assp-user Mailing List for Anti-Spam SMTP Proxy Server

Hi,

I've just installed ASSP-0.1.5 on a RedHat 6.2 Linux machine. I have another
machine already configured to serve mail, so I configured my client to
communicate through ASSP for testing. I cannot pop my mail directly through
ASSP, however, I can't send mail through it (it is configured to use my
sendmail-based mail server). My client is Outlook and it's error messages
aren't very helpful. Any suggestions on how I can debug this?

Thanks,
Jonathan

Hmmm... ok. i'll look at it.

j
----- Original Message -----
From: "Rainer Schuetz" <ass...@ra...>
To: <ass...@li...>
Sent: Thursday, March 27, 2003 2:30 PM
Subject: [Assp-user] Bug in 0.1.5




Hey John,

thanks for all your work and efforts!
Unfortunately 0.1.5 doesn't write the header line /all/ the time but only
sometimes?
Is there any logic I don't understand? In my mind a Received:-line has to be
on /every/ mail - equal if friend or enemy.

I sent this mail through a proxy server to myself. There is only one
received line
Received: from ws2 (10.0.1.2) by rs4u.com (Mercury/32 v3.32) with ESMTP ID
MG000024;
   27 Mar 03 22:03:29 +0100


Here's the connection log from my server:
T 20030327 220824 3e833d71 Connection from 10.0.1.2
T 20030327 220824 3e833d71 NOOP Connection from: 216.127.90.77, 27 Mar 03
21:08:24 -0000 relayed by ASSP-nospam
T 20030327 220824 3e833d71 HELO ws2
T 20030327 220824 3e833d71 MAIL FROM: <[deleted by me]>
T 20030327 220825 3e833d71 RCPT TO: <[deleted by me]>
T 20030327 220831 3e833d71 DATA - 31 lines, 796 bytes.
T 20030327 220832 3e833d71 QUIT
T 20030327 220832 3e833d71 Connection closed with 10.0.1.2, 8 sec. elapsed.


You rewrote the whole script and now it's much more compact but also much
more complex and I don't understand what you do when :-(. Would you pls.
have a look and correct that? I think a header should be in /every/ mail.



Thanks in advance, Rainer



> -----Original Message-----
> From: ass...@li...
> [mailto:ass...@li...]On Behalf Of John Hanna
> Sent: Thursday, March 27, 2003 7:20 PM
> To: ass...@li...
> Subject: [Assp-user] 0.1.5 is now available
>
>
> ASSP 0.1.5 is now available for download from
>
> http://prdownloads.sourceforge.net/assp/assp-0.1.5.zip?download
>
> This includes the long-awaited fix for pipeline-caused "354 Send data
> followed by CRLF.CRLF" errors and suggestions from Rainer. (Thanks,
Rainer!)
>
> So maybe now I can get on with the nifty new web configuration interface
and
> other cool stuff -- Look for that later in April.
>
> Note that this version is actually shorter and more effecient than the
> pervious version.
>
> As far as I know all communication-related bugs are resolved. If after
> upgrading you are still getting 354 "CRLF.CRLF" errors or "Bare LF"
errors,
> or any other strange behavior, please enable the $DEBUG=1 line in your
> config.pl file, and email me the .dbg file together with a detailed
> description of the error. I will only accept bug reports for version
0.1.5.
>
> Upgrading is easy -- replace your assp.pl with the new one and restart the
> service / process.
>
> If you're running CHROOT and find you need other perl modules, please let
me
> know and I'll add them to the documentation for that section.
>
> Enjoy,
> John
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by:
> The Definitive IT and Networking Event. Be There!
> NetWorld+Interop Las Vegas 2003 -- Register today!
> http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en
> _______________________________________________
> Assp-user mailing list
> Ass...@li...
> https://lists.sourceforge.net/lists/listinfo/assp-user
>

Enhancement/Feature RequestHi, Jonathan. I've added this to my list of =
things to do. It's a useful feature.

john
  ----- Original Message -----=20
  From: Jonathan Copeland=20
  To: ass...@li...=20
  Sent: Thursday, March 27, 2003 3:17 PM
  Subject: [Assp-user] Enhancement/Feature Request


  Is there any way to add a who domain to either the Whitelist or to the =
Redlist?  I have a number of companies that send me email using =
commercial remailers (such as XMR3.COM) that I need to get the email =
from.  I have tried to add this domain using the

  Perl list.pl +...@xm...=20
  command.   But it continually does not allow it.  I also receive email =
from various individuals at supplier companies and have a need to accept =
all mail from them.  For instance eve...@ci... or =
an...@mi...=20

  I don't have a huge grasp of perl so I am not sure if this needs to be =
fixed in the assp.pl file or in the list.pl file.  It would be logical =
to just fix the list.pl file as it is the one that adds to the redlist =
and whitelist.  But this would only work if the assp.pl file is able to =
handle @xmr3.com domain by itself or the @cisco.com or the =
@microsoft.com domains.  If this was done it would eliminate much of the =
time-consuming editing of the whitelist or redlist manually.  One entry =
for a trusted domain and everyone is included.

  Thanks,=20

  Jonathan Copeland=20

Is there any way to add a who domain to either the Whitelist or to the
Redlist?  I have a number of companies that send me email using
commercial remailers (such as XMR3.COM) that I need to get the email
from.  I have tried to add this domain using the
Perl list.pl +...@xm...=20
command.   But it continually does not allow it.  I also receive email
from various individuals at supplier companies and have a need to accept
all mail from them.  For instance eve...@ci... or
an...@mi...=20

I don't have a huge grasp of perl so I am not sure if this needs to be
fixed in the assp.pl file or in the list.pl file.  It would be logical
to just fix the list.pl file as it is the one that adds to the redlist
and whitelist.  But this would only work if the assp.pl file is able to
handle @xmr3.com domain by itself or the @cisco.com or the
@microsoft.com domains.  If this was done it would eliminate much of the
time-consuming editing of the whitelist or redlist manually.  One entry
for a trusted domain and everyone is included.

Thanks,

Jonathan Copeland

Hi, Mike. I probably need a little more information to figure what's wrong.

Is this your configuration:
Your client connects to ASSP on port 25; ASSP connects to your mail server
on port 125.

When the "connection was refused" did it give the message, "Relaying not
allowed"? If so, you need to edit your configuration file to allow your
client's ip address to relay mail through ASSP, or you might need to tell
your mail server to allow mail relaying from ASSP.

I hope that helps.
john



----- Original Message -----
From: "Mike Cooper" <mi...@co...>
To: <jh...@cp...>
Sent: Thursday, March 27, 2003 1:17 PM
Subject: Help


> Hi
>
>     Hope you can help me. I have installed the assp program and having a
> problem sending mail.  I have switched the smtp port to 125 and start
> the assp.  I can send mail locally but when I try to send it outside the
> company it stays in the mail que with a message stating that the
> connection was refused.  I then stopped the assp program switched back
> to port 25 for  smtp restart sendmail and the mail goes to the person I
> was trying to send.
>
>     If you could shed any light on this it would be greatly appreciated.
>
> Thank You
>
> --
> Michael Cooper
> Network Administrator
> mi...@co...
>
>
> IMPORTANT: THIS E-MAIL MESSAGE IS INTENDED ONLY FOR THE USE OF THE
> INDIVIDUAL OR
> ENTITY TO WHICH IT IS ADDRESSED AND MAY CONTAIN INFORMATION THAT IS
> PRIVILEGED,
> CONFIDENTIAL AND EXEMPT FROM DISCLOSURE UNDER APPLICABLE LAW.
>
> If the reader of this e-mail message is not the intended recipient, or
> the employee or agent responsible for delivering the message to the
> intended recipient, you are hereby notified that any dissemination,
> distribution or copying of this e-mail message is strictly prohibited.
> If you have received this e-mail message in error, please immediately
> notify the IS Department
> of Consac Industries, Inc. by calling (631) 232-5400 and delete or
> otherwise discard the original message and all copies thereof.
>
>
>

Hey John,

thanks for all your work and efforts!
Unfortunately 0.1.5 doesn't write the header line /all/ the time but =
only sometimes?
Is there any logic I don't understand? In my mind a Received:-line has =
to be on /every/ mail - equal if friend or enemy.

I sent this mail through a proxy server to myself. There is only one =
received line=20
Received: from ws2 (10.0.1.2) by rs4u.com (Mercury/32 v3.32) with ESMTP =
ID MG000024;
   27 Mar 03 22:03:29 +0100


Here's the connection log from my server:
T 20030327 220824 3e833d71 Connection from 10.0.1.2
T 20030327 220824 3e833d71 NOOP Connection from: 216.127.90.77, 27 Mar =
03 21:08:24 -0000 relayed by ASSP-nospam
T 20030327 220824 3e833d71 HELO ws2
T 20030327 220824 3e833d71 MAIL FROM: <[deleted by me]>
T 20030327 220825 3e833d71 RCPT TO: <[deleted by me]>
T 20030327 220831 3e833d71 DATA - 31 lines, 796 bytes.
T 20030327 220832 3e833d71 QUIT
T 20030327 220832 3e833d71 Connection closed with 10.0.1.2, 8 sec. =
elapsed.


You rewrote the whole script and now it's much more compact but also =
much more complex and I don't understand what you do when :-(. Would you =
pls. have a look and correct that? I think a header should be in /every/ =
mail.



Thanks in advance, Rainer



> -----Original Message-----
> From: ass...@li...
> [mailto:ass...@li...]On Behalf Of John Hanna
> Sent: Thursday, March 27, 2003 7:20 PM
> To: ass...@li...
> Subject: [Assp-user] 0.1.5 is now available
>=20
>=20
> ASSP 0.1.5 is now available for download from
>=20
> http://prdownloads.sourceforge.net/assp/assp-0.1.5.zip?download
>=20
> This includes the long-awaited fix for pipeline-caused "354 Send data
> followed by CRLF.CRLF" errors and suggestions from Rainer. (Thanks, =
Rainer!)
>=20
> So maybe now I can get on with the nifty new web configuration =
interface and
> other cool stuff -- Look for that later in April.
>=20
> Note that this version is actually shorter and more effecient than the
> pervious version.
>=20
> As far as I know all communication-related bugs are resolved. If after
> upgrading you are still getting 354 "CRLF.CRLF" errors or "Bare LF" =
errors,
> or any other strange behavior, please enable the $DEBUG=3D1 line in =
your
> config.pl file, and email me the .dbg file together with a detailed
> description of the error. I will only accept bug reports for version =
0.1.5.
>=20
> Upgrading is easy -- replace your assp.pl with the new one and restart =
the
> service / process.
>=20
> If you're running CHROOT and find you need other perl modules, please =
let me
> know and I'll add them to the documentation for that section.
>=20
> Enjoy,
> John
>=20
>=20
>=20
> -------------------------------------------------------
> This SF.net email is sponsored by:
> The Definitive IT and Networking Event. Be There!
> NetWorld+Interop Las Vegas 2003 -- Register today!
> http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en
> _______________________________________________
> Assp-user mailing list
> Ass...@li...
> https://lists.sourceforge.net/lists/listinfo/assp-user
>=20

ASSP 0.1.5 is now available for download from

http://prdownloads.sourceforge.net/assp/assp-0.1.5.zip?download

This includes the long-awaited fix for pipeline-caused "354 Send data
followed by CRLF.CRLF" errors and suggestions from Rainer. (Thanks, Rainer!)

