gmane.mail.virus.maiamailguard

Blacklist how-to

Koenraad Lelong — 2012-05-24T08:34:27

Hi,

I have a number of entries in my white/black list. But for some entries, 
I still get mail in the quarantaine. What am I missing ?
I have *< at >qaiglobal.com in the blacklist, but still I get mail from them 
in the quarantaine. How can I prevent this ? I thought those mails would 
just be discarded, so I never see them, not in my mail-client but also 
not in Maia.

Thanks,

Koenraad Lelong.

Re: Auto-confirm items older than a date

Douglas Mortensen — 2012-05-22T19:37:52

Seems pretty risky to me to do this without any regard for the actual message score. I agree with Robert on the auto-confirming through process-quarantine for anything above & below specific thresholds. We started doing this probably about a year ago & haven't really had any noticeable negative results (aside from these not being factored into Maia's reporting, which is a known issue). So I'd recommend it.
Thanks,
-
Doug Mortensen
Network Consultant
Impala Networks
P: 505.327.7300

From: Antonio Gutierrez [mailto:Antonio.Gutierrez-5HwmlVq+r+jg+h32lBrQVzEAbCKwanjM< at >public.gmane.org]
Sent: Tuesday, May 22, 2012 3:50 AM
Cc: maia-users-fBBSUI5vRLiWd6l5hS35sQ< at >public.gmane.org
Subject: [Maia-users] Auto-confirm items older than a date


Hi all!


I would like to create a new cron job to auto-confirm all the suspected spam older than X days (a week, maybe)

and after, run process-quarantine.pl. Is there a way to do this with maia scripts... or should I build a

custom query and run it out of the box?


If 2) is enough marking the items with a C on maia_mail_recipients (before extracting mail_ids from maia_mail)

and after run process-quarantine.pl ?


Thanks all!


Antonio.
_______________________________________________
Maia-users mailing list
Maia-users-fBBSUI5vRLiWd6l5hS35sQ< at >public.gmane.org
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users

Re: process-quarantine.pl issue

Bob — 2012-05-22T16:40:47

Thank you! I would love to get that working.

Re: process-quarantine.pl issue

David Morton — 2012-05-22T13:03:38

We've been discussing it in the devel list, but haven't yet found the 
source of the problem.

Re: Auto-confirm items older than a date

David Morton — 2012-05-22T13:01:51

Auto confirming older items is usually not recommended, as it is old 
data - in fact some places like spamcop don't accept it if it's over 
something like 3 days.  Furthermore, without at least some sort of 
constraint on the score, you might autolearn incorrectly, and as we've 
seen with AWL, that can cause the whole system to drift.

OTOH, there is an option in process-quarantine to auto confirm and learn 
from messages over a given point limit.  Just be sure that limit is set 
to avoid mistakes. :)

Usually, I have expire-quarantine set to just delete suspected spam in a 
week, at least on busy servers.

_______________________________________________
Maia-users mailing list
Maia-users-fBBSUI5vRLiWd6l5hS35sQ< at >public.gmane.org
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users

Auto-confirm items older than a date

Antonio Gutierrez — 2012-05-22T09:50:10

Hi all! 

I would like to create a new cron job to auto-confirm all the suspected spam older than X days (a week, maybe) 
and after, run process-quarantine.pl. Is there a way to do this with maia scripts... or should I build a  
custom query and run it out of the box? 

If 2) is enough marking the items with a C on maia_mail_recipients (before extracting mail_ids from maia_mail)  
and after run process-quarantine.pl ? 

Thanks all! 

Antonio. 
_______________________________________________
Maia-users mailing list
Maia-users-fBBSUI5vRLiWd6l5hS35sQ< at >public.gmane.org
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users

Re: process-quarantine.pl issue

Douglas Mortensen — 2012-05-19T20:47:50

This list is very active. There are 2 archives. One rewuires member login first. The other is publicly viewable. I'm probably not the best person to answer your question. But rest assured you have come to the tight place & I am sure that others on this list will be able to guide you to getting this resolved.

