Scan Messages = %rules-dir%/scan.messages.rules

Discussion:

Robert Lopez

2013-05-22 01:18:11 UTC

wrt "Scan Messages = %rules-dir%/scan.messages.rules"

Three questions:

1) Does MailScanner do a case sensitive match when
scan.messages.rules file is used?

2) Which "From:" does scan.messages.rules use (Envelope or Email Body)?

3) Does MailScanner directly implement the match and action or is this
passed to SpamAssassin to do the match and action?

--
Robert Lopez
Unix Systems Administrator
Central New Mexico Community College (CNM)
525 Buena Vista SE
Albuquerque, New Mexico 87106

Martin Hepworth

2013-05-22 08:20:51 UTC

Permalink

1) nope, email addresses are not case sensitive.
2) Envelope, MS always uses the Envelope-from in from parsing.
3) this is the 'big knob' that tells whether MailScanner scans the email or
not. Way before it's passed to SA, anti-virus or checked by mailScanner
again RBLS (independently of SA). etc. Be very careful with setting as it's
basically sending email through with zero scanning. Might want to look at
the the "Is definitely Not spam" setting. Normally this is only used for
trusted ip-addresses not email 'from' addresses.

hope that helps
--
Martin Hepworth, CISSP
Oxford, UK

Post by Robert Lopez
wrt "Scan Messages = %rules-dir%/scan.messages.rules"
1) Does MailScanner do a case sensitive match when
scan.messages.rules file is used?
2) Which "From:" does scan.messages.rules use (Envelope or Email Body)?
3) Does MailScanner directly implement the match and action or is this
passed to SpamAssassin to do the match and action?
--
Robert Lopez
Unix Systems Administrator
Central New Mexico Community College (CNM)
525 Buena Vista SE
Albuquerque, New Mexico 87106
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20130522/53090ad8/attachment.html

Robert Lopez

2013-05-22 17:45:17 UTC

Permalink

Post by Martin Hepworth
1) nope, email addresses are not case sensitive.
2) Envelope, MS always uses the Envelope-from in from parsing.
3) this is the 'big knob' that tells whether MailScanner scans the email or
not. Way before it's passed to SA, anti-virus or checked by mailScanner
again RBLS (independently of SA). etc. Be very careful with setting as it's
basically sending email through with zero scanning. Might want to look at
the the "Is definitely Not spam" setting. Normally this is only used for
trusted ip-addresses not email 'from' addresses.
hope that helps
--
Martin Hepworth, CISSP
Oxford, UK

--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!

Martin,

Please clarify to which rule "Normally this" refers.
I believe you are stating "Is definitely Not spam" is only used for
trusted ip-addresses not email 'from' addresses.

The situation I am trying to understand is email being scanned by
SpamAssassin when I thought
I had the system configured to not scan the email at all.

May 20 12:55:08 mg04 MailScanner[11127]: Message 55370642025.7712B
from 198.133.182.29 () to cnm.edu
is not spam, SpamAssassin (not cached, score=-1.699, required 6,
autolearn=disabled, CNM_EXCUSE 0.30,
CNM_FROM -1.00, CNM_ITS -1.00, HTML_MESSAGE 0.00)

--
Robert Lopez
Unix Systems Administrator
Central New Mexico Community College (CNM)
525 Buena Vista SE
Albuquerque, New Mexico 87106

Steve Campbell

2013-05-22 18:28:43 UTC

Permalink

Perhaps you should send us the "Scan Messages" line from your
MailScanner.conf file and what you have in your file that is pointed to
in by line above.

Have you restarted or reloaded MS since you changed the file?

