Re: procmail (was Re: Spam messages bypassing SA)

2014-10-28 Thread Ian Zimmerman
On Fri, 24 Oct 2014 08:43:41 -0400, David F. Skoll d...@roaringpenguin.com wrote: David Procmail is also unmaintained abandonware, as far as I can tell. David If you use SpamAssassin, you probably like Perl, so I would David recommend Email::Filter instead. It's far more flexible than David

Re: spf: lookup failed: addr is not a string

2014-10-28 Thread Thomas Preißler
Hey Mark, Do you have a firewall in place that tries to do a deep packet  inspection on DNS UDP packets but does not understand EDNS0 (the OPT RR) ? thanks for the suggestion! Unfortunately, the network is not the culprit. I tried to apply my chef recipes to a virtual machine on my

Re: procmail (was Re: Spam messages bypassing SA)

2014-10-28 Thread David F. Skoll
On Mon, 27 Oct 2014 23:50:20 -0700 Ian Zimmerman i...@buug.org wrote: Or you could run dovecot and its sieve plugin. Sieve is a real standard (RFC 5228) which procmail never was. It may be a standard, but it's nowhere near as flexible as Perl. I have very unusual filtering requirements (for

Re: spf: lookup failed: addr is not a string

2014-10-28 Thread Thomas Preißler
Hey! On Oct 28, 2014, at 10:51 AM, Thomas Preißler tho...@preissler.me wrote: Hey Mark, Do you have a firewall in place that tries to do a deep packet  inspection on DNS UDP packets but does not understand EDNS0 (the OPT RR) ? thanks for the suggestion! Unfortunately,

Re: procmail

2014-10-28 Thread Andrzej A. Filip
David F. Skoll d...@roaringpenguin.com wrote: On Mon, 27 Oct 2014 23:50:20 -0700 Ian Zimmerman i...@buug.org wrote: Or you could run dovecot and its sieve plugin. Sieve is a real standard (RFC 5228) which procmail never was. It may be a standard, but it's nowhere near as flexible as Perl.

Re: procmail

2014-10-28 Thread David F. Skoll
On Tue, 28 Oct 2014 13:28:19 +0100 Andrzej A. Filip andrzej.fi...@gmail.com wrote: It may be a standard, but it's nowhere near as flexible as Perl. I have very unusual filtering requirements (for example, rules that change depending on time-of-day or depending on who has the support

Re: Spam messages bypassing SA

2014-10-28 Thread Jeff Mincy
From: Bob Proulx b...@proulx.com Date: Mon, 27 Oct 2014 18:37:35 -0600 In the first email: # The lock file ensures that only 1 spamassassin invocation happens # at 1 time, to keep the load down. # :0fw: spamassassin.lock * 40 | spamc -x

Re: Spam messages bypassing SA

2014-10-28 Thread John Hardin
On Tue, 28 Oct 2014, Jeff Mincy wrote: I agree with everything you wrote but only when bayes autolearning is turned off. Bayes learning holds an exclusive lock to the bayes database particularly during expiration. If spamc does bayes autolearning and starts an expiration then other spamc runs

Re: spamassassin rule to combat phishing

2014-10-28 Thread francis picabia
On Mon, Oct 27, 2014 at 4:55 PM, John Hardin jhar...@impsec.org wrote: On Mon, 27 Oct 2014, francis picabia wrote: uri URI_EXAMPLE_EXTRA m;^https?://(?:www\.)?example\.com[^/?];i However another spoofed message was received today and the rule did not capture it. If I want to detect

CYA .link

2014-10-28 Thread Axb
Patience quota exceeded. What a weird way to get a new TLD's ROI if (version = 3.004000) blacklist_uri_host link endif

Re: procmail

2014-10-28 Thread jdow
On 2014-10-28 06:09, David F. Skoll wrote: On Tue, 28 Oct 2014 13:28:19 +0100 Andrzej A. Filip andrzej.fi...@gmail.com wrote: It may be a standard, but it's nowhere near as flexible as Perl. I have very unusual filtering requirements (for example, rules that change depending on time-of-day or

Re: Spam messages bypassing SA

2014-10-28 Thread Kevin A. McGrail
On 10/27/2014 8:37 PM, Bob Proulx wrote: In the first email: # The lock file ensures that only 1 spamassassin invocation happens # at 1 time, to keep the load down. Thanks, that was my thought as well and your analysis on using spamc and removing the lock was EXACTLY where my thought

