assp-user Mailing List for Anti-Spam SMTP Proxy Server

To MIS Manager,

1) Is Entourage configured for SMTP authentication? if not enable it on 
Kerio and Entourage.
2) ASSP is not a mail service, it is a proxy. It neither receives, nor 
delivers. It just sits in the middle of the mail client and mail server 
and listens in on the conversation.
3) See item 1 to resolve.

Using ASSP in a bypassed setup is pointless. It's like buying a car but 
not bothering to order an engine in it.

PS make sure Kerio doesn't have any tarpit or delaying configured as 
this will shutdown ASSP when it tries to connect.

Best of Luck

Peter


Elliot Wilen wrote:
> On Thursday, June 29, 2006 2:16 PM, MIS Manager <mis...@ps...> wrote:
>   
>> 1) Entourage tries to transmit the email
>> 2) ASSP picks up the transmission and tries to deliver it
>> 3) Kerio MailServer rejects it for being a bad address
>> 4) ASSP recieves the failure and does not complete the transaction with
>> Entourage
>> 5) Entourage thinks the message isn't sent
>>
>> Aside from configuring our clients to bypass ASSP for sending email (and
>> losing whitelist and notspam additions), is there anything I can change in
>> ASSP so that the mail server will think ASSP is the authenticated user and
>> accept the email (which Kerio Mailserver will then automatically bounce back
>> to my user's inbox) or does anyone have any suggestions for a
>> workaround?
>>     
>
> Perhaps I'm not understanding something, but have you tested the configuration that bypasses ASSP? If Kerio is rejecting the bad address with a 550, that's the same thing ASSP is doing via the Validate Local module. In other words I'd expect the same behavior even if the client is connecting directly to Kerio.
>
> --Elliot
>
>
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> Assp-user mailing list
> Ass...@li...
> https://lists.sourceforge.net/lists/listinfo/assp-user
>   

I think anything to reduce the JS and utilize CSS is a good idea.

If you'd like to take a crack at it - or point me to were I can find some example code, that would be great.

--
ME2   (wireless)

-----Original Message-----
From: "Lnet.com.ar" <in...@ln...>
Date: Friday, Jun 30, 2006 2:48 pm
Subject: Re: [Assp-user] Config webpages

Ohh ok, I see.

One quick question then, wouldn't be better for the implementation of the 
menu, instead of being done with JS to be done using CSS?
I mean by using/emulating "position:fixed".

I had to do several web apps, and I have been using this fixes without 
problem, In fact it is quite easy to do, all you have to do is to enclose 
the content in one div and the menu in another, and that's all of it.

http://tagsoup.com/-dev/null-/css/fixed/left/0-0-0
http://tagsoup.com/-dev/null-/css/fixed/


Other sources:
http://hem.fyristorg.com/g-force/test/fixedlayer.htm
http://www.cssplay.co.uk/layouts/fixed.html#
http://www.divinentd.com/experiments/emulating-position-fixed.html

REGARDS!

Javier Albinarrate


----- Original Message ----- 
From: "Micheal" <mi...@es...>
To: <ass...@li...>
Sent: Friday, June 30, 2006 3:03 PM
Subject: Re: [Assp-user] Config webpages


> I've noticed this behavior for quite a while. I've been planning on taking 
 a look at it when the beta functionality phases settle down.

> --
 ME2   (wireless)

> -----Original Message-----
 From: "Lnet.com.ar" <in...@ln...>
 Date: Friday, Jun 30, 2006 9:07 am
 Subject: [Assp-user] Config webpages

> Hi,

>        I have some issues, nothing serius but curious with the config
 webpages.
        If you turn off EnableFloatingMenu, then you start getting odd
 layouts.

>        For example, the content of the right at the infostats of maillog
 tail, starts BELLOW the level of the end of the menu. If you expand the
 menu, the content goes further bellow.

>        In the case of the maillog tail, the content is cut in two, and in
 fact some lines of log are not rendered... and you can only see them if 
 you
 mark the text in blue..

>        Odd right?
        I don't know if I can post a screenshot here or not.. but I am
 pretty sure that if you disable it, you will be able to see that by
 yourself.

