Re: OT - Hotmail/Outlook.com marking most of our email as Junk

2022-02-22 Thread Chris
Agreed, it seems to be deliberate to get people moved over to the big providers, they are clearly discouraging independent email servers as they clearly scored differently. I have even been doing tests on various spare unused ip's and the amount that get blocked by microsoft (but no other

Re: message size, mark if too large?

2020-12-27 Thread Chris
> > > > > > Is there a simple way? SpamAssassin version 3.4.2 > > > > > > > > > > > > > > > Here's a procmail recipe I use to mark large files :0 fh w * > 10 * ^Subject:\/.* | formail -I "Subject: {* -BIG- *} $MATCH" You can change the file size in the 2nd line to meet your needs. -- Chris 31.11972; -97.90167 (Elev. 1092 ft) 08:07:17 up 14 days, 23:10, 1 user, load average: 3.29, 2.60, 1.69 Description:Ubuntu 20.04.1 LTS, kernel 5.4.0-58-generic

channel 'kam.sa-channels.mcgrail.com': GPG validation failed, channel failed

2020-12-12 Thread Chris
s is Ubuntu 20.04.1 LTS Spamassassin spamassassin -V SpamAssassin version 3.4.4 running on Perl version 5.30.0 -- Chris 31.11972; -97.90167 (Elev. 1092 ft) 20:00:37 up 11:04, 1 user, load average: 1.50, 1.16, 1.02 Description:Ubuntu 20.04.1 LTS, kernel 5.4.0-58-generic

Re: spamhaus.net. type=A class=IN) failed: a domain name contains a null label

2020-10-07 Thread Chris
t; That is indeed v1.0.1 > > > > > It's old, 20190704 Riccardo, after updating the issue has been resolved. Thank you Chris -- Chris 31.11972; -97.90167 (Elev. 1092 ft) 19:43:53 up 1 day, 3:38, 1 user, load average: 1.10, 0.74, 0.71 Description:Ubuntu 20.04.1 LTS, kernel 5.4.0-48-generic

Re: spamhaus.net. type=A class=IN) failed: a domain name contains a null label

2020-10-07 Thread Chris
t; That is indeed v1.0.1 > > > > > It's old, 20190704 I picked up 20200825 last night, just waiting for my new key. -- Chris 31.11972; -97.90167 (Elev. 1092 ft) 09:37:02 up 17:31, 1 user, load average: 0.53, 0.39, 0.47 Description:Ubuntu 20.04.1 LTS, kernel 5.4.0-48-generic

Re: spamhaus.net. type=A class=IN) failed: a domain name contains a null label

2020-10-07 Thread Chris
.0.2, i.e. has the rdns chop [1] in the > module. > > > Here's the message complete with body - > > https://pastebin.com/CW7Vj7Yh > > This written to my syslog - https://pastebin.com/M12PS1fK > > [1] > https://github.com/spamhaus/spamassassin-dqs/blob/master/SH.pm

Re: spamhaus.net. type=A class=IN) failed: a domain name contains a null label

2020-10-06 Thread Chris
On Tue, 2020-10-06 at 20:52 -0700, John Hardin wrote: > On Wed, 7 Oct 2020, Riccardo Alfieri wrote: > > > Hi Chris, > > > > > > > > > > > spamd[435769]: dns: new_dns_packet > > > > > > > (domain=o279.send.iheartdogs.co

Re: spamhaus.net. type=A class=IN) failed: a domain name contains a null label

2020-10-06 Thread Chris
On Wed, 2020-10-07 at 03:40 +, Riccardo Alfieri wrote: > Hi Chris, > > > > > > > > spamd[435769]: dns: new_dns_packet > > > > > > (domain=o279.send.iheartdogs.com..x > > > > > > x/db > > > >

Re: spamhaus.net. type=A class=IN) failed: a domain name contains a null label

2020-10-06 Thread Chris Pollock
On Tue, 2020-10-06 at 19:49 -0700, John Hardin wrote: > On Tue, 6 Oct 2020, Chris wrote: > > > On Tue, 2020-10-06 at 18:54 -0700, John Hardin wrote: > > > On Tue, 6 Oct 2020, Chris wrote: > > > > > > > The complete error looks like this: > >

Re: spamhaus.net. type=A class=IN) failed: a domain name contains a null label

2020-10-06 Thread Chris
On Tue, 2020-10-06 at 19:49 -0700, John Hardin wrote: > On Tue, 6 Oct 2020, Chris wrote: > > > On Tue, 2020-10-06 at 18:54 -0700, John Hardin wrote: > > > On Tue, 6 Oct 2020, Chris wrote: > > > > > > > The complete error looks like this: > >

Re: spamhaus.net. type=A class=IN) failed: a domain name contains a null label

2020-10-06 Thread Chris
On Tue, 2020-10-06 at 18:54 -0700, John Hardin wrote: > On Tue, 6 Oct 2020, Chris wrote: > > > The complete error looks like this: > > > > spamd[435769]: dns: new_dns_packet > > (domain=o279.send.iheartdogs.com..xx/dbl.dq > > .spa &g

spamhaus.net. type=A class=IN) failed: a domain name contains a null label

2020-10-06 Thread Chris
doesn't hurt anything however I'm just curious as to what might be causing it. It appears to have been going on all year so far but as I said not with every incoming message just from certain domains it seems. Any ideas? -- Chris 31.11972; -97.90167 (Elev. 1092 ft) 20:12:39 up 4:07, 1 user, load

Re: DNS issues or something else?

