hMailServer forum

SorenR

OK, so I have the following in my script file... and come to find out that it was working, but it was placing the text into internal emails instead of external ones. How can we modify the rule in this script to add it to external email, and add a couple of <CR> between the notice and the text from ...

SorenR

Rules: enabled Criteria: from: not contains [our domain] Actions: run function "ExtSource" Can someone, please, tell me what I could possibly be doing wrong? You have my sincerest gratitude!! "From" is just a mailheader and is generally faked in SPAM and Malware. You need to dig a bit deeper and gr...

SorenR

Make sure that use exact versions detailed in the readme Readme says to use VS 2013 (PRO or Express) Update 3 ... I use VS 2013 Community Update 5 and install the MS API add-ons like with the Express edition. Using the FREE "Community" edition (covers full version) enables you to use Extensions. I ...

SorenR

Well... Some of this gear is carrier grade and pretty damn expensive... https://tools.cisco.com/security/center/publicationListing.x Regarding firmware... xDSL residential customers in Denmark cannot use other equipment than the box provided by the ISP/ITSP. They can configure a DMZ and put their o...

SorenR

Well... Some of this gear is carrier grade and pretty damn expensive... https://tools.cisco.com/security/center/publicationListing.x Regarding firmware... xDSL residential customers in Denmark cannot use other equipment than the box provided by the ISP/ITSP. They can configure a DMZ and put their ow...

SorenR

anyone with a $ 150-200 router can get acceptable security for their home or small business environment I don't think so. You are entitled to your opinion ... I just wish you would stop crying "wolf" all the time... Yes, some DSL routers are vulnerable but so what. How many "innocent" subscribers d...

SorenR

How do you know which ports are allowed inbound or outbound? As Dravion says Kali Linux in default mode will find all inbound ports and what service is behind them pretty quickly. I get multiple IPs per day that try SMTP connections on my server via a custom port? How do they know which port and wh...

SorenR

Actually there is one security risk not mentioned yet...

HOMO SAPIENS

They are the biggest security risk in Cyberspace by far! Eliminate them and you are safe.

https://www.getgds.com/resources/blog/c ... ts-in-2019

SorenR

Mainframes with Token Ring or limited LAN with Nebios or Novell IPX is a complete differen't thing then TCP/IP ISO Layers and even more complex with IPv6 in WAN Network Scenarios like a allways on and public Internet. Even a limited Scriptkid can nowdays download and install Kali Linux which has al...

SorenR

There is no suitable and exact answer to the generic question of whether it is necessary to configure a local DNS server to use HMailserver or any other service that requires DNS resolution. Yeah, but using a IoT Device for DNS on a Business Network like a Cheap Broadbandrouter is almost criminal. ...

SorenR

Function LockFile(strPath) Const Append = 8 Const Unicode = -1 With CreateObject("Scripting.FileSystemObject") Dim oFile, i For i = 0 To 30 On Error Resume Next Set oFile = .OpenTextFile(strPath, Append, True, Unicode) If Not (Err.Number = 70) Then Set LockFile = oFile On Error Goto 0 Exit For End ...

SorenR

I use OnHELO with one of SorenR scripts. Sub OnHELO(oClient) ' ' Exclude local LAN from test ' If (Left(oClient.IPAddress, 8) = "192.168.") Then Exit Sub If (Left(oClient.IPAddress, 9) = "127.0.0.1") Then Exit Sub strRegEx = "(127\.0\.0\.1|mail\.mydomain\.se|\*\.\*|User|xxx\.xxx\.xxx\.xxx|ylmf-pc|i...

SorenR

"Lookup" returns a boolean, "oLookup" returns an object.

Just add Lookup somewhere after oLookup, that's fine.

SorenR

Function Lookup(strRegEx, strMatch) : Lookup = False If strRegEx = "" Then Exit Function With CreateObject("VBScript.RegExp") .Pattern = strRegEx .Global = False .MultiLine = True .IgnoreCase = True If .Test(strMatch) Then Lookup = True End With End Function

SorenR

If you really want to host your own DNS then it's not really that difficult. You would want to set up a "Split Horizon" to cater for the FQDN's that is used both internally and externally. I agree My point is that this is NOT NEEDED to run hMailserver. I think you missed the point. Most residential...

SorenR

Most RBL's do not work well with public DNS servers "asking questions" so there's an argument for having your own caching DNS. Some ('nix) NAS systems have DHCP and a DNS server that actually communicate - or you can use DHCP and DNS on a Windows Server, that way the server will manage DNS names, an...

SorenR

SorenR

I work for a company who are looking to bring emails in house due to a rise in cost. Internally we do have technical knowledge with general ICT /Networking so I believe once we understand the requirements this should be no issue. Im struggeling to find a clear route for whats needed. Could anyone r...

SorenR

palinka wrote: ↑
2019-10-23 12:39
Only one issue: NF = Norfolk Island

Like I wrote ... "Not fully tested"

SorenR

Brainstorming ... Not fully testet ... The trick is how to use "ByVal" and "ByRef". :mrgreen: ByVal = Parse a copy of the variable, does not change content of original variable. (Default) ByRef = Parse reference to variable, will change content of the original variable. Save code to "geoiptest.vbs" ...

