Re: [Mimedefang] FTC asks ISPs to crack down on zombie PCs

2005-05-25 Thread Ben Kamen
Ian Mitchell wrote: Personally, I'm highly opposed to blocking outbound port 25. There are some of us who don't have the resources to run a domain on a business class line. Second off, there are those of us who take security very seriously and work hard to ensure our micro domains don't become

Re: [Mimedefang] FTC asks ISPs to crack down on zombie PCs

2005-05-25 Thread Ben Kamen
Ian Mitchell wrote: I have two broadband options. Cable and satellite. And it's a matter of picking your poisons at that point. I looked up dialup and no, I just could not drag myself to suffering with a 56K connection. Not to mention, it's damn hard to find Linux modems now-a-days. I have a

Re: [Mimedefang] spam now a registered trademark for downloadable software by Hormel

2005-05-24 Thread Ben Kamen
hormel. I'm not a legal expert, but I vaguely remember something like that.. -Ben -- Ben Kamen - O.D.T, S.P. -- Home: [EMAIL PROTECTED] http://www.benjammin.net Work: [EMAIL PROTECTED] gPG Pub Key - http

Re: [Mimedefang] FTC asks ISPs to crack down on zombie PCs

2005-05-24 Thread Ben Kamen
[EMAIL PROTECTED] wrote: About time, too... As a sidenote: They should also be writing a letter to Mr. Bill (Oo Noo) asking his darn company to stop writing so many darn bugs into the OS. We just all want to be free... IE/Outlook free that is. ;) -Ben p.s. I think we need a new

Re: [Mimedefang] FTC asks ISPs to crack down on zombie PCs

2005-05-24 Thread Ben Kamen
[EMAIL PROTECTED] wrote: http://www.ftc.gov/opa/2005/05/zombies.htm ... will send letters to more than 3,000 ISPs around the world, urging them to employ protective measures to prevent their customers' computers from being hijacked by spammers. The measures include: * blocking a common

Re: [Mimedefang] Sober virus highlights problem

2005-05-19 Thread Ben Kamen
Jonathan Maliepaard wrote: Also people use a lot of foul language and sexual references, they get nabbed every time. Keyword filters? Your company uses keyword filters? So are Breast, penis and vagina considered sexual references? I just thought they were anatomical terms for various body parts.

Re: [Mimedefang] Over-zealous scanners again...

2005-05-18 Thread Ben Kamen
David F. Skoll wrote: The email server, viruswall3.guiltyparty.hidden, did not deliver the message from [EMAIL PROTECTED] to [EMAIL PROTECTED] with the subject [Mimedefang] Scanning plain-text attachments, part II because the message contains 1 or more files with .eml extension(s). I will go away

Re: [Mimedefang] German spam (related to new worm Sober.q)

2005-05-15 Thread Ben Kamen
Stephane Lentz wrote: For those who don't follow the SpamAssassin list there are some new spam messages in German (racist ones apparently) Some extra rules are available on : http://mailscanner.prolocation.net/german.cf News coverage : http://isc.sans.org/ http://www.viruslist.com/en/weblog Ya,

Re: [Mimedefang] More patent stupidity

2005-05-14 Thread Ben Kamen
Joseph Brennan wrote: --On Friday, May 13, 2005 5:24 PM -0400 David F. Skoll [EMAIL PROTECTED] wrote: http://www.infoworld.com/article/05/05/13/HNtrendmicropatent_1.html The Trend Micro patent explains technology that scans e-mail and Internet data transfers for viruses at gateways and servers,

Re: [Mimedefang] Sendmail Help

2005-05-14 Thread Ben Kamen
Ray Spinhirne wrote: We are in the process of updated an HPUX server and MIMEDefang. I'm pretty sure this is a sendmail problem and not a MIMEDefang problem but perhaps someone could give me a pointer. (It's late and I'm not thinking were well.) At any rate here is what's happenning. Mail

Re: [Mimedefang] SMTP

2005-05-09 Thread Ben Kamen
Christopher Roberts wrote: Thanks for the very quick response! Have you tried sending an email to them by hand? Okay, so here's where I reveal my ignorance! How would I do that? Just a pointer would be helpful - do you just mean in sendmail, or is there a way to send SMTP commands manually? You

