Way to set user-prefs without a database?

2016-05-18 Thread Dan Mahoney, System Admin
Hey there, We have a couple of user accounts (really, role aliases) that need a different required_score from our global defaults. Since they're role accounts, they don't have a homedir. We're using a milter that passes the whole username (including domain name) along, anyway. Is there a

Good rules for PGP-Signed/Encrypted mail?

2014-11-07 Thread Dan Mahoney, System Admin
Hey all, The Day Job (and some of you may know what job that is) does enough PGP related stuff that we've had encrypted messages get dropped on occasion, and we'd like to whitelist this stuff. It looks like Mail::Spamassassin::Plugin::OpenPGP is way way old and has requirements that aren't

sa-learn from a cronjob?

2014-04-20 Thread Dan Mahoney, System Admin
All, Most of my users aren't command-line friendly. I'd like to basically have my IMAP server default to handing out two imap mailboxes that get auto-crontabbed to training bayes. Ideally, I'd also like to make it so that things dropped in the learn_spam folder are deleted, and stuff in

Re: [sa-list] Re: Weighted MIRRORED.BY files?

2013-03-24 Thread Dan Mahoney, System Admin
On Sun, 24 Mar 2013, Mark Martinec wrote: On Sunday March 24 2013 05:57:49 Dan Mahoney, System Admin wrote: sa-update also uses a mirror file which lists all of the URLs where the update can be downloaded from, optionally including weights for different mirrors. But there's no documentation

Weighted MIRRORED.BY files?

2013-03-23 Thread Dan Mahoney, System Admin
Hey there. The SA wiki says: sa-update also uses a mirror file which lists all of the URLs where the update can be downloaded from, optionally including weights for different mirrors. But there's no documentation or examples given for weighting. Anyone closer to the code know what this

Re: [sa-list] Re: Yahoo single link spam

2013-03-10 Thread Dan Mahoney, System Admin
On Fri, 22 Feb 2013, Kevin A. McGrail wrote: On 2/22/2013 3:27 PM, David F. Skoll wrote: On Fri, 22 Feb 2013 12:20:22 -0800 Marc Perkel supp...@junkemailfilter.com wrote: We need a rule to catch this. It looks like more data than it is but it's really little more than a single link. Like to

Re: [sa-list] Re: How to log detected locale/language?

2013-03-10 Thread Dan Mahoney, System Admin
On Fri, 8 Mar 2013, Axb wrote: On 03/08/2013 04:46 PM, Dan Mahoney, System Admin wrote: Hey there all, It seems a pretty core function in SA is the ok_languages and ok_locales function. I'd like to be able to turn on LOGGING of detected locales before I set which are ok (or specifically

How to log detected locale/language?

2013-03-08 Thread Dan Mahoney, System Admin
Hey there all, It seems a pretty core function in SA is the ok_languages and ok_locales function. I'd like to be able to turn on LOGGING of detected locales before I set which are ok (or specifically, which are less ok) I'm sure there's a knob for this somewhere, can anyone tell me where?

pyzor 401/unauthorized?

2013-03-06 Thread Dan Mahoney, System Admin
I was in the process of linting my SA config when I discovered that the pyzor servers are handing back this response to all commands: /usr/local/bin/pyzor --homedir /usr/local/etc/mail/spamassassin/.pyzor ping public.pyzor.org:24441 (401, 'Unauthorized: User is not authorized to request the

Re: [sa-list] Re: Supporting spamcop quick reporting

2013-02-19 Thread Dan Mahoney, System Admin
On Tue, 19 Feb 2013, Andrzej A. Filip wrote: On 02/19/2013 03:47 AM, Dan Mahoney, System Admin wrote: Spamcop has an undocumented feature that they allow you (if they trust you) to quick report spam, where you send to a different mail address, and it's reported instantly, without having to hit

Re: [sa-list] Re: Supporting spamcop quick reporting

2013-02-19 Thread Dan Mahoney, System Admin
On Tue, 19 Feb 2013, Kevin A. McGrail wrote: On 2/18/2013 9:47 PM, Dan Mahoney, System Admin wrote: Hey there, Spamcop has an undocumented feature that they allow you (if they trust you) to quick report spam, where you send to a different mail address, and it's reported instantly, without

Re: [sa-list] Re: Supporting spamcop quick reporting

2013-02-19 Thread Dan Mahoney, System Admin
On Tue, 19 Feb 2013, Andrzej A. Filip wrote: On 02/19/2013 08:53 PM, Dan Mahoney, System Admin wrote: On Tue, 19 Feb 2013, Andrzej A. Filip wrote: On 02/19/2013 03:47 AM, Dan Mahoney, System Admin wrote: Spamcop has an undocumented feature that they allow you (if they trust you) to quick

Supporting spamcop quick reporting

2013-02-18 Thread Dan Mahoney, System Admin
Hey there, Spamcop has an undocumented feature that they allow you (if they trust you) to quick report spam, where you send to a different mail address, and it's reported instantly, without having to hit the web interface. When you do this, you are still free to report spam in the usual way

Re: Still no apparent fix on ipv6 spamd?

