Anti-Spam SMTP Proxy Server

The magicvillage.de root site is available - but the link I was using 
for Fritz's ASSP development appears no longer valid.  Has something 
changed?

As of last week, I haven't seen any further updates to 1.3.9 (I'm in 
upgrade withdrawal!).  Does this mean nobody's found a bug of note, and 
we might consider 1.3.9 ready for mass distribution, i.e. placed on the 
sourceforge site?
-- 
Daniel

Running 1.3.9(0.3)Latest
I made a change to my config and all of the sudden LDAP stopped working.

Looking in the log, it was changed from my plain text password to an
encrypted one?  

For example:
Before->mypassword
After ->95QRZmwope3vU

The weird thing is that I saved several other things this morning(and
for the past several years) without it changing my password.
But when I changed 'maxSMTPipSessions', my ldap password magically
changed too.
I changed it back and it seems to be working ok after I unlocked the
account.

Kind Regards,
Brett

Jun-27-08 10:53:38 id-85617-00027 [Worker_1] 65.45.251.106
<davew@...> to: dduvall@....
                   org ClamAV: scanned 16104 bytes in whitelisted
message - OK 
Jun-27-08 10:53:38 id-85617-00027 [Worker_1] [Whitelisted] 65.45.251.106
<davew@...> to:
                   dduvall@... whitelisted (no bad
attachments) [Fwd SPAM MessageLimit testmode
                   New Bonus Cash Award] ->
./notspam/_Fwd_SPAM_MessageLimit_testmode_New_Bonus_Cash_Award_-
                   -17.eml
Jun-27-08 10:53:38 [Worker_1] warning: got unexpected signal CHLD in
Worker_1: package - ASSP_OCR, file -
                   Plugins/ASSP_OCR.pm, line - 68!

 

Jun-27-08 10:58:37 id-85916-00294 [Worker_1] 65.45.251.106
<davew@...> to: dduvall@....
                   org ClamAV: scanned 2475 bytes in whitelisted message
- OK 
Jun-27-08 10:58:37 id-85916-00294 [Worker_1] [Whitelisted] 65.45.251.106
<davew@...> to:
                   dduvall@... whitelisted (no bad
attachments) [Fwd Warning virus detected
                   Email Phishing DblDom 30] ->
./notspam/_Fwd_Warning_virus_detected_Email_Phishing_DblDom_30_-
                   -19.eml
Jun-27-08 10:58:37 [Worker_1] warning: got unexpected signal CHLD in
Worker_1: package - ASSP_OCR, file -
                   Plugins/ASSP_OCR.pm, line - 68!

 

Daniel Du Vall

MSGIDCache is part of the penaltybox. MSGID's are stored in RAM like any 
other cache and will be written to pbdb.msgid.db after PB-maintenance or 
if you stop ASSP! There is no chance (and I think no need) to see the 
realtime MSGID's! This belongs to all lists and caches - when ever you 
click on "show file" in GUI, you'll see the file - never the realtime 
cache!

How ever, I recommend setting MSGID tracking at maximum to score (not 
block !!!). ASSP will know all MSGID's of outgiong mails, but if the 
server, who sends the mail back, does not include the whole header with 
the original MSGID, the MSGID check will fail!


Thomas



Katip <katip@...> 
Gesendet von: assp-test-bounces@...
28.06.2008 15:08
Bitte antworten an
ASSP development mailing list <assp-test@...>


An
ASSP development mailing list <assp-test@...>
Kopie

Thema
Re: [Assp-test] Antwort:  [Fwd:  MSGID Cache 2.18]






On 26.06.2008 09:17, Thomas Eckardt/eck wrote:
> 
> 
> Set MSGIDCacheInterval to a low value to check if the Message-ID's will 
> be kicked out from Cache. I just saw, that I've forgot to save the 
> MSGIDCache in PB-maintenance, this will be fixed!

after PB-maintenance (or rebuildspamdb?), yes there are some msg-id's 
saved in pbdb.msgid.db
but a real time saving as seen on verbose log is not done.

as a result, a number of

"[MSGID-tracking] 2xx.1xx.2xx.1xx to: user@... [monitoring] 
MSGID tracking failed for bounce sender"

appear, which are legit bounces indeed due to some failure on receiving 
end.

where are msg-id's saved in real time of sending? in pbdb.msgid.db 
(obviously not) or in RAM or somewhere else on disk?