Re: [Mimedefang] OT - Using rDNS sendmail hack - your experiences

2005-05-03 Thread Ben Kamen
James Ebright wrote: On Tue, 03 May 2005 09:53:38 -0500, Ben Kamen wrote This is a misconfiguration of MS exhchange, it can be configured to return the SMTP response code and message, it just does not do it out of the box. Really?? When I guess TI.com (Yes, Texas Instruments - one of thr world

Re: [Mimedefang] OT: control internal spam

2005-05-03 Thread Ben Kamen
[EMAIL PROTECTED] wrote: [EMAIL PROTECTED] wrote: All, We block port 25 at the firewall so all outgoing mail has to go out our gateway. (snip) Obviously we have to allow SMTP for internal legit clients on our network. Is SMTP AUTH the answer? YES Write a terms-of-use that all users have to sign

Re: [Mimedefang] OT - Using rDNS sendmail hack - your experiences

2005-04-27 Thread Ben Kamen
James Ebright wrote: You can whitelist users or entire domains from the rDNS check in your access file using Niel's hack. I know... but it just seemed that while I was playing by all the rules, the slobs were just making my access file grow to biblical proportions. (shaking head some more)

[Mimedefang] OT: SpamAssassin - Lots of bayes_toks.expire##### files

2005-04-27 Thread Ben Kamen
In defang's ~/.spamassassin/ directory... Are these supposed to reconciled/cleaned up automatically? I'm gonna go look around the SA website - but have a feeling someone here might have better information than what's online. Thanks, -Ben ___ Visit

Re: [Mimedefang] OT - Using rDNS sendmail hack - your experiences

2005-04-26 Thread Ben Kamen
Rich West wrote: Personally, we've looked in to it. We tend to agree that AOL's position is somewhat aggressive since their techs are usually behind the time and don't support their own new technologies well. But, political opinions aside, we were leary about implementing it because, frankly,

Re: [Mimedefang] HUGE problem with mimedefang

2005-04-21 Thread Ben Kamen
David F. Skoll wrote: Oops, sorry! I adapted it from something we use with CanIt, and forgot that the mimedefang init script doesn't have a status. Anyway, if you know shell programming, you should be able to detect if mimedefang is running by checking the return status of: kill -0

Re: [Mimedefang] HUGE problem with mimedefang

2005-04-21 Thread Ben Kamen
-ray wrote: On Thu, 21 Apr 2005, Ben Kamen wrote: Especially if your problem is a large excess of $$$ in your budget... a few pSeries machines would fix that!!! hahahah, I'm running AIX (Bull version) on a 133MHz Motorola Atlas 604 board in a rack with sendmail 8.13.2 - Works great and is cheap

Re: [Mimedefang] HUGE problem with mimedefang

2005-04-21 Thread Ben Kamen
Lisa Casey wrote: Hi again, Oliver wrote: there is a status option for redhat, what distro do you? Try downloading the 2.51 .tar.gz and just copy/edit the redhat/mimedefang.init file to your /etc/init.d/ dir I'm currently using 2.48 on Redhat. I don't want to upgrade right now (unless I have to)

[Mimedefang] Re: [OT] AIX Power Servers

2005-04-21 Thread Ben Kamen
Arthur Corliss wrote: This is getting off-topic, but for me a good Power5 system with micro-partitioning and virtual I/O running a mix of AIX Linux is much more cost-effective than a blade server, *especially* when it comes to resource management... drool Ya, it'd be cool to have one of

Re: [Mimedefang] HUGE problem with mimedefang

2005-04-21 Thread Ben Kamen
Lisa Casey wrote: Hi, Sigh, no I think it's probably me that doesn't understand. Mimedefang is runing as a milter under Sendmail. I don't start mimedefang using /etc/init.d/mimedefang, I start it using /etc/init.d/sendmail. This script starts Sendmail and Mimedefang. When I installed

Re: [Mimedefang] OT: New Sendmail spam block

2005-03-25 Thread Ben Kamen
David F. Skoll wrote: On Thu, 24 Mar 2005, Ben Kamen wrote: The person I've been having the problems with is quoting RFC821, but forgetting he's breaking RFC1123 which is the amendment to 821. The latest is RFC 2821. Thanks, I'm looking over it and the section reads more like 821 than 1123. I'm

Re: [Mimedefang] OT: New Sendmail spam block

2005-03-25 Thread Ben Kamen
James Ebright wrote: Anyway, still sifting some of this.. maybe I will change my mind but bottom line is.. I think your Norton product is broke! It's not my system. It belongs to someone I help out. But as I already told the other admin - this extent, I do believe this could be done better.

