Re: SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-10 Thread LuKreme
On 9-Mar-2010, at 02:45, Brian wrote: On Tue, 2010-03-09 at 02:36 -0700, LuKreme wrote: On 08-Mar-10 23:51, Brian wrote: Yes, but that does not answer my question {and is once more Postfix biased} AFAIK Postfix is totally unable to reject mail at SMTP time that Spamassassin decides IS SPAM

Re: SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-10 Thread LuKreme
On 9-Mar-2010, at 05:51, Brian wrote: On Tue, 2010-03-09 at 13:17 +0100, Ralf Hildebrandt wrote: * Brian brel.astersik100...@copperproductions.co.uk: In the year 2010 it is not unreasonable to expect the MTA that takes responsibility for accepting a message to make reasonable checks about

Re: SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-10 Thread LuKreme
On 9-Mar-2010, at 06:50, Brian wrote: Postfix remains an MTA for the 1990's as it is, but that's just a view. If 9x% of the traffic an MTA gets to see is unwanted SPAM, it's not unreasonable to expect a solid and reliable built in mechanism to reject it. My postfix rejects more than 90% of

RE: [sa] Re: SMTP REJECT after DATA (was: SpamAssassin Milter Plugin...)

2010-03-10 Thread R-Elists
Now THAT is off-topic. We are discussing the use of SA at SMTP time. Please stay on-topic for this group, and for this thread. If you actually care to continue, I expect a reasonable response to my arguments about rejection being better than bouncing or silent diversion. Geez, you

[Fwd: Re: rules]

2010-03-10 Thread Martin Gregorie
Sent just to Matt by mistake. Apologies Forwarded Message From: Martin Gregorie mar...@gregorie.org Reply-to: mar...@gregorie.org To: Matt Kettler mkettler...@verizon.net Subject: Re: rules Date: Wed, 10 Mar 2010 12:19:23 + On Tue, 2010-03-09 at 20:52 -0500, Matt Kettler

Re: SMTP REJECT after DATA (was: SpamAssassin Milter Plugin...)

2010-03-10 Thread Charles Gregory
On Wed, 10 Mar 2010, R-Elists wrote: Charles Gregory Quote:Re: [sa] Re: SMTP REJECT after DATA The only efficiency to be gained is to reject as much as possible after the RCPT_TO, before accepting DATA. But for systems like mine, with lousy user cooperation, rejecting some of the mail after DATA

Inconsistent Application of Rules?

2010-03-10 Thread Stephen Carville
I am using spamassassin v 3.2.5 invoked via spamc from Postfix v2.3.3. My local.conf file is pretty basic. The only change is to shut off the FH_DATE_PAST_20XX rules which triggers for every message from Jan 1, 2010 on required_hits 5 report_safe 0 rewrite_header Subject [SPAM]

SpamAssassin Milter Plugin Input Validation Flaw patch

2010-03-10 Thread Robert Schetterer
Hi, an untested patch was written see http://savannah.nongnu.org/bugs/?29136 http://savannah.nongnu.org/support/download.php?file_id=19901 for urgent might try, other should wait until harder tested i think -- Best Regards MfG Robert Schetterer Germany/Munich/Bavaria

Re: Inconsistent Application of Rules?

2010-03-10 Thread John Hardin
On Wed, 10 Mar 2010, Stephen Carville wrote: --- Enter shop here [URL deleted because it causes my message to be rejected] Please publish the entire message including all headers to someplace like pastebin, and send us the link. tests=BAYES_50,RDNS_NONE,URIBL_BLACK Out of curiosity I

Re: [sa] Inconsistent Application of Rules?

2010-03-10 Thread Charles Gregory
On Wed, 10 Mar 2010, Stephen Carville wrote: I've been seeing several emails lately that are being scored low that, from what I know of the SA rules should be scored higher. A recent example was a typical spam message: FROM_STARTS_WITH_NUMS,RCVD_IN_DNSWL_LOW,URIBL_AB_SURBL,URIBL_JP_SURBL,

Body only checking through spamc

2010-03-10 Thread yongke
Hi Is there anyway to use spamc to only check the body section of an email? This is necessary when checking for emails that haven't been sent yet. Please help. -- View this message in context: http://old.nabble.com/Body-only-checking-through-spamc-tp27853336p27853336.html Sent from the

Re: Inconsistent Application of Rules?

