Anti-Spam SMTP Proxy Server

To block offending HELOs i use myServerRe as file:files/badhelo.txt  where I
list spammer helos. Of course Block Forged Helos (DoFakedLocalHelo) is on
That worked for many years, but suddenly stopped a few months ago. Can't
tell when, because I only update assp a few times a year. That test blocked
really tons of spam, now it's not working anymore, on a few different setup
(win32, debian..) where I just upgraded the assp files without changing the
config. Now in Infostas HELO Forged: is always zero for me.

Hints?

Re: [Assp-test] Prohibit a user from reporting spam From: Fritz Borgstedt <fb@iw...> - 2010-11-05 16:18 ASSP development mailing list <assp-test@...> schreibt: >put assp* into noProcessing >enable LocalAddressesNP May be Thomas will change V2 to accept that addresses from emailSenderNotOK are put into Nulladdresses.

Re: [Assp-test] [Assp-user] What is the difference From: Dale <dbritt@co...> - 2010-12-07 21:26 Hi Mike, So if I want to create a regex for an email address in the body of an email, would this work? Assuming the email address is oluthomas@... ([\\w-+]+(?:\\.[\\w-+]+)*@(?:[\\w-]+\\.)+[a-zA-Z]{2,7}) Would it matter if the email address is just plain text and not with mailto: Dale ----- Original Message ----- From: "Michael Thomas" <mike@...> To: <dbritt@...>; "'ASSP development mailing list'" <assp-test@...> Sent: Tuesday, December 07, 2010 12:13 PM Subject: RE: [Assp-user] What is the difference > > Dale, > > That wasn't quite clear. Email addresses never start with http, but they > might start with mailto if in a link. Also, your http regex does not > support > mailto, but if you needed mailto, it should probably be a separate regex. > > Mike > >> -----Original Message----- >> From: Michael Thomas [mailto:mike@...] >> Sent: Tuesday, December 07, 2010 3:08 PM >> To: 'Dale'; 'For Users of ASSP' >> Subject: RE: [Assp-user] What is the difference >> >> Dale, >> >> The second instance must start with http, but email addresses >> do not unless it is a mailto link. >> >> Michael Thomas >> Mathbox >> 978-687-3300 >> Toll Free: 1-877-MATHBOX (1-877-628-4269) >> >> > -----Original Message----- >> > From: Dale [mailto:dbritt@...] >> > Sent: Tuesday, December 07, 2010 3:01 PM >> > To: For Users of ASSP >> > Subject: [Assp-user] What is the difference >> > >> > >> > Hi >> > >> > I'm curious to know what the difference is between these two >> > examples when >> > put in bombdatare >> > >> > oluthomas@... >> > >> > >> > (?:ht|f)tps?\:\/\/(?:\w[\w\.\-]*\.)?oluthomas\@att\.net >> > >> > >> > Thanks >> > >> > Dale >> > >> > >> > >> > -------------------------------------------------------------- >> > ---------------- >> > What happens now with your Lotus Notes apps - do you make >> > another costly >> > upgrade, or settle for being marooned without product >> > support? Time to move >> > off Lotus Notes and onto the cloud with Force.com, apps are >> > easier to build, >> > use, and manage than apps on traditional platforms. Sign up >> > for the Lotus >> > Notes Migration Kit to learn more. >> http://p.sf.net/sfu/salesforce-d2d >> > _______________________________________________ >> > Assp-user mailing list >> > Assp-user@... >> > https://lists.sourceforge.net/lists/listinfo/assp-user >> > >> >

Re: [Assp-test] [Assp-user] What is the difference From: Fritz Borgstedt <fb@iw...> - 2010-12-07 21:38 Dale <dbritt@...> schreibt: >So if I want to create a regex for an email address in the body of an >email, >would this work? > >Assuming the email address is oluthomas@... > >([\\w-+]+(?:\\.[\\w-+]+)*@(?:[\\w-]+\\.)+[a-zA-Z]{2,7}) > > >Would it matter if the email address is just plain text and not with >mailto: There are regex testers on the web like http://www.internetofficer.com/seo-tool/regex-tester/. If I would try to catch "oluthomas@..." i would use: oluthomas\@att.net

[Assp-test] Block email address From: Gary Sunderland <garyS@Ca...> - 2011-01-03 23:42 Is there a new feature that blocks email addresses from being sent to from local? Have a client that is getting a new error, server blocked recipent address. 1.8.5.0(0.0.02) previous 1.8.1.8(0.0.03)

