hMailServer forum

Nime

I want to detect, count and then run external script to add entry into Windows Firewall. I know AutoBan is useful but swarm of IP range try to brute force for days. I've contacted abuse@netadmin but it didn't stop and I've manually added the IP range as firewall rule. New IP ranges are coming. I nee...

Nime

I do fully test by sending a message and then waiting for to receive it again. The server might run locally, I also test at WAN wide, so if something is wrong I restart server instead of hMailServer service.

Nime

Oops, I've already wrote a tool to check server health including online check, SpamD, ClamAV, SMTP and POP3 send & receive. I just needed to reset the new password and that's it. If anyone interested I can share C# solution.

Nime

Sometimes the delivery queue might stuck. Is there any script or tool that monitors excessive queue? Restarting hMailServer service or Windows Server can help. Retry counts and queue counts combined might be useful to decide what to do.

Nime

This is the report of banned messages, huge decrease! Guys, can you modify the regex so I can also ban *.GZ.TXT.TXT or simply *.GZ.* ?

Nime

Thanks guys!

554 Tagged as Spam by SpamAssassin

Nime

It seems like I cannot.

Neither SpamAssassin nor ClamAV+SaneSecurity can block *.GZ.txt attachments and I got tons of spams everyday.

Nime

After setting up a different DNS server it looks like fixed: "DEBUG" 3724 "2019-12-18 14:12:41.344" "Adding task AsynchronousTask to work queue Asynchronous task queue" "DEBUG" 3440 "2019-12-18 14:12:41.344" "Executing task AsynchronousTask in work queue Asynchronous task queue" "DEBUG" 3440 "2019-1...

Nime

C:\Users\ea>nslookup Default Server: 213-142-152-254.reverse.adeox.net Address: 213.142.152.254 > microsoft.com.multi.surbl.org Server: 213-142-152-254.reverse.adeox.net Address: 213.142.152.254 *** 213-142-152-254.reverse.adeox.net can't find microsoft.com.multi.surbl.org: Non-existent domain > se...

Nime

I'm not from China.
My DNS is 127.0.0.1 / WAN IP: 195.174.32.234
Is dbl.spamhaus.org alternative to multi.surbl.org?

Nime

I've disabled SURBL server (multi.surbl.org) bec. of false positives. Below is the log snippet: "DEBUG" 3548 "2019-12-16 09:14:20.303" "Adding task AsynchronousTask to work queue Asynchronous task queue" "DEBUG" 3284 "2019-12-16 09:14:20.303" "Executing task AsynchronousTask in work queue Asynchrono...

Nime

No, It's virtual server with synthetic drivers. Process Explorer can't kill it either.

Nime

In a batch file if error detected then I stopped and restarted the service and it has spawned multiple hmailserver.exe processes. Then I noticed the service won't stop.

Nime

5.4 because I'm happy with it. How many minutes? After 10 minutes there is still the process. I cannot kill it either.

Nime

The command below won't stop the process hmailserver.exe on Windows Server 2008 box. net stop hmailserver https://i.imgur.com/Y9zCdYE.png I cannot establish telnet connections to ports like 25 and 110. I've examined opened port by hmailserver.exe https://i.imgur.com/MZLO0cR.png And it's nearly impos...

Nime

I delete infected files by hand and rescan the data folders. It takes 30 minutes. I update Sanesecurity hourly. Currently paused the updates to test.

Script output: https://pastebin.com/P22V76M2

Nime

After 30 minutes I've performed another scan and got 97 more infected files. What the hell wrong with mailserver&antivirus? ----------- SCAN SUMMARY ----------- Known viruses: 6498632 Engine version: 0.99.1 Scanned directories: 13348 Scanned files: 4698 Infected files: 97 Data scanned: 1460.95 MB D...

Nime

I frequently scan the Data folder and still find infected files. Why didn't ClamAV delete these files? Scan Started Thu Nov 30 13:52:23 2017 ------------------------------------------------------------------------------- C:\NET\hMailServer\Data\{54FE2278-CC13-41D6-9D47-7AAE86B2EBA4}.eml: no action p...

Nime

It was report only. I set move to quarantine. ClamAV won't move infected files. It only reports if it finds malicious .eml files. I think I need to create a script from that report file to delete files manually.

