Re: Recognizing Sendmail's authentication -- patch included (WAS: How is LOCAL_AUTH_RCVD used?)

2006-12-05 Thread Daryl C. W. O'Shea
Jo Rhett wrote: On Dec 5, 2006, at 2:02 AM, David B Funk wrote: It still should not matter. So long as the client can authenticate to the server's statisfaction, SA should honor its decision regardless of how bogus the HELO or client's DNS entrys look. That's your argument. That may not

Re: rules_du_jour not working confusion?

2006-12-05 Thread Daryl C. W. O'Shea
Alan Munday wrote: By default, there is no duplication. sa-update will update only the stock rules. However, there have been additional channels created for sa-update to allow it to update the SARE rules as well. You just add the ones you want to your sa-update channels file. One

Re: How is LOCAL_AUTH_RCVD used?

2006-12-04 Thread Daryl C. W. O'Shea
René Berber wrote: Hi, I have a similar problem as the one recently reported by J. Rhett in thread skipping SPF checks for authenticated users. I'm trying to use Botnet plugin and make it not score for authenticated users; having the same for SPF and RBL would be even better. So the problem

Re: sa-update / taint error

2006-12-01 Thread Daryl C. W. O'Shea
Henk van Lingen wrote: Hi Daryl, I restored my situation from two days ago, and the problem returned. Your patch seems to fix the problem. Thanks for confirming the fix Henk. Fixed in the 3.1 branch (3.1.8) and trunk. Daryl

Re: sa-update / taint error

2006-11-30 Thread Daryl C. W. O'Shea
Henk van Lingen wrote: [14411] dbg: generic: unlinking 10_misc.cf Insecure dependency in unlink while running with -T switch at /usr/bin/sa-update line 1173. Please try the attached patch and *please* let me know if it resolves the problem. Daryl Index: sa-update.raw

Re: sa-update / taint error

2006-11-30 Thread Daryl C. W. O'Shea
Henk van Lingen wrote: On Thu, Nov 30, 2006 at 11:55:36AM -0500, Daryl C. W. O'Shea wrote: Henk van Lingen wrote: [14411] dbg: generic: unlinking 10_misc.cf Insecure dependency in unlink while running with -T switch at /usr/bin/sa-update line 1173. Please try the attached

Re: Prevent scanning internal mail

2006-11-30 Thread Daryl C. W. O'Shea
leemansvg wrote: This might be a simple question for most of you. How would I prevent spamassassin from scanning my internal mail Don't pass the mail to SpamAssassin. SA is a mail filter, it'll filter anything it's given. Daryl

Re: My Credit rateing does TOO matter

2006-11-30 Thread Daryl C. W. O'Shea
John Andersen wrote: How is it these spams slip under the radar with such low scores? They seldom score about 3.1 in my setup even with network tests and bayes (SA 3.1.7). I don't think I've seen such a spam pass as ham, although you've been quite vague. I wish I could find an effective

Re: RelayChecker (now Botnet ) 0.4

2006-11-28 Thread Daryl C. W. O'Shea
Rick Macdougall wrote: Jonas Eckerman wrote: Mark Martinec wrote: Indeed. Also coupling it with p0f (passive operating system fingerprinting) Good idea. Should have thought of that. :-) About p0f see: Those who like SQL might like the stuff at

Re: RelayChecker (now Botnet ) 0.4

2006-11-28 Thread Daryl C. W. O'Shea
Mark Martinec wrote: Daryl C. W. O'Shea, BTW... has anyone ever got the -Q option to have p0f itself listen on a socket to work, instead of using their own wrapper? The core problem is that p0f needs the full TCP session specification in a query: client and server IP address, as well

Re: RelayChecker (now Botnet ) 0.4

2006-11-28 Thread Daryl C. W. O'Shea
Mark Martinec wrote: Daryl, Yeah, but I have the session info Lucky you! But the difficulty of providing a p0f plugin for SA Luck of the Irish Mark! :) remains, SA can only obtain its information by parsing mail header, so there are basically just two options: - let MTA (or amavisd)

Re: Inordinate Dictionary Attavks

2006-11-28 Thread Daryl C. W. O'Shea
Patrick Sherrill wrote: Using sendmail/amavis-new/SA with Dual MTAs. Unfortunately, we still have a few relay domains unable to reasonably provide a userlist for us and we have really been getting slammed over the last few days. I realize this may be slightly off topic, but I could use some

Re: Custom Rulset Help

2006-11-27 Thread Daryl C. W. O'Shea
Simon wrote: Hi There, Im slowly getting there with custom rulesets... Would someone be able to check this out and offer any help if i have it incorrect? Email is coming in with the subject Name wrote:, where Name is a persons name. Subject =~ /\b[a-z]+\s+wrote:/i Thanks in advance That'll

