[Mimedefang] MIMEDefang 2.76 is released

2015-03-27 Thread David F. Skoll
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello, MIMEDefang 2.76 is available at http://www.mimedefang.org/download (Yes, we are still actually doing MD development! :)) Changelog follows. Regards, David. 2015-03-27 David F. Skoll * MIMEDefang 2.76 RELEASED 2015-03-24 David F

Re: [Mimedefang] extract body from INPUTMSG?

2015-03-10 Thread David F. Skoll
On Tue, 10 Mar 2015 15:39:59 -0400 Joseph Brennan wrote: > if (open(IN, '<', './INPUTMSG')) { > while () { > # stuff it into a variable? > } > close(IN); That works, as does this which does it all in one slurp and avoids repeated string appends: my $slurped; if (open(IN, '<', '.

Re: [Mimedefang] extract body from INPUTMSG?

2015-03-10 Thread David F. Skoll
On Tue, 10 Mar 2015 15:13:54 -0400 Scott Galambos wrote: > What is the easiest way to extract a copy of the text body of a > message (INPUTMSG) into a variable? A couple of good starting points: man MIME::Entity man MIME::Body and of course: man mimedefang-filter Regards, David. _

Re: [Mimedefang] Mimedefang dropping mail discard with no reason in log file - mail relay from hostname.roaringpenguin.com

2015-03-05 Thread David F. Skoll
Hi, This line: > Mar 5 16:36:16 ant sm-mta[3694]: t25GaFwa003694: ruleset=check_rcpt, > relay=hostname.roaringpenguin.com [x.x.x.x], discard indicates that you have a DISCARD entry somewhere in your access map (probably /etc/mail/access) Regards, David. __

Re: [Mimedefang] Strip DOC with macros

2015-02-25 Thread David F. Skoll
On Wed, 25 Feb 2015 13:17:42 -0500 (EST) Justin Edmands wrote: > I wanted to know if I could use mimedefang to strip > out .DOC, .DOCX, .XLS, and .XLSX files (or any applicable file type) > if they contain a macro. Yes. Stripping attachments is explained in the mimedefang-filter page. The impor

Re: [Mimedefang] Locking down sendmail from behind a filtering gateway

2015-02-19 Thread David F. Skoll
On Thu, 19 Feb 2015 10:26:17 -0500 John Von Essen wrote: > Would > Connect:IPv4 REJECT > Also work? No. Sendmail only prefixes IPv6 addresses, not IPv4. I can't understand why you don't simply use iptables rules or the equivalent; it's far simpler and more efficient. Regards, David

Re: [Mimedefang] Locking down sendmail from behind a filtering gateway

2015-02-17 Thread David F. Skoll
On Tue, 17 Feb 2015 14:29:16 -0500 "John Von Essen" wrote: > But yes, I never even thought of that, I could use MD on the mail > server and implement the reject/allow logic. I was just trying to see > if there was a native way to do it in sendmail. If I had 2nd NICs on > all the servers, I could

Re: [Mimedefang] Locking down sendmail from behind a filtering gateway

2015-02-17 Thread David F. Skoll
On Tue, 17 Feb 2015 12:19:34 -0500 John Von Essen wrote: > Any thoughts, the filtering gateways only have 1 NIC. Worst case, I > can put a firewall on the mail server, but I didn’t want to have to > do that. Is there a way to make sendmail deny everything by default? You're using MIMEDefang, rig

Re: [Mimedefang] umask, mimedefang, clamd and spamassassin

2015-02-02 Thread David F. Skoll
On Mon, 2 Feb 2015 14:13:31 - "Steve Hanselman" wrote: > I've just run strace over a session and it would appear that > spamassassin modifies the umask, which probably explains the issue (it > also depends which tests you have enabled in spamassassin if you grep > the tree). What version of

Re: [Mimedefang] Mimedefang breaks DKIM signing of single-part, plain text emails

2015-01-15 Thread David F. Skoll
On Thu, 15 Jan 2015 10:41:14 -0700 Peter Nagel wrote: [Some very good comments] Yes, I can see how MIMEDefang misbehaves if you're trying to sign something. I'll definitely look at fixing the behaviour. Regards, David. ___ NOTE: If there is a discla

Re: [Mimedefang] recommendations for DKIM signing, and DMARC/DKIM/SPF checks?

2015-01-14 Thread David F. Skoll
On Wed, 14 Jan 2015 17:00:51 -0500 Anne Bennett wrote: > In the meantime, are there any well-known and recommended > modules that I could add to MIMEDefang to help with this? Sure. Mail::DKIM::Signer if you want to DKIM-sign your mail. Our MIMEDefang filter contains this routine: use Mail::DK

[Mimedefang] Sendmail source (was Re: helo callback)

2014-11-18 Thread David F. Skoll
On Tue, 18 Nov 2014 14:51:14 -0500 "Dale Moore" wrote: > The routine in sendmail/srvrstmp.c where I suspect the bug > resides is a small 2800 lines long. Ah, you think it's 2800 lines long. Run it through the C preprocessor to expand all the horrible macros. The MILTER_REPLY macro alone is mor

