Re: "Received" headers for rules?

2015-10-26 Thread RW
On Mon, 26 Oct 2015 14:37:52 -0500 (CDT) sha...@shanew.net wrote: > On Mon, 26 Oct 2015, RW wrote: > > I had a quick look at the code and the only mention of ezmlm was > > related to gated_through_received_hdr_remover() which looks for > > signs that the email passed through something that might

Re: "Received" headers for rules?

2015-10-26 Thread shanew
On Mon, 26 Oct 2015, RW wrote: On Mon, 26 Oct 2015 11:37:58 -0500 (CDT) Shane Williams wrote: I've created a header rule with "Received =~ /blahblahblah/", and I just got a false positive on it when none of the Received headers in the mail actually match. I had a similar situation last week,

Re: "Received" headers for rules?

2015-10-26 Thread RW
On Mon, 26 Oct 2015 11:37:58 -0500 (CDT) Shane Williams wrote: > I've created a header rule with "Received =~ /blahblahblah/", and I > just got a false positive on it when none of the Received headers in > the mail actually match. I had a similar situation last week, and > (I think) found in the

Re: "Received" headers for rules?

2015-10-26 Thread Paul Stead
On 26/10/15 17:46, sha...@shanew.net wrote: Thanks to John Hardin for pointing out a way to determine (on a per email basis even) what headers count as Received. The following page might be of use to build a few rules too: https://wiki.apache.org/spamassassin/TrustedRelays -- Paul Stead Sys

Re: "Received" headers for rules?

2015-10-26 Thread shanew
On Mon, 26 Oct 2015, Reindl Harald wrote: Am 26.10.2015 um 17:37 schrieb Shane Williams: I've created a header rule with "Received =~ /blahblahblah/", and I just got a false positive on it when none of the Received headers in the mail actually match. I had a similar situation last week, and

Re: "Received" headers for rules?

2015-10-26 Thread John Hardin
On Mon, 26 Oct 2015, Shane Williams wrote: I've created a header rule with "Received =~ /blahblahblah/", and I just got a false positive on it when none of the Received headers in the mail actually match. I had a similar situation last week, and (I think) found in the SA code where it will trea

Re: "Received" headers for rules?

2015-10-26 Thread Reindl Harald
Am 26.10.2015 um 17:37 schrieb Shane Williams: I've created a header rule with "Received =~ /blahblahblah/", and I just got a false positive on it when none of the Received headers in the mail actually match. I had a similar situation last week, and (I think) found in the SA code where it will

"Received" headers for rules?

2015-10-26 Thread Shane Williams
I've created a header rule with "Received =~ /blahblahblah/", and I just got a false positive on it when none of the Received headers in the mail actually match. I had a similar situation last week, and (I think) found in the SA code where it will treat ezmlm headers as if they were Received head

Re: Spamassassin and amavisd-new wont' check (faked) bounce with zip-archive/exe (maleware)

2015-10-26 Thread John Hardin
On Mon, 26 Oct 2015, Django [BOfH] wrote: A few days agoe a colleague received over 200 bounce-messages and this over 10 minutes. O.K., that was all backscatter from a software-company in Redmond :( All those messages had have an attachment (zip archive) with maleware. http://impsec.org/email-

Spamassassin and amavisd-new wont' check (faked) bounce with zip-archive/exe (maleware)

2015-10-26 Thread Django [BOfH]
Hello list, dear Marc! I had have a "little problem" with a mailsystem. A few days agoe a colleague received over 200 bounce-messages and this over 10 minutes. O.K., that was all backscatter from a software-company in Redmond :( All those messages had have an attachment (zip archive) with malewar

Re: Spamassassin install on Centos 7

2015-10-26 Thread Django [BOfH]
Griasde Harald, Am 22.10.2015 um 17:46 schrieb Reindl Harald: > Trying to install and run spamassassin on Centos 7. Been using Centos 6. > But things have changed. Have you tried to read this: https://dokuwiki.nausch.org/doku.php/centos:mail_c7:spam_6 https://dokuwiki.nausch.org/doku.php/centos: