[Assp-user] ASSP Virtual Machine

[Bennett Lee <assp@be...>]

I'm in the process of switching quite a few clients from Exchange 2003
to virtual Exchange 2007, all running single box ASSP/Exchange.
Considering the odium of the single box setup and the new problems that
Exchange 2007 adds, I'm creating an ASSP virtual machine to drop in
place for all my clients.  Unfortunately, I'm having problems, and since
I'm not a *nix or Perl guy, my troubleshooting ability is limited and I
could use some assistance.  I'm keeping a step-by-step tutorial on
setting up an ASSP VM from scratch (mainly for my own reference since I
don't know what I'm doing),  ;)  but once it's working, I'd like to
release a public ASSP virtual appliance that everyone could use (like No
More SPAM, http://www.vmware.com/appliances/directory/197, which
apparently has been abandoned).  Of course, if someone has an ASSP
virtual appliance they want to offer up, please post it and we can all
ignore the rest of this email.  :)
 
 
BASE OS:
I'm trying TurnKey Core (http://www.turnkeylinux.org/appliances/core),
which is a lean, no frills Ubuntu, with basic console config and nice
webmin.  I wouldn't mind trying other Linux flavors or FreeBSD (which
might help me resurrect the pfSense ASSP package...in the far distant
future), but I can't find anything that's as user-friendly for an old
Windows rube like me as TurnKey.  Any feedback on TurnKey or another OS?
 
Relatively minor is directory location.  I know the wiki has the Debian
install at /usr/share/assp, but poking around that didn't seem right,
and mod_inst.pl doesn't even include that as a possible install
directory.  I settled on /etc/assp and chown to nobody:nogroup, with
logs, spam, notspam, etc., all under this base folder.  Is this
acceptable or would *nix best practices recommend somewhere else?
 
 
PERL:
My biggest problem is getting all the required Perl modules installed.
This seems to be a common problem, and I don't want to flood this list
with a bunch of Perl module install logs, but I'd appreciate some module
troubleshooting tips.  I'll happy take this topic off-list to direct
email, IM, etc. if anyone is willing.
 
With some work, I've managed to get all the mod_inst.pl v1.09 modules
installed except Tie::DBI.  Keeps telling me it can't find DBI.t, even
though it exists in a directory structure similar to other modules that
installed correctly.  Consequently, tests fail.  No Ubuntu package to
fall back on either (at least none I know of).  So I forced install, but
ASSP still says it's not available.  Also can't get some other modules
installed from mod_inst.pl v1.08, but haven't troubleshot them:
DBD::ADO, DBD::Mimer, DBD::ODBC, DBD::mysqlPP, Image::Magick,
PDF::GetImages, Image::OCR::Tesseract, PDF::OCR.
 
This brings me to my next question, why does the newer mod_inst.pl v1.09
packaged in 1.5.1.1 drop these v1.08 modules?  Are these no longer
necessary?  Does this mean ASSP no longer scans images?  Didn't want to
troubleshoot these if they're no longer necessary.
 
 
CLAMAV:
Next item is ClamAV.  Installed, working, freshens.  Haven't got
SaneSecurity's supplemental signatures integrated, but think I can
handle that.  What I don't know how to do is to create a ClamAV watchdog
like tBB's excellent ClamDog for Windows.  Any suggestions, scripts,
etc.?
 
 
My show stopper right now is Tie::DBI and possibly the DBD and Image/PDF
modules if those are still in use.  If I can get the Perl modules
installed, the VM should be ready for a beta release (so you can tell me
all the things I've done wrong).  :)  Roadmap includes ClamAV
supplemental and watchdog, cron and/or webmin custom command to rebuild
databases, regen of crypt keys on initial run like TurnKey does, and
Perl 5.10 upgrade.  Long-term I hope to add a webmin custom command that
can backup/restore current config & databases.
 
--Bennett

[Assp-user] LDAP matches non-local Contact domains & emails

[Bennett Lee <assp@be...>]

I have a problem where LDAP queries are finding & caching non-local
emails and domains.  Problem is the recommended ldLDAPFilter and
LDAPFilter combined with Active Directory "Contacts" that usually have
an external email address.  (Technically, AD users could have external
addresses, too, but that seems like bad practice.)
 
For example:
    ldLDAPFilter := proxyaddresses=smtp:*@DOMAIN
    LDAPFilter := proxyaddresses=smtp:EMAILADDRESS
    AD Contact "Bob's Home Email" = bob@...
 