Re: [Mimedefang] $Sender -> Return-Path

2014-11-18 Thread David F. Skoll
On Tue, 18 Nov 2014 12:01:27 +0100 Fredrik Pettai wrote: > It turns out that $Sender isn't the email address of From: header in > those cases, instead $Sender is set to the email address of the > Return-Path header. Strictly speaking, $Sender is whatever the other end used in the MAIL From:<...>

Re: [Mimedefang] helo callback

2014-11-07 Thread David F. Skoll
On Fri, 7 Nov 2014 13:06:29 -0500 "Dale Moore" wrote: > Client: Helo naughtywords > Mimedefang filter_helo: return('REJECT', 'I do not like > naughtywords'); Server: 220 somehost.cs.cmu.edu Hello > someclient.cs.cmu.edu [128.2.x.x], pleased to meet you > Client: Mail From: > Mimedefang filter_se

Re: [Mimedefang] Slightly OT: Sendmail config option for accepting user.n...@domain.com

2014-10-23 Thread David F. Skoll
On Thu, 23 Oct 2014 10:36:13 -0500 Ben Kamen wrote: > What's the config option so that sendmail accepts mail to a user's > "Full Name" field? There's a really ancient Sendmail configuration directive that makes it look at the gecos field of /etc/passwd. define(`confMATCH_GECOS',`true')dnl htt

Re: [Mimedefang] filter_cleanup question

2014-09-26 Thread David F. Skoll
On Fri, 26 Sep 2014 09:49:10 -0400 "Kevin A. McGrail" wrote: > From looking at the code, I think maybe I should have a return > status on my function so I've added return 0; If I'm right, I think > perhaps the man page could be a bit more effusive on that point? Well, it currently reads: Th

Re: [Mimedefang] delay on relay problems

2014-09-21 Thread David F. Skoll
On Sun, 21 Sep 2014 11:12:42 -0400 "Dale Moore" wrote: > I will have some patches I would like to submit. > Where should I submit them? Please post them to this list; I'll grab them. If they are large, then please send directly to me at Regards, David. ___

Re: [Mimedefang] ClamAV effectiveness (was Re: MIMEDefang Digest, Vol 132, Issue 3)

2014-09-18 Thread David F. Skoll
On Thu, 18 Sep 2014 14:17:13 -0500 Richard Laager wrote: > Is there a virus scanner you'd recommend for use with MIMEDefang on > Linux? No, not really. I'd recommend not running Windows which reduces your exposure to viruses by 99%. And rather than any sort of virus scanner, I'd simply block a

[Mimedefang] ClamAV effectiveness (was Re: MIMEDefang Digest, Vol 132, Issue 3)

2014-09-18 Thread David F. Skoll
On Thu, 18 Sep 2014 17:33:44 +0100 (BST) "G.W. Haywood" wrote: > In my opinion ClamAV is more or less useless for anything other than > the phishing signatures etc. for which I use it. Seconded. ClamAV has become almost completely useless since the Sourcefire and then Cicso acquisition. It's a

Re: [Mimedefang] ClamAV + SaneSecurity signatures

2014-09-18 Thread David F. Skoll
On Thu, 18 Sep 2014 08:26:30 -0600 Nels Lindquist wrote: > Has anyone done much on this front? If so, what's your experience? I experimented with Sane Security signatures. They are far better than the official ClamAV signatures (which are next to useless), but I would stick to the virus ones.

Re: [Mimedefang] detect failed auth

2014-09-10 Thread David F. Skoll
On Wed, 10 Sep 2014 16:08:31 +0200 Frank Doepper wrote: > Unfortunately saslauthd does not log the IP address. Ah. This apparently is a long-standing problem: http://objectmix.com/sendmail/760733-getting-ip-address-failed-authentications.html I believe if you increase the Sendmail log level t

Re: [Mimedefang] detect failed auth

2014-09-10 Thread David F. Skoll
On Wed, 10 Sep 2014 11:40:42 +0200 Frank Doepper wrote: > is there a way to detect a failed smtp auth in Milter? No, not as far as I know. If you want to block brute-force attacks, your best bet is something like fail2ban. http://www.fail2ban.org/ Regards, David.

Re: [Mimedefang] quarantine bad_filename messages

2014-09-09 Thread David F. Skoll
On Tue, 09 Sep 2014 10:43:44 -0400 Anne Bennett wrote: > But that uses a global variable that assumes that the same > slave will be used for the filter_begin and filter_end calls > - I thought we were supposed to be very careful about such > global variables. In the mimedefang-filter(5) man page

Re: [Mimedefang] quarantine bad_filename messages

2014-09-09 Thread David F. Skoll
On Tue, 09 Sep 2014 12:12:03 +0200 Marcus Schopen wrote: > I'd like to use "action_quarantine_entire_message" for messages > containing attachments with bad_filename, but not sure where to place > the quarantine command. Is "sub filter_bad_filename" the right place? You can do it there, or you

[Mimedefang] MIMEDefang and systemd

2014-08-06 Thread David F. Skoll
Hi, There is apparently some demand for a systemd unit file for MIMEDefang: https://bugzilla.redhat.com/show_bug.cgi?id=789768 I replied to that ticket at https://bugzilla.redhat.com/show_bug.cgi?id=789768#c10 If anyone is using MIMEDefang on a Linux distro that uses systemd and would like to h

Re: [Mimedefang] Mimedefang/Multiplexor wrong score. Stops running tests randomly

2014-07-18 Thread David F. Skoll
On Fri, 18 Jul 2014 12:50:53 -0400 Justin Edmands wrote: > From a combination of your responses I was able to shed some light on > a few things. Also, make sure that your filter explicitly sets: $SALocalTestsOnly = 0; Otherwise, all of the network tests (URIBL, DNSBL, etc.) are disabled.