So maybe now I can get on with the nifty new web configuration interface and
other cool stuff -- Look for that later in April.

Note that this version is actually shorter and more effecient than the
pervious version.

As far as I know all communication-related bugs are resolved. If after
upgrading you are still getting 354 "CRLF.CRLF" errors or "Bare LF" errors,
or any other strange behavior, please enable the $DEBUG=1 line in your
config.pl file, and email me the .dbg file together with a detailed
description of the error. I will only accept bug reports for version 0.1.5.

Upgrading is easy -- replace your assp.pl with the new one and restart the
service / process.

If you're running CHROOT and find you need other perl modules, please let me
know and I'll add them to the documentation for that section.

Enjoy,
John

Hey, John,

everything okay at home again?

Thanks for putting my little 0.02$ into the program.
Would you add the Header part too, pls? Its almost more important =
because the header is where I look in first.
It's in my mail of 2003/03/16.


Thanks, Rainer

> -----Original Message-----
> From: ass...@li...
> [mailto:ass...@li...]On Behalf Of John Hanna
> Sent: Thursday, March 27, 2003 5:43 PM
> To: ass...@li...
> Subject: Re: [Assp-user] SMTP-logfile / Mailheaders (was: RE:
> [Assp-user] ASSP and source ip in headers)
>=20
>=20
> Rainer, Thanks. This is a good idea for servers that log NOOPs. I'm
> including it in the 0.1.5 release which should be out later today.
>=20
> john
> ----- Original Message -----
> From: "Rainer Schuetz" <ass...@ra...>
> To: <ass...@li...>
> Sent: Tuesday, March 25, 2003 12:22 AM
> Subject: FW: [Assp-user] SMTP-logfile / Mailheaders (was: RE: =
[Assp-user]
> ASSP and source ip in headers)
>=20
>=20
>=20
> Hi Eric,
>=20
> wow, I thought I made the whole work only for myself....
> (Okay, that's what I actually did ;-) but I'd be happy if it could =
have been
> useful for others.)
>=20
> Here's the original mail.
>=20
> /Don't forget to adapt the path to config.pl in line 16!!!/
>=20
>=20
>=20
> Have a nice day, Rainer
>=20
>=20
>=20
> -----Original Message-----
> From: Rainer [mailto:ass...@ra...]
> Sent: Monday, March 17, 2003 9:47 AM
> To: ass...@li...
> Subject: RE: [Assp-user] SMTP-logfile / Mailheaders
>=20
>=20
>=20
> Hi list, hi John,
>=20
> here's another enhancement:
> it writes a line "NOOP Connection from: x.x.x.x, 17 Mar 03 00:29:16 =
-0000
> relayed by ASSP-nospam" to the server(logs) before the EHLO/HELO =
command. It
> also handles the unexpected "250 OK" response to that command =
(shouldn't be
> seen by client).
> The readability of the logfiles is nearly as w/o ASSP. See example =
below.
>=20
> This enhancement is fully RFC compliant as it uses the NOOP command.
>=20
>=20
>=20
> The additions are on line(s) 267-282, 284, 319, 320 and 486-494. I =
marked
> these lines with "##rsc2" at the end of the line(s).
>=20
>=20
>=20
> All the best to you,
>=20
> Rainer
>=20
>=20
>=20
> P.S. John, please please add that too :-)
> Feedback again welcome.
>=20
>=20
>=20
>=20
>=20
>=20
> Example:
> old:  --> you have /no/ chance to find out who was that (except with =
my
> first enhancement) as maillog.txt only logs received mails, not trials
> T 20030317 012916 3e746cfe Connection from 127.0.0.1
> T 20030317 012916 3e746cfe EHLO client
> T 20030317 012916 3e746cfe MAIL FROM: <badspammer@youdon'tseemyIP.com>
> T 20030317 012916 3e746cfe RCPT TO: <un...@wh...>
> E 20030317 012917 3e746cfe 550 5.7.1 <un...@wh...>... =
Relaying
> denied.
> .
> .
> .
> T 20030317 012917 3e746cfe RSET
> T 20030317 012917 3e746cfe QUIT
>=20
> new: IP address of offender is logged directly
> T 20030317 012916 3e746cfe Connection from 127.0.0.1
> T 20030317 012916 3e746cfe NOOP Connection from: 217.162.76.7, 17 Mar =
03
> 00:29:16 -0000     relayed by ASSP-nospam
> T 20030317 012916 3e746cfe EHLO client
> T 20030317 012916 3e746cfe MAIL FROM: <badspammer@youdon'tseemyIP.com>
> T 20030317 012916 3e746cfe RCPT TO: <un...@wh...>
> E 20030317 012917 3e746cfe 550 5.7.1 <un...@wh...>... =
Relaying
> denied..
> .
> .
> T 20030317 012917 3e746cfe RSET
> T 20030317 012917 3e746cfe QUIT
>=20
>=20
> > -----Original Message-----
> > From: ass...@li...
> > [mailto:ass...@li...]On Behalf Of Eric
> > Appelboom
> > Sent: Tuesday, March 25, 2003 7:30 AM
> > To: ass...@li...
> > Subject: [Assp-user] ASSP and source ip in headers
> >
> >
> > Hi all,
> >
> > Rainer could you post your assp.pl again I didn't see it in =
archives.
> >
> > Could someone help to customise the assp.pl and config.pl just to =
accept
> > a connection and forward to a mailserver
> > Just adding the source ip in headers and keeping current headers.
> >
> > We have a upstream mail proxy (Trend VirusWall) that removes the =
last
> > header thus it removes the origional ip of the mail sender.
> > This makes it a bit difficult when dealing with spam complaints.
> >
> > We are not interested at actually blocking spam or doing any =
filtering
> > just to stamp mail and forward without any disk i/o
> > Involvement so now queues can develop on filesystem.
> >
> > Help pretty please?
> >
> > Eric
> > (South Africa)
> >
> >
> > -------------------------------------------------------
> > This SF.net email is sponsored by:
> > The Definitive IT and Networking Event. Be There!
> > NetWorld+Interop Las Vegas 2003 -- Register today!
> > http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en
> > _______________________________________________
> > Assp-user mailing list
> > Ass...@li...
> > https://lists.sourceforge.net/lists/listinfo/assp-user
> >
>=20
>=20
>=20
> -------------------------------------------------------
> This SF.net email is sponsored by:
> The Definitive IT and Networking Event. Be There!
> NetWorld+Interop Las Vegas 2003 -- Register today!
> http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en
> _______________________________________________
> Assp-user mailing list
> Ass...@li...
> https://lists.sourceforge.net/lists/listinfo/assp-user
>=20