This is an excellent mailing list.

-
Doug Mortensen
Sent from my Windows Phone
________________________________
From: Bob
Sent: 5/19/2012 12:07 PM
To: Maia-users-fBBSUI5vRLiWd6l5hS35sQ< at >public.gmane.org
Subject: [Maia-users] process-quarantine.pl issue

I am not sure if this is active anymore. I can't find any archive
articles to indicate activity.  After making endless searches I am out
of ideas, so I am hoping someone is reading this.

A month or so ago I replaced qmail with postfix/maia/dovecot (I had been
running dovecot with qmail). I have freeBSD  8.2 AMD64 (64-bit) OS.
I used the freeBSD ports to install. Everything works correctly with a
single exception: process-quarantine.pl won't work correctly.

Initially, when I ran it I got a "no forks" "no threads" error. I have
perl 10 and forks is indeed installed. To troubleshoot, I commented out
the "die" in the search for forks/threads and ran the script again. It
appears to process spam. However it doesn't seem to terminate cleanly.
When I ran it with cron, I got this via email.

exiting at /var/maiad/maia/scripts/process-quarantine.pl line 767.

This is the "die" in do_exit.

I am not sure it is really processing, though it appears to be. The big issue is that when I check my running processes, the process-quarantine script is still running. The do_exit apparently isn't really stopping the process.

I have checked with the freeBSD port maintainer and he hasn't observed this issue. He uses FreeBSD 8.2 32 bit. He has no idea what is happening.

Is the author of this script still around? Does anyone have an idea:
1. Why the script can't discover forks or threads?
2. Why the script won't terminate (gracefully or not)?

Thanks in advance,
Bob




_______________________________________________
Maia-users mailing list
Maia-users-fBBSUI5vRLiWd6l5hS35sQ< at >public.gmane.org
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users

process-quarantine.pl issue

Bob — 2012-05-19T18:07:49

I am not sure if this is active anymore. I can't find any archive 
articles to indicate activity.  After making endless searches I am out 
of ideas, so I am hoping someone is reading this.

A month or so ago I replaced qmail with postfix/maia/dovecot (I had been 
running dovecot with qmail). I have freeBSD  8.2 AMD64 (64-bit) OS.
I used the freeBSD ports to install. Everything works correctly with a 
single exception: process-quarantine.pl won't work correctly.

Initially, when I ran it I got a "no forks" "no threads" error. I have 
perl 10 and forks is indeed installed. To troubleshoot, I commented out 
the "die" in the search for forks/threads and ran the script again. It 
appears to process spam. However it doesn't seem to terminate cleanly. 
When I ran it with cron, I got this via email.

exiting at /var/maiad/maia/scripts/process-quarantine.pl line 767.

This is the "die" in do_exit.

I am not sure it is really processing, though it appears to be. The big issue is that when I check my running processes, the process-quarantine script is still running. The do_exit apparently isn't really stopping the process.

I have checked with the freeBSD port maintainer and he hasn't observed this issue. He uses FreeBSD 8.2 32 bit. He has no idea what is happening.

Is the author of this script still around? Does anyone have an idea:
1. Why the script can't discover forks or threads?
2. Why the script won't terminate (gracefully or not)?

Thanks in advance,
Bob

Re: Spam getting through Mailguard

Erik Weber — 2012-05-08T19:58:58

Example 1 & 2 got delivered due to AWL, consider disabling it.

The highest Bayesian score I noticed was 60%, but most wasn't over 50%
which makes me wonder how your Bayesian filter is trained.

Do a spamassassin lint (do it as the maia user) and check the size of
your corpus. If it is big it might be full of wrong decisions and it
could be wise to consider a purge and start over.

Take a backup if you end up doing a purge, that way you can roll back
in case you regret it.

Another tip is to implement the different SaneSecurity clamav rules, I
haven't tested if they would catch any of these but my impression is
that they generally catch a lot without too much performance loss.