Re: [Mimedefang] Relayed emails can't be filter!

2014-06-13 Thread David F. Skoll
Hello, > MIMEDefang can check the message during relay phase. This is the > ability of Milter. We have answered your questions to the best of our ability. Please do not post any followups on this list; the topic is closed. Regards, David. ___ NOTE: I

Re: [Mimedefang] Relayed emails can't be filter!

2014-06-13 Thread David F. Skoll
On Fri, 13 Jun 2014 21:58:03 +0700 Cương Bùi wrote: > Could you tell me why? The Sendmail milter implementation only allows filtering for mail that comes into the MTA via SMTP. Once a message is in the queue, it's too late. Regards, David. ___ NOTE:

Re: [Mimedefang] Relayed emails can't be filter!

2014-06-13 Thread David F. Skoll
On Fri, 13 Jun 2014 21:32:18 +0700 Cương Bùi wrote: > I've done some tests. I found that OpenEMM just creates email files > and puts it into queue. Well, you need to get OpenEMM not to do that. MIMEDefang can only see messages that come in via SMTP. So you need to take up this issue with the O

[Mimedefang] MIMEDefang 2.75 is released

2014-05-21 Thread David F. Skoll
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello, MIMEDefang 2.75 is available at http://www.mimedefang.org/download Not too many changes... Regards, David. 2014-05-21 David F. Skoll * MIMEDefang 2.75 RELEASED * Many cosmetic improvements to watch-multiple

Re: [Mimedefang] spam_assassin_check randomly returns zero points and blank names

2014-05-21 Thread David F. Skoll
On Wed, 21 May 2014 01:07:53 -0500 Cliff Hayes wrote: > I don't know how long this has been going on but I just noticed that > about 1% of emails going through our system are being assigned zero > points/hits and blank tests/names. Maybe those message actually don't hit any tests? > I don't k

Re: [Mimedefang] Parse and export to database parts

2014-04-25 Thread David F. Skoll
On Thu, 24 Apr 2014 21:08:22 -0400 Jeffrey Starin wrote: > We are new to perl and certainly MIMEdefang and could use some > hand-holding. If you are new to Perl, I strongly recommend hiring a contractor who is familiar with Perl to do the work you need. What you want to do is moderately complex

Re: [Mimedefang] FB Joins? And current copy of code we are using to handle DMARC reject/quarantine domains and mailing lists - Was Re: ADMINISTRIVIA: Yahoo users may not post to this mailing list

2014-04-24 Thread David F. Skoll
On Thu, 24 Apr 2014 18:08:43 -0400 "Kevin A. McGrail" wrote: > On a related note, anyone know a quick way to handle modifying > subjects like this so I properly modify it? > Important Mailing List Notification > re:[=?utf-8?B?MjHkuJbnuqropoHkuYjnlLXlrZDllYbliqHvvIzopoHkuYjml6DllYblj6/liqHvvIE=?

Re: [Mimedefang] Parse and export to database parts

2014-04-24 Thread David F. Skoll
On Thu, 24 Apr 2014 16:32:48 -0400 Jeffrey Starin wrote: > Can MIMEdefang extract from, subject and attachment to a database or > otherwise parse it so another process can then examine those parts? Yes, certainly. All you need to do is supply the Perl code to make all of that happen. :) Regard

Re: [Mimedefang] FB Joins? And current copy of code we are using to handle DMARC reject/quarantine domains and mailing lists - Was Re: ADMINISTRIVIA: Yahoo users may not post to this mailing list

2014-04-24 Thread David F. Skoll
On Thu, 24 Apr 2014 15:30:49 -0400 "Kevin A. McGrail" wrote: > We apologize for the inconvenience but the cause of the issue rests > squarely and solely on your email provider. We recommend you > consider a free Google account available at http://www.gmail.com/. I like the logic but wonder wha

Re: [Mimedefang] Operating on attachments - choosing which attachment to operate on

2014-04-24 Thread David F. Skoll
On Thu, 24 Apr 2014 17:27:18 + Michael Lazar wrote: > 1) An email with an encrypted ZIP file is received > 2) Copy the attachment and use action_external_filter to decrypt the > attachment and re-compress it > 3) Rename the new attachment to a static name (i.e. clear.zip) > 3) Add the newly d

Re: [Mimedefang] DMARC pessimism (was Re: ADMINISTRIVIA: Yahoo users may not post to this mailing list)

2014-04-23 Thread David F. Skoll
On Wed, 23 Apr 2014 10:05:29 -0500 Les Mikesell wrote: > A standard for user interfaces??? What planet do you expect that to > happen on? which was more-or-less the response of the DMARC authors. I summarize it as: "The problem is too hard to fix correctly, so we will pretend to fix it in a h

[Mimedefang] DMARC pessimism (was Re: ADMINISTRIVIA: Yahoo users may not post to this mailing list)

