Search found 123 matches

by Nime
2021-03-01 01:28
Forum: Scripting
Topic: Is there any event to detect auth failures?
Replies: 2
Views: 41

Is there any event to detect auth failures?

I want to detect, count and then run external script to add entry into Windows Firewall. I know AutoBan is useful but swarm of IP range try to brute force for days. I've contacted abuse@netadmin but it didn't stop and I've manually added the IP range as firewall rule. New IP ranges are coming. I nee...
by Nime
2020-10-06 15:57
Forum: General discussions
Topic: How to monitor delivery queue?
Replies: 5
Views: 1505

Re: How to monitor delivery queue?

I do fully test by sending a message and then waiting for to receive it again. The server might run locally, I also test at WAN wide, so if something is wrong I restart server instead of hMailServer service.
by Nime
2020-10-06 14:21
Forum: General discussions
Topic: How to monitor delivery queue?
Replies: 5
Views: 1505

Re: How to monitor delivery queue?

Oops, I've already wrote a tool to check server health including online check, SpamD, ClamAV, SMTP and POP3 send & receive. I just needed to reset the new password and that's it. If anyone interested I can share C# solution.

Image
by Nime
2020-10-06 13:55
Forum: General discussions
Topic: How to monitor delivery queue?
Replies: 5
Views: 1505

How to monitor delivery queue?

Sometimes the delivery queue might stuck. Is there any script or tool that monitors excessive queue? Restarting hMailServer service or Windows Server can help. Retry counts and queue counts combined might be useful to decide what to do.
by Nime
2020-09-29 19:49
Forum: General discussions
Topic: Can I ban double attachment extensions like *.gz.txt?
Replies: 6
Views: 1983

Re: Can I ban double attachment extensions like *.gz.txt?

This is the report of banned messages, huge decrease! Guys, can you modify the regex so I can also ban *.GZ.TXT.TXT or simply *.GZ.* ?

Image
by Nime
2020-09-22 18:34
Forum: General discussions
Topic: Can I ban double attachment extensions like *.gz.txt?
Replies: 6
Views: 1983

Re: Can I ban double attachment extensions like *.gz.txt?

Thanks guys!
554 Tagged as Spam by SpamAssassin
by Nime
2020-09-18 13:37
Forum: General discussions
Topic: Can I ban double attachment extensions like *.gz.txt?
Replies: 6
Views: 1983

Can I ban double attachment extensions like *.gz.txt?

It seems like I cannot.

Neither SpamAssassin nor ClamAV+SaneSecurity can block *.GZ.txt attachments and I got tons of spams everyday.
by Nime
2019-12-18 13:36
Forum: General discussions
Topic: False positive SURBL match
Replies: 19
Views: 5104

Re: False positive SURBL match

After setting up a different DNS server it looks like fixed: "DEBUG" 3724 "2019-12-18 14:12:41.344" "Adding task AsynchronousTask to work queue Asynchronous task queue" "DEBUG" 3440 "2019-12-18 14:12:41.344" "Executing task AsynchronousTask in work queue Asynchronous task queue" "DEBUG" 3440 "2019-1...
by Nime
2019-12-18 12:26
Forum: General discussions
Topic: False positive SURBL match
Replies: 19
Views: 5104

Re: False positive SURBL match

C:\Users\ea>nslookup Default Server: 213-142-152-254.reverse.adeox.net Address: 213.142.152.254 > microsoft.com.multi.surbl.org Server: 213-142-152-254.reverse.adeox.net Address: 213.142.152.254 *** 213-142-152-254.reverse.adeox.net can't find microsoft.com.multi.surbl.org: Non-existent domain > se...
by Nime
2019-12-17 16:55
Forum: General discussions
Topic: False positive SURBL match
Replies: 19
Views: 5104

Re: False positive SURBL match

I'm not from China.
My DNS is 127.0.0.1 / WAN IP: 195.174.32.234
Is dbl.spamhaus.org alternative to multi.surbl.org?
by Nime
2019-12-16 16:38
Forum: General discussions
Topic: False positive SURBL match
Replies: 19
Views: 5104

False positive SURBL match

I've disabled SURBL server (multi.surbl.org) bec. of false positives. Below is the log snippet: "DEBUG" 3548 "2019-12-16 09:14:20.303" "Adding task AsynchronousTask to work queue Asynchronous task queue" "DEBUG" 3284 "2019-12-16 09:14:20.303" "Executing task AsynchronousTask in work queue Asynchrono...
by Nime
2018-07-12 16:12
Forum: General discussions
Topic: net stop hmailserver won't kill the process hmailserver.exe
Replies: 17
Views: 6344

