Re: [SAtalk] Need help interfacing with local RBL

2002-10-30 Thread Ken Causey
> The tests you performed were manually directed at the rbldns server. > However, RBL queries are done using standard DNS lookups, and are > therefore subject to the normal DNS recursive lookup algorithm. > > So if you didn't delegate the RBL base domain (rbl.mail...) to the > rbldns server, your

Re: [SAtalk] *whine* Local RBL checks not supported

2002-10-30 Thread Ken Causey
> Just create a subdomain, say blacklist.your-domain, and delegate it to > your rbldns server. That's what you'll have to do to use rbldns > anyway. "Local". That means not on the network. 127.0.0.1:53. As noted in my previous email that is the IP in /etc/hosts for rbl.mail.premiernet.net. Tha

RE: [SAtalk] *whine* Local RBL checks not supported.

2002-10-29 Thread Ken Causey
You're right, I'm sure this is doable in some fashion. However there's a limit to how much I want to fool with a server's setup. Note that I'm using a VERY specialized RBL-only DNS daemon here (djbdns's rbldns) and that it only provides RBL data. Frankly this becomes less interesting the more co

RE: [SAtalk] *whine* Local RBL checks not supported.

2002-10-29 Thread Ken Causey
On Tue, 2002-10-29 at 15:30, Steve Thomas wrote: > I'm not sure why you couldn't use "localhost" as the rbl server. In your > previous example I saw "local" as the rbl server. Unless you've got "local" > in your /etc/hosts file, it's not going to resolve. "localhost" *should* be > in /etc/hosts, a

RE: [SAtalk] *whine* Local RBL checks not supported.

2002-10-29 Thread Ken Causey
On Tue, 2002-10-29 at 15:30, Steve Thomas wrote: > | do_rbl_lookup) which contacts the $rbl_domain directly. This would > | allow me to do such things as defining the $rbl_domain as an alias for > | 127.0.0.1 in /etc/hosts and keeping the request completely local as > | needed. > > I'm not sure w

[SAtalk] *whine* Local RBL checks not supported.

2002-10-29 Thread Ken Causey
ving to repatch my installation each time Duncan releases a new deb would be a real pain in the butt. Ken Causey --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://t

[SAtalk] check_rbl() needs to exclude reserved IPs BEFORE trimming

2002-10-29 Thread Ken Causey
th reserved IPs before hitting the net at large. When check_rbl gets ahold of it it trims off only the last 2 hosts which having reserved IPs don't get checked at all since there is some logic to skip the check altogether for reserved IPs.

[SAtalk] Need help interfacing with local RBL

2002-10-29 Thread Ken Causey
SPAM: MSG_ID_ADDED_BY_MTA_3 (0.9 points) 'Message-Id' was added by a relay (3) SPAM: SPAM: End of SpamAssassin results - It doesn't appear to be even trying RBL checks. I don't have it disabled: mail:~# grep skip_rbl_check /etc/spa

[SAtalk] Re: Need help interfacing with local RBL

2002-10-29 Thread Ken Causey
I failed to note in my original message that rbldns only listens for UDP packets. Can SA handle rbl checks via UDP? Ken --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf __

RE: [SAtalk] MS Outlook gets weirder with 2002

2002-10-25 Thread Ken Causey
On Thu, 2002-10-24 at 22:48, Michael Moncur wrote: > > I don't know how they manage it but MS seems determined to do the > > strangest things. A customer using MS Outlook 2002 sends himself a > > message with no subject and only the words "Hi there" and it manages a > > score of 5.084: > > As som

[SAtalk] MS Outlook gets weirder with 2002

2002-10-24 Thread Ken Causey
*sigh* I don't know how they manage it but MS seems determined to do the strangest things. A customer using MS Outlook 2002 sends himself a message with no subject and only the words "Hi there" and it manages a score of 5.084: FROM_AND_TO_SAME_5 1.314 HTML_70_90

Re: [SAtalk] SA VERY slow tonight

2002-10-10 Thread Ken Causey
ISDN > (219) 322-2180 Quality Service, Affordable Prices > http://www.jorsm.com Serving Gov, Biz, Indivds Since 1995 > --------- > > On 10 Oct 2002, Ken Causey wrote: > > > spamassassin is

[SAtalk] Spamassassin stalls, what's munitions2.xs4all.nl (194.109.217.74)

2002-10-10 Thread Ken Causey
I think it's something to do with razor. But it stalls for many many minutes on connecting to this server and doesn't seem to be affected by razor_timeout. Anybody have a clue? I've disabled RAZOR_CHECK altogether for now. Time to check out pyzor I guess. Ken ---

[SAtalk] SA VERY slow tonight

2002-10-10 Thread Ken Causey
e a significant difference. It's stalling for many minutes (I'm at 8 right now and still waiting) so I can't even get any logs to see what's taking so long. Anyone have any ideas? This is killing my server. Ken Causey ---

[SAtalk] local.cf whitelist entries not being honored in 2.41?

