sa-update error

2007-07-24 Thread Zbigniew Szalbot
Hello, I'd be glad for your suggestions re sa-update error. $ sa-update can't resolve l27.0.0.1 to address at /usr/local/lib/perl5/site_perl/5.8.8/mach/Net/DNS/Resolver/Base.pm line 751. I think the issue started when I switched from my ISP DNS server to using my own caching name server at

Re: graphic spam

2007-07-24 Thread Nigel Frankcom
On Tue, 24 Jul 2007 11:04:23 +0800, Spamassassin List [EMAIL PROTECTED] wrote: Hi, Other than FuzzyOCR, is there other way to filter graphic spams? I had ImageInfo but seem like it is not working. regards LC ClamD with http://www.sanesecurity.co.uk/ work pretty well here. Be sure and read

Re: graphic spam

2007-07-24 Thread Nigel Frankcom
On Tue, 24 Jul 2007 11:04:23 +0800, Spamassassin List [EMAIL PROTECTED] wrote: Hi, Other than FuzzyOCR, is there other way to filter graphic spams? I had ImageInfo but seem like it is not working. regards LC PS... also check out ImageInfo.pm http://www.rulesemporium.com/plugins.htm Nigel

Re: sa-update error

2007-07-24 Thread Daryl C. W. O'Shea
Zbigniew Szalbot wrote: Hello, I'd be glad for your suggestions re sa-update error. $ sa-update can't resolve l27.0.0.1 to address at L27.0.0.1 isn't quite the same as 127.0.0.1. Daryl /usr/local/lib/perl5/site_perl/5.8.8/mach/Net/DNS/Resolver/Base.pm line 751. I think the issue started

Re: sa-update error

2007-07-24 Thread Zbigniew Szalbot
Hi Daryl, On Tue, 24 Jul 2007 02:56:02 -0400, Daryl C. W. O'Shea [EMAIL PROTECTED] wrote: Zbigniew Szalbot wrote: Hello, I'd be glad for your suggestions re sa-update error. $ sa-update can't resolve l27.0.0.1 to address at L27.0.0.1 isn't quite the same as 127.0.0.1. Well, I'm

RE: Any mailbox-challenge plugin?

2007-07-24 Thread Koopmann, Jan-Peter
and isn't considered to be that much better than C/R (it doesn't clutter a forged-sender's mail box, but it can bog down a forged-sender's mail server with verification requests). Well, it may be. I know, however, that a lot of people is doing this at the MTA level in order to reject

Re: graphic spam

2007-07-24 Thread Spamassassin List
Other than FuzzyOCR, is there other way to filter graphic spams? I had ImageInfo but seem like it is not working. PS... also check out ImageInfo.pm http://www.rulesemporium.com/plugins.htm Yes I had that, but it is not working for me. [26559] dbg: config: read file

Re: Stuff getting through

2007-07-24 Thread David Baron
Problem is that the S78 will start spamassassin but that start does not necessarily get a valid rule-set. For that, the internet connection must be up at the time. And why would it not be when the network start is S10network? I have: /etc/rc0.d/S35networking /etc/rc2.d/S99networking

RE: Solved: Was: DKIM vs DomainKeys plugins

2007-07-24 Thread Michael Scheidell
-Original Message- From: Bill Landry [mailto:[EMAIL PROTECTED] Sent: Monday, July 23, 2007 6:16 PM To: Michael Scheidell Cc: users@spamassassin.apache.org Subject: Re: Solved: Was: DKIM vs DomainKeys plugins Michael Scheidell wrote: What version of Mail::DKIM are you running,

Re: graphic spam

2007-07-24 Thread Matthias Keller
Spamassassin List wrote: Other than FuzzyOCR, is there other way to filter graphic spams? I had ImageInfo but seem like it is not working. PS... also check out ImageInfo.pm http://www.rulesemporium.com/plugins.htm Yes I had that, but it is not working for me. [26559] dbg: config: read file

Re: graphic spam

2007-07-24 Thread Spamassassin List
Other than FuzzyOCR, is there other way to filter graphic spams? I had ImageInfo but seem like it is not working. PS... also check out ImageInfo.pm http://www.rulesemporium.com/plugins.htm Yes I had that, but it is not working for me. [26559] dbg: config: read file