Re: Spam getting through Mailguard

Joshua Small — 2012-05-08T01:58:46

Hi,

The majority of these emails would have tripped your rules were it not for the highly negative score from the auto whitelist system.

Have a look here at resetting the AWL for the particular sender, which may be a nice quick solution:
http://wiki.apache.org/spamassassin/AwlWrongWay

It's not implemented by default in current versions, so perhaps your installation is simply out of date - leading to a better long term solution of upgrading?  There's a discussion on it here:

http://old.nabble.com/Yet-another-thread-about-AWL-td33364497.html



Joshua Small

Daraco Services
IT Consulting and Support
Unit 17, 7 Anella Avenue Castle Hill 2154
Phone: 1300 327 226 Fax: +612 8588 1200
Email: jsmall-4DEvm7Eym6QpAS55Wn97og< at >public.gmane.org<mailto:jsmall-4DEvm7Eym6QpAS55Wn97og< at >public.gmane.org> www.daraco.com.au<http://www.daraco.com.au>
[Description: NEW Daraco logo - low res]

This message and any attachments are solely for the intended recipient and may contain confidential or privileged information. If you are not the intended recipient, any disclosure, copying, use, or distribution of the information included in this message and any attachments is prohibited. If you have received this communication in error, please notify us by reply e-mail and immediately and permanently delete this message. If you do not wish to receive messages from this email account, then please reply with unsubscribe me in the subject line to: unsubscribe-4DEvm7Eym6QpAS55Wn97og< at >public.gmane.org<mailto:unsubscribe< at >daraco.com.au>

From: maia-users-bounces-fBBSUI5vRLiWd6l5hS35sQ< at >public.gmane.org [mailto:maia-users-bounces< at >renaissoft.com] On Behalf Of David Bell
Sent: Tuesday, 8 May 2012 8:59 AM
To: maia-users-fBBSUI5vRLiWd6l5hS35sQ< at >public.gmane.org
Cc: Douglas Mortensen
Subject: [Maia-users] Spam getting through Mailguard

Hello -

We have a client who's constantly receiving spam.

The client's Spam settings is set to mark an email as spam for anything that has a score of >=2.5.

As you can see via the provided link this particular client is receiving spam that is recording under 2.5 when it is clearly spam.

I would appreciate any recommendations on rectifying this situation.

http://www.impalanetworks.com/downloads/John_Doe-Spam_Cleanup.docx


Thank you,
David Bell
Impala Networks Inc
www.impalanetworks.com<http://www.impalanetworks.com/>
P: (505) 327-7300

_______________________________________________
Maia-users mailing list
Maia-users-fBBSUI5vRLiWd6l5hS35sQ< at >public.gmane.org
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users

Spam getting through Mailguard

David Bell — 2012-05-07T22:59:19

Hello -

We have a client who's constantly receiving spam.

The client's Spam settings is set to mark an email as spam for anything that has a score of >=2.5.

As you can see via the provided link this particular client is receiving spam that is recording under 2.5 when it is clearly spam.

I would appreciate any recommendations on rectifying this situation.

http://www.impalanetworks.com/downloads/John_Doe-Spam_Cleanup.docx


Thank you,
David Bell
Impala Networks Inc
www.impalanetworks.com<http://www.impalanetworks.com/>
P: (505) 327-7300

_______________________________________________
Maia-users mailing list
Maia-users-fBBSUI5vRLiWd6l5hS35sQ< at >public.gmane.org
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users

Re: message size limit per user basis

Indunil Jayasooriya — 2012-05-02T04:36:53



< at >message_size_limit_maps

e.ga



< at >message_size_limit_maps = (
  {'manager-hcDgGtZH8xNBDgjK7y7TUQ< at >public.gmane.org'=> 20_000_000,
   'secretary-7c22CCD1AURBDgjK7y7TUQ< at >public.gmane.org' => 10_000_000,
   '.emample.com' => 5_000_000
  }
);


I think the above is OKAY for me.


Have you guys done this before?




