Re: How to reject spam where sender = receiver

2009-10-28 Thread Benny Pedersen
On ons 28 okt 2009 15:42:19 CET, Adam Katz wrote [snip] forging one of them. My plugin maches userna...@domain1 to userna...@domain2 if username1 == username2 regardless of domain. legit users can not use smtp auth ?, hmm :) -- xpoint

Re: RCVD_IN_DNSWL_MED

2009-10-30 Thread Benny Pedersen
On fre 30 okt 2009 16:39:04 CET, Charles Gregory wrote Once again, I'm finding a piece of spam getting through because of RCVD_IN_DNSWL_MED=-4 . what is the ip ? http://www.dnswl.org/ make a request for change dont change problem in sa -- xpoint

Re: there goes the uri scripts..

2009-10-30 Thread Benny Pedersen
On fre 30 okt 2009 19:45:13 CET, Michael Scheidell wrote ICANN Approves Use Of Non-Latin Alphabets In Web Domain Names if the domain names conform to idn standard its okay with me -- xpoint

Re: Development dead

2009-11-04 Thread Benny Pedersen
On ons 04 nov 2009 15:10:45 CET, polloxx wrote Is the spamassassin development dead? On the website there's: 2008-06-12: SpamAssassin 3.2.5 has been released. join the dev maillist and ask the same question there, but as i see it, it being working on make sa 3.3.x stable for so long time now

Re: facebook Spam Question

2009-11-08 Thread Benny Pedersen
On søn 08 nov 2009 11:44:05 CET, rich...@buzzhost.co.uk wrote On Sun, 2009-11-08 at 10:39 +, Chip M. wrote: Ugh. I just checked Twitter, and no SPF record. :( No? twitter might use another domain for signup ?, no :) same as facebook.com does not use this domain for signup emails

Re: Spam coming from hotmail.

2009-11-09 Thread Benny Pedersen
On man 09 nov 2009 13:56:27 CET, Casartello, Thomas wrote Hotmail: Trusted email with Microsoft's powerful SPAM protection. Sign up now. why not enable it ? but for others: give a big spam score for rfc-i give a big ham score for users at hotmail that does not spam you meta RFC_ABUSE_POST

Re: Regex Question

2009-11-10 Thread Benny Pedersen
On tir 10 nov 2009 15:26:43 CET, rich...@buzzhost.co.uk wrote Please keep this in your mind in future before trotting out that tired old gas. imho Ralf have never being banned in maillist here, if you dont like his answers just unsubscribe -- xpoint

Re: Good reasons to dont use RBLs

2009-11-13 Thread Benny Pedersen
On fre 13 nov 2009 04:41:36 CET, Luis Daniel Lucio Quiroz wrote I'd like a brainstorm to convince that a RBL solution is not the best stoping SPAM, and we should look for L7 solution such as Bayes. and ip's is not part of bayes db ... -- xpoint

Re: [Fwd: Re: Getting off the Cloudmark formerly spamnet blacklist]

2009-11-13 Thread Benny Pedersen
On fre 13 nov 2009 18:26:07 CET, wrote One admin admitted that they were hacked through login guest / pass guest and this is a real hack :) -- xpoint

Re: New image spam

2009-11-14 Thread Benny Pedersen
On lør 14 nov 2009 07:25:20 CET, Alex wrote Any ideas what I could be missing on catching this one? Please let me know if I can provide any additional information. score DKIM_SIGNED 5 score USER_IN_DKIM_WHITELIST -5.0 whitelist_from_dkim fri...@sbcglobal.net -- xpoint

Re: New image spam

2009-11-14 Thread Benny Pedersen
On lør 14 nov 2009 17:31:11 CET, Alex wrote That's a good idea, but an administrative nightmare with many users, particularly with the fail first, correct later attitude, they would kill me. i maked a script in php that dump horde addressbook to whitelist_auth.cf put that in a daily cron,

Re: New image spam

2009-11-14 Thread Benny Pedersen
On lør 14 nov 2009 20:11:09 CET, Homer Parker wrote On Sat, 2009-11-14 at 18:58 +0100, Benny Pedersen wrote: i maked a script in php that dump horde addressbook to whitelist_auth.cf Only if everyone uses webmail... so how do i solve other problems ? if you make me a ldap addressbook