Nime

YES I WANT TO DELETE THOSE INFECTED FILES VERY BAD!

It's better not to delever infected files.

Nime

I've recently received an email from Google which alerts me about phishing at one of my sites. It is a webmail page. When I've examined I noticed that hMailserver messages contains tons of infected .eml files. The strange thing is hMailservser uses ClamAV as virus filter. Somehow those viruses could...

Nime

Modified for multiple recipients; it detects active user(s): ''''''''''''''''''''''''''''''''''''''''''''' Sub OnSMTPData(oClient, oMessage) ''''''''''''''''''''''''''''''''''''''''''''' Dim j, aUsername, oApp, oDomain, oAccount, oRecipient, aDomain, diffDays 'Dim isAway : isAway = True Set oApp = C...

Nime

No I've used your code except the 55x server message. Needed to check every recipients for active users and if any then accept the message. Multiple recipients are problematic: Delivery to the following recipient failed permanently: test@izsmmmo.com Technical details of permanent failure: Google tri...

Nime

I'm not sure, I fired the batch manually and then scheduled, etc... I need time to understand it works or not. I'll give it another try.

Nime

Hi Steve, it was a big suprise to see you here : ) I didn't test the official sigupdate.bat too much, just scheduled hourly and the next day I found js viruses again then I've panicked. If donation will help; I would like to get a private mirror. I'm just evaluating the ClamAv + Foxhole signatures. ...

Nime

Yes it worked! : ) Thanks a lot for the support... I don't deactivate the account, just won't accept new incoming messages. Delivery to the following recipient failed permanently: a.gurkan.turker@izsmmmo.com Technical details of permanent failure: Google tried to deliver your message, but it was rej...

Nime

Docs say OnSTMPData, I just copied : ) https://www.hmailserver.com/documentation/latest/?page=scripting_onSMTPdata Yeah I've asked that question in Feb. I was busy, now I have time to implement what I want, because I am fighting with spams these days. I've installed Sanesecurity & clamd with the hel...

Nime

A few days ago I've added foxhole signatures, they worked at first then cryptolocker class viruses appeared again. Training the Spamassassin was useless either; the score of infected message file was 0.8 *damn* I set scheduled updates hourly. However official sigupdate.bat couldn't help. I googled f...

Nime

Ok, here is my intial code, please examine: ''''''''''''''''''''''''''''''''''''''''''''' Sub OnSTMPData(oClient, oMessage) ''''''''''''''''''''''''''''''''''''''''''''' If oMessage.Recipients.Count = 1 Then 'Ignore if there are multiple recipients Dim oRecipient = oMessage.Recipients.Item(0) If oRe...

Nime

Login or not all active inboxes receive too many messages; Facebook notifications, newsletters, etc. They increase Volume Shadow Copy & Backup disk size, eat bandwidth, consume cpu, etc. I simply disable the account after a while; daily sql update query does the job. It's a perfect solution except t...

Nime

Currently I've deactivated the accounts if they are idle for a year. It's not the best way to save disk space, bandwidth and cpu (virus+spam check). The user might want to login again and asks for his/her password. Automatic re-activate would be nice on user authentication but I think it's not possi...

Nime

I want to cut down the unnecessary traffic & disk usage. Currently I disable the account if it's inactive for a year. It's not a good solution for returning users. Now I decided to deny their incoming messages instead of making the account inactive. So where is the best place in the events to check ...

Nime

@jimimaseye: Ok, it's beyond typo. All we hate the guy who registered those domains multiple times with multiple names?

@mattg: Good eye : ) It's defined at the top of the file: Public Const msg_fromaddress = "duyuru@izsmmmo.com"

Nime

This script is a must in my environment with or without the problem mentioned on this thread. I also ignore the script if the sender starts with "duyuru@" from any local domains. This is the directory list of HMS: Volume in drive Z is Webserver-C Volume Serial Number is 10D0-40AB Directory of Z:\NET...

Nime

I've already checked, the server is not an open relay. However any authenticated user (or bot) can send fake mails. To prevent it I use the script below: Sub OnAcceptMessage(oClient, oMessage) ' Prevent authenticated user to send from fake address If oClient.Username <> "" And oClient.Username <> ms...