2014-04-23 Thread David F. Skoll
On Wed, 23 Apr 2014 10:32:48 -0400 Joseph Brennan wrote: > The madness has spread to AOL effective yesterday 4/22. Ah well. The intersection of "AOL users" and "MIMEDefang members" is empty. This is not entirely unexpected. :) These moves, by the way, will have the effect of rendering DMARC c

[Mimedefang] ADMINISTRIVIA: Yahoo users may not post to this mailing list

2014-04-15 Thread David F. Skoll
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello, I regret to inform Yahoo users that they may no longer post to any mailing list hosted on lists.roaringpenguin.com. The reason is a recent policy change by Yahoo to their DMARC policy that makes third-party servers reject mailing list traffic

Re: [Mimedefang] Yahoo! DMARC and smfi_chngfrom was Yahoo DMARC

2014-04-15 Thread David F. Skoll
On Tue, 15 Apr 2014 09:35:19 -0400 "Kevin A. McGrail" wrote: > - All the various recipients that acknowledge p=reject reject the > mail as forged That's the part I don't understand. Mail from my list will not have a yahoo.com envelope sender. And if I remove the DKIM header, what basis could t

Re: [Mimedefang] Yahoo! DMARC and smfi_chngfrom was Yahoo DMARC

2014-04-14 Thread David F. Skoll
On Mon, 14 Apr 2014 16:27:58 -0400 "Kevin A. McGrail" wrote: > However, we are seeing an issue with the change_sender(); function. > Specifically, here's a test from my Yahoo! account to an autism > mailing list. Even though smfi_chgfrom appears to have worked, when > the email is parsed by mail

Re: [Mimedefang] filter_relay rejected host. (DNSBL)

2014-03-21 Thread David F. Skoll
On Fri, 21 Mar 2014 08:43:22 +0100 Lars Bjærris wrote: > sub filter_relay { > > my ( $ip, $name, $helo) = @_; > if (relay_is_blacklisted($ip, ‘zen.spamhaus.org’)) { > return(‘REJECT’, ‘You are listed in zen.spamhaus.org’); > } > } You don't return anything meanin

Re: [Mimedefang] Extension blocking (was What AV scanners do you use? and was Re: Any Sophie users out there?)

2014-03-21 Thread David F. Skoll
On Fri, 21 Mar 2014 10:45:46 + Andrew Watkins wrote: > I should tighten up on our extension blocking. Talking of extension blocking, I found a very nice tool called "lsar" that's part of the "unar" package. This is packaged in Debian ("apt-get install unar") and source is available here: h

Re: [Mimedefang] )What AV scanners do you use? (was Re: Any Sophie users out there?

2014-03-20 Thread David F. Skoll
On Thu, 20 Mar 2014 15:46:49 -0400 wbr...@e1b.org wrote: > We haven't seen an increase in virii detected by McAfee or Symantec > on servers downstream from our CanIt system. Maybe that's because > blocking the unsafe extensions kills them before we even call ClamAV. I've attached the statistics

[Mimedefang] )What AV scanners do you use? (was Re: Any Sophie users out there?

2014-03-20 Thread David F. Skoll
On Thu, 20 Mar 2014 14:49:32 -0400 (EDT) Jason Englander wrote: > Personally and professionally I've used ClamAV (via clamd) for a > long time. I actually used to be a "team member" pre-Cisco, > pre-SourceFire. Post-Cisco, ClamAV seems to have greatly declined in usefulness. It catches hardly a

Re: [Mimedefang] reject a message if listed on more than one DNSBL

2014-03-18 Thread David F. Skoll
On Tue, 18 Mar 2014 17:16:53 +0100 (CET) Steffen Kaiser wrote: > use the Net::DNS resolver and query the blacklists. mimedefang.pl has > the skeleton how to query. I also maintain a nice CPAN module: http://search.cpan.org/~dskoll/Net-DNSBL-Client-0.205/ that can help. Regards, David. __

Re: [Mimedefang] modern perl problems?

2014-03-13 Thread David F. Skoll
On Thu, 13 Mar 2014 16:50:22 +0100 Fredrik Pettai wrote: > main::rebuild_entity() called too early to check prototype > at /usr/pkg/bin/mimedefang.pl line 805. I have a patch in our git repo to fix this; just haven't done a new MIMEDefang release yet. diff --git a/mimedefang.pl.in b/mimedefang.

Re: [Mimedefang] my own Mailman postings discarded!?

2014-03-03 Thread David F. Skoll
On Mon, 3 Mar 2014 12:26:29 -0800 "Web Analysts" wrote: > My own postings to one of my Mailman lists is being rejected. My > outbound message is using my own SMTP server and Mailman is on the > same fedora machine. How can I fix this? This is maddening Well, something in your filter is calling a

Re: [Mimedefang] Can I get MimeDefang to email alert me when a customer server is on an RBL

2014-02-26 Thread David F. Skoll
On Wed, 26 Feb 2014 08:30:35 - "Jon Rowlan" wrote: > It just makes sense for me to RBL check the sending servers because > that is where the problem is and indeed we are finding these sending > servers listed on RBL servers - ours does not seem to get blacklisted. MIMEDefang is written in Pe

Re: [Mimedefang] Warning: Malformed MIME virus in the wild

2014-02-12 Thread David F. Skoll
On Tue, 11 Feb 2014 22:19:01 +0100 (CET) Kees Theunissen wrote: > I found this old message when I was searching my mailboxes for > malformed "Content-Disposition" MIME headers. > Note that the "name=" field in the Content-Disposition header above is > also wrong. This should be a "filename=" fiel

Re: [Mimedefang] Builds for MacOS X?