just wait -- the new release will be up in about an hour.

j
----- Original Message -----
From: "Don Wright" <dew...@mc...>
To: <ass...@li...>
Sent: Wednesday, March 26, 2003 6:31 PM
Subject: Re: [Assp-user] I know what the 354 OK, send data, end with
CRLF.CRLF bug is now


> any idea on how to do this in Exchange?
> ----- Original Message -----
> From: "John Hanna" <jh...@cp...>
> To: <ass...@li...>
> Sent: Wednesday, March 26, 2003 4:50 PM
> Subject: [Assp-user] I know what the 354 OK, send data, end with CRLF.CRLF
> bug is now
>
>
> > Thanks to so many who have written with debug info on the following
error:
> >  354 OK, send data, end with CRLF.CRLF
> >
> > It turns out it is a pipelining error -- ASSP is itercepting the DATA
> > portion of the message before the server response from MAIL From and
RCPT
> TO
> > have been delivered -- they're stuck in the pipeline.
> >
> > I'm working on a fix, but in the meantime if you disable pipelining for
> your
> > smtp server the error will go away.
> >
> > John
> >
> >
> >
> > -------------------------------------------------------
> > This SF.net email is sponsored by:
> > The Definitive IT and Networking Event. Be There!
> > NetWorld+Interop Las Vegas 2003 -- Register today!
> > http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en
> > _______________________________________________
> > Assp-user mailing list
> > Ass...@li...
> > https://lists.sourceforge.net/lists/listinfo/assp-user
> >
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by:
> The Definitive IT and Networking Event. Be There!
> NetWorld+Interop Las Vegas 2003 -- Register today!
> http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en
> _______________________________________________
> Assp-user mailing list
> Ass...@li...
> https://lists.sourceforge.net/lists/listinfo/assp-user
>

Rainer, Thanks. This is a good idea for servers that log NOOPs. I'm
including it in the 0.1.5 release which should be out later today.

john
----- Original Message -----
From: "Rainer Schuetz" <ass...@ra...>
To: <ass...@li...>
Sent: Tuesday, March 25, 2003 12:22 AM
Subject: FW: [Assp-user] SMTP-logfile / Mailheaders (was: RE: [Assp-user]
ASSP and source ip in headers)



Hi Eric,

wow, I thought I made the whole work only for myself....
(Okay, that's what I actually did ;-) but I'd be happy if it could have been
useful for others.)

Here's the original mail.

/Don't forget to adapt the path to config.pl in line 16!!!/



Have a nice day, Rainer



-----Original Message-----
From: Rainer [mailto:ass...@ra...]
Sent: Monday, March 17, 2003 9:47 AM
To: ass...@li...
Subject: RE: [Assp-user] SMTP-logfile / Mailheaders



Hi list, hi John,

here's another enhancement:
it writes a line "NOOP Connection from: x.x.x.x, 17 Mar 03 00:29:16 -0000
relayed by ASSP-nospam" to the server(logs) before the EHLO/HELO command. It
also handles the unexpected "250 OK" response to that command (shouldn't be
seen by client).
The readability of the logfiles is nearly as w/o ASSP. See example below.

This enhancement is fully RFC compliant as it uses the NOOP command.



The additions are on line(s) 267-282, 284, 319, 320 and 486-494. I marked
these lines with "##rsc2" at the end of the line(s).



All the best to you,

Rainer



P.S. John, please please add that too :-)
Feedback again welcome.






Example:
old:  --> you have /no/ chance to find out who was that (except with my
first enhancement) as maillog.txt only logs received mails, not trials
T 20030317 012916 3e746cfe Connection from 127.0.0.1
T 20030317 012916 3e746cfe EHLO client
T 20030317 012916 3e746cfe MAIL FROM: <badspammer@youdon'tseemyIP.com>
T 20030317 012916 3e746cfe RCPT TO: <un...@wh...>
E 20030317 012917 3e746cfe 550 5.7.1 <un...@wh...>... Relaying
denied.
.
.
.
T 20030317 012917 3e746cfe RSET
T 20030317 012917 3e746cfe QUIT

new: IP address of offender is logged directly
T 20030317 012916 3e746cfe Connection from 127.0.0.1
T 20030317 012916 3e746cfe NOOP Connection from: 217.162.76.7, 17 Mar 03
00:29:16 -0000     relayed by ASSP-nospam
T 20030317 012916 3e746cfe EHLO client
T 20030317 012916 3e746cfe MAIL FROM: <badspammer@youdon'tseemyIP.com>
T 20030317 012916 3e746cfe RCPT TO: <un...@wh...>
E 20030317 012917 3e746cfe 550 5.7.1 <un...@wh...>... Relaying
denied..
.
.
T 20030317 012917 3e746cfe RSET
T 20030317 012917 3e746cfe QUIT