Re: RelayChecker (now Botnet ) 0.4

2006-11-27 Thread Daryl C. W. O'Shea
John Rudd wrote: Rob Mangiafico wrote: On Thu, 23 Nov 2006, John Rudd wrote: I've changed RelayChecker's name to Botnet (since that's its real purpose: identify potential botnet submitted messages). Here's the 0.4 release. ... So, let me know what you think. Let me know if you find any

Re: SPF and SMTP AUTH

2006-11-23 Thread Daryl C. W. O'Shea
Rene Caspari wrote: Yes, this seems to be the problem, for authentication we use an external daemon for pop-before-smtp. Exim (3.36 - I know, its extremely outdated :-) reads the database file for the IP to allow relaying. So there is no authenticated content in the Received-headers, but a new

Re: Help with sa-learn when using Outlook 2003.

2006-11-19 Thread Daryl C. W. O'Shea
On 11/19/2006 3:01 PM, thekillerbean wrote: -Original Message- From: Michael Scheidell [mailto:[EMAIL PROTECTED] Sent: Monday, 20 November 2006 0:02 To: thekillerbean Subject: Offlist: RE: Help with sa-learn when using Outlook 2003. Point your self somewhere else then. It works for

Re: Unexpected behavior when checking list mails

2006-11-18 Thread Daryl C. W. O'Shea
Christian Aust wrote: Hi all, I'm using spamassassin 3.1.7 on Debian 3.1 w/ postfix 2.3.3 and GNU MailMain 2.1.5. When I last sent out a message to the list participants, I encountered this: Two users having an local account on the same machine from which the mail comes are subscribed to

Re: adjust rules and whitelist_from_rcvd

2006-11-14 Thread Daryl C. W. O'Shea
What version of SA are you using? Daryl

Re: Microsoft blacklisted?

2006-11-14 Thread Daryl C. W. O'Shea
Philip Prindeville wrote: whitelist_from_rcvd [EMAIL PROTECTED] mail1.microsoft.com whitelist_from_rcvd [EMAIL PROTECTED] smtp.microsoft.com whitelist_from_rcvd [EMAIL PROTECTED] maila.microsoft.com will that work? It should. Daryl

Re: Problem with spamd

2006-11-09 Thread Daryl C. W. O'Shea
Charlie Clark wrote: Am 09.11.2006 um 02:10 schrieb Daryl C. W. O'Shea: Charlie Clark wrote: Looks like I'm on top of the resources problem but I am getting 421 delivery errors even though the e-mails are coming through. This looks very similar to bug 3828 (which is Spamassassin + Exim

Re: sa-update DNS not updated (was: Block wrote: spams)

2006-11-09 Thread Daryl C. W. O'Shea
Theo Van Dinter wrote: On Thu, Nov 09, 2006 at 01:22:12PM -0500, Daryl C. W. O'Shea wrote: Theo, what's the procedure to push out 3.1.x updates? I posted this a while ago: http://wiki.apache.org/spamassassin/ManualRuleUpdates It's even linked in from the Development Information link

Re: Problem with spamd

2006-11-09 Thread Daryl C. W. O'Shea
Charlie Clark wrote: Am 09.11.2006 um 19:27 schrieb Daryl C. W. O'Shea: If your one and only child is busy doing an expire it can't scan messages too. ah, so I could increase the number of children running to do this? You could, running at least 2 children if you've got the resources

Re: extra line-break after upgrade

2006-11-09 Thread Daryl C. W. O'Shea
Mark Merchant wrote: i just upgraded spamassassin 3.1.0 to 3.1.7 ( Rh9 ) and seem to be getting an extra line-break in the Content-Type header. outlook apparently sees the semi-colon as a LF and doesn't render the email correctly. evolution sees it as a semi colon and every- thing works fine.

Re: Bayesian scores

2006-11-09 Thread Daryl C. W. O'Shea
Steve Ingraham wrote: I have already decreased the Bayes_50_Body rule from 5.0 to 2.5. I don't want to decrease the scores with every Bayes rule because I think I will start seeing some true spam delivered because it did not score high. Any ideas? Don't screw with the bayes scoring that

Re: Bayesian scores

2006-11-09 Thread Daryl C. W. O'Shea
Steve Ingraham wrote: I have already decreased the Bayes_50_Body rule from 5.0 to 2.5. I don't want to decrease the scores with every Bayes rule because I think I will start seeing some true spam delivered because it did not score high. Any ideas? Daryl wrote: Don't screw with the bayes

Re: Single *letter* gif spams (ransom-note-style)