Then, if anyone from yahoo.com emails the company:
(1)  ldLDAPFilter matches yahoo.com as local because "Bob's Home Email"
is included in proxyaddresses.
(2)  yahoo.com is added to LDAP cache as local domain.
(3)  All email from yahoo.com bounces/scores as "InvalidLocalSender" if
valid remote sender checks are enabled.
 
Likewise, if Bob mails the company from his Yahoo account:
(4)  LDAPFilter matches Bob's Yahoo account from his contact email
address.
(5)  bob@... is added to LDAP cache as local address.
(6)  All email from Bob's Yahoo account...?  Bounces/scores as
"InvalidLocalSender"?  Gets marked as local?  Fails as relaying?  (Don't
know consequences yet.)
 
A workaround is obviously to not validate remote senders, but I don't
want to give up that functionality.  A partial fix that I worked out
just excludes contacts entirely (assuming all local email domains
include at least one non-contact email address).
 
Partial fix:
    ldLDAPFilter :=
(&(proxyaddresses=smtp:*@DOMAIN)(!(objectclass=contact)))
 
Not sure what to do with LDAPFilter.  Some contacts could have dummy
local addresses (e.g., bob_home@... so people can use the same
email even if Bob changes to Gmail, then Hotmail, etc.), so we can't
just exclude Contacts entirely or DoLDAP would fail to find local
contact addresses.  Frankly, what we need is a 2-step test:
(1) check if DOMAIN is local by only matching either ASSP's localDomains
or Exchange's gatewayProxy (can't figure out a working LDAP query for
gatewayProxy), and
(2) if DOMAIN is local (and only if), then match EMAILADDRESS.
 
Can someone with more knowledge of LDAP queries (specifically against
Windows and Exchange) provide some insight?
 
--Bennett

[Assp-user] Problem with the latest version on magicvillage.de ....

[<jean-claude@co...>]

The version 1.5.1.2 (1.2.01) don't work very well ...
If I try this version, my mail don't come in. He claims he couldn't
create the server sockets to my mail server !!!!
If I put the previous version 1.5.1.2 51.1.10), the mail come back again
...

To correct then ...

Jean-Claude LANNOY

Re: [Assp-user] problem with v.1.5.1.2 (1.1.10)

[<hisham@sf...>]

Thanks to all who offered to help , much appreciated :)

Brett sent me the required file version 1.5.1.2 (1.1.07). Thanks Brett
It was my mistake thinking 1.1.10 was the stable release !


On Thu, 30 Apr 2009 16:42:13 +0200
  "GrayHat" <grayhat@...> wrote:
>> If you're talking 1.5.12 (1.0.07), then I can help. 
> 
> same here I've backups going back quite much :)
> 
> 
> ------------------------------------------------------------------------------
> Register Now & Save for Velocity, the Web Performance & 
>Operations 
> Conference from O'Reilly Media. Velocity features a full 
>day of 
> expert-led, hands-on workshops and two days of sessions 
>from industry 
> leaders in dedicated Performance & Operations tracks. 
>Use code vel09scf 
> and Save an extra 15% before 5/3. 
>http://p.sf.net/sfu/velocityconf
> _______________________________________________
> Assp-user mailing list
> Assp-user@...
> https://lists.sourceforge.net/lists/listinfo/assp-user

Re: [Assp-user] problem with v.1.5.1.2 (1.1.10)

[GrayHat <grayhat@gm...>]

> If you're talking 1.5.12 (1.0.07), then I can help. 

same here I've backups going back quite much :)

Re: [Assp-user] problem with v.1.5.1.2 (1.1.10)

[Doug Lytle <support@dr...>]

Alex Davidson wrote:
> Unfortunatly, I replaced the old assp.pl. From where i can redownload 
> 1.0.7.
>   
If you're talking 1.5.12 (1.0.07), then I can help. 

Let me know,

Doug

-- 
Ben Franklin quote:

"Those who would give up Essential Liberty to purchase a little Temporary Safety, deserve neither Liberty nor Safety."

Re: [Assp-user] problem with v.1.5.1.2 (1.1.10)

[Alex Davidson <AlexD@so...>]

I'd offer to send it to you but I don't have anything that old :(
1.2.4 is my limit

-----Original Message-----
Fritz Borgstedt wrote:
> For Users of ASSP  <assp-user@...> schreibt:
>> While it was running fine just before upgrade.
> 
> What happens if you run 1.0.7 again.

Unfortunatly, I replaced the old assp.pl. From where i can redownload 
1.0.7.
On the download site it always shows the latest release (1.1.10)!

Re: [Assp-user] problem with v.1.5.1.2 (1.1.10)

[Hill, Brett <hillrb@nl...>]

Hisham wrote:
> 
> Unfortunatly, I replaced the old assp.pl. From where i can 
> redownload 1.0.7.
> On the download site it always shows the latest release (1.1.10)!

