>20-01-2015 13:43:46 [Worker_1] <matchSL - 10.10.10.250 - noScanIP >20-01-2015 13:43:46 [Worker_1] <matchSL - 10.10.10.250 - noScanIP
both calls are wrong - they should call matchIP (<matchIP - 10.10.10.250 - noScanIP) this was a bug in 2.2.2 and was solve in assp 2.2.2 build 12218 and ASSP_AFC version 2.05 2012-08-05 fixed in assp 2.2.2 build 12218: - 'noScanIP' was not working - an new ASSP_AFC version 2.05 is relased to fix the 'noScanIP' problem for the plugin Thomas Von: Doug Lytle <supp...@drdos.info> An: ASSP development mailing list <assp-test@lists.sourceforge.net> Datum: 21.01.2015 00:44 Betreff: Re: [Assp-test] ClamAV - ASSP version 2.4.4(15004) Thomas Eckardt wrote: >> After moving the 2 IP addresses out of the web interface and into a file > configuration - following these steps: > > 1 - look in to the folder: files/optRE and find the file 'noScanIPs.txt' > 2 - make a backup of this file > 3 - now change the config back to plain IP - take care: use the same order > for the IP's like in the file noscanav.txt - and apply - this will update > the file files/optRE/noScanIPs.txt I did the above and ran md5sum on both files. It shows they are both identical. Now, reviewing the logs from this morning shows that I was incorrect. ClamAV is still scanning 10.10.10.250, but didn't hit a SaneSecurity signature. So, what I did was set a debug on the subject "Daily mail report". The debug captured the below. If you'd like the whole .dbg file, I'll zip it up and send it to you off list: >20-01-2015 13:43:46 [Worker_1] <Maillog >20-01-2015 13:43:46 [Worker_1] <SMTPTraffic - read OK >20-01-2015 13:43:46 [Worker_1] <SMTPTraffic - process read >20-01-2015 13:43:46 [Worker_1] <doing line <.[CR][LF] > >20-01-2015 13:43:46 [Worker_1] <Maillog >20-01-2015 13:43:46 [Worker_1] <bodyWrap >20-01-2015 13:43:46 [Worker_1] <bodyWrap >20-01-2015 13:43:46 [Worker_1] <getbody - done:1 maillength:11189 >20-01-2015 13:43:46 [Worker_1] <MsgScoreTooHigh >20-01-2015 13:43:46 [Worker_1] <CheckAttachments >20-01-2015 13:43:46 [Worker_1] <MsgScoreTooHigh >20-01-2015 13:43:46 [Worker_1] <BombOK >20-01-2015 13:43:46 [Worker_1] <matchSL - supp...@drdos.info - noBombScript >20-01-2015 13:43:46 [Worker_1] <MsgScoreTooHigh >20-01-2015 13:43:46 [Worker_1] <MsgScoreTooHigh >20-01-2015 13:43:46 [Worker_1] <BombBlackOK >20-01-2015 13:43:46 [Worker_1] <MsgScoreTooHigh >20-01-2015 13:43:46 [Worker_1] <matchSL - 10.10.10.250 - noScanIP >20-01-2015 13:43:46 [Worker_1] <matchSL - 10.10.10.250 - noScanIP >20-01-2015 13:43:46 [Worker_1] <ClamAV >20-01-2015 13:43:46 [Worker_1] <ClamScanPing - maxwait 10 seconds >20-01-2015 13:43:46 [Worker_1] <ClamScanScan - maxwait 15 seconds >20-01-2015 13:43:46 m1-79426-10118 [Worker_1] [TLS-out] 10.10.10.250 <supp...@drdos.info> to: supp...@drdos.info ClamAV: scanned 11187 bytes in local message - OK 20-01-2015 13:43:46 [Worker_1] <MsgScoreTooHigh >20-01-2015 13:43:46 [Worker_1] <MsgScoreTooHigh >20-01-2015 13:43:46 [Worker_1] <URIBLok >20-01-2015 13:43:46 [Worker_1] <MsgScoreTooHigh >20-01-2015 13:43:46 [Worker_1] <MsgScoreTooHigh Doug -- Ben Franklin quote: "Those who would give up Essential Liberty to purchase a little Temporary Safety, deserve neither Liberty nor Safety." ------------------------------------------------------------------------------ New Year. New Location. New Benefits. New Data Center in Ashburn, VA. GigeNET is offering a free month of service with a new server in Ashburn. Choose from 2 high performing configs, both with 100TB of bandwidth. Higher redundancy.Lower latency.Increased capacity.Completely compliant. http://p.sf.net/sfu/gigenet _______________________________________________ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test DISCLAIMER: ******************************************************* This email and any files transmitted with it may be confidential, legally privileged and protected in law and are intended solely for the use of the individual to whom it is addressed. This email was multiple times scanned for viruses. There should be no known virus in this email! ******************************************************* ------------------------------------------------------------------------------ New Year. New Location. New Benefits. New Data Center in Ashburn, VA. GigeNET is offering a free month of service with a new server in Ashburn. Choose from 2 high performing configs, both with 100TB of bandwidth. Higher redundancy.Lower latency.Increased capacity.Completely compliant. http://p.sf.net/sfu/gigenet _______________________________________________ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
