RE: [Qmail-scanner-general]Kav 5.5.2 e qmailscanner 1.24st-qms

2005-07-18 Thread Dallas L. Engelken
> my qmail-smtpd/run > exec /usr/local/bin/softlimit -m 12000 \ /usr/local/bin/tcpserver -v -R -l "$LOCAL" -x > /etc/qmail/tcp.smtp.cdb -c "$MAXSM TPD" \ -u "$QMAILDUID" -g > "$NOFILESGID" 0 smtp \ /var/qmail/bin/qmail-smtpd "$LOCAL" \ /home/vpopmail/bin/vchkpw /usr/bin/true 2>&1 > > Nicol

RE: [Qmail-scanner-general]qmail-scanner + domainkeys

2005-06-27 Thread Dallas L. Engelken
> > > IMO, Your best best is a patch to qmail-remote.c that 'signs' the > > domain key at that point as its leaving your system. > > > Maybe but I want to integrate it in qmail-scanner so I cannot > patch qmail-remote, since qmail-local handles incoming and > outgoing mails > Oh no.. Qmail

RE: [Qmail-scanner-general]qmail-scanner + domainkeys

2005-06-27 Thread Dallas L. Engelken
> >The only problem that I can think of now, is how to > determine if mail is delivered local, or it is delivered > remote (to sign it or to check it), since --local-domains > isn't good enough. I was thinking of some way to read the > domains from rcpthosts and know which domains are loca

RE: [Qmail-scanner-general]contrib/sub-avpdaemon.pl

2005-06-06 Thread Dallas L. Engelken
> > >Hey guys.. > > > >I was looking at this sub, and noticed it calls avpdaemon like > > > >`$avpdaemon_binary $ENV{'TMPDIR'} 2>&1`; > > > >However, if you've messed with aveclient/aveserver, you'll see that > >this does not work. > > > ># /usr/local/kav/bin/aveclient -p /var/run/aveserver -s

[Qmail-scanner-general]contrib/sub-avpdaemon.pl

2005-06-03 Thread Dallas L. Engelken
Hey guys.. I was looking at this sub, and noticed it calls avpdaemon like `$avpdaemon_binary $ENV{'TMPDIR'} 2>&1`; However, if you've messed with aveclient/aveserver, you'll see that this does not work. # /usr/local/kav/bin/aveclient -p /var/run/aveserver -s /tmp /tmp ERROR not a regular file

[Qmail-scanner-general]FW: [Ripmime-general] another ole unpack issue

2004-07-28 Thread Dallas L. Engelken
Just FYI... > -Original Message- > From: [EMAIL PROTECTED] [mailto:ripmime-general- > [EMAIL PROTECTED] On Behalf Of Dallas L. Engelken > Sent: Wednesday, July 28, 2004 12:57 PM > To: [EMAIL PROTECTED] > Subject: [Ripmime-general] another ole unpack issue > >

[Qmail-scanner-general]FW: [Ripmime-general] ripMIME 1.3.2.0

2004-06-28 Thread Dallas L. Engelken
FYI again. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of > Paul L Daniels > Sent: Monday, June 28, 2004 5:08 AM > To: [EMAIL PROTECTED] > Subject: [Ripmime-general] ripMIME 1.3.2.0 > > > 1.3.2.0 has been released publically; > > http://w

[Qmail-scanner-general]FW: [Ripmime-general] RE: Yet another ripmime 1.3.1.2 error

2004-06-28 Thread Dallas L. Engelken
FYI > -Original Message- > From: Paul L Daniels [mailto:[EMAIL PROTECTED] > Sent: Saturday, June 26, 2004 9:28 PM > To: Dallas L. Engelken > Cc: [EMAIL PROTECTED] > Subject: Re: [Ripmime-general] RE: Yet another ripmime 1.3.1.2 error > > > Dallas (and everyon

[Qmail-scanner-general]RE: Yet another ripmime 1.3.1.2 error

2004-06-23 Thread Dallas L. Engelken
> > > > > Argh... > > > > d_m: output spotted from /usr/local/bin/ripmime > > --disable-qmail-bounce --no-ole --recursion-max 30 > > --unique_names -i - -d > > /var/qmail/qmailscan/tmp/localhost108800011278119877/ > > (mime.c:1032:MIME_is_file_mime:ERROR: cannot open file > > '/var/qmail/qma

[Qmail-scanner-general]RE: Yet another ripmime 1.3.1.2 error

2004-06-23 Thread Dallas L. Engelken
> > Argh... > > d_m: output spotted from /usr/local/bin/ripmime > --disable-qmail-bounce --no-ole --recursion-max 30 > --unique_names -i - -d > /var/qmail/qmailscan/tmp/localhost108800011278119877/ > (mime.c:1032:MIME_is_file_mime:ERROR: cannot open file > '/var/qmail/qmailscan/tmp/localho