Re: balancechecker.zip balancechecker.exe

2009-11-15 Thread Benny Pedersen
On søn 15 nov 2009 18:47:49 CET, rich...@buzzhost.co.uk wrote http://pastebin.com/m730f90e9 winnow.malware.8163 -- xpoint

Re: rbl checks not running

2009-11-20 Thread Benny Pedersen
On fre 20 nov 2009 21:07:00 CET, Mark Hedges wrote Hi. I've set up my own rbldnsd server. It's responding to queries correctly, for example, I am trying to block the server that this message comes from, 64.22.103.163. spamassassin 21 -D metadata -t msg | less the ip above is not in the

Re: Custom Rule Location

2009-11-22 Thread Benny Pedersen
On søn 22 nov 2009 17:00:37 CET, rich...@buzzhost.co.uk wrote Is there a way to include these locations into the rules path at all? sa-update already use includes man sa-update -- xpoint

Re: Undisclosed recipients :; -- again

2009-11-23 Thread Benny Pedersen
On tir 24 nov 2009 01:11:38 CET, LuKreme wrote I used it all the time. And you WILL 'block' legitimate mail. and thats always sender to decide its legitimate :) i see a pattern there -- xpoint

Re: emailBL devel ?

2009-11-24 Thread Benny Pedersen
On tir 24 nov 2009 18:22:25 CET, R-Elists wrote didnt anyone think that the emailBL project was good enough in adding an extra factor of protection to continue development? +1 even without more devel on it, what does miss ? so far i have just seen one big problem with it, dns servers /

Re: emailBL devel ?

2009-11-24 Thread Benny Pedersen
On tir 24 nov 2009 18:30:15 CET, Yet Another Ninja wrote Freemail.pm plugin does it pretty well without the overhead and cron'd replication lag... just one problem with freemail it should list all domain as freemail as default, unless there is a clear sign of payment to get it otherway

Re: emailBL devel ?

2009-11-24 Thread Benny Pedersen
On tir 24 nov 2009 19:02:29 CET, Yet Another Ninja wrote seems simpler than adding 1 domains to freemail's config .-) that why i like to change it to be paidmail.pm with lists of paid domains got it now ? :) spammers can get any free domain and it can continue as a freemail, but

Re: well, isnt that special...

2009-11-25 Thread Benny Pedersen
On ons 25 nov 2009 18:55:11 CET, rich...@buzzhost.co.uk wrote Any more ranges most welcome :-) iptables -A FIREWALL -s 127.0.0.0/8 -j DROP -- xpoint

Re: which free RBL do you use?

2009-11-27 Thread Benny Pedersen
On fre 27 nov 2009 16:47:54 CET, rich...@buzzhost.co.uk wrote Matus, why are you once more sending me off list replies? Again, will you *please* keep your replies *ON LIST*. priceless reply-to -- xpoint

Re: which free RBL do you use?

2009-11-27 Thread Benny Pedersen
On fre 27 nov 2009 18:08:23 CET, Allen Chen wrote DNSBLs. We are non-profit organization and don't have too much email traffic. install bind, check spamhaus dnsbl in sendmail, add more internal spam tests in sendmail, dont add to much dnsbl in sendmail, and i have found spamcop is more for

Re: Need help running SA in a (comparative) anti-spam test

2009-11-29 Thread Benny Pedersen
On søn 29 nov 2009 12:59:32 CET, Jonas Eckerman wrote I'd assume that a big ISP using SA (and wants the best from SA install) would pay to use the better DNSBLs. ask recipient if a isp does a well good job of stopping spam to ones inbox, payed dnsbl or not :=) shared rbl listes is silly,

Re: which free RBL do you use?

2009-11-30 Thread Benny Pedersen
On man 30 nov 2009 10:56:47 CET, Matus UHLAR - fantomas wrote Priceless? Bullshit. Useless and annoying. Breaks (or at least makes harder) possibility for private replies. i wont solve all worlds problems, but seem reply-to is missused allot out there I sometimes send private reply

Re: How was your holiday weekend spam traffic?