>        This has been happening will all the version I tested, and I
 currently have 1.2.3(9)
        Regards!
 Javier Albinarrate

>
 Using Tomcat but need to do more? Need to support web services, security? 
 Get stuff done quickly with pre-integrated technology to make your job 
 easier Download IBM WebSphere Application Server v.1.0.1 based on Apache 
 Geronimo 
 http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
 _______________________________________________
 Assp-user mailing list
 Ass...@li...
 https://lists.sourceforge.net/lists/listinfo/assp-user

>

> Using Tomcat but need to do more? Need to support web services, security?
 Get stuff done quickly with pre-integrated technology to make your job 
 easier
 Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
 http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
 _______________________________________________
 Assp-user mailing list
 Ass...@li...
 https://lists.sourceforge.net/lists/listinfo/assp-user
 


Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Assp-user mailing list
Ass...@li...
https://lists.sourceforge.net/lists/listinfo/assp-user

Ohh ok, I see.

One quick question then, wouldn't be better for the implementation of the 
menu, instead of being done with JS to be done using CSS?
I mean by using/emulating "position:fixed".

I had to do several web apps, and I have been using this fixes without 
problem, In fact it is quite easy to do, all you have to do is to enclose 
the content in one div and the menu in another, and that's all of it.

http://tagsoup.com/-dev/null-/css/fixed/left/0-0-0
http://tagsoup.com/-dev/null-/css/fixed/


Other sources:
http://hem.fyristorg.com/g-force/test/fixedlayer.htm
http://www.cssplay.co.uk/layouts/fixed.html#
http://www.divinentd.com/experiments/emulating-position-fixed.html

REGARDS!

Javier Albinarrate


----- Original Message ----- 
From: "Micheal" <mi...@es...>
To: <ass...@li...>
Sent: Friday, June 30, 2006 3:03 PM
Subject: Re: [Assp-user] Config webpages


> I've noticed this behavior for quite a while. I've been planning on taking 
> a look at it when the beta functionality phases settle down.
>
> --
> ME2   (wireless)
>
> -----Original Message-----
> From: "Lnet.com.ar" <in...@ln...>
> Date: Friday, Jun 30, 2006 9:07 am
> Subject: [Assp-user] Config webpages
>
> Hi,
>
>        I have some issues, nothing serius but curious with the config
> webpages.
>        If you turn off EnableFloatingMenu, then you start getting odd
> layouts.
>
>        For example, the content of the right at the infostats of maillog
> tail, starts BELLOW the level of the end of the menu. If you expand the
> menu, the content goes further bellow.
>
>        In the case of the maillog tail, the content is cut in two, and in
> fact some lines of log are not rendered... and you can only see them if 
> you
> mark the text in blue..
>
>        Odd right?
>        I don't know if I can post a screenshot here or not.. but I am
> pretty sure that if you disable it, you will be able to see that by
> yourself.
>
>        This has been happening will all the version I tested, and I
> currently have 1.2.3(9)
>        Regards!
> Javier Albinarrate
>
>
> Using Tomcat but need to do more? Need to support web services, security? 
> Get stuff done quickly with pre-integrated technology to make your job 
> easier Download IBM WebSphere Application Server v.1.0.1 based on Apache 
> Geronimo 
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> Assp-user mailing list
> Ass...@li...
> https://lists.sourceforge.net/lists/listinfo/assp-user
>
>
>
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job 
> easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> Assp-user mailing list
> Ass...@li...
> https://lists.sourceforge.net/lists/listinfo/assp-user
> 

On Thursday, June 29, 2006 2:16 PM, MIS Manager <mis...@ps...> =
wrote:
>1) Entourage tries to transmit the email
>2) ASSP picks up the transmission and tries to deliver it
>3) Kerio MailServer rejects it for being a bad address
>4) ASSP recieves the failure and does not complete the transaction with
>Entourage
>5) Entourage thinks the message isn't sent
>
>Aside from configuring our clients to bypass ASSP for sending email (and
>losing whitelist and notspam additions), is there anything I can change =
in
>ASSP so that the mail server will think ASSP is the authenticated user =
and
>accept the email (which Kerio Mailserver will then automatically bounce =
back
>to my user's inbox) or does anyone have any suggestions for a
>workaround?