[Qmail-scanner-general]Yet another ripmime 1.3.1.2 error

2004-06-23 Thread Dallas L. Engelken
Argh... d_m: output spotted from /usr/local/bin/ripmime --disable-qmail-bounce --no-ole --recursion-max 30 --unique_names -i - -d /var/qmail/qmailscan/tmp/localhost108800011278119877/ (mime.c:1032:MIME_is_file_mime:ERROR: cannot open file '/var/qmail/qmailscan/tmp/localhost108800011278119877/tmp

[Qmail-scanner-general]RE: Ripmime v1.3.1.2

2004-06-22 Thread Dallas L. Engelken
> > Anyone else seeing ripmime doing crazy things like this?? > > [snip] > > PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME COMMAND > 8415 qmailq20 0 192 28 8 R26.3 0.0 223:21 ripmime > 14350 qmailq17 0 196 24 8 R24.5 0.0 159:48 ripmime > 18

[Qmail-scanner-general]ripmime --recursion-max setting?

2004-06-08 Thread Dallas L. Engelken
Is anyone seeing messages in qmail-scanner that cause ripmime to exceed 20 parts and cause tempfail ? output spotted from /usr/local/bin/ripmime --unique_names -i - -d /var/qmail/qmailscan/tmp/mailgw.nmgi.com108670228878018143/ (mime.c:2666:MIME_unpack_stage2:WARNING: Current recursion level of 2

RE: [Qmail-scanner-general]RE: SMTP error code

2004-05-14 Thread Dallas L. Engelken
> > > > Just curious which smtp clients re-attach the original message and > > send it back to the return-path?? Whoever does this should > be shot! > > I don't > > Err - Qmail for starters? Sendmail? Postfix? Exchange? All > mail servers default to bouncing the ENTIRE message back to > se

RE: [Qmail-scanner-general]RE: SMTP error code

2004-05-13 Thread Dallas L. Engelken
> > Seriously, my current take on this is that the currrent > system never sends viruses, and this "fix" will [effectively] > cause Q-S to generate viruses > > Why does that scare me? > Just curious which smtp clients re-attach the original message and send it back to the return-path?? Whoev

RE: [Qmail-scanner-general]RE: Re: RE: SMTP error code

2004-05-13 Thread Dallas L. Engelken
> > I gather that you would like to completely replace the > psender functionality (or create another option that is > mutually exclusive to psender) with the ability to return a > 550 and a customer error message. > Well, not completely replace it, but there is literally no difference between

RE: [Qmail-scanner-general]Re: RE: SMTP error code

2004-05-13 Thread Dallas L. Engelken
> > > > If this was a real user, sending a virus-infected file, then both > > methods would cause the user to be notified. > > Not if you're using psender functionality. That is the whole > basis for this discussion. The addition of psender > functionality, IMO, makes in necessary to return a

RE: [Qmail-scanner-general]Re: RE: SMTP error code

2004-05-12 Thread Dallas L. Engelken
> > What we *should* do is include a qmail patch to allow q-s to > return "550 message rejected because it contains a virus" > when it detects a virus. > Then if the virus is using its own SMTP engine (most do) it > will be unable to send mails to our servers. No bounces are > generated; vir

RE: [Qmail-scanner-general]RE: SMTP error code

2004-05-12 Thread Dallas L. Engelken
> > On Wed, May 12, 2004 at 08:08:04AM -0500, Dallas L. Engelken wrote: > > Nobody will bitch at you for handing a 550 to a virus infected > > email... I guarantee it! > > But no-one has explained why it is better than the current system! > First of all, this is

RE: [Qmail-scanner-general]Re: SMTP error code

2004-05-12 Thread Dallas L. Engelken
> > > > Sending a 5xx error only makes sense if a message is > quarantined due to policy reasons (by perl_scanner) since > that is usually where you have false positives. Otherwise > 99.9% of messages that have detectable viruses have fake > senders and therefore it would be meaningless to s

RE: [Qmail-scanner-general]RE: SMTP error code

2004-05-12 Thread Dallas L. Engelken
> > 1. I am an infected Windows PC. I use SMTP to send the virus to my > default SMTP gateway, it rejects the message (due to virus) > at the SMTP > layer. The virus doesn't report that SMTP error to the end user - so > they are unaware they are infected. > How many viruses send mail via the

RE: [Qmail-scanner-general]RE: SMTP error code

2004-05-11 Thread Dallas L. Engelken
> > > > if ($REJECT_VIRUS && $quarantine_event && $destring =~ > m/^virus/) { > >&error_condition("Virus detected, send SMTP error > code...",33); > > } > > > > if ($REJECT_SPAM && $spam_event) { > >&error_condition("Spam detected, send SMTP error > code...",32);