2014-02-10 Thread David F. Skoll
On Mon, 10 Feb 2014 15:53:41 -0700 Philip Prindeville wrote: > Which is definitely your prerogative. But if the software contains > community contributed enhancements, fixes, etc. is that a reasonable > decision to make unilaterally? I do not care if it's reasonable or not. I am the malevolent

Re: [Mimedefang] rate-limiting for outbound mails per sender

2014-02-10 Thread David F. Skoll
On Mon, 10 Feb 2014 07:08:38 +0100 (CET) Steffen Kaiser wrote: > > what would be a good way to implement rate-limiting for outbound > > mails per sender e.g. 50 recipients per smtp_auth sender per hour? > I do this in filter_begin. There I detect the sender, assign a > "SenderID" based on differ

Re: [Mimedefang] Builds for MacOS X?

2014-02-08 Thread David F. Skoll
On Fri, 7 Feb 2014 18:13:04 -0800 John Nemeth wrote: [David Skoll] > } The best way to make a platform fail is for developers to > } boycott it. > I'm certainly not a fan of the "walled garden" which is a > major reason why I have an Android phone, but I'm pretty sure that > ship has sailed

Re: [Mimedefang] Builds for MacOS X?

2014-02-07 Thread David F. Skoll
On Thu, 6 Feb 2014 23:11:35 -0700 Philip Prindeville wrote: > > No technical reason, I suppose, but I have a giant hate-on for > > Apple. :) > > > > http://david.skoll.ca/blog/2010-05-18-anti-apple.html > You might be shooting yourself in the foot. Shooting *myself* in the foot? How so? It's

Re: [Mimedefang] Builds for MacOS X?

2014-01-29 Thread David F. Skoll
On Wed, 29 Jan 2014 17:17:19 -0700 Philip Prindeville wrote: > Is there an obvious reason that Mimedefang isn't used with MacOS? No technical reason, I suppose, but I have a giant hate-on for Apple. :) http://david.skoll.ca/blog/2010-05-18-anti-apple.html Anyone is free to port MIMEDefang to M

Re: [Mimedefang] mimedefang filter sender using filter_sender

2014-01-18 Thread David F. Skoll
On Sat, 18 Jan 2014 08:27:15 +0545 Prabin Acharya wrote: > I know my mail server is loose in terms of security Well... you need to fix that first, don't you think? Regards, David. ___ NOTE: If there is a disclaimer or other legal boilerplate in the a

Re: [Mimedefang] spamassassin scores ignored in sa-mimedefang.cf

2014-01-08 Thread David F. Skoll
On Wed, 08 Jan 2014 14:28:51 +0100 Christoph Lehmann wrote: > I like to use different configuration files for authenticated and > non-authenticated users. > ($hits, $req, $names, $report) = > spam_assassin_check('/etc/mail/sa-mimedefang.cf'); MIMEDefang uses a persistent Mail::SpamAssassin ob

Re: [Mimedefang] mimedefang and incoming facebook email

2013-12-31 Thread David F. Skoll
On Tue, 31 Dec 2013 17:06:08 +0800 cc wrote: > My question is, how come I couldn't find "This message ..." > in mimedefang's sources? Something in your filter is munging the email. You need to post your filter for us to make any sense of what's going on. Regards, David. __

Re: [Mimedefang] add_recipient inconsistent results on postfix

2013-12-30 Thread David F. Skoll
On Mon, 30 Dec 2013 17:48:01 +0100 Benoit Panizzon wrote: > Hmm, maybe you pointed me to the problem. Very strange, that this > sometimes work even if it's not supposed to work. Well I guess I > could store all changes via Storable and then pull them in > filter_begin. Yes, you will need to do t

Re: [Mimedefang] add_recipient inconsistent results on postfix

2013-12-30 Thread David F. Skoll
On Mon, 30 Dec 2013 11:23:17 +0100 Benoit Panizzon wrote: > That's pretty weird now, because I have added an md_syslog > instruction before those recipient changes dumping what is being > changed so I know they are being run. Where are you calling action_add_recipient? It can only be called fro

Re: [Mimedefang] add_recipient inconsistent results on postfix

2013-12-23 Thread David F. Skoll
On Mon, 23 Dec 2013 11:35:11 +0100 Benoit Panizzon wrote: > Same result, only local delivery. I'm not familiar with Postfix, but this does sound like a Postfix bug. I would post on a Postfix list because I think most of the people on this list are Sendmail users... Regards, David.

Re: [Mimedefang] MIME::Head question

2013-12-12 Thread David F. Skoll
On Thu, 12 Dec 2013 12:06:43 -0700 Philip Prindeville wrote: > If I want to add a header via: > $entity->head()->add('Received', "some-multiline-folded-text"); MIME::Head is really a Mail::Header and it wants to take care of folding the line on your behalf. You have to give it a long unfolded

Re: [Mimedefang] Perl DBI problem stops mimedefang from loading?