2006-11-08 Thread Daryl C. W. O'Shea
Quinn Comendant wrote: I'm wondering which rules you have that flagged that so well. The same spam message for me scored low: (X-Spam-Status: No, score=2.1 required=4.9 tests=BAYES_50, DK_POLICY_SIGNSOME, EXTRA_MPART_TYPE, HTML_MESSAGE, TRACKER_ID autolearn=no version=3.1.7). I'm using all

Re: Problem with spamd

2006-11-08 Thread Daryl C. W. O'Shea
Charlie Clark wrote: Looks like I'm on top of the resources problem but I am getting 421 delivery errors even though the e-mails are coming through. This looks very similar to bug 3828 (which is Spamassassin + Exim). Except this bug should have been closed a long time ago. Without looking

Re: sa-update DNS not updated

2006-11-08 Thread Daryl C. W. O'Shea
Kenneth Porter wrote: --On Friday, November 03, 2006 5:43 PM + Justin Mason [EMAIL PROTECTED] wrote: there's a rule that matches them in 3.1.x sa-update, fwiw. I don't see it either. What's the name of the rule? I looked at this a few days ago when Theo mentioned it, and forgot to

Re: mail bounce warning for the list

2006-11-07 Thread Daryl C. W. O'Shea
Rose, Bobby wrote: I believe the correct process here is that the moderators of the SA listserver investigate why the listserver got listed on Spamcop. If it is a case where there are addresses to spamtraps in the list, then maybe the list needs to send out opt-in verification messages to

Re: Spam used whitelist?

2006-11-06 Thread Daryl C. W. O'Shea
John Fleming wrote: Real novice here - Would someone please explain how a stock spam was able to use my whitelist to get a huge negative score? I do have a whitelist, but the user shown below is not in it. I do have one Italian (.it) domain in the whitelist, but it is a different/address

Re: Big boost in spam since upgrade

2006-11-02 Thread Daryl C. W. O'Shea
Steve Lake wrote: Ok, this isn't right. Agreed. I upgraded my SA install to 3.1.17 day before yesterday. I cycled the server and now all of a sudden I'm getting 50% of the spam coming through that's getting completely missed. Do I need to reset something or maybe bayes or is

Re: problem with spamassassin

2006-10-30 Thread Daryl C. W. O'Shea
Matt Kettler wrote: [EMAIL PROTECTED] wrote: Thanks. I've found a possible answer. Spamassassin works with only 1 child. Now I have add another child, 2. And now all my mails have the header. Is possible that spamassassin couldn't process all mails because has only one child... so I have

Re: FW: MSGID_SPAM_LETTERS

2006-10-30 Thread Daryl C. W. O'Shea
Suhas (QualiSpace) wrote: Expecting some feedback on this. You're a real funny man. :)

Re: Age of a domain name - a new test?

2006-10-30 Thread Daryl C. W. O'Shea
Chris Santerre wrote: -Original Message- From: John D. Hardin [mailto:[EMAIL PROTECTED] Sent: Monday, October 30, 2006 3:30 PM To: Chris Santerre Cc: Wolfgang Uhr; users@spamassassin.apache.org Subject: RE: Age of a domain name - a new test? On Mon, 30 Oct 2006, Chris

Re: Per Domain Whitelisting

2006-10-27 Thread Daryl C. W. O'Shea
Roman Sozinov wrote: Peter H. Lemieux wrote: jasonegli wrote: For example let's say that domain xyz.com wants to allow all messages from yahoo.com, but domain 123.com does not. Is there a way to allow FROM [EMAIL PROTECTED] TO [EMAIL PROTECTED]? Obtuse SMTPD (http://sd.inodes.org/) can

Re: Scoring base64 blob messages

2006-10-27 Thread Daryl C. W. O'Shea
Peter H. Lemieux wrote: Theo Van Dinter wrote: On Thu, Oct 26, 2006 at 09:46:28AM -0400, Peter H. Lemieux wrote: Also is there an SA rule that scores messages that contain only a single base64 part (as opposed to a base64-encoded attachment)? I doubt many legitimate messages arrive with

Re: spamd shutting itself down?

2006-10-26 Thread Daryl C. W. O'Shea
Juan Mas wrote: Im getting this odd behavior where spamd shuts itself down out of nowhere. I cant really pinpoint what makes it shutdown just what Ive found in the logs. spamd[27466]: [spamd] fork: Cannot allocate memory at /usr/bin/spamd I'd say that's a pretty good reason for it to stop

Re: spamc timing out

2006-10-26 Thread Daryl C. W. O'Shea
Nick Gilbert wrote: [20193] dbg: bayes: first pass decided on 1382400 for atime delta [20193] dbg: locker: refresh_lock: refresh /home/nick/.spamassassin/bayes.lock [20193] dbg: locker: refresh_lock: refresh /home/nick/.spamassassin/bayes.lock [20193] dbg: locker: refresh_lock: refresh

Re: SA-Update error messages

2006-10-26 Thread Daryl C. W. O'Shea
John Andersen wrote: Everytime my SA-Update runs the output from the cron job shows these lines: Only from cron? Use of uninitialized value in eval string at /usr/bin/sa-update line 91. Use of uninitialized value in eval string at /usr/bin/sa-update line 91. Use of uninitialized value in

Re: RFC: spam trapping with policyd-weight and DNSBLs?

