Re: Trouble with VBounce

2008-05-13 Thread Erik Dasque
Anyone ? Do you get the same analysis with the attached message that I got ? Is my VBounce setup wrong then ? Erik (did my message get ignored because of the text attachment ?) On May 12, 2008, at 11:32 AM, Erik Dasque wrote: Hi all, I am having trouble with VBounce. I think I followed

Re: Trouble with VBounce

2008-05-13 Thread Erik Dasque
I checked the debug result of my a --lint and got: [EMAIL PROTECTED]:~$ spamassassin 21 -D --lint | grep ounce [13492] dbg: plugin: loading Mail::SpamAssassin::Plugin::VBounce from @INC [13492] dbg: config: fixed relative path: /var/lib/spamassassin/

Re: Trouble with VBounce

2008-05-13 Thread Luis Hernán Otegui
Hi, Eric 2008/5/13 Erik Dasque [EMAIL PROTECTED]: I checked the debug result of my a --lint and got: [EMAIL PROTECTED]:~$ spamassassin 21 -D --lint | grep ounce [13492] dbg: plugin: loading Mail::SpamAssassin::Plugin::VBounce from @INC [13492] dbg: config: fixed relative path:

Re: faked bouncebacks. what the?

2008-05-13 Thread Matus UHLAR - fantomas
On 12.05.08 21:49, Arvid Ephraim Picciani wrote: http://rafb.net/p/q3eZwd93.html anyone can see any sense in it? it uses my hostname to fake a bounceback that claims i sent a message to another faked address, while all doing that from a dialup. what's the point of that? testing spambots?

Re: trusted mailing list subscriber spam

2008-05-13 Thread Matus UHLAR - fantomas
On Sun, May 11, 2008 22:39, mouss wrote: a +all and you are annoying us about forwarding and SPF? On 12.05.08 23:07, Benny Pedersen wrote: he, i have +all and forward nothing :) it's not about what do you forward, it's about others forwarding your e-mail (without rewriting mail from: which

Re: faked bouncebacks. what the?

2008-05-13 Thread Arvid Ephraim Picciani
On Tuesday 13 May 2008 15:17:29 Matus UHLAR - fantomas wrote: On 12.05.08 21:49, Arvid Ephraim Picciani wrote: http://rafb.net/p/q3eZwd93.html anyone can see any sense in it? it uses my hostname to fake a bounceback that claims i sent a message to another faked address, while all doing

Re: Trouble with VBounce

2008-05-13 Thread Justin Mason
actually, the message simply isn't in a format known to the ruleset. The problem is that it doesn't contain a bounced message at all... just the bounce, and no copy of the original message. Since there's no copy of the original, there's no way to tell what message it was in reply to, and whether

Re: German Spam

2008-05-13 Thread Michael Monnerie
On Mittwoch, 30. Mai 2007 Sebastian Wiesinger wrote: It's a nice ruleset but we had a major problem with it.  RDJ pulled in an update which contained these lines: Sorry for that problem, and sorry for only answering now. I'd been busy on some private problems, and hope to get into this list

Re: Trouble with VBounce

2008-05-13 Thread Karsten Bräckelmann
Yup. Did you whitelist your servers? If you don't do it, SA doesn't know how to tell a legit bounce from UBE-generated bounces. You should have something like whitelist_bounce_relays my.server.name other.server.name in your local.cf. True, and the OP did. He included another header

Re: faked bouncebacks. what the?

2008-05-13 Thread Matus UHLAR - fantomas
On Tuesday 13 May 2008 15:17:29 Matus UHLAR - fantomas wrote: On 12.05.08 21:49, Arvid Ephraim Picciani wrote: http://rafb.net/p/q3eZwd93.html anyone can see any sense in it? it uses my hostname to fake a bounceback that claims i sent a message to another faked address, while all

Re: Trouble with VBounce

2008-05-13 Thread Erik Dasque
My problem is that despite the fact that VBounce is enabled very few of the backscatter gets trapped (5% ?). Even messages that include the headers of the original message such as the following don't get trapped (I thought VBounce was able to analyze included headers to look for the SMTP

Re: Trouble with VBounce

2008-05-13 Thread Luis Hernán Otegui
Karsten: 2008/5/13 Karsten Bräckelmann [EMAIL PROTECTED]: Yup. Did you whitelist your servers? If you don't do it, SA doesn't know how to tell a legit bounce from UBE-generated bounces. You should have something like whitelist_bounce_relays my.server.name other.server.name in

Re: faked bouncebacks. what the?