Re: Is this really the SpamAssassin list? (was Re: unsubscribe)

2014-10-28 Thread jdebert
On Tue, 28 Oct 2014 04:27:14 +0100 Karsten Bräckelmann guent...@rudersport.de wrote: On Mon, 2014-10-27 at 19:44 -0700, jdebert wrote: Redirecting them makes people lazy. Better than annoying but they don't learn anything except to repeat their mistakes. Your assumption, the list

Re: procmail

2014-10-28 Thread David F. Skoll
On Tue, 28 Oct 2014 10:24:37 -0700 jdow j...@earthlink.net wrote: Sure, but that doesn't mean a consummate chef need fear them! Nonetheless one should keep bare knife switches away from said chef lest he forget that being an consummate expert in one field does not make him even barely

Re: procmail

2014-10-28 Thread jdow
On 2014-10-28 11:24, David F. Skoll wrote: On Tue, 28 Oct 2014 10:24:37 -0700 jdow j...@earthlink.net wrote: Sure, but that doesn't mean a consummate chef need fear them! Nonetheless one should keep bare knife switches away from said chef lest he forget that being an consummate expert in

Re: Is this really the SpamAssassin list? (was Re: unsubscribe)

2014-10-28 Thread Kevin A. McGrail
On 10/27/2014 5:37 PM, Karsten Bräckelmann wrote: header__KAM_SA_BLOCK_UNSUB1Subject =~ /unsubscribe/i Ouch. Would you please /^anchor$/ that beast? Unless you actually intend this sub-thread to be swept off the list, too. ;) I was trying to stay broad but see your point.

Re: spamassassin rule to combat phishing

2014-10-28 Thread francis picabia
On Tue, Oct 28, 2014 at 11:47 AM, francis picabia fpica...@gmail.com wrote: On Mon, Oct 27, 2014 at 4:55 PM, John Hardin jhar...@impsec.org wrote: On Mon, 27 Oct 2014, francis picabia wrote: uri URI_EXAMPLE_EXTRA m;^https?://(?:www\.)?example\.com[^/?];i However another spoofed

Re: procmail

2014-10-28 Thread Ian Zimmerman
On Tue, 28 Oct 2014 11:43:04 -0700 jdow j...@earthlink.net wrote: jdow That is hardly a compelling reason to change from procmail to jdow perl, for me or others with working procmail systems. You seem to jdow be advocating handing me perl and turning me loose after ripping jdow procmail out of my

Re: CYA .link

2014-10-28 Thread Kevin A. McGrail
On 10/28/2014 12:06 PM, Axb wrote: Patience quota exceeded. What a weird way to get a new TLD's ROI if (version = 3.004000) blacklist_uri_host link endif So we added this wanting to play with this command and had no change in behavior for an email with this from header: From: Notification

Re: CYA .link

2014-10-28 Thread Axb
On 10/28/2014 10:13 PM, Kevin A. McGrail wrote: On 10/28/2014 12:06 PM, Axb wrote: Patience quota exceeded. What a weird way to get a new TLD's ROI if (version = 3.004000) blacklist_uri_host link endif So we added this wanting to play with this command and had no change in behavior for an

Re: CYA .link

2014-10-28 Thread Kevin A. McGrail
On 10/28/2014 5:19 PM, Axb wrote: On 10/28/2014 10:13 PM, Kevin A. McGrail wrote: On 10/28/2014 12:06 PM, Axb wrote: Patience quota exceeded. What a weird way to get a new TLD's ROI if (version = 3.004000) blacklist_uri_host link endif So we added this wanting to play with this command

Re: procmail (was Re: Spam messages bypassing SA)

2014-10-28 Thread Derek Diget
On Oct 28, 2014 at 07:40 -0400, David F. Skoll wrote: =On Mon, 27 Oct 2014 23:50:20 -0700 =Ian Zimmerman i...@buug.org wrote: = = Or you could run dovecot and its sieve plugin. Sieve is a real = standard (RFC 5228) which procmail never was. = =It may be a standard, but it's nowhere near as