[Mimedefang] OT: New Sendmail spam block

2005-03-24 Thread Ben Kamen
I've now run into 2 universities that are blocking email based on invalid hostnames at the HELO sequence. From what I can see with RFC1123, (see http://www.freesoft.org/CIE/RFC/1123/90.htm) this seems to be a no-no. 5.2.5 HELO Command: RFC-821 Section 3.5 The sender-SMTP MUST ensure that the

Re: [Mimedefang] OT: New Sendmail spam block

2005-03-24 Thread Ben Kamen
So far, from internal or people dup'ing your server, those sound reasonable.. But I'm talking about any host outside a domain/netblock's control. The person I've been having the problems with is quoting RFC821, but forgetting he's breaking RFC1123 which is the amendment to 821. Am I wrong in

Re: [Mimedefang] OT: New Sendmail spam block

2005-03-24 Thread Ben Kamen
James Ebright wrote: On Thu, 24 Mar 2005 16:17:45 -0600, Ben Kamen wrote It doesnt sound Kosher to me... but... I have to ask.. why is your server not sending him a FQDN that resolves correctly in DNS as the HELO? It's a norton anti-virus gateway sitting behind a firewall. Right now, it just

Re: [Mimedefang] Fw: [Asrg] user-level blacklisting patented

2005-03-21 Thread Ben Kamen
Let's here it again for the USPTO... USPTO, where the P stands for Putz. (c) 2005, Me. (wink) -Ben ___ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list MIMEDefang@lists.roaringpenguin.com

Re: [Mimedefang] OT can some help me with this?

2005-03-10 Thread Ben Kamen
On Wed, 9 Mar 2005, Ole Craig wrote: On 03/09/05 at 16:53, 'twas brillig and Jerry Vonau scrobe: Hi All: Just need to pick some brains here. My mail server is having trouble sending mail to one mail server, when I telnet to port 25 I get this back: [EMAIL PROTECTED] jerry]# telnet

Re: [Mimedefang] Interesting way to send spam

2005-02-24 Thread Ben Kamen
Wow... Smells like well, not teen spirit, but maybe desparation.. ___ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list MIMEDefang@lists.roaringpenguin.com http://lists.roaringpenguin.com/mailman/listinfo/mimedefang

Re: [Mimedefang] Block emails with certain words

2005-02-23 Thread Ben Kamen
Joey McKnight wrote: How can i block emails with words like Viagra, penis, using Mimedefang. You don't. You leave it to the basian filter.. Blocking by keywords is a horribly inaccurate thing to do. Let's say I wanted to make a joke about viagra. Or talk about donkey's, commonly referred to as

Re: [Mimedefang] Block emails with certain words

2005-02-23 Thread Ben Kamen
Ben Kamen wrote: What KAM said, I've posted for all to see and I think says it best: http://www.benjammin.net/www/pages/spam/ Sorry, I had KAM on the brain from reading a previous post from him, I meant, Kelson Vibber -Ben ___ Visit http

Re: [Mimedefang] Fedora to replace sendmail with Exim as default MTA?

2005-02-23 Thread Ben Kamen
Michael Sims wrote: I have to admit that I just don't understand all of the anti-Sendmail sentiment I see all over various mailing lists and forums such as Slashdot. Everytime the subject comes up there are tons of people saying the absolute worst thing you can do is run Sendmail or there's no

Re: [Mimedefang] OT: sendmail limit connections

2005-02-23 Thread Ben Kamen
-ray wrote: I have max daemon children set to 250. Occasionally one machine will open 250 connections, probably spamming, so sendmail stops new connections. Is there a sendmail way to limit # of connections by ip address? In /etc/mail/access ClientConn:ip addr limit rate See the README

Re: [Mimedefang] OT: sendmail limit connections

2005-02-23 Thread Ben Kamen
John wrote: Read the docs for the latest sendmail releases after 8.13.x There's tons ( Well, maybe not tons.) of ways to screw up people connecting fanatically to your mailserver. I just loved it when they brought that stuff out in 8.13.0 G You and me both. Good stuff Maynard. -Ben

Re: [Mimedefang] OT: sendmail limit connections

2005-02-23 Thread Ben Kamen
[EMAIL PROTECTED] wrote: Isn't that a sendmail 8.13 feature? I believe so. (what!?! Isn't EVERYONE on the latest release? grin) Sorry - forgot to mention it... So - UpGRADE! :) -Ben ___ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang

Re: [Mimedefang] OT: sendmail limit connections

2005-02-23 Thread Ben Kamen
Arthur Corliss wrote: From what you're saying, then, that would only work for him if he knows the IP/networks he's getting hit by ahead of time. It doesn't sound like it would prevent rate-limit connections from *any* IP address. For that you'd really need to keep track of simultaneous connects

Re: [Mimedefang] OT: sendmail limit connections

2005-02-23 Thread Ben Kamen
-ray wrote: On Wed, 23 Feb 2005, Sven Willenberger wrote: I've heard good stuff about greet_pause and plan to use it as soon as i get to 8.13.x. What delay do you all typically use to weed out zombies but respect legit servers? Can you disable greet_pause for the local network? I use 5

Re: [Mimedefang] Re: Scary... Filtering on the outbound.

2005-02-17 Thread Ben Kamen
George Kuetemeyer wrote: There's another issue with non-business-related email that wasn't brought up in that link. A few years ago we started noticing that on many days 50% or more of our internal SMTP traffic consisted of joke/inspirational attachments. We've since started quarantining/bouncing

[Mimedefang] Scary... Filtering on the outbound.

2005-02-16 Thread Ben Kamen
http://www.forbes.com/2005/02/16/cx_ah_0216tentech.html?partner=technology_newsletter I think you're all ugly and your momma's dress you funny. Filter that. ;) Notice how it presently only seems to work with Exchange. In a way, that infers that only us intelligent folks use behemoth's like

Re: [Mimedefang] ZDnet article on new Zombie Trick

2005-02-04 Thread Ben Kamen
I thought the definition of ISP was somewhat flexible in the definition as a remedy for people who do service their own email and such... (i.e. I hold/service email for more than 1 domain. I think the language could be interpreted in such a way that it would make me an ISP because of the

Re: [Mimedefang] ZDnet article on new Zombie Trick

2005-02-03 Thread Ben Kamen
I would think ISP's would want a greylisting filter on their inbound-outbound ports... But with my recent experience with my local ISP (SBC) proves to me (since I directly asked the half a dozen or so SBC tech rep's on the line if anyone knew anything about TCP/IP - no from all) I doubt if

Re: [Mimedefang] ZDnet article on new Zombie Trick

2005-02-03 Thread Ben Kamen
Paul Murphy wrote: Ben wrote: I would think ISP's would want a greylisting filter on their inbound-outbound ports... If the spam is coming from their legitimate customers, and is indistinguishable from normal mail, this will add nothing and annoy their customers, especially when those using

[Mimedefang] SpamTraps

2004-12-07 Thread Ben Kamen
How many of you out there use spamtraps with spamassassin?? I'm just curious about the feeling of others using them... -Ben ___ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED]

[Mimedefang] Re-init Bayes

2004-11-23 Thread Ben Kamen
I asked a while back and didn't see an answer... how often do people like to reinit their bayes databases?? -Ben ___ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED]

Re: [Mimedefang] Pounded by spam

2004-10-28 Thread Ben Kamen
MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang -- Ben Kamen - O.D.T., S.P. -- Home: [EMAIL PROTECTED] http://www.benjammin.net Work: [EMAIL PROTECTED] gPG

Re: [Mimedefang] SPF in MD

2004-10-08 Thread Ben Kamen
I did consulting for someone who asked if they should allow client-updates... (school district)... I chuckled and said, imagine 500 instances of laptops named brittney.. or insert famous icon here Hehehe.. -Ben Michael Weiner wrote: Has anyone used mime-defang filters to do any portion of the

Re: [Mimedefang] Re: OFF TOPIC - Need a product to block spyware (Mark Penkower)

2004-10-01 Thread Ben Kamen
Ian Mitchell wrote: As for the knock toward Symantec developers, having been a programmer at one time, I would take offense to that comment. I highly doubt Symantec has conceeded to the whims of spyware developers. I would be more inclined to think they simply don't care because it's outside of

Re: [Mimedefang] Danger of .vcs files?