Depending on what you have in that line and file, you probably shouldn't
be seeing those lines in your mail log.

steve campbell

Post by Robert Lopez

Martin,
Please clarify to which rule "Normally this" refers.
I believe you are stating "Is definitely Not spam" is only used for
trusted ip-addresses not email 'from' addresses.
The situation I am trying to understand is email being scanned by
SpamAssassin when I thought
I had the system configured to not scan the email at all.
May 20 12:55:08 mg04 MailScanner[11127]: Message 55370642025.7712B
from 198.133.182.29 () to cnm.edu
is not spam, SpamAssassin (not cached, score=-1.699, required 6,
autolearn=disabled, CNM_EXCUSE 0.30,
CNM_FROM -1.00, CNM_ITS -1.00, HTML_MESSAGE 0.00)
--
Robert Lopez
Unix Systems Administrator
Central New Mexico Community College (CNM)
525 Buena Vista SE
Albuquerque, New Mexico 87106

Robert Lopez

2013-05-22 21:42:49 UTC

Permalink

Post by Steve Campbell
Perhaps you should send us the "Scan Messages" line from your
MailScanner.conf file and what you have in your file that is pointed to
in by line above.
Have you restarted or reloaded MS since you changed the file?
Depending on what you have in that line and file, you probably shouldn't
be seeing those lines in your mail log.
steve campbell

The situation I am trying to understand is email being scanned by
SpamAssassin when I thought
I had all the systems configured to not scan the email at all.

Email generated by an office where the persons use Outlook to compose
email goes to an Exchange server and it is then relayed to an email
gateway. These email are from CNM_Official_Info at cnm.edu to
students at cnm.edu. The email gateway relays the email to a Mailman ($
postmap -q students /etc/postfix/virtualaliases -> students at listserv)
server.

Mailman then sends the message to all the students who are members of
the students list. So each student has a copy generated that is from
students-bounces at cnm.edu to <individual-student>@cnm.edu which is sent
back to the email gateways.

A Postfix rewrite via a virtualaliases map sends each email from
students-bounces at cnm.edu to <individual-student>@...gmail.com.

MailScanner.conf and conf.d/CNM-MailScanner.conf (newest gateway)
all have "Scan Messages = %rules-dir%/scan.messages.rules".
I had put both 'From' in scan.messages.rules:

From: students-bounces at cnm.edu no
From: cnm_official_info at cnm.edu no #This is not a case match to original

This directive and data file have been working for years.
However yesterday I noticed the email in this case (students list)
do get a SpamAssassin score and my thinking is this should not be happening.

Each email has a line such as this example:

May 20 12:55:08 mg04 MailScanner[11127]: Message 55370642025.7712B
from 198.133.182.29 () to cnm.edu is not spam, SpamAssassin (not
cached, score=-1.699, required 6, autolearn=disabled, CNM_EXCUSE 0.30,
CNM_FROM -1.00, CNM_ITS -1.00, HTML_MESSAGE 0.00)

There has been no recent change to any of these files. MailScanner is always
restarted or reloaded when ever any configuration file is modified. In fact,
the scripts to modify any component and copy them to the gateways do the
force-reload and test ($?) to see the return status.

--
Robert Lopez
Unix Systems Administrator
Central New Mexico Community College (CNM)
525 Buena Vista SE
Albuquerque, New Mexico 87106

Martin Hepworth

2013-05-23 09:20:10 UTC

Permalink

I'd suggest the scan.messages.rules be amended to cope with the ip-address
of the MailMan server. otherwise anyone faking the from address is going to
sail straight passed your email scanning.
--
Martin Hepworth, CISSP
Oxford, UK