Re: net stop hmailserver won't kill the process hmailserver.exe

No, It's virtual server with synthetic drivers. Process Explorer can't kill it either.
by Nime
2018-07-12 14:15
Forum: General discussions
Topic: net stop hmailserver won't kill the process hmailserver.exe
Replies: 17
Views: 6344

Re: net stop hmailserver won't kill the process hmailserver.exe

In a batch file if error detected then I stopped and restarted the service and it has spawned multiple hmailserver.exe processes. Then I noticed the service won't stop.
by Nime
2018-07-12 13:35
Forum: General discussions
Topic: net stop hmailserver won't kill the process hmailserver.exe
Replies: 17
Views: 6344

Re: net stop hmailserver won't kill the process hmailserver.exe

5.4 because I'm happy with it. How many minutes? After 10 minutes there is still the process. I cannot kill it either.
by Nime
2018-07-12 13:06
Forum: General discussions
Topic: net stop hmailserver won't kill the process hmailserver.exe
Replies: 17
Views: 6344

net stop hmailserver won't kill the process hmailserver.exe

The command below won't stop the process hmailserver.exe on Windows Server 2008 box. net stop hmailserver https://i.imgur.com/Y9zCdYE.png I cannot establish telnet connections to ports like 25 and 110. I've examined opened port by hmailserver.exe https://i.imgur.com/MZLO0cR.png And it's nearly impos...
by Nime
2017-11-30 15:59
Forum: General discussions
Topic: ClamAV: No action performed on a mailbox
Replies: 10
Views: 4163

Re: ClamAV: No action performed on a mailbox

I delete infected files by hand and rescan the data folders. It takes 30 minutes. I update Sanesecurity hourly. Currently paused the updates to test.


Script output: https://pastebin.com/P22V76M2
by Nime
2017-11-30 14:33
Forum: General discussions
Topic: ClamAV: No action performed on a mailbox
Replies: 10
Views: 4163

Re: ClamAV: No action performed on a mailbox

After 30 minutes I've performed another scan and got 97 more infected files. What the hell wrong with mailserver&antivirus? ----------- SCAN SUMMARY ----------- Known viruses: 6498632 Engine version: 0.99.1 Scanned directories: 13348 Scanned files: 4698 Infected files: 97 Data scanned: 1460.95 MB D...
by Nime
2017-11-30 14:24
Forum: General discussions
Topic: ClamAV: No action performed on a mailbox
Replies: 10
Views: 4163

Re: ClamAV: No action performed on a mailbox

I frequently scan the Data folder and still find infected files. Why didn't ClamAV delete these files? Scan Started Thu Nov 30 13:52:23 2017 ------------------------------------------------------------------------------- C:\NET\hMailServer\Data\{54FE2278-CC13-41D6-9D47-7AAE86B2EBA4}.eml: no action p...
by Nime
2017-11-28 14:13
Forum: General discussions
Topic: ClamAV: No action performed on a mailbox
Replies: 10
Views: 4163

Re: ClamAV: No action performed on a mailbox

It was report only. I set move to quarantine. ClamAV won't move infected files. It only reports if it finds malicious .eml files. I think I need to create a script from that report file to delete files manually.
by Nime
2017-11-28 10:04
Forum: General discussions
Topic: ClamAV: No action performed on a mailbox
Replies: 10
Views: 4163

Re: ClamAV: No action performed on a mailbox

YES I WANT TO DELETE THOSE INFECTED FILES VERY BAD!

It's better not to delever infected files.
by Nime
2017-11-28 09:46
Forum: General discussions
Topic: ClamAV: No action performed on a mailbox
Replies: 10
Views: 4163

ClamAV: No action performed on a mailbox

I've recently received an email from Google which alerts me about phishing at one of my sites. It is a webmail page. When I've examined I noticed that hMailserver messages contains tons of infected .eml files. The strange thing is hMailservser uses ClamAV as virus filter. Somehow those viruses could...
by Nime
2016-05-27 10:44
Forum: Scripting
Topic: Accept incoming mail if user recently authenticated
Replies: 13
Views: 7234

Re: Accept incoming mail if user recently authenticated

Modified for multiple recipients; it detects active user(s): ''''''''''''''''''''''''''''''''''''''''''''' Sub OnSMTPData(oClient, oMessage) ''''''''''''''''''''''''''''''''''''''''''''' Dim j, aUsername, oApp, oDomain, oAccount, oRecipient, aDomain, diffDays 'Dim isAway : isAway = True Set oApp = C...
by Nime
2016-05-26 17:12
Forum: Scripting
Topic: Accept incoming mail if user recently authenticated
Replies: 13
Views: 7234