2020-10-05 Thread Chris
On Mon, 2020-10-05 at 16:14 +0100, RW wrote: > On Mon, 05 Oct 2020 09:17:09 -0500 > Chris wrote: > > > Since my update to Ubuntu 20.04 last Wed I've been seeing this in > > every message that's run through spamassassin. > > > > https://pastebin.com/hy6WGXYH

DNS issues or something else?

2020-10-05 Thread Chris
should begin my research on this would be appreciated. Thanks Chris -- Chris 31.11972; -97.90167 (Elev. 1092 ft) 09:05:49 up 17:43, 1 user, load average: 1.64, 1.39, 1.28 Description:Ubuntu 20.04.1 LTS, kernel 5.4.0-48-generic

Re: DKIM invalid

2020-02-05 Thread Chris Conn
age a few plugins of my own for installation on other systems and hence you mangle the spamassassin package itself? oh my lord.. [root@mail-gw:~]$ rpm -qa | grep spamassassin | sort spamassassin-3.4.4-1.fc31.x86_64 spamassassin-bogofilter-1.0-8.fc31.20200204.rh.noarch

Re: DKIM invalid

2020-02-05 Thread Chris Conn
smart people would have opened koji, enter spamasssin,, select the F31 package from https://koji.fedoraproject.org/koji/packageinfo?packageID=554 and downloaded https://kojipkgs.fedoraproject.org//packages/spamassassin/3.4.4/1.fc31/x86_64/spamassassin-3.4.4-1.fc31.x86_64.rpm or just used "dnf

Re: DKIM invalid

2020-02-05 Thread Chris Conn
On 2/4/2020 5:12 PM, Chris Conn wrote: On 2/4/2020 5:09 PM, Damian wrote: https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7785 maybe? Hello, You were correct; using 3.4.3  on fedora with milter-spamc, pretty much every email would match DKIM_INVALID when handled by the MTA

Re: DKIM invalid

2020-02-04 Thread Chris Conn
On 2/4/2020 5:09 PM, Damian wrote: https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7785 maybe? Hello, HM, very possible.  I am using milter-spamc but the behaviour might be similar.  I will look to build 3.4.4 and see if I get better DKIM returns.  Thanks for this. Chris I am

DKIM invalid

2020-02-04 Thread Chris Conn
the MTA-level scan by the milter would score it invalid and a commandline test of the  .eml would return a different value on the same spamassassin daemon? Thanks in advance, Chris

Re: ANNOUNCE: Apache SpamAssassin 3.4.4 available

2020-01-30 Thread Chris
.4.3 they backported the fixes to 3.4.2. I'm getting ready to file another bug report requesting upgrade to 3.4.4 listing the CVE's affected and see what happens. > > Then they would presumably backport the SHA-256 checksum handling, > as > it is a security issue... > > -- Chris 31.11972; -97.90167 (Elev. 1092 ft) 17:12:12 up 2 days, 8:39, 1 user, load average: 1.41, 0.72, 0.54 Description:Ubuntu 18.04.3 LTS, kernel 5.3.0-28-generic

Re: Use of uninitialized value $r in scalar chomp at /usr/local/share/perl/5.26.1/File/Scan/ClamAV.pm line 224

2020-01-10 Thread Chris
On Fri, 2020-01-10 at 00:56 -0500, Bill Cole wrote: > On 9 Jan 2020, at 17:32, Chris wrote: > > > Since upgrading my Ubuntu 18.04.3 to ClamAV version 0.102.1 > > yesterday > > I've been seeing this in my syslog: > > > > spamd[2455]: Use of uninitialized value

Re: rpm of centos

2020-01-10 Thread Chris Conn
I am a fan of the Rule2XSBody plugin. Maybe thats old fashioned, I don't know; but Centos/RHEL being so strict on their versioning, Centos8 is stuck with 3.4.2 forever so I am happily running 3.4.3 on it. Best of luck in your build, hope this helps, Chris

Use of uninitialized value $r in scalar chomp at /usr/local/share/perl/5.26.1/File/Scan/ClamAV.pm line 224