2008-05-13 Thread Shane Williams
On Tue, 13 May 2008, Matus UHLAR - fantomas wrote: On Tuesday 13 May 2008 15:17:29 Matus UHLAR - fantomas wrote: On 12.05.08 21:49, Arvid Ephraim Picciani wrote: http://rafb.net/p/q3eZwd93.html anyone can see any sense in it? it uses my hostname to fake a bounceback that claims i sent a

Re: faked bouncebacks. what the?

2008-05-13 Thread Arvid Ephraim Picciani
On Tuesday 13 May 2008 16:51:50 Matus UHLAR - fantomas wrote: I've looked at it and I've (probably) missed it (again). Why do you think that it pretends to look like backscatter, and why do you think it is not? backscatter is what happens if mail systems automaticly reply to forged From:

bayes learning not on using cPanel

2008-05-13 Thread Angela Cymbalak
I am using the spamassassin that is installed when you install cPanel. I have been attempting to get the automatic bayes learning to work. I have set use_bayes to 1 in my properties file but it doesn't seem to be working. I say this because it appears that the only time the bayes_toks file

spamd

2008-05-13 Thread Mark Walmsley
Spamd is not using  whitelist_from_rcvd or whitelist_from_spf in local.cf but when i run a test msg spamassassin --test-mode 113.msg orspamassassin -D 113.msg The whitelist_from_rcvd and whitelist_from_spf are working I've even tried setting the path. Here is how I'm launching spamd

Re: Spanish Content

2008-05-13 Thread Diego Pomatta
Diego Pomatta escribió: For more info on usage, etc -- http://spamassassin.apache.org/full/3.1.x/doc/Mail_SpamAssassin_Plugin_TextCat.html Make that http://spamassassin.apache.org/full/3.2.x/doc/Mail_SpamAssassin_Plugin_TextCat.html for the 3.2.x version.

Re: Spanish Content

2008-05-13 Thread Diego Pomatta
Diego Pomatta escribió: Try adding loadplugin Mail::SpamAssassin::Plugin::TextCat to your /etc/mail/spamassassin/init.pre, to enable the TextCat plugin Or better yet, edit your /etc/mail/spamassassin/v310.pre file and uncomment #loadplugin Mail::SpamAssassin::Plugin::TextCat It's

Re: trusted mailing list subscriber spam

2008-05-13 Thread mouss
Matus UHLAR - fantomas wrote: On Sun, May 11, 2008 22:39, mouss wrote: a +all and you are annoying us about forwarding and SPF? On 12.05.08 23:07, Benny Pedersen wrote: he, i have +all and forward nothing :) it's not about what do you forward, it's about others

Re: trusted mailing list subscriber spam

2008-05-13 Thread Benny Pedersen
On Tue, May 13, 2008 15:19, Matus UHLAR - fantomas wrote: Don't wonder if anyone will reject or flag your e-mail because havinr +all in SPF yes i need to implement srs to fix it better ? come on, srs and +all it imho the same seen to the recipient diff is that i dont use srs installed

Re: faked bouncebacks. what the?

2008-05-13 Thread mouss
Arvid Ephraim Picciani wrote: On Tuesday 13 May 2008 16:51:50 Matus UHLAR - fantomas wrote: I've looked at it and I've (probably) missed it (again). Why do you think that it pretends to look like backscatter, and why do you think it is not? backscatter is what happens if mail systems

Re: faked bouncebacks. what the?

2008-05-13 Thread Matus UHLAR - fantomas
On 13.05.08 15:17, Arvid Ephraim Picciani wrote: It's not backscatter. Please see read the message again, you'll see that it actually _pretends_ to be backscatter. I'm just asking here becouse i wondered why somone would do that. I've looked at it and I've (probably) missed it (again). Why

Re: Spanish Content

2008-05-13 Thread Karsten Bräckelmann
I have a client that uses Spanish content and is getting filtered due to some of the symbols used. Is there anything in SpamAssasin that takes that into account? Try adding loadplugin Mail::SpamAssassin::Plugin::TextCat to your /etc/mail/spamassassin/init.pre, to enable

question about MISSING_SUBJECT

2008-05-13 Thread Leonardo Rodrigues Magalhães
Hello Guys, i got a message that was flagged with MISSING_SUBJECT rule. The message has, among other headers: From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Date: Tue, 13 May 2008 17:12:47 -0300 MIME-Version: 1.0 and rules are: header __HAS_SUBJECTexists:Subject

Re: faked bouncebacks. what the?

