Am 03.04.2013 15:50, schrieb Matus UHLAR - fantomas:
On 03.04.13 10:58, Dirk Bonengel wrote:
Are those your users sending lots of mails? Then what is the point in
submitting them to SpamAssassin? Bypassing SA might save your lots of
trouble (and ressources)
scanning outgoing mail by SA can
the extra overhead.
Are those your users sending lots of mails? Then what is the point in
submitting them to SpamAssassin? Bypassing SA might save your lots of
trouble (and ressources)
My 2 €-Cent
Dirk
eating up CPU.
Bernd Holzinger (regex Part 1) and Jan Schmidt proposed a modified
regular expression that prevents Perl from sometimes excessive
backtracking...
All users of iXhash should update to the new version - and thanks a lot
for the guys above for problem reports and fixes.
Dirk
but the old stuff should still work fine
Dirk
the hashes in a
message's metadata - no need to recompute them later on but maybe
storing the hashes actually takes more time)
Dirk
Original-Nachricht
Datum: Tue, 2 Dec 2008 06:30:20 -0600
Von: Chris [EMAIL PROTECTED]
An: users@spamassassin.apache.org
Betreff: Re: Bug in iXhash plugin - fixed version available
On Tuesday 02 December 2008 4:32 am, Dirk Bonengel wrote:
I'm looking into it. Only thing
I'm looking into it. Only thing - seems to work here.
Maybe one of you can send me his .cf file per PM?
Dirk
Original-Nachricht
Datum: Tue, 02 Dec 2008 09:12:45 +
Von: [EMAIL PROTECTED]
An: Spamass users@spamassassin.apache.org
Betreff: Re: Re: Bug in iXhash plugin
Karsten Bräckelmann schrieb:
On Tue, 2008-12-02 at 11:32 +0100, Dirk Bonengel wrote:
I'm looking into it. Only thing - seems to work here.
The reason why hash one is broken is the workaround introduced into
version 1.5.
$body_copy =~ s/[[:graph:]]+//go;
This can not work.
Hash one
OK, I found the bug.
I just released a fixed release. Thanks to Lars Uhlmann for finding the
culprit and delivering a fix.
Problem was the regular expression checking the IP returned if it
belongs to the 127.x.x.x range.
Hmm, I had this working before
Soryy again for the trouble
Dirk
to circumvent a problem I
had with my Perl's regexp engine.)
Simple replace your old (1.5) plugin with the new one (1.5.1) and
restart/reload SpamAssassin or whatever you use.
This really shouldn't have happened. My apologies.
Dirk
Arthur Dent schrieb:
[
CUT]
Hmmm.. OK I tried another one. This one actually triggered iXhash when I
got
it originally. You can see the original mail (including headers showing
iXhash
report) here:
http://pastebin.ca/1269211
Running it through now it doesn't generate the error that the
other
Perkel - for supporting my little project with
data, computing ressources and valuable time - and also to Host Europe
GmbH and Jan Doberstein who graciously support the iXhash project by
donating server and network ressources.
Dirk
do a 1.5.1
soon)
Otherwise I'm at a loss currently. Just checjked - runs fine on my system.
Dirk
Arthur Dent schrieb:
On Thu, Nov 27, 2008 at 06:05:52PM +0100, Dirk Bonengel wrote:
Folks,
just uploaded a new version of the iXhash plugin to http://ixhash.sf.net.
[Snip]
Thanks - I
Jan Doberstein schrieb:
Wolfgang Zeikat schrieb:
Do others also see that effect with ctyme.ixhash.net?
yes, thats why i added
ixhash_timeout 10
to my configuration (maybe hardware/bandwith on ctyme will be upgraded)
regards
jd
local issue, should be OK by now.