2004-09-30 Thread Ben Kamen
, ___ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang -- Ben Kamen - O.D.T, S.P. -- Home: [EMAIL PROTECTED

Re: [Mimedefang] Re: jpg exploit

2004-09-28 Thread Ben Kamen
Can I just say, Thank you Bill. Kawa-bunghole! -Ben ___ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang

Re: [Mimedefang] REALLY blocking the porn spam

2004-09-12 Thread Ben Kamen
we try and warn - but Nooo they gotta put that kind of crap in. -Ben ___ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang

Re: [Mimedefang] OT help with qpopper

2004-09-01 Thread Ben Kamen
how old is it?? (What ver?) Download a new one if you're not just... UW-IMAP includes an ipop daemon... -Ben Ray Spinhirne wrote: THis is OT but maybe someone can help. We have the HPUX supplied version of Qpopper running on our admin mail server. It seems to work ok under light load. However,

Re: [Mimedefang] Deadline for SPF records *long w/morbid horoscope*

2004-08-10 Thread Ben Kamen
Cor Bosman wrote: How about scaling? I'm pretty sure my ISP will run (screaming, no doubt), from a scenario in which they rely on their customers to keep their list of valid addresses current. If your ISP allows you to have mail servers behind theirs and they are the front line MX and forward

Re: [Mimedefang] Deadline for SPF records

2004-08-10 Thread Ben Kamen
Richard Laager wrote: Example: Let's say that I work for a hypothetical ACME Widgets, Inc. My e-mail address is [EMAIL PROTECTED] A potential customer, [EMAIL PROTECTED], tries to send me an e-mail message from his laptop using a public access point in his hotel. The network he's on is not listed

Re: [Mimedefang] Deadline for SPF records

2004-08-10 Thread Ben Kamen
Blackberry? My CEO has one of these and uses it a lot. All messages must be sent through their server but we want the 'From:' to be his desktop address. -- Ben Kamen - O.D.T, S.P. -- Home: [EMAIL PROTECTED

Re: [Mimedefang] Deadline for SPF records

2004-08-10 Thread Ben Kamen
Cor Bosman wrote: That's just it - if your sales guy is at hotel with his laptop, he could use AUTH/STARTTLS and actually relay through his company's mail server. Thus the email from [EMAIL PROTECTED] would be delivered by mail.acmewidgets.com to where it needed to go... SPF would be valid.

Re: [Mimedefang] Deadline for SPF records

2004-08-05 Thread Ben Kamen
Wouldn't that be funny that everyone started rejecting mail from them because they didn't do that. Yet, they pushed for the deadline for everyone else to have SPF published? Hahaha... Well, a quick check shows: MSN:NO Hotmail:NO Yahoo: NO AOL:YES

Re: [Mimedefang] Deadline for SPF records

2004-08-05 Thread Ben Kamen
/listinfo/mimedefang -- Ben Kamen - O.D.T, S.P. -- Home: [EMAIL PROTECTED] http://www.benjammin.net Work: [EMAIL PROTECTED] gPG Pub Key - http://www.benjammin.net/www/pages/library

Re: [Mimedefang] Deadline for SPF records

2004-08-04 Thread Ben Kamen
I will be visiting MS next week, maybe I can provide further information after that meeting Make sure to wear a rain coat! (and not because you're going to Washington State... more like BS-Deflection-wear)... :) -Ben ___ Visit

Re: [Mimedefang] Disk imaging software

2004-07-28 Thread Ben Kamen
Amanda might be worth looking into... But the best was is to connect a local mega-tape or somethng and tar or dd. -Ben [EMAIL PROTECTED] wrote: I am about to upgrade my mail filters and I would like a quick way to revert back to the previous environement. For regular backups, we use Tivoli

[Mimedefang] Sendmail/MIMEdefang issue?

2004-07-25 Thread Ben Kamen
I'm having a weird problem with attachments that are large causing a tempfail with AIX and Bellmail - I'm emailing here since I have a feeling this started when I started using mimedefang... If this proves not to be the problem I'll ask the sendmail guys... Here's my environment: AIX 4.3.2

Re: [Mimedefang] Sendmail/MIMEdefang issue?

2004-07-25 Thread Ben Kamen
Those were my thoughts exactly - after looking at the man pages for both programs... looks like bellmail is the program I want to run for sendmail to just deliver mail. it just uses the switch - '-t' to send to a user... so my prog/args should just be: /bin/bellmail and '-t $u' How interesting

Re: [Mimedefang] Sendmail/MIMEdefang issue?

2004-07-25 Thread Ben Kamen
... -Ben Ben Kamen wrote: Those were my thoughts exactly - after looking at the man pages for both programs... looks like bellmail is the program I want to run for sendmail to just deliver mail. it just uses the switch - '-t' to send to a user... so my prog/args should just be: /bin/bellmail

Re: [Mimedefang] White paper on futility of replying to viruses?

