Re: OT: SA also catches security hoaxes

2004-10-23 Thread einheit
Kenneth Porter wrote: --On Saturday, October 23, 2004 3:35 PM -0700 einheit <[EMAIL PROTECTED]> wrote: Those sorts of "honor-system viruses" for unix are quite common, but hardly ever work, up to now, since they require someone with both root access to a unix system, and a lack of sophistication,

Re: network tests

2004-10-23 Thread Dietmar Lippold
Am Mittwoch 20 Oktober 2004 04:46 schrieb Robert Menschel: > Monday, October 18, 2004, 3:27:58 PM, Theo wrote: > > TVD> On Tue, Oct 19, 2004 at 12:19:18AM +0200, Dietmar Lippold wrote: > >> * Which tests (SYMBOLIC_TEST_NAMEs) are not used when I run > >> spamassassin or spamd which option "-L"? >

Re: OT: SA also catches security hoaxes

2004-10-23 Thread Kenneth Porter
--On Saturday, October 23, 2004 3:35 PM -0700 einheit <[EMAIL PROTECTED]> wrote: Those sorts of "honor-system viruses" for unix are quite common, but hardly ever work, up to now, since they require someone with both root access to a unix system, and a lack of sophistication, two qualities which h

Re: OT: SA also catches security hoaxes

2004-10-23 Thread einheit
John Andersen wrote: Instead of laughing at it, has anyone actually LOOKED at what this would install on a redhat system? Feel free - it's likely some rude hack to bypass tcp wrappers, and allow ssh access from anywhere, or install some sort of innocuous-sounding daemon which listens for passw

Re: OT: SA also catches security hoaxes

2004-10-23 Thread John Andersen
On Saturday 23 October 2004 09:43 am, einheit wrote: > Pierre Thomson wrote: > >SpamAssassin flagged this just now, and MailScanner removed it from the > > stream. The main hits were DCC and RBL related. > > > >Good work, SA! > > > >http://frodo.bruderhof.com/redhat.txt > > Nice - SA detected bogos

Re: Dnsbl lookups not working since upgrade to 3.0.0

2004-10-23 Thread Niek
On 10/23/2004 11:28 PM +0200, marti wrote: I am running suse 8.1 just upgraded from 2.64 everything works bar the dnsbl lookups, not had one positive result since upgrading. Is there some other perl modules I need to upgrade? Other than the perl-spamassassin-3.0.0-1.i586.rpm Martin Please don't hij

Dnsbl lookups not working since upgrade to 3.0.0

2004-10-23 Thread marti
I am running suse 8.1 just upgraded from 2.64 everything works bar the dnsbl lookups, not had one positive result since upgrading. Is there some other perl modules I need to upgrade? Other than the perl-spamassassin-3.0.0-1.i586.rpm Martin

Re: Bayes sa-learn change in SA 3.0.1?

2004-10-23 Thread Bill Landry
Second follow-up: Please disregard my last post, this ended up being a directory access issue (yes, user error). The original post under this subject heading is still valid, though. = debug: rewrite_header: ignoring 5, not From, Subject, or To debug: bayes: 9607 tie-ing to DB file R/O /var/am

Re: Bayes sa-learn change in SA 3.0.1?

2004-10-23 Thread Bill Landry
As a follow-up to my own post, since upgrading to SA 3.0.1, I am also seeing: = debug: open of AWL file failed: lock: 6994 cannot create lockfile /var/amavis/.spamassassin/auto-whitelist.mutex: Permission denied debug: bayes: no dbs present, cannot tie DB R/O: /var/amavis/.spamassassin/bayes_to

Re: SpamAssassin timed out [Scanned]

2004-10-23 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 David Thurman writes: > On 10/20/04 8:40 AM, "Matt Kettler" wrote: > > > Mailscanner is inappropriately impatient with SpamAssassin. It's timeouts > > were designed in the pre-bayes era, and are not designed to accommodate > > bayes housekeeping chor

Re: spamd still burning CPU in 3.0.1

2004-10-23 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 BTW, SpamAssassin *is* CPU-intensive. It's designed that way ;) - --j. Tim B writes: > email builder wrote: > > I hurried out and installed 3.0.1, thinking one of those memory/language > > improvements mentioned in the release notes were going to b

Bayes sa-learn change in SA 3.0.1?

