Re: Googlepages Livefilestore spams

2008-01-11 Thread Justin Mason
John D. Hardin writes: On Thu, 10 Jan 2008, Rosenbaum, Larry M. wrote: Is it safe to use unbounded quantifiers like + and {2,} in uri rules? I avoid them in regular body rules. Probably. URIs are parsed out of the body, so they are going to be fairly limited in length. 'course, if

Anybody else frustrated by the iphone Mail application?

2008-01-11 Thread Robert Nicholson
If I'm not mistaken it doesn't show non standard headers and also doesn't appear to allow the viewing of mime attachments. So it's quite difficult to see exactly what the spam assassin headers/report look like from an iphone's native mail client.

Re: Googlepages Livefilestore spams

2008-01-11 Thread ram
On Wed, 2008-01-09 at 22:56 -0500, Ben Lentz wrote: but this URI redirection stuff isn't very friendly when used by a spammer. Ben, the key is the btnI param, which maps to the I'm feeling lucky button. This technique appeared last summer (I deployed my non-SA-based rule on

Re: Spam Scored zero ?

2008-01-11 Thread Justin Piszcz
On Fri, 11 Jan 2008, UxBoD wrote: Hi, I got this SPAM through this morning and it didn't trip on anything. Any ideas ? Looks like the sender address was NULL and maybe you don't filter that? Justin.

Re: spamassassin plugin / sorry wrong list

2008-01-11 Thread Robert Schetterer
Robert Schetterer schrieb: Hi @ll, does anyone know some more recent spamassasin plugins for editing local users_pref ( not sql!!! ) i ve tested spamassassin SpamFilter (Frontend) version 2 and SpamAssassin Configuration but both did not work like they should ( lots of php problems )

USER_IN_WHITELIST Rule

2008-01-11 Thread Matthew Goodman
Why does spam continually get a hit on this rule? I noticed a lot more spam coming in off the upgrade to 3.2.4. Are spammers getting crafty with their mail messages to appear as coming from myself TO myself? I could always reduce the adjustment that USER_IN_WHITELIST makes. However, I'd like to

Spam Scored zero ?

2008-01-11 Thread UxBoD
Hi, I got this SPAM through this morning and it didn't trip on anything. Any ideas ? -- From: [EMAIL PROTECTED] To: undisclosed-recipients:; Sent: 11 January 2008 09:01:06 o'clock (GMT) Europe/London Subject: ATM Master CARD

spamassassin plugin

2008-01-11 Thread Robert Schetterer
Hi @ll, does anyone know some more recent spamassasin plugins for editing local users_pref ( not sql!!! ) i ve tested spamassassin SpamFilter (Frontend) version 2 and SpamAssassin Configuration but both did not work like they should ( lots of php problems ) specially spamassassin SpamFilter

Re: BOTNET 0.8 + SA 3.2.3

2008-01-11 Thread Arthur Dent
Hello all, I'm so no nearer a solution to this... To recap: Since upgrading from SA 3.2.2 to SA 3.2.3 I have had no Botnet hits at all. I have checked with SA --lint -D and Botnet v.0.8 seem to be installed correctly. I have run an old message through my current setup that hit Botnet when

Re: BOTNET 0.8 + SA 3.2.3

2008-01-11 Thread UxBoD
I am running it with SA 3.2.4 with no problems at all. Regards, --[ UxBoD ]-- // PGP Key: curl -s https://www.splatnix.net/uxbod.asc | gpg --import // Fingerprint: C759 8F52 1D17 B3C5 5854 36BD 1FB1 B02F 5DB5 687B // Keyserver: www.keyserver.net Key-ID: 0x5DB5687B // Phone: +44 845 869 2749 SIP

RE: BOTNET 0.8 + SA 3.2.3

2008-01-11 Thread Dave Koontz
I am running Botnet 0.8 with SA 3.2.3 without issue. Try a fresh install of all Botnet files. -Original Message- From: UxBoD [mailto:[EMAIL PROTECTED] Sent: Friday, January 11, 2008 5:45 AM To: Arthur Dent Cc: users@spamassassin.apache.org Subject: Re: BOTNET 0.8 + SA 3.2.3 I am

Re: DDOS, Dictionary Attack... not sure what it is...