Problem with clamav plugin

2007-07-24 Thread Wolfgang Zeikat
In SA 3.1.8, I am trying to use the clamav plugin from http://wiki.apache.org/spamassassin/ClamAVPlugin spamassassin -t -D output includes dbg: ClamAV: Detected virus: Email.Stk.Gen596.Sanesecurity.07071900.pdf It adds a header X-Spam-Virus: Yes (Email.Stk.Gen596.Sanesecurity.07071900.pdf)

Re: not everyone is happy with SA

2007-07-24 Thread John D. Hardin
On Mon, 23 Jul 2007, jdow wrote: With snail mail it is nigh on to impossible to interrupt the reception process and reject a piece of mail. I simply place it into the trash on my way into the house. (Some things, like unwanted subscription offers or credit card offers, I tear in half. One

FW: RE: Solved: Was: DKIM vs DomainKeys plugins

2007-07-24 Thread Michael Scheidell
and can we find and drop this idiot too? Microsoft Mail Internet Headers Version 2.0 Received: from mail.secnap.net ([10.70.1.3]) by secnap2.secnap.com with Microsoft SMTPSVC(5.0.2195.6713); Tue, 24 Jul 2007 08:54:23 -0400 Received: by mail.secnap.net (Postfix, from userid 1001) id

Re: Problem with clamav plugin

2007-07-24 Thread OliverScott
You need to set a high priority for the meta rules as otherwise they are evaluated BEFORE the ClamAV plugin is used (I think?). I am not an expert in how SA works, but I eventually came up with the following solution (for using several different 3rd party clamav signatures): This is my clamav.cf

Re: graphic spam

2007-07-24 Thread Duane Hill
On Tue, 24 Jul 2007 at 20:48 +0800, [EMAIL PROTECTED] confabulated: Other than FuzzyOCR, is there other way to filter graphic spams? I had ImageInfo but seem like it is not working. PS... also check out ImageInfo.pm http://www.rulesemporium.com/plugins.htm Yes I had that, but it is not

Re: Problem with clamav plugin

2007-07-24 Thread Wolfgang Zeikat
On 07/24/07 15:43, OliverScott wrote: You need to set a high priority for the meta rules as otherwise they are evaluated BEFORE the ClamAV plugin is used (I think?). I am not an expert in how SA works, but I eventually came up with the following solution (for using several different 3rd party

sa-update is failing on users.spamassassin.org

2007-07-24 Thread Gary W. Smith
Running the below command starting failing in the last couple days saying it can't find updates.spamassassin.org DNS entry /usr/bin/sa-update --nogpg --channel updates.spamassassin.org --channel saupdates.openprotect.com saupdates.openprotect.com is working fine though. Are we having a DNS

Re: Problem with clamav plugin

2007-07-24 Thread Wolfgang Zeikat
On 07/24/07 15:43, OliverScott wrote: full CLAMAV eval:check_clamav() describe CLAMAV Clam AntiVirus detected something... score CLAMAV 0.001 If you don't want CLAMAV to score (high), apparently you can rename it to __CLAMAV, works fine here. To make the meta rule work too, I had to

Re: Writing a rule to access SA ClamAV Plugin Header

2007-07-24 Thread Wolfgang Zeikat
On 07/24/07 15:00, Wolfgang Zeikat wrote: In SA 3.1.8, I am trying to use the clamav plugin from http://wiki.apache.org/spamassassin/ClamAVPlugin spamassassin -t -D output includes dbg: ClamAV: Detected virus: Email.Stk.Gen596.Sanesecurity.07071900.pdf It adds a header X-Spam-Virus: Yes

RE: sa-update is failing on update.spamassassin.org

2007-07-24 Thread Gary W. Smith
Sorry, should have been update instead of users in subject... From: Gary W. Smith [mailto:[EMAIL PROTECTED] Sent: Tue 7/24/2007 7:25 AM To: users@spamassassin.apache.org Subject: sa-update is failing on users.spamassassin.org Running the below command starting

Re: sa-update is failing on update.spamassassin.org

2007-07-24 Thread Theo Van Dinter
As far as I know, DNS is working fine for the channel (tested from random work machine): $ host -t txt 1.1.3.updates.spamassassin.org 1.1.3.updates.spamassassin.org descriptive text 555165 On Tue, Jul 24, 2007 at 07:34:44AM -0700, Gary W. Smith wrote: Sorry, should have been update instead of