2010-03-10 Thread Stephen Carville
On Wed, Mar 10, 2010 at 9:14 AM, John Hardin jhar...@impsec.org wrote: On Wed, 10 Mar 2010, Stephen Carville wrote: --- Enter shop here [URL deleted because it causes my message to be rejected] Please publish the entire message including all headers to someplace like pastebin, and send us

Re: Body only checking through spamc

2010-03-10 Thread Martin Gregorie
On Wed, 2010-03-10 at 09:45 -0800, yongke wrote: Is there anyway to use spamc to only check the body section of an email? This is necessary when checking for emails that haven't been sent yet. This is possible provided that all your users send mail through an MTA that's under your control

Re: Body only checking through spamc

2010-03-10 Thread yongke
Hi Martin Thanks a lot for the reply, the emails our clients sends are under our control and under our MTA. How exactly would I do this though? What I have is just the email body in HTML from our clients, subject, to, etc, and some account information. Do I need to actually get the created

Bogus mails from hijacked accounts

2010-03-10 Thread Dennis B. Hopp
We seem to be having a problem where clients that we interact with regularly are having their hotmail/gmail/yahoo accounts hijacked. We are receiving e-mails from their accounts that legitimately go through the correct servers (hotmail,yahoo, etc.) and so they get passed through our spam filters.

Re: Body only checking through spamc

2010-03-10 Thread Martin Gregorie
On Wed, 2010-03-10 at 11:13 -0800, yongke wrote: Thanks a lot for the reply, the emails our clients sends are under our control and under our MTA. How exactly would I do this though? What I have is just the email body in HTML from our clients, subject, to, etc, and some account information.

Re: Bogus mails from hijacked accounts

2010-03-10 Thread Martin Gregorie
On Wed, 2010-03-10 at 13:37 -0600, Dennis B. Hopp wrote: Obviously we just have to tell the clients that they need to deal with the various e-mail providers, but is there an effective way that I can filter these messages out before my users see them without blacklisting the address? There's

Re: Bogus mails from hijacked accounts

2010-03-10 Thread Dennis B. Hopp
On Wed, 2010-03-10 at 20:22 +, Martin Gregorie wrote: On Wed, 2010-03-10 at 13:37 -0600, Dennis B. Hopp wrote: Obviously we just have to tell the clients that they need to deal with the various e-mail providers, but is there an effective way that I can filter these messages out

Re: Bogus mails from hijacked accounts

2010-03-10 Thread Martin Gregorie
On Wed, 2010-03-10 at 15:08 -0600, Dennis B. Hopp wrote: I meant blacklisting the sender address, not the MTA. From what you're describing the senders are all forged by somebody who bought or stole a list of valid hotmail etc. addresses and the corresponding addresses in your domain, so

My First Spam Mail Today

2010-03-10 Thread Carlos Mennens
OK so today I got my 1st spam email from someone at a yahoo.com email address. Basically SA didn't score it at all and 'Postgray' did it's job. Below are the headers from SA: X-spam-checker-version: SpamAssassin 3.3.0 (2010-01-18) on mail.iamghost.com X-spam-level: X-spam-status: No, score=0.0

Re: Bogus mails from hijacked accounts

2010-03-10 Thread Kris Deugau
Dennis B. Hopp wrote: On Wed, 2010-03-10 at 20:22 +, Martin Gregorie wrote: On Wed, 2010-03-10 at 13:37 -0600, Dennis B. Hopp wrote: Obviously we just have to tell the clients that they need to deal with the various e-mail providers, but is there an effective way that I can filter these

Re: My First Spam Mail Today

2010-03-10 Thread Martin Gregorie
On Wed, 2010-03-10 at 22:17 +, Carlos Mennens wrote: OK so today I got my 1st spam email from someone at a yahoo.com email address. Basically SA didn't score it at all and 'Postgray' did it's job. Below are the headers from SA: Thats not a lot to go on: only a few headers and no message

Re: Bogus mails from hijacked accounts

2010-03-10 Thread David B Funk
On Wed, 10 Mar 2010, Dennis B. Hopp wrote: We seem to be having a problem where clients that we interact with regularly are having their hotmail/gmail/yahoo accounts hijacked. We are receiving e-mails from their accounts that legitimately go through the correct servers (hotmail,yahoo, etc.)