Re: Accept incoming mail if user recently authenticated

No I've used your code except the 55x server message. Needed to check every recipients for active users and if any then accept the message. Multiple recipients are problematic: Delivery to the following recipient failed permanently: test@izsmmmo.com Technical details of permanent failure: Google tri...
by Nime
2016-05-26 16:19
Forum: User-submitted tutorials
Topic: HOW TO run Clamwin and have a ClamAV system SERVICE
Replies: 196
Views: 223482

Re: HOW TO run Clamwin and have a ClamAV system SERVICE

I'm not sure, I fired the batch manually and then scheduled, etc... I need time to understand it works or not. I'll give it another try.
by Nime
2016-05-26 15:57
Forum: User-submitted tutorials
Topic: HOW TO run Clamwin and have a ClamAV system SERVICE
Replies: 196
Views: 223482

Re: HOW TO run Clamwin and have a ClamAV system SERVICE

Hi Steve, it was a big suprise to see you here : ) I didn't test the official sigupdate.bat too much, just scheduled hourly and the next day I found js viruses again then I've panicked. If donation will help; I would like to get a private mirror. I'm just evaluating the ClamAv + Foxhole signatures. ...
by Nime
2016-05-26 15:43
Forum: Scripting
Topic: Accept incoming mail if user recently authenticated
Replies: 13
Views: 7234

Re: Accept incoming mail if user recently authenticated

Yes it worked! : ) Thanks a lot for the support... I don't deactivate the account, just won't accept new incoming messages. Delivery to the following recipient failed permanently: a.gurkan.turker@izsmmmo.com Technical details of permanent failure: Google tried to deliver your message, but it was rej...
by Nime
2016-05-26 08:35
Forum: Scripting
Topic: Accept incoming mail if user recently authenticated
Replies: 13
Views: 7234

Re: Accept incoming mail if user recently authenticated

Docs say OnSTMPData, I just copied : ) https://www.hmailserver.com/documentation/latest/?page=scripting_onSMTPdata Yeah I've asked that question in Feb. I was busy, now I have time to implement what I want, because I am fighting with spams these days. I've installed Sanesecurity & clamd with the hel...
by Nime
2016-05-26 08:24
Forum: User-submitted tutorials
Topic: HOW TO run Clamwin and have a ClamAV system SERVICE
Replies: 196
Views: 223482

Re: HOW TO run Clamwin and have a ClamAV system SERVICE

A few days ago I've added foxhole signatures, they worked at first then cryptolocker class viruses appeared again. Training the Spamassassin was useless either; the score of infected message file was 0.8 *damn* I set scheduled updates hourly. However official sigupdate.bat couldn't help. I googled f...
by Nime
2016-05-25 14:29
Forum: Scripting
Topic: Accept incoming mail if user recently authenticated
Replies: 13
Views: 7234

Re: Accept incoming mail if user recently authenticated

Ok, here is my intial code, please examine: ''''''''''''''''''''''''''''''''''''''''''''' Sub OnSTMPData(oClient, oMessage) ''''''''''''''''''''''''''''''''''''''''''''' If oMessage.Recipients.Count = 1 Then 'Ignore if there are multiple recipients Dim oRecipient = oMessage.Recipients.Item(0) If oRe...
by Nime
2016-05-24 15:44
Forum: Scripting
Topic: Accept incoming mail if user recently authenticated
Replies: 13
Views: 7234

Re: Accept incoming mail if user recently authenticated

Login or not all active inboxes receive too many messages; Facebook notifications, newsletters, etc. They increase Volume Shadow Copy & Backup disk size, eat bandwidth, consume cpu, etc. I simply disable the account after a while; daily sql update query does the job. It's a perfect solution except t...
by Nime
2016-05-24 09:52
Forum: Scripting
Topic: Accept incoming mail if user recently authenticated
Replies: 13
Views: 7234

Accept incoming mail if user recently authenticated

Currently I've deactivated the accounts if they are idle for a year. It's not the best way to save disk space, bandwidth and cpu (virus+spam check). The user might want to login again and asks for his/her password. Automatic re-activate would be nice on user authentication but I think it's not possi...
by Nime
2016-02-01 09:56
Forum: Scripting
Topic: Where is the best place to deny a message?
Replies: 2
Views: 2480

Where is the best place to deny a message?