Katip


-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
_______________________________________________
Assp-test mailing list
Assp-test@...
https://lists.sourceforge.net/lists/listinfo/assp-test


DISCLAIMER:
*******************************************************
This email and any files transmitted with it may be confidential, legally 
privileged and protected in law and are intended solely for the use of the 

individual to whom it is addressed.
This email was multiple times scanned for viruses. There should be no 
known virus in this email!

Validate DomainKeys Identified Mail (DoDKIM) = monitor
Non Spam (NonSpamLog) = no collection


Jun-27-08 14:16:52 id-65411-03935 [Worker_2] 206.190.38.167 
<xyz@...> to: abc@... DKIM-signature found
Jun-27-08 14:16:53 id-65411-03935 [Worker_2] [Whitelisted] 
206.190.38.167 <xyz@...> to: abc@... whitelisted (no bad 
attachments) [Re blah...]
Jun-27-08 14:16:53 id-65411-03935 [Worker_2] 206.190.38.167 
<xyz@...> to: abc@...  -> c:\assp/notspam/3935.txt


I disabled DoDKIM and collecting now works as expected (i.e. above 
message is NOT collected). FYI.

Katip

On 26.06.2008 09:17, Thomas Eckardt/eck wrote:
> 
> 
> Set MSGIDCacheInterval to a low value to check if the Message-ID's will 
> be kicked out from Cache. I just saw, that I've forgot to save the 
> MSGIDCache in PB-maintenance, this will be fixed!

after PB-maintenance (or rebuildspamdb?), yes there are some msg-id's 
saved in pbdb.msgid.db
but a real time saving as seen on verbose log is not done.

as a result, a number of

"[MSGID-tracking] 2xx.1xx.2xx.1xx to: user@... [monitoring] 
MSGID tracking failed for bounce sender"

appear, which are legit bounces indeed due to some failure on receiving end.

where are msg-id's saved in real time of sending? in pbdb.msgid.db 
(obviously not) or in RAM or somewhere else on disk?

Katip

That is correct.  This isn't consistent behavior.  The email originally
attached is one that it happened with.

Is no one else seeing some emails submitted to the whitelist not getting
whitelisted??

Paul K. Dickson
Systems Administrator
Frederick County Government, IIT
301-600-2399/x12399


-----Original Message-----
From: assp-test-bounces@...
[mailto:assp-test-bounces@...] On Behalf Of Paul
Houlbrooke
Sent: Thursday, June 19, 2008 12:55 PM
To: ASSP development mailing list
Subject: Re: [Assp-test] FW: Thank you for adding to the WHITELIST!

To be clear; are you saying that when you forward as an attachment the 
email gets whitelisted, but when you forward inline it does not?