Fritz always has the latest version on his website.  He does not host
old copies of the software.
(Which is why I always backup before applying an update.  It's as simple
as copy/paste to another directory.)

Kind Regards,
Brett

Re: [Assp-user] problem with v.1.5.1.2 (1.1.10)

[Hisham <hisham@sf...>]

Fritz Borgstedt wrote:
> For Users of ASSP  <assp-user@...> schreibt:
>> While it was running fine just before upgrade.
> 
> What happens if you run 1.0.7 again.

Unfortunatly, I replaced the old assp.pl. From where i can redownload 
1.0.7.
On the download site it always shows the latest release (1.1.10)!

Re: [Assp-user] FilesDistribution

[Fritz Borgstedt <fb@iw...>]

Please use the newest 1.5.1.2 version, I changed the FilesDistribution
= 1 calculus so, that this will not happen again.

Re: [Assp-user] problem with v.1.5.1.2 (1.1.10)

[Fritz Borgstedt <fb@iw...>]

For Users of ASSP  <assp-user@...> schreibt:
>Today I replaced assp.pl with the new one (1.1.10).


Please read the remark on top of the site:

If you want to run this version you should join
assp-test@...
To do that, mail to assp-test-request@... with
"subscribe" in body.

Re: [Assp-user] problem with v.1.5.1.2 (1.1.10)

[Fritz Borgstedt <fb@iw...>]

For Users of ASSP  <assp-user@...> schreibt:
>
>While it was running fine just before upgrade.

What happens if you run 1.0.7 again.

[Assp-user] problem with v.1.5.1.2 (1.1.10)

[Hisham <hisham@sf...>]

Today I replaced assp.pl with the new one (1.1.10). My old file was 
running (1.0.0.7). After upgrade, when sending to spam@... to 
report spam email, i get below bounced back:

Failed to deliver to 'spam@...'
mail loop: too many hops (too many 'Received:' header fields)

While it was running fine just before upgrade.

[Assp-user] FilesDistribution

[Graziano <dreamservice@li...>]

Hello

which is the correct FilesDistribution value to avoid a situation like this

Apr-25-09 16:12:30 27.18.20.14 <br@...> to: bks@... [spam found] (MessageScore 70, limit 46) [SALE] -> /usr/local/assp/spam/924.eml;
Apr-25-09 17:05:00 189.131.19.24 <km@...> to: bs@... [spam found] (MessageScore 63, limit 46) [Make] -> /usr/local/assp/spam/924.eml;

In less than 1 hour ASSP used 924.eml 2 times for 2 different email , so I have no way to resend the first email received on 
16:12:30

Currently I am using  FilesDistribution  1 (default) ; which is the best FilesDistribution value which permits to reduce 
the problem above (0.01 , 0.5 , 0.99 or 1 ?)

Thank you
Graziano

Re: [Assp-user] resendmail folder

[Brett <lists@sp...>]

Good job ... updating did it ..

So my config must have been sound .. just something didn't work for me with
the previous .pl ..

Thanks heaps!

-----Original Message-----
From: Fritz Borgstedt [mailto:fb@...] 
Sent: Wednesday, 29 April 2009 11:28 AM
To: 'For Users of ASSP'
Subject: Re: [Assp-user] resendmail folder

>
>
>Any advice?

At the moment I am clueless. But please install the newest 1.5.1.2.
Just replace the assp.pl file:

http://www.magicvillage.de/~Fritz_Borgstedt/assp/S06660E7E?WasRead=1


----------------------------------------------------------------------------
--
Register Now & Save for Velocity, the Web Performance & Operations 
Conference from O'Reilly Media. Velocity features a full day of 
expert-led, hands-on workshops and two days of sessions from industry 
leaders in dedicated Performance & Operations tracks. Use code vel09scf 
and Save an extra 15% before 5/3. http://p.sf.net/sfu/velocityconf
_______________________________________________
Assp-user mailing list
Assp-user@...
https://lists.sourceforge.net/lists/listinfo/assp-user

Re: [Assp-user] resendmail folder

[Fritz Borgstedt <fb@iw...>]

>
>
>Any advice?

At the moment I am clueless. But please install the newest 1.5.1.2.
Just replace the assp.pl file:

http://www.magicvillage.de/~Fritz_Borgstedt/assp/S06660E7E?WasRead=1

Re: [Assp-user] Lost email from root@xxxx

[Fritz Borgstedt <fb@iw...>]

For Users of ASSP  <assp-user@...> schreibt:
>Can I lock ASSP to just one IP and leave 127.0.0.1:25 for
>sendmail to send root notications?.

