those lines starting with an asterisk) only partially as regular expressio

Re: Why is my mail ending up in the wrong place? Procmailrc problem

2006-06-27 Thread Steve Holdoway
On Tue, 27 Jun 2006 18:50:13 +1200 Don Gould <[EMAIL PROTECTED]> wrote: > See: > http://www.tcn.bowenvale.co.nz/index.php?option=com_content&task=view&id=22&Itemid=8 > > You'll see that the mail ends up in my webmin folder most of the time. > > What have I don't wrong? > > Cheers Don 1. Are

Re: U/K-buntu 6.06 CD's

2006-06-27 Thread dave
On Monday 26 June 2006 16:55, Christopher Sawtell wrote: > On Monday 26 June 2006 14:58, [EMAIL PROTECTED] wrote: > > Anyone got any in yet? > > Not yet, due any day now. > > > I'd like to put my hand up for a set of kbuntu ones please. > > Yes. Can you get to a meeting? good chance i'll be an jul

Re: Why is my mail ending up in the wrong place? Procmailrc problem

2006-06-27 Thread Volker Kuhlmann
> Sorry about the don't <-> done thing.. Yes we can all spot the typos, now where's your problem description? > I provided a link to a page with both those files on it, is that not the > same as providing the files for download? Web-board-mangled is not the same, I'm afraid. Email it to me plea

Re: Why is my mail ending up in the wrong place? Procmailrc problem

2006-06-27 Thread Don Gould
Sorry about the don't <-> done thing.. I've got verbose on... I provided a link to a page with both those files on it, is that not the same as providing the files for download? Cheers Don Volker Kuhlmann wrote: You'll see that the mail ends up in my webmin folder most of the time. What ha

Re: Why is my mail ending up in the wrong place? Procmailrc problem

2006-06-27 Thread Volker Kuhlmann
> You'll see that the mail ends up in my webmin folder most of the time. > > What have I don't wrong? You have done wrong with not giving a usable description of the problem. Your ~/.procmailrc for download would help. The backslashes at the end of folder names look suspicious to me. In principl