RE: [Qmail-scanner-general]SMTP error code

2004-05-11 Thread Dallas L. Engelken
> > As you surely know, a 5xx is sent back to the return-path, and it is > almost always faked... > True, but you are issuing a 550 to the sending server, which in turn is responsible for delivery of the MAILER-DAEMON to the return-path. Your server is not sending the non-deliverable, therefor

RE: [Qmail-scanner-general]SMTP error code

2004-05-11 Thread Dallas L. Engelken
> > In order to get error codes that mean something, instead of > '451 qq temp > fail', you'll need to recompile qmail/netqmail. > And since we are talking about permanent failures, that should have said "551 mail server permanently rejected message" where exit code is 31. -

[Qmail-scanner-general]ANNOUNCE: Optional policy scan on Zip Contents

2004-05-11 Thread Dallas L. Engelken
Patch: - http://www.engelken.net/download/policyonzip.patch Description: - This patch allows you to configure whether or not perlscan_scanner has access to filenames that are inside of zip files. Currently, with $force_unzip=1, files are unzipped and the

RE: [Qmail-scanner-general]SMTP error code

2004-05-11 Thread Dallas L. Engelken
> > So why don't we change qmail-scanner to return > a 5xx SMTP error code and a short message when a > virus email is quarantined? > > That way, a legitimate sender will instantly > know that there is a problem with his email, > instead of believing that the email was delivered > successfully. I

RE: [Qmail-scanner-general]QS Vulnerability - Exploiting "No virus scan on plain text messages"

2004-04-15 Thread Dallas L. Engelken
> > Dallas L. Engelken wrote: > > > As you can see, reformime is the problem. I may be switching to > > ripmime > > :) > > I already have switched, and I think that scanning of all messages, > including text, should be on by default. > If you read

RE: [Qmail-scanner-general]scanloop in log file

2004-04-11 Thread Dallas L. Engelken
> > scanloop: scanner=spamassassin,plain_text_msg=0 > > Any one could explain what that means ? > It means 'sub scanloop' its calling the 'sub spamassassin' and $plain_text_msg is set to 0, either because you have the default set to off, or because the particular message it is scanning had MIM

[Qmail-scanner-general]X-Envelope-From and To added before init_scanners

2004-04-10 Thread Dallas L. Engelken
Is there any way &grab_envelope_hdrs; can be called before &working_copy so one could add X-Envelope-From:/To: headers to the tmp/TMPFILE before moving to new/ This would allow spamassassin whitelists and blacklists actually work against the envelope as well as the normal email headers since SA c

[Qmail-scanner-general]RE: QS Vulnerability - Exploiting "No virus scan on plain text messages"

2004-04-08 Thread Dallas L. Engelken
> > Here is the proof that QS bypasses Virus Scans on it > > Thu, 08 Apr 2004 10:14:43 -0500:17737: from=Kathy Scott > <[EMAIL PROTECTED]>,subj=FW: Mom & Russell, > x-qmail-scanner-message-id=<[EMAIL PROTECTED] > nmgi.com> via local process 17737 Thu, 08 Apr 2004 10:14:43 > -0500:17737: Th

RE: [Qmail-scanner-general]QS Vulnerability - Exploiting "No virus scan on plain text messages"

2004-04-08 Thread Dallas L. Engelken
> > Just tested ripmime and it sees it.. > > [EMAIL PROTECTED] tmp]# ripmime -v -imsg1 > Decoding filename=textfile0_1 > Decoding filename=Dad, Lavena, Alta.jpg > Decoding filename=textfile1_1 > Decoding filename=Dad, Lavena, Alta.jpg > > reformime does not. > > [EMAIL PROTECTED] tmp]# reform

RE: [Qmail-scanner-general]QS Vulnerability - Exploiting "No virus scan on plain text messages"

2004-04-08 Thread Dallas L. Engelken
> > > No I don't call it a vulnerability. The skip_text_msgs > feature, intended to skip messages that just seem to be plain > text, improves performance by not scanning messages that > don't appear to have binary content. Admittedly, yes, its > not perfect. Not being a user of QSQ 1.2x, I

RE: [Qmail-scanner-general]QS Vulnerability - Exploiting "No virus scan on plain text messages"

2004-04-08 Thread Dallas L. Engelken
> > It doesnt need to be addressed at all. It isnt a bug or a > problem with QS. If you are so worried about it, set > $skip_text_msgs = 0 and call it a day. This isnt anything > new. The only argument i see here is that MAYBE this should > be 0 by default. > Call it what you will... I jus

RE: [Qmail-scanner-general]g_e_h: no sender and no recips

2004-04-08 Thread Dallas L. Engelken
> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of [EMAIL PROTECTED] > Sent: Saturday, April 03, 2004 2:37 AM > To: [EMAIL PROTECTED] > Subject: [Qmail-scanner-general]g_e_h: no sender and no recips > > > Hello friends, > > I am using RH8.0 Linux,

RE: [Qmail-scanner-general]QS Vulnerability - Exploiting "No virus scan on plain text messages"