SMTP Listen Port ( listenPort)

The port number on which ASSP will listen for incoming SMTP
connections (normally 25). You can specify both an IP address and port
number to limit connections to a specific interface.
Examples: 25, 127.0.0.1:25, 127.0.0.1:25|127.0.0.2:25

[Assp-user] Lost email from root@xxxx

[Brett <lists@sp...>]

Since installing ASSP I don't get root emails anymore.

I have my local sendmail to receive only on 127.0.0.1:125 - which ASSP
passes emails to.

I turned off ASSP and added 127.0.0.1:25 to Sendmail and the root mails work
again. So what I can gather is that ASSP locks port 25 on the localhost and
routed IP. Can I lock ASSP to just one IP and leave 127.0.0.1:25 for
sendmail to send root notications?.

Or is there a better practice from within ASSP.

Thanks,
Brett

Re: [Assp-user] resendmail folder

[Brett <lists@sp...>]

Hi .. still having problems with this one ..

I've using the log to move files into "resendmail" ..

But the .eml files just stay there and don't resend ..

I've install the module that it says, and on my perl page if reads

"Email::Send	 2.194	 sending .eml files is available	CPAN"

Any advice?

-----Original Message-----
From: Brett [mailto:lists@...] 
Sent: Wednesday, 22 April 2009 9:21 AM
To: 'For Users of ASSP'
Subject: Re: [Assp-user] resendmail folder

Using the web interface .. I've selected the "resend file" options and "Do
it" ..

It shows up in the folder with and .eml extension

Brett

-----Original Message-----
From: Fritz Borgstedt [mailto:fb@...] 
Sent: Wednesday, 22 April 2009 1:46 AM
To: 'For Users of ASSP'
Subject: Re: [Assp-user] resendmail folder

For Users of ASSP  <assp-user@...> schreibt:
>But it's still not working .

how did the files came into the resend folder?
what endings do the files have in the resend folder?
Is your reportlog set to verbose?
Did you try to delete the files and produce a new one?


----------------------------------------------------------------------------
--
Stay on top of everything new and different, both inside and 
around Java (TM) technology - register by April 22, and save
$200 on the JavaOne (SM) conference, June 2-5, 2009, San Francisco.
300 plus technical and hands-on sessions. Register today. 
Use priority code J9JMT32. http://p.sf.net/sfu/p
_______________________________________________
Assp-user mailing list
Assp-user@...
https://lists.sourceforge.net/lists/listinfo/assp-user


----------------------------------------------------------------------------
--
Stay on top of everything new and different, both inside and 
around Java (TM) technology - register by April 22, and save
$200 on the JavaOne (SM) conference, June 2-5, 2009, San Francisco.
300 plus technical and hands-on sessions. Register today. 
Use priority code J9JMT32. http://p.sf.net/sfu/p
_______________________________________________
Assp-user mailing list
Assp-user@...
https://lists.sourceforge.net/lists/listinfo/assp-user

Re: [Assp-user] Problems with fprot virusscan and assp 1.5.1.2

[Paul K. Dickson <pdickson@fr...>]

LOL.  No, don't hold back, tell us how you really feel! :D


Paul K. Dickson
Systems Administrator
Frederick County Government, IIT
pdickson@...
301-600-2399/x12399




> From: GrayHat <grayhat@...>
> Reply-To: GrayHat <grayhat@...>, For Users of ASSP
> <assp-user@...>
> Date: Mon, 27 Apr 2009 15:29:07 +0200
> To: For Users of ASSP <assp-user@...>
> Subject: Re: [Assp-user] Problems with fprot virusscan and assp 1.5.1.2
> 
>> Just out of curiosity, is the purpose of "DoFileScan"
>> to allow scanning with in compressed files?
> 
> No, just to waste disk I/O and CPU cycles and to slow
> down ASSP on busy boxes and to allow people to use
> 3rd party scanners running as spawned processes; a
> totally crazy idea imVHo
> 
> ------------------------------------------------------------------------------
> Crystal Reports &#45; New Free Runtime and 30 Day Trial
> Check out the new simplified licensign option that enables unlimited
> royalty&#45;free distribution of the report engine for externally facing
> server and web deployment.
> http://p.sf.net/sfu/businessobjects
> _______________________________________________
> Assp-user mailing list
> Assp-user@...
> https://lists.sourceforge.net/lists/listinfo/assp-user

Re: [Assp-user] Problems with fprot virusscan and assp 1.5.1.2

[GrayHat <grayhat@gm...>]

> Just out of curiosity, is the purpose of "DoFileScan" 
> to allow scanning with in compressed files?

