RE: [LinkedIn Spam] Re: unwhitelist from_dkim?

2010-03-22 Thread SM
At 15:11 19-03-10, Chris Richman wrote: If anyone knows of a reliable way to identify mailing list addresses, I'd love to know so we could block mail to them. Currently, we just do it when it's reported to us. I suppose one approach might be to block list.* domains or email addresses in the

Re: Installation error on Windows Server 2008 / 64-bit

2010-03-22 Thread Daniel Lemke
Bret Miller-4 wrote: I worked on it for a while on Windows Server 2008R2, and concluded that I was not going to get it running in 64-bit ActivePerl. There were just too many dependencies that would not compile or were missing features in x64 mode. So I cleared it all off, reinstalled

Re: Pathological messages causing long scan times

2010-03-22 Thread Jakob Hirsch
John Hardin, 2010-03-21 01:01: The offending rule is FILL_THIS_FORM_LONG from 72_active.cf. I'll look into it. Fix is in local masscheck testing. Fix committed. But not online yet? At least not with 3.3.1's sa-update, it still takes nearly 5 minutes to scan this message (last hit is

Re: [LinkedIn Spam] Re: unwhitelist from_dkim?

2010-03-22 Thread Matus UHLAR - fantomas
At 15:11 19-03-10, Chris Richman wrote: If anyone knows of a reliable way to identify mailing list addresses, I'd love to know so we could block mail to them. Currently, we just do it when it's reported to us. I suppose one approach might be to block list.* domains or email addresses in the

Re: spamassassin-3.3.1 RPM packages for Fedora and RHEL5

2010-03-22 Thread Kai Schaetzl
Warren Togami wrote on Sun, 21 Mar 2010 22:13:10 -0400: I highly recommend NOT building the RPM package from the spec file contained within the spamassassin tarball. It has never been tested to work on Fedora or Red Hat Enterprise Linux. Well, it works perfectly on CentOS, so I assume on

Rules correct ?

2010-03-22 Thread Stephane MAGAND
Hi i am new in Spamassassin, anyone can say me if this rules are correct ? header MY_FILTRAGE_FROM_93 From =~ /txxa\.px...@makk\.fi/ header MY_FILTRAGE_TO_93 To =~ /exxent\.net/ meta MY_FILTRAGE_93 (MY_FILTRAGE_FROM_93 MY_FILTRAGE_TO_93) score MY_FILTRAGE_93 200 (xx

Re: Rules correct ?

2010-03-22 Thread Ned Slider
Stephane MAGAND wrote: Hi i am new in Spamassassin, anyone can say me if this rules are correct ? header MY_FILTRAGE_FROM_93 From =~ /txxa\.px...@makk\.fi/ header MY_FILTRAGE_TO_93 To =~ /exxent\.net/ meta MY_FILTRAGE_93 (MY_FILTRAGE_FROM_93 MY_FILTRAGE_TO_93) score

Re: Rules correct ?

2010-03-22 Thread Ned Slider
Ned Slider wrote: Stephane MAGAND wrote: Hi i am new in Spamassassin, anyone can say me if this rules are correct ? header MY_FILTRAGE_FROM_93 From =~ /txxa\.px...@makk\.fi/ header MY_FILTRAGE_TO_93 To =~ /exxent\.net/ meta MY_FILTRAGE_93 (MY_FILTRAGE_FROM_93

Re: Pathological messages causing long scan times

2010-03-22 Thread Mark Martinec
On Monday March 22 2010 11:49:22 Jakob Hirsch wrote: Btw, shouldn't --timeout-child on spamd limit the time spent? I have set it to 30, but that does not seem to work. The signal handling in 3.3 is left at perl default of 'safe handling', which means that alarm signal cannot interrupt

Re: Rules correct ?

2010-03-22 Thread Joseph Brennan
header__MY_FILTRAGE_TO_93 To =~ /\...@exxent\.net/i This matches if @exxent.net is in the To: header line. It doesn't match all mail sent to recipients at exxent.net-- only mail with their address in the To: header line. Of course this may be exactly what you want to do. Joseph

Re: need to uninstall Spamassassin 3.3.1

2010-03-22 Thread John Hardin
On Sun, 21 Mar 2010, Security Admin (NetSec) wrote: Have tried upgrading Spamassassin 3.2.5 to 3.3.1 and the result was a disaster. Currently have the spamassin* of one version and perl-Mail-spamassassin* of another. Precisely how did you go about upgrading? If you upgrade using a different

Re: Botnet plugin still relevant?

2010-03-22 Thread micah anderson
On Wed, 17 Mar 2010 14:45:53 -0700, John Rudd jr...@ucsc.edu wrote: Some people need to put in some alternate values for DNS timeouts, but if you've got a local caching name server, you typically don't need that. There aren't any actual bugs in it that I'm aware of, so I haven't released a

FREEMAIL_REPLY

2010-03-22 Thread Jason Bertoch
I recently received a FP complaint on a message that hit FREEMAIL_REPLY. The FP complaint is not in a format that would be useful for posting, but I don't believe that's going to be necessary. Here's what happened: some_u...@comcast.net saves a web page and sends it as an e-mail

Re: Botnet plugin still relevant?