2006-10-25 Thread Daryl C. W. O'Shea
Christian Quest wrote: Are statistics that important ? I'm not sure it is that important to get let spam go in. SA scoring is based on huge corpus and gives good results. Bayes auto-adapts to the spam and ham that is going thru the pre-filters one may set (like RBL or greylisting). If there

Re: RFC: spam trapping with policyd-weight and DNSBLs?

2006-10-25 Thread Daryl C. W. O'Shea
Justin Mason wrote: (In the meantime, I'm just going back to removing the BL, using SpamAssassin instead, and using the Shortcircuit plugin to reduce CPU load if RCVD_IN_SBL or RCVD_IN_XBL fires.) Can you selectively short-circuit based on the user's prefs (ie. spam traps vs not)?

Re: RFC: spam trapping with policyd-weight and DNSBLs?

2006-10-25 Thread Daryl C. W. O'Shea
Justin Mason wrote: Jason Haar writes: Obviously you have to have over-speced your mail servers to be able to do this - something poor old Justin can't manage I think :-) Yeah. If I could persuade someone to donate a server just for *my* personal mail, that'd solve it, but in the meantime,

Re: Max-children setting not high enough causing spamassassin to hang?

2006-10-24 Thread Daryl C. W. O'Shea
James Lavery wrote: Hi all, Version: 3.1.4 OS - Unslung 6.8 on a Linksys NSLU2 (Slug) Running spamd with fetchmail and postfix How much memory do one of those things have? A couple of days ago the Slug hung with masses of disk activity; when I looked at what was going on, it seemd that

Re: why this spam has a negative score?

2006-10-24 Thread Daryl C. W. O'Shea
[EMAIL PROTECTED] wrote: Hi all, I´m newbee to Spamassassin I´ve install Spamassassin 3.1.5 a some spam are§not marked as a spam. Whatś wrong in my settings of spamassassin Especially this header: Return-Path: [EMAIL PROTECTED] X-Spam-Checker-Version: SpamAssassin 3.1.5 (2006-08-29) on

Re: why this spam has a negative score?

2006-10-24 Thread Daryl C. W. O'Shea
[EMAIL PROTECTED] wrote to me off list: So, how whitelist the e-mail from users in my domain? I'd be asking myself why there's a need to whitelist my own users. Afterall, if you have to whitelist them to avoid their messages being marked as spam, what do you expect is going to happen when

Re: Max-children setting not high enough causing spamassassin to hang?

2006-10-24 Thread Daryl C. W. O'Shea
James Lavery wrote: Hi Daryl, Aha - yes I think you've right. The Slug only has (I think) 32MB of memory, and the symptoms are definitely of swap thrashing. So I presume what I should do is reduce the max children, and put up with reduced spamassassin performance when a lot of mails come in.

Re: can't create bugzilla account

2006-10-24 Thread Daryl C. W. O'Shea
Kai Bolay wrote: Hi! I'm having trouble signing up at http://issues.apache.org/SpamAssassin/createaccount.cgi - I never receive the email with the randomly-generated password. I've tried with various e-mail accounts - none of them gets any email. Could someone check if this is borken? An

Re: Does skip_rbl_checks have influence on razor 2 and DCC?

2006-10-23 Thread Daryl C. W. O'Shea
Volker wrote: Hi, does anybody know if disabling skip_rbl_checks does stop razor 2 checks and DCC too even if razor2 and dcc are enabled in local.cf? Run spamassassin in debug mode and find out. Daryl

Re: Psst!

2006-10-19 Thread Daryl C. W. O'Shea
Matt Kettler wrote: Another thing I've been noticing recently.. some idiot has been culling the web archives of mailing lists, and is trying to send spam emails to MESSAGE ID's of posts I've made. Check your mail logs! I've been seeing this for about 9 months now. I'm now getting multiple

Re: SA 3.1.7 children hang but don't die

2006-10-19 Thread Daryl C. W. O'Shea
George R. Kasica wrote: I've got my timeout here higher at 60 (slower box) and am not seeing timeout errors or any K processes with 3.1.5 since switching back. It only started with SA 3.1.7 so I'm thinking its something there thats causing the issue. I don't see anything in the 3.1.6/3.1.7

Re: Scoring PTR's

2006-10-19 Thread Daryl C. W. O'Shea
Mark wrote: No, it's NOT good practice. Seriously. Without battering the point, it's really perfectly legit for an MTA to use different HELO names (say, based on hosting of virtual servers), whilst the IP address for that MTA has a OK, we recognize the existence of virtual hosts. I know

Re: How to detect this spam..