2013-12-07 Thread David F. Skoll
On Fri, 06 Dec 2013 21:16:24 -0500 Scott Galambos wrote: > Can anyone recommend some values for these on a new SMP 64bit server > with about 6GB of memory and 8GB of swap? I don't know what to put > here now. Maybe leave it unlimited? I would leave it unlimited. Why are you attempting to l

Re: [Mimedefang] Perl DBI problem stops mimedefang from loading?

2013-12-06 Thread David F. Skoll
On Fri, 06 Dec 2013 09:46:13 -0500 Scott Galambos wrote: > I specify values [for RSS_MAX, etc] and I get the following. Very > strange. The values you specify must be too low, then. If it fails when you *don't* specify resource limits, maybe the default limits are too low --- check the output

Re: [Mimedefang] Perl DBI problem stops mimedefang from loading?

2013-12-06 Thread David F. Skoll
On Fri, 06 Dec 2013 07:00:42 -0500 Scott Galambos wrote: > Anyone seen this before? > module DBI: /usr/local/lib64/perl5/auto/DBI/DBI.so: failed to map > segment from shared object: Cannot allocate memory > at /usr/lib64/perl5/DynaLoader.pm line 190. No, never. Our commercial CanIt system is b

Re: [Mimedefang] Little help with no checks for AUTH users on 587

2013-11-25 Thread David F. Skoll
On Sun, 24 Nov 2013 21:24:53 -0700 Mark Costlow wrote: > Is it OK to call read_commands_file() from filter_relay? When I do, I > get this error: Ah, no, sorry. I forgot... Sendmail does not assign a Queue-ID until the MAIL FROM: stage. > I think the man page said it can only be called from fi

Re: [Mimedefang] Little help with no checks for AUTH users on 587

2013-11-25 Thread David F. Skoll
On Sat, 23 Nov 2013 13:38:56 -0600 Ben Kamen wrote: > I don't see any of those in my /etc/mail/mimedefang-filter, where > would I normally see those or do I have to write them? You'd have to write them, and if you don't need them you don't have to write them. Regards, David.

Re: [Mimedefang] Little help with no checks for AUTH users on 587

2013-11-22 Thread David F. Skoll
On Fri, 22 Nov 2013 14:16:16 -0600 Ben Kamen wrote: > > Nov 22 13:43:22 cornelius mimedefang.pl[11099]: rAMJhIGv015058: > > Message contains more than one Subject: header: > subject line which I removed for this post> You should not call read_commands_file from filter_end. It should only be c

[Mimedefang] Parcing Received: headers (was Re: Using ARF)

2013-11-19 Thread David F. Skoll
On Mon, 18 Nov 2013 23:07:59 -0700 Philip Prindeville wrote: > Well, can we cheat? [about parsing Received: headers] You can if you like. Also, I don't think MIME::tools is the right place for that sort of header parsing. I think it belongs in Mail::Header so you might want to get in touch wit

Re: [Mimedefang] Using ARF

2013-11-18 Thread David F. Skoll
On Mon, 18 Nov 2013 15:25:24 -0700 Philip Prindeville wrote: > does. Any chance of fixing new() and build() to allow one to set > views like Content-Disposition, Content-Transfer-Encoding, > MIME-Version, X-Mailer, etc. to undef and have that do the right > thing? Maybe... can you detect the di

Re: [Mimedefang] Using ARF

2013-11-18 Thread David F. Skoll
On Mon, 18 Nov 2013 14:15:03 -0700 Philip Prindeville wrote: > I was looking on CPAN for ARF modules, and just saw the > Email::ARF::Report module by Ricardo Signes. > Unfortunately, it uses Email::MIME which isn’t method-compatible with > MIME::Entity (et al). If you don't mind the bloat, you

Re: [Mimedefang] Bad Extensions in suggested example filter

2013-11-05 Thread David F. Skoll
On Tue, 05 Nov 2013 13:30:17 -0500 "Kevin A. McGrail" wrote: > 3 - Has anyone written description of all the extensions and a short > what/why description? If not, I'll take a pass at it. (example > below). The bad filename extension list in the default MIMEDefang filter is old, crufty, unmai

Re: [Mimedefang] Debugging MIME Parsing Errors

2013-10-15 Thread David F. Skoll
On Mon, 14 Oct 2013 09:46:32 -0500 Richard Laager wrote: > What's the best way to debug this? Try setting $MaxMimeParts to 0 temporarily and seeing what falls out of the logs. I agree that the code is pretty ugly and we should have a proper way to distinguish a parse error from a too-deeply-nes

[Mimedefang] Warning: Malformed MIME virus in the wild

2013-10-10 Thread David F. Skoll
Hi, We've run into a malformed MIME virus that has a structure like this: = To: some...@example.com Subject: Payroll Received by Intuit MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="--boundary" -

[Mimedefang] ClamAV effectiveness

2013-10-10 Thread David F. Skoll
Hi, all, Has anyone noticed that ClamAV does a pretty poor job lately of catching viruses? Here are a few days' worth of statistics from a reasonably-busy mail server cluster: Total messages scanned: 25 814 586 Viruses detected by ClamAV: 32 147 Viruses missed b

