hMailServer forum

SorenR

Seems like SpamAssassin is just doing a DNS TXT lookup and returns 3 "items".. This is from Mail::SpamAssassin::Plugin::ASN.pm https://apache.googlesource.com/spamassassin/+/fe7f3ba0ea96aab7a2fda3e953deeeb5652e84e4/lib/Mail/SpamAssassin/Plugin/ASN.pm foreach my $rr (@answer) { dbg("asn: %s: lookup r...

SorenR

MessageID is simply the worst ever header you could manipulate. It is the unique identifier for that email - of ALL emails in the world.

I would love to see the complete headers from the different stages of your conversation.

Any domain we should not see you can call "acme.inc".

SorenR

Spamassassin is using it... c:\SpamAssassin\share\3.004000\updates_spamassassin_org\25_asn.cf Added header; X-Spam-ASN: AS57043 185.222.209.40/32 Since two or three versions back SpamAssassin started including ASN numbers in Bayesian data to identify Spammers by Internet router. I was just wondering...

SorenR

Create object of type DNSLibrary.DNSResolver This object has 13 public functions: -- version() * returns the version number -- help() * shows this help -- IPv4A(<Domain name>) * query IPv4 A-Record(s) -- A(<Domain name>) * same as IPv4A (deprecated) -- DNSLookup(<Domain name>) * same as IPv4A (depr...

SorenR

I hate to say this to you, but you are wrong...and this is exactly why i created my own lookup component ... SScripting.IPNetwork only returns a single record, even if there are two! SScripting.IPNetwork is faulty! Yes, I know... Now... :wink: The difference between the "old" and the "new" is that ...

SorenR

Flag 32 is a real bugger... Had to search back in time... Yes, it says RECENT and Yes it means RECENT. How recent you may ask... The RFC does not define what "recently" means, and it doesn't define when the flag should be reset. A server could consider \Recent to be messages which has been received ...

SorenR

How is possible block outgoning email with more A o CC destination? I used 11 as the count to allow for 1 BCC address as per the above posts I want a limit of 10 email destination… Only with a script that checks the recipient count and bounces Using OnDeliveryStart should work fine Sub OnDeliverySt...

SorenR

SorenR wrote: ↑
2019-01-12 16:05
ISO 3166-1 alpha-3

I hate to quote myself but "ISO 3166-1 alpha-3 Code" is wrong, they are three letter country codes. The ones we get from countries.nerd.dk are calculated 3-digit "ISO 3166-1 UN codes".

https://www.iso.org/obp/ui

SorenR

Well Ruud, It seems as those pesky ISO 3166-1 alpha-3 IS the way to go. I reconfigured my system before I went to bed this morning and this is what I got... The "old" NerdLookup() is calling the "new" NerdLookupTXT() in order to get both solutions. 1568 "2019-01-12 04:23:23.247" "NerdLookup(89.248.1...

SorenR

May be a stupid question but what is CCN ?? BCC ??? All emails addressed to BCC are sendt as individual emails. Like... TO: John.doe@acme.inc CC: Jane.doe@acme.inc BCC:Wile.e.Coyote@acme.inc, Road.Runner@acme.inc Above email is split into to three emails, one with A & CC, one with one BCC and one wi...

SorenR

This is weird... 37.49.227.180 Iceland: https://apps.db.ripe.net/db-web-ui/#/query?searchtext=37.49.227.180#resultsSection https://www.ip2location.com/demo https://ipapi.co/37.49.227.180/ https://ipinfodb.com/ https://www.ultratools.com/tools/geoIpResult Estonia: https://api.iptoasn.com/v1/as/ip/37....

SorenR

01/11/19 21:30:16 whois 37.49.227.180 @whois.geektools.com whois -h whois.geektools.com 37.49.227.180 ... GeekTools Whois Proxy v5.0.6 Ready. Checking access for 87.51.72.165... ok. Final results obtained from whois.ripe.net. Results: % This is the RIPE Database query service. % The objects are in ...

SorenR

- zen.spamhaus.org - 127.0.0.2-9 - RBL - Rejected by Spamhaus - 5 - sbl.spamhaus.org - 127.0.0.3 - RBL - Rejected by Spamhaus (Snowshoe) - 99999 Assuming it is a snowshoe spam you are running 2x lookups to get the same result twice (the zen lookup will also return 127.0.0.3 as it is a combination o...

SorenR

hMailAdmin -> Settings -> Protocols -> SMTP [Advanced] : Maximum number of recipients in batch ??

