efa-project.org

Hi andyhud I'm not sure if that can be done. I have never had a need to do that so I've never researched or tested it. However, there is a way to get around the DNS issue. 1. Set up a random 'A' record hostname in your public DNS records. Something like specialhost.domain.com (substitute domain.com ...

Thanks Shawn.
This is clearly a weekend job.

Is there a migration path yet?

Can you post more details about how you updated MailScanner?

Does anyone know how this might have happened? and how I can fix it? It started yesterday.

It appears to be showing the total emails for the entire 24 hour period in one bar
.

Hi Telvenes, Blocking IPs yourself is a losing battle because the pro spammers are always changing their IPs. Even subscribing to to a blocklist service is not usually good enough. You probably have one or two valid reasons for turning off grey listing, but now it is time to ask yourself if it was w...

Hi Alex, Provided your AD is responding to LDAP queries, you should be good to go. To test ldap connectivity from the EFA box, you can formulate a simple query using ldapsearch. If it is not installed, you can download the package. The download package is called openldap-clients yum install openldap...

Hi Alex, Not all Exchange environments are the same. A lot depends on how your firewall is configured, if the exch server is not the same subnet at the EFA box, whether or not the users log in with their exchange alias or their email address, if the email address and the user principal name are the ...

I haven,t forgotten about this. I've just abandoned it because I no longer need my original blacklist entries to be imported and the whitelist is quite short, so I've entered them manually.

I've been playing around with this for a few hours now and finally got it working the way I wanted it. In my Exchange environment, most users log in with their primary email address such as user@domain.com It is also possible to log in with a user principal name (user@domain.local) or the older way ...

A quick note for those who have alias addresses in their Exchange server. For LDAP_FILTER, please use... define('LDAP_FILTER', 'proxyAddresses=smtp:%s', 'mail=%s'); or define('LDAP_FILTER', 'proxyAddresses=smtp:%s', 'proxyAddresses=SMTP:%s'); This allows validation lookup of all smtp email addresses...

I'm with you on that one pdwalker.
Better more delays than more junk.

Good call.

Now I've learned something too

I'll be testing all this methodically once I set up my lab and I'll report back with documented steps and results.

Thanks for all your help so far.

quarantine/20180914/nonspam/A2B9B182AA3.A9CDD:X-Greylist: whitelisted by SQLgrey-1.8.0 Simply means that it was whitelisted as a valid domain/address and IP combination in SqlGrey which is the first line of defense in EFA but is a completely separate program. This has absolutely nothing to do with ...

because the domains in the whitelist table that were imported are still being scanned by SA (not highlighted in green) and the ones in the blacklist table that were imported were not being blocked (Not highlighted in black). A couple of the whitelist emails were flagged as spam by SA and never made ...

Looks like it was finding the entries. Just not using them. Oct 9 19:46:28 emxg MailScanner[27207]: MailWatch: Whitelist refresh time reached Oct 9 19:46:28 emxg MailScanner[27207]: MailWatch: Starting up MailWatch SQL Whitelist Oct 9 19:46:28 emxg MailScanner[27207]: MailWatch: Read 523 whitelist e...

Thanks. I'll look into that after I set up a copy of the current production VM in a lab environment. This should prove interesting. As for SqlGrey, yep it's definitely running. That's what's catching 95% of the spam. [root@emxg ~]# ps -ef |grep sqlgrey sqlgrey 2727 1 0 Oct11 ? 00:00:03 /usr/bin/perl...

Thanks for the time you've taken to test this out. I did in fact reboot the appliance after I imported the lists. In the white list I imported around 550 entries and in the blacklist I imported approx 4800 entries. After the reboot I let it run for a good 2 hours before checking if the entries were ...

Hah. It seems my suspicions were corrrect. The SpamAssassin score threshold is configured in /etc/MailScanner/MailScanner.conf Look for these lines... somewhere around line 2240 # This replaces the SpamAssassin configuration value 'required_hits'. # If a message achieves a SpamAssassin score higher ...

Hi pdwalker, here is a sample of the data imported from CSV files. I determined the format by first exporting the existing databases to CSV files. 1,default,,@domain1.com 2,default,,@domain2.com 3,default,,@domain3.com 4,default,,@domain4.com Both tables (blacklist and whitelist) only have 4 fields ...

Well you definitely don't want any Malware infected emails to get through, but perhaps you'd like SpamAssassin to rate the email and pass it on to the end recipient no matter the spam score. That should not be difficult to achieve. I'm fairly new to EFA so I am not 100% certain that this solution wi...

My software versions are... EFA: 3.0.2.6 MailWatch: 1.2.7-dev Postfix: 3.1.3 MailScanner: 5.0.7 ClamAV: 0.100.1 SpamAssassin: 3.4.1 PHP: 7.2.10 MySQL: 10.1.36-MariaDB I ran into an issue when I imported my whitelist and blacklist data. I did not use the import script provided in these forums because...

@pdwalker

The delay time is listed in the header of the email.

Looks like this...
X-Greylist: delayed 00:06:41 by SQLgrey-1.8.0

Cheers

@toddh I am noticing that also. This especially happens with large anonymous email providers (Gmail, Yahoo, etc.) and large hosting companies (Bluehost, Godaddy, etc.). However, as the grey list learns the gateway IPs most often used by each domain/address), it automatically adds the domains/address...