Re: Strange problem

2006-07-09 Thread Daryl C. W. O'Shea
Rick Macdougall wrote: Hi, I'm having a strange problem on one of my spamd servers since upgrading to 3.1.3. What version were you running previously on this host? Upgrade, or wipe and clean install? After awhile under heavy load, children are not exiting, ie the log show BBBIII, and

Re: .doc only spam

2006-07-09 Thread Daryl C. W. O'Shea
jdow wrote: I can see that the .gif only spam filters need to be broadened out to handle .doc and probably proactively a bunch of other extensions. Please don't tell me that Outlook Express renders .doc files.

Re: false positive with dialup to gmx, problem with HELO_DYNAMIC?

2006-07-05 Thread Daryl C. W. O'Shea
Raimar Sandner wrote: Hi! SpamAssassin version 3.1.3 is reporting a false positive if the sender (gmx address) has a dialup connection and the recepiant (also gmx address) uses fetchmail to pull the message from pop.gmx.net (see example below). The HELO_DYNAMIC rules apply because mail.gmx.net

Re: Bayes_seen is 320MB

2006-07-03 Thread Daryl C. W. O'Shea
Paul Boven wrote: Paul Boven wrote: Hi everyone, The message-ID's of mails that have been (auto-)learned by Bayes are stored indefinitely in bayes_seen. Which, over the years that we've used SpamAssassin now, has grown to a 320MB file. We're using site-wide Bayes databases. What would be

Re: Please remove all users from asf.osuosl.org

2006-07-02 Thread Daryl C. W. O'Shea
jdow wrote: They are sending spam bounce messages based on spamassassin testing this list. ===8--- This message was created automatically by mail delivery software. A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following

Re: internal/trusted again, MSA tested for SPF ?

2006-07-01 Thread Daryl C. W. O'Shea
On 6/30/2006 9:29 PM, Mark Martinec wrote: Daryl, You've told SA that your users aren't a part of your internal network though. If you configure SA to treat your users as part of your internal network then it won't do net tests on them. For clarity, I should have said RBL and SPF tests

Re: trusted_networks confusion--simple case (clarification)

2006-07-01 Thread Daryl C. W. O'Shea
On 6/30/2006 11:08 PM, Ross Boylan wrote: To clear up an ambiguity in my original: On Fri, 2006-06-30 at 19:19 -0700, Ross Boylan wrote: Does a machine that is not part of my domain qualify as a client? Suppose my MTA is contacted by a dial-up IP for somewhere.com (not my domain), and that I

Re: trusted_networks confusion--simple case

2006-07-01 Thread Daryl C. W. O'Shea
On 6/30/2006 10:19 PM, Ross Boylan wrote: On Fri, 2006-06-30 at 18:00 -0400, Daryl C. W. O'Shea wrote: Ross Boylan wrote: Well, I've obviously missed something. In this message I will focus exclusively on the question of whether a host that receives messages from dial-up hosts should go

Re: internal/trusted again, MSA tested for SPF ?

2006-06-30 Thread Daryl C. W. O'Shea
Radoslaw Zielinski wrote: Daryl C. W. O'Shea [EMAIL PROTECTED] [30-06-2006 00:45]: Mark Martinec wrote: Hmm, I don't think that our own MSA is supposed to be tested for SPF. It is normal? Yeah, and correct. Your MSA is the host responsible for sending the mail to your server running SA

Re: trusted_networks confusion

2006-06-30 Thread Daryl C. W. O'Shea
I'm going to skip to the end pretty quick... where I tell you exactly the config YOU need (except I don't know your IPs, so you'll have to fill that in). Ross Boylan wrote: Well, I've obviously missed something. In this message I will focus exclusively on the question of whether a host that

Re: Problem with false-positives for SASL users

2006-06-30 Thread Daryl C. W. O'Shea
martin f krafft wrote: also sprach martin f krafft [EMAIL PROTECTED] [2006.06.06.1401 +0200]: Regarding the issue I raised in February (to which I have not yet found an answer), you may be interested in checking out the last paragraph of http://blog.madduck.net/geek/2006.06.06-delayed-mail,

Re: Problem with false-positives for SASL users

2006-06-30 Thread Daryl C. W. O'Shea
martin f krafft wrote: also sprach Daryl C. W. O'Shea [EMAIL PROTECTED] [2006.06.06.2021 +0200]: If you provide a full set of received headers that are being passed to SA, someone can help you out with the correct settings. I am having difficulties recreating the problem. Sometimes SA

Re: internal/trusted again, MSA tested for SPF ?