Re: [Mimedefang] Connection refused by ... /mimedefang.sock on Debian Squeeze

2013-09-22 Thread David F. Skoll
On Sun, 22 Sep 2013 17:39:19 +0200 jm130794 wrote: > We found this message in Mailing List archive : > http://lists.roaringpenguin.com/pipermail/mimedefang/2012-February/036486.html That could be it. However, newer versions of MIMEDefang (as of version 2.74) do not invoke smfi_setsymlist unless

Re: [Mimedefang] Connection refused by ... /mimedefang.sock on Debian Squeeze

2013-09-22 Thread David F. Skoll
On Sun, 22 Sep 2013 10:13:10 +0200 jm130794 wrote: > All works fine during few hours and suddenly, we get this error in > logs : > Milter (mimedefang): error connecting to filter: Connection refused by > /var/spool/MIMEDefang/mimedefang.sock We run several very busy scanners on Squeeze and are

Re: [Mimedefang] MIMEDefang 2.74 is released

2013-05-27 Thread David F. Skoll
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, all, I guess I should have flagged this release note as a potential incompatibility: > * Do not invokve smfi_setsymlist unless "-y" option to > mimedefang is given. smfi_setsymlist leaks memory in versions > of Sendmail prior t

[Mimedefang] MIMEDefang 2.74 is released

2013-05-27 Thread David F. Skoll
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello, MIMEDefang 2.74 is release and is available at http://www.mimedefang.org/download Changelog since 2.73 follows. Regards, David. 2013-05-27 David F. Skoll * MIMEDefang 2.74 RELEASED 2013-05-25 David F. Skoll * Increase

Re: [Mimedefang] What about DKIM

2013-05-22 Thread David F. Skoll
On Wed, 22 May 2013 15:35:28 +0200 Renaud Pascal wrote: > well, after all wasn't SPF an idea from Microsoft, a gang of squares > thinking they're geeks... SPF was created by Meng Wong of pobox.com, not by Microsoft. Microsoft had it's own invention called "Caller ID for Email" that was later me

Re: [Mimedefang] What about DKIM

2013-05-13 Thread David F. Skoll
On Mon, 13 May 2013 14:01:57 -0600 Philip Prindeville wrote: > Couple of questions: Is the SHA computed over the header or the > entirety of the message? Entire message. > $dkim->PRINT($entity->as_string()); I'm not sure how that would handle SMTP line endings. It's been a while since I wrote

Re: [Mimedefang] What about DKIM

2013-05-10 Thread David F. Skoll
On Thu, 09 May 2013 21:43:43 -0400 "Kevin A. McGrail" wrote: > Thanks for that info. Out of interest, it doesn't look like you use > ADSP. Any reason why or why not? No reason; just never bothered. And I think ADSP has been downgraded to "experimental" because DMARC is taking over. > I'd als

Re: [Mimedefang] What about DKIM

2013-05-09 Thread David F. Skoll
On Thu, 9 May 2013 12:14:40 -0600 Philip Prindeville wrote: > And DKIM support for verification is in SpamAssassin, but I'm not > seeing any support for signing in MimeDefang. It is very easy to add. Use the Mail::DKIM::Signer and Mail::DKIM::TextWrap modules from CPAN. This is in our filter a

Re: [Mimedefang] Constructing MIME::Entity via new

2013-05-03 Thread David F. Skoll
On Thu, 2 May 2013 16:55:38 -0600 Philip Prindeville wrote: > Would it be possible to add a flag that allows the parse_* methods to > succeed in the absence of body text? Nope, no plans to do that. Regards, David. ___ NOTE: If there is a disclaimer o

Re: [Mimedefang] How to change envelope sender?

2013-05-02 Thread David F. Skoll
On Thu, 2 May 2013 11:27:44 +0200 Benoit Panizzon wrote: > Now I miss some kind of command to do that within MIMEDefang. $sender > is read only I assume. If you are running Sendmail 8.14.0 or newer, you can call change_sender(...) from filter_begin or filter_end. It's not supported on Senmdil 8

Re: [Mimedefang] What about DKIM

2013-05-01 Thread David F. Skoll
On Wed, 1 May 2013 12:58:56 -0600 Philip Prindeville wrote: > On Mar 27, 2013, at 11:48 AM, David F. Skoll > wrote: > > DKIM is useful for letting you know that a message has been relayed > > through a responsible organization's server. > Since when did Y

Re: [Mimedefang] Constructing MIME::Entity via new

2013-04-30 Thread David F. Skoll
On Tue, 30 Apr 2013 11:39:57 -0600 Philip Prindeville wrote: > How does one normally construct a MIME::Entity from the stream > off-the-wire? I use MIME::Entity->build(...), but I'll have a look at why new(...) seems to be misbehaving. Regards, David. __

Re: [Mimedefang] rps-mail-eventreporter installation

2013-04-20 Thread David F. Skoll
On Sat, 20 Apr 2013 11:50:21 -0500 tim wrote: > When doing a "perl Makefile.PL" command (as root user) for the > rps-mail-eventreporter I get an error message of: This won't answer the question you asked, but... RPS::Mail::EventReporter is not required for MIMEDefang. Regards, David. _