2012-09-26 Thread Dan Mahoney, System Admin
On Tue, 25 Sep 2012, Kevin A. McGrail wrote: On 9/25/2012 5:02 PM, Dan Mahoney, System Admin wrote: I mentioned this on the mailing lists a few years ago. I notice that there still doesn't seem to be a clean way to just make spamd listen on all (v4 and v6) addresses by default, nor

Still no apparent fix on ipv6 spamd?

2012-09-25 Thread Dan Mahoney, System Admin
All, I mentioned this on the mailing lists a few years ago. I notice that there still doesn't seem to be a clean way to just make spamd listen on all (v4 and v6) addresses by default, nor is there a way to listen on multiple addresses with multiple -A options. This means that if you want to

Re: Still no apparent fix on ipv6 spamd?

2012-09-25 Thread Dan Mahoney, System Admin
On Tue, 25 Sep 2012, Kevin A. McGrail wrote: On 9/25/2012 5:02 PM, Dan Mahoney, System Admin wrote: I mentioned this on the mailing lists a few years ago. I notice that there still doesn't seem to be a clean way to just make spamd listen on all (v4 and v6) addresses by default, nor

Spamhaus Whitelist

2010-11-06 Thread Dan Mahoney, System Admin
All, Has anyone come up with a ruleset yet to score against the new spamhaus whitelists, and deduct points appropriately? -Dan -- Let me tell you something about regrowing your dead wife Lucy, Harry. It's probably illegal, potentially dangerous, and definitely crazy. -Harry nods- Vincent

Re: [sa-list] Re: Learing spam/ham with Pine

2010-11-06 Thread Dan Mahoney, System Admin
On Wed, 3 Nov 2010, John Hardin wrote: On Wed, 3 Nov 2010, Pat Traynor wrote: I've been running Spamassassin on my linux server for some time, and I use Pine to read my mail. Hello, fellow fossil! Aah, yonder fossils. I've found, by the way, that if you're not using Alpine, you sure

Re: [sa-list] Re: Spamhaus Whitelist

2010-11-06 Thread Dan Mahoney, System Admin
On Sat, 6 Nov 2010, David F. Skoll wrote: On Sat, 06 Nov 2010 00:41:53 -0700 Bill Landry b...@inetmsg.com wrote: You could also test the envelope sender: header SPAMHAUS_ENV eval:check_rbl_envfrom('SPAMHAUS_ENV', '_vouch.dwl.spamhaus.org.') But that's an abuse... you should not be

Pyzor occasionally dying when called from spamassassin.

2010-07-09 Thread Dan Mahoney, System Admin
Hey there, I just enabled pyzor as part of spamassassin (freebsd 6.4, pyzor built from ports), and occasionally get this message in my logs: Jul 9 05:40:59 quark spamd[11607]: spamd: connection from prime.gushi.org [72.9.101.130] at port 51280 Jul 9 05:40:59 quark spamd[11607]: spamd:

Minor Doc Issue on spamc config file?

2010-07-07 Thread Dan Mahoney, System Admin
Hey all, In my spamc config file I have: -d 72.9.101.140 -l --connect-retries=10 --retry-sleep=30 However, procmail scripts that I was using to report, via spamc -C report, were simply returning the message. When I added -d 72.9.101.140, the message was properly reported. The manpage

Passing preferences to spamd?

2010-07-07 Thread Dan Mahoney, System Admin
All, It seems the only way to pass a preference from spamc to spamd is by having a different user-id. In my specific case, I'd like to report to spamcop using their quick UID for some mails, but keep all my preferences otherwise the same (so I still get the benefits of bayes, dcc, awl,

Re: [sa-list] Re: Passing preferences to spamd?

2010-07-07 Thread Dan Mahoney, System Admin
On Thu, 8 Jul 2010, Karsten Bräckelmann wrote: On Wed, 2010-07-07 at 18:09 -0400, Dan Mahoney, System Admin wrote: It seems the only way to pass a preference from spamc to spamd is by having a different user-id. In my specific case, I'd like to report to spamcop using their quick UID for some

Adding headers on spamassassin ignores?

2010-07-05 Thread Dan Mahoney, System Admin
Hey all, From what I've gathered, there's both a recommended way to call spamassassin/spamd from procmail with a message-size-limit, as well as an overrideable builtin-default (-s option to spamc). These both cause the usual spamassasin headers to be missing from messages. The greater

Re: [sa-list] Re: Adding headers on spamassassin ignores?

2010-07-05 Thread Dan Mahoney, System Admin
On Mon, 5 Jul 2010, Karsten Bräckelmann wrote: On Mon, 2010-07-05 at 02:31 -0400, Dan Mahoney wrote: The greater problem is, that if for some reason spamassasin doesn't run (for example, a spamc timeout(*)) it produces exactly the same effect. Is there a way to have spamassasin/dspamd not

Re: [sa-list] Re: Autoreplies from RT are hitting on ANY_BOUNCE_MESSAGE

2010-06-29 Thread Dan Mahoney, System Admin
On Mon, 28 Jun 2010, Yet Another Ninja wrote: On 2010-06-28 11:33, Dan Mahoney, System Admin wrote: Hey there, Perhaps this is by design, but rt replies are, strictly speaking, not bounce messages. Message attached, let me know if it looks normal. -Dan from what I see it looks

Autoreplies from RT are hitting on ANY_BOUNCE_MESSAGE

2010-06-28 Thread Dan Mahoney, System Admin
Hey there, Perhaps this is by design, but rt replies are, strictly speaking, not bounce messages. Message attached, let me know if it looks normal. -Dan -- Dan Mahoney Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC ICQ: 13735144 AIM: LarpGM Site:

Re: [sa-list] Re: Learning and reporting with spamc in a single step?