Dickson, Paul wrote:
> 1.3.9
>
> Paul K. Dickson
> Systems Administrator
> Frederick County Government, IIT
> 301-600-2399/x12399
>
> -----Original Message-----
> From: assp-test-bounces@...
> [mailto:assp-test-bounces@...] On Behalf Of Paul
> Houlbrooke
> Sent: Thursday, June 19, 2008 12:20 PM
> To: ASSP development mailing list
> Subject: Re: [Assp-test] FW: Thank you for adding to the WHITELIST!
>
> Is this 2.00 or 1.3.9?
>
> Dickson, Paul wrote:
>> What am I missing here?  Am I the only one concerned that items
>> submitted to the whitelist aren't getting whitelisted??????
>>
>> Paul K. Dickson
>> Systems Administrator
>> Frederick County Government, IIT
>> 301-600-2399/x12399
>>
>>
>> -----Original Message-----
>> From: Dickson, Paul
>> Sent: Monday, June 16, 2008 1:26 PM
>> To: ASSP development mailing list
>> Subject: RE: [Assp-test] FW: Thank you for adding to the WHITELIST!
>>
>> What option?
>>
>> Paul K. Dickson
>>
>>
>> -----Original Message-----
>> From: assp-test-bounces@...
>> [mailto:assp-test-bounces@...] On Behalf Of Fritz
>> Borgstedt
>> Sent: Tuesday, June 10, 2008 12:03 PM
>> To: ASSP development mailing list
>> Subject: Re: [Assp-test] FW: Thank you for adding to the WHITELIST!
>>
>> ASSP development mailing list<assp-test@...>
>> schreibt:
>>> Fritz, any idea why ASSP wouldn't see it?  The address isn't getting
>>> whitelisted when this happens.
>> You did not set the option?
>>
>>
>>
>
------------------------------------------------------------------------
>> -
>> Check out the new SourceForge.net Marketplace.
>> It's the best place to buy or sell services for
>> just about anything Open Source.
>> http://sourceforge.net/services/buy/index.php
>> _______________________________________________
>> Assp-test mailing list
>> Assp-test@...
>> https://lists.sourceforge.net/lists/listinfo/assp-test
>>
>>
>
------------------------------------------------------------------------
> -
>> Check out the new SourceForge.net Marketplace.
>> It's the best place to buy or sell services for
>> just about anything Open Source.
>> http://sourceforge.net/services/buy/index.php
>> _______________________________________________
>> Assp-test mailing list
>> Assp-test@...
>> https://lists.sourceforge.net/lists/listinfo/assp-test
>
>
>
------------------------------------------------------------------------
> -
> Check out the new SourceForge.net Marketplace.
> It's the best place to buy or sell services for
> just about anything Open Source.
> http://sourceforge.net/services/buy/index.php
> _______________________________________________
> Assp-test mailing list
> Assp-test@...
> https://lists.sourceforge.net/lists/listinfo/assp-test
>
>
------------------------------------------------------------------------
-
> Check out the new SourceForge.net Marketplace.
> It's the best place to buy or sell services for
> just about anything Open Source.
> http://sourceforge.net/services/buy/index.php
> _______________________________________________
> Assp-test mailing list
> Assp-test@...
> https://lists.sourceforge.net/lists/listinfo/assp-test


------------------------------------------------------------------------
-
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
_______________________________________________
Assp-test mailing list
Assp-test@...
https://lists.sourceforge.net/lists/listinfo/assp-test

Jun-26-08 19:24:50 [Worker_1] info: Message-ID was stored for tracking

yes, verbose logging tells this but still nothing saved in 
pbdb.msgid.db, file remains empty.

DoMSGIDtracking is on "monitor"

MSGIDCacheInterval I have reduced to 6, but this is another thing I think..