2008-01-11 Thread Michelle Konzack
Am 2008-01-08 10:12:28, schrieb Joseph Brennan: I don't understand how refusing after MAIL could take 6 times as much resources as accepting the message. By refusing, you don't receive the message body and you don't have to output the message to a mailer. That has to use less resources than

Authors wanted for Linux Technical Review...

2008-01-11 Thread Markus Feilner
Hello List, As an editor for the german Linux Magazine I am looking for an author who would want to write articles for our Linux Technical Review 07 Spam about solutions, possibilities and the current state-of-the-art of spamassassin, rules updates (rules du jour, sare,...) and its affiliated

Re: USER_IN_WHITELIST Rule

2008-01-11 Thread Matt Kettler
Matthew Goodman wrote: Why does spam continually get a “hit” on this rule? I noticed a lot more spam coming in off the upgrade to 3.2.4. Are spammers getting crafty with their mail messages to appear as coming from myself TO myself? I could always reduce the adjustment that USER_IN_WHITELIST

Re: Spam Scored zero ?

2008-01-11 Thread Joseph Brennan
Real headers please. Joseph Brennan Columbia University Information Technology --On Friday, January 11, 2008 9:41 + UxBoD [EMAIL PROTECTED] wrote: Hi, I got this SPAM through this morning and it didn't trip on anything. Any ideas ?

Re: spamassassin 3.2.4, DKIM and DomainKeys

2008-01-11 Thread Mark Martinec
Pascal, it seems that since my upgrade to spamassassin 3.2.4, the DKIM an DomainKeys verifiers are no more used. All I see in the debug test are the following line : # spamassassin -D testmail.txt | grep -i dkim [4163] dbg: plugin: loading Mail::SpamAssassin::Plugin::DKIM from @INC

spamassassin 3.2.4, DKIM and DomainKeys

2008-01-11 Thread Pascal Maes
hello it seems that since my upgrade to spamassassin 3.2.4, the DKIM an DomainKeys verifiers are no more used. All I see in the debug test are the following line : # spamassassin -D testmail.txt | grep -i dkim [4163] dbg: plugin: loading Mail::SpamAssassin::Plugin::DKIM from @INC

Re: BOTNET 0.8 + SA 3.2.3

2008-01-11 Thread Arthur Dent
On Fri, Jan 11, 2008 at 06:49:19AM -0500, Dave Koontz wrote: I am running Botnet 0.8 with SA 3.2.3 without issue. Try a fresh install of all Botnet files. Well I have only recently upgraded my OS from FC6 to F8 (and that's what prompted me to check that everything was working properly).

Re: Spam Scored zero ?

2008-01-11 Thread Kai Schaetzl
Maybe just timed out? Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com

Re: spamassassin 3.2.4, DKIM and DomainKeys

2008-01-11 Thread Daniel J McDonald
On Fri, 2008-01-11 at 18:00 +0100, Mark Martinec wrote: Pascal, it seems that since my upgrade to spamassassin 3.2.4, the DKIM an DomainKeys verifiers are no more used. My 3.2.4 installation is working fine using Mail::DKIM version 0.29-4 Jan 11 11:20:35 sa amavis[14033]: (14033-16)

3.2.4 does not trigger any tests

2008-01-11 Thread Jari Fredriksson
3.2.3 worked fine, but after upgrading to 3.2.4 (via cpan) no test seem to work and generate points. All messages get thru. Only header that SA adds is X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on myservername I have two servers, and the problem is now on the second of them. When

Re: gpg keys?

2008-01-11 Thread Gene Heskett
On Friday 11 January 2008, McDonald, Dan wrote: On Fri, 2008-01-11 at 15:52 -0500, Gene Heskett wrote: On Friday 11 January 2008, Theo Van Dinter wrote: On Fri, Jan 11, 2008 at 02:34:29PM -0500, Gene Heskett wrote: Hope this helps. It doesn't Theo. Copy/paste from the shell I was using:

Re: gpg keys?

2008-01-11 Thread Gene Heskett
On Friday 11 January 2008, Theo Van Dinter wrote: On Fri, Jan 11, 2008 at 02:34:29PM -0500, Gene Heskett wrote: Is there a fix in the works for those who use sa-update other than disabling it in our crontabs? You'd want to be more specific about what your problem is. If the issue is the

RE: Apache SpamAssassin 3.2.4

2008-01-11 Thread Bret Miller
New upgrade is running GREAT here :) Running fine here on Windows Server 2003 with CommuniGate Pro. :) smime.p7s Description: S/MIME cryptographic signature

Re: gpg keys?