Perhaps I'm not understanding something, but have you tested the =
configuration that bypasses ASSP? If Kerio is rejecting the bad address =
with a 550, that's the same thing ASSP is doing via the Validate Local =
module. In other words I'd expect the same behavior even if the client is =
connecting directly to Kerio.

--Elliot

I've noticed this behavior for quite a while. I've been planning on taking a look at it when the beta functionality phases settle down.

--
ME2   (wireless)

-----Original Message-----
From: "Lnet.com.ar" <in...@ln...>
Date: Friday, Jun 30, 2006 9:07 am
Subject: [Assp-user] Config webpages

Hi,

        I have some issues, nothing serius but curious with the config 
webpages.
        If you turn off EnableFloatingMenu, then you start getting odd 
layouts.

        For example, the content of the right at the infostats of maillog 
tail, starts BELLOW the level of the end of the menu. If you expand the 
menu, the content goes further bellow.

        In the case of the maillog tail, the content is cut in two, and in 
fact some lines of log are not rendered... and you can only see them if you 
mark the text in blue..

        Odd right?
        I don't know if I can post a screenshot here or not.. but I am 
pretty sure that if you disable it, you will be able to see that by 
yourself.

        This has been happening will all the version I tested, and I 
currently have 1.2.3(9)
        Regards!
Javier Albinarrate 


Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Assp-user mailing list
Ass...@li...
https://lists.sourceforge.net/lists/listinfo/assp-user

check for matches againt the npRe. 

--
ME2   (wireless)

-----Original Message-----
From: Melvin Backus <mel...@eq...>
Date: Friday, Jun 30, 2006 7:07 am
Subject: [Assp-user] Odd mail getting through

I've got some odd mail that seems to get through ASSP untouched even though 
when I plug it into the analyzer it confirms that it should have been 
caught by my bombre.  The odd part is that there are no headers in the mail 
to indicate that it ever even went through ASSP.

I initially though that perhaps it was bypassing ASSP and going straight to 
the mail server, but that is only possible if it is sent from inside the 
firewall, and then only if they address it by IP directly.  OK, so going on 
that possibility I started checking, but the headers do indicate that it 
was received by the mail server from the machine running ASSP, so I've 
ruled that out.

Are there any mechanisms in ASSP that might allow the mail through this 

Hi,

        I have some issues, nothing serius but curious with the config 
webpages.
        If you turn off EnableFloatingMenu, then you start getting odd 
layouts.

        For example, the content of the right at the infostats of maillog 
tail, starts BELLOW the level of the end of the menu. If you expand the 
menu, the content goes further bellow.

        In the case of the maillog tail, the content is cut in two, and in 
fact some lines of log are not rendered... and you can only see them if you 
mark the text in blue..

        Odd right?
        I don't know if I can post a screenshot here or not.. but I am 
pretty sure that if you disable it, you will be able to see that by 
yourself.

        This has been happening will all the version I tested, and I 
currently have 1.2.3(9)
        Regards!
Javier Albinarrate 

At 09:19 AM 6/30/2006, you wrote:
> >
> > you should look in the log, if you can identify the messages there.
> > You should enable validation logging -> section validate
> > local addresses
> >
> >
>
>Also check the top received log on your mail server. Are you sure this
>email has gone through assp at all?
>
>Lars

This appears to be the log from that message.

    * Jun-29-06 22:24:02 Connected: 203.228.47.12:1657
    * Jun-29-06 22:24:02 PB: 203.228.47.12 score: 0+5 => 
5  reason:203.228.47.12:InvalidAddress
    * Jun-29-06 22:24:02 PB: 203.228.47.12 score: 5+50 => 55 
reason:203.228.47.12:SpamTrap
    * Jun-29-06 22:24:03 203.228.47.12 <mm...@ho...> to: 
us...@my... is disconnected
These mails always have a TO: header addresses to 4 specific people.  That 
particular combination of people is never valid, so I've added that 
combination to the bombre.  When I run the mail through the analyzer it 
confirms that it matched the bombre, but I see no indication of that here.

I've turned on the validation logging as Fritz suggested so I guess we'll 
see what happens.  They're not that frequent, maybe 3 or 4 a week.  Maybe 
by the time I get back from vacation there'll be enough evidence in my logs 
to see what's going on.