2020-01-09 Thread Chris
//) at /usr/local/share/perl/5.26.1/File/Scan/ClamAV.pm line 227 Line 224 - chomp(my $r = $conn->getline); Line 227 - if($r =~ /stream:\ (.+)\ FOUND/ix){ Is this an issue with ClamAV.pm or with ClamAV itself? Chris -- Chris 31.11972; -97.90167 (Elev. 1092 ft) 16:27:34 up 38 days, 7:10, 1 user, l

Ubuntu bug report for SA 3.4.3

2019-12-19 Thread Chris
I've submitted a bug report to Ubuntu to get SA upgraded by the newest version: https://bugs.launchpad.net/ubuntu/+source/spamassassin/+bug/1856248 -- Chris 31.11972; -97.90167 (Elev. 1092 ft) 19:49:22 up 17 days, 10:32, 1 user, load average: 1.20, 0.91, 0.60 Description:Ubuntu 18.04.3 LTS

Re: Spamassassin reporting

2019-12-05 Thread Chris
On Thu, 2019-12-05 at 14:47 -0500, Dave Goodrich wrote: > That looks very familiar, and exactly what I am looking for. I can > make that script work with our log files, thank you. > > DAve > You're welcome. -- Chris 31.11972; -97.90167 (Elev. 1092 ft) 17:28:20 up 3 days, 8:1

Re: Custom rule help

2019-12-05 Thread Chris Mulcahy
On Wed, 4 Dec 2019 12:40:27 -0800 Chris Mulcahy wrote: > Hi. > > I’m relatively new to complex custom rules. I have plenty of simple > and some multi-condition rules but need something custom. > > My approach to using my domain name is bad but I started it in the > 90s so… I

Re: Spamassassin reporting

2019-12-04 Thread Chris Pollock
not turning up > anything for me. > > Thanks, > > DAve > Forgot to add what the output looks like -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 19:11:09 up 2 days, 9:54, 1 user, load average: 0.66, 0.42, 0.39 Description:Ubuntu 18.04.3 LTS, kernel 5.0.0-

Re: Spamassassin reporting

2019-12-04 Thread Chris Pollock
not turning up > anything for me. > > Thanks, > > DAve > Here's what I use for my home system -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 18:06:20 up 2 days, 8:49, 1 user, load average: 0.90, 0.81, 0.84 Description:Ubuntu 18.04.3 LTS, kernel 5.0.0-37-g

Re: Custom rule help

2019-12-04 Thread Chris Mulcahy
From: Martin Gregorie Reply: mar...@gregorie.org Date: December 4, 2019 at 4:12:22 PM To: users@spamassassin.apache.org Subject: Re: Custom rule help On Wed, 2019-12-04 at 12:40 -0800, Chris Mulcahy wrote: > I want a rule that scores if “sitename” is not in the From: line. If > the

Custom rule help

2019-12-04 Thread Chris Mulcahy
Hi. I’m relatively new to complex custom rules. I have plenty of simple and some multi-condition rules but need something custom. My approach to using my domain name is bad but I started it in the 90s so… I have some sites where I gave them my email address as “ sitename@mydomain.com” so I

Re: Spamhaus Technology contributions to SpamAssassin

2019-07-03 Thread Chris Conn
ecanisms? Cheers and thanks, Chris

Re: SA-Update cronjob output rejected by ISP for containing spam

2019-06-22 Thread Chris Pollock
On Sat, 2019-06-22 at 16:10 -0700, John Hardin wrote: > On Sat, 22 Jun 2019, Chris Pollock wrote: > > > On Sat, 2019-06-22 at 10:29 -0700, John Hardin wrote: > > > On Sat, 22 Jun 2019, Chris Pollock wrote: > > > > > > > I'm not sure how

Re: SA-Update cronjob output rejected by ISP for containing spam

2019-06-22 Thread Chris Pollock
On Sat, 2019-06-22 at 16:10 -0700, John Hardin wrote: > On Sat, 22 Jun 2019, Chris Pollock wrote: > > > On Sat, 2019-06-22 at 10:29 -0700, John Hardin wrote: > > > On Sat, 22 Jun 2019, Chris Pollock wrote: > > > > > > > I'm not sure how

Re: SA-Update cronjob output rejected by ISP for containing spam

2019-06-22 Thread Chris Pollock
On Sat, 2019-06-22 at 10:29 -0700, John Hardin wrote: > On Sat, 22 Jun 2019, Chris Pollock wrote: > > > I'm not sure how to exactly word the problem so the subject is the > > best > > I can do for now. Whenever a crojob is run a message is sent out > > via >

SA-Update cronjob output rejected by ISP for containing spam

2019-06-22 Thread Chris Pollock
was rejected for containing spam. Any ideas what was in the latest rule updates to cause this? -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 11:56:52 up 1 day, 18:07, 1 user, load average: 1.21, 0.70, 0.65 Description:Ubuntu 18.04.2 LTS, kernel 4.18.0-22-generic