2006-06-30 Thread Daryl C. W. O'Shea
Bart Schaefer wrote: On 6/30/06, Daryl C. W. O'Shea [EMAIL PROTECTED] wrote: OK, I see now that you want to unconditionally trust the MSA *and* all hosts after it. Which is reasonable if the MSA is just an MSA. For whatever reason you don't want to rely on auth tokens, etc. Seems reasonable

Re: trusted_networks confusion

2006-06-30 Thread Daryl C. W. O'Shea
jdow wrote: From: Daryl C. W. O'Shea [EMAIL PROTECTED] jdow wrote: From: Daryl C. W. O'Shea [EMAIL PROTECTED] jdow wrote: From: Daryl C. W. O'Shea [EMAIL PROTECTED] The Earthlink mail servers are ABSODAMNLUTELY not part of my internal network. But if I do not list them with trusted

Re: Problem with false-positives for SASL users

2006-06-30 Thread Daryl C. W. O'Shea
Jamie L. Penman-Smithson wrote: It's better to look at the 'Authenticated sender': Received: from bar.example.org (bar.example.org [127.0.0.1]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) (Authenticated sender:

Re: Problem with false-positives for SASL users

2006-06-30 Thread Daryl C. W. O'Shea
Mark Martinec wrote: What do you have to do to get that Authenticated sender: line? It's not unpatched Postfix, is it? I know the Wietse was against such info being provided. Apparently postfix 2.3 will support auth tokens. Any link document that? I'd like to add it to the wiki.

Re: trusted_networks confusion

2006-06-29 Thread Daryl C. W. O'Shea
Ross Boylan wrote: On Wed, Jun 28, 2006 at 01:45:52AM -0400, Daryl C. W. O'Shea wrote: Ross Boylan wrote: For 99% of systems there's no need to worry about listing systems that aren't a part of your mail network in your trusted_networks (and never list them in your internal_networks). Keep

Re: spamc -d option problem

2006-06-29 Thread Daryl C. W. O'Shea
jdow wrote: From: Marc Perkel [EMAIL PROTECTED] Thanks Loren. I have an account but the links from the main web site don't take me to SA's bugzilla. it takes me to an appache bugzilla page and SA is not on that list. The redirector to the new URL wasn't working the other day for a bit.

Re: trusted_networks confusion

2006-06-29 Thread Daryl C. W. O'Shea
Bart Schaefer wrote: On 6/29/06, Daryl C. W. O'Shea [EMAIL PROTECTED] wrote: EVERYTHING after an MX MUST be listed as BOTH trusted and internal networks. Under what circumstances would one list something as internal but not trusted? NEVER. Newer versions of SA won't even allow you

Re: trusted_networks confusion

2006-06-29 Thread Daryl C. W. O'Shea
Bart Schaefer wrote: On 6/29/06, Daryl C. W. O'Shea [EMAIL PROTECTED] wrote: Bart Schaefer wrote: Under what circumstances would one list something as internal but not trusted? NEVER. Newer versions of SA won't even allow you to make that misconfiguration. Ah, good. That's as I expected

Re: trusted_networks confusion

2006-06-29 Thread Daryl C. W. O'Shea
jdow wrote: From: Bart Schaefer [EMAIL PROTECTED] On 6/29/06, Daryl C. W. O'Shea [EMAIL PROTECTED] wrote: EVERYTHING after an MX MUST be listed as BOTH trusted and internal networks. Under what circumstances would one list something as internal but not trusted? One example is when you

Re: trusted_networks confusion

2006-06-29 Thread Daryl C. W. O'Shea
jdow wrote: From: Daryl C. W. O'Shea [EMAIL PROTECTED] Bart Schaefer wrote: On 6/29/06, Daryl C. W. O'Shea [EMAIL PROTECTED] wrote: EVERYTHING after an MX MUST be listed as BOTH trusted and internal networks. Under what circumstances would one list something as internal but not trusted

Re: trusted_networks confusion

2006-06-29 Thread Daryl C. W. O'Shea
jdow wrote: From: Daryl C. W. O'Shea [EMAIL PROTECTED] jdow wrote: From: Bart Schaefer [EMAIL PROTECTED] On 6/29/06, Daryl C. W. O'Shea [EMAIL PROTECTED] wrote: EVERYTHING after an MX MUST be listed as BOTH trusted and internal networks. Under what circumstances would one list something

Re: Dev list on an RBL

2006-06-27 Thread Daryl C. W. O'Shea
Chris Santerre wrote: dev@spamassassin.apache.org mailing list Blockedby cbl.abuseat.org Oh noes! :) Both the users@ and dev@ lists use the same servers, so I don't see how you'd have one listed and not the other. Any particular IP that you see listed? Daryl

Re: trusted_networks confusion

2006-06-27 Thread Daryl C. W. O'Shea
Nothing trimmed in an attempt to keep things somewhat coherent... Ross Boylan wrote: Thank you for your very clear answers. I have a few follow-up questions below. On Fri, 2006-06-23 at 23:44 -0400, Daryl C. W. O'Shea wrote: On 6/21/2006 4:39 PM, Ross Boylan wrote: After reading the Mail