2009-11-30 Thread Benny Pedersen
On man 30 nov 2009 16:08:53 CET, Chris Santerre wrote I'm not fully awake yet but it looks like my blocking numbers from RBLs tripled over weekend. what RBLs are you on ? :) -- xpoint http://www.unicom.com/pw/reply-to-harmful.html

Re: Filter question

2009-11-30 Thread Benny Pedersen
On man 30 nov 2009 21:36:09 CET, Alex wrote You don't need SpamAssassin to do this. Most modern mail servers (postfix, sendmail, Exchange) can do this by default. Remove the default forwarding of non-existent addresses from being delivered to a general postmaster account, and explicitly define

Re: Filter question

2009-11-30 Thread Benny Pedersen
On man 30 nov 2009 21:54:37 CET, Thomas Harold wrote In general... no. Unless the other company is willing to give you access to their internal list of valid email accounts. well there is no point for spamassassin to know if a sender is valid recipient or not, whats counts for spamassassin

Re: FP on blacklist hostkarma

2009-11-30 Thread Benny Pedersen
On tir 01 dec 2009 00:51:38 CET, Raymond Dijkxhoorn wrote So if you have a crappy connection towards your mailserver Marc you can get listed, thats rather funny, and annoying. Connections do break also when not running a botnet... pfff maybe i am dump, but what do you mean by the above

Re: FP on blacklist hostkarma

2009-11-30 Thread Benny Pedersen
On tir 01 dec 2009 02:16:04 CET, wrote I believe Raymond's response was addressing the fact a server connection could possibly be interrupted before it had a chance to issue the SMTP QUIT command. I would think being listed for that alone would be ridiculous. if its this i would agree,

Re: FP on blacklist hostkarma

2009-12-01 Thread Benny Pedersen
On tir 01 dec 2009 12:27:58 CET, Mike Cardwell wrote When I say, you, I'm refering to the people using the JMF lists, not specifically you Benny. if it was just for me you would post it on maillists ? :) thanks for clearify it, atleast for me -- xpoint

Re: [sa] Re: Filter question

2009-12-01 Thread Benny Pedersen
On tir 01 dec 2009 16:59:12 CET, Charles Gregory wrote servers that your mail should be greylisted because it attempts to 'send mail' to too many non-existent addresses. One more reason to NOT verify addresses this way. well KISS to yahoo for not setting spf for there domains so we dont

freemail vs dkim / spf

2009-12-05 Thread Benny Pedersen
i think it could be added to freemail.pm to test if sender domain have spf or dkim and if no spf and or no dkim consider it as a freemail domain ? i dont know if it require code changes to do this, but it make sense for me atleast to make it, no ? objection, flames as i like to know

Re: Bayes

2009-12-09 Thread Benny Pedersen
On ons 09 dec 2009 14:56:53 CET, LuKreme wrote I don't speak German, however with the help of Google I think the answer to your question is 'you don't'. As I recall, when moving from file-based bayes to MySQL based bayes, you have to retrain. no just --backup filebased bayes, and

Re: emailreg.org - pretty good white list

2009-12-14 Thread Benny Pedersen
On tir 15 dec 2009 00:32:31 CET, mouss wrote head Can all the guys who think 20 isn't much send me 10$ each? I promise to write a song for you. /head what if the snail postman did not get paid ?, how many snailmails would not be sent ?, its wonder me that email is completely free of charge

Re: Spam from compromised web mails

2009-12-15 Thread Benny Pedersen
On tir 15 dec 2009 08:25:00 CET, Rajkumar S wrote I have pasted one such (slightly edited) mail at http://pastebin.ca/1715399 http://sa.hege.li/ to me it looks like a gmail user trying to get more users sending there login and passwords then what ever it really is ? -- xpoint

Re: Spam from compromised web mails

2009-12-15 Thread Benny Pedersen
On tir 15 dec 2009 15:44:50 CET, Jeff Koch wrote in has a tag. A tag of two characters would allow users to quickly identify the email as coming from the SA mailing list and decide whether the email is worth opening. in the header: List-Id:users.spamassassin.apache.org in sieve

Re: FP on blacklist hostkarma

2009-12-15 Thread Benny Pedersen
On tir 15 dec 2009 17:22:44 CET, Marc Perkel wrote Mark, can you *please* stop sending HTML-only messages to the list? Get a modern email client. helps more to get a better os :) -- xpoint http://www.unicom.com/pw/reply-to-harmful.html

Re: HTML in Messages

2009-12-15 Thread Benny Pedersen
On tir 15 dec 2009 17:31:54 CET, Marc Perkel wrote Get a modern email client. Are you using a KSR33 teletype on a 110 baud modem? why are you offtopic now ? -- xpoint http://www.unicom.com/pw/reply-to-harmful.html