2006-10-19 Thread Daryl C. W. O'Shea
Jonas Eckerman wrote: *If* the system is set up to use the SPF plugin *and* enable/allow user rules, it should still be possible for an end user to whitelist_from_spf. You don't need to enable user rules for whitelist_from_spf, or any other whitelist method, to work. Daryl

Re: SA 3.1.7 children hang but don't die

2006-10-18 Thread Daryl C. W. O'Shea
George R. Kasica wrote: I've dropped back to 3.1.5 last evening about 2200 CDT and no problems since. I'm also running FuzzyOCR 2.3b here and did not see the problem until I got to 3.1.7 I'll cc this to the FuzzyOCR list and see if anyone there is seeing this If someone(s) can

Re: spam assassin dies

2006-10-18 Thread Daryl C. W. O'Shea
Jeff Fulmer wrote: I'm getting occasional spam in my inbox that doesn't run through spam assassin. I turned on procmail and discovered that spam assassin is dying with -6. Details from the logs: procmail: Executing /usr/local/bin/spamassassin __db_assert: 0 failed: file

Re: SA 3.1.7 children hang but don't die

2006-10-18 Thread Daryl C. W. O'Shea
Sandy S wrote: Daryl - I switched back to 3.1.5 after my last post, and am sorry to report that I'm still seeing the same issue under 3.1.5. After running a while, the processes in a state of K start building up until I manually kill them. That's great! ;) At least we know that this wasn't

Re: sa-update versus rulesdujour questions

2006-10-18 Thread Daryl C. W. O'Shea
To start, again, I have *nothing* against RDJ. I just like things to be as efficient as practical (it's how I live and make a living), which is why I like sa-update. I'll explain why sa-update is more efficient... Bowie Bailey wrote: I don't know that there is much difference in the

Re: how to set trusted_networks for dynamic ip host

2006-10-18 Thread Daryl C. W. O'Shea
Chris Purves wrote: How do I properly set trusted_networks when my mail server has a dynamic IP address? Assuming your dynamically address mail server is your only mail server, and SA actually sees your public address, auto detection will probably work fine. If it's NATed and SA sees the

Re: sa-update of SARE channels returns multiple Subroutine ... redefined at ... errors

2006-10-18 Thread Daryl C. W. O'Shea
OpenMacNews wrote: i've SA 317 installed on OSX 10.4.8. i currently use RDJ to update SARE rules w/o error. i use sa-update w/ channel=updates.spamassassin.org, also w/o error. i'm switching to SARE updates via sa-update DOS's channels. on exec of sa-update + SARE channels, i get multiple

Re: sa-update of SARE channels returns multiple Subroutine ... redefined at ... errors

2006-10-18 Thread Daryl C. W. O'Shea
OpenMacNews wrote: after a clean install of SA 317, my DATADIR ((...)/SA/Dist/) contains: What's this DATADIR? Are you referring to what would normally be something like /var/lib/spamassassin/ ? DATADIR is what i've specified as my DATADIR @ build time. Mmm... it's not too often that

Re: sa-update of SARE channels returns multiple Subroutine ... redefined at ... errors

2006-10-18 Thread Daryl C. W. O'Shea
If you're seeing subroutine redefined warnings you're loading the same rules more than once, period. Run spamassassin --lint -D and make note of what directories it's loading rules from. Then go and blow away those directories (be careful not to delete things you don't have a copy of... like

Re: ALL_TRUSTED creating a problem

2006-10-17 Thread Daryl C. W. O'Shea
Jo Rhett wrote: Matt Kettler wrote: Matt Kettler wrote: So perhaps I didn't get the Received header that will be added by this host. Yeah, so how did it get to SA? That's the problem. How can SA be scanning it, if it hasn't reached this host yet? Does this matter? SA *IS* scanning it,

Re: ALL_TRUSTED creating a problem

2006-10-17 Thread Daryl C. W. O'Shea
Jo Rhett wrote: Bowie Bailey wrote: Unless you specify it in the configuration, SA has no idea what servers are local for you. In this case, it has to make a guess so it makes the (fairly reasonable) assumption that the most recent received header comes from a local MX. Oh. I get it. We're

Re: This image is turning frequent..