Dirk
Vidar Tyldum Hansen schrieb:
On Sat, Sep 27, 2008 at 05:27:52PM +0200, Vidar Tyldum Hansen wrote:
On Mon, Aug 04, 2008 at 11:13:29PM +0200, Dirk Bonengel wrote:
Hi all,
I'm the author of the iXhash plugin, a piece of code that computes a
variety of 'fuzzy checksums' along the lines
find the plugin?
Also, as Bill noted, I had a few errors in the example config at first. My
bad... either use Chris' version or revisit ixhash.sf.net/example.html
Sorry for the trouble
Dirk
--
Pt! Schon vom neuen GMX MultiMessenger gehört? Der kann`s mit allen:
http://www.gmx.net/de/go
correctly now.
Sorry, Chris, for the trouble, and Danke, Matthias, for pointing Chris
to it.
Dirk
Original-Nachricht
Datum: Fri, 26 Sep 2008 12:31:45 +0200 (CEST)
Von: Benny Pedersen [EMAIL PROTECTED]
An: users@spamassassin.apache.org
Betreff: Re: Important info for iXhash users
On Thu, September 25, 2008 23:48, Dirk Bonengel wrote:
Important news for all users
' for the time being)
Dirk
Chris schrieb:
On Thursday 25 September 2008 4:48 pm, Dirk Bonengel wrote:
Important news for all users of the iXhash plugin and the corresponding
lists.
An exemplary config file can be found at
http://ixhash.sourceforge.net/example.html.
(There you'll find two other iXhash zones - one run
those of you who use the
plugin for feedback. I'd appreciate any comments and information an hit
rates, FPs and such
Thanks in advance
Dirk
Dirk
I just started running iXhash about a week ago on a 3.2.5 SA
I haven't really had enough time to eval the net effects all the way
Original-Nachricht
Datum: Mon, 4 Aug 2008 19:11:09 -0500
Von: Chris [EMAIL PROTECTED]
An: Dirk Bonengel [EMAIL PROTECTED]
Betreff: Re: iXhash plugin and lists - feedback wanted
On Monday 04 August 2008 4:13 pm, Dirk Bonengel wrote:
Hi all,
I'm the author
Original-Nachricht
Datum: Tue, 5 Aug 2008 06:32:03 -0500
Von: Chris [EMAIL PROTECTED]
An: Dirk Bonengel [EMAIL PROTECTED]
CC: users@spamassassin.apache.org
Betreff: Re: iXhash plugin and lists - feedback wanted
On Tuesday 05 August 2008 2:06 am, Dirk Bonengel wrote
of the plugin and call it quits.
I guess this list is the best place to ask those of you who use the
plugin for feedback. I'd appreciate any comments and information an hit
rates, FPs and such
Thanks in advance
Dirk
the current version 1.01. Simply replace the current iXhash.pm
with the new one.
Thanks go out for Karsten for discovering the bug and suggesting the fix.
Dirk
of at first
I promised in an earlier reply to Per that I'll add some more info to
website and archive but give me some time as $iXhash ne $dayjob
Dirk
Biergarten to start the weekend.
Dirk
Per Jessen schrieb:
Dirk Bonengel wrote:
For those that don't know what this plugin does: It uses an algorithm
developed by Bert Ungerer of the German IT magazin iX (Heise Verlag)
to compute fuzzy checksums from (spam) emails and checks them against
those hashes I and Heise computed from
--
Thanks Dirk!
I have a question: two of the RBL zones have very similar names -
nospam.login-solutions.de and nospam.login-solutions.ag. Do they belong
to the same company, and what are the differences between them? Eg. do
they both contain exactly the same data (hashes
and I'll see to it.
Dirk
filtering is extremely
accurate.
OK, that's fair enough. But it also virtually rules out my using
anything from login-solutions(courtesy of Dirk). I can't trust
somebodyelses hashes very much, not unless they are from guaranteed
spamtraps or manually verified.
I'm sending Dirk only hashes. We
that table. If you do let me know - I'd be interested in any
results.
Dirk
in a whitelist the provider has set
up.