2010-06-28 Thread Dan Mahoney, System Admin
On Mon, 28 Jun 2010, Karsten Bräckelmann wrote: On Sun, 2010-06-27 at 16:52 -0400, Dan Mahoney, System Admin wrote: Can spamc do this, or must it be forked to tee or something. Ideally I'd like to both report and learn in a single step (such as in a pipe from alpine). I note

Does spamd support ipv6 yet?

2010-06-27 Thread Dan Mahoney, System Admin
I previously asked this question and was told the best answer might be to wait for 3.3. Was there ever support ratified for ipv6 including proper -A ipv6 access lists, and proper ability to listen on both the ipv6 default and the v4 default at the same time, when specifying -i? I'm not sure

Learning and reporting with spamc in a single step?

2010-06-27 Thread Dan Mahoney, System Admin
Can spamc do this, or must it be forked to tee or something. Ideally I'd like to both report and learn in a single step (such as in a pipe from alpine). I note that spamassassin -r also has the option to learn (by default!), but spamc doesn't for some reason. Or if it does, the manpage

Re: [sa-list] Re: Adding remote-ip/ESMTPID/X-Envelope to logging output?

2009-12-27 Thread Dan Mahoney, System Admin
Mahoney, System Admin wrote: Hey there, Background: Sendmail with spamd running on a different box, spamc called from global procmail file. I'm doing some nightly log-combing to look for interesting patterns, including against other network traffic (like erroneous DNS lookups, I think I might

Adding remote-ip/ESMTPID/X-Envelope to logging output?

2009-12-26 Thread Dan Mahoney, System Admin
Hey there, Background: Sendmail with spamd running on a different box, spamc called from global procmail file. I'm doing some nightly log-combing to look for interesting patterns, including against other network traffic (like erroneous DNS lookups, I think I might be on to something).

Re: [sa-list] Re: A rant about FUZZY_OCR

2009-04-27 Thread Dan Mahoney, System Admin
On Mon, 27 Apr 2009, Henrik K wrote: Nothing of this makes sense. If you don't have a test server, too bad. If you don't trust the score-changing values too bad. It all worked for me. It's a great idea, but I'd like to see it mature some first, especially with respect to its documentation,

Re: [sa-list] Re: A rant about FUZZY_OCR

2009-04-27 Thread Dan Mahoney, System Admin
On Mon, 27 Apr 2009, Jo Rhett wrote: On Apr 27, 2009, at 1:16 PM, Dan Mahoney, System Admin wrote: The problem exists now, there is PNG spam, and there will continue to be, because it gets through. Right now the only way I find this blocked is if spamcop blocks it. Just as a point

Re: [sa-list] Re: Image spam and failing rule

2009-04-26 Thread Dan Mahoney, System Admin
On Sat, 25 Apr 2009, John Hardin wrote: On Sat, 25 Apr 2009, Gary Forrest wrote: We are receiving the same image spam many times, random text within the body. FuzzyOCR. It seems Spammers are trying image spam again, after giving up on it for a year or so. Is there a version of FuzzyOCR

Code Rot?

2009-04-26 Thread Dan Mahoney, System Admin
Hey all, While there's a decent amount of spamassassin list traffic to imply otherwise, is the SA project falling dormant? the sare-rules claim they won't be updated due to lives, wives, and hockey. the fuzzyOCR project claims the only thing that works with 3.2 is the SVN version, and on

Re: [sa-list] Re: [sa-list] Re: [sa-list] Re: Spamd and ipv6

2008-12-05 Thread Dan Mahoney, System Admin
On Wed, 3 Dec 2008, SM wrote: At 18:23 02-12-2008, Byung-Hee HWANG wrote: Are you using FreeBSD or NetBSD? If so, i understand you. Unfortunately, SA developers do not care about IPv6 yet. So here SA program at first do action with 127.0.0.1 than ::1, i guess ;; This was tested on a BSD

Re: [sa-list] Spamd and ipv6

2008-12-05 Thread Dan Mahoney, System Admin
On Fri, 5 Dec 2008, Dan Mahoney, System Admin wrote: Also, sorry about the subject headers. I think I've fixed my procmail recipe. -Dan -- I love you forever eternally. -Connaian Expression Dan Mahoney Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC ICQ: 13735144

Re: [sa-list] Re: [sa-list] Re: Spamd and ipv6

2008-12-01 Thread Dan Mahoney, System Admin
On Mon, 1 Dec 2008, SM wrote: At 23:01 30-11-2008, Dan Mahoney, System Admin wrote: So then, you're saying the behavior for ipv4 and ipv6 is somehow different? If you start spamd without specifying the IP addresses to listen on, spamd will listen on the 127.0.0.1 IP address only