Re: Two Errors With Spamassassin - Please Help

2006-06-23 Thread Daryl C. W. O'Shea
On 6/22/2006 12:18 PM, James Hindley wrote: Here following is the error being returned when i run: spamassassin -D --lint [EMAIL PROTECTED] root]# spamassassin -D --lint Global symbol %opt requires explicit package name at /usr/bin/spamassassin line 117. Unmatched right curly bracket at

Re: Trouble with UNwhitelist_from_rcvd

2006-06-23 Thread Daryl C. W. O'Shea
On 6/23/2006 10:24 PM, Bart Schaefer wrote: The short of it is that I can't get unwhitelist_from_rcvd to unwhitelist anything. whitelist_from_rcvd [EMAIL PROTECTED] brasslantern.com unwhitelist_from_rcvd [EMAIL PROTECTED] brasslantern.com but this does not change anything. In fact I've

Re: trusted_networks confusion

2006-06-23 Thread Daryl C. W. O'Shea
On 6/21/2006 4:39 PM, Ross Boylan wrote: After reading the Mail::SpamAssassin::Conf (spamassassin 3.1.3-1 on Debian) I was unclear about trusted vs internal networks. After reviewing previous emails on this list, here's what I think it is: trusted_networks for hosts I trust to put good info in

Re: Domainkeys - Conflicting msg headers?

2006-06-13 Thread Daryl C. W. O'Shea
On 6/12/2006 8:58 AM, Magnus Holmgren wrote: On Monday 23 January 2006 15:50, Matt Kettler took the opportunity to write: Glen Carreras wrote: * 0.0 DK_SIGNED Domain Keys: message has an unverified signature * -0.0 DK_VERIFIED Domain Keys: signature passes verification From looking at the

Re: SA tags above header info

2006-06-13 Thread Daryl C. W. O'Shea
Magnus Holmgren wrote: One remark I haven't seen yet is that the DomainKey-Signature: field can include an h tag, which specifies which header fields are included in the signature. If that tag is included (and I think it usually is(?)) and there aren't already any X-Spam-* fields that have

Re: Windows Questions

2006-06-11 Thread Daryl C. W. O'Shea
Mike L wrote: I have SpamAssassin install with Perl 5.8.8 on a W2K3 box. SA is the latest version. I would like to setup the following I need to know how to setup wrongmx.pm http://wrongmx.pm and wrongmx.cf http://wrongmx.cf so that email that does not go to my spam filter first will be

Re: Windows Questions

2006-06-11 Thread Daryl C. W. O'Shea
Not really. I have no idea how you've got your SA setup on Windows and you haven't asked anything specific. Daryl On 6/11/2006 1:57 PM, Mike L wrote: Thanks Daryl, but can you give me a little more info? On 6/11/06, *Daryl C. W. O'Shea* [EMAIL PROTECTED] mailto:[EMAIL PROTECTED

Re: Windows Questions

2006-06-11 Thread Daryl C. W. O'Shea
never go to the 50 record(directly to the box) I would like to know if I need to modify local.cf http://local.cf or if i just place this in the same local as local.cf http://local.cf does it automatically work? Is this a beter email? On 6/11/06, *Daryl C. W. O'Shea* [EMAIL PROTECTED] mailto

Re: Labeling Bug?

2006-06-10 Thread Daryl C. W. O'Shea
On 6/10/2006 8:07 PM, David Goldsmith wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 A message with this set of SA headers just made it through to my mailbox. X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.3 (2006-06-01) on iceman12.giac.net X-Spam-Level: **

Re: Mail somehow bypassing spamassassin entirely showing up in my Inbox

2006-06-09 Thread Daryl C. W. O'Shea
Arias Hung wrote: On Thu, 08 Jun 2006, Daryl C. W. O'Shea delivered in simple text monotype: As for the copy_config timeouts... what kind of system load are you seeing. 10, 50, 500, or higher? The current 20 seconds alarm is twice the original alarm timeout, but if you've got a high

Re: is there a way to block email coming from

2006-06-08 Thread Daryl C. W. O'Shea
Kai Schaetzl wrote: Daryl C. W. O'Shea wrote on Thu, 08 Jun 2006 01:18:11 -0400: Some even with T1s (probably quietly provisioned over DSL) that have IPs smack in the middle of static business DSL ranges that are listed in SORBS' dynamic list. Nevertheless, it's their ISP's fault

Re: is there a way to block email coming from

2006-06-08 Thread Daryl C. W. O'Shea
Kai Schaetzl wrote: Daryl C. W. O'Shea wrote on Thu, 08 Jun 2006 11:46:48 -0400: Still, when your ISP isn't responsive As Chris says you better move away from them then if you can. If you can't I'd really bother them day and night since I don't get what I paid for. My Over the years

Re: SA 3.1.1 sometimes takes a long time...