2004-07-16 Thread Ben Kamen
sounds like a bad idea... imagine all the admins you would be emailing who would actually care or be allowed to do anything else due to politics.. ugh. Email is just a mess. -Ben Kenneth Porter wrote: I seem to get a lot of automated replies from virus scanners responding to forged viruses

Re: [Mimedefang] Validating sender domain opinion

2004-07-12 Thread Ben Kamen
2 config files - run bind 2 times binding the service to each interface. (that's the important part - MUST have 2 ethernet interfaces) Also - MS DNS is very evil. VERY evil. I would highly advise against running it. -Ben [EMAIL PROTECTED] wrote: Lazy is more like it. It's possible to run split

Re: [Mimedefang] OT: SCO

2004-07-09 Thread Ben Kamen
they did release one code snippet which was quickly digested by the industry's experts who resolved it was not infringing... at that point, the suit became much more of a joke as most people said, ~ if that's the bext they've got.. and so forth... -Ben On Thu, 8 Jul 2004, Kevin A.

[Mimedefang] Where is best to use $SendmailMacros{auth_authen} ?

2004-07-01 Thread Ben Kamen
Where would I be best putting a check for $SendmailMacros{auth_authen} to see if someone relaying has auth'd? And what action would I use? Just action_accept()? I don't want to do anything to the email - I want MIMEdefang to just get out of the way... heheh.. waste no more time! Thanks, -Ben

Re: [Mimedefang] Where is best to use $SendmailMacros{auth_authen} ?

2004-07-01 Thread Ben Kamen
nevermind... --Ben ___ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang

Re: [Mimedefang] Where is best to use $SendmailMacros{auth_authen} ?

2004-07-01 Thread Ben Kamen
Although it still shows in mail.log that X-Scanned-By: MIMEDefang was added to the header... should that be there? -Ben Ben Kamen wrote: nevermind... --Ben ___ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL

Re: [Mimedefang] sasldb2 not found

2004-06-30 Thread Ben Kamen
Actually, cyrus SASL is nice if you want to run sendmail AUTH which is what I do with it... -Ben David F. Skoll wrote: On Wed, 30 Jun 2004, David Kolar wrote: I have followed the Micky Hill HOWTO to the letter. That HOWTO is way too extensive -- you don't need Cyrus IMAP to run MIMEDefang;

[Mimedefang] Internet Virus hits IIS

2004-06-26 Thread Ben Kamen
http://www.msnbc.msn.com/id/5290386 Once again, we say, Thank you MicroSoft... Anyone got an httpd log finger print I can build a graph from?? -Ben ___ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED]

[Mimedefang] watch-mimedefang

2004-06-25 Thread Ben Kamen
Hey there, I haven't used watch-mimedefang in a long time and I fired it up today and get this error on the screen: MXCommand: connect: permission denied ??? Is that an X error or something else? Thanks, -Ben ___ Visit http://www.mimedefang.org and

Re: [Mimedefang] watch-mimedefang

2004-06-25 Thread Ben Kamen
Root permissions.. Nevermind. -Ben Ben Kamen wrote: Hey there, I haven't used watch-mimedefang in a long time and I fired it up today and get this error on the screen: MXCommand: connect: permission denied ??? Is that an X error or something else

Re: [Mimedefang] sendmail 8.13.0

2004-06-21 Thread Ben Kamen
Haven't read up - what does SocketMAP do? -Ben David F. Skoll wrote: On Mon, 21 Jun 2004, Marco Berizzi wrote: Anyone have tried it with MD 2.43? 8.13.0.Beta1 worked fine; I assume 8.13.0 will. I'll also be making support for Sendmail's SOCKETMAP option official with the next MIMEDefang

Re: [Mimedefang] TMDA

2004-06-18 Thread Ben Kamen
I would have to agree - they are pure evil. Not that anyone has quickly made it to my spam list... but evil they are indeed. Hey - I have a quick question: in SA there's skip_rbl_checks which I have turned ON since I do RBL checking in sendmail - but I want to do rDNS checking through SA... I

