Re: Bug or feature? ;-)

2019-03-25 Thread Henrik K
On Mon, Mar 25, 2019 at 08:42:50PM +0100, Axb wrote: > > seems to me everybody is making an effort in disregarding the fact that the > URI rule was hitting on a header and imo, that should not happen. > This makes the whole uri behaviour even more unpredictable. As already was established, all

Re: Filtering at border routers: Is it possible?

2019-03-25 Thread
On 25 Mar 2019, at 09:49, Matus UHLAR - fantomas wrote: > I can't see anywhere how smtps could mean multicast audio. That may have been a different use for port 465? I was operating from memory. I wasn't trying to do a ton of research on this. The point is 465 was a MSFT thing that they did

Re: Filtering at border routers: Is it possible?

2019-03-25 Thread Dave Warren
On 2019-03-22 21:43, Grant Taylor wrote: On 3/22/19 7:01 PM, Dave Warren wrote: To me, the big one is this: It sets your users up for failure. If a user configures their client on a network that allows unrestricted port 25 access and later moves (temporarily or permanently) to a network that

Re: track messages

2019-03-25 Thread Martin Gregorie
On Mon, 2019-03-25 at 13:49 -0600, Rick Gutierrez wrote: > > https://pastebin.com/nsJ4PUBM > I'd use awk to extract information from logs like that rather than messing around with an assemblage of grep and sed held together with bash glue: its exactly the sort of job that awk was written to

Fwd: track messages

2019-03-25 Thread Rick Gutierrez
El lun., 25 mar. 2019 a las 14:28, Grant Taylor () escribió: > > It looks like the spam-tag log may have part of what you want. > > awk '($7 == "spam-tag," && $11 == "Yes,"){print "From: " $8; print "To: > " $10; print "Score: " $12}' > > I don't know how well it will paly when you have multiple

Re: Bug or feature? ;-)

2019-03-25 Thread John Hardin
On Mon, 25 Mar 2019, Henrik K wrote: On Mon, Mar 25, 2019 at 06:49:49PM +0100, Tobi wrote: You could try something nasty like uri __HAS_URI /./ tflags __HAS_URI multiple meta __REALLY_HAS_URI (DKIM_SIGNED && __HAS_URI > 1) || (!DKIM_SIGNED && __HAS_URI) Efficiency note: if you're only

Re: track messages

2019-03-25 Thread Grant Taylor
On 3/25/19 1:49 PM, Rick Gutierrez wrote: https://pastebin.com/nsJ4PUBM It looks like the spam-tag log may have part of what you want. awk '($7 == "spam-tag," && $11 == "Yes,"){print "From: " $8; print "To: " $10; print "Score: " $12}' I don't know how well it will paly when you have

Re: Bug or feature? ;-)

2019-03-25 Thread Luis E. Muñoz
On 25 Mar 2019, at 13:02, David B Funk wrote: For example, I've seen increasing amounts of spam which contain cloud based URLs in the body of the message (worthless for URIBL filtering) which may also contain URLs in the headers that are specific to the spammer source (thus viable targets for

Re: Bug or feature? ;-)

2019-03-25 Thread David B Funk
On Mon, 25 Mar 2019, Axb wrote: On 3/25/19 7:01 PM, Henrik K wrote: On Mon, Mar 25, 2019 at 06:49:49PM +0100, Tobi wrote: Am 25.03.19 um 15:18 schrieb Henrik K: On Mon, Mar 25, 2019 at 03:00:30PM +0100, Tobi wrote: [snip..] uri __HAS_URI /./ tflags __HAS_URI multiple meta

Re: track messages

2019-03-25 Thread Rick Gutierrez
El lun., 25 mar. 2019 a las 9:44, Kris Deugau () escribió: > That looks to be far too complicated for most purposes, and reading back > and forth I don't think it's even intended for the standard spamd > logging; it's looking at log traces from some other SA library caller > entirely. Can you

Re: Bug or feature? ;-)

2019-03-25 Thread Axb
On 3/25/19 7:01 PM, Henrik K wrote: On Mon, Mar 25, 2019 at 06:49:49PM +0100, Tobi wrote: Am 25.03.19 um 15:18 schrieb Henrik K: On Mon, Mar 25, 2019 at 03:00:30PM +0100, Tobi wrote: You are matching "any uri" and expect it to be "reliable"? Perhaps consider first what you are trying to

Re: Bug or feature? ;-)