______________________________**_________________

Re: message size limit per user basis

Alan Murrell — 2012-05-02T04:03:14

I don't think this would be best done at the MX level, where 
Maia/amavisd-new is.  These limits should be set at the mailbox level 
(i.e., on the server where the mailboxes reside, using the tools of the 
particular mail server you have setup)

message size limit per user basis

Indunil Jayasooriya — 2012-05-02T03:28:55

Hi maia guys,

Is there a way to apply message size limit per user basis in maia or
amavisd.new ?


setting

message_size_limit = 10000000  in main.cf in postfix applies globally.

I Do NOT expect it. instead I need user level size limits.

Let's say.


Manager needs 20 MB mail size limit for incoming and outgoing.

secretary needs 10 MB mail size limit for incoming and outgoing.
The rest needs 5 MB mail size limit for incoming and outgoing.


How to achieve the above tasks with maia MailGuard 1.0.2a or amavisd-new?

 **

Re: process-quarantine.pl: Segementation fault

Janketh Jay — 2012-04-13T01:47:13

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

FBSD's issue was (seemingly) due to it's own version of libc. Robert
and I are making an attempt to look into this as soon as we can. Busy,
busy! If anyone has any ideas, though, feel free to act on them and
submit patches. Would be nice to stop hearing about this. :(

Regards,
Janky Jay, III

On 04/12/2012 06:56 PM, David Morton wrote:
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk+HhaEACgkQGK3MsUbJZn4MDgCfdPdqxwdetqDqCr3Gy5ARAApJ
ij0AnRKBHUe6o7RrM6zVkuQDQIcj+eEu
=b5h4
-----END PGP SIGNATURE-----

Re: process-quarantine.pl: Segementation fault

David Morton — 2012-04-13T00:56:30

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 4/9/12 8:57 PM, Alan Murrell wrote:

I think that is consistent with whatever was happening on the BSD
boxes too.  Looks like it isn't limited to BSD.


- -- 
David Morton <mortonda-0/IDydmJJnNeoWH0uzbU5w< at >public.gmane.org>

Morton Software & Design  http://www.dgrmm.net - Ruby on Rails
                                                 PHP Applications
Maia Mailguard http://www.maiamailguard.com    - Spam management
                                                 for mail servers
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iD8DBQFPh3mxUy30ODPkzl0RAht5AJwK/itvVR4o8otn7BhiMbx0DKXjbACg0Q/7
eFszV94mH6tFySIRNEuMFiM=
=3UBi
-----END PGP SIGNATURE-----

Re: mime_decode-1 file utility failed

Brian McCullough — 2012-04-10T15:03:01

I seem to remember this as an old issue, from a year or more ago.

If I remember correctly, different versions of "file" produced different output, and, perhaps, had different parameters, and the script did not handle that very well.


Hope this helps you get a bit further down the path.


Brian

mime_decode-1 file utility failed

Torben Dam Jensen — 2012-04-10T08:57:09

I seem to have trouble with the /usr/bin/file utility, and simple can 
not grasp why. This is a brand new installation, everything latest build.

I run maia/avavis-new.
The mail will go through but I end up with lots of attachments in the 
amavis folder.

Apr  9 09:38:42 mail amavis[24972]: (24972-04) TROUBLE in check_mail: 
mime_decode-1 FAILED: 'file' utility (/usr/bin/file) failed, exit 1 at 
(eval 99) line 160.
Apr  9 09:38:42 mail amavis[24972]: (24972-04) PRESERVING EVIDENCE in 
/var/lib/amavis/tmp/amavis-20120409T080514-24972
Apr  9 09:38:42 mail postfix/smtp[26224]: 9A33E10AA290: 
to=<user-9IKiO1iGCm/QT0dZR+AlfA< at >public.gmane.org>, relay=127.0.0.1[127.0.0.1]:10024, delay=433116, 
delays=433115/0/0/1.3, dsn=4.5.0, status=deferred (host 
127.0.0.1[127.0.0.1] said: 451 4.5.0 Error in processing, id=24972-04, 
mime_decode-1 FAILED: 'file' utility (/usr/bin/file) failed, exit 1 at 
(eval 99) line 160. (in reply to end of DATA command)

"file" version is 5.03, and can be executed by amavis.
root< at >mail:/var/www/maia# su amavis
$ /usr/bin/file -v
file-5.03
magic file from /etc/magic:/usr/share/misc/magic

I can not figure out where in the amavisd-new.pl script the issue is.

