RE: False Negatives

2008-04-18 Thread Koopmann, Jan-Peter
It really doesn't matter to me whether it was on urisbl/surbl when he sent it. I provided what our server marked this as as an example of rules that he could look at as to why it was scored low. Other people that don't use unwanted language may not need it, but in some cases it helps,

Re: Returned mail spam

2008-04-18 Thread Matus UHLAR - fantomas
Richard Smits wrote: Hos safe is it to pump up the score for the ANY_BOUNCE_MESSAGE ? Is it bug free, so I can give it 5 or 10 points ? On 18.04.08 09:19, Jason Haar wrote: So you are wanting to mark ANY bounce, out of office, or mailing-list related email into your organization as spam? If

Different vbounce results between 3.2.2 and 3.2.4

2008-04-18 Thread Stefan Jakobs
Hello list, I have two servers, one is running Spamassassin 3.2.2 and the other one is running 3.2.4. For each I have enabled the vbounce plug-in in v320.pre and have added the following line to my local.cf: whitelist_bounce_relays server.domain.tld If I now send this message

Re: Returned mail spam

2008-04-18 Thread Justin Mason
Matus UHLAR - fantomas writes: Richard Smits wrote: Hos safe is it to pump up the score for the ANY_BOUNCE_MESSAGE ? Is it bug free, so I can give it 5 or 10 points ? On 18.04.08 09:19, Jason Haar wrote: So you are wanting to mark ANY bounce, out of office, or mailing-list related

gpg failure on sa-update due to non-cross-certified key

2008-04-18 Thread McDonald, Dan
I recently installed Mandriva 2008.1 on one of my spamfilters. It includes gpg version 1.4.9. When I try to run sa-update, I get: [EMAIL PROTECTED] ~]$ sudo sa-update Password: gpg: WARNING: unsafe permissions on homedir `/etc/mail/spamassassin/sa-update-keys' gpg: WARNING: unsafe permissions

Re: Different vbounce results between 3.2.2 and 3.2.4

2008-04-18 Thread Matus UHLAR - fantomas
On 18.04.08 12:54, Stefan Jakobs wrote: I have two servers, one is running Spamassassin 3.2.2 and the other one is running 3.2.4. For each I have enabled the vbounce plug-in in v320.pre and have added the following line to my local.cf: whitelist_bounce_relays server.domain.tld If I

Re: gpg failure on sa-update due to non-cross-certified key

2008-04-18 Thread D Hill
Re-download a GPG key and import: wget http://spamassassin.apache.org/updates/GPG.KEY sa-update --import GPG.KEY This is in the wiki: http://wiki.apache.org/spamassassin/SaUpdateKeyNotCrossCertified?highlight=%28update%29 I had the same thing happen and all is well now. -d On Fri, 18

help!

2008-04-18 Thread ToTheCenter.com
Wow, how's that for a vague title. Here's the situation, our server is crashing lately once a week. Purely for fun i decided to stop anything related to mail: 1057 /etc/rc.d/init.d/MailScanner stop 1058 /etc/init.d/sendmail stop 1059 service spamassassin stop Then I ran the TOP

Re: help!

2008-04-18 Thread Robert Schetterer
ToTheCenter.com schrieb: Wow, how's that for a vague title. Here's the situation, our server is crashing lately once a week. Purely for fun i decided to stop anything related to mail: 1057 /etc/rc.d/init.d/MailScanner stop 1058 /etc/init.d/sendmail stop 1059 service spamassassin stop

Re: help!

2008-04-18 Thread DAve
CC'd to the SA list for the archives. ToTheCenter.com wrote: Dave, Admittedly, I'm TOTALLY confused. :) What exactly should I be doing? :) My knowledge of unix is limited. Would you be willing to talk me through it? Would AIM be easier? I am up to my butt in alligators this morning, I

Re: help!

2008-04-18 Thread DAve
ToTheCenter.com wrote: Wow, how's that for a vague title. Here's the situation, our server is crashing lately once a week. Purely for fun i decided to stop anything related to mail: 1057 /etc/rc.d/init.d/MailScanner stop 1058 /etc/init.d/sendmail stop 1059 service spamassassin stop

Re: gpg failure on sa-update due to non-cross-certified key

2008-04-18 Thread McDonald, Dan
On Fri, 2008-04-18 at 13:51 +, D Hill wrote: Re-download a GPG key and import: wget http://spamassassin.apache.org/updates/GPG.KEY sa-update --import GPG.KEY This is in the wiki: http://wiki.apache.org/spamassassin/SaUpdateKeyNotCrossCertified?highlight=%28update%29 I had

Re: ways to react faster to spam attacks

2008-04-18 Thread Benny Pedersen
On Wed, March 19, 2008 13:53, Henrik K wrote: Also: http://ixhash.sourceforge.net/ Using all three lists works great here. it olso calc the md5 sum pr lists :/ so internal it can imho be speeded up by a rewrite :) flow: md5 sum rule test #1 test sum on all lists you define md5 sum rule

Re: gpg failure on sa-update due to non-cross-certified key

2008-04-18 Thread D Hill
On Fri, 18 Apr 2008 at 10:30 -0500, [EMAIL PROTECTED] confabulated: On Fri, 2008-04-18 at 13:51 +, D Hill wrote: Re-download a GPG key and import: wget http://spamassassin.apache.org/updates/GPG.KEY sa-update --import GPG.KEY This is in the wiki:

Extend DNSEval.pm?

2008-04-18 Thread William Taylor
Is there anyway to extend this in DNSEval.pm locally without patching? Maybe with a plugin or something? my @originating = (); for my $header ('X-Originating-IP', 'X-Apparently-From') { my $str = $pms-get($header); next unless $str; push (@originating, ($str =~

Re: Extend DNSEval.pm?

2008-04-18 Thread Justin Mason
William Taylor writes: Is there anyway to extend this in DNSEval.pm locally without patching? Maybe with a plugin or something? my @originating = (); for my $header ('X-Originating-IP', 'X-Apparently-From') { my $str = $pms-get($header); next unless $str; push

Re: Extend DNSEval.pm?

2008-04-18 Thread William Taylor
On Fri, Apr 18, 2008 at 06:22:58PM +0100, Justin Mason wrote: William Taylor writes: Is there anyway to extend this in DNSEval.pm locally without patching? Maybe with a plugin or something? my @originating = (); for my $header ('X-Originating-IP', 'X-Apparently-From') { my

Re: SPF and Hotmail

2008-04-18 Thread Jari Fredriksson
I can't employ what you've told me as upgrading to 3.2.4 is out of the question until I rebuild the mail server (Debian Sarge), but the advice is appreciated. Cheers, Michael Hutchinson I have installed SpamAssassin on Debian Sarge Etch via cpan and no problem has followed. As long as

Another candidate for the hall of Shame: Eschelon

2008-04-18 Thread Philip Prindeville
Well, I got a bunch of spams from 66.213.228.51 about some non-existent stock (that's considered Wire Fraud, and it's a federal felony offense in the US). It was also unsolicited. I went to Eschelon.com, the ISP, and provided them with examples and asked them to shutdown the spammer. They

Re: Another candidate for the hall of Shame: Eschelon

2008-04-18 Thread Arvid Ephraim Picciani
On Saturday 19 April 2008 03:10:42 Philip Prindeville wrote: Which S/X/RBL would be most effective in this case? spamhaus. If it's a known spammer, the ISP will get in trouble pretty fast. No clue how you submit anything to them though :/ mabe they already know, if the problem is big enough. If