Nime

I've allowed WAN IP to send ext to ext now it seems ok. The strange thing was one domain could send while the other couldn't.

Nime

In my C# code there is only one account defined to auth for SMTP. There are 3 different senders, all authenticate using that account.

Nime

Screenshots of IP ranges are here: http://imgur.com/a/bQSVz

SMTP Route is empty.

Nime

Both domains are defined in HMS.

Nime

Allowing IP 24.133.83.138 external to external helps. What is the difference between izmirtesmer.org.tr and izsmmmoegitim.org.tr? Should I check my DNS?

Nime

I authenticate using address_1@domain-1.com. I can send from address_2@domain-2.com to gmail. I CANNOT send from address_3@domain-3.com. Logs say "Delivery is not allowed to this address." Notice: One address can send, the other one cannot. Here is the log: 84129 and 84130 are the lines. http://past...

Nime

No spam, I monitor our IP against blacklists too. 5.4 B1950

Nime

Recently, the queue is always full 4000+ msg. It looks like the process is paused. Even internal messages are not delivered, I force a message; right click & send now, no responses... Damn, I hit Pause and paused, I hit Pause again and now resumed... I spent 2 days, did one reboot, got one stupid ca...

Nime

I use a relay server to deliver external mails. I use relay server's IP in SPF record. But I'm not sure about blacklist monitoring/checking. Should I check main server's IP or relay's IP?

Nime

Great, thanks!

Nime

Now it should be ok; not sure, dik@ was not external, was fake/nonexist.

Settings > Advanced > IP Settings > Allow deliveries from: External to external [Disabled]

Nime

There is no mail address like dik@izsmmmo.com. How can I prevent a user to send from fake address? And how can I detect that user -via a script- and ban? "TCPIP" 4148 "2013-11-21 16:49:13.535" "TCP - 37.25.38.81 connected to 88.255.136.44:25." "DEBUG" 4148 "2013-11-21 16:49:13.535" "Creating session...

Nime

In short I delete 90 days old entries from the DB and delete +9 days older files from the disk. I DO NOT delete any necessary files. IMHO, it's still the fastest & safest & accurate method & run from batch command & scheduled easily. That's what I do. Imagine the counting expired messaged one by one...

Nime

I left orphaned files because of that umm... hMailserver might not find the necessary msg file so I put a margin - 9 days... I'll delete orphaned files at next run. Here is the updated/integrated script: :: MSSQL Delete aged hMailserver messages - eminakbulut@gmail.com 30/07/2013 :: Settings @SET pr...

Nime

You can use mail client. Have a look: http://www.hmailserver.com/forum/viewto ... 20&t=24826

If you still want to use hMailServer.Message object:

Equivalent code of CreateObject in C#
http://stackoverflow.com/questions/1371 ... in-c-sharp

Nime

Yes I simply set hard limits server-wide, domains wide or account specific, no any other logic.

Nime

Maybe I can whitelist *@mydomain.com at SA config.

Nime

Sorry but I felt in inception, because of your nested messages : )

Nime

They may connect from all around the world. Local user means authenticated user/account.

In short, can I exclude the user from Spamassassin using script?

Nime

I want to bypass Spamassassin when a local user sends message. Is it possible?

Nime

Actual VS Express would be enough to learn & play...

Nime

It's done: http://www.hmailserver.com/forum/viewto ... 52#p151652

Nime

Forum cannot list the active topics. Can admin fix it? Thanks.

Nime

I wrote a query which one reports the usage statistics. It counts the daily outgoing mails by accounts. SELECT deliveryaccount, DATEDIFF(d,[deliverytime], getdate()) AS [ago], COUNT(DISTINCT [hm_deliverylog].[deliveryid]) AS [session] ,COUNT( [hm_deliverylog_recipients].[deliveryid]) AS [recipients]...

Nime

It logs outgoing mails and counts to prevent excessive usage; ie by bots. It uses MS SQL Server. Table #1: ex_deliverylog http://pastebin.com/3YmJcsN3 Table #2: ex_deliverylog_recipients http://pastebin.com/nJjxdLEx Table #3: ex_outgoinglimits http://pastebin.com/Ah3KDMVC Data #3: ex_outgoinglimits ...

Search found 123 matches