2006-10-17 Thread Daryl C. W. O'Shea
Chris Santerre wrote: I'm embarrassed to ask but, what cf file is that from? [EMAIL PROTECTED] rulesets]$ grep SARE_GIF_STOX * -R | grep meta 70_sare_stocks.cf/20060803.cf:meta SARE_GIF_STOX ( SARE_GIF_ATTACH __IMG_ONLY ) 70_sare_stocks.cf/200608271034.cf:meta SARE_GIF_STOX

Re: ALL_TRUSTED creating a problem

2006-10-17 Thread Daryl C. W. O'Shea
Mark wrote: -Original Message- From: Daryl C. W. O'Shea [mailto:[EMAIL PROTECTED] Sent: dinsdag 17 oktober 2006 5:37 To: Matt Kettler Cc: Jo Rhett; Magnus Holmgren; users@spamassassin.apache.org Subject: Re: ALL_TRUSTED creating a problem As discovered today, Jo's milter isn't adding

Re: ALL_TRUSTED creating a problem

2006-10-17 Thread Daryl C. W. O'Shea
R Lists06 wrote: Im a little confused in this thread now... please clarify this... Does this mean my SA config is not correct if I do not have the ip address of the SA box which is also the main SMTP box in the local.cf in that trusted host config line? *that* trusted host config line? Do

Re: ALL_TRUSTED creating a problem

2006-10-17 Thread Daryl C. W. O'Shea
R Lists06 wrote: Do you put the loopback 127.0.0.1 in your configs? Yeah.

Re: FW: Spamd not killing children

2006-10-16 Thread Daryl C. W. O'Shea
Diffenderfer, Randy wrote: Folks, I, too, have been having somewhat similar issues with 3.1.7. On a RH ES 3.0u7 box, kernel 2.4.21-40.ELsmp, I see these symptoms in syslog (spamd running with -s local2): Oct 14 21:42:01 samler1 spamd[18694]: prefork: child states: III Oct 14 21:42:01 samler1

Re: FW: Spamd not killing children

2006-10-16 Thread Daryl C. W. O'Shea
Diffenderfer, Randy wrote: Well, if it is, they think it is fixed... :-) I'm not sure why Duncan originally marked the bug as a dupe of 4370, but I closed bug 4476 since (i) I couldn't reproduce it on my system after reporting it and (ii) no-one else had reported having problems. A lot of

Re: false positive on citibank e-mail

2006-10-16 Thread Daryl C. W. O'Shea
Jo Rhett wrote: Included below is a legitimate e-mail on a legitimate payment that I did make. I've looked at the rule, and I can't figure out why it failed. After unwrapping the mail included in your message body, I can't reproduce this under SA 3.1.8-r454679 using the ruleset

Re: false positive on citibank e-mail

2006-10-16 Thread Daryl C. W. O'Shea
Jo Rhett wrote: Daryl C. W. O'Shea wrote: Jo Rhett wrote: Included below is a legitimate e-mail on a legitimate payment that I did make. I've looked at the rule, and I can't figure out why it failed. After unwrapping the mail included in your message body, I can't reproduce this under SA

Re: false positive on citibank e-mail

2006-10-16 Thread Daryl C. W. O'Shea
Jo Rhett wrote: Daryl C. W. O'Shea wrote: Is there any part of this rule that might be affected by using Amavisd or testing via Milter? (I do both) If whatever handled the message for scanning didn't fudge the Received: from bigfootinteractive.com header like it should

Re: improving the sa-update process

2006-10-16 Thread Daryl C. W. O'Shea
Jo Rhett wrote: Daryl C. W. O'Shea wrote: this case, it's just a coincidence that I happen to provide the SARE sa-update channel infrastructure too. Well Thank You for that. I love sa-update. Thank Theo, he's behind sa-update. I like it too, which is why I'm willing to support the SARE

Re: improving the sa-update process

2006-10-16 Thread Daryl C. W. O'Shea
Jo Rhett wrote: Daryl C. W. O'Shea wrote: I overlooked a couple ways that you could legitimately break a --lint between updates, nobody else caught it either, so sa-update was (the only thing) broken for some people in the SA 3.1.6 release. SA 3.1.7 reverted to the simpler --lint check

Re: improving the sa-update process

2006-10-16 Thread Daryl C. W. O'Shea
Jo Rhett wrote: Daryl C. W. O'Shea wrote: I've been having some issues with the restarts, and when that happens mail is down. I'd say that's an issue of it's own, regardless of what sa-update does. eh? eh... The socket issues experienced during restarts have nothing to do with sa

Re: ALL_TRUSTED creating a problem

2006-10-16 Thread Daryl C. W. O'Shea
Matt Kettler wrote: Jo Rhett wrote: The autodetection is totally broken actually, and needs to be fixed. I've added a comment to the Wiki to let people know about this. Erm, Jo.. I assume you're referring to this: --- ''Comment: auto detection appears to be broken in