Spamd and ipv6

2008-11-30 Thread Dan Mahoney, System Admin
Since getting my hosts natively speaking ipv6, I've been seeing a lot of initial timeouts connecting to spamc, because I believe it's apparently trying ipv6 first. spamc: connect to spamd on 2001:470:1f07:a7f::1 failed, retrying (#1 of 3): Connection refused spamc: connect to spamd on

Re: [sa-list] Re: Spamd and ipv6

2008-11-30 Thread Dan Mahoney, System Admin
On Sun, 30 Nov 2008, SM wrote: At 21:45 30-11-2008, Dan Mahoney, System Admin wrote: Since getting my hosts natively speaking ipv6, I've been seeing a lot of initial timeouts connecting to spamc, because I believe it's apparently trying ipv6 first. spamc: connect to spamd on 2001:470:1f07

Blogger URLs

2008-04-20 Thread Dan Mahoney, System Admin
Hello all, A lot of the spam I'm seeing sneak past spamassassin has a blogger url in it (this seems to be a new favorite for spammers). I've got about 200 such spams that have managed to sneak past (no idea how many of the 2 spams in my confirmed-kills folder also match). So, that

Re: [sa-list] Re: Blogger URLs

2008-04-20 Thread Dan Mahoney, System Admin
On Sun, 20 Apr 2008, Theo Van Dinter wrote: On Sun, Apr 20, 2008 at 12:39:29PM -0400, Dan Mahoney, System Admin wrote: Can someone do a spam-versus-ham comparison for included links to blogger.com (I don't have the corpus handy, nor do I know how to set up a proper test.) It's not really

[no subject]

2007-12-10 Thread Dan Mahoney, System Admin
-- Man, this is such a trip -Dan Mahoney, October 25, 1997 Dan Mahoney Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC ICQ: 13735144 AIM: LarpGM Site: http://www.gushi.org ---

Re: [sa-list] Re: RCVD_IN_DNSWL_LOW

2007-10-26 Thread Dan Mahoney, System Admin
On Fri, 26 Oct 2007, Matthias Leisi wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Alex Woick schrieb: [Spamcop] I understand the two step reporting process too, and I too find it annoying and timeconsuming to ack my (manually reviewed) 50 spams per day to them, so I ceased to do it.

Re: RCVD_IN_DNSWL_LOW

2007-10-25 Thread Dan Mahoney, System Admin
On Wed, 17 Oct 2007, ram wrote: Sorry I meant like spamcop .. I think I must proof-read my own mail now before Ctrl-Enter :-) The problem with SpamCop is: the two step reporting process makes things a bear to do. I understand the logic behind it, but once or twice I've taken a couple

Rule for TLS verify=OK?

2007-10-24 Thread Dan Mahoney, System Admin
Hey all, In looking through my sendmail logs, I've found that some connecting mail servers actually are correctly configured with a signed, valid cert from one of the major CA's. Is there a rule that can match this, on sendmail, based on the connecting ip on your network edge? This could

Re: [sa-list] Re: RCVD_IN_DNSWL_LOW

2007-10-17 Thread Dan Mahoney, System Admin
On Wed, 17 Oct 2007, Henrik Krohns wrote: On Tue, Oct 16, 2007 at 06:16:49PM -0400, Dan Mahoney, System Admin wrote: dnswl.org is either full of it, or not well maintained. I've gotten at least 20 spams which I see are listed in dnswl.org as low trust (which still merits -1.0). Umm, did you

Re: RCVD_IN_DNSWL_LOW

2007-10-17 Thread Dan Mahoney, System Admin
On Wed, 17 Oct 2007, Matthias Leisi wrote: I forwarded over 200 of them earlier today (as an attachment -- total email size was about one meg). It would have been from this address. -Dan -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dan Mahoney, System Admin schrieb: dnswl.org

Re: [sa-list] Re: [sa-list] Re: RCVD_IN_DNSWL_LOW

2007-10-17 Thread Dan Mahoney, System Admin
On Wed, 17 Oct 2007, Henrik Krohns wrote: On Wed, Oct 17, 2007 at 02:48:49AM -0400, Dan Mahoney, System Admin wrote: On Wed, 17 Oct 2007, Henrik Krohns wrote: On Tue, Oct 16, 2007 at 06:16:49PM -0400, Dan Mahoney, System Admin wrote: dnswl.org is either full of it, or not well maintained

Re: RCVD_IN_DNSWL_LOW

2007-10-17 Thread Dan Mahoney, System Admin
On Wed, 17 Oct 2007, Matthias Leisi wrote: I forwarded over 200 of them earlier today (as an attachment -- total email size was about one meg). OK, I now could have a look at them (well, a sample of them, not each of the 200 individually). All samples in that set have been forwarded through

Re: RCVD_IN_DNSWL_LOW

2007-10-17 Thread Dan Mahoney, System Admin
On Wed, 17 Oct 2007, Matthias Leisi wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dan Mahoney, System Admin schrieb: Livejournal's purely a mail forwarding service (i.e. there's no way to POP/IMAP that account) As far as I know, there are mails originating from LJ itself (eg

Re: [sa-list] Re: RCVD_IN_DNSWL_LOW

2007-10-17 Thread Dan Mahoney, System Admin
On Wed, 17 Oct 2007, Alex Woick wrote: Matthias Leisi schrieb am 17.10.2007 09:46: Correct. But by setting (in your local.cf or equivalent) | trusted_networks 204.9.177.18 you are telling SpamAssassin that this relay is not operated by a spammer and that it should apply all black-/whitelist

RCVD_IN_DNSWL_LOW

2007-10-16 Thread Dan Mahoney, System Admin
dnswl.org is either full of it, or not well maintained. I've gotten at least 20 spams which I see are listed in dnswl.org as low trust (which still merits -1.0). Could we maybe please add a feature to spamassassin -r (or some other hook to the generic whitelisting code) which reports this to

A compound bounce/(spf/dk/dkim) rule I'd like to see.