Re: Ransom spam body is .jpg

2019-05-24 Thread Chris Pollock
On Fri, 2019-05-24 at 18:29 -0700, John Hardin wrote: > On Fri, 24 May 2019, Chris Pollock wrote: > > > This is the 2nd of these ransom spams I've received where the body > > of > > the message is a .jpg. Below is the body and also a link to the > > heade

Ransom spam body is .jpg

2019-05-24 Thread Chris Pollock
Fuz1=1 Fuz2=many DCC Brand is x.dcc-servers PYZOR Results are Reported 0 times. I don't know if a rule exists for something like this or not. -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 20:04:36 up 9 days, 12:23, 1 user, load average: 1.15, 1.15, 1.12 Description

Re: Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-13 Thread Chris Pollock
On Thu, 2018-12-13 at 17:08 -0500, Bill Cole wrote: > On 13 Dec 2018, at 16:24, Chris Pollock wrote: > > > On Thu, 2018-12-13 at 15:14 -0600, Chris Pollock wrote: > > > On Tue, 2018-12-11 at 19:00 -0500, Bill Cole wrote: > > > > On 11 Dec 20

Re: Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-13 Thread Chris Pollock
On Thu, 2018-12-13 at 15:14 -0600, Chris Pollock wrote: > On Tue, 2018-12-11 at 19:00 -0500, Bill Cole wrote: > > On 11 Dec 2018, at 16:37, Chris Pollock wrote: > > > > > On Mon, 2018-12-10 at 13:09 -0500, Bill Cole wrote: > > > > [...] > > > >

Re: Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-13 Thread Chris Pollock
On Tue, 2018-12-11 at 19:00 -0500, Bill Cole wrote: > On 11 Dec 2018, at 16:37, Chris Pollock wrote: > > > On Mon, 2018-12-10 at 13:09 -0500, Bill Cole wrote: > > [...] > > > Anyway, as of today I've capped those 2 subrules at levels which > > > leave ample

Re: Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-11 Thread Chris Pollock
On Tue, 2018-12-11 at 19:00 -0500, Bill Cole wrote: > On 11 Dec 2018, at 16:37, Chris Pollock wrote: > > > On Mon, 2018-12-10 at 13:09 -0500, Bill Cole wrote: > > [...] > > > Anyway, as of today I've capped those 2 subrules at levels which > > > leave ample

Re: Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-11 Thread Chris Pollock
On Mon, 2018-12-10 at 13:09 -0500, Bill Cole wrote: > On 9 Dec 2018, at 18:23, Chris Pollock wrote: > > > On Sun, 2018-12-09 at 13:06 -0500, Bill Cole wrote: > > > On 9 Dec 2018, at 12:04, Chris Pollock wrote: > > > > > > > This is probably very trivial

Re: Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-11 Thread Chris Pollock
On Mon, 2018-12-10 at 13:09 -0500, Bill Cole wrote: > On 9 Dec 2018, at 18:23, Chris Pollock wrote: > > > On Sun, 2018-12-09 at 13:06 -0500, Bill Cole wrote: > > > On 9 Dec 2018, at 12:04, Chris Pollock wrote: > > > > > > > This is probably very trivial

Re: Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-09 Thread Chris Pollock
On Sun, 2018-12-09 at 13:06 -0500, Bill Cole wrote: > On 9 Dec 2018, at 12:04, Chris Pollock wrote: > > > This is probably very trivial and doesn't affect anything except > > maybe > > the size of the headers but I have to ask. When looking at the > > headers >

Subtest __E_LIKE_LETTER and __LOWER_E listed many times in message header

2018-12-09 Thread Chris Pollock
listed? Couldn't each subtest be listed just once instead of multiple times? -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 10:58:20 up 1 day, 15:22, 1 user, load average: 0.67, 0.49, 0.31 Description:Ubuntu 18.04.1 LTS, kernel 4.15.0-42-generic signature.asc Description

Re: Cannot install SpamAssassin on Ubuntu 18.04.1 (gpg not found?)

2018-10-26 Thread Chris Pollock
t; > installed > > and sa-compile was installed later. > > I am using SA on Ubuntu 18.04 without any such problems. Looking at > the package changelogs for SA 3.4.1-8 under Debian/Ubuntu they are > identical except that, for Ubuntu 18.04, SA was rebuilt > against openssl1.1.