2004-04-08 Thread Dallas L. Engelken
> > I wouldn't necessarily call this a vulnerability. I ran into > this when writting the Regex Scanner for QSQ. Find > $skip_text_msgs and set it to 0 so that all e-mails, > including plain text, are scanned. > > This only applies to the 1.2x versions, 1.1x don't have this feature. > You d

RE: [Qmail-scanner-general]Spamd using too much cpu power and memory

2004-04-08 Thread Dallas L. Engelken
> PID USERNAME PRI NICE SIZERES STATETIME WCPUCPU COMMAND > 3706 spamd1290 420M 300M RUN 12:01 85.21% 85.21% perl Softlimit your call to spamd... That way it cant use 420M of physical mem. However, it should never use that much.. Are your bayes databases large, o

[Qmail-scanner-general]QS Vulnerability - Exploiting "No virus scan on plain text messages"

2004-04-08 Thread Dallas L. Engelken
I was looking through the code on 1.21 and saw that virus scans are disabled on plain text messages... This can be a problem when a plain text message with an old style Uuencoded attachment is in-lined into a message using begin and end statements... Take the following email for example... (note

RE: [Qmail-scanner-general]hostname call

2004-02-03 Thread Dallas L. Engelken
> -Original Message- > From: Doug Monroe [mailto:[EMAIL PROTECTED] > Sent: Tuesday, February 03, 2004 5:13 PM > To: [EMAIL PROTECTED] > Subject: Re: [Qmail-scanner-general]hostname call > > > Dallas L. Engelken wrote: > > > > you call open(

RE: [Qmail-scanner-general]hostname call

2004-02-03 Thread Dallas L. Engelken
> > Jason Haar wrote: > > > On Tue, Feb 03, 2004 at 08:44:08AM -0600, Dallas L. Engelken wrote: > > > >># HOSTNAME GRABBED DYNAMICALLY open(ME,"/var/qmail/control/me"); > >>flock(ME,2); > >>my $temphost=; > >>close(ME); >

RE: [Qmail-scanner-general]hostname call

2004-02-03 Thread Dallas L. Engelken
> -Original Message- > From: Jason Haar [mailto:[EMAIL PROTECTED] > Sent: Tuesday, February 03, 2004 2:53 PM > To: [EMAIL PROTECTED] > Subject: Re: [Qmail-scanner-general]hostname call > > > On Tue, Feb 03, 2004 at 08:44:08AM -0600, Dallas L. Engelken wrote

RE: [Qmail-scanner-general]hostname call

2004-02-03 Thread Dallas L. Engelken
> -Original Message- > From: Jason Haar [mailto:[EMAIL PROTECTED] > Sent: Monday, February 02, 2004 5:36 PM > To: [EMAIL PROTECTED] > Subject: Re: [Qmail-scanner-general]hostname call > > > On Tue, Jan 27, 2004 at 10:49:49AM +, Mark Powell wrote: > > Hi, > > Is there any reason tha

RE: [Qmail-scanner-general]:/var/spool/qmailscan/quarantine

2004-01-28 Thread Dallas L. Engelken
> Hi :) > > Anyone knows how I can easly view the msgs inside this folder > after QS scans them? > > Shai > Symlink it to your maildir and view it via IMAP Something like... ln -s /var/qmail/qmailscan/quarantine /var/vpopmail/domains/mydomain.com/myuser/Maildir/.Quarantine And then subsc

RE: [Qmail-scanner-general]deleting high SA scoring spam

2003-10-25 Thread Dallas L. Engelken
> > if ($sa_status == 0) { > if ($sa_max == 0) { > $tag_score .= "SA:?($sa_score/$sa_max):"; > } else { > $tag_score .= "SA:0($sa_score/$sa_max):"; > $sa_comment = "No, hits=$sa_score required=$sa_max" if > ($spamc_options =~ /\-c/); > } > } else { > $tag_sco

RE: [Qmail-scanner-general]incoming concurrency

2003-10-22 Thread Dallas L. Engelken
> -Original Message- > From: Jeff Koch [mailto:[EMAIL PROTECTED] > Sent: Tuesday, October 21, 2003 7:23 PM > To: [EMAIL PROTECTED] > Subject: [Qmail-scanner-general]incoming concurrency > > > > Hi: > > We have our incomingconcurrency set to 30. We have 1GB of > ram. Does anyone > kno

RE: [Qmail-scanner-general]Clamscan -- any thoughts?