2019-03-25 Thread Henrik K
On Mon, Mar 25, 2019 at 06:49:49PM +0100, Tobi wrote: > > Am 25.03.19 um 15:18 schrieb Henrik K: > > On Mon, Mar 25, 2019 at 03:00:30PM +0100, Tobi wrote: > > > > You are matching "any uri" and expect it to be "reliable"? Perhaps consider > > first what you are trying to accomplish. Your way

Re: Bug or feature? ;-)

2019-03-25 Thread Tobi
Am 25.03.19 um 15:18 schrieb Henrik K: > On Mon, Mar 25, 2019 at 03:00:30PM +0100, Tobi wrote: > > You are matching "any uri" and expect it to be "reliable"? Perhaps consider > first what you are trying to accomplish. Your way will match mailto: and > strings like perl.pl etc, but perhaps

Re: Bug or feature? ;-)

2019-03-25 Thread Bill Cole
On 25 Mar 2019, at 7:09, Tobi wrote: Hello we're running spamassassin 3.4.2 and have the issue that one of our rules which tests for existence of a url always sez url found for our test message. Although the message body does not contain a url uri __HAS_URI/\S/ After running

Re: Bug or feature? ;-)

2019-03-25 Thread John Hardin
On Mon, 25 Mar 2019, Tobi wrote: Hello we're running spamassassin 3.4.2 and have the issue that one of our rules which tests for existence of a url always sez url found for our test message. Although the message body does not contain a url uri __HAS_URI/\S/ After running

Re: Filtering at border routers: Is it possible?

2019-03-25 Thread Matus UHLAR - fantomas
And didn't Microsoft start using it for their non-standard email in Windows 95? I'm not sure how non-standard Microsoft's use of SMTP-over-TLS (SMTPS / TCP port 465) is. The closest thing I remember to non-standard nature was that they were atypical in their choice of preferring SMTP-over-TLS

Re: track messages

2019-03-25 Thread Kris Deugau
Rick Gutierrez wrote: Hi list , I need to do a trace of all the messages that spamassassin cataloged as spam yesterday, I have found a bash statement but I do not make it work, some idea that it may be failing, I am using centos 6 and spamassassin 3.4.2 grep "$(date +"%b %_d" -d "yesterday")"

Re: Bug or feature? ;-)

2019-03-25 Thread Henrik K
On Mon, Mar 25, 2019 at 02:54:39PM +, RW wrote: > On Mon, 25 Mar 2019 16:18:19 +0200 > Henrik K wrote: > > > On Mon, Mar 25, 2019 at 03:00:30PM +0100, Tobi > > wrote: > > > Hi > > > > > > Am 25.03.19 um 13:25 schrieb Henrik K: > > > > > > > > Use /^https?:/ to find real uris. > > > > >

Re: Bug or feature? ;-)

2019-03-25 Thread RW
On Mon, 25 Mar 2019 16:18:19 +0200 Henrik K wrote: > On Mon, Mar 25, 2019 at 03:00:30PM +0100, Tobi > wrote: > > Hi > > > > Am 25.03.19 um 13:25 schrieb Henrik K: > > > > > > Use /^https?:/ to find real uris. > > > > > > > what if the scheme is ftp (or something else) or fully missing just

Re: Bug or feature? ;-)

2019-03-25 Thread Henrik K
On Mon, Mar 25, 2019 at 03:00:30PM +0100, Tobi wrote: > Hi > > Am 25.03.19 um 13:25 schrieb Henrik K: > > > > Use /^https?:/ to find real uris. > > > > what if the scheme is ftp (or something else) or fully missing just the URI? Then use /^(https?|ftp):/i? Are you expecting more, gopher

Re: Bug or feature? ;-)

2019-03-25 Thread Tobi
Hi Am 25.03.19 um 13:25 schrieb Henrik K: > > Use /^https?:/ to find real uris. > what if the scheme is ftp (or something else) or fully missing just the URI? Think that approach is not so much reliable ;-) Found this config param in the docs "parse_dkim_uris" which defaults to 1. But set it to

Re: Bug or feature? ;-)

2019-03-25 Thread Henrik K
On Mon, Mar 25, 2019 at 12:09:32PM +0100, Tobi wrote: > Hello > > we're running spamassassin 3.4.2 and have the issue that one of our > rules which tests for existence of a url always sez url found for our > test message. Although the message body does not contain a url > > uri __HAS_URI

Re: Filtering at border routers: Is it possible?

2019-03-25 Thread @lbutlr
On 24 Mar 2019, at 19:06, Reindl Harald wrote: > well, given all that technical bullshit you are talking on several lists > at least for 5 years better shut up... I asked you to stop emailing me directly, so stop emailing me directly. -- Well I've seen the Heart of Darkness/Read the writing