Re: FP on blacklist hostkarma

2009-12-15 Thread Benny Pedersen
On tir 15 dec 2009 17:36:56 CET, Toni Mueller wrote HTML in emails is usually a synonym for F*CKING SH*T. most users that try doing it is maybe just trying to write in red or white :) but yes, i will also say html is not for email, but so many clients have it as default i have giving up

Re: SA Tag Spam from compromised web mails

2009-12-15 Thread Benny Pedersen
On tir 15 dec 2009 18:22:00 CET, Jeff Koch wrote How could a two character tag like SA be annoying? You must never use a blackberry or iPhone to check your email either. open your eyes and see more, both the above smartphones above can handle imap just fine, but i just test it from nokia

Re: SA Tag Spam from compromised web mails

2009-12-15 Thread Benny Pedersen
On tir 15 dec 2009 18:52:44 CET, Jeff Koch wrote Of course an iPhone can see IMAP folders. But what's going to sort mail into folders when I'm traveling for a week and the office PC is turned off? never tryed a google email at gmail ? well sieve is the answer, not the clients problem you

Re: emailreg.org - tainted white list

2009-12-16 Thread Benny Pedersen
On ons 16 dec 2009 12:10:11 CET, Res wrote no whitelist should ever become default part of SA, the day it is, is the day I look elsewhere. please post on this maillist what you do when you find replacement for sa -- xpoint http://www.unicom.com/pw/reply-to-harmful.html

Re: dkim whitelisting

2009-12-16 Thread Benny Pedersen
On ons 16 dec 2009 16:23:23 CET, LuKreme wrote whitelist_from_dkim *...@buffetsinc.com bluehornet.com the correct syntax for whitelisting these emails? syntax is ok, but i would not use whitelist_from_dkim with a willcard domain, imho its better to def_whitelist_from_dkim

Re: OT: Museum piece...

2009-12-16 Thread Benny Pedersen
On ons 16 dec 2009 16:49:52 CET, Charles Gregory wrote On Tue, 15 Dec 2009, Chris Hoogendyk wrote: Marc Perkel wrote: http://www.vintage-computer.com/asr33.shtml There was actually a time when I had one of those in my house. For your amusement: I still have my old Commodore 64 and 1541

Re: habeas - tainted white list

2009-12-18 Thread Benny Pedersen
On fre 18 dec 2009 08:13:31 CET, Christian Brel wrote * [212.159.7.100 listed in list.dnswl.org] Yet the same IP is on and off SORBS and part of an ongoing spam problem. Perhaps this can be reviewed and given a zero score by default? see dnswl homepage, there is NONE, LOW, MED, HI, the

Re: habeas - tainted white list

2009-12-18 Thread Benny Pedersen
On fre 18 dec 2009 10:07:55 CET, Daryl C. W. O'Shea wrote If you like you can transparently disable the DNSWLs. or create a bug to have dnswl use trusted_networks from local.cf in spamassassin -- xpoint http://www.unicom.com/pw/reply-to-harmful.html pgpfoovQHfqN5.pgp Description: PGP

Re: habeas - tainted white list

2009-12-18 Thread Benny Pedersen
On fre 18 dec 2009 10:23:48 CET, Christian Brel wrote If you like you can transparently disable the DNSWLs. I found it much more useful to apply them as blocklists and give the a +4/+8 myself - but that's a personal choice. and No, hits=0.7 required=10.0 tests=SPF_SOFTFAIL is also a personal

Re: OT Re: Museum piece...

2009-12-18 Thread Benny Pedersen
On Fri 18 Dec 2009 07:09:03 PM CET, Per Jessen wrote Completely agree, but the ZX80/1 made computers very, very affordable. I was 15 when I managed to convince my parents that I desperately needed one of those. Back in 1981, zx80 was 1980 imho, and had just 1k ram, and 8k rom, fully

RE: habeas - tainted white list

2009-12-18 Thread Benny Pedersen
On Fri 18 Dec 2009 07:42:55 PM CET, R-Elists wrote or create a bug to have dnswl use trusted_networks from local.cf in spamassassin can you help me / us better understand what you are getting at here and why? example: trusted_networks 127.128.0.0/16 and then if 127.128.128.128 is listed in