> -----Original Message-----
> From: ass...@li...
> [mailto:ass...@li...]On Behalf Of Eric
> Appelboom
> Sent: Tuesday, March 25, 2003 7:30 AM
> To: ass...@li...
> Subject: [Assp-user] ASSP and source ip in headers
>
>
> Hi all,
>
> Rainer could you post your assp.pl again I didn't see it in archives.
>
> Could someone help to customise the assp.pl and config.pl just to accept
> a connection and forward to a mailserver
> Just adding the source ip in headers and keeping current headers.
>
> We have a upstream mail proxy (Trend VirusWall) that removes the last
> header thus it removes the origional ip of the mail sender.
> This makes it a bit difficult when dealing with spam complaints.
>
> We are not interested at actually blocking spam or doing any filtering
> just to stamp mail and forward without any disk i/o
> Involvement so now queues can develop on filesystem.
>
> Help pretty please?
>
> Eric
> (South Africa)
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by:
> The Definitive IT and Networking Event. Be There!
> NetWorld+Interop Las Vegas 2003 -- Register today!
> http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en
> _______________________________________________
> Assp-user mailing list
> Ass...@li...
> https://lists.sourceforge.net/lists/listinfo/assp-user
>

any idea on how to do this in Exchange?
----- Original Message -----
From: "John Hanna" <jh...@cp...>
To: <ass...@li...>
Sent: Wednesday, March 26, 2003 4:50 PM
Subject: [Assp-user] I know what the 354 OK, send data, end with CRLF.CRLF
bug is now


> Thanks to so many who have written with debug info on the following error:
>  354 OK, send data, end with CRLF.CRLF
>
> It turns out it is a pipelining error -- ASSP is itercepting the DATA
> portion of the message before the server response from MAIL From and RCPT
TO
> have been delivered -- they're stuck in the pipeline.
>
> I'm working on a fix, but in the meantime if you disable pipelining for
your
> smtp server the error will go away.
>
> John
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by:
> The Definitive IT and Networking Event. Be There!
> NetWorld+Interop Las Vegas 2003 -- Register today!
> http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en
> _______________________________________________
> Assp-user mailing list
> Ass...@li...
> https://lists.sourceforge.net/lists/listinfo/assp-user
>

Thanks to so many who have written with debug info on the following error:
 354 OK, send data, end with CRLF.CRLF

It turns out it is a pipelining error -- ASSP is itercepting the DATA
portion of the message before the server response from MAIL From and RCPT TO
have been delivered -- they're stuck in the pipeline.

I'm working on a fix, but in the meantime if you disable pipelining for your
smtp server the error will go away.

John

Hi Eric,

wow, I thought I made the whole work only for myself....
(Okay, that's what I actually did ;-) but I'd be happy if it could have =
been useful for others.)

Here's the original mail.=20

/Don't forget to adapt the path to config.pl in line 16!!!/



Have a nice day, Rainer



-----Original Message-----
From: Rainer [mailto:ass...@ra...]
Sent: Monday, March 17, 2003 9:47 AM
To: ass...@li...
Subject: RE: [Assp-user] SMTP-logfile / Mailheaders



Hi list, hi John,

here's another enhancement:
it writes a line "NOOP Connection from: x.x.x.x, 17 Mar 03 00:29:16 =
-0000     relayed by ASSP-nospam" to the server(logs) before the =
EHLO/HELO command. It also handles the unexpected "250 OK" response to =
that command (shouldn't be seen by client).
The readability of the logfiles is nearly as w/o ASSP. See example =
below.

This enhancement is fully RFC compliant as it uses the NOOP command.=20



The additions are on line(s) 267-282, 284, 319, 320 and 486-494. I =
marked these lines with "##rsc2" at the end of the line(s).



All the best to you,

Rainer



P.S. John, please please add that too :-)
	Feedback again welcome.






Example:
old:  --> you have /no/ chance to find out who was that (except with my =
first enhancement) as maillog.txt only logs received mails, not trials=20
T 20030317 012916 3e746cfe Connection from 127.0.0.1
T 20030317 012916 3e746cfe EHLO client
T 20030317 012916 3e746cfe MAIL FROM: <badspammer@youdon'tseemyIP.com>
T 20030317 012916 3e746cfe RCPT TO: <un...@wh...>
E 20030317 012917 3e746cfe 550 5.7.1 <un...@wh...>... Relaying =
denied.
.
.
.
T 20030317 012917 3e746cfe RSET
T 20030317 012917 3e746cfe QUIT

new: IP address of offender is logged directly
T 20030317 012916 3e746cfe Connection from 127.0.0.1
T 20030317 012916 3e746cfe NOOP Connection from: 217.162.76.7, 17 Mar 03 =
00:29:16 -0000     relayed by ASSP-nospam
T 20030317 012916 3e746cfe EHLO client
T 20030317 012916 3e746cfe MAIL FROM: <badspammer@youdon'tseemyIP.com>
T 20030317 012916 3e746cfe RCPT TO: <un...@wh...>
E 20030317 012917 3e746cfe 550 5.7.1 <un...@wh...>... Relaying =
denied..
.
.
T 20030317 012917 3e746cfe RSET
T 20030317 012917 3e746cfe QUIT


