Mail server is to strict with filtering? And virus mails get through sometimes!
 

Hey guys,

I noticed that when i forward mails from my own hotmail account to the bots-united account, i do not recieve mails. Even some people who mail me directly from hotmail to stefan@bots-united.com do not seem to get through.

I was wondering how this could be. Perhaps the 'spam filter' is to strict. I can send you a list with good mail adresses if that is needed.

I also want to point out i have been recieving a few mails from 'fake bots-united members'. This is like, i get a mail from Aspirin (and the e-mail adres is okay there too in the 'from' field), or from myself. It has a file attached, but was already removed by my Norton Antivirus.

Just pointing out , perhaps something can be fixed about this?

Btw, i care more about the 'mails not getting through' subject because i could miss vital information with (good) attachements from my fellow students...

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

ok, just to understand the filtering ...

every mail is scanned and assigned a score. If the score is higher than 5 then the mail gets dropped ... everything from hotmail any yahoo automatically gets 2 points ... so there is very little othjer triggers needed to stop the mail ...

thats why

:) tell your friends to get a proper email adress. i would really like to set the filter to DROP everything from yahoo / hotmail, cant do that unfortunately :) i will look into that virus thing, can u sent me a copy of those mails as well as the norton logfile please ?

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

Yes BTW,
I noticed I can't seem to get any email from SoUlFaThEr anymore (his address is at web.de)
Could you check that too while you're at it ?

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

Ok i have changed a few settings.

1) hotmail / yahoo only get 1 point autmatically
2) if a mail is blocked (for any reason) the sender gets notified why

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

i have a web.de adress too, i will check

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

ok boys, i made some more changes.

I updated SpamAssassin, MailScaner and f-prot, now spamasssin does NOT block any mail, it just puts the tag [spam] in the subject line of a mail that its believes is spam. Please update your mail programm to filter out these mails manually ... viruses get deattached and the orignial mail delivered.

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

deattaching is a fine idea, otherwise I would have killed you, and the weird frenchman would have done the like ...

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

please revert that, it also changes the subject of all other messages to [clean], i really don't like that ;)

also why change at all, we are a closed organisation, allthough we should agree on what to do, i don't think it good to make more traffic because a virus is found....

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

I don't like that either. It takes AGES on my 56k to download all this shitty spam, and I should delete 95% of it ? Man that wants to say that I could download my emails 95% faster. No shit ! Something must be done. Can we add rules manually to the spam filter ? Show me a little tutorial and I'll get my hands in it. >:(

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

Well i CAN set it that way, but then dont complain that the filter is too strict. We have the following options

bounce: bounce spam back to sender
deliver: deliver with modified subject line
store: store do not modify
forward: forward all spam into seperate flolder
delete: sent the lot to /dev/

I would prefer option 5, no user intervention and so on. BUT THAT WAY IF A MESSAGE IS ACCIDENTALY CONSIDERED SPAM IT WILL BE HARD TO RECOVER !

So what do we want. I have also removed the [clean] tag again, forgot to take that back out ... only [spam] and [bad filename] and [virus] stay

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

do not send something to the emai address sending the virus, those sender addresse are VERY orften forged, to this becomes collateral spam.
and in the end is in my postbox (me=postmaster)

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

Its weird that hotmail adresses gets a score, because its from hotmail. Its just because a lot of people use it, it does nto mean it is spam (although spam mails will use a 'fake' adress 'from' hotmail).

Anyway, i can't check my mail from here yet, so i will notify you later if it worked for me. Anything that is spam that could be deleted in my opinion. The problem is when the mails are not spam and get deleted.

There must be a whitelist no? Well, if so, i just send you mail adresses that are confirmed and okay.

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

Oh well, i have set spam to go straight to /dev/null now. if some mails dont seem to get through, its probably the attachments.

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

I have recieved some hotmail mails today, great work. No virusses today, when i have some i will notify you Nova. Thanks ;)

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

You wont get virus mails. a mail taht contains a virus is immediatly sent to /dev/null

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

Well, thats my point. I DID recieve virus mails even with the virus protection we had. Perhaps you changed something, and i did not pay attention to it. Anyway, i rely on the virus scanner at our server.