2010-03-22 Thread Jari Fredriksson
On 22.3.2010 16:51, micah anderson wrote: On Wed, 17 Mar 2010 14:45:53 -0700, John Rudd jr...@ucsc.edu wrote: Some people need to put in some alternate values for DNS timeouts, but if you've got a local caching name server, you typically don't need that. There aren't any actual bugs in it

RE: Sa-update

2010-03-22 Thread Kaleb Hosie
In my environment, postfix passes the message onto the exchange server so once it releases the message, I don't have anything to train bayes with since it's deleted. Add an 'always_bcc' directive to your Postfix configuration to grab a copy of all mail passing through it and send it to a

Re: Botnet plugin still relevant?

2010-03-22 Thread John Rudd
On Mon, Mar 22, 2010 at 07:51, micah anderson mi...@riseup.net wrote: From a user who has unfortunately been saddled with a dynamic IP that previously was used by a spammer. No amount of explanation to these users about this is going to assuage their feelings, and there isn't really anything

Re: Yahoo/URL spam

2010-03-22 Thread Charles Gregory
On Mon, 22 Mar 2010, Alex wrote: rawbody __BODY_ONLY_URI /^[^a-z]{0,10}(http:\/\/|www\.)(\w+\.)+(com|net|org|biz|cn|ru)\/?[^ ]{0,20}[^a-z]{0,10}$/msi This allows for some amount (up to ten chars?) of text before and after the URI if I'm reading that right, correct? Nope. With the /ms flags ^

Re: Botnet plugin still relevant?

2010-03-22 Thread John Hardin
On Mon, 22 Mar 2010, micah anderson wrote: Many users are complaining and when I finally get some useful messages with headers to analyze I am finding something like the following: X-Spam-Report: * 3.3 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL * [213.6.61.151

Re: FREEMAIL_REPLY

2010-03-22 Thread John Hardin
On Mon, 22 Mar 2010, Jason Bertoch wrote: Should FREEMAIL_REPLY really be looking in attachments Sure. Just looking at the presence of freemail domains, there's nothing to distinguish the mail you got an FP report on from 419 spams that put the pitch and reply address in an attachment.

Re: FREEMAIL_REPLY

2010-03-22 Thread Jason Bertoch
On 2010/03/22 12:26 PM, John Hardin wrote: On Mon, 22 Mar 2010, Jason Bertoch wrote: Should FREEMAIL_REPLY really be looking in attachments Sure. Just looking at the presence of freemail domains, there's nothing to distinguish the mail you got an FP report on from 419 spams that put the

Re: Botnet plugin still relevant?

2010-03-22 Thread Joseph Brennan
micah anderson mi...@riseup.net wrote: Yeah, I've been having problems recently which I think are related to me using both Zen/PBL along with the Botnet plugin weighted to score level 5, even if I were to have it lower at 3 it would still be too much. Are you using the PBL appropriately?

Re: FREEMAIL_REPLY

2010-03-22 Thread John Hardin
On Mon, 22 Mar 2010, Jason Bertoch wrote: On 2010/03/22 12:26 PM, John Hardin wrote: On Mon, 22 Mar 2010, Jason Bertoch wrote: Should FREEMAIL_REPLY really be looking in attachments Sure. Just looking at the presence of freemail domains, there's nothing to distinguish the mail you got

Re: spamassassin-3.3.1 RPM packages for Fedora and RHEL5

2010-03-22 Thread Bill Landry
On Mon, March 22, 2010 9:01 am, Bill Landry wrote: On 3/22/2010 4:31 AM, Kai Schaetzl wrote: Warren Togami wrote on Sun, 21 Mar 2010 22:13:10 -0400: I highly recommend NOT building the RPM package from the spec file contained within the spamassassin tarball. It has never been tested to work

Re: FREEMAIL_REPLY

2010-03-22 Thread Jason Bertoch
On 2010/03/22 1:03 PM, John Hardin wrote: On Mon, 22 Mar 2010, Jason Bertoch wrote: On 2010/03/22 12:26 PM, John Hardin wrote: On Mon, 22 Mar 2010, Jason Bertoch wrote: Should FREEMAIL_REPLY really be looking in attachments Sure. Just looking at the presence of freemail domains, there's

Re: Botnet plugin still relevant?

2010-03-22 Thread RW
On Mon, 22 Mar 2010 10:51:20 -0400 micah anderson mi...@riseup.net wrote: Yeah, I've been having problems recently which I think are related to me using both Zen/PBL along with the Botnet plugin weighted to score level 5, even if I were to have it lower at 3 it would still be too much. If

Re: spamassassin-3.3.1 RPM packages for Fedora and RHEL5

2010-03-22 Thread Kris Deugau
Kai Schaetzl wrote: Well, it works perfectly on CentOS, so I assume on RHEL as well. And it doesn't contain unwanted dependencies (like the one from rpmforge I'm curious about these unwanted dependencies, since I've never had trouble with that using the RPMForge package. About the only

Re: Botnet plugin still relevant?