2003-10-15 Thread Dallas L. Engelken
> -Original Message- > From: Matt [mailto:[EMAIL PROTECTED] > Sent: Wednesday, October 15, 2003 9:19 AM > To: [EMAIL PROTECTED] > Subject: [Qmail-scanner-general]Clamscan -- any thoughts? > > > I'm using clam-av with qmail-scanner. Is anyone else STILL > haven't problems blocking the "

RE: [Qmail-scanner-general]redundant scanning and unzip

2003-10-08 Thread Dallas L. Engelken
> -Original Message- > From: Adam Denenberg [mailto:[EMAIL PROTECTED] > Sent: Tuesday, October 07, 2003 6:11 PM > To: Dallas L. Engelken > Cc: [EMAIL PROTECTED] > Subject: Re: [Qmail-scanner-general]redundant scanning and unzip > > > i thought --secure calle

RE: [Qmail-scanner-general]redundant scanning and unzip

2003-10-07 Thread Dallas L. Engelken
> > so i should probably turn off --unzip then in uvscan since i > have to leave it on in Q-S to get perlscanner to read inside > and outside the zip and then turn redundant_scanning on. > That seems most optimal CPU wise for needing to catch > attachments and viruses both inside and outside

RE: [Qmail-scanner-general]redundant scanning and unzip

2003-10-07 Thread Dallas L. Engelken
> > I have redundant scanning off in my 1.16 qmail-scanner and > uvscan setup b/c i use --unzip with uvscan. I would like to > turn off force_unzip, but i need perlscanner to block > attachments outside and inside the zip. > is it possible for perlscanner to block outside and inside > the z

RE: [Qmail-scanner-general]No quarantine

2003-10-03 Thread Dallas L. Engelken
> -Original Message- > From: Marcio R A Garcia [mailto:[EMAIL PROTECTED] > Sent: Friday, October 03, 2003 2:31 PM > To: [EMAIL PROTECTED] > Subject: Re: [Qmail-scanner-general]No quarantine > > > > > Anything like this: > > cd /var/spool/qmailscan/quarantine > rm -rf new > ln -s /dev/

RE: [Qmail-scanner-general]Q-S + SA performance survey.

2003-09-18 Thread Dallas L. Engelken
> so i have 150 incoming concurrency, and 60 spamd children... > grepping my > maillog, i see 20 of 20 children reached on each server only a couple > times a day. > correction, 150 incoming, 40 spamd children as i have 3 mta's 50x3 and 2 spamd boxes 20x2. dallas --

RE: [Qmail-scanner-general]Q-S + SA performance survey.

2003-09-18 Thread Dallas L. Engelken
> -Original Message- > From: Steve Fulton [mailto:[EMAIL PROTECTED] > Sent: Thursday, September 18, 2003 2:35 PM > To: [EMAIL PROTECTED] > Subject: [Qmail-scanner-general]Q-S + SA performance survey. > > > Hi all, > > I'd like to know what kind of performance (particularly in concurrent

RE: [Qmail-scanner-general]Fwd: Uvscan on 1.20rc3 using --redundant

2003-09-09 Thread Dallas L. Engelken
> -Original Message- > From: Chris Eagles [mailto:[EMAIL PROTECTED] > Sent: Tuesday, September 09, 2003 10:22 AM > To: Dallas L. Engelken > Subject: RE: [Qmail-scanner-general]Fwd: Uvscan on 1.20rc3 > using --redundant > > > Do you know why they aren'

RE: [Qmail-scanner-general]Fwd: Uvscan on 1.20rc3 using --redundant

2003-09-09 Thread Dallas L. Engelken
> -Original Message- > From: Chris Eagles [mailto:[EMAIL PROTECTED] > Sent: Tuesday, September 09, 2003 9:08 AM > To: [EMAIL PROTECTED] > Subject: [Qmail-scanner-general]Fwd: Uvscan on 1.20rc3 using > --redundant > > > When using qmail-scanner-1.20rc3 if the --redundant switch is > set

RE: [Qmail-scanner-general]RE: SoBig.F silent

2003-09-03 Thread Dallas L. Engelken
> How does qmail-scanner actually send the notification though? > Does it just use the sendmail command? > my $qmailinject = '/var/qmail/bin/qmail-inject'; open(SM,"|$qmailinject -h -f ''")||&tempfail("cannot open $qmailinject for sending quarantine report - $!"); > If that's the case, the

RE: [Qmail-scanner-general]SoBig.F silent

2003-09-03 Thread Dallas L. Engelken
> -Original Message- > From: Jesse Guardiani [mailto:[EMAIL PROTECTED] > Sent: Wednesday, September 03, 2003 10:04 AM > To: [EMAIL PROTECTED] > Subject: [Qmail-scanner-general]SoBig.F silent > > > Howdy list, > > I have "sobig" in my list of --silent-viruses. > And I am (appropriately)

RE: [Qmail-scanner-general]Using Bayes/Spamassassin with Qmailscanner

2003-09-02 Thread Dallas L. Engelken
> -Original Message- > From: Jennifer Fountain [mailto:[EMAIL PROTECTED] > Sent: Saturday, August 30, 2003 8:02 AM > To: Dallas L. Engelken; [EMAIL PROTECTED] > Subject: RE: [Qmail-scanner-general]Using Bayes/Spamassassin > with Qmailscanner > > > > edit

