ASSP Deluxe for cPanel

[manokiss]

Thanx Radio!

btw, looks like the `--log-verbose' option is not available, perhaps you have to update your docs. I got the following error from the cron:

/usr/bin/freshclam: unrecognized option `--log-verbose'
ERROR: Unknown option passed
ERROR: Can't parse command line options

I have changed to '--verbose'

Thanx!

[Radio_Head]

Thanx Radio!

btw, looks like the `--log-verbose' option is not available, perhaps you have to update your docs. I got the following error from the cron:

/usr/bin/freshclam: unrecognized option `--log-verbose'
ERROR: Unknown option passed
ERROR: Can't parse command line options

I have changed to '--verbose'

Thanx!

Than you to report it (clamd changed the command).
(BTW the cron is automatically created by cPanel when you install
clamd using WHM/plugins).

In ASSP WHM 4.7.3 I added code to fix the cron automatically .
All the docs updated too.

[crazyaboutlinux]

I've got ASSP installed on my server and have disabled Spamassassin. ASSP is fantastic, I highly recommend it.

Note: I am only recommending ASSP, not the services of Radio Head, because I installed ASSP myself. Being able to access it via Cpanel sounds like a great idea, though.

Dear Cruiser,

as you installed assp your self on your server same as i also want install assp on my server my self so can elaborate steps for me ??????

Thanks in advance

bye & wait for prompt & faithful reply

[Radio_Head]

Another update

There is a new find_abusers.php feature which will be really usueful in some
bad situation (huge email dictionary attack against several domain names)

From now, for example you may have this 2 cronjobs..

*/30 * * * * /usr/local/cpanel/3rdparty/bin/php-cgi /usr/local/assp/deluxe/find_abusers.php show=14 sc=32 er=13 lm=13 dc=25 rl=20 on=1
*/10 * * * * /usr/local/cpanel/3rdparty/bin/php-cgi /usr/local/assp/deluxe/find_abusers.php show=3 sc=6 dm=file dc=3 on=1

where the first find_abusers.php is server wide , and it will create a failry moderate bad ip collection , while the second find_abusers.php cron line will create a very aggressive bad collection ip using only domain names in /usr/local/assp/deluxe/dmfile .

In /usr/local/assp/deluxe/dmfile you can add a list of your most bombarded domain names ( you can get the list executing as usual
# /usr/local/cpanel/3rdparty/bin/php-cgi /usr/local/assp/deluxe/find_abusers.php
)

I resume here what's new with current and latest updates .

ASSP WHM 4.7.3
- fixes clamd freshclam cron (thank you to arteryplanet for reporting)
- compatibility with ASSP 1.5.1.2 and ASSP 1.5.1 RC 0.09.03
- automatically upgrades rebuildspamdb.pl to version 2.5.1.1 (0.09)
with server load controls

ASSP Deluxe 3.5.8
new dm=file feature added to find_abusers.php
Spam activity detector now use new default values
Fixed a spambox permission problem

ASSP Deluxe Cpanel frontend 5.5
:: Portuguese language pack
:: German language pack ( created by lederhaas.st )

ASSP 1.5.1.2
:: Improved performance and memory usage
:: Improved HELO handling
:: Improved community Griplist (GreyIP List)
:: Lots of more usefull tweaks and setting



Detailed changelog here > http://www.grscripts.com/changelog.html



Useful links
Did you check latest recommended RBL lists ? http://www.grscripts.com/tweaking.html#08
Are you using Unofficial clamd Signatures ? http://www.grscripts.com/tweaking.html#8
ASSP Deluxe for cPanel checklist : http://www.grscripts.com/advice2.html

[Fulcan]

Hi Radio,

I am getting this message when installing.

Where do you get the licence??? I didn't see that in your installation instructions.