Mails should be directed at [EMAIL PROTECTED]
Dirk
Btw, I hear the issue(s) have been solved and ix.dnsbl.manitu.net is
again freely accessible.
set
up.
Mails should be directed at [EMAIL PROTECTED]
Dirk
] and 2 Gig RAM and SCSI disks with 10K. mtop said
at times it makes up to 2K queries per seconds. Should be enough for you
too...
You don't say what your hardware is but tuning and putting in some more
RAM should help
Dirk
DL360 G1 ([EMAIL PROTECTED] and 2 Gig RAM) and SCSI disks with 10K. mtop said
at times it makes up to 2K queries per seconds. Should be enough for you
too...
You don't say what your hardware is but tuning and putting in some more
RAM should help
Dirk
to disable greylisting for the other domains, so this
shouldn't bother them.
This will deter many spambots in the first place
Dirk
, 18. Dezember 2006 16:40
An: Fettke, Dirk
Cc: users@spamassassin.apache.org
Betreff: Re: special spam-account for spam mails
Fettke, Dirk wrote:
Hello List,
here we have a spam-filtering email-gateway with no local
mailboxes. all mails getting scanned only for spam
, 18. Dezember 2006 16:40
An: Fettke, Dirk
Cc: users@spamassassin.apache.org
Betreff: Re: special spam-account for spam mails
Fettke, Dirk wrote:
Hello List,
here we have a spam-filtering email-gateway with no local
mailboxes. all mails getting scanned only for spam
Hi,
I don't know if this works with your solution because I do subject-rewriting in
the amavisd.conf, but my local.cf looks like this (in short form):
# rewrite the Subject: line with SPAM .* if set to 1 (default=1)
rewrite_subject 1
required_score 5
subject_tag
mailboxes which will be automatically generated on our
system. all other mails whith score 5 should forwarded further on.
The Users then could log into their generated spam-account and read or
delete their spam-mails.
How can I do this or is there any solution for this?
Regards
Dirk
[mailto:[EMAIL PROTECTED]
Gesendet: Montag, 18. Dezember 2006 14:35
An: Fettke, Dirk
Betreff: RE: special spam-account for spam mails
this is possible.
the solution you are asking depends on your current hub email server
setup and pop3 servers.
what is current your MTA and POP3 servers
I wonder if its possible to add points to mail coming from certain
hosts. I have exim+spamassassin running for some time now and my
second MX host is hosted at my ISP. Most spam that passes
my filters
are routed via the second mx host. (grrr) I don't want to
ignore the
second host
On Sun, 12 Nov 2006 06:38:42 +0100 (CET)
Benny Pedersen [EMAIL PROTECTED] wrote:
On Sat, November 11, 2006 20:47, Dirk Bonengel wrote:
The fine thing is that you can use the iXhash plugin along razor, pyzor and
dcc. (I don't know if it's possible to use two pyzor servers from within
pyzor servers from within
spamassassin, I think if you set up your own server you automatically lose the
capabilty to use the public one).
HTH
Dirk
On Sat, 11 Nov 2006 03:58:00 -0500
Paul Aviles [EMAIL PROTECTED] wrote:
Hi there, is there a way to create a signature or rule more or less
machine, maybe they have problems.
I'll get in touch with them
Dirk
Chris schrieb:
On Tuesday 24 October 2006 1:55 am, Dirk Bonengel wrote:
Chris schrieb:
I've been seeing this quite a bit lately, is the site down or do the
timeouts need to be increased? Its currently set for the default 10
seconds.
Oct 21 12:28:03 localhost spamd[19162]: ixhash
be content with 'finishing' Spamhaus.
Despite the UN bashing common in some parts of the American continent I
maintain that an organisation like the ITU (www.itu.int) would be the
right body to administer supra-national domains like .org, .and .net
(even .com).
My 2 (Euro-)Cent
Dirk
there.