SorenR

GeoLookup = group(0) Is there a way to pass two variables back to the call? Specifically, I want to pass country code and country name. Or do I need a function for each? No, all you get is the country code. You can create your own "Countrycode<->Country" table here --> http://peric.github.io/GetCou...

SorenR

Well... I downsized to use a simple DNS lookup ;-) Sometimes there is no country and sometimes there are two countries. I did dig into it a while back. Source data is OK and it appears to be a registration glitch with the local registrars as WHOIS data sometimes show similar discrepancies. Function ...

SorenR

So you missed that Ruud (RvdH) made a tool for that that a looooong time ago? https://d-fault.nl/files/DNSResolverComponent_1.1_64bit.exe.zip (will autoselect latest version) Create object of type DNSLibrary.DNSResolver This object has 13 public functions: -- version() * returns the version number -...

SorenR

Last 6 lines in that log are HELO's. I had to whitelist HELO = (.*\.immuniweb\.com) to allow it to test but it eventually failed on the GEOIP for IMAPS and SMTPS. I have not edited the log, it is one section cut'n paste. I have no trace of the HELO's you saw in any of my logs. Weird. That's what i ...

SorenR

Thanks, Soren. But see my prior Post Response to Palinka. Junkemailfilter's IP Addresses do on occasion change so your Incoming Relays would require manual monitoring. And junkemailfilter IP address are not sequential so I cannot specify a range either. I have been using the Incoming Relays method ...

SorenR

hMailAdmin -> Settings -> Advanced -> Incoming relays Add IP range of your TRUSTED Backup-MX or Relay server(s). I have 3 entries here with "Lower IP" = "Upper IP" of my Backup MX'es In SpamAssassin I have: # Set which networks or hosts are considered 'trusted' by your mail # server (i.e. not spamme...

SorenR

Huh ??? Never mind. I see what you're doing. Very sneaky. :) You're using PTR lookup, not HELO. I tested one of their IPs and it returned what you'd shown. C:\Users\palinka>nslookup 70.38.27.252 Server: resolver1.opendns.com Address: 208.67.222.222 Name: f10.immuniweb.com Address: 70.38.27.252 But ...

SorenR

The HELOs immuniweb use are mail.example.com and openssl.client.net - every one of them got hit by Spamhaus. Client.net exists but its not part of immuniweb and example.com has no A record at all. Probably reserved or something. If not, I'll grab it today. :mrgreen: Edit - Example domains As descri...

SorenR

RESULTS OF LOOKUP 192.175.111.241 is listed This IP address was detected and listed 17 times in the past 28 days, and 3 times in the past 24 hours. The most recent detection was at Fri Oct 18 03:25:00 2019 UTC +/- 5 minutes Your IP address (192.175.111.241) is sending email in such a way as to stro...

SorenR

When we talk about port 25 being blocked... This is basic TCP/IP knowledge btw. hMailServer RECEIVE mail on port 25 hMailServer SEND mail on random port > 1024 - Receiver must per RFC RECEIVE mail on port 25, se previous line. A mailserver receive mail on port 25, that is the ONLY thing you need to ...

SorenR

I already saw a few times that external servers were sending a local address in FROM. I think Google Calendar was one of them. That's the reason why I disabled "Local to local e-mail addresses" under "Require SMTP authentication". I also checked this behavior against the mailserver of my previous h...

SorenR

How come I keep hearing how ISPs block outgoing Port 25? I've been on two major ISPs in the 8 or more years I've been using hMailServer and neither one of them blocked Port 25 to me though one kept documenting they may do it but I never ran into it. Granted I now use a Static IP Address from my ISP...

SorenR

Must have been the ship you were stationed on when you were in the Marines! Eh.. I'm not 120 years old, nor am i British. Anyway holystoning is a job for swabbies and squids and never Marines . :mrgreen: How do you think marines learn to take orders and become marines? I believe the danish "Frogmen...

SorenR

Can I suggest you do your GeoID lookup only when you pass "1" on hits?

1: code performs faster
2: IPAddress will probably stay geo-stationary for at least the next couple of milliseconds

SorenR

Added SorenR's Intrusion Detection System (IDS). Its a great idea and picks up spammers that don't ordinarily get picked up. The way it works is simple, but genius. 1) every connection, it records the IP into the db with hits=1. 2a) IF a message is successfully received, the record is deleted -OR- ...

SorenR

You can check it out on my firewall ban demo: http://hmsfirewallbandemo.ddns.net/IDS.php :D Did you keep the 180 minute window ? Working with AutoBan somtimes aggressive settings will kill your server performance, which is why I only look at a 180 minutes window. No point in banning someone that wi...

SorenR

Anyways, here's something to get you going. I presume you don't need the handler.vbs if you already have something that reads the database... Done. A couple of minor changes, but nothing to write home about. I want to run it a few days before committing to github. One question - what is the column ...

SorenR

Spammers/hackers do not stay on the same IPaddress for too long so over time you'll be "playing" with maillinglists.

