check_header_count_range() for MIME sections?

2018-10-29 Thread Philip Prindeville
Hi. I’d like to be able to detect duplicated header types in MIME sections. I think you all have been seeing them too. Is there an easy way to see if a message contains any MIME sections where particular headers occur more than once? Thanks, -Philip

Re: Rule for a link with an numeric IP in body?

2018-10-29 Thread Martin Gregorie
On Mon, 2018-10-29 at 18:18 +, RW wrote: > On Mon, 29 Oct 2018 17:26:29 + > Martin Gregorie wrote: > > > > describe MG_BARE_IP Bare IP in a URI > > body __MG_BAI0 /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/ > > uri __MG_BAI1 /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\w*/ > > meta MG_BARE

Re: Rule for a link with an numeric IP in body?

2018-10-29 Thread RW
On Mon, 29 Oct 2018 14:53:51 -0500 (CDT) David B Funk wrote: > On Mon, 29 Oct 2018, Martin Gregorie wrote: > > > Note that technical computing discussions may validly contain bare > > IPs, e.g. 127.0.0.1 is never a spam indication since it is the IP of > > 'localhost' and so its appearance is no

Re: Rule for a link with an numeric IP in body?

2018-10-29 Thread David B Funk
On Mon, 29 Oct 2018, Martin Gregorie wrote: On Mon, 2018-10-29 at 15:55 +0200, Anders Gustafsson wrote: Is there such a rule already in 3.3.x? I would ideally want a version of that that adds to the spam score if it sees a x.x.x.x/unsubscribe link, possibly translated. [snip..] describe MG_

Re: Rule for a link with an numeric IP in body?

2018-10-29 Thread RW
On Mon, 29 Oct 2018 17:26:29 + Martin Gregorie wrote: > describe MG_BARE_IP Bare IP in a URI > body __MG_BAI0 /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/ > uri __MG_BAI1 /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\w*/ > meta MG_BARE_IP (__MG_BAI0 || __MG_BAI1) > scoreMG_BARE_IP 0.01 > >

Sv: Re: Rule for a link with an numeric IP in body?

2018-10-29 Thread Anders Gustafsson
Thanks. I hd some issues installing 3.4, libc conflict IIRC so I Installed 3.3, but I have been planning to upgrade. I guess I will jut download the source tarball and build it on the system. FWIW this system is not facing the internet. The MTA deposits incoming main into a folder where sa pic

Re: Rule for a link with an numeric IP in body?

2018-10-29 Thread Martin Gregorie
On Mon, 2018-10-29 at 15:55 +0200, Anders Gustafsson wrote: > Is there such a rule already in 3.3.x? I would ideally want a version > of that that adds to the spam score if it sees a x.x.x.x/unsubscribe > link, possibly translated. > > Asking here as regexps are not really my strong side. > Here'

Re: Rule for a link with an numeric IP in body?

2018-10-29 Thread Bill Cole
On 29 Oct 2018, at 9:55, Anders Gustafsson wrote: Is there such a rule already in 3.3.x? Do not run SpamAssassin 3.3.x. It is not safe. There have been multiple serious security bugs fixed in the 3.4.x series. However, the rules for 3.3.x and 3.4.x are identical. And yes, the rule "NORMAL

Re: spamd fails to remove bayes.lock file

2018-10-29 Thread John Hardin
On Mon, 29 Oct 2018, Emanuel Gonzalez wrote: Hi.!! the permits of the directory are correct: ll -d /.spamassassin/ drwxrwxr-x 2 nobody nobody 63 oct 29 08:54 /.spamassassin/ The parameter bayes_auto_learn is set to "0". The advice was for auto *expire*. -- John Hardin KA7OHZ

Rule for a link with an numeric IP in body?

2018-10-29 Thread Anders Gustafsson
Is there such a rule already in 3.3.x? I would ideally want a version of that that adds to the spam score if it sees a x.x.x.x/unsubscribe link, possibly translated. Asking here as regexps are not really my strong side. -- Anders Gustafsson Engineer, CNI, CNE6, ASE Pedago, The Aaland Islands (

Re: Error running sa-update - cannot refresh mirrors file

2018-10-29 Thread Kevin A. McGrail
On 10/29/2018 8:03 AM, Rodney Baker wrote: > re: renaming curl and using wget > Thanks. Did that - it worked with wget instead of curl, successfully > downloading the mirrors file and all updates. The last failure with > curl was last night. > Then you are likely caught up in the buggy curl we've

Re: Error running sa-update - cannot refresh mirrors file

2018-10-29 Thread Rodney Baker
On 29/10/2018 1:47, RW wrote: On Sun, 28 Oct 2018 21:34:33 +1030 Rodney Baker wrote: On Saturday, 27 October 2018 0:14:32 ACDT Kevin A. McGrail wrote: It does concern me that it can't pull the file. I had added an https redirect which broke a lot of places using a broken version of curl. Ac

Re: spamd fails to remove bayes.lock file

2018-10-29 Thread Emanuel Gonzalez
Hi.!! the permits of the directory are correct: ll -d /.spamassassin/ drwxrwxr-x 2 nobody nobody 63 oct 29 08:54 /.spamassassin/ The parameter bayes_auto_learn is set to "0". any ideas? Regards, Emanuel.