2002-09-26 Thread Ken Causey
PERCASE_25_50,USER_IN_WHITELIST version=2.41 X-Spam-Level: And the whitelist entry works. Can anyone figure out what's going on here? Thanks, Ken Causey --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven.

Re: [SAtalk] X-Mailer: Atlas Mailer 2.0 is spam mailer?

2002-05-31 Thread Ken Causey
Berch wrote: > On Friday, May 31, 2002, at 07:20 AM, Ken Causey wrote: > > In my daily missed spam harvesting I'm noticing this X-Mailer header: > > > > X-Mailer: Atlas Mailer 2.0 > > > > occassionally. Can anyone confirm or deny that this is a spam oriented &g

[SAtalk] X-Mailer: Atlas Mailer 2.0 is spam mailer?

2002-05-31 Thread Ken Causey
In my daily missed spam harvesting I'm noticing this X-Mailer header: X-Mailer: Atlas Mailer 2.0 occassionally. Can anyone confirm or deny that this is a spam oriented mailer? Until I hear otherwise I believe I'll stick in a rule for it. Thanks, Ken __

Re: [SAtalk] HTML comments not searched by body rule?

2002-05-21 Thread Ken Causey
Great! Thank you. On Tue, 2002-05-21 at 15:17, Theo Van Dinter wrote: > On Tue, May 21, 2002 at 03:03:06PM -0500, Ken Causey wrote: > > body IMAS_SCRIPT/imas.?script/i > > > > What's up with that? HTML comments are not searched? > > Try using

[SAtalk] HTML comments not searched by body rule?

2002-05-21 Thread Ken Causey
I recently mentioned the occurrence of spams referring to something called IMAS. In particular they are HTML emails and will include near the beginning OK. So I added the following the my local.cf: body IMAS_SCRIPT/imas.?script/i describe IMAS_SCRIPTTag indicating

[SAtalk] Stormpost? Blank headers?

2002-05-20 Thread Ken Causey
Two questions in this one. First, would it be difficult to add a rule for blank headers? For example Return-Path: <[EMAIL PROTECTED]> X-Sieve: cmu-sieve 2.0 Received: from mail.premiernet.net [205.229.224.233] by localhost with POP3 (fetchmail-5.9.0) for ken@localhost (single-drop); Sun

[SAtalk] Offer888 email

2002-05-17 Thread Ken Causey
I've been getting quite a few of these messages that seem to consistently refer to offer888, and there's not much content here to work with, so I added the following to my local.cf: body OFFER888 /offer888/i describe OFFER888 UCE from Offer888.net score OFFER888 2.5 The

[SAtalk] [Fwd: Who's We.... Information through stimulation]

2002-05-14 Thread Ken Causey
I'm getting a lot of similar messages slipping through SAs fingers lately that are similar to this one and I would like to figure out something to do about them sooner than later. Primarily what I'm wondering is what is IMAS Messaging Application Server IMAS? I've not previously noticed messa

Re: [SAtalk] Yet another From: format?

2002-05-12 Thread Ken Causey
Yes, Ed Henderson was quickest on the draw in pointing out my flub up. Thanks! Ken Craig R Hughes wrote: > I think the problem is that you need a * before the @s > > C > > Ken Causey wrote: > > KC> At a user's request I recently whitelisted > KC> > KC&g

RE: [SAtalk] Turning on SA sitewide, overriding on a per-user basis?

2002-05-03 Thread Ken Causey
Thanks again Ed. I had to modify the script slightly to get it to work with my procmail (procmail v3.22 2001/09/10): # Test for nospamcheck :0 * ? test -f $HOME/.nospamcheck { #if nospamcheck exists then deliver normally :0: $ORGMAIL } #Filter message thru SA :0fw | /usr/bin/spamc -u $LO

RE: [SAtalk] Turning on SA sitewide, overriding on a per-user basis?

2002-05-03 Thread Ken Causey
Thank you, this looks like a possible solution! Ken On Fri, 2002-05-03 at 11:12, CertaintyTech - Ed Henderson wrote: > > > > > > You could add an entry to the main procmailrc that checks for the > > existence > > of a certain file called "nospamcheck" (or something like that). IF the > > file e

[SAtalk] Turning on SA sitewide, overriding on a per-user basis?