>=20
> you should look in the log, if you can identify the messages there.
> You should enable validation logging -> section validate=20
> local addresses
>=20
>=20

Also check the top received log on your mail server. Are you sure this
email has gone through assp at all?

Lars

Questions and Answers for users of ASSP Anti-Spam SMTP Proxy
<ass...@li...> schreibt:
>I've got some odd mail that seems to get through ASSP untouched even
>though 
>when I plug it into the analyzer it confirms that it should have been 
>caught by my bombre.  The odd part is that there are no headers in
>the mail 
>to indicate that it ever even went through ASSP.

you should look in the log, if you can identify the messages there.
You should enable validation logging -> section validate local
addresses

I've got some odd mail that seems to get through ASSP untouched even though 
when I plug it into the analyzer it confirms that it should have been 
caught by my bombre.  The odd part is that there are no headers in the mail 
to indicate that it ever even went through ASSP.

I initially though that perhaps it was bypassing ASSP and going straight to 
the mail server, but that is only possible if it is sent from inside the 
firewall, and then only if they address it by IP directly.  OK, so going on 
that possibility I started checking, but the headers do indicate that it 
was received by the mail server from the machine running ASSP, so I've 
ruled that out.

Are there any mechanisms in ASSP that might allow the mail through this way 
and still not show up in the analyzer?


Melvin Backus
Sr. Quality Assurance Specialist
404.497.8103
404.497.8101 fax
www.equorum.com
--
Do not meddle in the affairs of dragons, for you
are crunchy, and taste good with ketchup!
--

Duct tape is like the force.  It has a light side, and a dark side, and
it holds the universe together ...
                 -- Carl Zwanzig

Hello all,

I have a problem on my network with users sending emails to email addresses
that don't exist. If someone addresses an email to someone within our
company, but incorrectly types the email address, the email will sit in
Entourage's outbox indefinitely without any real notification to the user
that it didn't go through (except showing a message in the outbox, which I
can't seem to get some of my users to pay attention to). Our Mailserver
program won't accept the email because it isn't a valid recipient. I have
talked to the tech support for our mail program and worked out what is
happening:

1) Entourage tries to transmit the email
2) ASSP picks up the transmission and tries to deliver it
3) Kerio MailServer rejects it for being a bad address
4) ASSP recieves the failure and does not complete the transaction with
Entourage
5) Entourage thinks the message isn't sent

Aside from configuring our clients to bypass ASSP for sending email (and
losing whitelist and notspam additions), is there anything I can change in
ASSP so that the mail server will think ASSP is the authenticated user and
accept the email (which Kerio Mailserver will then automatically bounce back
to my user's inbox) or does anyone have any suggestions for a workaround?

Thank You,

Scott Hander
MIS Manager
The Fabulous Palm Springs Follies

TEL  760.778.7654 x208
FAX  760.322.3196
EMAIL   mis...@ps...
WEB   http://www.psfollies.com

Questions and Answers for users of ASSP Anti-Spam SMTP Proxy
<ass...@li...> schreibt:
>Yes :o)
>
>I clicked the "Show black" button under PB, but after deleting the
>line that 
>contained the IP and hitting SAVE, I got a page can not be displayed
>screen 
>every time.  When clicking "Show Black" again, the IP is still there.
> It 
>displays fairly quickly even though I have ~23000 entries in the
>blackPB.
>
>Doug

Ok, I did not look in that part for some time. For now , you should be
able to do addwhite report with ip in body.

> Did you try the edit button?

Yes :o)

I clicked the "Show black" button under PB, but after deleting the line that 
contained the IP and hitting SAVE, I got a page can not be displayed screen 
every time.  When clicking "Show Black" again, the IP is still there.  It 
displays fairly quickly even though I have ~23000 entries in the blackPB.

Doug


----- Original Message ----- 
From: "Fritz Borgstedt" <fb...@iw...>
To: "Questions and Answers for users of ASSP Anti-Spam SMTP Proxy" 
<ass...@li...>
Sent: Thursday, June 29, 2006 10:43 AM
Subject: Re: [Assp-user] PBblack IP removal?