> -----Original Message-----
> From: ass...@li...
> [mailto:ass...@li...]On Behalf Of Eric
> Appelboom
> Sent: Tuesday, March 25, 2003 7:30 AM
> To: ass...@li...
> Subject: [Assp-user] ASSP and source ip in headers
>=20
>=20
> Hi all,
>=20
> Rainer could you post your assp.pl again I didn't see it in archives.
>=20
> Could someone help to customise the assp.pl and config.pl just to =
accept
> a connection and forward to a mailserver
> Just adding the source ip in headers and keeping current headers.
>=20
> We have a upstream mail proxy (Trend VirusWall) that removes the last
> header thus it removes the origional ip of the mail sender.
> This makes it a bit difficult when dealing with spam complaints.
>=20
> We are not interested at actually blocking spam or doing any filtering
> just to stamp mail and forward without any disk i/o
> Involvement so now queues can develop on filesystem.
>=20
> Help pretty please?
>=20
> Eric=20
> (South Africa)
>=20
>=20
> -------------------------------------------------------
> This SF.net email is sponsored by:
> The Definitive IT and Networking Event. Be There!
> NetWorld+Interop Las Vegas 2003 -- Register today!
> http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en
> _______________________________________________
> Assp-user mailing list
> Ass...@li...
> https://lists.sourceforge.net/lists/listinfo/assp-user
>=20

Hi all,

Rainer could you post your assp.pl again I didn't see it in archives.

Could someone help to customise the assp.pl and config.pl just to accept
a connection and forward to a mailserver
Just adding the source ip in headers and keeping current headers.

We have a upstream mail proxy (Trend VirusWall) that removes the last
header thus it removes the origional ip of the mail sender.
This makes it a bit difficult when dealing with spam complaints.

We are not interested at actually blocking spam or doing any filtering
just to stamp mail and forward without any disk i/o
Involvement so now queues can develop on filesystem.

Help pretty please?

Eric=20
(South Africa)

Hi all. Sorry i'm not able to do much with assp just now. My wife was 
sick, and now my kids are, and I'm Denver which was burried in nearly 
a meter of snow in 24 hours. Next week is their spring break from 
school, so I won't get caught up then either. Hopefully I'll have time 
to work on assp the week after that.

John

Hi list, hi John,

here's another enhancement:
it writes a line "NOOP Connection from: x.x.x.x, 17 Mar 03 00:29:16 =
-0000     relayed by ASSP-nospam" to the server(logs) before the =
EHLO/HELO command. It also handles the unexpected "250 OK" response to =
that command (shouldn't be seen by client).
The readability of the logfiles is nearly as w/o ASSP. See example =
below.

This enhancement is fully RFC compliant as it uses the NOOP command.=20



The additions are on line(s) 267-282, 284, 319, 320 and 486-494. I =
marked these lines with "##rsc2" at the end of the line(s).



All the best to you,

Rainer



P.S. John, please please add that too :-)
	Feedback again welcome.






Example:
old:  --> you have /no/ chance to find out who was that (except with my =
first enhancement) as maillog.txt only logs received mails, not trials=20
T 20030317 012916 3e746cfe Connection from 127.0.0.1
T 20030317 012916 3e746cfe EHLO client
T 20030317 012916 3e746cfe MAIL FROM: <badspammer@youdon'tseemyIP.com>
T 20030317 012916 3e746cfe RCPT TO: <un...@wh...>
E 20030317 012917 3e746cfe 550 5.7.1 <un...@wh...>... Relaying =
denied.
.
.
.
T 20030317 012917 3e746cfe RSET
T 20030317 012917 3e746cfe QUIT

new: IP address of offender is logged directly
T 20030317 012916 3e746cfe Connection from 127.0.0.1
T 20030317 012916 3e746cfe NOOP Connection from: 217.162.76.7, 17 Mar 03 =
00:29:16 -0000     relayed by ASSP-nospam
T 20030317 012916 3e746cfe EHLO client
T 20030317 012916 3e746cfe MAIL FROM: <badspammer@youdon'tseemyIP.com>
T 20030317 012916 3e746cfe RCPT TO: <un...@wh...>
E 20030317 012917 3e746cfe 550 5.7.1 <un...@wh...>... Relaying =
denied..
.
.
T 20030317 012917 3e746cfe RSET
T 20030317 012917 3e746cfe QUIT

Hi List, hi John,

Using ASSP as it was in v.1.4 means loss of evidence and control over =
logfiles of the SMTP server. If the other side forges the EHLE/HELO =
command I have no idea /who/ connected to me (especially if the other =
one only tries several RCPT TO:s but doesn't actually send mail). If you =
receive a mail you have to consult logfile of ASSP to find the =
corresponding IP and you have to forge the mailheader yourself to give =
the ab...@so... what they expect a mailheader to look like if =
you complain.

I hope you're not mad with me, but I fixed these issues.
Please find attached my assp.pl. Lines I added or changed are signed =
with "##rsc" at the end of the line.


New features:
add X-SpamProb in case of SPAM in TestMode --> done on line 684

add X-SpamProb on whitelisted mails too --> done on line 495; remove the =
"#" to enable=20

add connect-line to maillog.txt (Mar-16-03 18:41:53 Connected: =
x.x.x.x:PORT) --> done on lines 290 + 291

add Received:-line to mailheader (Received: from x.x.x.x (x.x.x.x) by =
ASSP-nospam ; 16 Mar 03 17:41:53 -0000) --> done on lines 300, 301, 595, =
596; remove the "#" on line 301 to write Received:-Line to maillog.txt =
too



Bugfix in Line 598    old:  $clint->{header}=3D'';    fixed:  =
$client->{header}=3D'';



PLEASE, dear John, please put these changes into the source so I don't =
have to patch every new version.



All the best to you,

Rainer


P.S. Feedback (positive/negative) welcome from everyone!!!

Hi. the header is only added for non-whitelist mails -- the mails without it
are either local or on the whitelist.

john
----- Original Message -----
From: "Rainer Schuetz" <ass...@ra...>
To: <ass...@li...>
Sent: Friday, March 14, 2003 4:20 AM
Subject: [Assp-user] ASSP 1.4 not 'marking' all mails



Hi community,

upgraded to 1.4 and had to notice that only about half the mail I receive
contains the "X-Assp-Spam-Prob:" header.
I couldn't see any rule that might follow (such as only small mails aren't
marked or so).