2010-03-22 Thread Kai Schaetzl
Micah anderson wrote on Mon, 22 Mar 2010 10:51:20 -0400: This brings it over the 8 threshold, although it is a legitimate email From a user who has unfortunately been saddled with a dynamic IP Most ISPs reject direct mail from non-static IP addresses nowadays. If you combine this with John

Re: spamassassin-3.3.1 RPM packages for Fedora and RHEL5

2010-03-22 Thread Kai Schaetzl
Bill Landry wrote on Mon, 22 Mar 2010 09:01:26 -0700: I tried it with Fedora 12 I didn't say anything about Fedora. Kai -- Get your web at Conactive Internet Services: http://www.conactive.com

Re: spamassassin-3.3.1 RPM packages for Fedora and RHEL5

2010-03-22 Thread Bill Landry
On Mon, March 22, 2010 10:31 am, Kai Schaetzl wrote: Bill Landry wrote on Mon, 22 Mar 2010 09:01:26 -0700: I tried it with Fedora 12 I didn't say anything about Fedora. But Warren certainly did in his original post. And BTW, he didn't say anything about CentOS is his original post, but that

Re: Installation error on Windows Server 2008 / 64-bit

2010-03-22 Thread weirdbeardmt
Actually, I was using the x64 bit version of AP, hence the need to use the CPAN route for NetAddr-IP as I couldn't find a repo that included it for x64. Have tried your suggestions below using x86 AP, and, still not working. Nmake fails with the same error. quote=Error optional module missing:

Re: Botnet plugin still relevant?

2010-03-22 Thread John Hardin
On Mon, 22 Mar 2010, Kai Schaetzl wrote: Micah anderson wrote on Mon, 22 Mar 2010 10:51:20 -0400: This brings it over the 8 threshold, although it is a legitimate email From a user who has unfortunately been saddled with a dynamic IP Most ISPs reject direct mail from non-static IP addresses

Re: Installation error on Windows Server 2008 / 64-bit

2010-03-22 Thread John Hardin
On Mon, 22 Mar 2010, weirdbeardmt wrote: What else can I try? Running it on a *NIX box like God intended? GDR... :) To be serious, have you considered setting up a Linux VM that is dedicated to hosting spamd? -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/

Re: Installation error on Windows Server 2008 / 64-bit

2010-03-22 Thread Bret Miller
I didn't try to make spamc with mine. If you're doing that, it is possible that there could be a configuration situation that prevents it. I'm not sure why else it would fail. For the few items I had to manually compile and install I used Visual Studio 2008 Express. Bret On 3/22/2010 10:40

Re: Botnet plugin still relevant?

2010-03-22 Thread Kai Schaetzl
John Hardin wrote on Mon, 22 Mar 2010 10:47:35 -0700 (PDT): How do you reject mail from a non-static IP without doing a DNSBL lookup (e.g. Zen)? we are talking about lookups from SA here ;-) And these you can disable if you reject such mail, anyway. Kai -- Get your web at Conactive

Re: Installation error on Windows Server 2008 / 64-bit

2010-03-22 Thread weirdbeardmt
If only it was that simple. SA is actually required as a component of a bigger system which actually has NO business being near a Windows server, but unfortunately our sys admin team have no experience of admin-ing Linux... nor any desire to learn. So I'm afraid I'm stuck with it. What is

Re: spamassassin-3.3.1 RPM packages for Fedora and RHEL5

2010-03-22 Thread Kai Schaetzl
Kris Deugau wrote on Mon, 22 Mar 2010 13:25:34 -0400: I'm curious about these unwanted dependencies, since I've never had trouble with that using the RPMForge package. I can't tell you as this was at least one year ago. I would have to change my priorities settings and then pull down an rpm

Re: spamassassin-3.3.1 RPM packages for Fedora and RHEL5

2010-03-22 Thread Kai Schaetzl
Bill Landry wrote on Mon, 22 Mar 2010 10:37:12 -0700: But Warren certainly did in his original post. If you didn't reply to me I would ask you to reply to the message you reply to instead and don't quote me ;-) And BTW, he didn't say anything about CentOS is his original post, but that

Re: Installation error on Windows Server 2008 / 64-bit

2010-03-22 Thread John Hardin
On Mon, 22 Mar 2010, weirdbeardmt wrote: John Hardin wrote: To be serious, have you considered setting up a Linux VM that is dedicated to hosting spamd? If only it was that simple. SA is actually required as a component of a bigger system which actually has NO business being near a Windows

Re: Rules correct ?

2010-03-22 Thread Matt Kettler
On 3/22/2010 9:11 AM, Joseph Brennan wrote: header__MY_FILTRAGE_TO_93 To =~ /\...@exxent\.net/i This matches if @exxent.net is in the To: header line. It doesn't match all mail sent to recipients at exxent.net-- only mail with their address in the To: header line. Of course