Anyone know what the problem is ?

Thanks.

Re: process-quarantine.pl: Segementation fault

Alan Murrell — 2012-04-10T01:57:34

Quoting "Aaron Bennett" <abennett-AvQt5fSem9M3uPMLIKxrzw< at >public.gmane.org>:

I ran it with the following:

   /bin/su maia -c '/var/lib/maia/scripts/process-quarantine.pl  
--log-level=4 --learn --report'

It still gave a Segemntation Fault, of course, the log file was full  
of entries like:

2012-04-09 18:53:28 [32709] Processing email 6175, type SPAM, score  
38.496, autolearn = 'spam'
2012-04-09 18:53:28 [32718] Learned mail item 6136 as spam and reported it
2012-04-09 18:53:28 [32718] Processing email 6149, type SPAM, score  
33.105, autolearn = 'spam'
2012-04-09 18:53:28 [32715] Learned mail item 6157 as spam and reported it

so it looks like it *is* processing, but still no indication what the  
segmentation fault is.  Does that seem about right?

-Alan

Re: process-quarantine.pl: Segementation fault

Aaron Bennett — 2012-04-09T19:50:15

You might want to try running it manually with --debug all on the command line.

From: maia-users-bounces-fBBSUI5vRLiWd6l5hS35sQ< at >public.gmane.org [mailto:maia-users-bounces< at >renaissoft.com] On Behalf Of Lists
Sent: Wednesday, April 04, 2012 11:39 AM
To: maia-users-fBBSUI5vRLiWd6l5hS35sQ< at >public.gmane.org
Subject: [Maia-users] process-quarantine.pl: Segementation fault

Hi all,

I am running Maia v1.0.3 (svn 1575) on Debian 6.0.4.  I have emails from cron when running the "process-quaratnine.pl --learn --report" job; it says "Segmentation fault".

I have run the job from the shell as the maia user and it still gives the Segementation fault (I figured it would, but felt it was worth trying).  There is no core dump.

I saw a similar post in the archives, but it was for FreeBSD and had something to do with the libc version.  It turned out to be a benign error as the script still ran successfully.  I am wondering if it may be the same thng here?  Perhaps a benign error?

I ran the script again through strace hoping there would be something obvious.  There are a number of " ENOENT (No such file or directory)" entires for various files, but I am not sure if that is normal.  I can post a link tot he strace output, if that would help?

Please advise.  Thanks! :-)

-Alan

_______________________________________________
Maia-users mailing list
Maia-users-fBBSUI5vRLiWd6l5hS35sQ< at >public.gmane.org
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users

process-quarantine.pl: Segementation fault

Lists — 2012-04-04T15:38:48

Hi all,
 
I am running Maia v1.0.3 (svn 1575) on Debian 6.0.4.  I have emails from cron when running the "process-quaratnine.pl --learn --report" job; it says "Segmentation fault".
 
I have run the job from the shell as the maia user and it still gives the Segementation fault (I figured it would, but felt it was worth trying).  There is no core dump.
 
I saw a similar post in the archives, but it was for FreeBSD and had something to do with the libc version.  It turned out to be a benign error as the script still ran successfully.  I am wondering if it may be the same thng here?  Perhaps a benign error?
 
I ran the script again through strace hoping there would be something obvious.  There are a number of " ENOENT (No such file or directory)" entires for various files, but I am not sure if that is normal.  I can post a link tot he strace output, if that would help?
 
Please advise.  Thanks! :-)
 
-Alan
 
 
 
_______________________________________________
Maia-users mailing list
Maia-users-fBBSUI5vRLiWd6l5hS35sQ< at >public.gmane.org
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users