hMailServer forum

thomas10

Aside on this, I found that in the hmail log file, there are a lot of different IPs trying to access but most of them get "Authentication failed. Restarting authentication process." Many of us block AUTH on port 25 to mitigate these threats. (This is done in the hMailserverv.ini, and MAY require th...

thomas10

Huh, That is fresh news to me. I just checked on the location at C:\Windows\System32\config\systemprofile\.spamassassin, there are only files with bayes journal, toks, etc, no user_prefs file inside. then put one and try. (no extension, filename as only user_prefs ) Ok, If I put there, do I still n...

thomas10

Ok, will use your sample. I input them in the local.cf. I believe that restart SA service every time updating the code will be the best to make sure the code run normally. (I always did that when updating the blacklist and whitelist cf):lol: assuming your SA is JAM Win: there should be a file in <w...

thomas10

body PHISH_BODY_1 /^.*( [ b] cancel de-activation|cancel deactivation [ /b] ).*$/i body PHISH_BODY_2 /^.*( [ b] Keep Your Old Password [ /b] ).*$/i meta PHISH_BODY (PHISH_BODY_1|PHISH_BODY_2) score PHISH_BODY 10.0 describe PHISH_BODY My Phishing BODY Rule[/code] Why do you have [ b] tags there? It ...

thomas10

@jimimaseye Done with rules for the subject and test working. But how about the message body? I have done with some testing with the rules below, but it doesn't seems to be working. I insert texts below in the message body of the test message via external email address, but the message still goes th...

thomas10

yes you can clear them manually (unless they are for NOW) ok, Thanks for clarfying. I found these old temp files when I ran full scan using antivirus software and it detected that there were some of these files infected. Cool, I will delete them and only keep the today's temp file. :lol: Thanks aga...

thomas10

Hi All, I found that there are a lot of SA temporary files under Windows- Temp folder with the name such as .spamassassin-3836lxD7Fatmp, .spamassassin-4600XKpxQStmp, etc. Some files have old modified date which seems didn't being removed. :? Can I clear them manually? or is there any kind of .bat co...

thomas10

@jimimaseye I have faced an issue. I tried to set score for the text "upgrαde required" in SA but when save the local cf, a pop up said the file contains characters in Unicode format which will be lost if save the file as ANSI encoded text file. The culprit is the letter "a" in the text upgrade. Ple...

thomas10

The link i posted should tell you how to do OR comparisons. After read through, I only manage to find && and +. For the OR, I believe will still be the || that I set previously. RvDH also provide the answer for it too. Thanks again. I have bookmarked the page for future reference. But one more ques...

thomas10

Q1) Rule looks fine and should be captured when in local.cf Q2) meta PHISH_SUBJECT (PHISH_SUBJECT_1 && PHISH_SUBJECT_2 && PHISH_SUBJECT_3) would work if you specify PHISH_SUBJECT_3 regex Q3) I haven't heard/seen limits of spamassassin regex's Thanks so much RvDH for your answer. Will compile them u...

thomas10

I'm confident that defaults defaults spamassassin ruleset will have identified this as spam already and that your score threshold is too high. It is the easiest thing to do without repercussions. What are your settings? run this and post the results: https://www.hmailserver.com/forum/viewtopic.php?...

thomas10

Update: (02 July 2020) Few days ago, I set the rules separately into 3 parts due to the limitation of blocked texts in regex to be set. Today, I found that only the first rule is working and not the other two rules. I set them with the same criteria and action except the texts to be set in regex. Af...

thomas10

Dunno. You havent said what you were trying to enter. And I dont think anyone knows of a limit or what it is. i certainly had a rule that incorporated 7 or 8 words but its likely that you hit a character string limit (if there is one). Post your desired rule here or test yourself by shortening (spl...

thomas10

oooh. Storage full of Sexy Bitcoins. Oooh..... (Nurse!) :lol: (BTW: |SEX|SEXY| - is duplicate and not required. "SEX" is already found in "SEXY". You only need "SEX". (Dont we all?!)) Gosh jimi, of course I need "SEX" :oops: :oops: By the way, for the regex, I was thinking to add more keywords but ...