What might be the cause? Same at your site?


Thx in advance, Rainer



-------------------------------------------------------
This SF.net email is sponsored by:Crypto Challenge is now open!
Get cracking and register here for some mind boggling fun and
the chance of winning an Apple iPod:
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0031en
_______________________________________________
Assp-user mailing list
Ass...@li...
https://lists.sourceforge.net/lists/listinfo/assp-user

Hi community,

upgraded to 1.4 and had to notice that only about half the mail I =
receive contains the "X-Assp-Spam-Prob:" header.
I couldn't see any rule that might follow (such as only small mails =
aren't marked or so).

What might be the cause? Same at your site?


Thx in advance, Rainer

ASSP questions
  ----- Original Message -----=20
  From: Jonathan Copeland=20
  To: jh...@cp...=20
  Sent: Wednesday, March 12, 2003 12:18 PM
  Subject: ASSP questions


  Is there a way to turn off attachment blocking? =20

Yes -- simply comment out the lines in the config file like this:

#$badattach=3D&re(<<'EOT');
#content-\w+: .*\s+.*name\s*=3D\s*".*\.(exe|scr|pif|vbs|lnk|bat|com)"
#content-\w+: .*\s+.*name\s*=3D\s*.*\.(exe|scr|pif|vbs|lnk|bat|com)\s
#EOT


  I would like to allow executables through assp.  My antivirus checks =
all attachments.  As a techie there are times I need to send myself an =
executable from a client location and email is one of the easiest ways.

  I have read through the docs and through the email archives and =
through the forums.  I seem to have ASSP running on my server with =
Exchange.  ASSP is on port 25 and Exchange is on 125. =20

  Do I need to create an email box in Exchange for IMAP access to the =
reportspam mailbox? =20

Yes, you need to create the account, and then also manually move the =
messages (1 per file) to the errors/spam folder


  Or is this created in ASSP? =20
  Where do spam emails go so that I can search for false positives? =20


They go to the $spamlog folder from your config file

  What head does the ASSP server give when telnetted to? =20

It echos your mail server's 'head'
  Is anyone else using this with Exchange?=20

I think so, but I'm not sure -- Some folks have written about using ASSP =
with exchange -- the problem is that if mail clients send mail through =
exchange, they're not sending through smtp, but through exchange's file =
transfer protocol. This doesn't really work so well with ASSP.

  Is there a way to allow emails to be accepted from any address at a =
domain without adding each email sender to the whitelist?  I get email =
from several vendors and their reps and would like to make sure that I =
receive all emails from them.  Example *@microsoft.com  *@intel.com =
*@cisco.com etc...

If you did this it would open a possible door for spammers to exploit =
it, but it is a reasonable request. I'll try to add it to my "requested =
features" list.

  I think this could be a very useful feature. =20

  Does assp send out email.

No, ASSP proxies to a smtp server which should send the mail.

    Should I point my Exchange server's smtp connector to the assp =
daemon as a smart host.

This is one way to get assp working with exchange. I'll repeat my notes =
on that at the bottom of this message

    They are located on the same machine.  Does assp do DNS lookups for =
outbound email? =20

no. assp proxies to a smtp server which it expects to do that sort of =
thing.

  Seems most people are running this on *nix servers.=20

Many are. I'm using it with Mercury on Windows for about 6 months now.

  Thanks for listening to my ramblings.=20

  Jonathan Copeland=20



Here's the notes about using it with exchange:


John

----- Original Message -----=20
From: <jh...@cp...>
To: "FireAnt Support" <su...@fi...>
Cc: <ass...@li...>
Sent: Tuesday, March 11, 2003 5:11 PM
Subject: RE: assp with exchange?


> These are great questions. Since Exchange is more than just a smtp=20
> server there will be some issues here. But exchange is quite common,=20
> so you're not the only one with this question.
>=20
> The problem is that ASSP uses your outbound traffic in two ways: 1) it =

> builds the non-spam collection, and 2) builds the whitelist.
>=20
> There are two possible solutions.
>=20
> 1) Route your outgoing Exchange mail through another smtp server as a=20
> relay host. ASSP is attached to this relay. I don't like this solution =

> because it requires another service and another point of failure,=20
> however this solution preserves ASSP's features.
>=20
> 2) Attach ASSP to your Exchange interface and (a) manually build an=20
> extensive whitelist, and (b) manually build an extensive non-spam=20
> collection. Since whitelists also contribute to the non-spam=20
> collection once you've done this once it should suffice. However=20
> you'll need to continue to manually maintain the whitelist.=20
> Unfortunately, this is less than ideal as well.=20
>=20
> If anybody here is an exchange expert and has better suggestions, I'm=20
> eager to hear them!
>=20
> John
>=20

Is there a way to turn off attachment blocking? =20

I would like to allow executables through assp.  My antivirus checks all
attachments.  As a techie there are times I need to send myself an
executable from a client location and email is one of the easiest ways.

Thanks,

Jonathan Copeland

I have read through the docs and through the email archives and through
the forums.  I seem to have ASSP running on my server with Exchange.
ASSP is on port 25 and Exchange is on 125. =20
Do I need to create an email box in Exchange for IMAP access to the
reportspam mailbox? =20
Or is this created in ASSP? =20
Where do spam emails go so that I can search for false positives? =20
What head does the ASSP server give when telnetted to? =20

Is anyone else using this with Exchange?

Thanks

Jonathan Copeland

Thanks Henry. Perl 5.8 has a number of "features" which complicate things.
I'll add this to the documentation. You might also want to include a "use
bytes;" at the top of assp.pl -- that will be in the next release and it
removes some errors caused by unicode.

john
----- Original Message -----
From: "Henry B. Tindall, Jr." <hen...@ar...>
To: <jh...@cp...>
Sent: Friday, March 07, 2003 10:21 PM
Subject: ASSP problem.