RE: [Qmail-scanner-general]Using Bayes/Spamassassin with Qmailscanner

2003-08-29 Thread Dallas L. Engelken
-Original Message- > From: Jennifer Fountain [mailto:[EMAIL PROTECTED] > Sent: Friday, August 29, 2003 5:56 PM > To: [EMAIL PROTECTED] > Subject: [Qmail-scanner-general]Using Bayes/Spamassassin with > Qmailscanner > > > I am trying to implement bayes filtering with > qmailscanner/spam

RE: [Qmail-scanner-general]version string of F-Prot Antivirus

2003-08-29 Thread Dallas L. Engelken
> -Original Message- > From: Kazuhiko [mailto:[EMAIL PROTECTED] > Sent: Friday, August 29, 2003 8:16 AM > To: [EMAIL PROTECTED] > Subject: [Qmail-scanner-general]version string of F-Prot Antivirus > > > Hello. > > I recently downloaded 'F-Prot Antivirus for Linux > Workstations - for h

RE: [Qmail-scanner-general]F-prot daemon scanner

2003-08-29 Thread Dallas L. Engelken
> -Original Message- > From: Arno Slatius [mailto:[EMAIL PROTECTED] > Sent: Friday, August 29, 2003 3:21 AM > To: [EMAIL PROTECTED] > Subject: [Qmail-scanner-general]F-prot daemon scanner > > > Hi, > > I'm using the qmail scanner with f-prot. The full version of > f-prot comes with a d

RE: [Qmail-scanner-general]question about mysql sa with qs

2003-08-28 Thread Dallas L. Engelken
> -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > Sent: Thursday, August 28, 2003 2:03 PM > To: [EMAIL PROTECTED] > Cc: Dallas L. Engelken > Subject: RE: [Qmail-scanner-general]question about mysql sa with qs > > Aug 28 14:59:02 fbsd sp

RE: [Qmail-scanner-general]question about mysql sa with qs

2003-08-28 Thread Dallas L. Engelken
> -Original Message- > From: Richard Lyszczek [mailto:[EMAIL PROTECTED] > Sent: Thursday, August 28, 2003 12:51 PM > To: [EMAIL PROTECTED] > Cc: [EMAIL PROTECTED] > Subject: Re: [Qmail-scanner-general]question about mysql sa with qs > > > > my $spamc_options=' -u [EMAIL PROTECTED] -f'; >

RE: [Qmail-scanner-general]Cleaning quarantine?

2003-08-28 Thread Dallas L. Engelken
> -Original Message- > From: Marc Nicholas [mailto:[EMAIL PROTECTED] > Sent: Thursday, August 28, 2003 11:09 AM > To: Qmail-scanner > Subject: [Qmail-scanner-general]Cleaning quarantine? > > > So can I just delete messages in quarantine? Are these > messages also still somewhere in the

RE: [Qmail-scanner-general]McAfee problem

2003-08-28 Thread Dallas L. Engelken
> I had a bit of a problem with McAfee. It does not run on RH9 > unless you do a trick: LD_PRELOAD=/lib/libc.so.6 uvscan This > preloads the correct library. I set up an alias (in > /etc/profile.d/color*) which created and alias for uvscan > (uvscan='LD_PRELOAD=/lib/libc.so.6 uvscan') > insta

RE: [Qmail-scanner-general]problems with SA

2003-08-27 Thread Dallas L. Engelken
> -Original Message- > From: Jennifer Fountain [mailto:[EMAIL PROTECTED] > Sent: Wednesday, August 27, 2003 4:15 PM > To: Dallas L. Engelken; [EMAIL PROTECTED] > Subject: RE: [Qmail-scanner-general]problems with SA > > > I just confirmed. Although, I did

RE: [Qmail-scanner-general]performance issue

2003-08-27 Thread Dallas L. Engelken
> -Original Message- > From: Nick Lomonte [mailto:[EMAIL PROTECTED] > Sent: Wednesday, August 27, 2003 3:14 PM > To: [EMAIL PROTECTED] > Subject: [Qmail-scanner-general]performance issue > > > Like so many others, with the recent flood of SoBig spam > coming through our server, I decide

RE: [Qmail-scanner-general]problems with SA

2003-08-27 Thread Dallas L. Engelken
> -Original Message- > From: Jennifer Fountain [mailto:[EMAIL PROTECTED] > Sent: Wednesday, August 27, 2003 1:41 PM > To: Dallas L. Engelken > Subject: RE: [Qmail-scanner-general]problems with SA > > > this is the only thing in my scanner_array: > > my @sc

RE: [Qmail-scanner-general]problems with SA

2003-08-27 Thread Dallas L. Engelken
> -Original Message- > From: Jennifer Fountain [mailto:[EMAIL PROTECTED] > Sent: Wednesday, August 27, 2003 12:32 PM > To: [EMAIL PROTECTED] > Subject: [Qmail-scanner-general]problems with SA > > --scanners "clamscan,verbose_spamassassin" > > see what @scanners has in it... jsut becau