Re: CYA .link

2014-10-28 Thread Axb
On 10/28/2014 10:30 PM, Kevin A. McGrail wrote: On 10/28/2014 5:19 PM, Axb wrote: On 10/28/2014 10:13 PM, Kevin A. McGrail wrote: On 10/28/2014 12:06 PM, Axb wrote: Patience quota exceeded. What a weird way to get a new TLD's ROI if (version = 3.004000) blacklist_uri_host link endif So

Re: CYA .link

2014-10-28 Thread Quanah Gibson-Mount
--On Tuesday, October 28, 2014 6:06 PM +0100 Axb axb.li...@gmail.com wrote: Patience quota exceeded. What a weird way to get a new TLD's ROI if (version = 3.004000) blacklist_uri_host link endif Testing this on my MTA's now... --Quanah -- Quanah Gibson-Mount Server Architect

Re: CYA .link

2014-10-28 Thread Axb
On 10/28/2014 11:16 PM, Quanah Gibson-Mount wrote: --On Tuesday, October 28, 2014 6:06 PM +0100 Axb axb.li...@gmail.com wrote: Patience quota exceeded. What a weird way to get a new TLD's ROI if (version = 3.004000) blacklist_uri_host link endif Testing this on my MTA's now... Not

Re: CYA .link

2014-10-28 Thread Quanah Gibson-Mount
--On Tuesday, October 28, 2014 4:16 PM -0700 Quanah Gibson-Mount qua...@zimbra.com wrote: --On Tuesday, October 28, 2014 6:06 PM +0100 Axb axb.li...@gmail.com wrote: Patience quota exceeded. What a weird way to get a new TLD's ROI if (version = 3.004000) blacklist_uri_host link endif

Re: CYA .link

2014-10-28 Thread Axb
On 10/28/2014 11:28 PM, Quanah Gibson-Mount wrote: --On Tuesday, October 28, 2014 4:16 PM -0700 Quanah Gibson-Mount qua...@zimbra.com wrote: --On Tuesday, October 28, 2014 6:06 PM +0100 Axb axb.li...@gmail.com wrote: Patience quota exceeded. What a weird way to get a new TLD's ROI if

Re: CYA .link

2014-10-28 Thread Axb
On 10/28/2014 10:30 PM, Kevin A. McGrail wrote: On 10/28/2014 5:19 PM, Axb wrote: On 10/28/2014 10:13 PM, Kevin A. McGrail wrote: On 10/28/2014 12:06 PM, Axb wrote: Patience quota exceeded. What a weird way to get a new TLD's ROI if (version = 3.004000) blacklist_uri_host link endif So

Re: CYA .link

2014-10-28 Thread Axb
On 10/29/2014 12:23 AM, Jeff Mincy wrote: From: Axb axb.li...@gmail.com Date: Wed, 29 Oct 2014 00:00:39 +0100 before I commit please test with describe HEADER_HOST_IN_BLACKLIST Whitelisted header host or domain describe HEADER_HOST_IN_WHITELIST Blacklisted header host or

Re: Is this really the SpamAssassin list? (was Re: unsubscribe)

2014-10-28 Thread Karsten Bräckelmann
On Tue, 2014-10-28 at 11:19 -0700, jdebert wrote: On Tue, 28 Oct 2014 04:27:14 +0100 Karsten Bräckelmann guent...@rudersport.de wrote: On Mon, 2014-10-27 at 19:44 -0700, jdebert wrote: Redirecting them makes people lazy. Better than annoying but they don't learn anything except to

Re: procmail

2014-10-28 Thread Ted Mittelstaedt
I think that one of the things that up and coming Linux admins are supposed to do is write a Procmail is dead article and post it somewhere. It sure seems like it there's enough of them out there. Procmail isn't dead. However, the Procmail website is simply in an awful and atrocious state. It

Re: procmail

2014-10-28 Thread Reindl Harald
Am 29.10.2014 um 01:23 schrieb Ted Mittelstaedt: I think that one of the things that up and coming Linux admins are supposed to do is write a Procmail is dead article and post it somewhere. It sure seems like it there's enough of them out there. Procmail isn't dead. However, the Procmail

Re: procmail

2014-10-28 Thread Ted Mittelstaedt
On 10/28/2014 5:31 PM, Reindl Harald wrote: Am 29.10.2014 um 01:23 schrieb Ted Mittelstaedt: I think that one of the things that up and coming Linux admins are supposed to do is write a Procmail is dead article and post it somewhere. It sure seems like it there's enough of them out there.