Current update channels

2018-09-19 Thread Chris Pollock
I noticed in a post that Kevin McGrail made that the 'sought' rules are no longer published. So, my update-channels file that SA-Update reads should have only one entry: updates.spamassassin.org Is that correct -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 14:38:23 up 3

Re: [ANNOUNCE] Apache SpamAssassin 3.4.2 available

2018-09-16 Thread Chris
Sun, Sep 16, 2018, 20:45 Chris wrote: > > On Sun, 2018-09-16 at 11:03 -0400, Kevin A. McGrail wrote: > > > > > Good Morning, > > > > > > > > > > On behalf of the Apache SpamAssassin Project Management > > Committee, I > > >

Re: [ANNOUNCE] Apache SpamAssassin 3.4.2 available

2018-09-16 Thread Chris
urity announcement > will > follow within the next 24 hours. > > Apache SpamAssassin can be downloaded from > https://spamassassin.apache.org/downloads.cgi and via cpan > (Mail::SpamAssassin). > I assume that once the Ubuntu folks get the security announcement they'll build and r

Re: KAM.cf update script

2018-08-18 Thread Chris
r/bin/mail -s KAM_changes jpff > /bin/systemctl -l reload spamassassin.service > > exit 0 > > Sems to work OK; noting special > Thanks, looks good, I'll give it a try. > > On Sat, 18 Aug 2018, Chris wrote: > > > Does anyone have a script that I can run as a cro

KAM.cf update script

2018-08-18 Thread Chris
Does anyone have a script that I can run as a cron job to update the KAM.cf file? Thanks Chris -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 12:27:45 up 14:39, 1 user, load average: 8.88, 3.45, 1.40 Description:Ubuntu 18.04.1 LTS, kernel 4.15.0-32-generic

Re: Update to Ubuntu 18.04.1 seems to have partially broken SA

2018-08-17 Thread Chris
On Fri, 2018-08-17 at 23:00 +0100, RW wrote: > On Fri, 17 Aug 2018 16:25:14 -0500 > Chris wrote: > > > Early on when SA-Compile was run I did manage to capture this: > > > > Running sa-compile (may take a long time) > > Unescaped left brace in regex is d

Re: Update to Ubuntu 18.04.1 seems to have partially broken SA

2018-08-17 Thread Chris
On Fri, 2018-08-17 at 14:46 -0700, John Hardin wrote: > On Fri, 17 Aug 2018, Chris wrote: > > > Early on > > when SA-Compile was run I did manage to capture this: > > > > Running sa-compile (may take a long time) > > Unescaped left brace in regex i

Re: Update to Ubuntu 18.04.1 seems to have partially broken SA

2018-08-17 Thread Chris
On Fri, 2018-08-17 at 17:54 +0100, Dominic Raferd wrote: > > > On Fri, 17 Aug 2018 at 17:34, Chris wrote: > > I noticed last night while updating to 18.04.1 that there were > > warnings > > about SA Compile. I tried to copy to the clipboard however that &g

Re: Update to Ubuntu 18.04.1 seems to have partially broken SA

2018-08-17 Thread Chris
On Fri, 2018-08-17 at 17:54 +0100, Dominic Raferd wrote: > > > On Fri, 17 Aug 2018 at 17:34, Chris wrote: > > I noticed last night while updating to 18.04.1 that there were > > warnings > > about SA Compile. I tried to copy to the clipboard however that &g

Update to Ubuntu 18.04.1 seems to have partially broken SA

2018-08-17 Thread Chris
ntu.com/ubuntu bionic/main i386 Packages 100 /var/lib/dpkg/status -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 11:18:49 up 13:48, 1 user, load average: 1.43, 1.26, 1.07 Description:Ubuntu 18.04.1 LTS, kernel 4.15.0-32-generic signature.asc Description: This is a digitally signed message part

Re: plugin: eval failed: __alarm__ignore__(xxx) how to troubleshoot

2018-04-20 Thread Chris Conn
an get 3.4.x deployed. Thanks again, Chris

Re: plugin: eval failed: __alarm__ignore__(xxx) how to troubleshoot

2018-04-20 Thread Chris Conn
; got hit: "your business" Apr 20 14:14:06.444 [27778] dbg: rules: ran body rule __HIGHBITS ==> got hit: "â?¢ â?? " Apr 20 14:14:06.590 [27778] dbg: rules: running uri tests; score so far=4. however, with Rule2XSBody enabled, on SA 3.3.1 on Centos6, it loops forever. With or witout Rule2XSBody on Centos7 SA 3.4.0-2 bundled SA rpm, it works correctly. I am disabling Rule2XSBody for now while I rebuild Centos7 boxes. Chris

Re: plugin: eval failed: __alarm__ignore__(xxx) how to troubleshoot

2018-04-20 Thread Chris Conn
On 4/18/2018 10:32 AM, Benny Pedersen wrote: Chris Conn skrev den 2018-04-18 16:00: this is a relatively old install, SA 3.3.1 on Centos6 (stock RPMs) maybe solved in centos7 ? i do not use precompiled problems Hello, I believe I found the issue.  On my Centos6 boxes with SA 3.3.1

Re: plugin: eval failed: __alarm__ignore__(xxx) how to troubleshoot

2018-04-18 Thread Chris Conn
, and eventually croaks with that msg. Thanks folks, Chris

plugin: eval failed: __alarm__ignore__(xxx) how to troubleshoot

2018-04-18 Thread Chris Conn
to be a function in Timeout.pm this is a relatively old install, SA 3.3.1 on Centos6 (stock RPMs) Any tips on how to troubleshoot the essence or root of this issue? Thanks in advance, Chris