2004-10-23 Thread Bill Landry
I have "bayes_auto_expire 0" in my local.cf and instead run "sa-learn --force-expire" via an hourly cron job. With SA 3.0.0 I was see the following results in my hourly cron results e-mails: = synced Bayes databases from journal in 3 seconds: 3677 unique entries (3714 total entries) expired ol

Re: OT: SA also catches security hoaxes

2004-10-23 Thread einheit
Pierre Thomson wrote: SpamAssassin flagged this just now, and MailScanner removed it from the stream. The main hits were DCC and RBL related. Good work, SA! http://frodo.bruderhof.com/redhat.txt Nice - SA detected bogosity in this message, though differently than a human would (If I had gott

2.64 -> 3.0.1 (and Bayes) Help

2004-10-23 Thread Andy Norris
Hi All, If this is in a FAQ or in the history, please point me to it, ridicule me, and go on about your day. :-) We have a Linux server running Ensim. We had SpamAssassin 2.60. Upgraded to 2.64. Then we tried to upgrade to 3.0.0. SpamAssassin would not start. (I did the Bayes sa-learn stuff in

Re: SpamAssassin timed out [Scanned]

2004-10-23 Thread David Thurman
On 10/20/04 8:40 AM, "Matt Kettler" wrote: > Mailscanner is inappropriately impatient with SpamAssassin. It's timeouts > were designed in the pre-bayes era, and are not designed to accommodate > bayes housekeeping chores like expiry and journal syncs. > > In the short term, you can help by runnin

OT: SA also catches security hoaxes

2004-10-23 Thread Pierre Thomson
SpamAssassin flagged this just now, and MailScanner removed it from the stream. The main hits were DCC and RBL related. Good work, SA! http://frodo.bruderhof.com/redhat.txt I hope sysadmins are smart enough to check sources before applying an OS patch!!! Pierre Thomson BIC

Re: spamd still burning CPU in 3.0.1

2004-10-23 Thread Tim B
email builder wrote: I hurried out and installed 3.0.1, thinking one of those memory/language improvements mentioned in the release notes were going to be my savior... Sadly, 3.0.1's spamd has the same CPU-intensive behavior here. I am s at a loss; tried everything I've read... spent days read

Re: No SBL, RBL, SURBL etc. checks

2004-10-23 Thread Jeff Chan
On Saturday, October 23, 2004, 4:36:50 AM, Sven Ehret wrote: > Hello List, > I installaed a Postfix/SA Mailrelay for one of our clients and it's > performing good, /except/, and this could be critical, there are no > SBL, RBL, SURBL or similar checks made. This leads to inacceptable low > scorings

Re: SpamAssassin 3.0.1 is released!

2004-10-23 Thread Michael Parker
On Sat, Oct 23, 2004 at 01:31:20PM +0200, Kai Schaetzl wrote: > Justin Mason wrote on Fri, 22 Oct 2004 20:09:10 -0700: > > > - excessive memory-usage fixes > > > > installed on two machines, no problems so far. Memory usage of MailScanner > is slightly higher after upgrade. I assume the memory-u

No SBL, RBL, SURBL etc. checks

2004-10-23 Thread Sven Ehret
Hello List, I installaed a Postfix/SA Mailrelay for one of our clients and it's performing good, /except/, and this could be critical, there are no SBL, RBL, SURBL or similar checks made. This leads to inacceptable low scorings and could be a showstopper. What may I missing? I thought of firewall

Re: SpamAssassin 3.0.1 is released!