thomas10

Hi Guys, The Regex works. Thanks Guys. Really Appreciate it. :D :D :D Criteria: (Use And) Subject-> REGEXP-> (?i:^.*(STORAGE FULL|SEX|SEXY|BITCOIN).*$) x-hmailserver-loopcount-> LESS THAN-> 1 Action: Forward-> My Email Delete Meaning any text contains storage full/ sex/ sexy/ bitcoin will be forward...

thomas10

Guys, Thanks for replying. I was just gotten the answer by adding the x-hmailserver-loopcount < 1. Also set Use And. Thanks Jimi. But I need to remove the "subject-> contains-> blocked" in order to make it work. So after done, the subject that contains "Storage full" will be captured. That's what I ...

thomas10

Hi, I was trying to set a Global Rule with the purpose below. User A sends an email to User B with Subject: "NOTIFICATION - Storage Full/Blocked..". I want to use Global Rule to forward the email with the subject Storage Full/Blocked to my email and delete the email without reaching to User B. I set...

thomas10

Hi All, I recently receive some email sent from different email address and IP but with same email message. I know that it can be resolved by decreasing the delete threshold but I haven't tried on how to set score for certain texts. So I need to learn and get help from you guys on this. - May I know...

thomas10

jimimaseye wrote: ↑
2020-04-16 11:17
This will give you help: https://www.hmailserver.com/forum/viewt ... 21&t=29179

(Section 1 applies)

[Entered by mobile. Excuse my spelling.]

Hmm, interesting, will study this. Thanks Jimi.

thomas10

Let your spamassassin do it's job. X-Spam-Level: **** X-Spam-Status: No, score=4.6 required=5.0 Your spamassassin had already determined this to be spam but your threshold is way too high. In my experience anything over 3 is definitely spam and most email is mainly under 1(often -ve). Change your ...

thomas10

Hi All, I found that there are some spam mails with the same sender name(Dr. Somnath Sakore) but with different email address. Is that possible to use Global Rules to block just the Sender Name only? Sample Below: Received: from advanced1.interideas.net (advanced1.interideas.net [198.46.83.140]) by ...

thomas10

Yes there is definitely something wrong with your setup. State A, how is your autoreply configured? B, what script do you have in place? run this and post the results: https://www.hmailserver.com/forum/viewtopic.php?f=20&t=30914 and include rules for the account with autoreply enabled. [Entered by ...

thomas10

Hi All, I set an autoreply for an user. In my understanding, if I send an email to the user, the autoreply will be triggered and send to me. But there is another scenario. When the user sends me an email, the autoreply triggers and send to me. a. User sent email to me. b. User's autoreply email came...

thomas10

Hi All,

Sorry for super late reply.
Have done the migration and yeah, just copy and paste the needed files and done.
Thanks again jimi and guys again.

thomas10

I performed a migration a few days ago and can confirm that the procedure @jimimaseye suggested works. As far as I can tell, those of us who use the built-in database and have a huge amount of message data have to copy the database file (hMailServer.sdf) over, since backups won't allow us to save d...

thomas10

Should be ok. Perhaps use /MIR which keeps it up to data. Then copy the sql database file from the database directory and the existing hmailserver.ini file. Assuming all paths are identical (and security settings/ permissions ) on both the old and new server then you should them be able to turn the...

thomas10

Added:
I have read some mentioned about using robocopy to backup the data folder.
Is the command something like below?