Thanks

[Radio_Head]

Hi Radio,
Where do you get the licence??? I didn't see that in your installation instructions.
Thanks

How to order ASSP Deluxe for cPanel

[Fulcan]

Hi Radio,

ASSP seems to be treating my own server as a forged helo and therefore no email is getting in and no email is getting out. I could not see anything on this in your FAQ. Can you steer me to a fix please?

Thanks

[Radio_Head]

Hi Radio,
ASSP seems to be treating my own server as a forged helo and therefore no email is getting in and no email is getting out. I could not see anything on this in your FAQ. Can you steer me to a fix please?
Thanks

It's due to some incorrect setting , please email me for support daniolo@gmail.com .

[norelidd]

Where does ASSP Deluxe save the custom clamav definitions? I think one of them is corrupted and is causing clamd to fail. This has happened before and the solution was the clear the folder and let the databases be downloaded again.

clamd usually stores the defs in /usr/local/share/clamav/ but the custom defs weren't there. where are they?

Could the Deluxe frontend have options for turning the definition downloading on/off as well as a simple "clear folder" button to wipe out the contents in case clamd fails?

[manokiss]

Where does ASSP Deluxe save the custom clamav definitions? I think one of them is corrupted and is causing clamd to fail. This has happened before and the solution was the clear the folder and let the databases be downloaded again.

clamd usually stores the defs in /usr/local/share/clamav/ but the custom defs weren't there. where are they?

Check at /usr/share/clamav/

Could the Deluxe frontend have options for turning the definition downloading on/off as well as a simple "clear folder" button to wipe out the contents in case clamd fails?

Check the "Unofficial clamD signatures" section at http://grscripts.com/tweaking.html

[manokiss]

Hi Radio,

Here are some features requests :-)

Recently we have a ddos in the mailserver and you did help us to take care of it.

After that we have limited the connection ip's , etc.

Now some of the clients is having problem receiving emails from Comcast users and after checking the crons that we have running the find_abusers, wondering if is possible you add an option to it to after X days it clean up the /files/denysmtp.txt and the /files/blockip.txt files. Or also an option to only clean up the ip's blocked for the specific domains listed in the dmfile. Perhaps you have to collect those ip's in a different file as i guess is hard to know which ip was blocked for those domains and which ones for the rest of the domains in the server.

Thanx in advance!

[Radio_Head]

Currently I can't see a way to do what you are asking (I will see however) . If you have a server under smtp ddos attack, with "forced settings" you can return to "normal" conditions cutting most of your bad smtp sessions . The price for it , is that (such as you reported) you may have some compliant (good senders ip in some bad ip list) . However you have all the tools to whitelist or fully bypass the good ip (or ip range or CIDR) using ASSP (noprocessing menu and whitelisting menu i.e.).

You can also put in /usr/local/assp/files/ignore.txt ips which must be ignored by find_abusers.php collection.

And, if after some day you think the attack is reduced you can lower forced settings and use a lesser aggressive bad ip collection.

You may also set a cron which automatically clean your deny and blockip files each 3 or 4 days (i.e.) and consider that find_abusers.php collects ips based only on your current ASSP log (which by default reset each 7 days).

[manokiss]

Thanx Radio!

You can also put in /usr/local/assp/files/ignore.txt ips which must be ignored by find_abusers.php collection.

Well no....the problem is not with the server users sending emails, the problem is with people sending emails to the server users, you cant guess or know who sent you an email and what is they ip's.

You may also set a cron which automatically clean your deny and blockip files each 3 or 4 days (i.e.) and consider that find_abusers.php collects ips based only on your current ASSP log (which by default reset each 7 days).

How i can do this?

Thanx!

[Radio_Head]

in this way for example

0 1 * * 0,3 /bin/echo "" > /usr/local/assp/files/deny.txt
1 1 * * 0,3 /bin/echo "" > /usr/local/assp/files/blockip.txt

[Radio_Head]

Here

==> http://www.grscripts.com/advice11.html

you can find how to fix clamd restarts related
with www.malware.com.br signatures.