Re: [AMaViS-user] Brand-new viruses, banned content and spamassassin

2007-01-31 Thread Henrik Krohns
On Wed, Jan 31, 2007 at 10:38:35PM +0100, Mark Martinec wrote: It looks like what you are looking for is for a CC_BANNED to have a lower priority than CC_SPAM. The ranking of contents categories is currently hard-wired and not configurable. It could be dangerous to place CC_BANNED below

Re: [AMaViS-user] maRBL on Debian

2007-01-07 Thread Henrik Krohns
On Sun, Jan 07, 2007 at 07:28:00PM +1100, grant maxwell wrote: I wrote: What's the use for that? It would either greylist everything or just greylist instead of directly rejecting. I made the patch: http://hege.li/policyd-weight/greylist-p0f.diff Henrik I'm not sure how

Re: [AMaViS-user] maRBL on Debian

2007-01-03 Thread Henrik Krohns
On Thu, Jan 04, 2007 at 01:43:27AM +0100, mouss wrote: grant maxwell wrote: It would be very simple to add greylist command support to policyd- weight. Used when you match only one RBL or get over some specific score. And p0f support contributing to the score? Heck, I'll make some patches

Re: [AMaViS-user] maRBL on Debian

2007-01-02 Thread Henrik Krohns
On Tue, Jan 02, 2007 at 04:03:18PM -0700, Gary V wrote: I am going to let it go for a while by itself but will probably add (a somewhat permissive) policyd-weight back into the mix (ahead of selective greylisting). It would be very simple to add greylist command support to policyd-weight.

Re: [AMaViS-user] advice on black lists use

2006-12-24 Thread Henrik Krohns
On Sat, Dec 23, 2006 at 06:10:12PM +0200, Leon Kolchinsky wrote: Hello All, Below is a list ob black lists I'm using with main.cf config. smtpd_recipient_restrictions = reject_rbl_client zombie.dnsbl.sorbs.net, reject_rbl_client relays.ordb.org,

[AMaViS-user] Unchecked bug?

2006-11-30 Thread Henrik Krohns
Hi, when you receive mail with encrypted zip.. On HAM: Passed UNCHECKED. SPAM-TAG line is logged. Everything fine. On SPAM: Blocked UNCHECKED. SPAM(-TAG) line is not logged, bug? Also wouldn't it be more clear to report Blocked SPAM in this case? Or is this some configuration issue I

Re: [AMaViS-user] d-ot: sa tags meanings

2006-11-14 Thread Henrik Krohns
On Tue, Nov 14, 2006 at 10:11:29PM +1100, Voytek Eymont wrote: dumb Q: where do I find meaning of various SA tags ? I managed to find some on the http://spamassassin.apache.org/tests_3_1_x.html, but, can't find reference to TVD_FW_GRAPHIC That comes from sa-update updates, I don't think

Re: [AMaViS-user] d-ot: sa tags meanings

2006-11-14 Thread Henrik Krohns
On Tue, Nov 14, 2006 at 11:17:19PM +1100, Voytek Eymont wrote: On Tue, November 14, 2006 11:05 pm, Henrik Krohns wrote: On Tue, Nov 14, 2006 at 10:11:29PM +1100, Voytek Eymont wrote: That comes from sa-update updates, I don't think all have reference. Find the updates from /var/lib

Re: [AMaViS-user] postfix issue/questions regarding relay_recipients

2006-11-06 Thread Henrik Krohns
On Mon, Nov 06, 2006 at 12:17:01PM +0100, Bärtl, Martin wrote: Event though this is the amavisd list, i hope to get an answer for my postfix problem/questions. We are using postfix/amavisd-new as a mail gateway for our exchange server. As we are getting very much spam and infected mails

Re: [AMaViS-user] another sa-update question

2006-11-02 Thread Henrik Krohns
On Thu, Nov 02, 2006 at 03:32:27PM -0800, Jo Rhett wrote: MrC wrote: The is a short-circuting AND; it will only perform the next command *iff* the previous command succeeds. Since 1 is a failure, the amavisd reload does not occur. yeah, but it doesn't do anything intelligent in the

Re: [AMaViS-user] skipped check of .gif.exe attachment

2006-11-01 Thread Henrik Krohns
On Wed, Nov 01, 2006 at 08:50:48AM +0100, Jakob Curdes wrote: Patrick T. Tsang schrieb: The .exe is banned in amavis but it still penetrates to the mailboxes. in /etc/amavisd.conf: ... # block certain double extensions anywhere in the base name

Re: [AMaViS-user] Spam with embedded gif...

2006-10-20 Thread Henrik Krohns
On Fri, Oct 20, 2006 at 06:49:52PM +0200, Mark Martinec wrote: Ricardo, fuzzyocr spamassassin plugin into the mix and I really like it. What's the performance hit ? It is quite hefty, somewhat instable, but worth it if you can afford it. Though you need to remember that it is only

Re: [AMaViS-user] SA suddenly takes AGES...

2006-10-17 Thread Henrik Krohns
On Tue, Oct 17, 2006 at 03:30:16PM +0200, Ralf Hildebrandt wrote: * Hanne Moa [EMAIL PROTECTED]: Maybe setting up a dns-cache/dns-proxy woulds be the way to go? You do know who am I, don't you? I do have a cache, of course. So why do you ask why the lists are slow? Obviously you are

Re: [AMaViS-user] howto integrate dspam into amavisd-new?

2006-10-01 Thread Henrik Krohns
On Sun, Oct 01, 2006 at 01:25:57PM +0200, Heinz Ulrich Stille wrote: (..message trimmed..) 4). Discover that it only works well if you constantly manually feed it. Well, yes, but in my experience any filter needs constant training. 5). Stop using dspam because it's not worth the

Re: [AMaViS-user] howto integrate dspam into amavisd-new?

2006-10-01 Thread Henrik Krohns
On Sun, Oct 01, 2006 at 02:26:51PM +0200, Felix Schwarz wrote: Maybe its just me, but SpamAssassin only works for me. If I would use SpamAssassin, I would still get ~5-10 spam messages per day. Hard to say without knowing your configuration or experience.. With DSPAM, I only get 1-3 per

Re: [AMaViS-user] Re-queueing of mails

2006-10-01 Thread Henrik Krohns
On Sun, Oct 01, 2006 at 03:52:34PM +0100, Werner Schalk wrote: Hi, find /var/amavis/quarantine/spam* -type f | xargs . this doesn't work either for some reason (8000 files might be too many?): # find /var/amavis/quarantine/spam* -type f | xargs zgrep '^X-Envelope-To: $i' | grep

Re: [AMaViS-user] Re-queueing of mails

2006-10-01 Thread Henrik Krohns
On Sun, Oct 01, 2006 at 05:49:30PM +0100, Werner Schalk wrote: Hi, hhhmm, this is strange. In a bash shell I get: # find /var/amavis/quarantine/spam-* -type f | xargs zgrep '^X-Envelope-To: $i' | grep 'mydomain.com' | cut -c 24-43 list find: /var/amavis/quarantine/spam-*: No such file or

Re: [AMaViS-user] Re-queueing of mails

2006-09-30 Thread Henrik Krohns
On Sat, Sep 30, 2006 at 07:59:42AM -0600, Gary V wrote: zgrep '^X-Envelope-To: ' /var/amavis/quarantine/spam-a* | grep 'mydomain.com' | cut -c 24-43 list zgrep '^X-Envelope-To: ' /var/amavis/quarantine/spam-b* | grep 'mydomain.com' | cut -c 24-43 list If I'm not mistaken, the

Re: [AMaViS-user] syslog-ng config and problems

2006-08-26 Thread Henrik Krohns
On Sat, Aug 26, 2006 at 12:32:58PM +0200, Anders Norrbring wrote: I've tried to set up a looging av messages from amavis-new into a separate file, but that fle doesn't get created at all. Can someone please advice? syslog-ng.conf: filter f_mailscan { level(scan) and facility(mail);

Re: [AMaViS-user] sa-update (sa v 3.1.4)

2006-08-04 Thread Henrik Krohns
On Thu, Aug 03, 2006 at 01:44:54PM -0600, Gary V wrote: I would guess the only people this may have an adverse effect on would be those who place custom rule sets in the default rules dir and also use 'sa-update'. They shouldn't be doing that at any rate, I believe custom rules go in the

Re: [AMaViS-user] sa-update (sa v 3.1.4)

2006-08-04 Thread Henrik Krohns
On Fri, Aug 04, 2006 at 08:18:01AM -0600, Gary V wrote: Henrik wrote: On Thu, Aug 03, 2006 at 01:44:54PM -0600, Gary V wrote: I would guess the only people this may have an adverse effect on would be those who place custom rule sets in the default rules dir and also use 'sa-update'.

Re: [AMaViS-user] perl Digest::MD5 version requirement

2006-03-21 Thread Henrik Krohns
On Mon, Mar 20, 2006 at 03:16:36PM -0500, Adam Gibson wrote: I noticed in dag's amavisd-new 2.3.3 spec for amavisd the info below which goes against everything I have found in the archives for the amavisd-new list: ### No longer required with new amavisd-new #Requires: perl(Digest::MD5) =

Re: [AMaViS-user] Re: perl Digest::MD5 version requirement

2006-03-21 Thread Henrik Krohns
On Tue, Mar 21, 2006 at 11:33:47AM +0100, Felix Schwarz wrote: Henrik Krohns wrote: Maybe this is a bit offtopic, but why does everyone insist on using RPM/DEB whatever packages for everything? In my humble opinion, amavisd-new/spamassassin is much easier to handle when you compile

Re: [AMaViS-user] Decoding of p002 (RAR archive data, v1d, os: Win32) failed, leaving it unpacked: timed out

2006-03-07 Thread Henrik Krohns
On Wed, Mar 01, 2006 at 02:13:01AM +0100, Nicklas Bondesson wrote: Ran into some strange things today: Seems like the RAR decoder (unrar) doesn't cope very well with large .rar files (~15MB). First of all I got this message in the log: Decoding of p002 (RAR archive data, v1d, os: Win32)

Re: [AMaViS-user] OT: Is this a virusmail?

2006-02-01 Thread Henrik Krohns
On Wed, Feb 01, 2006 at 08:55:42PM +0100, Al Bogner wrote: I got this mail today, which was not recognized by 4 virus-scanners: http://members.inode.at/pinguin/possiblevirus.txt Can anyone confirm, that this is a virus? Al Use these.. http://virusscan.jotti.org/

Re: [AMaViS-user] BitDefender bdc and the --all option in amavisd.conf

2006-01-27 Thread Henrik Krohns
On Thu, Jan 26, 2006 at 10:18:09AM -0800, Bill Landry wrote: - Original Message - From: Max Matslofva [EMAIL PROTECTED] Hi I just installed BitDefender bdc from FreeBSD ports. BDC/FreeBSD 5.x-Console (v7.0-2545) (i386) (Dec 22 2004 19:56:57) Copyright (C) 1996-2004 SOFTWIN SRL.

Re: [AMaViS-user] Best specs for server;

2006-01-14 Thread Henrik Krohns
On Fri, Jan 13, 2006 at 12:40:02PM -1000, Clifton Royston wrote: On Fri, Jan 13, 2006 at 12:36:39PM -0800, Rich Marriner wrote: This might be a little bit off topic, but a new computer recently came into my hands and am wondering if I should retire(or reassign) my existing server and use

Re: [AMaViS-user] RE: How to clean /var/spool/amavis directory automatically

2005-12-26 Thread Henrik Krohns
On Mon, Dec 26, 2005 at 01:37:41PM +0200, [EMAIL PROTECTED] wrote: Is there any script to clean it automatically (or maybe there is some built-in amavis option) so it won???t eat my disk spaceoe http://www.postfix-buch.com/download/remove_amavisd-new_stale_files.sh.gz Thanks :) But