2007-10-10 Thread Dan Mahoney, System Admin
In pseudocode... IF (message is a recognizable bounce || message is from )... AND (we can guess the domain being sent to (can't trust the to header, but maybe the X-Envelope-To or some MTA token?) AND the domain being sent TO supports SPF and/or DKIM...(i.e. implying a misdirected bounce)

Re: [sa-list] RE: Auto-RBL was: Why did this not hit more? (SPF, DKIM, Ironport, X-originating-ip)

2007-10-10 Thread Dan Mahoney, System Admin
On Wed, 10 Oct 2007, Bret Miller wrote: sa-update does NOT feed a local blocklist generated by *my* particular corpus of spam emails. Think of it as the RBL equivalent of sitewide-bayes. Or think of it as a way of SA saying when I get twelve spams of score 10+ from ip 208.23.118.172...I

Re: [sa-list] Re: Advice on MTA blacklist

2007-10-10 Thread Dan Mahoney, System Admin
On Wed, 10 Oct 2007, David B Funk wrote: On Tue, 9 Oct 2007, Jo Rhett wrote: On Oct 9, 2007, at 4:22 PM, Chris Edwards wrote: Your server then enforces encryption and SMTP-AUTH, and the SSL will (hopefully) defeat any man-in-the-middle attacks by trans-proxies. That's exactly the problem I

Re: Auto-RBL was: Why did this not hit more? (SPF, DKIM, Ironport, X-originating-ip)

2007-10-09 Thread Dan Mahoney, System Admin
On Tue, 9 Oct 2007, Steven Kurylo wrote: Or think of it as a way of SA saying when I get twelve spams of score 10+ from ip 208.23.118.172...I will feed the auto-expiring RBL, which *SENDMAIL* works off of, thus keeping my *SPAMASSASSIN* load lower. Thus a spam deluge via a dictionary attack

Re: Auto-RBL was: Why did this not hit more? (SPF, DKIM, Ironport, X-originating-ip)

2007-10-09 Thread Dan Mahoney, System Admin
On Tue, 9 Oct 2007, Steven Kurylo wrote: Parsing the SA logs would be easy, but the connecting IP isn't listed there. As I mentioned, I'm parsing exim's logs. It contains the spam score and the IP address. Oh, that's true enough. I was musing on parsing my own logfiles as opposed to

Auto-RBL was: Why did this not hit more? (SPF, DKIM, Ironport, X-originating-ip)

2007-10-08 Thread Dan Mahoney, System Admin
On Mon, 8 Oct 2007, Matus UHLAR - fantomas wrote: On Sat, 6 Oct 2007, Rob McEwen wrote: FWIW... that IP, 220.226.197.15, is currently listed on four spam blacklists (RBLs): 1) uceprotect 2) no-more-funn 3) psbl 4) ivmSIP.com (mine) On 07.10.07 05:55, Dan Mahoney, System Admin wrote: My

Re: [sa-list] Re: Auto-RBL was: Why did this not hit more? (SPF, DKIM, Ironport,

2007-10-08 Thread Dan Mahoney, System Admin
On Mon, 8 Oct 2007, Rob McEwen wrote: Therefore, I recommend that you re-think your choices here! Don't let your quest for guaranteed long-term perfection keep you from making **substantial** progress today! Rob, Then help rally the SA team to include those RBLs that you mentioned in the

Re: [sa-list] Re: Why did this not hit more? (SPF, DKIM, Ironport, X-originating-ip)

2007-10-07 Thread Dan Mahoney, System Admin
. The latter two are much more safe for outright blocking... particularly ivmSIP.com, which a FP rate that is almost low as the FP rate of SpamHaus's lists. Rob McEwen Dan Mahoney, System Admin wrote: Message at bottom. I checked on this email. My system is right: it is an spf soft-fail

Why did this not hit more? (SPF, DKIM, Ironport, X-originating-ip)

2007-10-06 Thread Dan Mahoney, System Admin
Message at bottom. I checked on this email. My system is right: it is an spf soft-fail. At this point, ninety nine percent of people who set up SPF are going to be setting ~all and not understanding the difference between ~all and -all. And this did constitute a fail (i.e. a forgery), but

Re: [sa-list] Re: DK_POLICY_SIGNSOME

2007-08-07 Thread Dan Mahoney, System Admin
On Mon, 6 Aug 2007, Mark Martinec wrote: Rob, When the domainkey policy record for the domain in question says the domain signs some of its email. Heheh.. Yeah, I guessed that much, but, we *don't* sign email. Not DK(IM) or anything else. Yes, this is normal. An absence of a policy record

Re: [sa-list] Re: [sa-list] Re: Default Plugins?