I want to cut down the unnecessary traffic & disk usage. Currently I disable the account if it's inactive for a year. It's not a good solution for returning users. Now I decided to deny their incoming messages instead of making the account inactive. So where is the best place in the events to check ...
by Nime
2016-01-26 09:55
Forum: General discussions
Topic: Send from different address from account
Replies: 19
Views: 7855

Re: Send from different address from account

@jimimaseye: Ok, it's beyond typo. All we hate the guy who registered those domains multiple times with multiple names?

@mattg: Good eye : ) It's defined at the top of the file: Public Const msg_fromaddress = "duyuru@izsmmmo.com"
by Nime
2016-01-25 17:21
Forum: General discussions
Topic: Send from different address from account
Replies: 19
Views: 7855

Re: Send from different address from account

This script is a must in my environment with or without the problem mentioned on this thread. I also ignore the script if the sender starts with "duyuru@" from any local domains. This is the directory list of HMS: Volume in drive Z is Webserver-C Volume Serial Number is 10D0-40AB Directory of Z:\NET...
by Nime
2016-01-25 09:55
Forum: General discussions
Topic: Send from different address from account
Replies: 19
Views: 7855

Re: Send from different address from account

I've already checked, the server is not an open relay. However any authenticated user (or bot) can send fake mails. To prevent it I use the script below: Sub OnAcceptMessage(oClient, oMessage) ' Prevent authenticated user to send from fake address If oClient.Username <> "" And oClient.Username <> ms...
by Nime
2016-01-22 17:52
Forum: General discussions
Topic: Send from different address from account
Replies: 19
Views: 7855

Re: Send from different address from account

I've allowed WAN IP to send ext to ext now it seems ok. The strange thing was one domain could send while the other couldn't.
by Nime
2016-01-22 10:35
Forum: General discussions
Topic: Send from different address from account
Replies: 19
Views: 7855

Re: Send from different address from account

In my C# code there is only one account defined to auth for SMTP. There are 3 different senders, all authenticate using that account.
by Nime
2016-01-19 10:18
Forum: General discussions
Topic: Send from different address from account
Replies: 19
Views: 7855

Re: Send from different address from account

Screenshots of IP ranges are here: http://imgur.com/a/bQSVz

SMTP Route is empty.
by Nime
2016-01-15 21:46
Forum: General discussions
Topic: Send from different address from account
Replies: 19
Views: 7855

Re: Send from different address from account

Both domains are defined in HMS.
by Nime
2016-01-15 18:00
Forum: General discussions
Topic: Send from different address from account
Replies: 19
Views: 7855

Re: Send from different address from account

Allowing IP 24.133.83.138 external to external helps. What is the difference between izmirtesmer.org.tr and izsmmmoegitim.org.tr? Should I check my DNS?
by Nime
2016-01-15 17:32
Forum: General discussions
Topic: Send from different address from account
Replies: 19
Views: 7855

Send from different address from account

I authenticate using address_1@domain-1.com. I can send from address_2@domain-2.com to gmail. I CANNOT send from address_3@domain-3.com. Logs say "Delivery is not allowed to this address." Notice: One address can send, the other one cannot. Here is the log: 84129 and 84130 are the lines. http://past...
by Nime
2014-01-24 16:37
Forum: General discussions
Topic: Delivery queue problem
Replies: 4
Views: 2204

Re: Delivery queue problem

No spam, I monitor our IP against blacklists too. 5.4 B1950
by Nime
2014-01-24 15:37
Forum: General discussions
Topic: Delivery queue problem
Replies: 4
Views: 2204

Delivery queue problem

Recently, the queue is always full 4000+ msg. It looks like the process is paused. Even internal messages are not delivered, I force a message; right click & send now, no responses... Damn, I hit Pause and paused, I hit Pause again and now resumed... I spent 2 days, did one reboot, got one stupid ca...
by Nime
2014-01-01 21:14
Forum: Off-topic discussions
Topic: Blacklist: Which IP to monitor?
Replies: 1
Views: 2692

Blacklist: Which IP to monitor?

I use a relay server to deliver external mails. I use relay server's IP in SPF record. But I'm not sure about blacklist monitoring/checking. Should I check main server's IP or relay's IP?
by Nime
2013-11-21 21:12
Forum: General discussions
Topic: Authenticated user can send from fake address
Replies: 3
Views: 3007

Re: Authenticated user can send from fake address

Now it should be ok; not sure, dik@ was not external, was fake/nonexist.
Settings > Advanced > IP Settings > Allow deliveries from: External to external [Disabled]
by Nime
2013-11-21 17:34
Forum: General discussions
Topic: Authenticated user can send from fake address
Replies: 3
Views: 3007