Re: smtp.centurylink.net 206.152.134.66

2018-02-11 Thread Chris
hich was useless also) or call. You might try them though.  Sorry I couldn't be of more help. Chris -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 15:31:38 up 9 days, 23:04, 1 user, load average: 0.94, 0.83, 0.74 Description:Ubuntu 16.04.3 LTS, kernel 4.13.0-32-ge

Re: SA-Update exits with code 4

2018-01-31 Thread Chris
On Wed, 2018-01-31 at 13:09 -0600, David Jones wrote: > On 01/30/2018 09:37 PM, Chris wrote: > > > > > > > > > > > rules: failed to run FORGED_GMAIL_RCVD test, skipping: > > >   (Can't locate object method > > > "check_for_forged_gm

Re: SA-Update exits with code 4

2018-01-30 Thread Chris
On Tue, 2018-01-30 at 21:15 -0600, David Jones wrote: > On 01/30/2018 08:04 PM, Chris wrote: > > > > Yesterday there were no issues with my once a day update. Today it > > exited with a code 4. Here is the output: > > > > https://pastebin.com/aXvk0QQu

SA-Update exits with code 4

2018-01-30 Thread Chris
Yesterday there were no issues with my once a day update. Today it exited with a code 4. Here is the output: https://pastebin.com/aXvk0QQu Any ideas on what seems to be the problem? Chris -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 20:02:58 up 2:46, 1 user, load

Re: ClamAV.pm question

2018-01-30 Thread Chris
after I changed the tmp dir to /var/tmp instead of /var/lib/clamav/tmp > On 30/01/2018 17:50, Chris wrote: > > > > I'm seeing this - https://pastebin.com/86s7cVBj and I'm not sure if > > it's an SA issue or a ClamAV issue. > > > > apt-cache policy cla

ClamAV.pm question

2018-01-30 Thread Chris
I'm seeing this - https://pastebin.com/86s7cVBj and I'm not sure if it's an SA issue or a ClamAV issue.  apt-cache policy clamav clamav:   Installed: 0.99.3-0ubuntu1~chris+1   Candidate: 0.99.3-0ubuntu1~chris+1 apt-cache policy spamassassin spamassassin:   Installed: 3.4.1-3   Candidate: 3.4.1-3

Re: From name containing a spoofed email address

2018-01-26 Thread Chris
On Fri, 2018-01-26 at 16:26 -0600, sha...@shanew.net wrote: > Just a hunch, but did you make sure to add the "$self->register..." > line inside the "sub new {" block with all the others in > HeaderEval.pm? > Yep, sure did, thanks for that. All is well now. &g

Re: From name containing a spoofed email address

2018-01-26 Thread Chris
>   } > } > > R.G. > Just for the heck of it I added the above to my SpamAssassin setup at home. However my syslog shows: rules: failed to run __F_DM1 test, skipping: (Can't locate object method "from_domains_mismatch" via package "Mail: [...]:SpamAssassin::PerMsgSt

Re: skipping nameserver '0.ns.spamhaus.org' because it is a CNAME

2018-01-14 Thread Chris
n > logs; I am quite confident that nothing was really seriously broken, > but I understand that it may have annoyed some people. > Thanks for the explanation Alex, I wasn't annoyed, just baffled. As you said, everything is back to normal. Chris -- Chris KeyID 0xE372A7DA98E6705C 31.11

skipping nameserver '0.ns.spamhaus.org' because it is a CNAME

2018-01-14 Thread Chris
I started seeing this yesterday evening - https://pastebin.com/Q01t63uf  AFAICT it's happening on every message that is processed by SA. This is: spamassassin -V SpamAssassin version 3.4.1   running on Perl version 5.22.1 Any ideas? Chris -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167

Re: error: unable to refresh mirrors file for channel updates.spamassassin.org

2017-11-30 Thread Chris
On Thu, 2017-11-30 at 13:17 -0600, David Jones wrote: > On 11/30/2017 01:09 PM, Chris wrote: > > > > Over the past few days I've been seeing the above. The complete > > output > > is: > > > > /etc/cron.daily/spamassassin: > > erro

error: unable to refresh mirrors file for channel updates.spamassassin.org

2017-11-30 Thread Chris
for this? Chris -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 13:05:38 up 8 days, 2:06, 1 user, load average: 0.45, 0.72, 0.80 Description:Ubuntu 16.04.3 LTS, kernel 4.10.0-40-generic signature.asc Description: This is a digitally signed message part