2008-05-13 Thread Matus UHLAR - fantomas
On Tuesday 13 May 2008 16:51:50 Matus UHLAR - fantomas wrote: I've looked at it and I've (probably) missed it (again). Why do you think that it pretends to look like backscatter, and why do you think it is not? On 13.05.08 19:09, Arvid Ephraim Picciani wrote: backscatter is what happens

Re: Spanish Content

2008-05-13 Thread Matus UHLAR - fantomas
On 13.05.08 10:59, Josie Walls wrote: I have a client that uses Spanish content and is getting filtered due to some of the symbols used. what rules do those hit? Maybe you use some rules that have false positives for non-english languages (chickenpox or so) Is there anything in SpamAssasin

Re: trusted mailing list subscriber spam

2008-05-13 Thread Matus UHLAR - fantomas
On Tue, May 13, 2008 15:19, Matus UHLAR - fantomas wrote: Don't wonder if anyone will reject or flag your e-mail because havinr +all in SPF On 13.05.08 21:29, Benny Pedersen wrote: yes i need to implement srs to fix it better ? no, forwarders need to. come on, srs and +all it imho the

AWL putting spam in my inbox

2008-05-13 Thread Robotech_Master
I'm using SpamAssassin 3.2.3 w/ Perl 5.8.8 on Linux. I'm not the sysadmin of the machine, but a user. I invoke it through a procmail recipe that says, in part, :0fw | /usr/bin/spamc My user_prefs file is as follows. report_safe 0 required_score 4.0 score BAYES_50 0.1 score BAYES_80 3.0 score

VBounceRuleset for non-sysadmin?

2008-05-13 Thread Robotech_Master
I'm not the sysadmin but a user on someone else's machine. This other machine has SpamAssassin set up, and the VBounceRuleset module loaded, but does not have the whitelist_bounce_relays line in local.cf that is needed to make the rule function. Would it function if I added that line to my

Re: trusted mailing list subscriber spam

2008-05-13 Thread Benny Pedersen
On Tue, May 13, 2008 23:09, Matus UHLAR - fantomas wrote: spammers will use whatever they'll see people don't catch. you just told all spammers to use mx +all in SPF records for their domains to be able to use them for world-wide spamming basic score in spf is olso very low pr default, one

Re: question about MISSING_SUBJECT

2008-05-13 Thread mouss
Leonardo Rodrigues Magalhães wrote: Hello Guys, i got a message that was flagged with MISSING_SUBJECT rule. The message has, among other headers: From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Date: Tue, 13 May 2008 17:12:47 -0300 MIME-Version: 1.0 and rules are: header

Re: faked bouncebacks. what the?

2008-05-13 Thread Arvid Ephraim Picciani
On Tuesday 13 May 2008 22:45:43 mouss wrote: That said, one possibility is this: Some soho have an MSA on a dsl line. a ratwared box inside (or a web service running on the MSA box) sends mail to an invalid recipient. the MSA gets rejected and then sends you an NDR. the MSA is borked

Re: VBounceRuleset for non-sysadmin?

2008-05-13 Thread Karsten Bräckelmann
On Tue, 2008-05-13 at 16:20 -0500, Robotech_Master wrote: I'm not the sysadmin but a user on someone else's machine. This other machine has SpamAssassin set up, and the VBounceRuleset module loaded, but does not have the whitelist_bounce_relays line in local.cf that is needed to make the rule

Re: faked bouncebacks. what the?