Re: an actual IPv6 spam

2010-01-04 Thread Benny Pedersen
On Mon 04 Jan 2010 04:21:02 PM CET, Greg Troxel wrote http://www.lexort.com/spam/spam-ipv6-cn.txt X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.3 (fnord.ir.bbn.com [0.0.0.0]); Sun, 03 Jan 2010 22:17:05 -0500 (EST) you are on ipv4, any ip whitelisted or ? --

Re: semi-legit senders in DNSWL and habeas - a hard problem

2010-01-10 Thread Benny Pedersen
On Tue 05 Jan 2010 09:59:15 PM CET, Michael Scheidell wrote and if someone wants to get linkedin email, they should get a hotmail or gmail account. talk about bussiness now ? -- xpoint http://www.unicom.com/pw/reply-to-harmful.html

Re: spamassassin bug

2010-01-11 Thread Benny Pedersen
On Mon 11 Jan 2010 07:01:04 PM CET, Rich Shepard wrote In /etc/mail/spamassassin/rules/ I have init.pre, v310.pre, and v312.pre files. which would be a non-default location. Almost all SA-related files are in /etc/mail/spamassassin/; that's where the Slackware package installs everything. If

Re: spamassassin bug

2010-01-11 Thread Benny Pedersen
On Mon 11 Jan 2010 08:07:12 PM CET, Rich Shepard wrote Should I copy the .pre files to /usr/share/spamassassin? no do not copy, edit the files in there place where thay got installed spamassassin 21 -D --lint | less I can post the results, but the final error still is: check: no loaded

Re: Fake mailing list spam

2010-01-11 Thread Benny Pedersen
On Mon 11 Jan 2010 08:19:13 PM CET, LuKreme wrote I have been bouncing these to gmail, but I know that's useless. Not sure what do do since I don't want to scan mailing-lists. send this mail to maillist-owner and or abuse at google, seem this maillist have a spammer connected on this

RE: spamassassin bug

2010-01-11 Thread Benny Pedersen
On Mon 11 Jan 2010 08:45:40 PM CET, Rosenbaum, Larry M. wrote check: no loaded plugin implements 'check_main': cannot scan! at /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/PerMsgStatus.pm line 164. What plugin do I need to have loaded to resolve this error? It looks like you are missing

exchange bounces from chrisrobin.hundredacrewood.local

2010-01-11 Thread Benny Pedersen
Original-Envelope-ID: c=US;a= ;p=HUNDREDACREWOOD;l=CHRISROBIN-100111200457Z-1594 Reporting-MTA: dns; chrisrobin.hundredacrewood.local Final-Recipient: RFC822;

Re: Fake mailing list spam

2010-01-11 Thread Benny Pedersen
On Mon 11 Jan 2010 09:14:06 PM CET, LuKreme wrote google, seem this maillist have a spammer connected on this maillist where you recieve the spam from a valid maillist at google, so report it as spam to them I never subscribed to the list in question. I am, in fact, not subscribed to any

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Benny Pedersen
On Tue 12 Jan 2010 07:48:23 AM CET, Christian Brel wrote http://pastebin.com/m66a5a2ae X-Virus-Status: Infected (Sanesecurity.Junk.25057.UNOFFICIAL) -- xpoint http://www.unicom.com/pw/reply-to-harmful.html

Re: SA not picking up rules from /var/lib/spamassassin/

2010-01-13 Thread Benny Pedersen
On Wed 13 Jan 2010 02:53:13 PM CET, Geoff Soper wrote saupdates.openprotect.com channel which contains recommended SAREs rules and all is working! outdated sare rules is not recommended, and openprotect do care ? :) if you update sare rules via sa-update it would work, if you do some

Re: SA not picking up rules from /var/lib/spamassassin/

2010-01-13 Thread Benny Pedersen
On Wed 13 Jan 2010 04:11:45 PM CET, Geoff Soper wrote I'll certainly add sought.rules.yerp.org and 90_2tld.cf.sare.sa-update.dostech.net to updates.spamassassin.org as suggested by Jason. delete all files in the 3.2.5 sa update dir, use sa-update again so all sa-update rules gets loaded,

Re: Faked _From_ field using our domain - how to filter/score?