Post by Robert Lopez

The situation I am trying to understand is email being scanned by
SpamAssassin when I thought
I had all the systems configured to not scan the email at all.
Email generated by an office where the persons use Outlook to compose
email goes to an Exchange server and it is then relayed to an email
gateway. These email are from CNM_Official_Info at cnm.edu to
students at cnm.edu. The email gateway relays the email to a Mailman ($
postmap -q students /etc/postfix/virtualaliases -> students at listserv)
server.
Mailman then sends the message to all the students who are members of
the students list. So each student has a copy generated that is from
back to the email gateways.
A Postfix rewrite via a virtualaliases map sends each email from
MailScanner.conf and conf.d/CNM-MailScanner.conf (newest gateway)
all have "Scan Messages = %rules-dir%/scan.messages.rules".
From: students-bounces at cnm.edu no
From: cnm_official_info at cnm.edu no #This is not a case match to original
This directive and data file have been working for years.
However yesterday I noticed the email in this case (students list)
do get a SpamAssassin score and my thinking is this should not be happening.
May 20 12:55:08 mg04 MailScanner[11127]: Message 55370642025.7712B
from 198.133.182.29 () to cnm.edu is not spam, SpamAssassin (not
cached, score=-1.699, required 6, autolearn=disabled, CNM_EXCUSE 0.30,
CNM_FROM -1.00, CNM_ITS -1.00, HTML_MESSAGE 0.00)
There has been no recent change to any of these files. MailScanner is always
restarted or reloaded when ever any configuration file is modified. In fact,
the scripts to modify any component and copy them to the gateways do the
force-reload and test ($?) to see the return status.
--
Robert Lopez
Unix Systems Administrator
Central New Mexico Community College (CNM)
525 Buena Vista SE
Albuquerque, New Mexico 87106
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20130523/3116290d/attachment.html

Steve Campbell

2013-05-23 12:37:36 UTC

Permalink

That was going to be my suggestion also. Are there any other emails
besides the student mail list that would originate from that IP? You
might need a compound rule (using the "and" component) to define the
rule a little better if you use IP based lines in the configuration file.

steve

Post by Martin Hepworth
I'd suggest the scan.messages.rules be amended to cope with the
ip-address of the MailMan server. otherwise anyone faking the from
address is going to sail straight passed your email scanning.
--
Martin Hepworth, CISSP
Oxford, UK
On 22 May 2013 22:42, Robert Lopez <rlopezcnm at gmail.com
On Wed, May 22, 2013 at 12:28 PM, Steve Campbell

Post by Steve Campbell
Perhaps you should send us the "Scan Messages" line from your
MailScanner.conf file and what you have in your file that is

pointed to

Post by Steve Campbell
in by line above.
Have you restarted or reloaded MS since you changed the file?
Depending on what you have in that line and file, you probably

shouldn't

Post by Steve Campbell
be seeing those lines in your mail log.
steve campbell

The situation I am trying to understand is email being scanned by
SpamAssassin when I thought
I had all the systems configured to not scan the email at all.
Email generated by an office where the persons use Outlook to compose
email goes to an Exchange server and it is then relayed to an email
gateway. These email are from CNM_Official_Info at cnm.edu
<mailto:CNM_Official_Info at cnm.edu> to
students at cnm.edu <mailto:students at cnm.edu>. The email gateway
relays the email to a Mailman ($
postmap -q students /etc/postfix/virtualaliases -> students at listserv)
server.
Mailman then sends the message to all the students who are members of
the students list. So each student has a copy generated that is from
students-bounces at cnm.edu <mailto:students-bounces at cnm.edu> to
back to the email gateways.
A Postfix rewrite via a virtualaliases map sends each email from
students-bounces at cnm.edu <mailto:students-bounces at cnm.edu> to
MailScanner.conf and conf.d/CNM-MailScanner.conf (newest gateway)
all have "Scan Messages = %rules-dir%/scan.messages.rules".
From: students-bounces at cnm.edu <mailto:students-bounces at cnm.edu> no
From: cnm_official_info at cnm.edu <mailto:cnm_official_info at cnm.edu>
no #This is not a case match to original
This directive and data file have been working for years.
However yesterday I noticed the email in this case (students list)
do get a SpamAssassin score and my thinking is this should not be happening.
May 20 12:55:08 mg04 MailScanner[11127]: Message 55370642025.7712B
from 198.133.182.29 () to cnm.edu <http://cnm.edu> is not spam,
SpamAssassin (not
cached, score=-1.699, required 6, autolearn=disabled, CNM_EXCUSE 0.30,
CNM_FROM -1.00, CNM_ITS -1.00, HTML_MESSAGE 0.00)
There has been no recent change to any of these files. MailScanner is always
restarted or reloaded when ever any configuration file is
modified. In fact,
the scripts to modify any component and copy them to the gateways do the
force-reload and test ($?) to see the return status.
--
Robert Lopez
Unix Systems Administrator
Central New Mexico Community College (CNM)
525 Buena Vista SE
Albuquerque, New Mexico 87106
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
<mailto:mailscanner at lists.mailscanner.info>
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20130523/2dcd00d4/attachment.html

