Re: Forward Conformed Reverse DNS troubleshooting tool

2007-11-30 Thread Matus UHLAR - fantomas
On 30.11.07 06:06, Ben Spencer wrote: Some sendmail milters due look at that banner. And perform lookups on it. One which comes to mind is milter-spiff (SPF checks). A misconfiguration host with misleading banner information may also contain other misconfiguration which, while may not allow

Re: Forward Conformed Reverse DNS troubleshooting tool

2007-11-30 Thread Graham Murray
Ken A [EMAIL PROTECTED] writes: RFCs say: 1. helo should be a fqdn. 2. you should not reject based on helo. Not quite. The RFC only says that you should not reject if the helo does not match the connecting IP address. It says nothing about rejecting the helo for other reasons - such as not

Re: Mondo bayes_toks - millions of entries

2007-11-30 Thread Kevin Parris
If I have followed the discussion correctly so far, the explanation for manual-learn not being distinguished from auto-learn is this: no matter what mode of learning caused a token to appear in the database, if there is ongoing mail traffic that hits on the token then said token will not

Re: Mondo bayes_toks - millions of entries

2007-11-30 Thread Michael Parker
On Nov 30, 2007, at 1:56 PM, Wes wrote: Well, spamd is apparently doing things far more efficiently than sa- learn --restore. Tokens are loading into the DB much faster than the restore, and postmaster is hardly ever a blip in 'top' (at least so far). When running the restore, postmaster

Re: Mondo bayes_toks - millions of entries

2007-11-30 Thread Daryl C. W. O'Shea
Wes wrote: I'm doing the sa-learn restore to the PostgreSQL database now. Performance is not so good - about 300 tokens per second loaded. It's going to take a while to reload the several million from the backup. I am using Mail::SpamAssassin::BayesStore::PgSQL. The PostgreSQL shows it is

Re: Forward Conformed Reverse DNS troubleshooting tool

2007-11-30 Thread mouss
Jonas Eckerman wrote: Vivek Khera wrote: On Nov 29, 2007, at 10:19 AM, Mike Jackson wrote: It also confirms that your SMTP banner greeting matches the reverse DNS. Who requires this? The hostname in the banner is usually the same hostname as in HELO/EHLO, and it's often a good idea to

Re: white-list doubt

2007-11-30 Thread mouss
Matthias Haegele wrote: mouss schrieb: Morvan Daniel Müller wrote: I use amavisd-new, entries into amavisd.conf: @blacklist_sender_maps = read_hash($MYHOME/black_sender.lst); @whitelist_sender_maps = read_hash($MYHOME/white_sender.lst); read_hash(\%spam_lovers,

Re: Mondo bayes_toks - millions of entries

2007-11-30 Thread Wes
Well, spamd is apparently doing things far more efficiently than sa-learn --restore. Tokens are loading into the DB much faster than the restore, and postmaster is hardly ever a blip in 'top' (at least so far). When running the restore, postmaster was sitting up about 60-80% CPU constantly. Wes

Re: Mondo bayes_toks - millions of entries

2007-11-30 Thread Wes
One other question on the database... What happens when the DB is down? Connection refused could be handled quickly if it fails opena and just said ok, no bayes for now. Waiting on a TCP Connect Abort timer for every query attempt would be devastating. Load performance has dropped

Re: Forward Conformed Reverse DNS troubleshooting tool

2007-11-30 Thread John D. Hardin
On Fri, 30 Nov 2007, Kevin W. Gagel wrote: Not quite. The RFC only says that you should not reject if the helo does not match the connecting IP address. It says nothing about rejecting the helo for other reasons - such as not being an fqdn. I agree. Besides, as much as I preach adherance to

Re: Mondo bayes_toks - millions of entries

2007-11-30 Thread Wes
On 11/30/07 12:57 PM, Kevin Parris [EMAIL PROTECTED] wrote: If I have followed the discussion correctly so far, the explanation for manual-learn not being distinguished from auto-learn is this: no matter what mode of learning caused a token to appear in the database, if there is ongoing mail

Re: Mondo bayes_toks - millions of entries

2007-11-30 Thread Wes
I'm doing the sa-learn restore to the PostgreSQL database now. Performance is not so good - about 300 tokens per second loaded. It's going to take a while to reload the several million from the backup. I am using Mail::SpamAssassin::BayesStore::PgSQL. The PostgreSQL shows it is doing a separate

Re: Forward Conformed Reverse DNS troubleshooting tool

2007-11-30 Thread Ken A
Matus UHLAR - fantomas wrote: On 30.11.07 06:06, Ben Spencer wrote: Some sendmail milters due look at that banner. And perform lookups on it. One which comes to mind is milter-spiff (SPF checks). A misconfiguration host with misleading banner information may also contain other misconfiguration

Re: Mondo bayes_toks - millions of entries

2007-11-30 Thread Wes
Well, I was suggesting making the expiry period just under, not the force-expire.. Really you can do it either way as long as expiry_period force-expire. Ok, I misunderstood what you were saying. I set bayes_expiry_period to 3 hours, and ran expires every 4 hours over night. I still get the

Re: Mondo bayes_toks - millions of entries

2007-11-30 Thread Daryl C. W. O'Shea
Wes wrote: One other question on the database... What happens when the DB is down? SA continues using scoreset 0 or 1 (instead of 2 or 3), depending on if you've got net tests enabled or not. Connection refused could be handled quickly if it fails opena and just said ok, no bayes for now.

Re: Forward Conformed Reverse DNS troubleshooting tool

2007-11-30 Thread Kevin W. Gagel
- Original Message - RFCs say: 1. helo should be a fqdn. 2. you should not reject based on helo. Not quite. The RFC only says that you should not reject if the helo does not match the connecting IP address. It says nothing about rejecting the helo for other reasons - such as not being

Re: space dot space com messages

2007-11-30 Thread Michelle Konzack
Am 2007-11-23 21:57:13, schrieb Loren Wilton: I'm seeing a lot of these spammed to my Mailman mailing lists. They generally consist of a single line with an obfuscated URL and a couple of blank lines. The URL looks like abcde . com (ie. a space on either side of the dot). If you post one

RE: Forward Conformed Reverse DNS troubleshooting tool

2007-11-30 Thread Ben Spencer
Some sendmail milters due look at that banner. And perform lookups on it. One which comes to mind is milter-spiff (SPF checks). A misconfiguration host with misleading banner information may also contain other misconfiguration which, while may not allow spam, may cause some MTAs to reject the

Re: Forward Conformed Reverse DNS troubleshooting tool

2007-11-30 Thread Jonas Eckerman
Vivek Khera wrote: On Nov 29, 2007, at 10:19 AM, Mike Jackson wrote: It also confirms that your SMTP banner greeting matches the reverse DNS. Who requires this? The hostname in the banner is usually the same hostname as in HELO/EHLO, and it's often a good idea to HELO/EHLO with a

Re: white-list doubt

2007-11-30 Thread Matthias Haegele
mouss schrieb: Morvan Daniel Müller wrote: I use amavisd-new, entries into amavisd.conf: @blacklist_sender_maps = read_hash($MYHOME/black_sender.lst); @whitelist_sender_maps = read_hash($MYHOME/white_sender.lst); read_hash(\%spam_lovers, '/var/spool/amavisd/spam_lovers.lst'); Into this files I