I was looking at the SA logs and noticed how a spammer would open up multiple sessions
all to one target address. He opened 15 sessions in 10 seconds and proceded to hold
them for 5 minutes until I timed out on the connections. So for 5 minutes my filter
was essentially rendered useless since I limit it to 15 simultaneous connections due
to hardware limitations.
Has anyone else seen this? What would be the best solution to combat this?
-----Original Message-----
From: Tony W. Bunce [mailto:[EMAIL PROTECTED]
Sent: Thu 12/18/2003 3:36 PM
To: Larry Gilson
Cc: Spamassassin-List
Subject: RE: [SAtalk] importing spam from exchange users for sa-learn?
We only have one exchange server. Its 2003 upgraded from 2000
I don't know a lot about CDO but thus far I have only been able to find
methods that can retrieve specific parts of a message but nothing that
can retrieve the raw message as a whole. I'll keep looking though.
Thanks,
Tony B, CCNA, Network+
Systems Administration
GO Concepts, Inc. / www.go-concepts.com
Are you on the GO yet?
What about those you know, are they on the GO?
513.934.2800
1.888.ON.GO.YET
-----Original Message-----
From: Larry Gilson [mailto:[EMAIL PROTECTED]
Sent: Thursday, December 18, 2003 3:49 PM
To: Tony W. Bunce
Cc: 'Spamassassin-List'
Subject: RE: [SAtalk] importing spam from exchange users for sa-learn?
Interesting - so it does sound like Public Folder issue and not just the
mechanism for accessing the store. Are all your Exchange servers the
same
version or does the message traverse different versions of Exchange.
--Larry
> -----Original Message-----
> From: Tony W. Bunce [mailto:[EMAIL PROTECTED]
> Sent: Thursday, December 18, 2003 2:08 PM
> To: Spamassassin-List
> Subject: RE: [SAtalk] importing spam from exchange users for
> sa-learn?
>
>
> I tried option 1 and it also modifies the headers the say way
> as if you access the public folder with a IMAP client. Maybe
> the mail client (outlook 2003 for me) is modifying the
> message when it moves the message?
>
> When I get some time I'll try option #2
>
> Thanks,
> Tony B, CCNA, Network+
> Systems Administration
> GO Concepts, Inc. / www.go-concepts.com
> Are you on the GO yet?
> What about those you know, are they on the GO?
> 513.934.2800
> 1.888.ON.GO.YET
>
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
> Behalf Of Larry Gilson
> Sent: Thursday, December 18, 2003 12:58 PM
> To: 'Spamassassin-List'
> Subject: RE: [SAtalk] importing spam from exchange users for
> sa-learn?
>
> I was thinking of tackling this problem from the other end.
> Below are some options from the Exchange list I subscribe to.
> I asked the question as to how to extract the message to a
> text file. Presumably, the message would be raw. The
> thought is that the extraction method would be a solution
> more native and local for and to Exchange.
>
> OPTION 1 (Ravi Agarwal)
> ========
> Exchange 2000:
> 1. Simply browse the virtual M drive and you can copy the
> message files out to another directory. These are simply text
> files with the full message headers intact.
>
> Exchange 2003: (If you don't have the M drive)
> 1. Put the messages into a public folder
> 2. Mount the Public Folders as a Virtual Folder. See
> instructions on our website:
> http://www.123together.com/Support/Accessing_Mail_Items_Throug
> h_Web_Folders.htm
> 3. Browse the Virtual Folder and you can simply copy the
> messages out as text files, with all headers intact.
>
>
> OPTION 2 (Kevin Derby)
> ========
> 1) Use a CDO script to extract the messages from the public folder.
>
>
> After extracting the message, I would have a number of text
> files in a compressed directory on the Exchange server. I
> would schedule a job to create an SFTP session with the relay
> server and push the files rather than pull.
>
> Thoughts?
>
>
> --Larry
>
-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
Free Linux Tutorials. Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id78&alloc_id371&op=ick
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
†+wzf¢–+,¦‰ìo"0¸§»îâj[yÊ&y©ÞÆ«¶)Ë Õ¢¸î²Û!jº^Ÿ*.®É"–[Š î¥ú+
,·ž.)îÅ;¢¸š–ÂÞj¹Þêò¶§úèšØ^m«!²¥–Ú,ÊÆš)Â'$žŒ!¶Úý§l¢Çgr‰¿iØ×nüjYhr'wßh¥ÉbrD©jf¬±«,Š{Z–IšŠX§‚X¬µ*Z™«,jË"žÖ’X¬¶Ë(º· ~Šàzw†Ûi³ÿåŠËl²‹«qç讧zßåŠËlþX¬¶)ßû)jf¬±«,Š{Z–