Re: [Assp-test] ASSP 2.0.2 (2.0.15) - unknown local sender From: GrayHat <grayhat@gm...> - 2011-01-10 09:00 > Got reports from some users about emails being refused by ASSP > with an "unknown local sender" message, decided to have a look > at the issue and found that a bunch of *foreign* domains had been > added (dunno how) to the ldaplist file; upgraded to (2.0.16) and > deleted the ldaplisr file, will now keep an eye on it, but I thought I > had to report about the issue since it may really cause a lot of > trouble :( Update; looked at some backups of the ldaplistdb files and found that in some cases it contained entries like @domain that is, only the @ and the FQDN domain name but without the "address" part and such entries were referring to internal AND *external* domains; the latter caused the issue; as an example, one of the entries was "@microsoft.com" and this caused ASSP to reject ALL emails coming from MS with the "unknown local sender" message The problem now is to understand HOW those entries got into the ldaplistdb file; as a note I use BerkeleyDB for this file, in case this makes any difference After deleting the ldaplist*.* and updating ASSP (now running the .17) the problem went away, at least till now but I'm still monitoring the box to see if the issue resurfaces and I think that having a look at the ldap code to check if and how such entries got stored there may be due

Re: [Assp-test] ASSP 2.0.2 (2.0.15) - unknown local sender From: Fritz Borgstedt <fb@iw...> - 2011-01-10 10:48 Since several versions ASSP is storing domains of validated addresses (ldap,vrfy,flat) into ldaplist.

Re: [Assp-test] fixes in 2.0.2_3.0.10 From: Fritz Borgstedt <fb@iw...> - 2011-04-17 16:23 ASSP development mailing list <assp-test@...> schreibt: >put this into bombSubjectRe >[a-z][A-Z].*[a-z][A-Z].*[a-z][A-Z] Sorry I meant (?-i)([a-z][A-Z].*[a-z][A-Z].*[a-z][A-Z])?

Re: [Assp-test] fixes in 2.0.2_3.0.10 From: Steve Moffat <Steve@op...> - 2011-04-17 16:33 Getting this when I put the above in the file... Quantifier follows nothing in regex; marked by <-- HERE in m/(?is:(?:? <-- HERE -----Original Message----- From: Fritz Borgstedt [mailto:fb@...] Sent: Sunday, April 17, 2011 1:21 PM To: ASSP development mailing list Subject: Re: [Assp-test] fixes in 2.0.2_3.0.10 ASSP development mailing list <assp-test@...> schreibt: >put this into bombSubjectRe >[a-z][A-Z].*[a-z][A-Z].*[a-z][A-Z] Sorry I meant (?-i)([a-z][A-Z].*[a-z][A-Z].*[a-z][A-Z])? ------------------------------------------------------------------------------ Benefiting from Server Virtualization: Beyond Initial Workload Consolidation -- Increasing the use of server virtualization is a top priority.Virtualization can reduce costs, simplify management, and improve application availability and disaster protection. Learn more about boosting the value of server virtualization. http://p.sf.net/sfu/vmware-sfdev2dev _______________________________________________ Assp-test mailing list Assp-test@... https://lists.sourceforge.net/lists/listinfo/assp-test

Re: [Assp-test] an account for all spam/discards . . . From: Doug Lytle <support@dr...> - 2011-05-09 11:09 Spyros Tsiolis wrote: > Can I also have the option to explicitly state_which_ users/accounts > (e-mails : e.g.user@...) are allowed to tell ASSP which > That would be a few fields down on the page: Copy Spam to these Recipients Only* / (ccSpamFilter) /Restricts Copy Spam to these recipients. Accepts specific addresses (user@...), user parts (user) or entire domains (@example.com). Wildcards are supported (fribo*@example.com). Doug -- Ben Franklin quote: "Those who would give up Essential Liberty to purchase a little Temporary Safety, deserve neither Liberty nor Safety."

Re: [Assp-test] an account for all spam/discards . . . From: Fritz Borgstedt <fb@iw...> - 2011-05-09 16:57 ASSP development mailing list <assp-test@...> schreibt: >That would be a few fields down on the page: > >Copy Spam to these Recipients Only* / (ccSpamFilter) > >/Restricts Copy Spam to these recipients. Accepts specific addresses >(user@...), user parts (user) or entire domains >(@example.com). >Wildcards are supported (fribo*@example.com). That would restrict spam-copies. The question here is IMHO afor a restriction of the senders of ham/spam reports. That can be done here: -Not Authorized Addresses* (EmailSenderNotOK) Mail from any of these addresses are not accepted from Email Interface, except "Help Report", "Analyze Report" and "Block Report/Resend". Accepts specific addresses (user@...), user parts (user) or entire domains (@example.com). The user will get informed about the denied request. -Ignore Not Authorized Addresses* (EmailSenderIgnore) (shareable) Mail from any of these addresses are not accepted from Email Interface, except "Help Report", "Analyze Report" and "Block Report/Resend". Accepts specific addresses (user@...), user parts (user) or entire domains (@example.com). The user will get not informed about the denied request.