Katip

On 26.06.2008 09:17, Thomas Eckardt/eck wrote:
> 
> It's running well on win32. Please set MSGIDtrLog to verbose and tell 
> me, if you can see the following message in Log when a mail is relayed:
> 
> ..........  info: Message-ID was stored for tracking
> 
> Set MSGIDCacheInterval to a low value to check if the Message-ID's will 
> be kicked out from Cache. I just saw, that I've forgot to save the 
> MSGIDCache in PB-maintenance, this will be fixed!
> 
> Thomas
> 
> 
> 
> *Katip <katip@...>*
> Gesendet von: assp-test-bounces@...
> 
> 25.06.2008 19:12
> Bitte antworten an
> ASSP development mailing list <assp-test@...>
> 
> 
> 	
> An
> 	ASSP development mailing list <assp-test@...>
> Kopie
> 	
> Thema
> 	[Assp-test] [Fwd:  MSGID Cache 2.18]
> 
> 
> 	
> 
> 
> 
> 
> 
> Is there someone who has been able to write to pbdb.msgid.db on a win32
> system? here no avail. also on 2.20.
> 
> Katip
> 
> -------- Original Message --------
> Subject: [Assp-test] MSGID Cache 2.18
> Date: Mon, 23 Jun 2008 19:59:30 +0300
> From: Katip <katip@...>
> Reply-To: ASSP development mailing list <assp-test@...>
> To: ASSP development mailing list <assp-test@...>
> 
> Do Message-ID Tracking is set to monitor.
> File c:\assp/pb/pbdb.msgid.db exists.
> However there is nothing in the file after more than 2 days running. Is
> there something else to switch on? TIA
> Katip
> 
> 
> -------------------------------------------------------------------------
> Check out the new SourceForge.net Marketplace.
> It's the best place to buy or sell services for
> just about anything Open Source.
> http://sourceforge.net/services/buy/index.php
> _______________________________________________
> Assp-test mailing list
> Assp-test@...
> https://lists.sourceforge.net/lists/listinfo/assp-test
> 
> 
> 
> -------------------------------------------------------------------------
> Check out the new SourceForge.net Marketplace.
> It's the best place to buy or sell services for
> just about anything Open Source.
> http://sourceforge.net/services/buy/index.php
> _______________________________________________
> Assp-test mailing list
> Assp-test@...
> https://lists.sourceforge.net/lists/listinfo/assp-test
> 
> 
> DISCLAIMER:
> *******************************************************
> This email and any files transmitted with it may be confidential, 
> legally privileged and protected in law and are intended solely for the 
> use of the
> individual to whom it is addressed.
> This email was multiple times scanned for viruses. There should be no 
> known virus in this email!
> 
> 
> ------------------------------------------------------------------------
> 
> -------------------------------------------------------------------------
> Check out the new SourceForge.net Marketplace.
> It's the best place to buy or sell services for
> just about anything Open Source.
> http://sourceforge.net/services/buy/index.php
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Assp-test mailing list
> Assp-test@...
> https://lists.sourceforge.net/lists/listinfo/assp-test

It's running well on win32. Please set MSGIDtrLog to verbose and tell me, 
if you can see the following message in Log when a mail is relayed:

..........  info: Message-ID was stored for tracking

Set MSGIDCacheInterval to a low value to check if the Message-ID's will be 
kicked out from Cache. I just saw, that I've forgot to save the MSGIDCache 
in PB-maintenance, this will be fixed!

Thomas




Katip <katip@...> 
Gesendet von: assp-test-bounces@...
25.06.2008 19:12
Bitte antworten an
ASSP development mailing list <assp-test@...>


An
ASSP development mailing list <assp-test@...>
Kopie

Thema
[Assp-test] [Fwd:  MSGID Cache 2.18]






Is there someone who has been able to write to pbdb.msgid.db on a win32 
system? here no avail. also on 2.20.

Katip

-------- Original Message --------
Subject: [Assp-test] MSGID Cache 2.18
Date: Mon, 23 Jun 2008 19:59:30 +0300
From: Katip <katip@...>
Reply-To: ASSP development mailing list <assp-test@...>
To: ASSP development mailing list <assp-test@...>

Do Message-ID Tracking is set to monitor.
File c:\assp/pb/pbdb.msgid.db exists.
However there is nothing in the file after more than 2 days running. Is
there something else to switch on? TIA
Katip


-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
_______________________________________________
Assp-test mailing list
Assp-test@...
https://lists.sourceforge.net/lists/listinfo/assp-test



-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
_______________________________________________
Assp-test mailing list
Assp-test@...
https://lists.sourceforge.net/lists/listinfo/assp-test


DISCLAIMER:
*******************************************************
This email and any files transmitted with it may be confidential, legally 
privileged and protected in law and are intended solely for the use of the 

individual to whom it is addressed.
This email was multiple times scanned for viruses. There should be no 
known virus in this email!