Re: How to filter these spam messages

2006-10-16 Thread Daryl C. W. O'Shea
Gary V wrote: body GV_MAKE_K / how to (generate|make) 1\.5 - 3\.5k / score GV_MAKE_K 3.5 uri GEOCITIES /^http:\/\/(..|www)\.geocities\.com\/+.+/i describe GEOCITIES Geocities URL scoreGEOCITIES 3.5 FWIW, if you process large quantities of mail, scoring on just the Geocities URI

Re: Disable ALL_TRUSTED

2006-10-14 Thread Daryl C. W. O'Shea
Benny Pedersen wrote: On Sat, October 14, 2006 12:18, Suhas \(QualiSpace\) wrote: How to disable ALL_TRUSTED ? no local.cf: clear_internal_networks internal_networks 127.0.0.0/8 clear_trusted_networks trusted_networks 127.0.0.0/8 trusted_networks ip-of-your-mx-host This is incorrect.

Re: exclude a client from internal_networks

2006-10-13 Thread Daryl C. W. O'Shea
Gary V wrote: I failed to find an example where a client or clients can be excluded from a network that is configured in internal_networks. Some stupid NAT boxes proxy the mail so it appears to come from that host. I would like to include the internal network in internal_networks, but exclude

Re: spamd would not start after sa-update

2006-10-12 Thread Daryl C. W. O'Shea
Frank Bures wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I am running sa-update once a day as a part of my daily housekeeping script. Today, first time since I've been using spamassassin, the spamd would not restart and the spam started pouring in. Error message: Starting spamd:

Re: no network tests

2006-10-10 Thread Daryl C. W. O'Shea
Toll, Eric wrote: hello list: I just set up a box who is: FreeBSD 6.1 Perl 5.8.7 Spamassassin 3.1.6 and when I: spamassassin -D --lint, I get the following: [67350] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC [67350] dbg: plugin: registered

Re: Any comments of the SpamHaus lawsuit?

2006-10-10 Thread Daryl C. W. O'Shea
Jason Haar wrote: I've been waiting for anyone else to bring it up - but no-one has. If Spamhaus lose this lawsuit (which they are ignoring as they are UK-based and this is some judge in Chicago), they may very well lose their .ORG domain - which would have a rather large impact on our Antispam

Re: Spamd: forkscaling issue?

2006-10-09 Thread Daryl C. W. O'Shea
Larry Rosenman wrote: 3.1.6 on FreeBSD: Oct 9 12:54:42 lists spamd[46015]: prefork: ordered child to accept, but child reported state '1' at /usr/local/lib/perl5/site_perl/5.8.8/Mail/SpamAssassin/SpamdForkScalin g.pm line 450. Any ideas on what this means? Previous prefork status: Oct 9

Re: spf: no suitable relay for spf use found

2006-10-08 Thread Daryl C. W. O'Shea
Email Lists wrote this to me instead of the list: - - This is normal behaviour when running --lint. - - Daryl Side note, when running spamassassin -D --lint How do we get that to log to a file in a bash shell. Everything I have tried so far has failed. Angle brackets? spamassassin -D

Re: Re: Hi spam

2006-10-08 Thread Daryl C. W. O'Shea
Kenneth Porter wrote: I noticed today an unusually high incidence of spam subject lines of Re: Hi, and I don't see a rule for this in the distribution. Do others see this much in legitimate mail? Or could it make a good rule? I see enough legit mail with such a subject go through my systems

Re: How to monitor spamd works well or not?

2006-10-08 Thread Daryl C. W. O'Shea
Monty Ree wrote: Hello.. I have operated sendmail + procmail + SA at linux. and sometimes, it seems that SA doesn't work well. At that times, I can see so lots of procmail processes. But after spamd restart, SA works well... So is there any script or tool to monitor spamd works well or

Re: How to monitor spamd works well or not?

2006-10-08 Thread Daryl C. W. O'Shea
Daryl C. W. O'Shea wrote: Monty Ree wrote: Hello.. I have operated sendmail + procmail + SA at linux. and sometimes, it seems that SA doesn't work well. At that times, I can see so lots of procmail processes. But after spamd restart, SA works well... So is there any script or tool

Re: spf: no suitable relay for spf use found

2006-10-07 Thread Daryl C. W. O'Shea
Tomasz Chmielewski wrote: When I test spamassassin setup by running spamassassin -D --lint, I get these complaints about spf: [6100] dbg: spf: no suitable relay for spf use found, skipping SPF-helo check [6100] dbg: spf: no suitable relay for spf use found, skipping SPF check [6100] dbg:

ANNOUNCE: Apache SpamAssassin 3.1.6 available!