2010-01-13 Thread Benny Pedersen
On Wed 13 Jan 2010 05:54:58 PM CET, Skaz wrote Sadly SPF won't catch this type of spam as that only deals with the envelope and the faked field is in the body. We already have SPF set up anyhow which obviously catches a fair few faked HELO's. ug :/

Re: Faked _From_ field using our domain - how to filter/score?

2010-01-13 Thread Benny Pedersen
On Wed 13 Jan 2010 08:39:13 PM CET, Mike Wallace wrote I do this but it only works for rejecting a forged envelope. It doesn't work if it's only a forged From header which the example shows. and you get spam from spf pass domains where From: is spf fail ? Does anyone know of a way to

sa 3.2.1 FH_DATE_PAST_20XX

2010-01-14 Thread Benny Pedersen
since 3.2.1 is still stable in gentoo portage would make sense to update rules on this for that bug ? -- xpoint

Re: sa 3.2.1 FH_DATE_PAST_20XX

2010-01-15 Thread Benny Pedersen
http://bugs.gentoo.org/show_bug.cgi?id=301125 hope it gets resolved now, point for me is that 3.2.5 is only marked unstable in gentoo, and i tryed to make another server with just stable ebuilds to see where remaining problems is -- xpoint http://www.unicom.com/pw/reply-to-harmful.html

Re: is bayes enabled by default?

2010-01-17 Thread Benny Pedersen
On Sun 17 Jan 2010 10:05:13 PM CET, tonjg wrote so if there is no 'use_bayes' entry in local.cf does that mean bayes is disabled by default? spamassassin 21 -D --lint | less is this line not a FAQ by now ? -- xpoint http://www.unicom.com/pw/reply-to-harmful.html

Re: is bayes enabled by default?

2010-01-17 Thread Benny Pedersen
On Sun 17 Jan 2010 10:33:24 PM CET, tonjg wrote [29394] dbg: plugin: loading Mail::SpamAssassin::Plugin::Bayes from @INC bayes plugin is loaded [29394] dbg: bayes: no dbs present, cannot tie DB R/O: /root/.spamassassin/bayes_toks is BerkelayDB working in generic on this computer ? is perl

Re: is bayes enabled by default?

2010-01-17 Thread Benny Pedersen
On Sun 17 Jan 2010 11:43:19 PM CET, tonjg wrote ls -l /root/.spamassassin would just liked to permissions on this dir try delete it and see what happends this command gives: total 0 sa-learn --ham --showdots msg sa-learn --dump magic sa-learn --spam --showdots msg sa-learn --dump magic

Re: Whitelist on List-ID

2010-01-21 Thread Benny Pedersen
On Fri 22 Jan 2010 05:08:05 AM CET, LuKreme wrote On Jan 21, 2010, at 20:24, Rick Knight rick_kni...@rlknight.com wrote: I belong to several mailing lists and newsgroups. Messages from one particular list is almost always marked as spam by spamassassin. You shouldn't be sending ANY

Re: administra...@willspc.net bounces

2010-01-23 Thread Benny Pedersen
On Sat 23 Jan 2010 07:35:43 PM CET, RobertH wrote why is the account or accounts that create the Delivery Status Notification (Failure) bounces from administra...@willspc.net still subscribed to the list? it does not bounce to apache org, only to subscribers :) just hoped that maillist-owner

Re: administra...@willspc.net bounces

2010-01-24 Thread Benny Pedersen
On Sun 24 Jan 2010 05:55:21 PM CET, Evan Platt wrote Won't work, AFAIK. You need to reply to the unsub request to confirm it. Otherwise, you would be able to unsubscribe anyone :) why did the bounce not go to apache.org ?, or did it, but apache.org did not see the problem in maillist ? not

Re: Please help with rule

2008-02-25 Thread Benny Pedersen
On Sat, February 23, 2008 15:52, Dave Koontz wrote: I am still getting some Storm Worm messages that are not being caught, even with Sane Security / ClamAV. I thought I'd write a rule to score any URL that has a dot exe, scr or pif extension. However, my rule is not working. Can someone

Re: unsubscribe

2008-02-25 Thread Benny Pedersen
On Mon, February 25, 2008 16:18, Chris wrote: Unsubscribe list-unsubscribe: mailto:[EMAIL PROTECTED] in squirrelmail i just press a bottom :-)

