Search found 456 matches

by ovizii
10 Sep 2019 21:12
Forum: 3.x How-to
Topic: Problems releasing an infected email from quarantine
Replies: 0
Views: 337

Problems releasing an infected email from quarantine

Hi there, I have read a couple of similar posts around here but I think my problem is different. Recently apparently malwarepatrol seems to have started marking email containing docs.gogle.com as viruses: sigtool --find-sigs MBL_34101911 [malwarepatrol.ndb] MBL_34101911:0:*:68747470733a2f2f646f63732...
by ovizii
04 Sep 2019 11:42
Forum: 3.x Bugs
Topic: Mailwatch interface somehow stopped showing details about email?
Replies: 4
Views: 352

Re: Mailwatch interface somehow stopped showing details about email?

I am pretty sure this is only a display problem as going back I cannot see that info for older email either.
by ovizii
04 Sep 2019 11:40
Forum: 3.x Bugs
Topic: Mailwatch interface somehow stopped showing details about email?
Replies: 4
Views: 352

Re: Mailwatch interface somehow stopped showing details about email?

I have retraced my steps. All I did before this problem occured was this: inside /etc/mail/spamassassin I edited my my-adjusted-scores.cf and added this content at the bottom of the file (I had more modified scores inside there) # # these ones scored well, upping their score # # original 0.10 #score...
by ovizii
04 Sep 2019 11:31
Forum: 3.x Bugs
Topic: Mailwatch interface somehow stopped showing details about email?
Replies: 4
Views: 352

Re: Mailwatch interface somehow stopped showing details about email?

This seems to be only the case for incoming emails where this info is missing...
by ovizii
04 Sep 2019 11:29
Forum: 3.x Bugs
Topic: Mailwatch interface somehow stopped showing details about email?
Replies: 4
Views: 352

Mailwatch interface somehow stopped showing details about email?

It might have been me modifying some configs but I can't retrace what triggered this:

https://pasteboard.co/IvQaTUK.png

Any ideas? The emails are still being scanned properly and everythign works but I still want to see those details :-(
by ovizii
29 Jun 2019 13:23
Forum: Discussion
Topic: Additional ClamAV signatures?
Replies: 1
Views: 1674

Additional ClamAV signatures?

Just stumbled across these free signatures: https://malware.expert/signatures/ - anyone knows those guys?
Any hitns on the best way to add them in addition to the other sources?
by ovizii
13 Jun 2019 09:45
Forum: 3.x How-to
Topic: new Plugin [sadwl]
Replies: 3
Views: 1045

Re: new Plugin [sadwl]

I'm sorry can you quickly explain what exactly this is: "reverse sender host domain"?
Do you take the IP of the sending server and do a reverse DNS lookup?
by ovizii
06 Jun 2019 15:44
Forum: Discussion
Topic: Alternative to Spamassassin
Replies: 2
Views: 1802

Re: Alternative to Spamassassin

Oh wow, looking at what you linked to you are totally right and one should not consider this a viable alternative.
I found the product via a tech newsletter, looks like someone didn't really quality check their newsletter :-)
by ovizii
05 Jun 2019 10:43
Forum: Discussion
Topic: question about user types
Replies: 8
Views: 3401

Re: question about user types

I can try and explain how I understand the situation but I might be wrong. Looking at https://docs.mailwatch.org/using/user-filter.html and https://forum.efa-project.org/viewtopic.php?t=3002 this is what I took away: If you create a user named johndoe@example.com as user type User and I log-in as th...
by ovizii
04 Jun 2019 15:12
Forum: Discussion
Topic: Alternative to Spamassassin
Replies: 2
Views: 1802

Alternative to Spamassassin

I'm not sure what you have decided for EFA v4 but I jsut stumbled upon this project and thought I'd share it here: https://orangeassassin.org/ From their description: OrangeAssassin was created as an upgraded open-source drop-in replacement for SpamAssassin for Linux users and control panel provider...
by ovizii
15 May 2019 04:41
Forum: Discussion
Topic: question about user types
Replies: 8
Views: 3401

Re: question about user types

Thanks for confirming and digging out that old post. I did not have to add a new user in a while but when I tried adding 2 new domains and saw that all my old users were in a different format, I just vaguely remembered there was a reason for that but couldn't find where it was described :-) I'll get...
by ovizii
14 May 2019 07:32
Forum: Discussion
Topic: question about user types
Replies: 8
Views: 3401

Re: question about user types

Yes, thanks henk, that is exactly what I meant but the link you posted is a bit confusing as the screenshot does not exactly fit the text you wrote there. This is what I am confused about: In previous MailWatch versions we could enter any username in a non valid email format, to generate 1 single qu...
by ovizii
13 May 2019 04:45
Forum: Discussion
Topic: question about user types
Replies: 8
Views: 3401