Glenn Steen

2013-05-23 14:05:00 UTC

Permalink

Post by Robert Lopez

The situation I am trying to understand is email being scanned by
SpamAssassin when I thought
I had all the systems configured to not scan the email at all.
Email generated by an office where the persons use Outlook to compose
email goes to an Exchange server and it is then relayed to an email
gateway. These email are from CNM_Official_Info at cnm.edu to
students at cnm.edu. The email gateway relays the email to a Mailman ($
postmap -q students /etc/postfix/virtualaliases -> students at listserv)
server.
Mailman then sends the message to all the students who are members of
the students list. So each student has a copy generated that is from
back to the email gateways.
A Postfix rewrite via a virtualaliases map sends each email from
MailScanner.conf and conf.d/CNM-MailScanner.conf (newest gateway)
all have "Scan Messages = %rules-dir%/scan.messages.rules".
From: students-bounces at cnm.edu no
From: cnm_official_info at cnm.edu no #This is not a case match to original
This directive and data file have been working for years.
However yesterday I noticed the email in this case (students list)
do get a SpamAssassin score and my thinking is this should not be happening.
May 20 12:55:08 mg04 MailScanner[11127]: Message 55370642025.7712B
from 198.133.182.29 () to cnm.edu is not spam, SpamAssassin (not
cached, score=-1.699, required 6, autolearn=disabled, CNM_EXCUSE 0.30,
CNM_FROM -1.00, CNM_ITS -1.00, HTML_MESSAGE 0.00)
There has been no recent change to any of these files. MailScanner is always
restarted or reloaded when ever any configuration file is modified. In fact,
the scripts to modify any component and copy them to the gateways do the
force-reload and test ($?) to see the return status.

Hello Robert,

Two things come to mind:
1) Go look in the logs (on the MailScanner host) again... Track one of
the messages that shouldn't have been scanned to see the actual
envelope sender and recipient(s)... Do they match what you have there?
2) Use the eminent inbuilt ruleset checking capabilities of the
MailScanner command to check what will actually happen... Do
"MailScanner --help" to see the possible things you can do... Then do
something like:
MailScanner --value=scanmessages --from=students-bounces at cnm.edu
to see what the effect would be.

I use the Scan Messages setting to do a blanket whitelist for
releasing from localhost, so ... Here's an example (run as the postfix
user):
-bash-3.2$ /usr/sbin/MailScanner --value=scanmessages
--from=tony.irving at nowhere.com --to=glenn.steen at ap1.se --ip=127.0.0.1
Looked up internal option name "scanmail"
With sender = tony.irving at nowhere.com
recipient = glenn.steen at ap1.se
Client IP = 127.0.0.1
Virus =
Result is "0"

0=No 1=Yes
-bash-3.2$ /usr/sbin/MailScanner --value=scanmessages
--from=tony.irving at nowhere.com --to=glenn.steen at ap1.se --ip=127.0.0.2
Looked up internal option name "scanmail"
With sender = tony.irving at nowhere.com
recipient = glenn.steen at ap1.se
Client IP = 127.0.0.2
Virus =
Result is "1"

0=No 1=Yes
-bash-3.2$

You should probably do both the above suggestions:-).
Cheers!