Re: HABEAS_ACCREDITED_COI

2008-02-26 Thread Benny Pedersen
On Tue, February 26, 2008 09:49, Anthony Peacock wrote: Does anyone know anything about this. At this stage I am planning on changing the score for all HABEAS_ACCREDITED_??? rules to 0, to make them neutral to the score. score 0 disables the test

Re: HABEAS_ACCREDITED_COI

2008-02-27 Thread Benny Pedersen
http://www.chime.ucl.ac.uk/~rmhiajp/habeas-misfire.eml disable DomainKey plugin and add DKIM plugin will help on that msg and search on DKIM mta scores for not being sent from a DKIM signer

Re: Quick Postfix Question [OT]

2008-02-27 Thread Benny Pedersen
It appears that Postfix only does DNS blacklists and not whitelists then. I was going to publish my whitelist and Postfix instructions but I guess I can't do that. http://linux.softpedia.com/get/Communications/Email-Filters/maRBL-16435.shtml this link helps :-) test for rbl blacklist and if

sare_uri does not --lint

2008-02-27 Thread Benny Pedersen
created a patch so it does --- /var/lib/spamassassin/3.002004/70_sare_uri_cf_sare_sa-update_dostech_net/200510102200.cf.orig 2008-02-25 06:15:39.0 +0100 +++ /var/lib/spamassassin/3.002004/70_sare_uri_cf_sare_sa-update_dostech_net/200510102200.cf 2008-02-27 18:21:47.0 +0100 @@

Re: Quick Postfix Question [OT]

2008-02-28 Thread Benny Pedersen
rbl=hostkarma.junkemailfilter.com/127.0.0.1; action=OK whitelisted suggest change OK to permit_auth_destination or DUNNO rbl=hostkarma.junkemailfilter.com/127.0.0.2; action=REJECT blacklisted rbl=hostkarma.junkemailfilter.com/127.0.0.3; action=PREPEND X-Karma: yellow .. among many other

Re: 'Malformed UTF-8 character' errors

2008-02-28 Thread Benny Pedersen
running on Perl version 5.8.5 upgrade, and let us know problem later if i remember unicode was a problem before 5.8.8

DKIM and gmail fails

2008-03-02 Thread Benny Pedersen
i seem to have a problem with Mail::DKIM 0.22 and sa 3.2.4 dkim plugin that do not work with sigatures gmail uses i upgraded Mail::DKIM to 0.26 but now i get this [7106] dbg: dkim: no wl entries match author [EMAIL PROTECTED], no need to verify sigs [7106] dbg: dkim: performing public key lookup

Re: DKIM and gmail fails

2008-03-02 Thread Benny Pedersen
my host is gentoo based with latest updates, atleast i hope upgrade Mail::DKIM to 0.30-1 where it works, thanks will try to get it bumped version on gentoo

Re: Testing MD5-Sum of the Subject against a dnsbl

2008-03-02 Thread Benny Pedersen
Is there a way to realise this in SA. http://ixhash.sourceforge.net/

Re: FW by [EMAIL PROTECTED] : Re: --max-children setting, consider raising it

2008-03-03 Thread Benny Pedersen
Hello Listmaster or whoever will read it, add spf to freenet.de would help the clueless :-)

Re: Testing MD5-Sum of the Subject against a dnsbl

2008-03-03 Thread Benny Pedersen
Is there a way to realise this in SA. http://ixhash.sourceforge.net/ That is a good starting point for writing a plugin to do something similar but the OP wants to hash the subject not the body. subject is part of the body I started doing this a while ago in addition to using ixhash. how

Re: DKIM and gmail fails

2008-03-03 Thread Benny Pedersen
my host is gentoo based with latest updates, atleast i hope Was using Mail::DKIM 26, right? all older then 0.30-1 fails why i tested 0.22 and 0.26 is that its the only in gentoo portage

Re: [spamassassin] Re: [spamassassin] Re: How to report 120, 000 spams a day

2008-03-12 Thread Benny Pedersen
On Sun, March 9, 2008 19:01, Tuc at T-B-O-H.NET wrote: I guess I'm still not being clear. There are 120K emails a day coming to INVALID EMAIL ADDRESSES THAT NEVER EXISTED. this is a ERROR IN YOUR DUMP SENDMAIL :=) [EMAIL PROTECTED] nobody FIX IT ! Benny