Re: procmail

2014-10-28 Thread Reindl Harald
Am 29.10.2014 um 01:39 schrieb Ted Mittelstaedt: On 10/28/2014 5:31 PM, Reindl Harald wrote: Am 29.10.2014 um 01:23 schrieb Ted Mittelstaedt: I think that one of the things that up and coming Linux admins are supposed to do is write a Procmail is dead article and post it somewhere. It

Re: spf: lookup failed: addr is not a string

2014-10-28 Thread Mark Martinec
On 2014-10-28 13:25, Thomas Preißler wrote: Finally, I’m able to reproduce this issue on a plain debian wheezy system: - install debian wheezy - enable backports and run apt-get update - apt-get -t wheezy-backports install spamassassin - apt-get install libmail-dkim-perl - set 156.154.70.1 as

Re: procmail

2014-10-28 Thread David F. Skoll
On Wed, 29 Oct 2014 01:31:51 +0100 Reindl Harald h.rei...@thelounge.net wrote: frankly in times of LMTP and Sieve there is hardly a need to use procmail - it is used because i know it and it just works - so why should somebody step in and maintain it while nobody is forced to use it I use

Re: Is this really the SpamAssassin list? (was Re: unsubscribe)

2014-10-28 Thread jdebert
On Wed, 29 Oct 2014 00:33:04 +0100 Karsten Bräckelmann guent...@rudersport.de wrote: On Tue, 2014-10-28 at 11:19 -0700, jdebert wrote: On Tue, 28 Oct 2014 04:27:14 +0100 Karsten Bräckelmann guent...@rudersport.de wrote: On Mon, 2014-10-27 at 19:44 -0700, jdebert wrote: Redirecting

Re: procmail

2014-10-28 Thread Ted Mittelstaedt
On 10/28/2014 7:10 PM, David F. Skoll wrote: On Wed, 29 Oct 2014 01:31:51 +0100 Reindl Haraldh.rei...@thelounge.net wrote: frankly in times of LMTP and Sieve there is hardly a need to use procmail - it is used because i know it and it just works - so why should somebody step in and maintain

Re: procmail

2014-10-28 Thread Karsten Bräckelmann
On Tue, 2014-10-28 at 22:10 -0400, David F. Skoll wrote: frankly in times of LMTP and Sieve there is hardly a need to use procmail - it is used because i know it and it just works - so why should somebody step in and maintain it while nobody is forced to use it I use Email::Filter,

Who is ISIPP IADB why are they vouching for spammers?

2014-10-28 Thread David B Funk
While grubbing thru messages in one of my spam traps I came across one that had negative scores from: -2.2 RCVD_IN_IADB_VOUCHED RBL: ISIPP IADB lists as vouched-for sender -0.5 KHOP_RCVD_TRUSTDNS-Whitelisted sender is verified Since it also hit RAZOR2_CF_RANGE_E8_51_100

Re: Who is ISIPP IADB why are they vouching for spammers?

2014-10-28 Thread Olivier Nicole
David B Funk dbf...@engineering.uiowa.edu writes: While grubbing thru messages in one of my spam traps I came across one that had negative scores from: -2.2 RCVD_IN_IADB_VOUCHED RBL: ISIPP IADB lists as vouched-for sender -0.5 KHOP_RCVD_TRUSTDNS-Whitelisted sender is verified

Re: Spam messages bypassing SA

2014-10-28 Thread Bob Proulx
Jeff Mincy wrote: I agree with everything you wrote but only when bayes autolearning is turned off. Bayes learning holds an exclusive lock to the bayes database particularly during expiration. But the example was calling spamc. Bayes autolearning would be occuring in the spamd side of

Re: Is this really the SpamAssassin list? (was Re: unsubscribe)

2014-10-28 Thread Karsten Bräckelmann
On Tue, 2014-10-28 at 19:56 -0700, jdebert wrote: On Wed, 29 Oct 2014 00:33:04 +0100 Karsten Bräckelmann guent...@rudersport.de wrote: Redirecting them makes people lazy. Better than annoying but they don't learn anything except to repeat their mistakes. Your assumption, the