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

hmmm. if you DO get a virus, can you please post the WHOLE email including headers in the forum and upload the virus to /var/spool/MailScanner/quarantine ?

Thnx.
Seb

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

I will try to send you as much information when it happens again. I have an own virus scanner which eliminates the virus before it hits my mailbox. Anyway, i bet Norton also gives information about the virus itself?

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

Why not make a full killer mail program that learns what spam e-mail is and kill it and learn from non-spam e-mails. (using AI techniques of course, got you guys interested...)I might try myself :) I've already made a program that simply deletes emails more than 15KB from my e-mail because my ISP email gets so much spam :( I guess its a start :p

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

well, that is what a bayes filter is about. it's allready used by spam scanners and netscape mail. whilst server side scanners do more, they have big lists and stuff.

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

The spammers have developed a new technique which almost always bypasses most spam filters:
All spam filters which are based on some kind of statistical analysis (e.g. bayes or razor) depend on statistical analyzable data. They assume that most spam has common attributes e.g. words like "viagra" or whatever the spam wants to advertise. And they assume some other criterias like a minimum percentage of HTML code.
What the spammers do to bypass the filters is very simple but effective:
- avoid those keywords
- use 1337 language for keywords !!!!
- add some random text to the mail to make each mail unique

@spamassassin:
Don't use Subject: rewriting, instead use the X-Spam headers. Your Subject: lines won't get altered and almost every mail client can filter for custom header lines.

@general suggestion:
Use IMAP instead of POP3.
With IMAP you can have your mail folders at the server and also filter the mails at the server into different folders. Users with slow connections benefit from another feature too: the e-mail clients doesn't need to download the entire messages, instead he only downloads some parts of the header to get an overview of the mails. And only if the user opens a message it's downloaded. And even then attachements are only downloaded at request.

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

we have imap here, i think i saw it open in the firewall. also the wiki uses imap for the staff authentication; and the server is started in the inetd :)

so i encourage all BU email users to switch to imap mail clients.

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

Back on Cheeseh's suggestion.

This is VERY MUCH doable.

Currently, what no mail scanner can do, is scanning the message in its POST-PROCESSED form. Meaning, when all the <sutghdigsud> </sdghldfgsu> tags have been cleaned out, when "Vìàgrà" has been translated into "Viagra", when the 2-pixel high random text has been stripped, when the white text that no one can see on the white background has been stripped too. It's all about cleaning the spam. THEN, it would be very easy to filter that out.

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

OMG. THIS MailServer is a serious mess. Ok, volunteers please:

I really need someone that

1) Has extensive sendmail knowledge, and can install / configure sendmail for all the domains / users on this server properly (coz the config is a mess and all over the place, especially the userpermission of the spooler files ...

2) Configure the IMAP. What i really would like to do. Have two specific IMAP folders. One that low-scoring spam gets written into (between 5 and 10 spamassasin score) and one for highscoring (above 10)

3) Someone that knows MailScanner better than I do (because most of the time is just take a good guess and hope it works ...

4) Someone that knows how to PROPERLY configure spamassassin so that its integrated in MailScanner properly.

If ANYONE is up for the challenge, please post here or email me or whatever.

Regards,
Sebastian

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

Well back to what I was saying, I was meangin making an end-user application, that simply downloads stuff from the server and can go into two categories, spam & not spam. And the program can learn from these e-mails to figure out what is spam and isn't, and of course it might think non-spam stuff is spam, so move it into spam stuff and make it learn etc.etc... some sorta big dynamic NN might work lol :O and things that identify each e-mail either by splitting it up into words from a dictionary or taking crc's and md5sums. urk:D

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

Finally I got some time again to participate at BU :-)

@Nova:
@sendmail:
sendmail is one of the worst pieces of code ever written. Dump it. It has a never ending story of serious bugs and this will never end because of it's poor design.
@IMAP:
You don't need to configure this, usually the user creates the folders.
@Mailscanner:
I don't know about this tool.
@spamassassin:
Add it to the individual users .forward file...

@Cheeseh:
Those applications already exist. E.g. current versions of mozilla/thunderbird or opera have this feature.

Re: Mail server is to strict with filtering? And virus mails get through sometimes!
 

:o cool never knew :p