SorenR

DNSBL's to use... DNS host Expected result Message Score - b.barracudacentral.org <== THIS IS POSITIVE ON 216.245.204.40 - 127.0.0.2 - RBL - Rejected by Barracuda Reputation Block List - 5 <== High enough to mark as SPAM but not high enough to delete - zen.spamhaus.org - 127.0.0.2-9 - RBL - Rejected...

SorenR

Received: from headlightmag.com ( aliceandolivia.com [216.245.204.40]) by mydomAIN.org with ESMTP ; Fri, 11 Jan 2019 08:02:10 -0800 BLUE not equal to RED = 98% SPAM. BLUE is the greeting from HELO/EHLO (SMTP logging) and RED is the hostname of [216.245.204.40]. If you are not using SpamAssassin and...

SorenR

Another example: dig +short 180.227.49.37.zz.countries.nerd.dk TXT "is" "ee" That's a bug... The IP address belongs to Iceland. Get your own copy ... :mrgreen: mkdir -p rsync/dg rsync -a rsync://countries-ns.mdc.dk/zone/ rsync cat rsync/zz.countries.nerd.dk.rbldnsd zz.countries.nerd.dk.rbldnsd.add ...

SorenR

BTW, if you do a TXT lookup against zz.countries.nerd.dk you don't have to work with those annoying ISO 3166-1 alpha-3 codes Any particular reason for the "On Error Resume Next", "On Error Goto 0" around your object :?: Downsized your function to this... Function NerdLookup(strIP) : NerdLookup = "z...

SorenR

A while back I was going over some old logs (from 2011 to now) and found that probably 80% of all "unwanted" connections from the same IP happen probably 1-2 times a week - no point in waisting a BAN on those - all you do is fill up your BAN list and it slows the server down for no reason. So... If ...

SorenR

I also have this in my Eventhandlers... Any connection from outside the The Danish Realm on any port other than 25 is nuked. That's what I use the "port" variable for. Roaming is usually expensive (when you exceed your allowed data) and when on holiday you don't need a phone - I have webmail if the ...

SorenR

SorenR wrote: ↑
2019-01-11 01:01
Erhmmm.... PRIMARY KEY should be ipaddress I believe. Hmm... Table one modify must.

Nope... It works as intended.

SorenR

How is Calling oDB.ExecuteSQL(strSQL) 2 times, code optimization? Function idsAddIP(sIPAddress, iPort) Dim strSQL, oDB : Set oDB = GetDatabaseObject strSQL = "INSERT INTO " & idsTable & " (timestamp,ipaddress,port,hits) VALUES (NOW(),'" & sIPAddress & "'," & iPort & ",0) ON DUPLICATE KEY UPDATE hit...

SorenR

Function idsAddIP(sIPAddress, iPort) Dim strSQL, oDB : Set oDB = GetDatabaseObject strSQL = "INSERT IGNORE INTO " & idsTable & " (timestamp,ipaddress,port,hits) VALUES (NOW(),'" & sIPAddress & "'," & iPort & ",0);" Call oDB.ExecuteSQL(strSQL) strSQL = "UPDATE " & idsTable & " SET hits=(hits+1) WHER...

SorenR

https://log.damnation.org.uk/ Session: 4099 "SMTPD" 6356 4099 "2019-01-10 16:41:41.003" "208.124.188.202" "SENT: 220 10.154.0.52 ESMTP" "SMTPD" 5916 4099 "2019-01-10 16:41:41.519" "208.124.188.202" "RECEIVED: HELO 10.154.0.52" "SMTPD" 5916 4099 "2019-01-10 16:41:41.519" "208.124.188.202" "SENT: 250...

SorenR

Wow ... this seems to be a good idea. I will try it this way and post the code here. For me it make sense to make some small changes in the SQL-statements and in the table. An "auto increment" or "indexed" field slows down the insert in a mysql table and it isn't necessary in this case. Table: CREA...

SorenR

Looks like (for security) i'm going to go with the "Half Hearted Solution" as the local email server will mainly only be used for device status/maintenance alerts and if it went out to an external address well everyone would be informed of the "rules" for delivery back to the correct inbox. So I th...

SorenR

global rule. Tested a few times. Could not add a 'Reply-To' Header with a global rule we do this almost every day. inquiry sendout to a group of suppliers and global rule adds Reply-To (which is purchase@ourdomain.com) properly. right now i tested again, yes it does add it. v.5.6.7 - 2425 Outbound,...

