Anti-Spam SMTP Proxy Server

Hi

Has anyone else seen their loads increase after upgrading to 3.1.10?

Thanks

Dale


----- Original Message ----- 
From: "Thomas Eckardt" <Thomas.Eckardt@...>
To: "ASSP development mailing list" <assp-test@...>
Sent: Tuesday, June 28, 2011 2:43 AM
Subject: [Assp-test] fixes in 2.0.2_3.1.10


> Hi all,
>
> fixed in 2.0.2_3.1.10:
>
> - A code change in 3.1.04 for adding our header lines has caused in some
> cases that the mail header was destroyed. So the MIME content was no
> longer valid.
>
> Thomas
>
>
> DISCLAIMER:
> *******************************************************
> This email and any files transmitted with it may be confidential, legally
> privileged and protected in law and are intended solely for the use of the
>
> individual to whom it is addressed.
> This email was multiple times scanned for viruses. There should be no
> known virus in this email!
> *******************************************************
>
>
>


--------------------------------------------------------------------------------


> ------------------------------------------------------------------------------
> All of the data generated in your IT infrastructure is seriously valuable.
> Why? It contains a definitive record of application performance, security
> threats, fraudulent activity, and more. Splunk takes this data and makes
> sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-d2d-c2


--------------------------------------------------------------------------------


> _______________________________________________
> Assp-test mailing list
> Assp-test@...
> https://lists.sourceforge.net/lists/listinfo/assp-test
>

> Hi
>
> Has anyone else seen their loads increase after upgrading to 3.1.10?
>
> Thanks
>
> Dale

For me on Linux 64-bit, ASSP 2.0.2_3.1.10 is stable at load average: 0.02, 
0.10, 0.12
Though 'top' does show 'perl' is busy with the following resource use:

  PID  USER      PR  NI  VIRT  RES    SHR S  %CPU  %MEM    TIME+  COMMAND
25686 nobody    20   0   1645m 477m  28m S    98.2      6.0          1:42.43 
perl

Peter

Hi Peter

I show very similar "Top" as well and in addition, my ASSP has crashed twice 
since the upgrade with no real spike in traffic

Dale


----- Original Message ----- 
From: "Peter W Bowey" <support@...>
To: "Dale Britt" <dbritt@...>; "ASSP development 
mailing list" <assp-test@...>
Sent: Wednesday, June 29, 2011 7:40 AM
Subject: [POSSIBLE SPAM] Re: [Assp-test] fixes in 2.0.2_3.1.10


>
>
>> Hi
>>
>> Has anyone else seen their loads increase after upgrading to 3.1.10?
>>
>> Thanks
>>
>> Dale
>
> For me on Linux 64-bit, ASSP 2.0.2_3.1.10 is stable at load average: 0.02, 
> 0.10, 0.12
> Though 'top' does show 'perl' is busy with the following resource use:
>
>  PID  USER      PR  NI  VIRT  RES    SHR S  %CPU  %MEM    TIME+  COMMAND
> 25686 nobody    20   0   1645m 477m  28m S    98.2      6.0 
> 1:42.43 perl
>
> Peter

Thank you very much for the update :)

Max


On 06/28/2011 11:43 AM, Thomas Eckardt wrote:
> Hi all,
>
> fixed in 2.0.2_3.1.10:
>
> - A code change in 3.1.04 for adding our header lines has caused in some
> cases that the mail header was destroyed. So the MIME content was no
> longer valid.
>
> Thomas
>
>
> DISCLAIMER:
> *******************************************************
> This email and any files transmitted with it may be confidential, legally
> privileged and protected in law and are intended solely for the use of the
>
> individual to whom it is addressed.
> This email was multiple times scanned for viruses. There should be no
> known virus in this email!
> *******************************************************
>
>
>
>
> ------------------------------------------------------------------------------
> All of the data generated in your IT infrastructure is seriously valuable.
> Why? It contains a definitive record of application performance, security
> threats, fraudulent activity, and more. Splunk takes this data and makes
> sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-d2d-c2
>
>
> _______________________________________________
> Assp-test mailing list
> Assp-test@...
> https://lists.sourceforge.net/lists/listinfo/assp-test

> Hi all,
>
> fixed in 2.0.2_3.1.10:
>
> - A code change in 3.1.04 for adding our header lines has caused in some
> cases that the mail header was destroyed. So the MIME content was no
> longer valid.
>
> Thomas


Hi Thomas,

Since using the latest ASSP 2.0.2_3.1.10, I have noticed a large increase in 
'fake Bank alert' emails!
About 12 in the last 9 hours...
Possibly not related to ASSP, but 'possibly' just a 'seasonal' attack :)

Peter

Using ASSP 2.0.2_3.1.10

The 'fraud bank mailers' are escalating, I see ASSP pass most of these; 
about 10 per day!
Once, it was only 2 per week that slipped through ASSP?