Re: SA-Update not updating DB

2017-11-16 Thread Chris
On Thu, 2017-11-16 at 09:06 -0600, David Jones wrote: > On 11/16/2017 08:57 AM, Chris wrote: > > > > On Thu, 2017-11-16 at 07:22 -0600, David Jones wrote: > > > > > > Great news!  Last night's run finally produced a full > > > 72_scores.cf. > >

Re: SA-Update not updating DB

2017-11-16 Thread Chris
ruleset to my platforms and will monitor  > scoring/blocking over the next couple of days. > Hmm, the file doesn't seem to be able to be found unless of course I did something incorrectly: chris@localhost:~/Downloads$ wget http://sa-update.ena.com/${REV}.tar.g z --2017-11-16 08:51:50-- 

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-21 Thread Chris
On Thu, 2017-09-21 at 11:58 +0100, Martin Gregorie wrote: > On Wed, 2017-09-20 at 19:39 -0500, Chris wrote: > > > > It was installed by default when upgrading from 14.04LTS to > > 16.04LTS > > > Then it may be best to just leave it there. > > > &

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-20 Thread Chris
On Wed, 2017-09-20 at 15:22 -0700, Ian Zimmerman wrote: > On 2017-09-20 17:02, Chris wrote: > > > > > So, IIUC it would be a good idea to remove the resolv.conf symlink > > in > > /run/resolvconf ? > Definitely _not_ a good idea while the resolvconf package

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-20 Thread Chris
On Wed, 2017-09-20 at 19:05 +0100, Martin Gregorie wrote: > On Wed, 2017-09-20 at 08:48 -0500, Chris wrote: > > > > On Wed, 2017-09-20 at 11:15 +0100, Martin Gregorie wrote: > > > > > > On Tue, 2017-09-19 at 19:32 -0500, Chris wrote: > > > >

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-20 Thread Chris
be a good idea to remove the resolv.conf symlink in /run/resolvconf ? > Finally (and getting really OT), it helps to keep relevant /etc files > under version control, so you know when the system helpfully shifts > the > ground under you. > -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 16:42:52 up 19:55, 1 user, load average: 0.65, 0.59, 0.83 Description:Ubuntu 16.04.3 LTS, kernel 4.10.0-35-generic signature.asc Description: This is a digitally signed message part

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-20 Thread Chris
   - nethack  3.4.2-2 2 ogra   - pubip0.6 28thibran- snappy-debug 0.31.4-snapd2.26.9  70canonical  - snapweb  0.26-11-dev 307   canonical  - speed-test   1.8.0   16bartaz - wallpaper

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-20 Thread Chris
On Tue, 2017-09-19 at 23:04 -0400, Bill Cole wrote: > On 19 Sep 2017, at 22:36, Chris wrote: > > > > > On Wed, 2017-09-20 at 04:31 +0200, Reindl Harald wrote: > > > > > > > > > Am 20.09.2017 um 02:32 schrieb Chris: > > > > > &

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-20 Thread Chris
On Wed, 2017-09-20 at 11:15 +0100, Martin Gregorie wrote: > On Tue, 2017-09-19 at 19:32 -0500, Chris wrote: > > > > Hi Martin, here's what I see: > > > > sudo systemctl status dnsmasq > > [sudo] password for chris:  > > ● dnsmasq.service > &g

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-19 Thread Chris
On Wed, 2017-09-20 at 04:31 +0200, Reindl Harald wrote: > > Am 20.09.2017 um 02:32 schrieb Chris: > > > > I then installed dnsmasq (apparently it wasn't installed) > frankly clean up your mess - you recently posted dnsmasq as well as  > named listening on different int

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-19 Thread Chris
On Tue, 2017-09-19 at 19:32 -0500, Chris wrote: > On Wed, 2017-09-20 at 00:40 +0100, Martin Gregorie wrote: > > > > On Tue, 2017-09-19 at 16:44 -0500, Chris wrote: > > > > > > > > > > > > Thanks Martin, here's what I get, it appears to not b

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-19 Thread Chris
On Wed, 2017-09-20 at 00:40 +0100, Martin Gregorie wrote: > On Tue, 2017-09-19 at 16:44 -0500, Chris wrote: > > > > > > Thanks Martin, here's what I get, it appears to not be running. > > > > sudo systemctl stop dnsmasq > > [sudo] password for chris:  &

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-19 Thread Chris
On Tue, 2017-09-19 at 15:40 -0500, Chris wrote: > On Tue, 2017-09-19 at 08:41 -0500, David Jones wrote: > > > > On 09/19/2017 08:25 AM, Chris wrote: > > > > > > > > > On Tue, 2017-09-19 at 08:16 -0500, Chris wrote: > > > > > > >

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-19 Thread Chris
On Tue, 2017-09-19 at 14:47 -0700, John Hardin wrote: > On Tue, 19 Sep 2017, Chris wrote: > > > I'm getting different outputs each time I run dig +trace > > 65.43.116.208.iadb.isipp.com > > > > 65.43.116.208.iadb.isipp.com. 3600 IN A   127.0.1.255 > >