Re: question about user types

Found this manual entry: https://docs.mailwatch.org/using/user-filter.html

is that how it works now? Should I rename my domain admin users?
by ovizii
13 May 2019 04:44
Forum: Discussion
Topic: question about user types
Replies: 8
Views: 3401

question about user types

I previously had only listed one user per domain as domain administrator, it looked like this: https://monosnap.com/file/TMty0szOLSMhTJiuoezZF11tILsmiE you notice the user name is the full domain. Seems that is no longer possible as I now get: "For all users other than Administrator you must use an ...
by ovizii
05 Mar 2019 12:16
Forum: 3.x How-to
Topic: Custom bad sites Phishtank.com
Replies: 12
Views: 2382

Re: Custom bad sites Phishtank.com

@alleyviper: you should add this to the github issue tracker as a feature suggestion for EFA v4 though => https://github.com/E-F-A/v4/issues
by ovizii
05 Mar 2019 12:14
Forum: 3.x How-to
Topic: Custom bad sites Phishtank.com
Replies: 12
Views: 2382

Re: Custom bad sites Phishtank.com

I do think adding phishtank is unnecessary as after reading this old thread it seems it is or was already incorporated: https://forum.efa-project.org/viewtopic.php?f=14&t=1736 /etc/MailScanner/phishing.bad.sites.conf USED to include this line: # This file is updated once per day from http://www.phis...
by ovizii
05 Mar 2019 12:09
Forum: 3.x How-to
Topic: Interesting email based blacklist
Replies: 11
Views: 2496

Re: Interesting email based blacklist

Hi there, Where to put pm file included? I don't think its necessary to do anything. as of Sa 3.4.2 if you have /etc/mail/spamassassin/hashbl.cf look inside, mine says: loadplugin Mail::SpamAssassin::Plugin::HashBL HashBL.pm ifplugin Mail::SpamAssassin::Plugin::HashBL header HASHBL_EMAIL eval:check...
by ovizii
05 Mar 2019 11:54
Forum: 3.x How-to
Topic: How to use phishing.safe.sites.custom ?
Replies: 4
Views: 1454

Re: How to use phishing.safe.sites.custom ?

Sounds good. here is a link to a more current documentation: https://spamassassin.apache.org/full/3. ... _Conf.html

I'm going ahead and will use:

unblacklist_from *@onedrive.live.com
unblacklist_from *@play.google.com
by ovizii
19 Feb 2019 11:12
Forum: 3.x Feature Requests
Topic: Supported Antivirus Consideration & Question
Replies: 7
Views: 3797

Re: Supported Antivirus Consideration & Question

Not trying to hijack your thread just some input: we are also using the free sophos version and have bought additional AV definitions for clamav: securiteinfo - roughly 30€ / year for their professional subscription and malwarepatrol - roughly 40€ / year This and using clamav-unofficial-sigs with th...
by ovizii
29 Nov 2018 20:41
Forum: 3.x How-to
Topic: How to use phishing.safe.sites.custom ?
Replies: 4
Views: 1454

Re: How to use phishing.safe.sites.custom ?

Thanks for the workaround. I'll do that until someone finds a better way.
by ovizii
22 Nov 2018 13:05
Forum: 3.x How-to
Topic: How to use phishing.safe.sites.custom ?
Replies: 4
Views: 1454

How to use phishing.safe.sites.custom ?

I had read (somewhere) that I can add safe sites in here to mitigate the problem that the global "bad" list lists onedrive.live.com and play.google.com by listing them inside phishing.safe.sites.custom - and yet even after restarting Mailscanner, these lists still get marked as phishing fraud. Did a...
by ovizii
27 Sep 2018 08:22
Forum: Discussion
Topic: web interface unreachable 2-3 times a day
Replies: 7
Views: 1445

Re: web interface unreachable 2-3 times a day

Thanks for the pointers. I will do all of that and reply if / when it happens again.
by ovizii
26 Sep 2018 08:36
Forum: Discussion
Topic: web interface unreachable 2-3 times a day
Replies: 7
Views: 1445

Re: web interface unreachable 2-3 times a day

nope. the system resources for EFA are actually over-sized. To give you an idea, this EFA instance has about an average of 150 emails per working day and 20 per Sat/Sun. Its a VM with 8GB RAM and 2CPUs. The problem has recently started and hasn't happened again since I posted here. I was rather curi...
by ovizii
24 Sep 2018 07:47
Forum: Discussion
Topic: web interface unreachable 2-3 times a day
Replies: 7
Views: 1445

web interface unreachable 2-3 times a day

EFA keeps working but the web interface keep telling me cannot connect or unreachable. Solved by doing a /etc/init.d/httpd restart the /var/log/httpd/error.log file says: [notice] child pid 53446 exit signal Segmentation fault Any ideas? I already did a yum update.This happened twice in the last 24h