Maybe so. But it sure will be more expensive for most spammers to rent
10 times as many machines.
decoder, I'd like a test your code as well. Count me in
Dirk
it? If yes, could this be used as another
spam indicator (assuming a normal user would use some graphics tool that
produces correctly built GIFs)??
Dirk
that...
Shrinking it to, say, a quarter of it's original size would take care of
at least many random noise pixels.
Dirk
Just read up at http://www.maiamailguard.com/, but: yes, each and every
mail is stored in a database.
Ham/Non-virus-mails get delivered at once though, only a copy is getting
stored in the db
Dirk
Chr. v. Stuckrad schrieb:
On Tue, 18 Jul 2006, Dirk Bonengel wrote:
...
If I was in your
is your results from
the plugin.
Dirk
Rick Macdougall schrieb:
Rick Macdougall wrote:
Daryl C. W. O'Shea wrote:
Rick Macdougall wrote:
Further, I don't know why it even uses it's own DNS resolver. It
would make much more sense to use SA's and do all this in the
background.
I'm just
is
for you
Dirk
Dallas Engelken schrieb:
-Original Message-
From: Rick Macdougall [mailto:[EMAIL PROTECTED]
Sent: Monday, July 10, 2006 11:59
To: [EMAIL PROTECTED]
Cc: users@spamassassin.apache.org
Subject: Re: Strange problem
Sanford Whiteman wrote:
Both servers have exactly
' be to hard to
work around that
Dirk
[EMAIL PROTECTED] schrieb:
I am running SpamAssassin on a Windows 2003 Server.
It is version 3.1.2.
Is there any way to know which plugins work on the Windows version?
The Windows setup instructions at
http://www.openhandhome.com/howtosa310.html
seems to say
and the like, but as
I live in Munich, I don't see me uploading content as long as the World
Cup is on. Saturday I witnessed a Saudi-Arabian/Brazilian drumming
session at the Marienplatz - no, I'd rather not spend much time on
my PC!!
Dirk
Nice to hear! But: Don't blame me if you get a FP due to iXhash.
Did you set up all three lists, btw? (i.e. manitu.net,
login-solutions.de and login-solutions.ag ??)
Dirk
Marc Perkel schrieb:
So far so good. This is as you say very accurate. I increased the
score to 4.5. No FPs so far
Wolfgang,
I guess you already use spamassassin (why else post to this particular
list?). Make sure you use a recent release (3.1.3 is current) and the
rules from rulesemporium.com.
But apart from that I'd need more info
Hope this helps!
Servus
Dirk
[EMAIL PROTECTED] schrieb:
Hi all
Hi list,
just as the subject says: I added some stuff to
http://wiki.apache.org/spamassassin/iXhash and
- made it clear (I hope) what it actually does
- added installation instructions
- added a version that runs under SpamAssassin 3.0.x
Dirk
Marc,
just drop both files (.cf and .pm) into the directory where your
local.cf is.
One important piece of (missing) info: You must be running SA v 3.1.0 or
higher (not 3.0 as stated). If this is a problem I can easily post a
version working with 3.0.x
Dirk
Marc Perkel schrieb:
Matt
, if disired I can post that plugin somewhere (with appropriate
words of caution)...
Dirk
John D. Hardin schrieb:
All:
A few posts back was a suggestion for checking the MD5 checksum of
attached images against a blacklist to catch the current wave of
attached-image-only stock pump-and-dump scam
in fact do contain text and/or html code, and the
above mentioned plugins can score on that. At least that's what I see here
SURBL and URIBL are nice to have to but fail with stock spam that's
often sent as 'image only'
Dirk
Matt schrieb:
Hi,
We have received a large quantity of spam that is nothing
/spamassassin/iXhash.
If not, enhancing it to also compute checksums of attachments would be
nice to have. If only I had the time...