> I ran across this problem:
>
> Can't locate utf8_heavy.pl in @INC (@INC contains:
> /usr/lib/perl5/5.8.0/i386-linux /usr/lib/perl5/5.8.0
> /usr/lib/perl5/site_perl/5.8.0/i386-linux /usr/lib/perl5/site_perl/5.8.0
> /usr/lib/perl5/site_perl .) at /usr/lib/perl5/5.8.0/utf8.pm line 17.
>
> The file IS really in /usr/lib/perl5/5.8.0, it just doesn't see it.  I
> created a usr/lib/perl5/5.8.0 under the chrooted home for assp
> (/usr/local/assp, as it happens on my system) and everything is
> copasetic.
> I had the same thing happen with utf8.pl, as well.
>
>
>
> Henry B. Tindall, Jr.
>   "Maybe Iraqis just manufacture their conventional weapons to a higher
> standard than we do, but I don't think so."  Colin Powell, US Secretary
> of State
>   "My parents just came back from a planet where the dominant lifeform
> had no bilateral symmetry, and all I got was this stupid F-Shirt."
>   "There are only 10 kinds of people: Those who understand binary and
> those who don't."
>   "It's perfectly fine to use the name of your pet or child as a
> password.  However, for the sake of security, make sure the names of all
> your pets and children contain several non-alphanumeric characters."  --
> Lore Sjöberg, brunching.com
>
>

Hi John,

thanks for your reply. Can't tell you what a BUSY mail admin will do with=
 all the mails that were logged ;-)
Hosting more than one domain I sometimes find some senders in the sendmai=
l logfile suspicious. Unfortunately I don't have the chance to look at th=
ese mails (from suspicious senders) cause they were not sent to me.

Logging all incoming mails in a "ring buffer" (as in version 0.1.3 spam/n=
otspam dirs) will greately help me to optimize my spamdb. I just did a "g=
rep" over the appropriate directories (spam/notspam) copying the mails ma=
tching into the errors/... directories.

Finally I want to let you know that ASSP helped me to greatly reduce the =
amount of spam hitting the mailboxes here!=20
Thank you very much!

Michael


> -----Urspr=FCngliche Nachricht-----
> Von: "John Hanna" <jh...@cp...>
> Gesendet: Monday, 03. March 2003 17:51
> An: <ass...@li...>
> Betreff: Re: [Assp-user] ASSP 0.1.4: Logging the notspam messages does =
not work properly (at least for me)
>=20
> This is intentional. I found that even a low level of false negatives c=
an
> tend over time to skew your non-spam database. I changed the code to al=
low
> only local and whitelisted mail into the non-spam collection. This mean=
s
> that your non-spam collection is guarenteed 100% nonspam (unless you ha=
ve
> local spammers). This also makes creating your nonspam collection worry
> free -- false negatives never get in your nonspam collection and
> (consequently) never need to be trimmed out.
>=20
> It\\'s on my list of things to do to create an optional third collectio=
n of
> probable-non-spam as a place to put mail which passed the bayesian test=
, but
> I haven\\'t got there yet. It\\'s also not clear what a busy mailadmin =
would do
> with this collection -- this is mail that was delivered and considered =
not
> spam -- one could look for spam in it and move it to the errors/spam fo=
lder
> to improve detection or look for list confirmation / amazon order
> confirmation type emails to add to the errors/notspam collection to hel=
p
> weight these mails. I think in most cases it\\'s simply ignored, and th=
at\\'s
> ok.
>=20
> John
> ----- Original Message -----
> From: <as...@cr...>
> To: <ass...@li...>
> Sent: Sunday, March 02, 2003 3:11 AM
> Subject: [Assp-user] ASSP 0.1.4: Logging the notspam messages does not =
work
> properly (at least for me)
>=20
>=20
> > Hi,
> >
> > I noticed that mails not classified as spam do not find their way int=
o
> > the "notspam" directory.
> > Mails classified as spam seem to be properly copied to the spam
> > directory.
> >
> > Any hints?
> >
> > Thank you,
> > Michael
> >
> >
> >
> > -------------------------------------------------------
> > This sf.net email is sponsored by:ThinkGeek
> > Welcome to geek heaven.
> > http://thinkgeek.com/sf
> > _______________________________________________
> > Assp-user mailing list
> > Ass...@li...
> > https://lists.sourceforge.net/lists/listinfo/assp-user
>=20
>=20
>=20
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Assp-user mailing list
> Ass...@li...
> https://lists.sourceforge.net/lists/listinfo/assp-user
>=20
>=20

Ok. Look at the beginning of rebuildspamdb.pl -- there is a line like 
'use bytes;' or like that. Copy that line and put it near the 
beginning of assp.pl. That should fix that. I'll add it to the next 
release. Activeperl 5.8 handles unicode differently than 5.6 does.

John

----Original Message-----
   >From:     	Don Wright <dw...@hd...>
   >To:         	John Hanna <jh...@cp...>
   >Cc:         	
   >Subj:     	AASP crashes
   >Reply To:     	
   >Sent:    	Tuesday, March 04, 2003 4:04 PM
   >
   >Malformed UTF-8 character (overflow at 0x78145e29, byte 0x66, 
after
   >start byte 0
   >xff) in substitution (s///) at assp.pl line 879.
   >Free to wrong pool 15d24d8 not 2c2c2c2c at assp.pl line 782.
   >This is the error I receive before it crashes.  Still not running 
as a
   >service though.  Command line only.  Not sure if thats the cause.
   >Thanks,
   >Don Wright
   >
   >	=20
   >
   >
   >