Re: SA on a backup MX

2014-07-09 Thread ML mail
The reason for read-only is that I am using PostgreSQL with hot standby streaming replication. The main MX server will use the master PostgreSQL server and the backup MX will use its own local PostgreSQL slave server. The slave server of a PostgreSQL hot standby pair is only available in

Re: SA on a backup MX

2014-07-09 Thread Axb
On 07/09/2014 12:40 AM, RW wrote: use_learner 0 use_learner ( 0 | 1 ) (default: 1) Whether to use any machine-learning classifiers with SpamAssassin, such as the default 'BAYES_*' rules. Setting this to 0 will disable use of any and all human-trained classifiers.

Re: help with a sintax rule appreciated

2014-07-09 Thread Benny Pedersen
On 9. jul. 2014 07.00.44 CEST, Sergio sec...@gmail.com wrote: It seems that my rule using Received instead of From did the trick, the rule is working now. It 2 diffrent spams :) These are the headers from amazoncoupons-user=domain@lastawhdak.com: headerBLACKLIST_REGEXFrom:address

Re: help with a sintax rule appreciated

2014-07-09 Thread RW
On Wed, 09 Jul 2014 13:42:26 +0200 Benny Pedersen wrote: On 9. jul. 2014 07.00.44 CEST, Sergio sec...@gmail.com wrote: It seems that my rule using Received instead of From did the trick, the rule is working now. It should run only on the From header. Otherwise it may FP on VERP and similar

Re: help with a sintax rule appreciated

2014-07-09 Thread Kevin A. McGrail
On 7/9/2014 1:00 AM, Sergio wrote: It seems that my rule using Received instead of From did the trick, the rule is working now. Sergio, The format of that email address is likely verp or some related format that encodes the recipient in the From address so that bounces can be processed

Re: help with a sintax rule appreciated

2014-07-09 Thread RW
On Wed, 09 Jul 2014 08:54:08 -0400 Kevin A. McGrail wrote: On 7/9/2014 1:00 AM, Sergio wrote: It seems that my rule using Received instead of From did the trick, the rule is working now. Sergio, The format of that email address is likely verp or some related format that encodes the

Re: help with a sintax rule appreciated

2014-07-09 Thread Kevin A. McGrail
On 7/9/2014 9:08 AM, RW wrote: VERP and similar schemes work on the envelope, so checking the From header should relatively safe. Not debating that point because it's not really my point. I'm trying to focus on the fact that the existence of the schema he is looking for with the rule looks

Deleting Bayes Data and MySQL Tables

2014-07-09 Thread Asai
Greetings, We've been running Spamassassin (3.3.1 currently, concurrently with Amavis) using MySQL as a backend for many years now and we have 1 million + entries in the Bayes table. At this time, there seems to be a lot of spam getting through the filters and we currently have our spam

Re: Deleting Bayes Data and MySQL Tables

2014-07-09 Thread John Hardin
On Wed, 9 Jul 2014, Asai wrote: Greetings, We've been running Spamassassin (3.3.1 currently, concurrently with Amavis) using MySQL as a backend for many years now and we have 1 million + entries in the Bayes table. At this time, there seems to be a lot of spam getting through the filters

Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-09 Thread David F. Skoll
On Wed, 09 Jul 2014 05:44:34 +0200 Karsten Bräckelmann guent...@rudersport.de wrote: If you deliberately try to sneak past sensible security measures, you should not be surprised to be blocked. The attempt by an honest user to disguise any $file (he did it on purpose, so he knows there's

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-09 Thread Ted Mittelstaedt
First of all why do people insist on hiding names of companies that do stuff like this? It just makes it look like your manufacturing an event that doesn't exist, it destroys your credibility. Secondly, if you think that this is an example of badness on Windows security best practices you

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-09 Thread Mauricio Tavares
On Wed, Jul 9, 2014 at 2:23 PM, Ted Mittelstaedt t...@ipinc.net wrote: First of all why do people insist on hiding names of companies that do stuff like this? It just makes it look like your manufacturing an event that doesn't exist, it destroys your credibility. You mean besides NDAs

Re: I was wrong - Bayes filter not quite right

2014-07-09 Thread Bruce Sackett
On Jul 8, 2014, at 9:42 AM, John Hardin jhar...@impsec.org wrote: On Tue, 8 Jul 2014, motty cruz wrote: Hi Bruce, I was having similar issues, can you do su - vscan and restart amavisd service? user vscan != user amavis. On Tue, Jul 8, 2014 at 8:54 AM, Bruce Sackett br...@oecnw.com

Re: I was wrong - Bayes filter not quite right

2014-07-09 Thread motty cruz
I had similar issue, I am running FreeBSD, in my etc/group vscan:*:110:clamav also, cd /var ls -la drwxr-x 8 vscan vscan amavis because inside /var/amavisd db .spamassassin Thanks, On Wed, Jul 9, 2014 at 1:26 PM, Bruce Sackett br...@oecnw.com wrote: On Jul 8,

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-09 Thread Ted Mittelstaedt
On 7/9/2014 11:37 AM, Mauricio Tavares wrote: On Wed, Jul 9, 2014 at 2:23 PM, Ted Mittelstaedtt...@ipinc.net wrote: First of all why do people insist on hiding names of companies that do stuff like this? It just makes it look like your manufacturing an event that doesn't exist, it destroys

Fwd: help with a sintax rule appreciated

2014-07-09 Thread Sergio
Hi all, first of all, big thanks for all the inputs. I am seeing a nice quantity of blocked spammers it was really a high rate of them and KAM you, as always, are right. It is taking some FP on the run, but from 640 blocked emails less than a 1 percent were FP, that FPs are being taking care on a

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-09 Thread David F. Skoll
On Wed, 09 Jul 2014 14:44:27 -0700 Ted Mittelstaedt t...@ipinc.net wrote: David DID NOT say that. He said that he was shocked to discover Why are you assuming he is under NDA or he is an employee of this company? Let me clarify the situation: 1) I'm the owner of Roaring Penguin, so my boss

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-09 Thread John Hardin
On Wed, 9 Jul 2014, Ted Mittelstaedt wrote: You are an administrator. YOU ARE PAID BY CLUELESS USERS TO PROTECT THEM AND THEIR DATA, DAMMIT. recovered_monk ...unless it involves some actual, you know, effort on their part. /recovered_monk And in this instance, Large DP Company *is* doing

Re: Obfuscated Windows excecutables (was Re: Ideas sought for blocking new variant of cryptolocker)

2014-07-09 Thread Mauricio Tavares
On Wed, Jul 9, 2014 at 5:44 PM, Ted Mittelstaedt t...@ipinc.net wrote: On 7/9/2014 11:37 AM, Mauricio Tavares wrote: On Wed, Jul 9, 2014 at 2:23 PM, Ted Mittelstaedtt...@ipinc.net wrote: First of all why do people insist on hiding names of companies that do stuff like this? It just