2002-05-03 Thread Ken Causey
I need some SA specific procmail help and I'm hoping someone on the list has already run into this. I've recently setup SA for a small ISP (about 1000+ mailboxes). 99% percent of their customers are happy, there are a couple that are offended that their email is being "modified". Can I continue

Re: [SAtalk] [Fwd: I have some exclusive information for you.]

2002-05-03 Thread Ken Causey
I want to apologize to everyone for my fumble here. I will be more careful in the future. Ken On Fri, 2002-05-03 at 09:25, Theo Van Dinter wrote: > On Fri, May 03, 2002 at 09:20:34AM -0500, Ken Causey wrote: > > Not much to filter here, I reported it to razor as well as AOL. > &g

[SAtalk] [Fwd: I have some exclusive information for you.]

2002-05-03 Thread Ken Causey
Not much to filter here, I reported it to razor as well as AOL. --- Begin Message --- Check out the most exclusive sex guide site on the net, for men and women! http://pleasurelover.subverter.net";>Click here! --- End Message ---

Re: [SAtalk] Appending original message as MIME attachment?

2002-05-01 Thread Ken Causey
#x27;m actually quite motivated to do > the coding myself; I have a couple of other things I'm probably going to be > working on, but might well have 130 done by month end. > > C > > Ken Causey wrote: > > KC> I've just recently setup SA for an ISP customer of mine

RE: [SAtalk] Appending original message as MIME attachment?

2002-05-01 Thread Ken Causey
wrote: > "man Mail::SpamAssassin::Conf" is your friend. Look for "report_header" > option. > > --- > Ed. > > > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED]]On Behalf Of Ken > &

[SAtalk] Appending original message as MIME attachment?

2002-05-01 Thread Ken Causey
nd the MUA would render it correctly. Ken Causey ___ Have big pipes? SourceForge.net is looking for download mirrors. We supply the hardware. You get the recognition. Email Us: [EMAIL

RE: [SAtalk] Can't whitelist_from local addresses?

2002-04-23 Thread Ken Causey
Heh! Thanks! I'll have to give that one a bit of a thought to think if I want to apply that. Sort of overrides my ability to setup a blacklist, which I've yet to have any need of... Ken On Tue, 2002-04-23 at 17:18, Craig R Hughes wrote: > Ken Causey wrote: > > KC>

RE: [SAtalk] Can't whitelist_from local addresses?

2002-04-23 Thread Ken Causey
*sigh* I could have sworn that I did indeed restart spamd. But just to be sure, after getting this message I made sure that spamd stopped and started from scratch. I had to wait for another error to come through, but once it did, it was clear that the whitelist applied. Thanks for the sanity c

[SAtalk] Can't whitelist_from local addresses?

2002-04-23 Thread Ken Causey
ght that I would get some opinions first before adding to bugzilla needlessly. Ken Causey ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] FORGED_*_RCVD scores low?

2002-04-19 Thread Ken Causey
OK, after reading through the source for one of the Received header tests, I realize they aren't exactly infallible. Thanks. Ken Causey On Fri, 2002-04-19 at 10:31, Bart Schaefer wrote: > On 19 Apr 2002, Ken Causey wrote: > > > Is there any case in which a "valid"

[SAtalk] FORGED_*_RCVD scores low?

2002-04-19 Thread Ken Causey
e higher scores? I do realize that I can change the scores, and I may do that, but I thought I would check and see if there was some logic or bit of information that I'm missing. Ken Causey ___ Spamassassin-talk mailing list [EM

[SAtalk] What does whitelist_from apply to?

2002-04-15 Thread Ken Causey
1017793410/mail.premiernet.net" X-UIDL: `0*!!lC?"!~`Z!!,al"! and my /etc/spamassassin/local.cf includes: whitelist_from [EMAIL PROTECTED] and yes, I restarted spamd. Ken Causey ___ Spamassassin-talk mailing list [EMAIL PR

[SAtalk] Handling reporting

2002-04-02 Thread Ken Causey
uation. I would like to point out that I have the one stipulation that all messages are at least glanced at before reporting so that false reports are less likely to slip through. Thanks, Ken Causey ___ Spamassassin-talk mailing list [EMAIL PROTE

[SAtalk] What does spamassassin -r actually do?

2002-04-02 Thread Ken Causey
s ordb. If not currently, is this something that is planned? I currently do this myself and have a program that I use to try to semi-automate this. But it's a bear of a problem (that is assuming you don't feel comfortable flooding the relay databases with likely false repor