SorenR

I use MySQL and I created a new table in the hMailServer database. If you use a different database you must change the ODBC connector accordingly. ALSO... Check if strSQL = "INSERT IGNORE INTO...." is supported by your database. The functionality is essential in updating number of hits since field I...

SorenR

On My system if I use 'Return-Path' rather than 'Reply-To' it works as I'd expect too (except that two Return-Path headers are created, but it seems to follow the last one - the one made with the rule) Are you quite sure? "Return-Path" is the last thing hMailServer add to the raw email just before ...

SorenR

strange. i have a very similar (condition not OR but AND) global rule and it works. out of habit there is a "X-hMailServer-LoopCount less than 1" too, not sure if relevant.. "X-hMailServer-LoopCount less than 1" is only if you use Forward , Create and send copy or Send using route . Situations wher...

SorenR

Paulo Meireles wrote: ↑
2019-01-09 02:57
I have meanwhile solved my original issue - a corrupted table - with myisamchk. The wife external email account is pumping again!

Happy wife, Happy life

SorenR

My IDS Handler, CheckState and RunBackup scripts are now "compiled" and running. Next is my SA-Learn script. Reworking my EventHandler will require some thoughts on optimizing if I am to move all password dependant functions out. It should be doable though. Not sure about performance but time will t...

SorenR

I have found that "shoot first, ask questions later" is not good with banning. A huge "banning list" on a small server really kills performance. I definitely did experience this in the end by using Hmailserver bans. Although, now that I switched bans to my firewall, my servers are screaming fast an...

SorenR

Why not use vbsedit to convert vbs to an exe file ... Now that is an interesting thought From HELP file... Convert Into Executable VbsEdit lets you convert your scripts into standalone applications. Unlike the older versions of VbsEdit, the script will now be executed directly within the executable...

SorenR

Why not use vbsedit to convert vbs to an exe file and call it from the script in a CMD prompt with parameters ?? I've just converted the "Handler.vbs" that does all my banning of IDS, PORTBLOCK and stuff externally of hMailServer. The script and my handler share the MySQL database for information ex...

SorenR

I have found that "shoot first, ask questions later" is not good with banning. A huge "banning list" on a small server really kills performance. Sooo many "attacks" are 1-2 attempts every 8-12 hours so I have my banning set up differentiated. - SnowShoe SPAM is only rejected as I only see recurring ...

SorenR

Don't purchase. Get one for free. https://hmailserver.com/forum/viewtopic.php?f=21&t=32593 Hopefully purchasing will have better time:price ratio :shock: @Dravion: If SMTP, IMAP & POP3 are on mail.example.com then one cert will suffice? I read that I should pay attention that it's a RSA certificate...

SorenR

brutzler wrote: ↑
2019-01-02 11:45
Hi guys,

do you think, that your discussion is still matching to my request?
For me its of no help, and makes the thread confusing.

It's called "brainstorming". This is what you pay $500/hour for when you engage a consultancy service. Here it's FREE and we are bound to get the ideas eventually.

SorenR

Weird...

I open a DOS window, type telnet......, interact with server and end session by typing QUIT... No problem...

SorenR

This is what I get... Copied a session from my logs :mrgreen: C:\WINDOWS>telnet mx.fakemx.net 25 220 mx.fakemx.net ESMTP Service Ready EHLO a4-20.smtp-out.eu-west-1.amazonses.com 250 OK MAIL FROM:<b0897f6f794wife=acme.inc@bounce.twitter.com> 250 OK RCPT TO:<wife@acme.inc> 451 Try again later 421 Clo...

SorenR

I have re-arranged my MX records... MX 10 mx.mydomain.tld MX 20 mx.backupmx.tld MX 30 mx2.mydomain.tld mx2.mydomain.tld is an alias for mx.mydomain.tld so SPAM should always go to hMailServer Alternatively one can use fake MX records to kill SPAM https://wiki.apache.org/spamassassin/OtherTricks This...

SorenR

just goes to show that hMailserver is versatile software I have a few installs of hMailserver where I use it to forward from a networked scanner etc to my main hMailserver, and I also have some that POP3 or IMAP connect an account on my main hmailserver, and via scripts drop attachments to a known ...

SorenR

.... But I have to ask, why bother with hmailserver at all if you're using an outside mail provider? Why not just connect your clients directly? I have only a basic-account at my ISP. Storage amount of the mailboxes are very small. And I prefer to store my mails on my server @home in somehow define...