Dirk
William Stearns schrieb:
Good evening, Jack, all,
On Tue, 7 Mar 2006, Jack Gostl wrote:
I've seen some references to this in threads, but I didn't see an
answer
Hi,
You need to restart amavisd-new which uses the spamassassin-classes
internally.
So no need to run spamd (if you do).
Applies only if you do spamchecking via amavisd-new, of course
Dirk
Tom Brown schrieb:
Hi
I have been manually tweaking some rules to increase their score
-new and stores spam in a database for
later review.
Presumed Ham is also stored in the DB but passed on to the final
destination. Great setup to train one bayes...
Dirk
Jean-Paul Natola schrieb:
Hi everyone,
If this shouldn't be posted here I do apologize in advance;
I would like
spamassassin have the rights to actually access his
database???
just my two euro-cent
Dirk
If I use spamassassin -D --lint then it reveals that I'm at 3.0.2
I have posted the x-spam-status from 15 messages at
http://www.meehanontheweb.com/xspamstatus.txt
(the software_spam_rule, which looks
-new correctly, so there you are.
Dirk
Jaime Aguado schrieb:
Hi all, I have spamassassin 2.64 running on a SuSE Enterprise 9 running
postfix as smtpd.
My spamassassin system is leaking most spam messages (60-80%) without
tagging them.
I have done some configuration tests:
# spamassassin --lint
changes in some places.
If you use amavisd-new then enable network tests (or disable the
local-tests-only-option) in the amavis config
HTH
Dirk
Jaime Aguado schrieb:
Hi all, I have spamassassin 2.64 running on a SuSE Enterprise 9 running
postfix as smtpd.
My spamassassin system is leaking most
Have a lokk at Maia Mailguard:
http://www.renaissoft.com/maia/
Basically it's an enhanced version of amavisd-new and also allows the
users to maintain their own whitelists.
David Benigni schrieb:
Hello,
I've been searching for an application to manage per user quarantines
with SA.
different spam rules, white- and blacklists.
I searched google, but haven't find anything for use.
What have i to do, to realize these requirements?
Thanks
Dirk
mailboxes.
Is there a possibility to do this with spamassassin?
It can't be so difficult, or?
Thanks
Dirk
it will be delivered to my mailbox.
Any other ideas?
Greetings
Dirk
-Ursprüngliche Nachricht-
Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Gesendet: Montag, 15. August 2005 15:41
An: users@spamassassin.apache.org
Cc: Fettke, Dirk
Betreff: Re: filter for subjects
Hi,
I become
Thanks for the clarification.
Dirk
Rob Skedgell schrieb:
On Saturday 13 Aug 2005 12:29, Dirk Bonengel wrote:
FYI:
rfc-ignorant.org has .de listed in whois.rfc-ignorant.com.
http://www.rfc-ignorant.org/tools/detail.php?domain=desubmitted=1120996396table=whois
In a standard 3.0.x
...
Dirk
In an older episode (Friday, 12. August 2005 01:46), Dallas L. Engelken
wrote:
-Original Message-
From: wolfgang [mailto:[EMAIL PROTECTED]
Sent: Thursday, August 11, 2005 6:36 PM
To: users@spamassassin.apache.org
Subject: Re: Phishing IP listed in URIBL and SURBL
is that SA/SURBL (3.0.4) does apparently not try to
lookup IPs, only domains.
Dirk
Raymond Dijkxhoorn schrieb:
Hi!
What about false positives? 158.194.144.219 apparently belogs to Palacky
University in Olomouc,Czechia. This IP is now wrongfully listed in
SURBL!
I'll post that problem
Well, the IP is listed OK, but one needs to do reverse queries:
dig 158.194.144.219.multi.surbl.org
gives
158.194.144.219.multi.surbl.org. 1850 IN A 127.0.0.12
which sounds good to me.