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-19 Thread Chris
On Tue, 2017-09-19 at 22:07 +0100, Martin Gregorie wrote: > On Tue, 2017-09-19 at 15:40 -0500, Chris wrote: > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > &g

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-19 Thread Chris
On Tue, 2017-09-19 at 08:41 -0500, David Jones wrote: > On 09/19/2017 08:25 AM, Chris wrote: > > > > On Tue, 2017-09-19 at 08:16 -0500, Chris wrote: > > > > > > On Tue, 2017-09-19 at 07:45 -0500, David Jones wrote: > > > > > > > >

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-19 Thread Chris
On Tue, 2017-09-19 at 08:16 -0500, Chris wrote: > On Tue, 2017-09-19 at 07:45 -0500, David Jones wrote: > > > > On 09/18/2017 06:03 PM, Chris wrote: > [snip] > > > > > > > > > > > localhost dnsmasq[2323]: started, version 2.75 cachesize 150

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-19 Thread Chris
On Tue, 2017-09-19 at 07:45 -0500, David Jones wrote: > On 09/18/2017 06:03 PM, Chris wrote: [snip] > > > > localhost dnsmasq[2323]: started, version 2.75 cachesize 150 > > localhost dnsmasq[2323]: compile time options: IPv6 GNU-getopt DBus > > i18n IDN DHCP DHCPv6

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-18 Thread Chris
On Mon, 2017-09-18 at 12:32 -0500, David Jones wrote: > On 09/18/2017 11:52 AM, Chris wrote: > > > > On Mon, 2017-09-18 at 11:40 -0500, David Jones wrote: > > > > > > On 09/18/2017 11:14 AM, Chris wrote: > > > > > > > > &

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-18 Thread Chris
On Mon, 2017-09-18 at 11:40 -0500, David Jones wrote: > On 09/18/2017 11:14 AM, Chris wrote: > > > > On Mon, 2017-09-18 at 11:11 -0400, Bill Cole wrote: > > > > > > On 18 Sep 2017, at 10:57, Chris wrote: > > > > > > [...] > > > >

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-18 Thread Chris
On Mon, 2017-09-18 at 11:11 -0400, Bill Cole wrote: > On 18 Sep 2017, at 10:57, Chris wrote: > > [...] > > > > > > > > I am receiving many hits on *_IADB_* rules just fine recently for > > > emails  > > > from constantcontact.com and others.

Re: ISIPP - Re: bb.barracudacentral.org

2017-09-18 Thread Chris
On Mon, 2017-09-18 at 09:28 -0500, David Jones wrote: > On 09/18/2017 09:12 AM, Kevin A. McGrail wrote: > > > > On 9/16/2017 4:36 PM, Chris wrote: > > > > > > I'm also seeing issues with ISIPP which is in 20_dnsbl_tests.cf. > > > I've > > > atta

Re: bb.barracudacentral.org

2017-09-16 Thread Chris
On Sat, 2017-09-16 at 16:32 +0200, Reindl Harald wrote: > > Am 16.09.2017 um 16:27 schrieb Chris: > > > > named[1284]: REFUSED unexpected RCODE resolving > > '165.170.166.108.iadb.isipp.com/A/IN': 168.150.251.35#53 > > named[1284]: host unreachable resolving >

Re: bb.barracudacentral.org

2017-09-16 Thread Chris
On Sat, 2017-09-16 at 09:45 -0400, Kevin A. McGrail wrote: > Chris & all, > I have opened a bug about this:  > https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7471 > > I believe scoring it 0 for now will disable the rule but that's just  > hiding the issue. &g

Re: bb.barracudacentral.org

2017-09-15 Thread Chris
since as I said at first it's not causing any other issues it's just something that had been nagging at me since I keep seeing it and wondering why. -- Chris KeyID 0xE372A7DA98E6705C 31.11972; -97.90167 (Elev. 1092 ft) 19:44:07 up 7 days, 3:12, 1 user, load average: 0.55, 2.25, 2.56 Descrip

Re: bb.barracudacentral.org

2017-09-15 Thread Chris
On Fri, 2017-09-15 at 18:20 -0400, Kevin A. McGrail wrote: > On 9/15/2017 5:50 PM, Chris wrote: > > > > It's not a 'show stopper' it's just annoying to keep seeing this > > and > > wondering what the cause is. > You have configured your installation with the Bara

bb.barracudacentral.org

2017-09-15 Thread Chris
ede...@mail190.atl81.rsgsv.net> for chris:1000 localhost named[1284]: connection refused resolving '190.129.2.198.bb.barracudacentral.org/A/IN': 64.235.154.72#53 Is this an issue with an SA rule or some kind of an issue with Bind? I'm only using it as a caching name server. When running the message t

  1   2   3   4   5   6   7   8   9   10   >