2007-08-04 Thread Dan Mahoney, System Admin
On Sat, 4 Aug 2007, Theo Van Dinter wrote: On Fri, Aug 03, 2007 at 10:59:31PM -0400, Dan Mahoney, System Admin wrote: Is there some default mechanism loading these things (for example, I notice loadplugin Mail::SpamAssassin::Plugin::DKIM is only in v312.pre), and is it safe to remove the old

Default Plugins?

2007-08-03 Thread Dan Mahoney, System Admin
Hello all, I've got some stale v3xx.pre files around, and I notice that they load plugins that are NOT loaded by v320.pre Is there some default mechanism loading these things (for example, I notice loadplugin Mail::SpamAssassin::Plugin::DKIM is only in v312.pre), and is it safe to remove

http://wiki.apache.org/spamassassin/SareChannels

2007-08-03 Thread Dan Mahoney, System Admin
I notice the above page is immutable, for some reason. I noticed, upon trying to use the instructions at http://saupdates.openprotect.com/, that there IS no DNS record for 3.2.2 updates there, and I cannot edit the page to reflect this. Nor is there an easy piece of contact information on

Re: [sa-list] Re: Default Plugins?

2007-08-03 Thread Dan Mahoney, System Admin
On Fri, 3 Aug 2007, Theo Van Dinter wrote: On Fri, Aug 03, 2007 at 06:49:58PM -0400, Dan Mahoney, System Admin wrote: I've got some stale v3xx.pre files around, and I notice that they load plugins that are NOT loaded by v320.pre Of course. Is there some default mechanism loading

DNS timeouts on almost all queries

2007-01-05 Thread Dan Mahoney, System Admin
Any idea what could be causing the following? DNS is against localhost, net::dns is 0.59 I'm seeing a ton of this in my ddebug log: Jan 5 16:37:14 quark spamd[2031]: dns: timeout for sorbs-lastexternal,sorbs after 11 seconds Jan 5 16:37:14 quark spamd[2027]: dns: timeout for rfci_envfrom

remove known-postmaster entries from AWL?

2007-01-05 Thread Dan Mahoney, System Admin
Hey all, The subject line says it all. I've got a lot of users complaining about bounce spam, and while there's an 0.1 scoring Vbounce ruleset, I notice that more often than not postmaster scores sometimes a whopping .5, and at other times -17. Is there any way to simply say dont do this

Re: [sa-list] Re: remove known-postmaster entries from AWL?

2007-01-05 Thread Dan Mahoney, System Admin
On Fri, 5 Jan 2007, Matt Kettler wrote: Dan Mahoney, System Admin wrote: Hey all, The subject line says it all. I've got a lot of users complaining about bounce spam, and while there's an 0.1 scoring Vbounce ruleset, I notice that more often than not postmaster scores sometimes a whopping .5

Re: [sa-list] Re: DNS timeouts on almost all queries

2007-01-05 Thread Dan Mahoney, System Admin
On Fri, 5 Jan 2007, Matt Kettler wrote: Dan Mahoney, System Admin wrote: Any idea what could be causing the following? DNS is against localhost, net::dns is 0.59 I'm seeing a ton of this in my ddebug log: Jan 5 16:37:14 quark spamd[2031]: dns: timeout for sorbs-lastexternal,sorbs after 11

Re: [sa-list] Re: DNS timeouts on almost all queries

2007-01-05 Thread Dan Mahoney, System Admin
On Fri, 5 Jan 2007, Matt Kettler wrote: Dan Mahoney, System Admin wrote: ie: is the localhost DNS server working properly? Yes, it is. I'm not seeing any major errors in /var/log/messages, and I'm seeing some rules match on this. It would be quasi-helpful if the error logged what lookup

Re: [sa-list] Re: [sa-list] Re: Way to skip scanning per-user?

2006-12-23 Thread Dan Mahoney, System Admin
One of my users just started getting slammed. This one user, out of 400+ is getting a dictionary attack that's overwhelming all my spamd process slots. Doing this on the spamd side would make simply stopping this really simple -- even programmatically (i.e. automatically). Manually, even

Re: [sa-list] Re: SPF is hopelessly broken and must die!

2006-12-16 Thread Dan Mahoney, System Admin
On Thu, 14 Dec 2006, Magnus Holmgren wrote: On Thursday 14 December 2006 01:37, Marc Perkel wrote: How do you deal with people forwarding email from another domain when using SPF? *If* you intend to reject mail based on hard SPF failures, then you *must* allow for exceptions for forwarded

Way to skip scanning per-user?

2006-12-14 Thread Dan Mahoney, System Admin
Hey all, I'm looking for an easy way to override ALL scanning (NOT scoring) for a specific user. This is NOT the same as just setting required_score to 1000 -- basically what I want instead is some special way that SA will say nope, not even testing and short circuit. This shouldn't be a

Re: [sa-list] Re: Way to skip scanning per-user?

2006-12-14 Thread Dan Mahoney, System Admin
On Thu, 14 Dec 2006, Theo Van Dinter wrote: On Thu, Dec 14, 2006 at 11:59:26AM -0500, Dan Mahoney, System Admin wrote: I'm looking for an easy way to override ALL scanning (NOT scoring) for a specific user. Don't send mails for that user to SA. At the moment, that's a hack in the system

Re: [sa-list] RE: Way to skip scanning per-user?