Re: [Mimedefang] How to count recipients in filter_recipient

2013-04-16 Thread David F. Skoll
On Tue, 16 Apr 2013 11:51:50 +0200 Benoit Panizzon wrote: > Is there a way to define some sort of over-global variable that is > consistent for one SMTP session between all of the mimedefang > processes? No, but you can store persistent state in a file. See the MAINTAINING STATE section of mime

Re: [Mimedefang] md_check_against_smtp_server and md_graphdefang_log

2013-04-03 Thread David F. Skoll
On Wed, 03 Apr 2013 19:26:08 +0200 Tilman Schmidt wrote: > Why four result elements? The manpage says > md_check_against_smtp_server returns only two. Ah... the man page is wrong. I will fix it. Regards, David. ___ NOTE: If there is a disclaimer or

Re: [Mimedefang] What about DKIM

2013-03-27 Thread David F. Skoll
On Wed, 27 Mar 2013 12:22:37 -0500 Ben Kamen wrote: > Now that we've see/talked some stats on SPF... I'd be interested to > know what anyone might have to offer on DKIM usefulness. DKIM is useful for letting you know that a message has been relayed through a responsible organization's server.

Re: [Mimedefang] Spammers - was Re: md_check_against_smtp_server and md_graphdefang_log

2013-03-27 Thread David F. Skoll
On Tue, 26 Mar 2013 23:14:15 -0700 (PDT) kd6...@yahoo.com wrote: > 1) When a spammer uses SPF, recipients KNOW the spammer domains and > servers and automatically block them. Eventually. But when spammers register domains and throw them away after a few hours' use, it can be difficult to keep u

Re: [Mimedefang] md_check_against_smtp_server and md_graphdefang_log

2013-03-26 Thread David F. Skoll
On Tue, 26 Mar 2013 15:42:42 -0700 (PDT) kd6...@yahoo.com wrote: > > SPF is completely useless in the following sense: Rejecting mail > > because of SPF "fail" will absolutely cause valid mail to be > > rejected.  You (and I) may say "Tough luck for domains that publish > > broken SPF records", bu

[Mimedefang] Quote of the Week (was Re: md_check_against_smtp_server and md_graphdefang_log)

2013-03-26 Thread David F. Skoll
On Wed, 27 Mar 2013 00:43:05 +0100 Tilman Schmidt wrote: > I'll try to remember your advice should I ever come across a > properly set up LDAP server. LoL! :) You win the Quote of the Week prize! Regards, David. ___ NOTE: If there is a disclaimer or

Re: [Mimedefang] md_check_against_smtp_server and md_graphdefang_log

2013-03-26 Thread David F. Skoll
On Tue, 26 Mar 2013 15:24:17 -0700 (PDT) kd6...@yahoo.com wrote: > --- On Tue, 3/26/13, t...@phoenixsoftware.de > > - The easiest way for that is SMTP call-ahead aka > > md_check_against_smtp_server. > A much better way is to access the user database directly. Yes, but that may not be possible

Re: [Mimedefang] md_check_against_smtp_server and md_graphdefang_log

2013-03-26 Thread David F. Skoll
On Tue, 26 Mar 2013 13:45:31 -0700 (PDT) kd6...@yahoo.com wrote: > --- On Tue, 3/26/13, David F. Skoll wrote: > > Attempting to deliver to nonexistent recipients is by far the most > > common cause of backscatter, and doing an SMTP call-forward on the > > ultimate destin

Re: [Mimedefang] md_check_against_smtp_server and md_graphdefang_log

2013-03-26 Thread David F. Skoll
On Tue, 26 Mar 2013 11:33:33 -0700 (PDT) kd6...@yahoo.com wrote: > 3) Forwarding services shouldn't be randomly probing the ultimate > destinations. I disagree strongly (assuming we remove the noise word "randomly") Attempting to deliver to nonexistent recipients is by far the most common cause

Re: [Mimedefang] md_check_against_smtp_server and md_graphdefang_log

2013-03-25 Thread David F. Skoll
On Mon, 25 Mar 2013 13:53:34 -0700 (PDT) kd6...@yahoo.com wrote: > Although this will issue a QUIT when an error is returned, it does > NOT do so when the transaction succeeds to the point where 'DATA' is > normally issued.  There are at least two blacklisting DNSBLs that > track systems that trac

Re: [Mimedefang] md_check_against_smtp_server and md_graphdefang_log

2013-03-25 Thread David F. Skoll
On Mon, 25 Mar 2013 13:30:31 -0400 James Curtis wrote: > md_check_against_smtp_server($sender, $recip, "localhost", "192.168.1.10"); You are throwing away the return values from that function. You need to assign them to some local variables like this: my ($retval, $code, $dsn, $text) = md_chec

Re: [Mimedefang] md_check_against_smtp_server and md_graphdefang_log

2013-03-25 Thread David F. Skoll
On Sun, 24 Mar 2013 10:28:16 -0400 James Curtis wrote: > I guess I need a mimedefang-filter and Perl for dummies book. There are plenty of pretty good "Intro to Perl" books; check the O'Reilly site. As for intro to MIMEDefang, you could have a look at slides from a talk I gave (a long time ago)

  1   2   3   4   5   6   7   8   9   10   >