Authenticated user can send from fake address

There is no mail address like dik@izsmmmo.com. How can I prevent a user to send from fake address? And how can I detect that user -via a script- and ban? "TCPIP" 4148 "2013-11-21 16:49:13.535" "TCP - 37.25.38.81 connected to 88.255.136.44:25." "DEBUG" 4148 "2013-11-21 16:49:13.535" "Creating session...
by Nime
2013-07-30 14:06
Forum: User contributed hMailServer 5 scripts
Topic: Easy expiration: Delete aged messages
Replies: 3
Views: 6251

Re: Easy expiration: Delete aged messages

In short I delete 90 days old entries from the DB and delete +9 days older files from the disk. I DO NOT delete any necessary files. IMHO, it's still the fastest & safest & accurate method & run from batch command & scheduled easily. That's what I do. Imagine the counting expired messaged one by one...
by Nime
2013-07-30 10:16
Forum: User contributed hMailServer 5 scripts
Topic: Easy expiration: Delete aged messages
Replies: 3
Views: 6251

Re: Easy expiration: Delete aged messages

I left orphaned files because of that umm... hMailserver might not find the necessary msg file so I put a margin - 9 days... I'll delete orphaned files at next run. Here is the updated/integrated script: :: MSSQL Delete aged hMailserver messages - eminakbulut@gmail.com 30/07/2013 :: Settings @SET pr...
by Nime
2013-07-19 15:31
Forum: Scripting
Topic: How to write C# to hMailServer.Message to send mail?
Replies: 6
Views: 8524

Re: How to write C# to hMailServer.Message to send mail?

You can use mail client. Have a look: http://www.hmailserver.com/forum/viewto ... 20&t=24826

If you still want to use hMailServer.Message object:

Equivalent code of CreateObject in C#
http://stackoverflow.com/questions/1371 ... in-c-sharp
by Nime
2013-07-12 09:21
Forum: Scripting
Topic: SQL based outgoing mail limiter
Replies: 2
Views: 2719

Re: SQL based outgoing mail limiter

Yes I simply set hard limits server-wide, domains wide or account specific, no any other logic.
by Nime
2013-07-11 17:20
Forum: General discussions
Topic: Bypass Spamassassin if account is authenticated
Replies: 6
Views: 3337

Re: Bypass Spamassassin if account is authenticated

Maybe I can whitelist *@mydomain.com at SA config.
by Nime
2013-07-11 14:38
Forum: Feature requests
Topic: hMailServer Feature Request voting results
Replies: 22
Views: 14531

Re: hMailServer Feature Request voting results

Sorry but I felt in inception, because of your nested messages : )
by Nime
2013-07-11 14:27
Forum: General discussions
Topic: Bypass Spamassassin if account is authenticated
Replies: 6
Views: 3337

Re: Bypass Spamassassin if account is authenticated

They may connect from all around the world. Local user means authenticated user/account.

In short, can I exclude the user from Spamassassin using script?
by Nime
2013-07-11 08:27
Forum: General discussions
Topic: Bypass Spamassassin if account is authenticated
Replies: 6
Views: 3337

Bypass Spamassassin if account is authenticated

I want to bypass Spamassassin when a local user sends message. Is it possible?
by Nime
2013-07-11 08:23
Forum: Off-topic discussions
Topic: which c and c++ development environment would you recommend
Replies: 7
Views: 6969

Re: which c and c++ development environment would you recomm

Actual VS Express would be enough to learn & play...
by Nime
2013-07-11 08:08
Forum: Off-topic discussions
Topic: Active topics
Replies: 0
Views: 3696

Active topics

Forum cannot list the active topics. Can admin fix it? Thanks.
by Nime
2013-07-11 07:46
Forum: User contributed hMailServer 5 scripts
Topic: Database delivery log
Replies: 22
Views: 26865

Re: Database delivery log

I wrote a query which one reports the usage statistics. It counts the daily outgoing mails by accounts. SELECT deliveryaccount, DATEDIFF(d,[deliverytime], getdate()) AS [ago], COUNT(DISTINCT [hm_deliverylog].[deliveryid]) AS [session] ,COUNT( [hm_deliverylog_recipients].[deliveryid]) AS [recipients]...
by Nime
2013-07-10 17:29
Forum: Scripting
Topic: SQL based outgoing mail limiter
Replies: 2
Views: 2719

SQL based outgoing mail limiter

It logs outgoing mails and counts to prevent excessive usage; ie by bots. It uses MS SQL Server. Table #1: ex_deliverylog http://pastebin.com/3YmJcsN3 Table #2: ex_deliverylog_recipients http://pastebin.com/nJjxdLEx Table #3: ex_outgoinglimits http://pastebin.com/Ah3KDMVC Data #3: ex_outgoinglimits ...