2006-06-07 Thread Daryl C. W. O'Shea
On 6/7/2006 9:58 PM, Matt Kettler wrote: Guy Waugh wrote: * I only turned on SA debugging for bayes and learn to get the above log entries. Are bayes, learn and dns the only debugging flags available? Maybe next time I should turn on dns debugging as well? I know of at least one other...

Re: Mail somehow bypassing spamassassin entirely showing up in my Inbox

2006-06-07 Thread Daryl C. W. O'Shea
On 6/7/2006 8:09 PM, Arias Hung wrote: On Tue, 06 Jun 2006, Daryl C. W. O'Shea delivered in simple text monotype: How long are messages (that are logged) taking to be scanned by SpamAssassin when/before this happens. What timeout are you using with spamc? You are using spamc, right

Re: Mail somehow bypassing spamassassin entirely showing up in my Inbox

2006-06-07 Thread Daryl C. W. O'Shea
On 6/7/2006 8:51 PM, Arias Hung wrote: On Mon, 05 Jun 2006, Daryl C. W. O'Shea delivered in simple text monotype: Daryl ---snip--- Ah, and one more quick question while I'm at it. What would you suggest would be the best way to increase the alarm timeout value? Straight in the spamd

Re: is there a way to block email coming from

2006-06-07 Thread Daryl C. W. O'Shea
On 6/8/2006 12:05 AM, Greg Allen wrote: However, the ISP dynamic address tests *do* belong in the MTA RBL checks. The fraction of legitimate emails received from dynamic-IP hosts is vanishingly small compared to the tens or hundreds of thousands of compromised Windows boxen spewing spam and

Re: blocking email from Vietname is not working...

2006-06-07 Thread Daryl C. W. O'Shea
On 6/8/2006 12:03 AM, John D. Hardin wrote: On Wed, 7 Jun 2006, Screaming Eagle wrote: (1) countries.nerd.dk may not list vietnam. Take a look at their website. (2) The IP address may have been assigned to vietnam recently enough that countries.nerd.dk doesn't have it (i.e. they are not

Re: Problem with false-positives for SASL users

2006-06-06 Thread Daryl C. W. O'Shea
martin f krafft wrote: also sprach martin f krafft [EMAIL PROTECTED] [2006.06.06.1401 +0200]: Regarding the issue I raised in February (to which I have not yet found an answer) I am sorry (again), I only just saw

Re: Problem with false-positives for SASL users

2006-06-06 Thread Daryl C. W. O'Shea
martin f krafft wrote: also sprach Daryl C. W. O'Shea [EMAIL PROTECTED] [2006.06.06.1848 +0200]: Really? That makes no sense to me. I don't see anything in your example header that we use as auth tokens. Actually, I don't see any auth tokens. What's to stop someone from connecting with SSL

Re: Mail somehow bypassing spamassassin entirely showing up in my Inbox

2006-06-06 Thread Daryl C. W. O'Shea
Arias Hung wrote: Thanks for your reply. I actually limit my maxchildren to 4 due to the intensive memory hogging nature of the beast. At present I'm using a recent spamassassin compiled from the svn version 3.2.0-r386260. My spamassasin logs have absolutely no trace of the spam that gets

Re: Received header not parsed

2006-06-05 Thread Daryl C. W. O'Shea
Ben Wylie wrote: Received: (from localhost [24.180.47.240]) by server. (NAVGW 2.5.2.12) with SMTP id M2006060503484615455 for [EMAIL PROTECTED]; Mon, 05 Jun 2006 03:48:47 +0100 OK, we specifically skip received headers that start with ( at line 387 of Received.pm. Annoyingly, we don't

Re: Received header not parsed

2006-06-05 Thread Daryl C. W. O'Shea
Ben Wylie wrote: If you had the time to write a patch for this I would be very grateful, and let me know what I would need to do to apply the patch, and if I would need to make changes every time I upgraded. http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4943 Daryl

Re: Mail somehow bypassing spamassassin entirely showing up in my Inbox

2006-06-05 Thread Daryl C. W. O'Shea
On 6/5/2006 7:41 PM, Arias Hung wrote: I've been having the issue lately of at least a few mails a day somehow bypassing spamassassin via procmail entirely and showing up in my inbox. Sometimes its more like a flood which forces me to inevitably to forward my entire inbox through procmail

Re: Received header not parsed

2006-06-04 Thread Daryl C. W. O'Shea
On 6/4/2006 9:54 PM, Ben Wylie wrote: I have had a problem with a particular form of received header not being parsed correctly because it is malformed. I had a brief conversation on this list about a year ago with a glimmer of hope that in future versions this would be overcome. However a year

Re: Received header not parsed

2006-06-04 Thread Daryl C. W. O'Shea
On 6/4/2006 11:28 PM, Ben Wylie wrote: Received: from [127.0.0.1] by arkbb.co.uk with SMTP (HELO server.) (ArGoSoft Mail Server Pro for WinNT/2000/XP, Version 1.8 (1.8.8.2)); Mon, 5 Jun 2006 03:48:52 +0100 Received: (from localhost [24.180.47.240]) by server. (NAVGW 2.5.2.12) with SMTP id