Re: [Assp-test] an account for all spam/discards . . . From: Spyros Tsiolis <stsiol@ya...> - 2011-05-10 11:06 --- On Mon, 9/5/11, Fritz Borgstedt <fb@...> wrote: > From: Fritz Borgstedt <fb@...> > Subject: Re: [Assp-test] an account for all spam/discards . . . > To: "ASSP development mailing list" <assp-test@...> > Date: Monday, 9 May, 2011, 19:54 > ASSP development mailing list <assp-test@...> > schreibt: > >That would be a few fields down on the page: > > > >Copy Spam to these Recipients Only* / (ccSpamFilter) > > > >/Restricts Copy Spam to these recipients. Accepts > specific addresses > >(user@...), > user parts (user) or entire domains > >(@example.com). > >Wildcards are supported (fribo*@example.com). > > > That would restrict spam-copies. The question here is IMHO > afor a > restriction of the senders of  ham/spam reports. > That can be done here: > > -Not Authorized Addresses* (EmailSenderNotOK) > > Mail from any of these addresses are not accepted from > Email > Interface, except "Help Report", "Analyze Report" and > "Block > Report/Resend". Accepts specific addresses (user@...), > user > parts (user) or entire domains (@example.com). The user > will get > informed about the denied request.  > > -Ignore Not Authorized Addresses* (EmailSenderIgnore)  > (shareable) > > Mail from any of these addresses are not accepted from > Email > Interface, except "Help Report", "Analyze Report" and > "Block > Report/Resend". Accepts specific addresses (user@...), > user > parts (user) or entire domains (@example.com). The user > will get not > informed about the denied request. > > > ------------------------------------------------------------------------------ > WhatsUp Gold - Download Free Network Management Software > The most intuitive, comprehensive, and cost-effective > network > management toolset available today.  Delivers lowest > initial > acquisition cost and overall TCO of any competing > solution. > http://p.sf.net/sfu/whatsupgold-sd > _______________________________________________ > Assp-test mailing list > Assp-test@... > https://lists.sourceforge.net/lists/listinfo/assp-test Hello Fritz, I am sorry but I will have to ask again about this : Will this ("SendAllSpam") also copy _discarded_ messages ? I get a lot of "discarded" in the ASSP logs that I, later, re-send and mark it as "correctednotspam" from the actions list (when one clicks on the actual log event string). Also, I don't understand what you're trying to tell me here, Best Regards, spyros ---- "I merely function as a channel that filters music through the chaos of noise" - Vangelis

Re: [Assp-test] Antwort: Re: Antwort: 2 issues with VRFY From: Michael Thomas <mike@ma...> - 2011-10-11 18:53 Fritz, My understanding is that, when using DoVRFY, it is an option that one can specify a MTA which should perform the VRFY. It is also my understanding that it is optional, not required to specify an MTA which should perform the VRFY. Michael Thomas Mathbox 978-687-3300 Toll Free: 1-877-MATHBOX (1-877-628-4269) On 10/11/2011 1:11 PM, Fritz Borgstedt wrote: > > ASSP development mailing list<assp-test@...> writes: >> Fritz, >> >> Is DoVRFY (verify with MTA) an alternative to LDAP? If not, what is >> the >> purpose of DoVRFY? > > > DoVRFY is one of multiple validation methods, > the others are LocalAddresses_Flat and DoLDAP. > > Lookup will look into > - LocalAddresses_Flat > - LDAPlist (Cache for LDAP and VRFY) > - DoLDAP > - DoVRFY > > If not found the listening MTA at SMTPDestination will check the MAIL > FROM and return 550 if not valid. > > > ------------------------------------------------------------------------------ > All the data continuously generated in your IT infrastructure contains a > definitive record of customers, application performance, security > threats, fraudulent activity and more. Splunk takes this data and makes > sense of it. Business sense. IT sense. Common sense. > http://p.sf.net/sfu/splunk-d2d-oct > _______________________________________________ > Assp-test mailing list > Assp-test@... > https://lists.sourceforge.net/lists/listinfo/assp-test > >