2006-12-14 Thread Dan Mahoney, System Admin
On Thu, 14 Dec 2006, Coffey, Neal wrote: Dan Mahoney, System Admin wrote: I'm looking for an easy way to override ALL scanning (NOT scoring) for a specific user. This needs to be done in whatever you're using to call SpamAssassin (postfix, exim, sendmail, etc). This shouldn't

Re: [sa-list] Re: [sa-list] Re: Way to skip scanning per-user?

2006-12-14 Thread Dan Mahoney, System Admin
On Thu, 14 Dec 2006, Theo Van Dinter wrote: On Thu, Dec 14, 2006 at 12:11:11PM -0500, Dan Mahoney, System Admin wrote: At the moment, that's a hack in the system-wide procmailrc that I don't know how to do, since the only thing procmail knows about userspace is dropprivs=yes, and there's

Re: Way to skip scanning per-user?

2006-12-14 Thread Dan Mahoney, System Admin
On Thu, 14 Dec 2006, Theo Van Dinter wrote: As an aside, part of this is why I had asked for (a while back) a way to specify the domain portion of the -u argument, i.e. so it could be done per-calling server (i.e. it is assumed that if shell server A and shell server B, each with a distinct

Re: [Devel-spam] SA 3.1.7 children hang but don't die

2006-10-18 Thread Dan Mahoney, System Admin
On Wed, 18 Oct 2006, George R. Kasica wrote: I'm having the same issue with 3.1.7 under FreeBSD 5.4 -- all patches applied to gocr/giftext. -Dan On Wed, 18 Oct 2006 13:20:06 -0500, you wrote: - Original Message - From: Daryl C. W. O'Shea [EMAIL PROTECTED] To: [EMAIL PROTECTED]

Userprefs via X-Envelope-To header.

2006-07-10 Thread Dan Mahoney, System Admin
Hey all, Has anyone managed to successfully create an easy way to have a custom query look up prefs based on the X-Envelope-To header -- preferably with domain and username via custom query? I just need a few pointers here. -Dan -- Oh, and we just recently got an invoice...

Re: Spamd keeps getting hung up!

2006-04-01 Thread Dan Mahoney, System Admin
, alright. btw if *is* load-related, an strace -f -ttt log will show that pretty clearly. --j. Daryl C. W. O'Shea writes: (copying Justin since this has to do with pre-forking) Dan Mahoney, System Admin wrote: On Fri, 10 Mar 2006, Daryl C. W. O'Shea wrote: On 3/10/2006 11:22 AM, Dan Mahoney

Re: Spamd keeps getting hung up!

2006-04-01 Thread Dan Mahoney, System Admin
On Sun, 2 Apr 2006, Daryl C. W. O'Shea wrote: Dan Mahoney, System Admin wrote: On Fri, 31 Mar 2006, Daryl C. W. O'Shea wrote: Dan Mahoney, System Admin wrote: Mar 30 21:52:14 quark spamd[45835]: __alarm__ Mar 30 21:52:14 quark spamd[45835]: __alarm__ Mar 30 21:52:14 quark spamd[45835

Re: Spamd keeps getting hung up!

2006-03-31 Thread Dan Mahoney, System Admin
On Fri, 10 Mar 2006, Daryl C. W. O'Shea wrote: On 3/10/2006 11:22 AM, Dan Mahoney, System Admin wrote: I of course have no idea what to make of this output. Pointers? Each line is one file descriptor. So it doesn't appear that it's using an insane number of them. Next time spamd hangs

Re: Spamd keeps getting hung up!

2006-03-31 Thread Dan Mahoney, System Admin
On Fri, 31 Mar 2006, Daryl C. W. O'Shea wrote: (copying Justin since this has to do with pre-forking) Dan Mahoney, System Admin wrote: On Fri, 10 Mar 2006, Daryl C. W. O'Shea wrote: On 3/10/2006 11:22 AM, Dan Mahoney, System Admin wrote: Okay, I'm still getting these issues. I've

Re: Spamd keeps getting hung up!

2006-03-27 Thread Dan Mahoney, System Admin
this. -Dan On 3/10/2006 11:22 AM, Dan Mahoney, System Admin wrote: I of course have no idea what to make of this output. Pointers? Each line is one file descriptor. So it doesn't appear that it's using an insane number of them. Next time spamd hangs up, you might want to do this check

Re: [sa-list] Re: Spamd keeps getting hung up!

2006-03-13 Thread Dan Mahoney, System Admin
On Fri, 10 Mar 2006, Dan Mahoney, System Admin wrote: Okay. SpamAssassin 3.1.1 -- same problems. Uninitialized values, bad match strings, and the ever popular spamd uses all its children and the spam keeps flowing. http://www.gushi.org/maillogAGAIN.txt (warning, 20 megs) The user

Re: Spamd keeps getting hung up!