RE: sa-update is failing on update.spamassassin.org

2007-07-24 Thread Gary W. Smith
Theo, I just checked it out on dnsstuff.com (which is where I should have also checked earlier but sleep depervation...). It's also failing there as well. You might have a cached record. How I am searching: Searching for updates.spamassassin.org A record at b.root-servers.net

Re: sa-update is failing on update.spamassassin.org

2007-07-24 Thread Theo Van Dinter
updates.spamassassin.org has no A record. It has a TXT record though. :) On Tue, Jul 24, 2007 at 07:44:59AM -0700, Gary W. Smith wrote: Theo, I just checked it out on dnsstuff.com (which is where I should have also checked earlier but sleep depervation...). It's also failing there as

Re: Now its zip attachments ^^

2007-07-24 Thread Jonas Eckerman
Chr. v. Stuckrad wrote: Did somebody of you create an extra 'instance' of clamad-filter to fight spam with spam-sigs only, without scaning for virus-sigs? I'm running two instances of clamd in our mail gateway. One instance has the stock signatures (minus phishing sigs) and is used before

Re: Stuff getting through

2007-07-24 Thread Gene Heskett
On Tuesday 24 July 2007, David Baron wrote: Humm, with my lashup here that Joanne helped me setup, S78spamassassin starts a few copies of spamd, and fetchmail is started much later in S99local. Its fetchmail that calls procmail, and its procmail that calls the spamd's, so there is no time

Re: migrating from clamav before mta to SA ClamAV plugin experiences

2007-07-24 Thread Matus UHLAR - fantomas
what does clamav checking in that scanner do then? It should call clamdscan asap (before SA) and when a virus is found, the mail should be imediately rejected, the same way it's rejected when SA tells so. On 23.07.07 20:31, Robert - eLists wrote: It quarantines and notifies admin via

Re: Any mailbox-challenge plugin?

2007-07-24 Thread Jonas Eckerman
Giampaolo Tomassoni wrote: anyone knows of a SA plugin to score mails based on challenging the sender e-mail? I've got an experimental caching SAV plugin (wich tries to mitigate the general obnoxiousness of SAV a tinty bit) for SA at http://whatever.frukt.org. I'm not recommending using

Re: Stuff getting through

2007-07-24 Thread David Baron
On Tuesday 24 July 2007, Gene Heskett wrote: On Tuesday 24 July 2007, David Baron wrote: Humm, with my lashup here that Joanne helped me setup, S78spamassassin starts a few copies of spamd, and fetchmail is started much later in S99local. Its fetchmail that calls procmail, and its

Can I examinate results?

2007-07-24 Thread Paul Lenz
I hope this is not a FAQ... Is it possible to write some rules, get their results and examinate these results in other rules? Two examples (I used round brackets for correct display): 1.) Phishing: (a href=DANGEROUS_LINK)LINK_OF_YOUR_BANK(/a) rule 1 grabs DANGEROUS_LINK and LINK_OF_YOUR_BANK

Re: Can I examinate results?

2007-07-24 Thread Meng Weng Wong
you probably want a meta-rule, see manpage for Mail::SpamAssassin::Conf On Jul 24, 2007, at 11:47 PM, Paul Lenz wrote: I hope this is not a FAQ... Is it possible to write some rules, get their results and examinate these results in other rules?

Re: Now its zip attachments ^^

2007-07-24 Thread Kelson
John Rudd wrote: Chr. v. Stuckrad wrote: I have a 'political problem' with that. We 'drop' knowv viruses into a quarantine directory without further notice, and only once in years somebody complained and wanted his virus back :-) You could even do it as 5 different instances (1 for base

Re: Can I examinate results?

2007-07-24 Thread Theo Van Dinter
On Tue, Jul 24, 2007 at 06:47:06PM +0300, Paul Lenz wrote: 1.) Phishing: (a href=DANGEROUS_LINK)LINK_OF_YOUR_BANK(/a) rule 1 grabs DANGEROUS_LINK and LINK_OF_YOUR_BANK rule 2 compares the results whether both have the same domain, if not -- seems to be phishing, give some spam points

Re: Can I examinate results?