Code: Select all

robocopy C:\Program Files (x86)\hMailServer\Data E:\backup\Data /e

thomas10

Hi All, We are going to migrate to new server due to the current one has some issues. We have referred to the documentation about Moving to a new server: https://www.hmailserver.com/documentation/v5.1/?page=maintenance_newserver - New Server info: Win 2008 R2 standard - SQL Compact Edition (built-in...

thomas10

ok, will take your advice on it. Hopefully everything will be ok. Hmail rocks.

thomas10

Thanks Soren and Jimi. jimi, Will do on the setting. but for the URIBL_BLOCKED issue, I don't have any DNS server here. I believe this means some sort of the quota has been exceeded and that's why it is being blocked. I read your suggested post, but how to add the records as mentioned in your last p...

thomas10

so you get a quit and a log on every second? That seems unusual, although I have seen mobiles phones do silly things while they are being charged Ya, pretty sure is every second because the next same log starts again when the first log quit. Just share below log for your reference. I will check on ...

thomas10

Maybe the user has ben playing with his phone, messing with settings, and misconfigured it. Perhaps his choice of mail app allows the Poll (pop) frequency be set in seconds but he thought it was minutes (and he's entered "1"). Get phone, turn it off, turn it on, check settings, check future logs. O...

thomas10

Hi All, Need some help here. One of the user has received one spam mail without sender email stated. I tend to block the email/domain name but I'm not sure which is the one. Below is the message log. Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on GCF X-Spam-Flag: YES X-Spam-...

thomas10

Hi Matt, Thanks for clarifying. hmm, although the send/receive setting was 1 minute, but this happens every second which is weird to me. and also, the user shouldn't be using the email account at that period of time (Sleeping time). But anyway, I will have a check out on the user. Update: Ok, it is ...

thomas10

Hi All, I need help here. I am not sure what's going on. This message has kept on repeating in hmail log for 2 days and it happens in the midnight till morning from my side. It has caused the log file size becoming very big. Is there anything wrong in the message? "TCPIP" 3016 "2018-07-26 05:06:45.8...

thomas10

Hi All, Recently, I found that sometimes in the spamd, it mentioned about Bayes: cannot open bayes database. Below is the sample: Thu May 31 17:40:49 2018 [-2928] info: spamd: connection from GCF [127.0.0.1]:58866 to port 783, fd 7 Thu May 31 17:40:49 2018 [-2928] info: spamd: processing message <16...

thomas10

Fair enough. I do note, however, that it is already identified as spam (by a long way - I dont expect anything over 2.5 and have 3 as my threshold). Out of interest, what are the Spamassassin headers/report? )Dont the headers already say BAYES probablity > 80%?) You are right indeed, the probabilit...

thomas10

Jimi, you are right indeed, i have misread the one you mentioned about the bat I am running. Silly me

Thanks for your suggestion jimi.
Below is the sample of the spam I have found here, the size is 702kb.

thomas10

Update:

Finally found the answer from this link.
viewtopic.php?f=22&t=26750&p=163734&hilit=max#p163968

Need to edit the trainbayes.bat file to set the max message size.

thomas10

Update:

Tried with code below in spamc.conf or spamc.cf in /etc/spamassassin, but the max size still the same.

Code: Select all

# spamc global configuration file
# max message size for scanning = 700k
-s 700000

thomas10

Ok noted. Will try it on next week and see the outcome.

One last question, is bayes learning supporting .msg file (Outlook message file)?
Because I tried yesterday and it seemed to work.

If so, then I have no need to worry on converting.

thomas10

2) Some spam mails are unable to learn due to greater than max message size (512000 bytes). The size of the email is more than 512kb but it is spam. What should I do? It exceeds the SPAMC maximum message size. Ignore it or increase your max message size: https://spamassassin.apache.org/full/3.2.x/d...

thomas10

Add On another question:
What file type that trainbayes.bat support? I just tried with mbx, eml and msg (File copy out from outlook), and it works.

thomas10

Hope someone can help me out on Bayes training. 1) Message successfully un/learned. Is it learned? Because I am confused on 'un/learned'. As shown below: spamd learn.jpg 2) Some spam mails are unable to learn due to greater than max message size (512000 bytes). The size of the email is more than 512...

thomas10

No probs. TBH I dont claim to know much about the technical workings and, in fact, my Spamasassin installation is more or less out-of-the-box regarding configuration (as detailed in 'my preferred' set up on this forum). There are others on the forum that pay more attention or are more particular wi...