2008-05-13 Thread mouss
Arvid Ephraim Picciani wrote: On Tuesday 13 May 2008 22:45:43 mouss wrote: That said, one possibility is this: Some soho have an MSA on a dsl line. a ratwared box inside (or a web service running on the MSA box) sends mail to an invalid recipient. the MSA gets rejected and then sends you

backscatter and (was: Re: AWL putting spam in my inbox)

2008-05-13 Thread Karsten Bräckelmann
On Tue, 2008-05-13 at 16:16 -0500, Robotech_Master wrote: I'm using SpamAssassin 3.2.3 w/ Perl 5.8.8 on Linux. I'm not the sysadmin of the machine, but a user. I invoke it through a procmail recipe that says, in part, :0fw | /usr/bin/spamc I am getting an immense amount of backscatter

Re: backscatter and (was: Re: AWL putting spam in my inbox)

2008-05-13 Thread Karsten Bräckelmann
Please keep list posts on list, by either Replying To List or All. On Tue, 2008-05-13 at 17:43 -0500, Robotech_Master wrote: On Tue, May 13, 2008 at 5:05 PM, Karsten Bräckelmann [EMAIL PROTECTED] wrote: Now, here goes my favorite quote these days: $ grep -A 2

Re: spamd

2008-05-13 Thread Matt Kettler
Mark Walmsley wrote: Spamd is not using whitelist_from_rcvd or whitelist_from_spf in local.cf but when i run a test msg spamassassin --test-mode 113.msg or spamassassin -D 113.msg The whitelist_from_rcvd and whitelist_from_spf are working I've even tried setting the path. Here is how

User Folder problem with sa_learn

2008-05-13 Thread Matthias Schmidt
Hello all, since some longer time I have a little problem with the spam learning method, which is used in a script on my box. The script runs as user _amavisd, but it always tries to acces the root folder. This of course produces an error: config: path /var/root/.spamassassin is inaccessible:

_HAMMYTOKENS_/_SPAMMYTOKENS_ templates

2008-05-13 Thread Chris
In my local.cf I have: add_header all Spammy _SPAMMYTOKENS(2,long)_ add_header all Hammy _HAMMYTOKENS(2,long)_ which according to Mail::SpamAssassin::Conf should result in: X-Spam-Spammy: 0.989-6--0h-4s--4d--remove.php, 0.988-33--2h-25s--1d--UD:jpg however when running spamassassin -t

Re: _HAMMYTOKENS_/_SPAMMYTOKENS_ templates

2008-05-13 Thread Chris
On Tuesday 13 May 2008 9:30 pm, Chris wrote: In my local.cf I have: add_header all Spammy _SPAMMYTOKENS(2,long)_ add_header all Hammy _HAMMYTOKENS(2,long)_ which according to Mail::SpamAssassin::Conf should result in: X-Spam-Spammy: 0.989-6--0h-4s--4d--remove.php,

How to output Debugged Lint to file

2008-05-13 Thread Kathryn Kleinschafer
Hi all, My installation of spamassassin seems to have stopped using all the rules I have added when checking email. They now reside in /var/lib/spamassassin/3.002002 I'm trying to run spamassassin -D --lint and output it to say test.txt so that I can see it all later and try and trouble

Re: How to output Debugged Lint to file

2008-05-13 Thread Matt Kettler
Kathryn Kleinschafer wrote: Hi all, My installation of spamassassin seems to have stopped using all the rules I have added when checking email. They now reside in /var/lib/spamassassin/3.002002 I'm trying to run spamassassin -D --lint and output it to say test.txt so that I can see it all

Re: How to output Debugged Lint to file

2008-05-13 Thread Kathryn Kleinschafer
Awesome thanks. the output showed [3887] dbg: config: using /etc/mail/spamassassin for site rules pre files [3887] dbg: config: read file /etc/mail/spamassassin/init.pre [3887] dbg: config: read file /etc/mail/spamassassin/v310.pre [3887] dbg: config: read file /etc/mail/spamassassin/v312.pre

Re: How to output Debugged Lint to file

2008-05-13 Thread Matt Kettler
Kathryn Kleinschafer wrote: Awesome thanks. the output showed [3887] dbg: config: using /etc/mail/spamassassin for site rules pre files [3887] dbg: config: read file /etc/mail/spamassassin/init.pre [3887] dbg: config: read file /etc/mail/spamassassin/v310.pre [3887] dbg: config: read file

Re: How to output Debugged Lint to file

2008-05-13 Thread Kathryn Kleinschafer
I am running it by going: sudo -u postfix spamassassin -p /etc/MailScanner/spam.assassin.prefs.conf -t messagename.mai Matt Kettler wrote: Kathryn Kleinschafer wrote: Awesome thanks. the output showed [3887] dbg: config: using /etc/mail/spamassassin for site rules pre files [3887]