proper use of internal_networks?

2023-12-07 Thread Dan Mahoney (Gushi)
Hey there all, Recently, we noticed that one of our system's "cron" mails started getting caught by our spam filter (because it had lots of hostnames in it about failed ssh logins, which the uribl plugin didn't like). This system is listed (v4 and v6) in trusted_networks -- and it sends it

Re: [sa-list] Re: [External] warnings with sa-compile?

2023-02-11 Thread Dan Mahoney (Gushi)
On Fri, 10 Feb 2023, Kevin A. McGrail wrote: Does this still occur after a change I made yesterday?  I had a regex that some versions of perl handle and others didn't. Still ongoing as of a few minutes ago. If you want full output, let me know. If there's a way to force sa-compile to use

warnings with sa-compile?

2023-02-09 Thread Dan Mahoney (Gushi)
Hey there all. We're only using two real rulesets: core and kam.cf Our nightly sa-update/sa-compile run is throwing warnings like the following. So, these are only warnings, and the compile continues, but they're making my cron jobs noisy. The questions: 1) Are these known issues. 2) Is

Bayes converstion: SQL--> Redis?

2021-02-04 Thread Dan Mahoney (Gushi)
Hey there all, In looking at my sql server, it looks like the on-disk size of my MySQL DB's is like 9G (because of InnoDB, it's hard to glean just from the filesystem what tables are which). Anyway, I'd like to move over to a global redis system, but I don't see an easy way to convert from

Re: [sa-list] Re: Help writing a rule

2021-01-27 Thread Dan Mahoney (Gushi)
On Wed, 27 Jan 2021, John Hardin wrote: On Wed, 27 Jan 2021, Dan Mahoney (Gushi) wrote: All, I'm noticing a pattern of email like: From: "GUSHI.ORG Administrator" To: y...@gushi.org Subject: Your mailbox has exceeded its quota Or some such nonsense. Now, DMARC and SPF and

Help writing a rule

2021-01-27 Thread Dan Mahoney (Gushi)
All, I'm noticing a pattern of email like: From: "GUSHI.ORG Administrator" To: y...@gushi.org Subject: Your mailbox has exceeded its quota Or some such nonsense. Now, DMARC and SPF and DKIM would be able to block the domain if they tried to spoof it in the From email address. But mail

Undisclosed-recipients: rule?

2021-01-15 Thread Dan Mahoney (Gushi)
All, In doing a sort of my mailbox, I'm finding that there are many popular spams with to: undisclosed-recipients. Which is *legal* but, in some cases shouldn't exist. In our particular use case, the box we're looking to protect is the dayjob's info@ box. Nobody should be bccing the

Rule tag for _USERNAME_?

2021-01-15 Thread Dan Mahoney (Gushi)
All, For dumb reasons, we at the day job are using spamass-milter, which doesn't seem to let SpamAssassin add any extra X-Spam-Foo: message tags beyond stock (I have a github issue open on this, which seems to be where a fork is being maintained). However, in order to work around this,

Doc Bug: Trusted_networks versus internal

2018-03-15 Thread Dan Mahoney (Gushi)
Hey there, I'm seeing conflicting information about what trusted_networks/internal_networks means. One of $dayjob's emails tripped off our internal spamassassin, which was scanning outbound mail as well. Apparently we used a URL in our mail (talking about a security issue) and caused URIBL