2004-10-23 Thread Kai Schaetzl
Justin Mason wrote on Fri, 22 Oct 2004 20:09:10 -0700: > - excessive memory-usage fixes > installed on two machines, no problems so far. Memory usage of MailScanner is slightly higher after upgrade. I assume the memory-usage fixes were for spamd, anyway? Kai -- Kai Schätzl, Berlin, Germany

Re: False positives with FAKED_HOTMAIL_DAV

2004-10-23 Thread Matt Kettler
At 12:40 PM 10/23/2004 +0200, Frank Tore Johansen wrote: Hi, I have seen a handfull of these mails triggering FAKED_HOTMAIL_DAV, which is kind of bad since it adds 3.9 in version 2.63. The rule has been deleted from the 3.0 series due to FP problems. Suggestion: zero out the rule until you can upg

False positives with FAKED_HOTMAIL_DAV

2004-10-23 Thread Frank Tore Johansen
Hi, I have seen a handfull of these mails triggering FAKED_HOTMAIL_DAV, which is kind of bad since it adds 3.9 in version 2.63. Here are the headers in question, and at the bottom comes the scores from spamassassin. -Frank. --- Received: from listserv.brown.edu (canis.services.brown.edu [128.14

Re: Spam score mismatch

2004-10-23 Thread Matt Kettler
At 06:40 PM 10/22/2004 -0400, Asif Iqbal wrote: @400041797c921b8ffdfc 2004-10-22 21:32:56 [13829] i: clean message (1.6/5.0) for [EMAIL PROTECTED]:7794 in 1.1 seconds, 1227 bytes. @400041797c921b98ef0c 2004-10-22 21:32:56 [13829] i: result: . 1 - BAYES_00,MSGID_DOLLARS,RAZOR2_CF_RANGE_51

Re: 3.0.1 on Cpan yet?

2004-10-23 Thread Theo Van Dinter
On Fri, Oct 22, 2004 at 09:09:35PM -0800, John Andersen wrote: > How long till the new version appears on CPAN? It usually takes anywhere from 6-24 hours before new releases are distributed out to the CPAN mirrors. -- Randomly Generated Tagline: I did this 'cause Linux gives me a woody. It does

Re: [OT] Email Servers

2004-10-23 Thread email builder
> >><[EMAIL PROTECTED]> said: > >>Normal system load averages 0.15, with about 5 spamd processes running. > >>Peak load varies, very occasionally going above 8, with around 30 spamd > >>processes at once. This system has been processing about 20,000 messages > >>per day lately. > > > > > > Thank

3.0.1 on Cpan yet?

2004-10-23 Thread John Andersen
Cpan said my SA was up to date, and spamassassin -V said it was still 3.0.0. How long till the new version appears on CPAN? -- _ John Andersen pgpfz2lxU6e7D.pgp Description: signature

spamd still burning CPU in 3.0.1

2004-10-23 Thread email builder
I hurried out and installed 3.0.1, thinking one of those memory/language improvements mentioned in the release notes were going to be my savior... Sadly, 3.0.1's spamd has the same CPU-intensive behavior here. I am s at a loss; tried everything I've read... spent days reading... please, anyon

SpamAssassin 3.0.1 is released!

2004-10-23 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 SpamAssassin 3.0.1 is released! 3.0.1 contains some important bugfixes, and is recommended. Highlights: - excessive memory-usage fixes - bug fixed which stopped DCC, Pyzor working with amavisd - deprecate RCVD_IN_RFC_IPWHOIS - user_prefs we

Re: [OT] Email Servers

2004-10-23 Thread John Fleming
> What in the world is going on? Isn't it true that spamd (beside DCC) does > its thing w/out disk I/O? If so, what else could be chewing up so much CPU? I don't know - The same thing happens to me a couple of times a day, and I only get about 350 messages per day. Today it was at 12:25p: 11:3

Re: [OT] Email Servers

2004-10-23 Thread email builder
> >>Normal system load averages 0.15, with about 5 spamd processes running. > >>Peak load varies, very occasionally going above 8, with around 30 spamd > >>processes at once. This system has been processing about 20,000 messages > >>per day lately. > > > > > > Thanks for the good info. I'm glad