Re: [Mimedefang] Add Hebrew Support

2004-06-17 Thread Ben Kamen
David F. Skoll wrote: On Thu, 17 Jun 2004, Kevin A. McGrail wrote: I just had that discussion re: HAM / SPAM. I vote we change it to kosher and non-kosher email ;-) Tecnically, Kosher and Treif. But I think ham/spam are too deeply ingrained to be disloged. :-) They're also

Re: [Mimedefang] Somewhat OT: Dictionary attacks

2004-06-09 Thread Ben Kamen
I have and I am also running something like that - I wrote a TCL script that does exactly what you're talking about... It's features are: routes IP's into the 'route add -blackhole' almost immediately. Runs continuously based on tcl's fileevent (as to not suck CPU time) Keeps a table in

Re: [Mimedefang] Somewhat OT: Dictionary attacks

2004-06-09 Thread Ben Kamen
Which brings up another thought: That of using such gathered output to generate another DNSBL of some sort. ;) How many bad recipients is acceptable? I have my throttling set at 2. -Ben David F. Skoll wrote: Hi, Are MIMEDefang list denizens seen a huge increase in dictionary attacks? I know I am.

Re: [Mimedefang] Help with Spamassassin

2004-06-02 Thread Ben Kamen
I agree. Content based filtering is never good.. You can't filter ideas.. Only your users can do that. I've run into filters sending mail to various places I don't remember the words I typed they caused the bounce... but I sent the admins a message saying how a$$in1ne and f*ck'n stoopid it

[Mimedefang] Recovering Quarantined Message

2004-05-18 Thread Ben Kamen
Ok, I tried the FAQ item and since I don't have a ENTIRE_MESSAGE file, I'm out of luck? I just want the PART.1.BODY (.chm file) Where can I find the fang.pl? It says contrib/fang.pl but what's the rest of the path on that? Thanks, -Ben ___ Visit

[Mimedefang] Quarantined message

2004-05-18 Thread Ben Kamen
Nevermind on the path.. ;) I thought it was a web URL reference.. -Ben ___ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang

Re: [Mimedefang] Accuracy of infected IP in mdlog

2004-05-17 Thread Ben Kamen
Joseph Brennan wrote: --On Monday, May 17, 2004 10:14 AM -0400 David F. Skoll [EMAIL PROTECTED] wrote: Actually, there's a very large ISP in Canada (Sympatico) that shuts down customers if it detects that they are sending out viruses. You don't get your connectivity back until you have proven

Re: [Mimedefang] Accuracy of infected IP in mdlog

2004-05-17 Thread Ben Kamen
Joseph Brennan wrote: --On Monday, May 17, 2004 10:14 AM -0400 David F. Skoll [EMAIL PROTECTED] wrote: Actually, there's a very large ISP in Canada (Sympatico) that shuts down customers if it detects that they are sending out viruses. You don't get your connectivity back until you have proven

Re: [Mimedefang] RBL's

2004-05-17 Thread Ben Kamen
I agree on SpamHaus. They have rational methodology for entries in the list. I use them and ORDB. Between those 2 and my own access list for sendmail - I have great success at this point. Yea, maybe I get 5 SPAMs a day - but I can live with that. -Ben

Re: [Mimedefang] OT: Sasser info

2004-05-04 Thread Ben Kamen
As a sidenote, that article shows at the bottom how MS is offering a $4.5million bounty for capture of virus authors.. Now if they just put that money into FIXING their bugs or paying for some people who have a clue about computer security... THEN they'd be getting somewhere fast! -Ben

Re: [Mimedefang] OT: Sasser info

2004-05-04 Thread Ben Kamen
NO KIDDING. Unfortunately, some might argue that's a lot like blaming the gun manufacturer.. Personally, I think guns have their place (like for those who live in the middle of nowhere - and such)... sloppy programming does not. -Ben SRAR Mail Administrator wrote: From

Re: [Mimedefang] test

2004-04-26 Thread Ben Kamen
Pong Jim McCullars wrote: ping ___ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang

Re: [Mimedefang] User Doc: How To Setup Outlook XP To Automatically Filter Spam

2004-04-13 Thread Ben Kamen
I hope you don't mind if I link to that on my web page.. -Ben I've created some end-user documentation to assist users in creating an Outlook XP rule to automatically filter Spam if anyone is interested: http://www.thompsonic.com/util/antispam/index.html

Re: OT: Re: [Mimedefang] Extremism or just leveling the playing field..