> Questions and Answers for users of ASSP Anti-Spam SMTP Proxy
> <ass...@li...> schreibt:
>>How can I remove an IP from the BlackPB that got there by accident
>>due to
>>some testing I did wrong?
>
> Did you try the edit button? 

Questions and Answers for users of ASSP Anti-Spam SMTP Proxy
<ass...@li...> schreibt:
>How can I remove an IP from the BlackPB that got there by accident
>due to 
>some testing I did wrong?

Did you try the edit button?

How can I remove an IP from the BlackPB that got there by accident due to 
some testing I did wrong?

Thanks,

Doug Traylor 

Thanks again Fritz.

Doug


----- Original Message ----- 
From: "Doug Traylor" <dtr...@hf...>
To: "Questions and Answers for users of ASSP Anti-Spam SMTP Proxy" 
<ass...@li...>
Sent: Wednesday, June 28, 2006 1:14 PM
Subject: Re: [Assp-user] Spam address & logging set to 3


> Thanks for this change Fritz.  It really somes in handy.
>
> Is it possible to get spamTRAP logging to display the address the email 
> was
> sent to? 

I've seen this a few times on my setup.  The zombie is giving multiple
recipients.  Note the alphbetical closeness of your address and the second
address.

Maybe it's a two-birds-with-one-stone scenario.  Zombies send you spam and
search for open relays.

Maybe it's bad zombie-software design.  Why send a message for multiple
domains recipients to the first recipient's server?

adamc 

-----Original Message-----
From: ass...@li...
[mailto:ass...@li...] On Behalf Of Doug Traylor
Sent: Wednesday, June 28, 2006 14:24
To: Questions and Answers for users of ASSP Anti-Spam SMTP Proxy
Subject: Re: [Assp-user] please educate me - relay attempt question

Anybody have thoughts on this?  Is everybody seeing this kind of activity?

Thanks,

Doug

----- Original Message -----
From: "Doug Traylor" <dtr...@hf...>
To: "assp user list" <ass...@li...>
Sent: Thursday, June 22, 2006 10:13 PM
Subject: [Assp-user] please educate me


> My valid address replaced with <me>@<mydomain>.com in the following log
> snippet.
>
> Jun-22-06 21:58:03 Connected: 218.12.35.178:11120 -> 10.0.0.3 -> 
> 10.0.3.2:26
> Jun-22-06 21:58:04 218.12.35.178 <hlp...@us...> adding new
> triplet: (218.12.35.0,hlp...@us...,<me>@<mydomain>.com)
> Jun-22-06 21:58:04 218.12.35.178 <hlp...@us...> recipient 
> delayed:
> <me>@<mydomain>.com
> Jun-22-06 21:58:04 218.12.35.178 <hlp...@us...> relay attempt
> blocked for: dtr...@ho...
> Jun-22-06 21:58:04 PB: 218.12.35.178 score: 0+200 => 200
> reason:218.12.35.178:RelayAttempt
> Jun-22-06 21:58:06 218.12.35.178 <hlp...@us...> is disconnected
>
> How is it that a single connection from an IP can result in an email to a
> known user, me, on my domain and an email to an address on another domain
> that is seen as a relay attempt by ASSP?  I score relay attempts very high
> to extreme block future connections from that IP.  This is an obvious spam
> mail and I was just curious how they are doing it if anybody knows.  Is 
> this
> a simple function of SMTP communications, or is ASSP doing something 
> flakey
> here on a cc'd or bcc'd address?  I can not recreate this type of block 
> with
> testing so I assume ASSP is handling this correctly.
>
> Thanks,
>
> Doug Traylor 


Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Assp-user mailing list
Ass...@li...
https://lists.sourceforge.net/lists/listinfo/assp-user

Anybody have thoughts on this?  Is everybody seeing this kind of activity?