Is there someone who has been able to write to pbdb.msgid.db on a win32 
system? here no avail. also on 2.20.

Katip

-------- Original Message --------
Subject: [Assp-test] MSGID Cache 2.18
Date: Mon, 23 Jun 2008 19:59:30 +0300
From: Katip <katip@...>
Reply-To: ASSP development mailing list <assp-test@...>
To: ASSP development mailing list <assp-test@...>

Do Message-ID Tracking is set to monitor.
File c:\assp/pb/pbdb.msgid.db exists.
However there is nothing in the file after more than 2 days running. Is
there something else to switch on? TIA
Katip


-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
_______________________________________________
Assp-test mailing list
Assp-test@...
https://lists.sourceforge.net/lists/listinfo/assp-test

My proposal is to automatically disable Bayesian analysis if the corpus 
is not mature (doesn't have enough files).  I believe this will:

1.  Aid new users that do not understand the concept and try to enable 
Bayesian too soon.
2.  Correct for conditions caused by users that manually perform 
"cleanup" of their corpus (see 1.)
3.  Correct for any conditions where the corpus becomes effected by 
improper anti-virus configurations (such as not excluding the corpus 
directories, etc).

Perhaps an indicator of the disabled status at the Bayesian Check menu 
option.  Maybe some red text that states "Bayesian disabled because of 
immature corpus", etc.

ASSP is terminating the only thing I can find in the system logs is
this:

Jun 24 12:00:27 SWENG01 perl: *** glibc detected *** perl: double free
or corruption (fasttop): 0x00002aaac47b5120 *** 