2006-03-10 Thread Dan Mahoney, System Admin
On Fri, 10 Mar 2006, Daryl C. W. O'Shea wrote: On 10/03/06 12:50 AM, Dan Mahoney, System Admin wrote: As I'm not a C programmer, I don't know what the relation is between a kqueue and an FD -- but could it be related? kqueues use FDs, so they are related. If that original dccifd process

Re: Spamd keeps getting hung up!

2006-03-10 Thread Dan Mahoney, System Admin
On Fri, 10 Mar 2006, Daryl C. W. O'Shea wrote: On 3/10/2006 11:22 AM, Dan Mahoney, System Admin wrote: I of course have no idea what to make of this output. Pointers? Each line is one file descriptor. So it doesn't appear that it's using an insane number of them. Next time spamd hangs

More Errors (Was Spamd Keeps Getting Hung Up).

2006-03-09 Thread Dan Mahoney, System Admin
First, a note: I wrote this last night but forgot to send. Spamd gave me a lockup YET AGAIN last night, that will be responded to separately. Anyway, I was pretty happy at the number of things I had cleared out, and issues I had resolved. I'm using basically what amounts to a reinstall of

Re: [sa-list] Re: More Errors (Was Spamd Keeps Getting Hung Up).

2006-03-09 Thread Dan Mahoney, System Admin
On Thu, 9 Mar 2006, Daryl C. W. O'Shea wrote: On 09/03/06 02:29 PM, Dan Mahoney, System Admin wrote: Thusfar, here's the continuing list: 1) This old friend. Mar 9 01:38:18 quark spamd[61724]: Use of uninitialized value in pattern match (m//) at /usr/local/lib/perl5/site_perl/5.8.6/Mail

Spamd keeps getting hung up!

2006-03-09 Thread Dan Mahoney, System Admin
Hey all. Had another hangup last night. My full log is at http://www.gushi.org/maillog2.txt (but only for the next 24 or so...don't need to leave that out in the open). Scroll down to about Mar 9 07:13:00 to see what happens. I'm noting a few things. First, almost all of the locked up

Re: [sa-list] Re: Spamd keeps getting hung up!

2006-03-09 Thread Dan Mahoney, System Admin
On Thu, 9 Mar 2006, Daryl C. W. O'Shea wrote: On 09/03/06 03:09 PM, Dan Mahoney, System Admin wrote: Off topic, a bit, but is this harmless? Mar 9 19:18:52 quark spamd[32106]: netset: cannot include 216.89.180.7/32 as it has already been included Mar 9 19:18:52 quark spamd[32106]: netset

Re: [sa-list] Re: Spamd keeps getting hung up!

2006-03-09 Thread Dan Mahoney, System Admin
On Thu, 9 Mar 2006, Daryl C. W. O'Shea wrote: On 09/03/06 07:03 PM, Dan Mahoney, System Admin wrote: On Thu, 9 Mar 2006, Daryl C. W. O'Shea wrote: On 09/03/06 03:09 PM, Dan Mahoney, System Admin wrote: Off topic, a bit, but is this harmless? Mar 9 19:18:52 quark spamd[32106]: netset

Re: [sa-list] Re: Spamd keeps getting hung up!

2006-03-09 Thread Dan Mahoney, System Admin
On Thu, 9 Mar 2006, Daryl C. W. O'Shea wrote: On 09/03/06 07:35 PM, Dan Mahoney, System Admin wrote: On Thu, 9 Mar 2006, Daryl C. W. O'Shea wrote: On 09/03/06 07:03 PM, Dan Mahoney, System Admin wrote: On Thu, 9 Mar 2006, Daryl C. W. O'Shea wrote: On 09/03/06 03:09 PM, Dan Mahoney, System

Re: Spamd keeps getting hung up!

2006-03-09 Thread Dan Mahoney, System Admin
On Fri, 10 Mar 2006, Daryl C. W. O'Shea wrote: On 09/03/06 03:09 PM, Dan Mahoney, System Admin wrote: Hey all. Had another hangup last night. My full log is at http://www.gushi.org/maillog2.txt (but only for the next 24 or so...don't need to leave that out in the open). Scroll down

Re: Spamd keeps getting hung up!

2006-03-09 Thread Dan Mahoney, System Admin
On Fri, 10 Mar 2006, Daryl C. W. O'Shea wrote: On 10/03/06 12:12 AM, Dan Mahoney, System Admin wrote: On Fri, 10 Mar 2006, Daryl C. W. O'Shea wrote: On 09/03/06 03:09 PM, Dan Mahoney, System Admin wrote: Hey all. Had another hangup last night. My full log is at http://www.gushi.org

SQL config lines failing to parse

2006-03-08 Thread Dan Mahoney, System Admin
Hey all, I recently tried to turn on SQL on my SA 3.1.0 installation. Apparently user prefs are okay, but the lines that are supposed to turn on the other two modules don't want to load. I copied the config lines almost verbatim from an existing (working) SA 3.1 server, into local.cf: Mar

Re: SQL config lines failing to parse

2006-03-08 Thread Dan Mahoney, System Admin
On Wed, 8 Mar 2006, Matt Kettler wrote: That fixed half of it. Dan Mahoney, System Admin wrote: Hey all, I recently tried to turn on SQL on my SA 3.1.0 installation. Apparently user prefs are okay, but the lines that are supposed to turn on the other two modules don't want to load. I

  1   2   3   >