[Assp-test] Fwd: Re: Antwort: Re: Antwort: 2 issues with VRFY From: Michael Thomas <mike@ma...> - 2011-10-11 19:02 Fritz, My response was not clear, even to me. Sorry. Let me try again. My understanding is that, when using DoVRFY, it is an option that one can specify, in LocalAddresses_Flat, a domain and a MTA which should perform the VRFY. It is also my understanding that it is optional, not required to specify an MTA which should perform the VRFY. If the optional MTA is not specified in LocalAddresses_Flat, the smtpDestination is used. Michael Thomas Mathbox 978-687-3300 Toll Free: 1-877-MATHBOX (1-877-628-4269) -------- Original Message -------- Subject: Re: [Assp-test] Antwort: Re: Antwort: 2 issues with VRFY Date: Tue, 11 Oct 2011 14:53:14 -0400 From: Michael Thomas <mike@...> Organization: Mathbox To: ASSP development mailing list <assp-test@...> Fritz, My understanding is that, when using DoVRFY, it is an option that one can specify a MTA which should perform the VRFY. It is also my understanding that it is optional, not required to specify an MTA which should perform the VRFY. Michael Thomas Mathbox 978-687-3300 Toll Free: 1-877-MATHBOX (1-877-628-4269) On 10/11/2011 1:11 PM, Fritz Borgstedt wrote: > > ASSP development mailing list<assp-test@...> writes: >> Fritz, >> >> Is DoVRFY (verify with MTA) an alternative to LDAP? If not, what is >> the >> purpose of DoVRFY? > > > DoVRFY is one of multiple validation methods, > the others are LocalAddresses_Flat and DoLDAP. > > Lookup will look into > - LocalAddresses_Flat > - LDAPlist (Cache for LDAP and VRFY) > - DoLDAP > - DoVRFY > > If not found the listening MTA at SMTPDestination will check the MAIL > FROM and return 550 if not valid. > > > ------------------------------------------------------------------------------ > All the data continuously generated in your IT infrastructure contains a > definitive record of customers, application performance, security > threats, fraudulent activity and more. Splunk takes this data and makes > sense of it. Business sense. IT sense. Common sense. > http://p.sf.net/sfu/splunk-d2d-oct > _______________________________________________ > Assp-test mailing list > Assp-test@... > https://lists.sourceforge.net/lists/listinfo/assp-test > >

Re: [Assp-test] Antwort: Re: Antwort: 2 issues with VRFY From: Fritz Borgstedt <fb@iw...> - 2011-10-11 19:13 ASSP development mailing list <assp-test@...> writes: > It is also my >understanding that it is optional, not required to specify an MTA >which >should perform the VRFY. That is not my understanding. The MTA is requrired. In V1 was a way to set the default MTA by setting *=defaultmta in vrfyDomains. V2 and V1 got recently the default setting by setting ALL=>defaultmta

Re: [Assp-test] Fwd: Re: Antwort: Re: Antwort: 2 issues with VRFY From: Fritz Borgstedt <fb@iw...> - 2011-10-11 19:23 ASSP development mailing list <assp-test@...> writes: > >My understanding is that, when using DoVRFY, it is an option that one >can specify, in LocalAddresses_Flat, a domain and a MTA which should >perform the VRFY. It is also my understanding that it is optional, >not >required to specify an MTA which should perform the VRFY. If the >optional MTA is not specified in LocalAddresses_Flat, the The domain=>MTA settings for DoVRFY can be done in both: LocalAddresses_Flat and localDomains. I know of no hidden default and was very surprised to read your comment about that. May be there is something in the code which does that, I am not able to see it.

Re: [Assp-test] Fwd: Re: Antwort: Re: Antwort: 2 issues with VRFY From: Michael Thomas <mike@ma...> - 2011-10-11 19:39 Fritz, I should have mentioned, that I also have VRFYforceRCPTTO set the same as smtpDestination, which may be the overriding factor. The MTA does not do VRFY. Michael Thomas Mathbox 978-687-3300 Toll Free: 1-877-MATHBOX (1-877-628-4269) On 10/11/2011 3:21 PM, Fritz Borgstedt wrote: > > ASSP development mailing list<assp-test@...> writes: >> >> My understanding is that, when using DoVRFY, it is an option that one >> can specify, in LocalAddresses_Flat, a domain and a MTA which should >> perform the VRFY. It is also my understanding that it is optional, >> not >> required to specify an MTA which should perform the VRFY. If the >> optional MTA is not specified in LocalAddresses_Flat, the > > > The domain=>MTA settings for DoVRFY can be done in both: > LocalAddresses_Flat and localDomains. > I know of no hidden default and was very surprised to read your > comment about that. > May be there is something in the code which does that, I am not able > to see it. > > > ------------------------------------------------------------------------------ > All the data continuously generated in your IT infrastructure contains a > definitive record of customers, application performance, security > threats, fraudulent activity and more. Splunk takes this data and makes > sense of it. Business sense. IT sense. Common sense. > http://p.sf.net/sfu/splunk-d2d-oct > _______________________________________________ > Assp-test mailing list > Assp-test@... > https://lists.sourceforge.net/lists/listinfo/assp-test > >