And from ASSP logs:
Jun-24-08 12:00:18 [Worker_5] sending DNS-query to 192.168.0.2 on
list.dsbl.org for RBL checks on 63.150.74.74
Jun-24-08 12:00:18 [Worker_5] sending DNS-query to 192.168.0.2 on
safe.dnsbl.sorbs.net for RBL checks on 63.150.74.74
Jun-24-08 12:00:18 [Worker_5] sending DNS-query to 192.168.0.2 on
blackholes.five-ten-sg.com for RBL checks on 63.150.74.74
Jun-24-08 12:00:18 [Worker_5] Commencing RBL checks on 63.150.74.74
Jun-24-08 12:00:19 [Worker_1] got 30 answers, 0 replies and 0 hits after
15 seconds for RBL checks on 85.255.19.53
Jun-24-08 12:00:19 [Worker_1] Completed RBL checks on 85.255.19.53
Jun-24-08 12:00:19 34002-12562 [Worker_1] [DNSBL] 85.255.19.53
<bounce-mail-146947580-ad065f7821ecdb91@...> to:
davew@... [scoring] (DNSBL: pass)
Jun-24-08 12:00:20 34002-12562 [Worker_1] [SPF] 85.255.19.53
<bounce-mail-146947580-ad065f7821ecdb91@...> to:
davew@... [scoring] SPF: pass ip=85.255.19.53
mailfrom=bounce-mail-146947580-ad065f7821ecdb91@...
helo=dc5mail02.element5.com
Jun-24-08 12:00:20 34002-12562 [Worker_1] [preDKIM] 85.255.19.53
<bounce-mail-146947580-ad065f7821ecdb91@...> to:
davew@... [scoring] DKIM domain-check skipped -
bounces.element5.com does not support DKIM
Jun-24-08 12:00:20 34002-12562 [Worker_1] 85.255.19.53
<bounce-mail-146947580-ad065f7821ecdb91@...> to:
davew@... ClamAV: scanned 2591 bytes in  message - OK
Jun-24-08 12:00:20 [Worker_1] sending DNS-query to 192.168.0.2 on
multi.surbl.org for URIBL checks on element5.com
Jun-24-08 12:00:20 [Worker_1] sending DNS-query to 192.168.0.2 on
multi.uribl.com for URIBL checks on element5.com
Jun-24-08 12:00:20 [Worker_1] sending DNS-query to 192.168.0.2 on
sc.surbl.org for URIBL checks on element5.com
Jun-24-08 12:00:20 [Worker_1] sending DNS-query to 192.168.0.2 on
ws.surbl.org for URIBL checks on element5.com
Jun-24-08 12:00:20 [Worker_1] sending DNS-query to 192.168.0.2 on
ob.surbl.org for URIBL checks on element5.com
Jun-24-08 12:00:20 [Worker_1] sending DNS-query to 192.168.0.2 on
ab.surbl.org for URIBL checks on element5.com
Jun-24-08 12:00:20 [Worker_1] Commencing URIBL checks on element5.com
Jun-24-08 12:00:25 [Worker_2] got 30 answers, 0 replies and 0 hits after
15 seconds for RBL checks on 217.65.132.254
Jun-24-08 12:00:25 [Worker_2] Completed RBL checks on 217.65.132.254
Jun-24-08 12:00:25 34009-13779 [Worker_2] [DNSBL] 217.65.132.254
<bounce-mail-146947599-a59fd3c1ed57c013@...> to:
davew@... [scoring] (DNSBL: pass)
Jun-24-08 12:00:25 34009-13779 [Worker_2] [SPF] 217.65.132.254
<bounce-mail-146947599-a59fd3c1ed57c013@...> to:
davew@... [scoring] SPF: pass ip=217.65.132.254
mailfrom=bounce-mail-146947599-a59fd3c1ed57c013@...
helo=dc6snat01.element5.com
Jun-24-08 12:00:25 34009-13779 [Worker_2] [preDKIM] 217.65.132.254
<bounce-mail-146947599-a59fd3c1ed57c013@...> to:
davew@... [scoring] DKIM domain-check skipped -
bounces.element5.com does not support DKIM
Jun-24-08 12:00:26 34009-13779 [Worker_2] 217.65.132.254
<bounce-mail-146947599-a59fd3c1ed57c013@...> to:
davew@... ClamAV: scanned 11945 bytes in  message - OK
Jun-24-08 12:00:26 [Worker_2] sending DNS-query to 192.168.0.2 on
multi.surbl.org for URIBL checks on element5.com
Jun-24-08 12:00:26 [Worker_2] sending DNS-query to 192.168.0.2 on
multi.uribl.com for URIBL checks on element5.com
Jun-24-08 12:00:26 [Worker_2] sending DNS-query to 192.168.0.2 on
sc.surbl.org for URIBL checks on element5.com
Jun-24-08 12:00:26 [Worker_2] sending DNS-query to 192.168.0.2 on
ws.surbl.org for URIBL checks on element5.com
Jun-24-08 12:00:26 [Worker_2] sending DNS-query to 192.168.0.2 on
ob.surbl.org for URIBL checks on element5.com
Jun-24-08 12:00:26 [Worker_2] sending DNS-query to 192.168.0.2 on
ab.surbl.org for URIBL checks on element5.com
Jun-24-08 12:00:26 [Worker_2] Commencing URIBL checks on element5.com
Jun-24-08 12:14:09 [startup] ASSP version 2.0.0(2.20) (Perl 5.008008)
(on linux) initializing

What should I expect if a message gets this ?

X-Assp-Message-Totalscore:      -10

 

Also I may have missed the setting but or is there a place to set the
total score at which a message is finally determined as SPAM in the GUI?

 

Daniel Du Vall

Do Message-ID Tracking is set to monitor.
File c:\assp/pb/pbdb.msgid.db exists.
However there is nothing in the file after more than 2 days running. Is 
there something else to switch on? TIA
Katip