Re: Hiring for Spam Assassin Troubleshooting

2006-06-03 Thread Daryl C. W. O'Shea
On 6/2/2006 11:44 PM, spectacularstuff wrote: We already have SA setup and working with Smartermail. We would like to hire someone that is familiar with SpamAssassin and a Windows 2003 server system in order to come set this thing up so that our own emails are not being detected as SPAM. Is

Re: Razor2 Error

2006-05-30 Thread Daryl C. W. O'Shea
RAZOR2_CF_RANGE_00_01 0.01 score RAZOR2_CF_RANGE_02_10 0.10 score RAZOR2_CF_RANGE_11_50 0.50 score RAZOR2_CF_RANGE_51_100 0.00 score RAZOR2_CF_RANGE_51_90 3.70 score RAZOR2_CF_RANGE_91_100 7.50 -Original Message- From: Daryl C. W. O'Shea [mailto:[EMAIL PROTECTED] Sent: Monday, May 29, 2006

Re: Razor2 Error

2006-05-29 Thread Daryl C. W. O'Shea
Jim Hermann - UUN Hostmaster wrote: I found my problem. I had some custom definitions that used eval:check_razor2_range. I deleted the custom definitions and the error went away. What were the custom rules you had that caused that error? It's likely that we could add/improve validation of

Re: .spamassassin

2006-05-29 Thread Daryl C. W. O'Shea
On 5/29/2006 5:20 PM, George Georgalis wrote: Looking at this block from above SpamAssassin.pm line 1469, it's not clear to me how to avoid the warning/errors listed below. note: I'm doing active (in smtp) filtering, and I do not want to create a .spamassassin directory. You don't say how,

Re: lint failure with 3.1.2

2006-05-27 Thread Daryl C. W. O'Shea
Chris wrote: On Saturday 27 May 2006 12:21 pm, Daryl C. W. O'Shea wrote: [9324] warn: trusted_networks doesn't contain internal_networks entry '192.168/16' [9324] warn: lint: 7 issues detected, please rerun with debug enabled for more information Here is my local.cf entry for trusted_networks

Re: lint failure with 3.1.2

2006-05-27 Thread Daryl C. W. O'Shea
Chris wrote: On Saturday 27 May 2006 4:33 pm, you wrote: Any why did --lint work fine every time in 3.1.0? Commenting out the internal_networks entry and restarting SA, --lint shows no errorrs now, why? We're continuously improving the config parser's ability to detect configuration *logic*

Re: lint failure with 3.1.2

2006-05-27 Thread Daryl C. W. O'Shea
On 5/27/2006 11:44 PM, Loren Wilton wrote: From: Daryl C. W. O'Shea [EMAIL PROTECTED] [9324] warn: config: SpamAssassin failed to parse line, MY_LRGROD .85 is not valid for score, skipping: score MY_LRGROD .85 I thought this was required in 3.1.0 (but not 3.0.x) too, but anyway, all

Re: spamd ignoring add_header

2006-05-25 Thread Daryl C. W. O'Shea
On 5/24/2006 5:46 AM, Rainer Sokoll wrote: Hi all, in my local.cf, I have (among others): add_header all Contact Rainer Sokoll If I pipe a mail through spamassassin, a header X-Spam-Contact: is added, as expected. But spamd does not. spamd is called with these options: -d -u vscan

Re: Help with rule for geocities spam

2006-05-23 Thread Daryl C. W. O'Shea
On 5/23/2006 2:51 AM, Benny Pedersen wrote: http://wiki.apache.org/spamassassin/WebRedirectPlugin there is a slight config error on the page [WWW] http://people.apache.org/~dos/sa-plugins/3.1/WebRedirect.cf [WWW] http://people.apache.org/~dos/sa-plugins/3.1/WebRedirect.pm in the cf file the

Re: Custom SA Filters

2006-05-23 Thread Daryl C. W. O'Shea
On 5/23/2006 9:42 PM, Chan, Wilson wrote: Anyone know of any good custom SA filters? Im already using SARE with Rules dejour. Are there any other good custom filters online? Thanks! Are you looking to catch a particular type of spam? Most people with an up-to-date SpamAssassin version and a

Re: Vouching for mail from a dynamic IP

2006-05-22 Thread Daryl C. W. O'Shea
On 5/22/2006 12:16 PM, Kenneth Porter wrote: --On Saturday, May 20, 2006 4:54 PM -0700 jdow [EMAIL PROTECTED] wrote: Looking at your own email it comes from a COMCAST cable connection in Palmer Ranch Florida through the WFGB mailer. The WFGB mailer is not in SORBS anywhere. YOUR address most

Re: out of memory when receiving larger mails

2006-05-22 Thread Daryl C. W. O'Shea
On 5/22/2006 8:09 PM, nxxs wrote: The only problem is that I cannot receive mails above a certain size (usually mails with attachments). They simply dont get delivered. I can read the following error message in my syslog: qmail: 1148341842.937112 starting delivery 79: msg 61161737 to local

Re: Help with rule for geocities spam

2006-05-22 Thread Daryl C. W. O'Shea
On 5/22/2006 6:14 PM, Kenneth Porter wrote: As it turns out, I had a SARE rule installed that should catch these, but I found some spams leaking through due to the insecure dependency bug (bug 3838), even though I'm running Perl 5.8.3. I'm applying Daryl C. W. O'Shea's patch for that bug.