No, just to waste disk I/O and CPU cycles and to slow
down ASSP on busy boxes and to allow people to use
3rd party scanners running as spawned processes; a
totally crazy idea imVHo

Re: [Assp-user] Problems with fprot virusscan and assp 1.5.1.2

[Paul K. Dickson <pdickson@fr...>]

Just out of curiosity, is the purpose of "DoFileScan" to allow scanning with
in compressed files?


Paul K. Dickson
Systems Administrator
Frederick County Government, IIT
pdickson@...
301-600-2399/x12399




> From: Fritz Borgstedt <fb@...>
> Reply-To: For Users of ASSP <assp-user@...>
> Date: Mon, 27 Apr 2009 08:31:34 +0200
> To: <assp-user@...>
> Subject: Re: [Assp-user] Problems with fprot virusscan and assp 1.5.1.2
> 
> For Users of ASSP  <assp-user@...> schreibt:
>> Hi,
>> 
>> I tested assp 1.5.1.2 with fprot virusscan on rhel5.3 x86_64.
>> Whitelisted mails are not scanned although ScanWL=1.
> 
> 
> you tested that with DoFileScan disabled (DoFileScan:=0) ?
> 
> 
> ------------------------------------------------------------------------------
> Crystal Reports &#45; New Free Runtime and 30 Day Trial
> Check out the new simplified licensign option that enables unlimited
> royalty&#45;free distribution of the report engine for externally facing
> server and web deployment.
> http://p.sf.net/sfu/businessobjects
> _______________________________________________
> Assp-user mailing list
> Assp-user@...
> https://lists.sourceforge.net/lists/listinfo/assp-user

Re: [Assp-user] Problems with fprot virusscan and assp 1.5.1.2

[Nicole Hähnel <nicole.haehnel@gm...>]

Ah, no. For testing I enabled DoFileScan of course.
I changed the settings for normal work back to clamav...

Nicole


Fritz Borgstedt schrieb:
> For Users of ASSP  <assp-user@...> schreibt:
>   
>> Hi,
>>
>> I tested assp 1.5.1.2 with fprot virusscan on rhel5.3 x86_64.
>> Whitelisted mails are not scanned although ScanWL=1.
>>     
>
>
> you tested that with DoFileScan disabled (DoFileScan:=0) ?
>
>
> ------------------------------------------------------------------------------
> Crystal Reports &#45; New Free Runtime and 30 Day Trial
> Check out the new simplified licensign option that enables unlimited
> royalty&#45;free distribution of the report engine for externally facing 
> server and web deployment.
> http://p.sf.net/sfu/businessobjects
> _______________________________________________
> Assp-user mailing list
> Assp-user@...
> https://lists.sourceforge.net/lists/listinfo/assp-user
>
>   

Re: [Assp-user] Problems with fprot virusscan and assp 1.5.1.2

[Fritz Borgstedt <fb@iw...>]

For Users of ASSP  <assp-user@...> schreibt:
>Hi,
>
>I tested assp 1.5.1.2 with fprot virusscan on rhel5.3 x86_64.
>Whitelisted mails are not scanned although ScanWL=1.


you tested that with DoFileScan disabled (DoFileScan:=0) ?

[Assp-user] Problems with fprot virusscan and assp 1.5.1.2

[Nicole Hähnel <nicole.haehnel@gm...>]

Hi,

I tested assp 1.5.1.2 with fprot virusscan on rhel5.3 x86_64.
Whitelisted mails are not scanned although ScanWL=1.
And I get no notify mail if a virus was found, but I get those mails 
with clamav.

I am not sure if FileScanBad and FileScanGood are set correctly.
Maybe these cause such problems.

Any experiences with fprot?

Thanks!
Nicole


noScan:=
ScanWL:=1
ScanNP:=
ScanLocal:=
ScanCC:=
AvError:=550 5.7.7 Mail appears infected with '$infection'.
EmailVirusReportsTo:=nicole.haehnel@...
EmailVirusReportsHeader:=
EmailVirusReportsToRCPT:=
UseAvClamd:=0
AvClamdPort:=/var/run/clamav/clamd.sock
ClamAVBytes:=200000
ClamAVtimeout:=10
NoScanRe:=
SuspiciousVirus:=
DoFileScan:=0
FileScanDir:=./virusscan
FileScanCMD:=/opt/f-prot/fpscan FILENAME
FileScanBad:=.*Infected\sobjects\:\s[^0].*
FileScanGood:=.*Infected\sobjects\:\s0.*
FileScanRespRe:=