Is anyone  else seeing this fraud bank spam increase?

Peter

> -----Original Message-----
> From: Fritz Borgstedt [mailto:fb@...]
> Sent: Thursday, June 30, 2011 12:05 PM
> To: ASSP development mailing list
> Subject: Re: [Assp-test] ASSP 1.9.1.2(0.0.09) not accepting
connectionson
> listenport
> 
> This drives me crazy. Ok, I will go back to 1.9.1.1(0.1.09) and will
> work forward from there.
> The first of this series is 1.9.1.2 (0.3.01).

Sorry, there may be a later version that works, but I don't have it.  I
stopped upgrading right before you removed the nopbwvalencePB (in case
you were to put it back in, which you did, thanks).

Kind Regards,
Brett

ASSP development mailing list <assp-test@...>
schreibt:
>It appears that the only item that caused this mail to be classified
>as spam is this IPv6 source address.  This is not correct. ASSP
>1.9.1.2

What is not correct?

On Jun 29, 2011, at 9:33 PM, Fritz Borgstedt wrote:

> ASSP development mailing list <assp-test@...>
> schreibt:
>> It appears that the only item that caused this mail to be classified
>> as spam is this IPv6 source address.  This is not correct. ASSP
>> 1.9.1.2
> 
> What is not correct? 
> 
Why should an IPv4 encapsulated address raise the score so high that it values the email to be tagged as spam when there was nothing other that this to add to the spam score? This is specially true when the IPv4 encapsulated address is correct and not spammy

Tom

ASSP development mailing list <assp-test@...>
schreibt:
>Why should an IPv4 encapsulated address raise the score so high that
>it values the email to be tagged as spam when there was nothing other
>that this to add to the spam score? 


Sorry, but I could not see that in your posting.
Is this address not in the PBBlackBox? There is usually the last event
stored which increased the score.

On Jun 30, 2011, at 7:07 AM, Fritz Borgstedt wrote:

> ASSP development mailing list <assp-test@...>
> schreibt:
>> Why should an IPv4 encapsulated address raise the score so high that
>> it values the email to be tagged as spam when there was nothing other
>> that this to add to the spam score? 
> 
> 
> Sorry, but I could not see that in your posting.
> Is this address not in the PBBlackBox? There is usually the last event
> stored which increased the score.
> 
No sure isn't. Here's the entire headers:

X-Assp-Version: 1.9.1.2(0.0.03) on assp.oitc.com
X-Assp-Delay: debra@... was delayed for 1h 30m; 29 Jun 2011
	17:33:01 -0400
X-Assp-Envelope-From: bounce-2314202-921145-debra=captainsball.net@...
X-Assp-Intended-For: debra@...
X-Assp-ID: assp.oitc.com 30938-00304
X-Assp-Spam: YES
X-Assp-Original-Subject: St. John's eNews for July 3, 2011
X-Spam-Status:yes
X-Assp-Spam-Reason: score for ::ffff:69.20.90.33 is 640, surpassing extreme
	level of 500
Received: from mcsv158.net ([::ffff:69.20.90.33] helo=mcsv158.net) by
	assp.oitc.com with ESMTP (ASSP 1.9.1.2); 29 Jun 2011 17:33:01 -0400
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=k1; d=mcsv158.net;
h=Subject:From:Reply-To:To:Date:Message-ID:List-Unsubscribe:Sender:Content-Type:MIME-Version; i=eric=3Dstjohnsmlb.org@...;
bh=T90rUzrOkLYb9dVx0rHi/HVmNFc=;
b=GBuzBqO1KLtsiuqLQJPpqp7vC6VaC26yQ+/andKbHTljeY9tZwdSWaME5j6tIKeFvLCsggp9U7NN
  tTH+QzdbtQk3jNIFKmHhfvDugt6ESM1tFjmOtCSqmXTaug40UqQ2bzx2YItYQaoDHE3U/Kb3sLOl
  6Pf/0edWRZz/zi1gD2E=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=k1; d=mcsv158.net;
b=H6C0uhMdxcxpzap4DPW4xRiFrYoYTEeNjP+n1/U0+BStBwx1QFmDziHDqInGnDt+Enxa2RxjqVDS
  /p3WJxMoDjzw8xEPp04rlp6BJZS0Tq1lIChHTQ+jZFmf2dGWT+QQAb9+BP01N4UtydZ56pFzlSel
  rTDkGTazCv9peq7uzJ0=;
Received: from (127.0.0.1) by mcsv158.net (PowerMTA(TM) v3.5r16) id h1ed0q0lj3gs for <debra@...>; Wed, 29 Jun 2011 16:03:01 -0400 (envelope-from <bounce-2314202-921145-debra=captainsball.net@...>)
Subject: St. John's eNews for July 3, 2011
From: "St. John's Episcopal Church" <eric@...>
Reply-To: "St. John's Episcopal Church" <eric@...>
To: "Debra" <debra@...>
Date: Wed, 29 Jun 2011 16:03:01 -0400
Message-ID: <1fb0d2b722cf48dbc4811b4fca7f9a9d52d.20110629200258@...>
X-Mailer: MailChimp Mailer - **CID48de226aefa7f9a9d52d**
X-Campaign: mailchimp1fb0d2b722cf48dbc4811b4fc.48de226aef
X-campaignid: mailchimp1fb0d2b722cf48dbc4811b4fc.48de226aef
x-im: 38509-48de226aef
X-Report-Abuse: Please report abuse for this campaign here: http://www.mailchimp.com/abuse/abuse.phtml?u=1fb0d2b722cf48dbc4811b4fc&id=48de226aef&e=a7f9a9d52d
x-accounttype: ff
List-Unsubscribe: <mailto:unsubscribe-1fb0d2b722cf48dbc4811b4fc-48de226aef-a7f9a9d52d@...>, <http://stjohnsmlb.us2.list-manage1.com/unsubscribe?u=1fb0d2b722cf48dbc4811b4fc&id=d4a77d96f8&e=a7f9a9d52d&c=48de226aef>
Sender: "St. John's Episcopal Church" <eric=stjohnsmlb.org@...>
x-mcda: FALSE
Content-Type: multipart/alternative; boundary="_----------=_MCPart_2145576541"
MIME-Version: 1.0

Hill, Brett wrote:
> I just upgraded to 1.9.1.2(0.0.09) and noticed that it might let through
> one or two connections, but then does not respond.  Rolling back to
> previous version fixed the problem.

For me this appeared as of some 1.9.x build. No CPU, no extraordinary 
memory, but no response after 3-4 hours during prime-time. Latest 
1.9.1.1 (1.0.00) the same.
1.8.5.9 (2.0.02) is the last stable here.
Win2K3 Perl 5.008008

Katip

> -----Original Message-----
> From: Fritz Borgstedt [mailto:fb@...]
> Sent: Monday, June 27, 2011 3:47 PM
> To: ASSP development mailing list
> Subject: Re: [Assp-test] nopbwValencePB in ASSP 1.x
> 
> ASSP development mailing list <assp-test@...>
> schreibt:
> >Hi Fritz,  Is nopbwValencePB no longer in ASSP 1.x?  I saw it was
> >removed after 1.9.1.1(0.1.09).
> 
> Yes I removed it. The valence is not a good one.
> 

I have found it mostly beneficial in my environment, but if you say
so...

Kind Regards,
Brett

ASSP development mailing list <assp-test@...>
schreibt:
>I have found it mostly beneficial in my environment

If you say so, it will reappear.

> -----Original Message-----
> From: Fritz Borgstedt [mailto:fb@...]
> Sent: Tuesday, June 28, 2011 3:57 PM
> To: ASSP development mailing list
> Subject: Re: [Assp-test] nopbwValencePB in ASSP 1.x
> 
> ASSP development mailing list <assp-test@...>
> schreibt:
> >I have found it mostly beneficial in my environment
> 
> If you say so, it will reappear.

If I'm the only one benefiting from this, then I suppose it's not worth
the maintenance.  But, if there are others who use it also (I don't know
how you would determine that), then please add it.

Thanks!