thomas10

Its not so straight forward yes or no. https://wiki.apache.org/spamassassin/AutolearningNotWorking Tip: the spamassassin mail list is the best place for specific functionality questions. (I am subscribed for curiosity and it is always being answered by helpers). hmm...ok. As long as SA works, that ...

thomas10

fixed Thanks You're welcome and thanks for fixing, matt. I have successfully turn on SA and the Chinese text spam is finally out of sight. Thanks for the guidance. I have set 'bayes_auto_learn 1' in local.cf but I am not sure whether the auto learn is running or not as the token is still the same w...

thomas10

jimimaseye wrote: ↑
2018-02-26 13:19
Yes, --max-children is a parameter and should be one full word.

Where did you get these instructions? Do they also show the misplaced space?

This is the link. By percepts. There is a space there.
viewtopic.php?p=164408#p165590

thomas10

UPDATE:

I HAVE GOT THE ANSWER.
l -s "C:\Program Files (x86)\hMailServer\Logs\spamd.log" --max-spare=2 --max- children=20 --timeout-child=20

There is a space in between which kills it. now the test is done. Thanks so much JIMI.

thomas10

I cant help you with that type of installation of the service as I dont do it that way. I do it a little simpler: https://www.hmailserver.com/forum/viewtopic.php?f=21&t=28133 (using NSSM) Tried the nssm method. path: C:\Program Files\JAM Software\SpamAssassin for Windows\spamd.exe Startup Directory...

thomas10

Updated: Found that I need to double click the spamd.exe to have it run and then the test worked. How in the hell it happens?lol That means that you dont have the SERVICE running then. Manually running the spamd.exe is not running the service. Set the spamd to run as a service so it starts as a pro...

thomas10

Therefore the Service is not running or responding. Check the service is installed correctly Check that the address/port is set correctly in HMS Check the service is running Check the firewall allows the comms (port 783) Hohoho, I have no idea where I did wrong, Service install correctly and starte...

thomas10

Update:
1) While clicked Test, it mentioned "unable to connect to the specific SA server."
2) The spamd.log isn't created.

thomas10

Problem when trying to test the SA.
it said unable to connect to the specific SA server. Why?

thomas10

Yup, Same as yours m using HITS and [SPAM] in hmail. only that the required_score on my side is 5. :D I find a threshold of 5 is too high leaving many spam emails free entry without being marked. I never see valid emails over 2 (max) and usually below zero. No worries jimi, I set this just to see h...

thomas10

If your SpamAssassin 'required_score' was say 3, and then scored at least that number, then it will say that the message is SPAM Actually it will mark according to whatever you set in your local.cf under rewrite_header Subject . In my setup it doesnt write "spam"- I have it put the score (" [_hits_...

thomas10

SpamAssassin score independently from hMailserver. If your SpamAssassin 'required_score' was say 3, and then scored at least that number, then it will say that the message is SPAM If in hMailsevrer you set to NOT use SPamAssassin score, but instead choose 5 as the SpamAssassin score, then no matter...

thomas10

If you want to react (by a rule) only to SA scoring then count the asterix ('X-Spam-Level' Contains '********') If you want to react to HMS system then review the header X-hMailServer-Spam' Equals: 'YES' or X-hMailServer-Reason-Score. (HMS scoring system is also used by the 'Spam Mark' and 'Spam De...

thomas10

If you set delete threshold at 8, but use a set score for SpamAssassin as jimimaseye does, then using a rule that catches Custom header field: 'X-Spam-Level' Contains '********' << 8 asterix will catch mail that SpamAssassin sees as higher than 8 on it's own. It is possible that all other hmailserv...

thomas10

Ok matt, thanks for your explanation. So there is no need to set rules to forward email that score more than 8 as it is already deleted due to Delete Threshold:8. To receive higher score email, Set the Delete Threshold higher. Lastly, a delete set in the rules, email won't go to the original recipie...

Search found 82 matches