Re: [AMaViS-user] Avoiding spam scan on message originating from my network/s

2005-10-24 Thread Henrik Krohns
On Mon, Oct 24, 2005 at 11:05:14AM +0200, Rocco Scappatura wrote: Hello, Gary this morning the CPU of my servers was overloaded... So I hace removed the blacklist.cf ruleset list... So the CPU has returned to work normally... Is a problem? How can I replace thiat list? As already said,

Re: [AMaViS-user] Mail from localhost is not local

2005-10-24 Thread Henrik Krohns
On Mon, Oct 24, 2005 at 11:06:43AM +0200, Thomas Bange wrote: Hi, I'm running postfix with amavis as a relay for our exchange server. I setup the MYNETS policy bank to skip spam checks for mail from internal to external. For mail which originates from exchange to external recipients this

Re: [AMaViS-user] Amavisd-new vs appliance

2005-10-13 Thread Henrik Krohns
On Mon, Oct 10, 2005 at 09:55:36AM +0200, Rocco Scappatura wrote: - Can be a such black box more efficient then spam assassin (SA) - How to you use SA so that it can works fine? Depends entirely on the admin. SA has many little things to tweak and understand. Reading all the manuals and

Re: [AMaViS-user] Amavisd-new vs appliance

2005-10-10 Thread Henrik Krohns
On Mon, Oct 10, 2005 at 09:55:36AM +0200, Rocco Scappatura wrote: - Can be a such black box more efficient then spam assassin (SA) - How to you use SA so that it can works fine? Depends entirely on the admin. SA has many little things to tweak and understand. Reading all the manuals and

Re: [AMaViS-user] Bypass spam checks on local dsn/bounce

2005-09-14 Thread Henrik Krohns
On Wed, Sep 14, 2005 at 06:41:18AM -1000, Clifton Royston wrote: On Wed, Sep 14, 2005 at 08:18:55AM -0600, Gary V wrote: Henrik wrote: Hi, I have postfix-amavisd-new-postfix setup. I'm trying to disable spam checks on dsn/bounce messages ( sender) generated by the first postfix. I

Re: [AMaViS-user] Bypass spam checks on local dsn/bounce

2005-09-14 Thread Henrik Krohns
On Wed, Sep 14, 2005 at 11:55:01AM -0600, Gary V wrote: Henrik wrote: I already have checks disabled from mynetworks to local_domains, Additional details on how you accomplish this would help. This could work.. except we are redirecting different domains to different amavisd ports

Re: [AMaViS-user] Bypass spam checks on local dsn/bounce

2005-09-14 Thread Henrik Krohns
On Wed, Sep 14, 2005 at 09:57:48PM +0300, Henrik Krohns wrote: Well.. I spent some debugging and came to the conclusion that when sending a dsn, the first postfix doesn't send XFORWARD and that is the only thing amavisd checks from mynetworks. I probably need to hack amavisd to think

Re: [AMaViS-user] Bypass spam checks on local dsn/bounce

2005-09-14 Thread Henrik Krohns
On Wed, Sep 14, 2005 at 12:04:45PM -1000, Clifton Royston wrote: On Thu, Sep 15, 2005 at 12:01:44AM +0200, mouss wrote: Clifton Royston a écrit : I guess my point was more along the lines of: why is it routed through amavisd in the first place? Why send a self-generated DSN through

Re: [AMaViS-user] $first_infected_stops_scan = 0 ??

2005-07-17 Thread Henrik Krohns
On Sun, Jul 17, 2005 at 11:58:58PM +0800, meow wrote: I am wondering if I set $first_infected_stops_scan = 0 And I install 3 anti-virus software(all in @av_scanners not @av_scanners_backup), what will happen if only 2 or 1 of these anti-virus says certain mail contains virus and other

Re: [AMaViS-user] amavisd-2.3 version error

2005-06-27 Thread Henrik Krohns
On Mon, Jun 27, 2005 at 04:00:36PM +0200, Mark Martinec wrote: After that I got it working, but ended up with this error: Jun 27 01:34:41 xyz amavis[18246]: [ID 702911 mail.warning] (18246-01) WARN save_info_final: Insecure dependency in parameter 1 of DBI::db=HASH(0x1612700)-prepare