--
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se

Robert Lopez

2013-05-23 22:58:26 UTC

Permalink

Post by Glenn Steen
Hello Robert,
1) Go look in the logs (on the MailScanner host) again... Track one of
the messages that shouldn't have been scanned to see the actual
envelope sender and recipient(s)... Do they match what you have there?
2) Use the eminent inbuilt ruleset checking capabilities of the
MailScanner command to check what will actually happen... Do
"MailScanner --help" to see the possible things you can do... Then do
MailScanner --value=scanmessages --from=students-bounces at cnm.edu
to see what the effect would be.
I use the Scan Messages setting to do a blanket whitelist for
releasing from localhost, so ... Here's an example (run as the postfix
-bash-3.2$ /usr/sbin/MailScanner --value=scanmessages
--from=tony.irving at nowhere.com --to=glenn.steen at ap1.se --ip=127.0.0.1
Looked up internal option name "scanmail"
With sender = tony.irving at nowhere.com
recipient = glenn.steen at ap1.se
Client IP = 127.0.0.1
Virus =
Result is "0"
0=No 1=Yes
-bash-3.2$ /usr/sbin/MailScanner --value=scanmessages
--from=tony.irving at nowhere.com --to=glenn.steen at ap1.se --ip=127.0.0.2
Looked up internal option name "scanmail"
With sender = tony.irving at nowhere.com
recipient = glenn.steen at ap1.se
Client IP = 127.0.0.2
Virus =
Result is "1"
0=No 1=Yes
-bash-3.2$
You should probably do both the above suggestions:-).
Cheers!
--
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!

Glenn,

1) You nailed it! Out of the >100,000 email some of them to Gmail
bounced back. It was the last step of the bounceback after the return
to Mailman and on way to Exchange (the original sender) that was
scanned. The bounce back messages were the ones that were scanned and
logged. That becomes an separate problem to address.

2) If you write a book on MailScanner I will buy it. All your advice
is very good. You opened my mind to features I never considered.
Now I see a faster way to determine how to take Martin's advice to
"cope with the IP address of the Mailman server"

--
Robert Lopez
Unix Systems Administrator
Central New Mexico Community College (CNM)
525 Buena Vista SE
Albuquerque, New Mexico 87106

Glenn Steen

2013-05-24 09:07:08 UTC

Permalink

Hello Robert,

Post by Robert Lopez

Ah, good!
Or not:-). Handling bounces "correctly" is a pain:-)

Post by Robert Lopez
2) If you write a book on MailScanner I will buy it. All your advice
is very good. You opened my mind to features I never considered.
Now I see a faster way to determine how to take Martin's advice to
"cope with the IP address of the Mailman server"

*Blush* You are too kind:-)
It's very unlikely I'll ever get the time to even write anything more
on the wiki, let alone a book (I work in a very small/slim
organization, where I do ... everything... that has anything remotely
to do with computers. About 4 years ago the situation went from bad to
worse, when we did a "right-sizing" from hell)...

Besides, Jules already wrote The Book on MailScanner;-)

Cheers!

--
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se

Antony Stone

2013-05-22 18:55:36 UTC

Permalink

Post by Martin Hepworth
1) nope, email addresses are not case sensitive.

Not entirely true...

From http://tools.ietf.org/html/rfc5321#section-4.1.2

Post by Martin Hepworth
Local-part = Dot-string / Quoted-string
; MAY be case-sensitive

Which means the part before the @ sign can be case-sensitive, and it's only
the authoritative mail server for the domain which can decide whether there's
a difference between j.smith and J.Smith.

Not often important, I know, but can catch you out when you're not expecting
it :)

Regards,

Antony.

--
"I estimate there's a world market for about five computers."

- Thomas J Watson, Chairman of IBM

Robert Lopez

2013-05-22 21:26:42 UTC

Permalink

On Wed, May 22, 2013 at 12:55 PM, Antony Stone

Post by Antony Stone

Post by Martin Hepworth
1) nope, email addresses are not case sensitive.

Not entirely true...

Post by Martin Hepworth
From http://tools.ietf.org/html/rfc5321#section-4.1.2
Local-part = Dot-string / Quoted-string
; MAY be case-sensitive

the authoritative mail server for the domain which can decide whether there's
a difference between j.smith and J.Smith.
Not often important, I know, but can catch you out when you're not expecting
it :)
Regards,
Antony.
--
"I estimate there's a world market for about five computers."
- Thomas J Watson, Chairman of IBM
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!

--
Robert Lopez
Unix Systems Administrator
Central New Mexico Community College (CNM)
525 Buena Vista SE
Albuquerque, New Mexico 87106