Re: [Assp-test] Fwd: Re: Antwort: Re: Antwort: 2 issues with VRFY From: Fritz Borgstedt <fb@iw...> - 2011-10-11 20:13 ASSP development mailing list <assp-test@...> writes: >I should have mentioned, that I also have VRFYforceRCPTTO set the >same >as smtpDestination, which may be the overriding factor. The MTA does >not >do VRFY. VRFYforceRCPTTO will be in effect if a MTA is found in the domain=>MTA settings and the MTA is matched.

Re: [Assp-test] timeouts with 1.9.x From: marrco <assp@mi...> - 2011-11-17 12:36 > I'm struggling with lots of mail timeouting without any real reason > (1.9.1.x) on windows 2003 server, with just assp and perl > > I did a clean install of perl and assp, but it did not solve the problem. > Upgraded a few hours ago to 1.9.1.8(2.0.00) but the issue is still present. > Server has lots of free ram, and sits idle 99% of the time. I just did an additional test. Setup a debian (squeeze) box, with just ASSP Version: 1.9.1.8(2.0.00). I'm still having timeouts. Suggestions?

[Assp-test] 1.9.5.8(0.0.01) and PB From: Graziano <dreamservice@li...> - 2012-01-13 18:43 Hello Could be possible to collect in BlackBox all the ips which surpassed the MessageScoring Upper Limit too ? And could be possible to decide what should be collected in BlackBox? For example I would collect only MessageScoring|InvalidAddress|MissingMXA|ForgedHELO . Thank you Graziano

[Assp-test] Connection / Disconnection time From: Graziano <dreamservice@li...> - 2012-03-08 08:09 Hello suggestion, what do you think about an option to show/hide total time between Connection and Disconnection ? Mar-08-12 02:58:29 Connected: 122.167.8.121:2805 -> 72.52.241.40:25 (listenPort) -> 37.30.30.31:125; Mar-08-12 02:58:32 Disconnected: 122.167.8.121 (time 3s); It could be useful to find bottleneck/delay in filter processing , DNS ... This data could be saved also in stats , to know which is the avg connection time in server. Thank you Graziano

Re: [Assp-test] Connection / Disconnection time From: Fritz Borgstedt <fb@iw...> - 2012-03-08 12:51 ASSP development mailing list <assp-test@...> schreibt: > Disconnected: In the case of HAM the disconnected time will include the timeout of the receiving or sending MTA.

Re: [Assp-test] HELO forged in 1.9.4.3 From: marrco <assp@mi...> - 2012-10-23 11:29 Upgraded to 1.9.4.6(1.0.02) and still not working. Ne1 has a suggestion? Setting validatehelolog to Verbose is useless. So I'm guessing incoming mail simply doesn't pass all HELO filters. > To block offending HELOs i use myServerRe as file:files/badhelo.txt > where I list spammer helos. Of course Block Forged Helos (DoFakedLocalHelo) > is on That worked for many years, but suddenly stopped a few months ago. > Can't tell when, because I only update assp a few times a year. That test > blocked really tons of spam, now it's not working anymore, on a few different > setup (win32, debian..) where I just upgraded the assp files without changing > the config. Now in Infostas HELO Forged: is always zero for me. > > Hints?

Re: [Assp-test] HELO forged in 1.9.4.3 From: Fritz Borgstedt <fb@iw...> - 2012-10-23 12:16 ASSP development mailing list <assp-test@...> schrei bt: >Upgraded to 1.9.4.6(1.0.02) and still not working. Ne1 has a suggestio >n? > >Setting validatehelolog to Verbose is useless. So I'm guessing incomin >g mail >simply doesn't pass all HELO filters. It is working, but not counting. 1.9.4.7 fixed that.

Re: [Assp-test] HELO forged in 1.9.4.3 From: marrco <assp@mi...> - 2012-10-27 14:35 >>Setting validatehelolog to Verbose is useless. So I'm guessing incomin >>g mail simply doesn't pass all HELO filters. > > >It is working, but not counting. >1.9.4.7 fixed that. Confirmed. Working fine in 1.9.4.7 (1.0.02) both on debian linux and windows.

14 messages have been excluded from this view by a project administrator.

Next Messages