2008-01-11 Thread Theo Van Dinter
On Fri, Jan 11, 2008 at 02:34:29PM -0500, Gene Heskett wrote: Is there a fix in the works for those who use sa-update other than disabling it in our crontabs? You'd want to be more specific about what your problem is. If the issue is the cross-certify problem for the updates.spamassassin.org

Re: sa-update fails

2008-01-11 Thread Jonas Eckerman
Gene Heskett wrote: Even though I have followed the intructions in the error message twice now, I still have the same error when sa-update is run: Did you also follow the instructions for the channel you are trying to update? They are available at http://saupdates.openprotect.com/. #

gpg keys?

2008-01-11 Thread Gene Heskett
Is there a fix in the works for those who use sa-update other than disabling it in our crontabs? Thanks. -- Cheers, Gene There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order. -Ed Howdershelt (Author) Never put off until tomorrow what

Re: gpg keys?

2008-01-11 Thread McDonald, Dan
On Fri, 2008-01-11 at 15:52 -0500, Gene Heskett wrote: On Friday 11 January 2008, Theo Van Dinter wrote: On Fri, Jan 11, 2008 at 02:34:29PM -0500, Gene Heskett wrote: Hope this helps. It doesn't Theo. Copy/paste from the shell I was using: [EMAIL PROTECTED]

Re: gpg keys?

2008-01-11 Thread Jonas Eckerman
now it works without error, but doesn't report that anything was updated Sounds like it's working then. You can check the exit code to see if there was an update (it's in the man page). /usr/bin/sa-update --allowplugins --gpgkey D1C035168C1EBC08464946DA258CDB3ABDE9DC10 --channel

Re: gpg keys?

2008-01-11 Thread John D. Hardin
On Fri, 11 Jan 2008, Gene Heskett wrote: [EMAIL PROTECTED] ~]# wget http://spamassassin.apache.org/updates/GPG.KEY --14:33:42-- http://spamassassin.apache.org/updates/GPG.KEY = `GPG.KEY.1' Resolving spamassassin.apache.org... 140.211.11.130 Connecting to

Re: sa-update fails

2008-01-11 Thread Jonas Eckerman
(Please keep it on the list...) Gene Heskett wrote: Did you also follow the instructions for the channel you are trying to update? They are available at http://saupdates.openprotect.com/. First time anybody has mentioned that in about 6 months, Maybe it is, but in that case it was

Re: gpg keys?

2008-01-11 Thread Karsten Bräckelmann
On Fri, 2008-01-11 at 15:52 -0500, Gene Heskett wrote: [EMAIL PROTECTED] ~]# wget http://spamassassin.apache.org/updates/GPG.KEY --14:33:42-- http://spamassassin.apache.org/updates/GPG.KEY = `GPG.KEY.1' [...] 14:33:43 (53.32 KB/s) - `GPG.KEY.1' saved [3304/3304]

Re: BOTNET 0.8 + SA 3.2.3

2008-01-11 Thread Arthur Dent
On Fri, Jan 11, 2008 at 03:56:03PM +, Arthur Dent wrote: On Fri, Jan 11, 2008 at 06:49:19AM -0500, Dave Koontz wrote: I am running Botnet 0.8 with SA 3.2.3 without issue. Try a fresh install of all Botnet files. Well I have only recently upgraded my OS from FC6 to F8 (and

MSDN renewal reported as spam

2008-01-11 Thread Kenneth Porter
I just found my MSDN renewal in my spam folder, and rightly so. It has all kinds of spam-sign in it. I'm pasting the offending headers below. Apparently these are being sent from some non-MS server with a long delivery delay, all-HTML. Any comments? (My company name replaced with mycompany.)

RE: BOTNET 0.8 + SA 3.2.3

2008-01-11 Thread Robert - elists
Nope sorry... Here's what I did: I removed the botnet files from /etc/mail/spamassassin and restarted spamd. I ran --lint which confirmed that no there was no botnet installation. I downloaded Botnet 0.8 *again* from http://people.ucsc.edu/~jrudd/spamassassin/Botnet-0.8.tar I untarred

Re: BOTNET 0.8 + SA 3.2.3

2008-01-11 Thread Dave Koontz
Arthur Dent wrote: Nope sorry.. Please confirm... that your botnet.pm file is where your other plugin PM modules reside. And that the botnet.cf file is where your custom rules live (may be a different path depending on configuration). Make sure the botnet.cf is in the same directory as

Re: gpg keys?