Thanks,

Doug

----- Original Message ----- 
From: "Doug Traylor" <dtr...@hf...>
To: "assp user list" <ass...@li...>
Sent: Thursday, June 22, 2006 10:13 PM
Subject: [Assp-user] please educate me


> My valid address replaced with <me>@<mydomain>.com in the following log
> snippet.
>
> Jun-22-06 21:58:03 Connected: 218.12.35.178:11120 -> 10.0.0.3 -> 
> 10.0.3.2:26
> Jun-22-06 21:58:04 218.12.35.178 <hlp...@us...> adding new
> triplet: (218.12.35.0,hlp...@us...,<me>@<mydomain>.com)
> Jun-22-06 21:58:04 218.12.35.178 <hlp...@us...> recipient 
> delayed:
> <me>@<mydomain>.com
> Jun-22-06 21:58:04 218.12.35.178 <hlp...@us...> relay attempt
> blocked for: dtr...@ho...
> Jun-22-06 21:58:04 PB: 218.12.35.178 score: 0+200 => 200
> reason:218.12.35.178:RelayAttempt
> Jun-22-06 21:58:06 218.12.35.178 <hlp...@us...> is disconnected
>
> How is it that a single connection from an IP can result in an email to a
> known user, me, on my domain and an email to an address on another domain
> that is seen as a relay attempt by ASSP?  I score relay attempts very high
> to extreme block future connections from that IP.  This is an obvious spam
> mail and I was just curious how they are doing it if anybody knows.  Is 
> this
> a simple function of SMTP communications, or is ASSP doing something 
> flakey
> here on a cc'd or bcc'd address?  I can not recreate this type of block 
> with
> testing so I assume ASSP is handling this correctly.
>
> Thanks,
>
> Doug Traylor 

Thanks for this change Fritz.  It really somes in handy.

Is it possible to get spamTRAP logging to display the address the email was 
sent to?  It used to do this but has not for a few revisions.  This is not 
that important, but satisfies my curiosity if a new addition to the spamtrap 
is getting any hits.

Jun-28-06 08:05:10 Connected: 201.37.166.35:60292 -> 10.0.0.3:25 -> 
10.0.3.2:26
Jun-28-06 08:05:11 PB: 201.37.166.35 score: 0+200 => 200 
reason:201.37.166.35:SpamTrap
Jun-28-06 08:05:11 201.37.166.35 <> is disconnected

Thanks,

Doug


----- Original Message ----- 
From: "Fritz Borgstedt" <fb...@iw...>
To: "Questions and Answers for users of ASSP Anti-Spam SMTP Proxy" 
<ass...@li...>
Sent: Monday, June 26, 2006 4:43 PM
Subject: Re: [Assp-user] Spam address & logging set to 3


> Try the last 1.2.3 (7)

Since may 31 I haven't seen any "Validate Sender: Unknown User in Local
Domain" in my maillog anymore.
At least on my setup the "Validate Local Sender Addresses" check seems
broken since then.
Is it still working for other testers?
If it's due to a change in the code I think it would be in or near the
1.2.2(23)
to 1.2.2(24) changes...

2006/6/28, Wim Borghs <wim...@gm...>:
>
> Since may 31 I haven't seen any "Validate Sender: Unknown User in Local
> Domain" in my maillog anymore.
> At least on my setup the "Validate Local Sender Addresses" check seems
> broken since then.
> Is it still working for other testers?
> If it's due to a change in the code I think it would be in or near the
> 1.2.2(23) to 1.2.2(24) changes...
>

I did some more testing and it appears it actually still works ok. It seems
I just got a lot of these especially from may 28 until may 31 and those few
after then were catched by earlier checks. Coincidences can be confusing...
;-)

concur...  If test-modes are off, its most likely that.

--
ME2   (wireless)

-----Original Message-----
From: Melvin Backus <mel...@eq...>
Date: Wednesday, Jun 28, 2006 8:08 am
Subject: Re: [Assp-user] Test mode mail - not in test mode

Check the value for Bayesian Confidence Level under Spam Control.  I 
believe mail which is passed because of that setting uses that message also.


At 07:46 AM 6/28/2006, Chris Moore wrote:
Hello list

>One of my users has complained of receiving mail with [SPAM] in the subject
line.

>I have no spam-lovers, and I am not running in test mode.

>Not all of the mail is forwarded, just occasional mails, I can see no
pattern.

>Can anyone explain what may be happening?

>FYI:
Perl                            :5.008008
ASSP                            :1.2.2
Compress::Zlib          :1.41
Digest::MD5             :2.36
Email::Valid            :0.16
File::ReadBackwards     :1.04
Mail::SPF::Query                

Check the value for Bayesian Confidence Level under Spam Control.  I 
believe mail which is passed because of that setting uses that message also.