RE: [Qmail-scanner-general]Spam Assassin Scripts

2003-08-27 Thread Dallas L. Engelken
> -Original Message- > From: Tyler [mailto:[EMAIL PROTECTED] > Sent: Wednesday, August 27, 2003 12:08 PM > To: [EMAIL PROTECTED] > Subject: Re: [Qmail-scanner-general]Spam Assassin Scripts > > > > Here are the scripts I am using. Right now, the QMAILQUEUE > env variable is set to q

RE: [Qmail-scanner-general]Qmail-scanner + SpamAssassin / domain-specific filters/databases

2003-08-27 Thread Dallas L. Engelken
> > Anyway, I wonder whether a "sort-of" domain setup is possible > with qmail-scanner and SpamAssassin ? What I want to achieve, > is that all mail for a specific domain uses its own bayesian > database - and maybe own customized filters. The problem is, > that the domain is not hosted locall

RE: [Qmail-scanner-general]Spam Assassin Scripts

2003-08-27 Thread Dallas L. Engelken
> -Original Message- > From: Tyler [mailto:[EMAIL PROTECTED] > Sent: Wednesday, August 27, 2003 10:19 AM > To: [EMAIL PROTECTED] > Subject: Re: [Qmail-scanner-general]Spam Assassin Scripts > > > Just wondering if anyone had any ideas as to how to add my > own spamassassin scripts to qma

RE: [Qmail-scanner-general]Suggestion: Option to archive all messages tagged by SpamAssassin

2003-08-26 Thread Dallas L. Engelken
> -Original Message- > From: Brian Ipsen [mailto:[EMAIL PROTECTED] > Sent: Sunday, August 24, 2003 10:29 AM > To: [EMAIL PROTECTED] > Subject: [Qmail-scanner-general]Suggestion: Option to archive > all messages tagged by SpamAssassin > > > Hi! > > I miss an option, where it is possib

RE: [Qmail-scanner-general]Worm.Sobig.F

2003-08-26 Thread Dallas L. Engelken
> -Original Message- > From: CertaintyTech [mailto:[EMAIL PROTECTED] > Sent: Monday, August 25, 2003 11:25 AM > To: Dallas L. Engelken; 'ML qmail-scanner' > Subject: RE: [Qmail-scanner-general]Worm.Sobig.F > > > Shouldn't the last entry in the acce

RE: [Qmail-scanner-general]Worm.Sobig.F

2003-08-22 Thread Dallas L. Engelken
> -Original Message- > From: CertaintyTech [mailto:[EMAIL PROTECTED] > Sent: Friday, August 22, 2003 12:04 PM > To: 'ML qmail-scanner' > Subject: RE: [Qmail-scanner-general]Worm.Sobig.F > > > > option 1) restrict all outbound destination port 25 traffic > from your > > internal lan, ex

RE: [Qmail-scanner-general]Worm.Sobig.F

2003-08-22 Thread Dallas L. Engelken
> -Original Message- > From: Bill Moran [mailto:[EMAIL PROTECTED] > Sent: Friday, August 22, 2003 7:34 AM > To: Matt > Cc: ML qmail-scanner > Subject: Re: [Qmail-scanner-general]Worm.Sobig.F > > > Matt wrote: > > How can I prevent the sobig worm from going out to people? > > Get it off

RE: [Qmail-scanner-general]Sobig.F and attachment type

2003-08-20 Thread Dallas L. Engelken
> So far today we have trapped over 400 infected emails with > the Sobig.F attachment. > check out the attached image 18% of the mail today is sobig.f. <>

[Qmail-scanner-general]sub-spamassassin.pl patch for QS 1.16

2003-08-14 Thread Dallas L. Engelken
this patch will prevent multiple X-Spam-Status: occurencys from overriding your $sa_score and $sa_max values. for some people who use the sql logging additions, this is important, otherwise it records incorrect values. for everyone else, it's not overly important, because the only place you will

RE: [Qmail-scanner-general]uvscan confusion with --unzip and --mime

2003-07-16 Thread Dallas L. Engelken
> -Original Message- > From: Adam Denenberg [mailto:[EMAIL PROTECTED] > Sent: Wednesday, July 16, 2003 11:09 AM > To: [EMAIL PROTECTED] > Subject: RE: [Qmail-scanner-general]uvscan confusion with > --unzip and --mime > > > so am i gaining anything by turning on either force_unzip or

RE: [Qmail-scanner-general]uvscan confusion with --unzip and --mime

2003-07-16 Thread Dallas L. Engelken
> -Original Message- > From: Adam Denenberg [mailto:[EMAIL PROTECTED] > Sent: Wednesday, July 16, 2003 8:28 AM > To: [EMAIL PROTECTED] > Subject: [Qmail-scanner-general]uvscan confusion with --unzip > and --mime > > > Also i understand that since Q-S calls uvscan with --secure > that t