2008-01-11 Thread Theo Van Dinter
On Fri, Jan 11, 2008 at 03:52:34PM -0500, Gene Heskett wrote: Hope this helps. It doesn't Theo. Copy/paste from the shell I was using: [EMAIL PROTECTED] ~]# /usr/bin/sa-update --allowplugins --gpgkey D1C035168C1EBC08464946DA258CDB3ABDE9DC10 --channel saupdates.openprotect.com error: GPG

Re: 3.2.4 does not trigger any tests

2008-01-11 Thread Theo Van Dinter
On Fri, Jan 11, 2008 at 11:13:58PM +0200, Jari Fredriksson wrote: If anyone can get any constructive ideas from it, I would be ethernally greatful! When you use third party rule updates, you need to also use the SA rule updates if you want those rules. ie: run just sa-update or specify

I'm still getting question marks in spam scores.

2008-01-11 Thread fchan
Hi, I updated from spamassassin 3.2.3 to 3.2.4 and I'm still getting these question marks in score from spamassassin. Here is a sample of the header I get with this message: Return-Path: [EMAIL PROTECTED] Delivered-To: [EMAIL PROTECTED] Received: (qmail 23882 invoked by uid 501); 11 Jan 2008

Re: gpg keys?

2008-01-11 Thread Gene Heskett
On Friday 11 January 2008, Theo Van Dinter wrote: On Fri, Jan 11, 2008 at 03:52:34PM -0500, Gene Heskett wrote: Hope this helps. It doesn't Theo. Copy/paste from the shell I was using: [EMAIL PROTECTED] ~]# /usr/bin/sa-update --allowplugins --gpgkey D1C035168C1EBC08464946DA258CDB3ABDE9DC10

Re: 3.2.4 does not trigger any tests

2008-01-11 Thread Jari Fredriksson
When you use third party rule updates, you need to also use the SA rule updates if you want those rules. ie: run just sa-update or specify multiple channels appropriately. I use sa-update, and multiple channels. My /etc/cron.daily/sa-update:

Re: 3.2.4 does not trigger any tests

2008-01-11 Thread Jari Fredriksson
Top post, sorry! Now it works. I just ran sa-update; sa-compile without that channel-file! Puzzled, but works anyway. When you use third party rule updates, you need to also use the SA rule updates if you want those rules. ie: run just sa-update or specify multiple channels

Re: 3.2.4 does not trigger any tests

2008-01-11 Thread Duane Hill
On Sat, 12 Jan 2008 04:56:57 +0200 Jari Fredriksson [EMAIL PROTECTED] wrote: [snip] My /etc/spamassassin/channels.txt: --(8)--

Re: BOTNET 0.8 + SA 3.2.3

2008-01-11 Thread Chris
On Friday 11 January 2008 6:20 pm, Dave Koontz wrote: Arthur Dent wrote: Nope sorry.. Please confirm... that your botnet.pm file is where your other plugin PM modules reside. And that the botnet.cf file is where your custom rules live (may be a different path depending on configuration).

Re: I'm still getting question marks in spam scores.

2008-01-11 Thread Matt Kettler
fchan wrote: Hi, I updated from spamassassin 3.2.3 to 3.2.4 and I'm still getting these question marks in score from spamassassin. Here is a sample of the header I get with this message: Return-Path: [EMAIL PROTECTED] Delivered-To: [EMAIL PROTECTED] Received: (qmail 23882 invoked by uid 501);

Re: 3.2.4 does not trigger any tests

2008-01-11 Thread Jari Fredriksson
On Sat, 12 Jan 2008 04:56:57 +0200 Jari Fredriksson [EMAIL PROTECTED] wrote: [snip] My /etc/spamassassin/channels.txt:

Problem with handle_user

2008-01-11 Thread Matthew Goodman
I am also having this error in my spamd.log file. Spamd is being run with: SPAMD_OPTS=-c -d -v -m 40 -s local4 -q -u vpopmail --virtual-config-dir=/var/vpopmail/domains/%d/%l/.spamassassin/ -H /var/vpopmail And spamc is being called by qmail-scanner-2.01 with /usr/bin/spamc -t 30 NONE of my