Re: dcc SA problem

2008-03-12 Thread Benny Pedersen
On Mon, March 10, 2008 14:11, Anatoly Pugachev wrote: /etc/mail/spamassassin/local.cf have following directives: loadplugin Mail::SpamAssassin::Plugin::DCC remove this line in local.cf find the plugin in one of the *.pre files and enable the plugin from there should fix the problem Benny

Re: autowhitelisting of recipient itself

2008-03-13 Thread Benny Pedersen
mail with will be recorded in AWL db with from, ip, score when a spammer users YOUR email it will be recorded with from, ip, score ip will most time stop the spammer here :-) Thanks for your help. no problem Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

Re: dcc SA problem

2008-03-13 Thread Benny Pedersen
user_prefs files since as user, i can't change system installed files. its designed as with secureity in mind Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

Re: autowhitelisting of recipient itself

2008-03-13 Thread Benny Pedersen
On Thu, March 13, 2008 14:18, Matt Kettler wrote: USER_IN_WHITELIST means the message matched a whitelist_from, whitelist_from_rcvd, or whitelist_from_spf statement in your configfiles. spf no Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

Re: Pyzor and cloudmark

2008-03-13 Thread Benny Pedersen
version from 2002) could olso just mean its stable atleast it is here Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

Re: Pyzor and cloudmark

2008-03-13 Thread Benny Pedersen
On Wed, March 12, 2008 16:30, R.Smits wrote: I have just discovered DCC . Looks a lot better :-) sure do, we are all here to help later even if it looks good later olso Sorry i've asked. Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

Re: blogspot spam

2008-03-20 Thread Benny Pedersen
On Wed, March 19, 2008 13:21, James E. Pratt wrote: http://pastebin.com/m8520d64 http://pastebin.com/m159c02de http://www.gossamer-threads.com/lists/spamassassin/users/90664 Botnet plugin hits them nicely Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

Re: any way to stop these tiny zip spams?

2008-03-24 Thread Benny Pedersen
, and the sender ip is olso a botnet without reverse dns, botnet plugin finds this http://pastebin.com/m493f478c for spamassassin get the jm sought rules, it hits there Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

Re: Howto stop SPF_FAIL from internal network?

2008-03-24 Thread Benny Pedersen
| trusted_networks192.168.8.0/24 192.168.3.0/24 Then, an (untrusted but internal) host like 192.168.3.24 sends a mail from [EMAIL PROTECTED]. The generated header is or change to 192.168.0.0/16 Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

Re: Howto stop SPF_FAIL from internal network?

2008-03-24 Thread Benny Pedersen
to but not open to the whole world Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

Re: Howto stop SPF_FAIL from internal network?

2008-03-25 Thread Benny Pedersen
On Tue, March 25, 2008 10:40, Enrico Scholz wrote: Benny Pedersen [EMAIL PROTECTED] writes: I have a problem that mails from internal (private) IPs generate SPF_FAIL hits. E.g. my configuration is | internal_networks 62.153.82.30 | internal_networks 192.168.0.0/16

Re: relays.ordb.org returning positive for everything?

2008-03-25 Thread Benny Pedersen
the maintainers were tired of all the queries. 05/01/07: ORDB is gone - Remove from your mailserver! maybe spammers want to take over that domain, lol :) Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

Re: Howto stop SPF_FAIL from internal network?

2008-03-26 Thread Benny Pedersen
On Wed, March 26, 2008 09:24, Enrico Scholz wrote: | msa_networks192.168.0.0/16 spamassassin 21 -D spf -t /tmp/msg /tmp/msg.spf.debug post the debug file /tmp/msg is a email where it happends Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

Re: can we make AWL ignore mail from self to self?

2008-03-28 Thread Benny Pedersen
to self should be ignored by the AWL. (it's harder to forged mail from a regular correspondent, so this makes AWL more useful) better configure awl to weight scores better to what trustness you want from it perldoc Mail::SpamAssassin::Plugin::AWL see the factor setting in usersettings Benny

Re: Howto stop SPF_FAIL from internal network?

2008-03-29 Thread Benny Pedersen
On Thu, March 27, 2008 11:28, Enrico Scholz wrote: Benny Pedersen [EMAIL PROTECTED] writes: spamassassin 21 -D spf -t /tmp/msg /tmp/msg.spf.debug post the debug file https://www.cvg.de/people/ensc/spf_fail.txt info: generic: trusted_networks doesn't contain msa_networks entry

<    1   2   3   4   5   6   7   8   9   10   >