History data is only usefull for legitimate services

SorenR

ipaddress is UNIQUE KEY so therefore: INSERT ipaddress bla bla ON DUPLICATE KEY UPDATE hits=(hits+1) Exactly. But my firewall ban requires unique key on ID to allow for duplicate IP addresses (for a few reasons). So I'll probably just prepend the column names with ids_ in order to just follow the s...

SorenR

Cool. Yea, I have a powershell script in the firewall ban for autoexpiry, among other things. Also, I have to do something with this: ON DUPLICATE KEY UPDATE hits=(hits+1) because I necessarily use a unique ID. Possibly, I could just add your columns to my table or create a new table just for count...

SorenR

3 connects without actually sending mail will put the IP address on my blocklist - No mercy :mrgreen: ... Does not affect performance of hMailServer, will only use CPU cycles. You allow 2 unencumbered? I would call that extremely merciful. Your ancestors would never have allowed 2 attempts. In fact...

SorenR

I've been seeing the types of attacks PeterChan is getting to. The first set pf Log Entries where the IP Address was just sending RCPT TO commands, I figured the IP Address was just trying to see if it could get a hit on an Email ID being found on your Server. Once that Email ID came back as a succ...

SorenR

Well... This is one way to stop the intruder... :wink: The Russian IL-20M (COOT-A) "just cruising around" :roll: Danish F-16 is besides being a member of the strategic air defense also a member of the national air defense show group. Thus it is showing it's true colours :mrgreen: Picture is dated Oc...

SorenR

Not sure MX'es are the best place for honeypots. I use my ISP server as Backup-MX (3 servers in round-robin) and have seen occationally, in my logs, that IF I go off-line or accidentally deny connection by an experimental filter, mails are delivered through the Backup-MX and will continue to do so f...

SorenR

Wile.E.Coyote@10.10.10.10 is a perfectly acceptable mail address. Maybe strictly speaking, but the RFC says the IP address has to be enclosed in braces:https://tools.ietf.org/html/rfc5322#section-3.4.1 Wile.E.Coyote@[10.10.10.10] And: It is therefore incumbent upon implementations to conform to the...

SorenR

That just the way email routing works. The right-hand side of an email address is not the address of the server that handle mail for that user, so you can't just place an ip address there and expect mail to be directed to a server at that address. Really ?? How do you think people sent mail before ...

SorenR

That just the way email routing works. The right-hand side of an email address is not the address of the server that handle mail for that user, so you can't just place an ip address there and expect mail to be directed to a server at that address. Really ?? How do you think people sent mail before ...

SorenR

I believe WiFi networks are initialized differently from Ethernet based on the fact that you can select alternative WiFi networks pre and post startup - Ethernet is "hardwired"

SorenR

I assume you have activated "file and printer sharing" on your selected profiles? (WiFi and LAN on same machine use each their own profile). I went to Windows 10 directly from XP and first impression: IT SUCKS BIG TIME! However I'm getting to the point where I have found compatible (free) versions f...

SorenR

Function Discovery Resource Publication has to be automatic.

It's the main change from previous builds.

SorenR

I have my issues with Win 10 but seemingly not to the level I've seen listed on this Forum Topic and I'm on version 1903. Cortana ?? On a "server" ?? Anyways, your network problem... Open windows services (winlogo + X >Run type services.msc) on each of your win 10 computers take a look if these ser...

SorenR

Who said emailservers and their theory is not rocket science

SorenR

What's the difference between Marvel comics and these scientists? they fancy up their fantasies with scientific terminology garbage and some (unapplicable) mathematics. i read once there are adult folks in USA who believe that Star Wars is real (as if we're done with wars on earth). perception engi...

SorenR

Don't mock Sci-Fi, they tend to have some degree of foresight ... Children growing up in the early 1900s would have been familiar with the Tom Swift series of books. In the books, the main character Tom Swift made use of a stun gun. When NASA physicist Jack Clover invented the taser, he gave it that...

SorenR

So I guess all of you are betting on Tony Stark returning from an alternative universe sometime soon?

SorenR

Thank you for your answer. My job is that I have a server that receives a mail every night from another server outside the network, which contains a link to something my server needs to download and load into the database. ... ... Emails are stored in C:\[hmailserver folder]\Data\[domain]\[username...

SorenR

Ever see a vegan wearing lipstick? Not me. Those people have a screw loose. A couple of times a year there's a news story about another vegan infant death or near death because they try to give the baby a vegan diet and the poor child ends up chronically malnourished. Who in their right mind would ...

SorenR

RvdH wrote: ↑
2019-08-20 21:51
Result.Value=3

viewtopic.php?p=211186#p211186

SorenR

Hello palinka Thank you for your suggestion. But unfortunately that doesn't work either. As I see it (https://www.hmailserver.com/documentation/latest/?page=scripting_onSMTPdata) oMessage.Body is not an option in the OnSMTPData Sub. But I have another question now... I have looked in the documentat...

SorenR

if you steal an a-bomb and destroy it to save humanity that means stealing is good... no?

Search found 3212 matches