At 07:46 AM 6/28/2006, Chris Moore wrote:
>Hello list
>
>One of my users has complained of receiving mail with [SPAM] in the subject
>line.
>
>I have no spam-lovers, and I am not running in test mode.
>
>Not all of the mail is forwarded, just occasional mails, I can see no
>pattern.
>
>Can anyone explain what may be happening?
>
>FYI:
>Perl                            :5.008008
>ASSP                            :1.2.2
>Compress::Zlib          :1.41
>Digest::MD5             :2.36
>Email::Valid            :0.16
>File::ReadBackwards     :1.04
>Mail::SPF::Query                :1.999001
>Mail::SRS               :NI
>Net::DNS                        :0.57
>Net::LDAP                       :NI
>Time::HiRes                     :1.86
>Sys::Syslog                     :NI
>Win32::Daemon           :20030617
>
>Log snip:
>Jun-28-06 10:16:52 193.192.160.253 <in...@bp...> adding new triplet:
>(193.192.160.0,in...@bp...,my...@my...)
>Jun-28-06 10:16:52 193.192.160.253 <in...@bp...> recipient delayed:
>my...@my...
>Jun-28-06 10:50:46 193.192.160.253 <in...@bp...> whitelisting triplet:
>(193.192.160.0,in...@bp...,my...@my...) waited: 33m 54s
>Jun-28-06 10:51:01 193.192.160.253 <in...@bp...> to: my...@my...
>passing if safe because testmode, otherwise Bayesian spam
>Jun-28-06 10:51:01 193.192.160.253 <in...@bp...> to: my...@my... spam
>determined to be safe, passing on to recipient
>Jun-28-06 10:51:01 193.192.160.253 <in...@bp...> to: my...@my...
>deleting spamming whitelisted tuplet: (193.192.160.0,bpcc.org.pl) age: 15s
>
>(I know it SAYS "because testmode", but honestly, I'm not in testmode! =))
>
>TIA - Chris
>
>Chris Moore
>Computer Department
>
>Brother Industries (UK) Ltd
>
>
>
>
>
>Using Tomcat but need to do more? Need to support web services, security?
>Get stuff done quickly with pre-integrated technology to make your job easier
>Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
>http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
>_______________________________________________
>Assp-user mailing list
>Ass...@li...
>https://lists.sourceforge.net/lists/listinfo/assp-user

Hello list

One of my users has complained of receiving mail with [SPAM] in the subject
line.

I have no spam-lovers, and I am not running in test mode.  

Not all of the mail is forwarded, just occasional mails, I can see no
pattern.

Can anyone explain what may be happening?

FYI:
Perl 				:5.008008 
ASSP 				:1.2.2 
Compress::Zlib 		:1.41  
Digest::MD5 		:2.36  
Email::Valid		:0.16  
File::ReadBackwards	:1.04  
Mail::SPF::Query 		:1.999001  
Mail::SRS   		:NI
Net::DNS 			:0.57  
Net::LDAP			:NI   
Time::HiRes			:1.86  
Sys::Syslog			:NI   
Win32::Daemon 		:20030617   

Log snip:
Jun-28-06 10:16:52 193.192.160.253 <in...@bp...> adding new triplet:
(193.192.160.0,in...@bp...,my...@my...)
Jun-28-06 10:16:52 193.192.160.253 <in...@bp...> recipient delayed:
my...@my...
Jun-28-06 10:50:46 193.192.160.253 <in...@bp...> whitelisting triplet:
(193.192.160.0,in...@bp...,my...@my...) waited: 33m 54s
Jun-28-06 10:51:01 193.192.160.253 <in...@bp...> to: my...@my...
passing if safe because testmode, otherwise Bayesian spam
Jun-28-06 10:51:01 193.192.160.253 <in...@bp...> to: my...@my... spam
determined to be safe, passing on to recipient 
Jun-28-06 10:51:01 193.192.160.253 <in...@bp...> to: my...@my...
deleting spamming whitelisted tuplet: (193.192.160.0,bpcc.org.pl) age: 15s

(I know it SAYS "because testmode", but honestly, I'm not in testmode! =))

TIA - Chris

Chris Moore
Computer Department

Brother Industries (UK) Ltd