Dirk
Chris Santerre schrieb:
-Original Message-
From: wolfgang [mailto:[EMAIL PROTECTED]
Sent
.
wolfgang schrieb:
In an older episode (Thursday, 11. August 2005 22:46), Dirk Bonengel wrote:
Well, the IP is listed OK, but one needs to do reverse queries:
dig 158.194.144.219.multi.surbl.org
gives
158.194.144.219.multi.surbl.org. 1850 IN A 127.0.0.12
which sounds good to me
is special only in that there is only the IP given as a type of
surrogate domain name.
Dirk
wolfgang schrieb:
In an older episode (Thursday, 11. August 2005 22:58), Greg Allen wrote:
This is a very, very dangerous road to go down. You would see a lot of
collateral damage by doing a URIBL
not being able to
resolve 219.144.194.158.multi.surbl.org, and that's true.
The zone files contain an entry for 158.194.144.219.multi.surbl.org,
which - to me at least - is wrong as SA is douing forward lookups on it.
Dirk
Title: Blocking specific domains
Hi,
I have installed postfix with amavisd, spamassassin, pyzer and razor.
My problem is now, that spam-mails from a specific domain don't get filtered.
When I insert following command in the local.cf file from spamassassin, the entry will be ignored
and
and report some
results? I, for my part, was surprised to find the spam that hit us to
be apparently quite different from that hitting iX.
BTW: Both tests against our and iX's blacklist hit about 50% of all
incoming mails, and I've still to find a false positive. For me, this works.
Dirk
PS: I think
:
Hi Dirk,
Dirk Bonengel wrote:
Hi all,
maybe this list can give me some feedback on a plugin I've written a
few weeks ago.
The Plugin is based on parts of the 'NiXSpam' project by the German
IT magazine iX. NiXSpam is an elaborate procmail recipe (for more
info see http://www.heise.de/ix
willing to experiment is welcome, expecially Sven, the original
poster (who lives in Munich just like I do- the world's a small
place...). More info to be found at the wiki.
Dirk
Rob Skedgell schrieb:
On Sunday 10 Jul 2005 06:41, William Stearns wrote:
Good evening, all,
On Thu, 9 Jun 2005
is it looking, and how do
I give it what it wants?
Dirk
/user_prefs
Dirk
=5
debug: tests=ALL_TRUSTED,MISSING_DATE,MISSING_SUBJECT,NO_REAL_NAME
debug:
subtests=__HAS_MSGID,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__SANE_MSGID,__UNUSABLE_MSGID
Dirk
perl modules installed.
Once you get those installed SA will give you a better
analysis of what is spam and what is not.
Thanks. Its on The List of Things To Do. Right now, I'd be happy to
get it up and running in a basic fashion.
Dirk
On Thu, 23 Jun 2005, Andy Jezierski wrote:
Dirk the Daring [EMAIL PROTECTED] wrote on 06/23/2005 02:36:21 PM:
I don't want SA to create things in home directories. This is a mail
relay. There are no local user accounts, mail is not delivered locally.
SA should only use system-wide
-detect SA at run-time, and will use it
if it finds it.
But the install process for MD still did not copy the config file
that MD wants for SA. It would have done it if SA had been installed
when MD was installed, but I ended up having to do it manually.
Dirk
The System:
Solaris 8 on Sparc
Perl v5.8.5 (with ExtUtils::MakeMaker v6.17 and podlators v1.27)
gcc v3.3.2
The Problem:
Despite having Pod::Man installed, no man pages get installed (or
even created, as far as I can tell). How can I get the man pages
created?
Dirk
with qmail-scanner
normally, but I am not the one configuring the mail-server...
Thanks for any help
Dirk
--
Dipl.-Ing. Dirk Kuypers
Lehrstuhl fuer Kommunikationsnetze, RWTH Aachen
Kopernikusstr. 16, 52074 Aachen, W101
Tel: +49 241 879 3779, RWTH: +49 241 (80) 20547
show up
as 'not listed'
And I already wondered ...
Beste Grüsse
Dirk Bonengel
92 matches
Mail list logo