Re: Spam Assassin Detecting our emails as spam

2006-05-20 Thread Daryl C. W. O'Shea
On 5/20/2006 11:44 PM, WFGB Team wrote: [My Replies] A) Since I am unsure what MSA is I did some checking up. How do I know if I am set up for MSA? I am using Smartermail. I am equally unsure of what MTA is. I know what the MX Records are sort of. Looking at the headers of the email you

Re: Spam Assassin Detecting our emails as spam

2006-05-20 Thread Daryl C. W. O'Shea
On 5/21/2006 12:30 AM, spectacularstuff wrote: Hi Daryl, I put the trusted networks in and that seem to get rid of a few things but now it brought out 4 or 5 others... lol I understand what the following is. I just don't know how to fix it. Do you know how to fix this issue? 3.2

Re: Spamd Children

2006-05-11 Thread Daryl C. W. O'Shea
The Help Guy wrote: hello all: You've been very helpful in the past, so let me say thank you to start. Im currently using SA 3.1.0 on Linux with procmail. I have a problem that is pretty much exactly described in this bug report: http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4410

Re: RCVD_IN_SORBS_DUL matches also First Hop. Why?

2006-05-11 Thread Daryl C. W. O'Shea
Christian Reiter wrote: Hi! I have a problem with my Spamassassin 3.1.1 installation here. I have Postfix as MTA and Amavids-new 2.3.3 The Rule RCVD_IN_SORBS_DUL matches also the first hop of the received Headers. If i understand correctly the first hop should not be matched as a user could

Re: The New SpamAssassin sa-update

2006-05-11 Thread Daryl C. W. O'Shea
On 5/10/2006 3:13 PM, David Baron wrote: 2. Fails after several time outs with: http: request failed: 500 read timeout: 500 read timeout error: no mirror data available for channel updates.spamassassin.org channel: MIRRORED.BY contents were missing, channel failed This can occur if you've got

Re: Nasty bug? in 3.1.1 headers inserting?

2006-05-09 Thread Daryl C. W. O'Shea
On 5/9/2006 2:16 PM, Theo Van Dinter wrote: There's some difference of opinion around this question, but my general opinion is that there should be an update to spamass-milter which properly handles the newlines either way. I'm not sure whether or not that's happened yet. As discussed in

Re: qmail auth mail received as spam

2006-05-02 Thread Daryl C. W. O'Shea
Jason Haar wrote: I guess a more generic question would be: how do sites handle calling SA for validated-but-remote local users? Qmail-Scanner defaults to *not* calling SA - is that what most others do too? If not, how do you handle the fact those users are (by definition) going to be on DUL

Re: Very Long Scan Times (3.1.1 on FreeBSD)

2006-04-19 Thread Daryl C. W. O'Shea
Richard Collyer wrote: I have done some dig requests using the hosts in the debug file and they are getting returned ok. Strange thing is that sometimes 18 or 38 pass, sometimes 25 of 38 pass there seems to be no pattern to them failing. There is a firewall running (nothing that would stop

Re: Very Long Scan Times (3.1.1 on FreeBSD)

2006-04-18 Thread Daryl C. W. O'Shea
Richard Collyer wrote: Hello, I am trying to track down why is is tracking so long for mails to be scanned via FreeBSD. I am scanning then using qmail-scanner (1.25). From what I can see the problem is coming from when e-mails are arriving from external sources. The top log entry shows

Re: Very Long Scan Times (3.1.1 on FreeBSD)

2006-04-18 Thread Daryl C. W. O'Shea
Richard Collyer wrote: Daryl C. W. O'Shea wrote: ... [31974] dbg: dns: name server: 192.168.1.1, family: 2, ipv6: 0 [31974] dbg: dns: testing resolver nameservers: 192.168.1.1 [31974] dbg: dns: trying (3) google.com... [31974] dbg: dns: looking up NS for 'google.com' [31974] dbg: dns: NS lookup

Re: Very Long Scan Times (3.1.1 on FreeBSD)

2006-04-18 Thread Daryl C. W. O'Shea
Richard Collyer wrote: I've changed it to a DNS server from my ISP, but so far its not making any difference. SA: finished scan in 13.719613 secs - hits=-1.0 BTW, if you watch the debug output of a message being scanned, you'll see exactly where it's slow. spamassassin -D

Re: How do you score your own domain(s)?

2006-04-18 Thread Daryl C. W. O'Shea
Julian Underwood wrote: Dear List, I was curious how organizations typically score mail which comes from their own domain(s). Obviously spammers will spoof the source domain in hopes that you have whitelisted your domain or give special treatment from mail originating from within your own org.

Re: X-Originating and X-Apparently-From

2006-04-18 Thread Daryl C. W. O'Shea
Andrew Doughety wrote: Hi, We are trying to perform DNSBL checks on incoming mail and we are not seeing any actual DNS queries. When looking at the code it seems that the information on which IP(s) to check is obtained from X-Originating and X-Apparently-From headers. Grepping through

Re: Very Long Scan Times (3.1.1 on FreeBSD)

2006-04-18 Thread Daryl C. W. O'Shea
Richard Collyer wrote: Daryl C. W. O'Shea wrote: Richard Collyer wrote: I've changed it to a DNS server from my ISP, but so far its not making any difference. SA: finished scan in 13.719613 secs - hits=-1.0 BTW, if you watch the debug output of a message being scanned, you'll see

Re: Getting spamassassin not to bother checking outgoing mail

2006-04-14 Thread Daryl C. W. O'Shea
Rob Tanner wrote: Hi, I installed spamassassin on my server a week ago and along with a number of Postfix settings, I'm nearly 100% spam free (I might get one spam a day now). But one thing I haven't figured out. I would like not to check mail originating in my address space. Is that a

Re: xxxl spam

2006-04-13 Thread Daryl C. W. O'Shea
Mark Martinec wrote: The most interesting part in my view is not the IP distance, but the type of OS, illustrated by the following table (derived from the same data as fig2): p0f OS guessham : spam - Windows-XP0.7 % : 99.3 % Windows-2000

Re: xxxl spam

2006-04-13 Thread Daryl C. W. O'Shea
Mark Martinec wrote: I guess Windows Server 2003 is reported as Windows 2000, but I don't know. Certainly a couple of very large sites are seen as Windows 2000. In the UNKNOWN category there must be a mix of Windows and Unix hosts, not sure what is unusual about them. Mark Hmm... FWIW:

Re: SpamAssassin BZ downtime

2006-04-13 Thread Daryl C. W. O'Shea
Justin Mason wrote: http://ajax.apache.org/%7ejefft/ : Bugzilla is moving to a new host, and is temporarily down while the database synchs. Apologies for the inconvenience. --j. Yay, it doesn't seem excruciatingly slow anymore.

Re: Proper use of user_prefs whitelist

2006-04-13 Thread Daryl C. W. O'Shea
Forrest Aldrich wrote: I've been having some difficulty with the user_prefs and the whitelist_* fucntions. I read the examples etc, and I believe these are correct, but clearly certain email is still being tagged (see below). I wonder if someone can help clarify what I'm doing wrong here.

Re: Internal email marked as spam...

2006-04-10 Thread Daryl C. W. O'Shea
Screaming Eagle wrote: All, Emailing with outlook and from internal network is marked as spam: pts rule name description -- -- -1.8 ALL_TRUSTEDPassed through trusted hosts only via SMTP 1.1

Re: Idea for new SA Rule

2006-04-05 Thread Daryl C. W. O'Shea
Gustafson, Tim wrote: 3) FPs on email sent by lazy/stupid folks that can't spell. (Translation: management material) I don't mind these getting blocked. In fact, I'd love it if every time someone sent me a very poorly written e-mail they got a bounce message back telling them to turn on the

Re: Idea for new SA Rule

2006-04-05 Thread Daryl C. W. O'Shea
Philip Prindeville wrote: litre, and if I'm feeling really silly, aluminium (I hate that word). Aluminium rocks! Especially aluminium foil and aluminium airplanes.

Re: Ok, I'm stumped...

2006-04-05 Thread Daryl C. W. O'Shea
Matt Kettler wrote: Philip Prindeville wrote: What gives you that idea? The debug output clearly shows the received headers being parsed, the mime parser finds the message part (malformed content-type and all), URIs are parsed out of the message, etc. Well, for a start, normally the

Re: running SA on multiple machines

2006-04-04 Thread Daryl C. W. O'Shea
Dave Stern wrote: As to the format spamc -d 1.2.3.4,10 2.3.4.5,10 That was from a google search. I believe that allows you to specify timeouts per host rather than a more universal -t. I'm not aware of that being valid. In any case, anything beyond a single host would either not fail to

Re: Stopping recent stock pumping spam

2006-04-04 Thread Daryl C. W. O'Shea
[EMAIL PROTECTED] wrote: Tristan Miller wrote: debug: is DNS available? 0 What is the output of $ cat /etc/resolv.conf ? It's likely that spamd is being called with -L. If on a RedHat/Fedora system, it'll be set in /etc/sysconfig/spamassassin.