2004-04-12 Thread Ben Kamen
/mimedefang -- Ben Kamen - O.D.T, S.P. -- Home: [EMAIL PROTECTED] http://www.benjammin.net Work: [EMAIL PROTECTED] gPG Pub Key - http://www.benjammin.net/www/pages/library

Re: [Mimedefang] Trend Anti-Virus question

2004-04-12 Thread Ben Kamen
Ehhh, that's what 100Mb Full Duplex via Ethernet switches are for! ;) Michael Haro wrote: I'm also looking into switching from the sendmail edition on solaris to something else (sun ram is too expensive)... It would probably be less complicated to just use the linux vscan method with mimedefang,

Re: [Mimedefang] Extremism or just leveling the playing field..

2004-04-11 Thread Ben Kamen
Well, I did it last night - I wrote an event driven TCL script that watches the mail log for sendmail's RCPT Flood message and then blackholes the IP address... then, after a user specified time limit, it will remove the blackhole automatically. Any add/delete actions are saved in a text file

Re: [Mimedefang] bayesian working?

2004-04-11 Thread Ben Kamen
No no no, what IT needs to tell management is: We have 2 machines... one is way faster than the other... but it still gets bogged... if we want to keep up the war on spam, what we need is TWO really fast machines... ;) Put in terms that make the suits unhappy... then hardware you shall have.

Re: [Mimedefang] Extremism or just leveling the playing field..

2004-04-11 Thread Ben Kamen
Heheh, isn't anyone else doing this? I would imagine so... On Sun, 11 Apr 2004, Stephen Smoogen wrote: Now you just need to add a signed peer2peer networking scheme so that you can share that info with hosts that are also on the network and then 4. profit.

Re: [Mimedefang] Extremism or just leveling the playing field..

2004-04-09 Thread Ben Kamen
That's pretty funny... actually.. Now that I think about it, I might have a TCL script that with some modification could probably do this for me... I think I might look into it this weekend... heheh.. thanks! -Ben Stefano McGhee wrote: I would love to have a hook in mimedefang to

Re: [Mimedefang] Black Listed

2004-04-06 Thread Ben Kamen
Well, first thing would be to contact the customer directly and let them know you can't email them because of the problem you're having with their ISP. Then you can recommend any fine sendmail admins in your area on this list to come and install their own sendmail server complete with

Re: [Mimedefang] Black Listed

2004-04-06 Thread Ben Kamen
Ken Morley wrote: Mark: So, call AmeriTech and tell them that they need to address the RBL/ISP's concerns about spam sent by an AmeriTech customer. Good luck with it. (sigh) Yea.. emphasis on luck - first - you need to find someone who understands that problem... So, ask them if they have

Re: [Mimedefang] Black Listed

2004-04-05 Thread Ben Kamen
addresses and I've had to null-route three 4096 host subnets because the idiots at ameritech didn't care... I don't have any special love for Ameritech/SBC. I filed a complaint against them with the Illinois Commerce Commission. Nothing ever happened. Big surprise. -Ben -- Ben Kamen - O.D.T

[Mimedefang] OT: or not? Contact Congress

2004-03-22 Thread Ben Kamen
I realize this list crosses national boundaries, but I'm beginning to think it's time to really start hammering our local governmental people (for those of us in the US) with complaints that the CAN-SPAM act has done wonders... the BIG ISP's with money get to sue while we smaller guys just get

Re: [Mimedefang]

2004-03-22 Thread Ben Kamen
If you're already root, just 'make install' is what you want. -Ben Mark Penkower wrote: I am running Redhat Linux 9.0 and am setting up Mimedefang 2.39. According to your instructions, to install the various libraries needed Mimedefang, I need to do the following: perl Makefile.PL make make

Re: [Mimedefang] Discarding fake MXs

2004-03-22 Thread Ben Kamen
Well, we do that for a reason... it sends spammers to the next (unreachable) MX point after failing to send spam to the primary. I used to use 127.0.0.1 - but people like SBC block incoming mail if the remote's have any MX's set like that (poo!)... Oh well. -Ben Andrea Venturoli wrote:

Re: [Mimedefang] MD I/O intensive?

2004-03-16 Thread Ben Kamen
It's just quoted... no by Nick Ok. That answers my question. Tanks, -Ben Andrew J Caird wrote: Quoting Ben Kamen [EMAIL PROTECTED]: Did I miss something? Section 3.3.3 of what? :) Yes. :) Section 3.3.3 of the book mentioned in the previous line, sendmail Performance Tuning

<    1   2   3   >