SorenR

Try this... With CreateObject("hMailServer.Message") .From = Chr(34) & m_Sender & Chr(34) & " <" & m_SenderAddress & ">" .FromAddress = m_SenderAddress .AddRecipient a(0), a(0) .AddRecipient m_Sender, m_SenderAddress .HeaderValue("To") = Chr(34) & m_To & Chr(34) & " <" & a(0) & ">" .HeaderValue("CC"...

SorenR

Running a virtual hMailServer on a cloud based intrusion detection system that, if compromised, will spawn a new server on a new IP address, update DNS et al. and start a "cat after mouse" chase across the Internet :mrgreen: That could be really cool 8) Problem is though, safe systems are not user f...

SorenR

May I suggest something?

1: Buy a good FIREWALL.
2: LOCK the DOOR to the computer room.

SorenR

https://www.oo-software.com/en/shutup10

SorenR

Svetoslav92 wrote: ↑
2018-12-24 04:10
Maybe there is a chance to directly write file in UTF8 with vbscript with ADODB.Stream instead of FSO but my point was finally accomplished.

Happy Holidays!

This problem ?

https://shiftordie.de/blog/2007/03/01/u ... ascw-rant/

SorenR

I use this ...

https://www.oo-software.com/en/shutup10

SorenR

Learned something new today... I would never have believed one could compare IP addresses that way so had to try it :mrgreen: I do somewhat the same in my EventHandler and I convert IPAddresses to LongInteger before comparing ... Oh well... Had a play with the code... ' ClientIP = "127.0.0.1" Client...

SorenR

Good point - I actually did that - after updating the forum :roll: Anyways, a while back I changed the AutoBan() function so it's not really a problem - it will catch it and ignore it. While Not oRecord.EOF ' EventLog.Write( "Wohoo... IPAddress: " & oRecord("ipaddress") & " Port: " & oRecord("port")...

SorenR

mats wrote: ↑
2018-12-20 21:48
Seems to be 25 only.

I have 5.6.6 installed.
Does DisableAUTHList work with that?
Found an older thread that indicated that a special build was required

Was introduced in Version 5.6.3 - Build 2249 (2015-04-03)

https://www.hmailserver.com/changelog

SorenR

My "handler" ... It's running alpha test right now. Nothing has blown up yet, so we'll see ... :mrgreen: handler.vbs runs every 5 minutes. You can regard this whole excercise a Proof of Concept on how to offload tasks from hMailServer execution. Option Explicit '*************************************...

SorenR

With respect to the IDS code I posted earlier. I have reduced the script footprint in hMailserver from previously quoted 241 lines of active code to 55 lines of code. Plus it's no longer using the AODB.Connection and all the extra API calls - so all in all it should speed things up with a factor 500...

SorenR

I see two repeating patterns on my mailserver of spammers trying to use on of my domains. They try to send a Mail and when they get a PW request they quit the connection. "SMTPD" 2316 1668 "2018-12-18 18:34:56.751" "190.236.239.220" "SENT: 530 SMTP authentication is required." "DEBUG" 2316 "2018-12...

SorenR

I just remembered that RvdH's custom build contain an experimental trigger OnClientLogon(oClient) ... Scenario: OnClientConnect: - register IP Address in database - if IP Address exists, increment counter (may skip if 12 hours old) - if counter > 3 = AutoBan OnClientLogon: - If logon OK then delete ...

SorenR

I see two repeating patterns on my mailserver of spammers trying to use on of my domains. They try to send a Mail and when they get a PW request they quit the connection. "SMTPD" 2316 1668 "2018-12-18 18:34:56.751" "190.236.239.220" "SENT: 530 SMTP authentication is required." "DEBUG" 2316 "2018-12...

SorenR

Well... Europeans (Citizens of EU) are INDIVUALS, PERSONS with free speach and total ownership of their personal data/Internet presence. In the good ol' US of A, citizens are PRODUCTS. They have NO RIGHTS. True Orwellian. So true... :wink: In Denmark we have this really old law, that allow us to exp...

SorenR

Got another message from Kmart via shopyourway.com. And one from sears. They seem to be in cahoots. In any case, I found the reason why the unsubscribe didn't work - these sharers simply don't honor unsubscribe requests. how do i unsubscribe to shop your way??? can't find anything on the web site a...

SorenR

If you ask Google there are numerous bugs in Outlook 2016. So, as a result, Outlook 2016 is only really compatible with Exchange

Search found 2690 matches