Re: Spamd keeps getting hung up!

2006-04-01 Thread Daryl C. W. O'Shea
Dan Mahoney, System Admin wrote: On Fri, 31 Mar 2006, Daryl C. W. O'Shea wrote: Dan Mahoney, System Admin wrote: Mar 30 21:52:14 quark spamd[45835]: __alarm__ Mar 30 21:52:14 quark spamd[45835]: __alarm__ Mar 30 21:52:14 quark spamd[45835]: spamd: copy_config timeout (with empty

Re: Spamd keeps getting hung up!

2006-03-31 Thread Daryl C. W. O'Shea
(copying Justin since this has to do with pre-forking) Dan Mahoney, System Admin wrote: On Fri, 10 Mar 2006, Daryl C. W. O'Shea wrote: On 3/10/2006 11:22 AM, Dan Mahoney, System Admin wrote: Okay, I'm still getting these issues. I've corrected every other issue that's plagued us

Re: Fast update for rules

2006-03-31 Thread Daryl C. W. O'Shea
Michele Neylon:: Blacknight.ie wrote: Theo Van Dinter wrote: On Fri, Mar 31, 2006 at 07:36:18PM +0100, Michele Neylon:: Blacknight.ie wrote: Which ports and protocols does this use for the connections in and out? It does a few DNS queries, and grabs files via HTTP. I'm getting the

Re: Spamd keeps getting hung up!

2006-03-31 Thread Daryl C. W. O'Shea
Dan Mahoney, System Admin wrote: On Fri, 31 Mar 2006, Daryl C. W. O'Shea wrote: I think it's actually load related... spamd is timing out the copy_config sooner than it's really taking under high load. If you were to change the alarm value from 10 to 100 or so, around spamd line 949

Re: 3.1.1 Upgrade Problems [solved]

2006-03-28 Thread Daryl C. W. O'Shea
Dale Blount wrote: On Fri, Mar 17, 2006 at 08:18:35PM -0800, Dan Kohn wrote: Anything else to try? Nothing comes to mind. It looks like a bug in IO::Zlib or perl on your platform. Anyone else on FreeBSD having simliar problems? I'm having this problem on Arch Linux with IO::Zlib 1.0.4.

Re: Trusted or internal networks not recognized

2006-03-28 Thread Daryl C. W. O'Shea
Stephan Menzel wrote: Hi there, I'm currently about to customize a local (gentoo~) 3.1 installation to our specific needs. One of the first steps there was a special regex to catch our very own Received: headers To check if this works I modified some other SA code parts and enabled debug

Re: rulesdujour, lint, and whitelist_spf

2006-03-24 Thread Daryl C. W. O'Shea
Michael Monnerie wrote: Anybody else got this problem? Lots of warnings suddenly. mfg zmi [31721] warn: config: failed to parse line, skipping: whitelist_from_spf[EMAIL PROTECTED] [31721] warn: config: failed to parse line, skipping: whitelist_from_spf Is the SPF plugin enabled?

Re: rulesdujour, lint, and whitelist_spf

2006-03-24 Thread Daryl C. W. O'Shea
Michael Monnerie wrote: On Freitag, 24. März 2006 09:01 Daryl C. W. O'Shea wrote: Is the SPF plugin enabled? The syntax looks fine, but it can't be parsed if the plugin isn't loaded. ARghl. I should not work late night... Thanks. As I use SPF on MTA level, I wanted to disable SPF. So I have

Re: trusted networks help

2006-03-24 Thread Daryl C. W. O'Shea
Jim Maul wrote: Bowie Bailey wrote: My question is, with this setup, what trusted_networks should i have defined? You should define all of the IP addresses of your mailserver. trusted_networks 192.168.128.4 trusted_networks 69.27.243.222 I see that 167.206.112.76 (mx1.lightpath.net) also

Re: trusted networks help

2006-03-24 Thread Daryl C. W. O'Shea
[EMAIL PROTECTED] wrote: Daryl C. W. O'Shea wrote: You might as well through in trusted_networks 127.0.0.1 ... that's not hardcoded? When automatically set, yes. When you manually define your trusted/internal networks, no -- you really get to define them.

Re: INVALID_DATE

2006-03-23 Thread Daryl C. W. O'Shea
David Lee wrote: If, conversely, it is not in breach, then SA has a problem: it shouldn't be marking it INVALID_DATE. Incidentally, it is this aspect (rather than any other) of the date that is triggering this SA rule, isn't it? I guess we could fix it by renaming the rule

Re: SPF and Domain Keys

2006-03-23 Thread Daryl C. W. O'Shea
Jeferson Pessoa Santana wrote: Does anyone have the link of this Domain Keys patch for the version 3.1.0? Doing a Google Search I found some information about this patch but any file or text to create the file. http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4623 Note that it is only

<    3   4   5   6   7   8   9   10   11   >