RE: [Qmail-scanner-general]Environment variables

2003-06-30 Thread Dallas L. Engelken
> -Original Message- > From: J. Kendzorra [mailto:[EMAIL PROTECTED] > Sent: Monday, June 30, 2003 10:13 AM > To: [EMAIL PROTECTED] > Subject: Re: [Qmail-scanner-general]Environment variables > > > > > $spamc_options="-f -u" and later > > > &debug("SA: run $spamc_binary $spamc_options $re

RE: [Qmail-scanner-general]Environment variables

2003-06-30 Thread Dallas L. Engelken
> -Original Message- > From: J. Kendzorra [mailto:[EMAIL PROTECTED] > Sent: Sunday, June 29, 2003 4:03 AM > To: [EMAIL PROTECTED] > Subject: Re: [Qmail-scanner-general]Environment variables > > > Hi Dallas, > i tried your solution, but for me it didn't work because the > .qmail-file >

RE: [Qmail-scanner-general]Environment variables

2003-06-27 Thread Dallas L. Engelken
> -Original Message- > From: J. Kendzorra [mailto:[EMAIL PROTECTED] > Sent: Friday, June 27, 2003 3:43 PM > To: [EMAIL PROTECTED] > Subject: [Qmail-scanner-general]Environment variables > > > Hello list, > I searched the archive for that, but didn't find anything: > I'd like to use SpamA

RE: [Qmail-scanner-general]test

2003-06-27 Thread Dallas L. Engelken
> -Original Message- > From: John Johnson [mailto:[EMAIL PROTECTED] > Sent: Friday, June 27, 2003 9:00 AM > To: [EMAIL PROTECTED] > Subject: Re: [Qmail-scanner-general]test > > > It works So do you know how SF managed this trick with > there mail servers? > > -John > when i send

RE: [Qmail-scanner-general]silent_viruses: v scan before suffix check desired

2003-06-27 Thread Dallas L. Engelken
> I'm afraid the perlscanner file checks happen first for a > reason - they're cheap :-) Any virus/whatever you can block > earlier means less work for your system. > is it possible to change the calls to perlscan_scanner() and scanloop() around in the init_scanners() function? or will take br

[Qmail-scanner-general]test

2003-06-27 Thread Dallas L. Engelken
testing.. looks like sourceforge implemented rfc822 checks at the smtp level to verify the remote party accepts mail for [EMAIL PROTECTED] just want to see if this goes through.. d --- This SF.Net email is sponsored by: INetU Attention Web Dev

RE: [Qmail-scanner-general]magic-smtpd?

2003-06-06 Thread Dallas L. Engelken
> -Original Message- > From: D.Monroe [mailto:[EMAIL PROTECTED] > Sent: Thursday, June 05, 2003 8:31 AM > To: [EMAIL PROTECTED] > Subject: [Qmail-scanner-general]magic-smtpd? > > > I'm curious to know if anyone on this list has made use of > magic-smtpd: >http://www.linuxmagic.com/o

RE: [Qmail-scanner-general]Trying to daemonize uvscan through spamd

2003-05-31 Thread Dallas L. Engelken
> -Original Message- > From: Jeremy Kusnetz [mailto:[EMAIL PROTECTED] > Sent: Thursday, May 29, 2003 5:01 PM > > Actually I'm now looking at the uvscan docs, it seems by > adding --mime and --mailbox to uvscan it should handle the > unpacked email by itself. Maybe these should be added

RE: [Qmail-scanner-general]Trying to daemonize uvscan through spamd

2003-05-30 Thread Dallas L. Engelken
> Actually I'm now looking at the uvscan docs, it seems by > adding --mime and --mailbox to uvscan it should handle the > unpacked email by itself. Maybe these should be added to > qmail-scanner itself? Also qmail-scanner sets the --secure > option, which activates --unzip, so should --unzip

RE: [Qmail-scanner-general]Trying to daemonize uvscan through spamd

2003-05-30 Thread Dallas L. Engelken
> -Original Message- > From: Jeremy Kusnetz [mailto:[EMAIL PROTECTED] > Sent: Thursday, May 29, 2003 5:01 PM > To: Dallas L. Engelken; [EMAIL PROTECTED] > Subject: RE: [Qmail-scanner-general]Trying to daemonize > uvscan through spamd > > Actually I'm now l

RE: [Qmail-scanner-general]Trying to daemonize uvscan through spamd

2003-05-30 Thread Dallas L. Engelken
> -Original Message- > From: Jeremy Kusnetz [mailto:[EMAIL PROTECTED] > Sent: Thursday, May 29, 2003 3:29 PM > > I've been running with virus scanning through uvscan and spam > scanning with spamassassin with no problems. > > I would now like to move to where both virus and spam > scann