2007-07-24 Thread Paul Lenz
Meng Weng Wong [EMAIL PROTECTED] wrote: Is it possible to write some rules, get their results and examinate these results in other rules? you probably want a meta-rule, see manpage for Mail::SpamAssassin::Conf I don't mean the spam point results of __RULE1 + __RULE2, I mean results of

Re: Stuff getting through

2007-07-24 Thread Bob Proulx
David Baron wrote: Gene Heskett wrote: I have: /etc/rc0.d/S35networking /etc/rc2.d/S99networking /etc/rc3.d/S99networking /etc/rc5.d/S99networking /etc/rc6.d/S35networking /etc/rcS.d/S40networking S99 is what is being hit. And I would call ANY distro that starts networking

Re: graphic spam

2007-07-24 Thread Jerry Durand
At 11:43 PM 7/23/2007, Nigel Frankcom wrote: ClamD with http://www.sanesecurity.co.uk/ work pretty well here. Be sure and read http://www.sanesecurity.co.uk/clamav/usage.htm Warning to Mac users: I tried to use their automated script in OS X Server and got a script error (SED error). I

Re: graphic spam

2007-07-24 Thread John Rudd
Jerry Durand wrote: At 11:43 PM 7/23/2007, Nigel Frankcom wrote: ClamD with http://www.sanesecurity.co.uk/ work pretty well here. Be sure and read http://www.sanesecurity.co.uk/clamav/usage.htm Warning to Mac users: I tried to use their automated script in OS X Server and got a script

Re: Stuff getting through

2007-07-24 Thread David Baron
On Tuesday 24 July 2007, Bob Proulx wrote: Those init.d files are not stock Debian.  They have been modified. However since the rc0.d and rcS.d files still exists with low numbers then networking will start very early.  Those S99 files are simply red herrings for you distracting you from what

Why DUL hit?

2007-07-24 Thread Dan Barker
My sister-in-law is using the appropriate outbound SMTP server. Why'd SORBS_DUL misfire? (Oh, not misfire, but fire. The 65... Address is a dial-up, but the 207... Is not. I wonder why SORBS has it listed? Dan HEADERS: Received: from fmailhost01.isp.att.net [207.115.11.51] by

RE: Why DUL hit?

2007-07-24 Thread Michael Scheidell
The reverse dns. (and helo) Received: from hubert382f6e2f (adsl-065-012-175-061.sip.asm.bellsouth.net[65.12.175.61]) by bellsouth.net (frfwmhc01) with SMTP Aol won't accept email from something like that either. To fix: assign a dns name, fwd and reverse, then set it up in your mail

RE: Why DUL hit?

2007-07-24 Thread Dan Barker
The DUL account, relayed through the ISP. The ISP's IP should be checked in the DUL, not the end-user. I agree about all the RFC junk, but Bellsouth.net is not my domain. They are a fairly large (in the Southeast US) ISP and really should have a clue. Unfortunately, they don't. The REPORT showed

scam spam fwds to [EMAIL PROTECTED] bouncing

2007-07-24 Thread Chris
Ever since changing from my Earthlink account to my Embarq account scam fwds to the above bounce: [EMAIL PROTECTED]: host mail-gw.usss.treas.gov[10.119.253.67] said: 550     [EMAIL PROTECTED]: Recipient address rejected: Blocked (in reply to     RCPT TO command) One reason that the Embarq QA

Re: scam spam fwds to [EMAIL PROTECTED] bouncing

2007-07-24 Thread SM
Hi Chris, At 20:02 24-07-2007, Chris wrote: Ever since changing from my Earthlink account to my Embarq account scam fwds to the above bounce: [EMAIL PROTECTED]: host mail-gw.usss.treas.gov[10.119.253.67] said: 550 [EMAIL PROTECTED]: Recipient address rejected: Blocked (in reply to

sa-update error

2007-07-24 Thread Sg
Hi I am using SA 3.1.7. I want to update it. I tried this command sa-update --nogpg --channel updates.spamassassin.org --channel saupdates.openprotect.com But i got this error Argument 1.26_01 isnt numeric in subroutine entry at sa-update line 91 -- Sg