2006-10-05 Thread Daryl C. W. O'Shea
Apache SpamAssassin 3.1.6 is now available! This is a maintenance release of the 3.1.x branch. Downloads are available from: http://spamassassin.apache.org/downloads.cgi?update=200610050918 The release file will also be available via CPAN in the near future. md5sum of archive files:

Re: 3.1.6, local scores, and sa-update

2006-10-05 Thread Daryl C. W. O'Shea
Mike Grau wrote: Since upgrading to SpamAssassin 3.1.6, running sa-update yields # sa-update config: warning: score set for non-existent rule BAYES_50 config: warning: score set for non-existent rule BAYES_05 ... error: lint check of current site config failed, cannot continue. I assume

Re: 3.1.6, local scores, and sa-update

2006-10-05 Thread Daryl C. W. O'Shea
Stuart Johnston wrote: Could you just add appropriate ifplugin lines for a more permanent fix? Unfortunately, no. Everything in the local site config dir is loaded, including the pre files. The default rules aren't loaded though... a poor attempt at not bothering to lint rules that are

Re: 3.1.6, local scores, and sa-update

2006-10-05 Thread Daryl C. W. O'Shea
Daryl C. W. O'Shea wrote: For now you'll have to disable the score lines while you do sa-update. Temporarily renaming whatever.cf to whatever.cf-disabled is probably the easiest way to go about it. BTW, you could also delete or comment out the exit 2; around line 375 of sa-update. Daryl

Re: pyzor timeout

2006-10-03 Thread Daryl C. W. O'Shea
Fletcher Mattox wrote: Hi, How does one decrease the default Pyzor timeout of five seconds? (without editing the source code :) ) The Pyzor SpamAssassin plugin documentation seems to mention a pyzor_timeout option. Daryl

Re: Email to SMS Gateways and Spam

2006-09-29 Thread Daryl C. W. O'Shea
[EMAIL PROTECTED] wrote: Recently I've discovered that if I attempt to forge the From: header in an email message that it ends up being considerably delayed when sent thru my providers Email to SMS Gateway. I strongly suspect they have in place measures to identify SPAM that will cause the

Re: [OT] Re: Fw: failure notice / spaassassin.apache.org

2006-09-29 Thread Daryl C. W. O'Shea
Theo Van Dinter wrote: On Fri, Sep 29, 2006 at 07:59:13PM +0200, Andreas Pettersson wrote: Then why aren't they using one to block their own customers from spamming the rest of the world? While you can sell we block spam from your inbox to people as a reason to pay you money, you can't sell

Re: Q. about spam directed towards highest MX Record?

2006-09-27 Thread Daryl C. W. O'Shea
Rob McEwen wrote: (CCing Marc Perkel because I seem to recall him knowing about this) Not that I'd ever outright block based on this one factor alone, but... Does anyone have any stats about what percentage of spam is directed towards the highest MX Record? (that is, where there is more than

Re: [qmailtoaster] duplicate emails

2006-09-26 Thread Daryl C. W. O'Shea
Steve Ingraham wrote: If anyone has a simple way of updating rules for spamassassin I would welcome your input. I still need to update the rules as I have been getting a great number of emails coming through to users. Specifically, we are getting a lot of the pharmaceutical spam and the

Re: Problem with user_white_list

2006-09-20 Thread Daryl C. W. O'Shea
On 9/20/2006 8:00 PM, Salatiel Filho wrote: I'm having troubles with spamassassin , Here it is the spam header: Return-Path: [EMAIL PROTECTED] Probably USER_IN_WHITELIST is adding -100 to the total sum. But i have no idea why. There's no griffield.biz http://griffield.biz on my

Re: POPAuth plugin

2006-09-20 Thread Daryl C. W. O'Shea
On 9/21/2006 12:46 AM, Olivier Nicole wrote: Hi, I just found POPAuth plugin, it sound very nice and is exactelly what I was looking for. I'm looking for Rescue Me season 1 and 2 on DVD! :) http://www.amazon.com/o/registry/2UUNX1ZJ2Y6S4 My only question is, when running spamd, whis is the

Re: Need help with SA and Received headers...

2006-09-17 Thread Daryl C. W. O'Shea
thekillerbean wrote: jdow wrote: Trust in-mtaX.MYISP.com.au. {^_^} Thanks a ton. Now I know that I can simply type in the FQDN! No, you can't. Single IPs or IP ranges using CIDR notation only. I called my ISP and asked for the subnet range they use for their mail servers and that's

Re: Need help with SA and Received headers...

2006-09-17 Thread Daryl C. W. O'Shea
Daryl C. W. O'Shea wrote: thekillerbean wrote: Now I know that I can simply type in the FQDN! No, you can't. Single IPs or IP ranges using CIDR notation only. Oh yeah, you can use one, two, or three parts of a dot quad, with a trailing dot, for /8, /16, or /24s too, but IP ranges

<    1   2   3   4   5   6   7   8   9   10   >