Re: Abused accounts

2016-03-19 Thread Ted Mittelstaedt
That is a little different. Google makes it clear to colleges and universities that their mail system is not to be used for HIPAA stuff there is no guarantee of privacy. This is different than a run-of-the-mill class. There are legal restrictions in place on medical communications and in

Re: new(ish) malware: RTF with MIME payload

2016-03-19 Thread Jari Fredriksson
Joseph Brennan kirjoitti 18.3.2016 18:48: Today's version has a Subject of this form: FW: Notification from WORD WORD ...where WORD WORD varies per message but is always all caps. The three Content-Type lines Chip mentioned are the same, and they are the only ones that should be used for rtf.

Unable to resolve localhost

2016-03-19 Thread Alarig Le Lay
Hi, The daily spamassasin cron is failing because localhost is an unresolvable name: /etc/cron.daily/spamassassin: unresolvable name: localhost at /usr/bin/sa-update line 432. sa-update failed for unknown reasons But, I can perfectly ping it (and by the way, resolve it):

new(ish) malware: RTF with MIME payload

2016-03-19 Thread Chip M.
Starting about two hours ago, more than 80% of my real-time honeypot spam is a new malware campaign. Full spample (with redacted/munged email addresses and Message-ID): http://puffin.net/software/spam/samples/0039_mal_rtf_mime.txt This is a variation on an XML file malware campaign that

Re: Unable to resolve localhost

2016-03-19 Thread Jari Fredriksson
Alarig Le Lay kirjoitti 17.3.2016 9:53: Hi, The daily spamassasin cron is failing because localhost is an unresolvable name: /etc/cron.daily/spamassassin: unresolvable name: localhost at /usr/bin/sa-update line 432. sa-update failed for unknown reasons But, I can

Re: Abused accounts

2016-03-19 Thread RW
On Tue, 15 Mar 2016 17:47:51 -0700 Ted Mittelstaedt wrote: > On 3/15/2016 5:14 PM, Reindl Harald wrote: > > > > > > a lot of nosense > > > > * nobody is talking about throw away *any* other rules > > Uh, why yes, they are: > > "Some other systems such as isnotspam.com caught some SA rule

Re: Unable to resolve localhost

2016-03-19 Thread Reindl Harald
Am 17.03.2016 um 12:36 schrieb Alarig Le Lay: $ host localhost localhost has address 127.0.0.1 localhost has IPv6 address ::1 What does THAT say in your box? Seems normal: ;; ANSWER SECTION: localhost. 10800 IN A 127.0.0.1 ;; Query time: 0 msec ;; SERVER:

Re: new(ish) malware: RTF with MIME payload

2016-03-19 Thread Joseph Brennan
Today's version has a Subject of this form: FW: Notification from WORD WORD ...where WORD WORD varies per message but is always all caps. The three Content-Type lines Chip mentioned are the same, and they are the only ones that should be used for rtf. The name is similar, repeating the same

Re: new(ish) malware: RTF with MIME payload

2016-03-19 Thread Reindl Harald
Am 18.03.2016 um 09:39 schrieb Cedric Knight: On 17/03/16 19:31, Chip M. wrote: On 17/03/16 19:46, Reindl Harald wrote: /var/www/uploadtemp/8044012e4e9b882b3c7643489c05df73e5cf6dcf.eml: Sanesecurity.Malware.26034.XmlHeurGen.AM.UNOFFICIAL FOUND Yes, Sanesecurity is great... this detects

Re: Unable to resolve localhost

2016-03-19 Thread RW
On Thu, 17 Mar 2016 08:53:52 +0100 Alarig Le Lay wrote: > Hi, > > The daily spamassasin cron is failing because localhost is an > unresolvable name: > > /etc/cron.daily/spamassassin: > unresolvable name: localhost at /usr/bin/sa-update line 432. > sa-update failed for unknown

Re: Abused accounts

2016-03-19 Thread Dave Warren
On 2016-03-15 14:15, Ted Mittelstaedt wrote: I agree with you on that one. There's a big push among colleges to push students to use their "blessed" mailsystems. They don't want students emailing instructors from the student's gmail account, they want the students emailing the instructors

Re: Bayes expiry vs. sync, again

2016-03-19 Thread RW
On Tue, 15 Mar 2016 18:00:22 -0700 Ian Zimmerman wrote: > I am sorry to return to this horse which has perhaps been beaten > enough. But I still don't know and don't understand (_after_ reading > the docs) if I can, at the same time: > > 1. completely disable expiry You can only disable