Re: Plugins Can't be Enabled by Users

Michael Parker wrote: On Fri, Dec 17, 2004 at 05:00:14PM -0600, Stuart Johnston wrote: Yes, quite. I double checked just to be sure and I notice that the 'debug: plugin' line comes after the user_prefs is loaded even if it is loaded by init.pre. Never the less, if I remove the loadplugin line

Re: spamassassin error messages

Has anyone seen this type of error message? Known bug that is fixed? Am running on SuSE 9.1, SA v2.64-3.2. > Use of uninitialized value in length at /usr/lib/perl5/vendor_perl/5.8.3/Mail/SpamAssassin/Bayes.pm line 457. Use of uninitialized value in concatenation (.) or string at /usr/lib/perl5/v

Re: Plugins Can't be Enabled by Users

On Fri, Dec 17, 2004 at 05:00:14PM -0600, Stuart Johnston wrote: > > Yes, quite. I double checked just to be sure and I notice that the > 'debug: plugin' line comes after the user_prefs is loaded even if it is > loaded by init.pre. Never the less, if I remove the loadplugin line > from init.p

Re: Plugins Can't be Enabled by Users

Michael Parker wrote: On Fri, Dec 17, 2004 at 04:41:01PM -0600, Stuart Johnston wrote: I certainly don't disagree with the security problems with allowing users to load plugins. The problem is that in fact, user_conf CAN load a plugin and does quite certainly execute its code, despite what the

Re: Equifax/NCR partnership in spam???

Having worked for an Equifax subsidiary many years ago, let me assure you that Equifax is a real company. In fact, they are one of the credit reporting bureaus, and have been for a long time. But this mail looks pretty suspicious. The website look a little sketchy as well, having no front page

Re: Plugins Can't be Enabled by Users

On Fri, Dec 17, 2004 at 04:41:01PM -0600, Stuart Johnston wrote: > > I certainly don't disagree with the security problems with allowing > users to load plugins. The problem is that in fact, user_conf CAN load > a plugin and does quite certainly execute its code, despite what the > documentati

Re: Plugins Can't be Enabled by Users

Matt Kettler wrote: At 05:04 PM 12/17/2004, Stuart Johnston wrote: I have been having a difficult time getting URIDNSBL to work and I finally figured out why. I was trying to do the loadplugin in a user_prefs file in order to test out a new configuration. The problem is that the builtin plugins

Re: Bayes still not working

On Fri, Dec 17, 2004 at 03:08:24PM -0500, shane mullins wrote: [...] > debug: bayes: 23576 tie-ing to DB file R/O > /var/amavisd/.spamassassin/bayes_toks > debug: bayes: 23576 tie-ing to DB file R/O > /var/amavisd/.spamassassin/bayes_seen > debug: bayes: found bayes db version 3 > debug: Score set

Re: Plugins Can't be Enabled by Users

At 05:04 PM 12/17/2004, Stuart Johnston wrote: I have been having a difficult time getting URIDNSBL to work and I finally figured out why. I was trying to do the loadplugin in a user_prefs file in order to test out a new configuration. The problem is that the builtin plugins can not be enabled

Bayes still not working

I am still not getting any Bayes entries in my maillog.We are running: OpenBSD 3.5, SA 3.0.2, amavisd-new, dcc and razor. With the following info provided, does anyone have any ideas? I could provide more details if needed. Here is my local.cf references to Bayes: use_bayes 1 bayes_auto_le

Re: MIT Spam conference

On Fri, Dec 17, 2004 at 04:39:49PM -0500, Chris Santerre wrote: > Is anyone else planning on attending? Already registered. :) -- Randomly Generated Tagline: How do you make Windows faster? Throw it harder.

Plugins Can't be Enabled by Users

I have been having a difficult time getting URIDNSBL to work and I finally figured out why. I was trying to do the loadplugin in a user_prefs file in order to test out a new configuration. The problem is that the builtin plugins can not be enabled from user_prefs because the default rules (25_

spamd and blacklist issue

We are running SA under spamd (Version 3). My mail logs indicate a server is being blocked by dnsbl.sorbs.net but when I check their database it is not listed. I added their domain name under whitelists in local.cf and restarted spamd but it doesn't see to help. Does anyone have suggestions. I

Re: MIT Spam conference

Chris Santerre wrote: -Original Message- From: William Stearns [mailto:[EMAIL PROTECTED] Sent: Friday, December 17, 2004 3:53 PM To: ML-spamassassin-talk; ml-surbl-discuss Cc: William Stearns Subject: MIT Spam conference Good day, all, I'll be attending the MIT spam conference this year, J

RE: Equifax/NCR partnership in spam???

> >Also, this mail was sent via PowerMTA, which appears to be a tool of >choice for spammers. I've created a rule for this, should this be a >standard rule? Could be a fish. But I wanted to comment on the PowerMTA. It is a legit mailerHOWEVER it is often used by spammers. I also have a local

RE: MIT Spam conference

>-Original Message- >From: William Stearns [mailto:[EMAIL PROTECTED] >Sent: Friday, December 17, 2004 3:53 PM >To: ML-spamassassin-talk; ml-surbl-discuss >Cc: William Stearns >Subject: MIT Spam conference > > >Good day, all, > I'll be attending the MIT spam conference this year, Jan

RE: Equifax/NCR partnership in spam???

Looks like the first attempts at some phishing. The domain name and everything look like NCR BUT the DNS servers are NCRWEBHOST.COM with what looks like a bogus email address for admin contract. Gary -Original Message- From: Michael Barnes [mailto:[EMAIL PROTECTED] Sent: Friday, Decembe

Re: Equifax/NCR partnership in spam???

Justin Mason wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Michael Barnes writes: All, Does anyone have an opinion of the mail below? To me it looks like deceptive marketing practice where the people at equifaxmktg.com are trying to validate emails or something. The scary thing is that equ

Re: Equifax/NCR partnership in spam???

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Michael Barnes writes: > All, > > Does anyone have an opinion of the mail below? To me it looks like > deceptive marketing practice where the people at equifaxmktg.com are > trying to validate emails or something. The scary thing is that > equifaxm

MIT Spam conference

Good day, all, I'll be attending the MIT spam conference this year, Jan 21st, 9-5. Details at http://www.spamconference.org/ . The registration is free, but they suggest an early registration before the conference fills up. I'd love a chance to meet other people working on spamassassin and

RE: Equifax/NCR partnership in spam???

> -Original Message- > From: Michael Barnes [mailto:[EMAIL PROTECTED] > Sent: Friday, December 17, 2004 2:27 PM > To: SpamAssassin Users > Subject: Equifax/NCR partnership in spam??? > > > All, > > Does anyone have an opinion of the mail below? To me it > looks like deceptive marketin

Re: more spam gets through since SA 3.x

Hi Jon, you should upgrade Net::DNS. it won't hurt anything and it will make your RBL checks work. on my system, i ran some statistics, and the SURBL checks are responsible for catching 90% of the spam. okay, I will try to do so! Florian

Equifax/NCR partnership in spam???

All, Does anyone have an opinion of the mail below? To me it looks like deceptive marketing practice where the people at equifaxmktg.com are trying to validate emails or something. The scary thing is that equifaxmktg.com appears to be a division of NCR. I guess its common knowledge that Equifax

not to be outdone! Funny pic!

http://www.fattonyracing.com/neoimages/funny/noninjascopy.jpg We need a place for our pimp ninja rides! --Chris

Filtering unknown Charset

Is there any way of filtering out unknown charsets as in the examples below:- A936ADD5A146DE8ECF3 Content-Type: text/plain; charset="iso-61FC-B" Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="iso-8FCB-F" Content-Transfer-Encoding: quoted-print

Re: SPAM word in subject isnt removed

Zé said: > I use kmail 1.7.2 (kde-3.3.2) and the spam rule puts in the subject the > word > SPAM and is i click to HAM this same email, it does not do anything and > doenst remove the word SPAM of the good email that was considered spam. That's probably a question better asked on a kmail list if n

rule based on mime version header

Hello, I've noticed an interesting ratware pattern in the Mime-Version field that uses "produced by" and then a combination of two random words and a random version number. Here are a few examples: MIME-Version: 1.0 (produced by nightgownbunyan 8.2) MIME-Version: 1.0 (produced by lamellartramway

Re: more spam gets through since SA 3.x

Florian Effenberger wrote: Hi Rakesh, Well i cannot help much in your problem apart from saying what Jeff had said earlier, that you need to upgrade some of your Perl modules. the problem is that I run on a Debian 3.0 system that has older Perl modules. :-) you should upgrade Net::DNS. it won't

Re: more spam gets through since SA 3.x

Hi, This is a known issue, see bug 4007. Thanks for pointing on that! Translators wanted, if you can help bring translated descriptions down below the 50 character mark please feel free to open a bug and attach the translations. Unfortunately, absolutely no time. :-( Otherwise I'd do it. Florian

Re: more spam gets through since SA 3.x

Hi Bowie, As far as I know, the module lookup is a function of the Perl install. In order to keep your current stuff along with the new stuff, you would need a second install of Perl. Why do you want to keep the old modules? I can understand not wanting to upgrade Perl itself, but unless you've go

SPAM word in subject isnt removed

I use kmail 1.7.2 (kde-3.3.2) and the spam rule puts in the subject the word SPAM and is i click to HAM this same email, it does not do anything and doenst remove the word SPAM of the good email that was considered spam. ANy help to remove the word SPAM in subject and why a good email is conside

Re: more spam gets through since SA 3.x

On Fri, Dec 17, 2004 at 04:24:11PM +0100, Florian Effenberger wrote: > Hi Martin, > > >I guess the thing to do is move the de stuff out of the directory and > >run the --lint againif it passes without the 50 characters error > >then that's the issue. > > thanks, that worked! The file is the

Re: more spam gets through since SA 3.x

Florian I guess the thing to do is move the de stuff out of the directory and run the --lint againif it passes without the 50 characters error then that's the issue. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Florian Effenberger wrote: Hi Martin, h

RE: more spam gets through since SA 3.x

From: Florian Effenberger [mailto:[EMAIL PROTECTED] > > > Network tests like RBL, SURBL, etc. probably won't work unless > > you upgrade your Net::DNS to something more recent. > > Okay, will try to do that. Anyone knows how I can tell SA to look > Perl modules up in one additional directory? I d

Re: F.P. with SARE rule

At 10:18 AM 12/17/2004 -0500, Shawn R. Beairsto wrote: I just got a F.P. using one of the SARE rulesets, looks like the SARE_SUB_PENIS_OB rule might need some tweaking. Seems like it fired from the word pennies: Yep.. it's crap like that that makes me staunchly refuse to use .? as a gapping char

Re: more spam gets through since SA 3.x

Hi Martin, I guess the thing to do is move the de stuff out of the directory and run the --lint againif it passes without the 50 characters error then that's the issue. thanks, that worked! The file is the culprit for the lint error message. Have filed a bug report (#4040, closed #4038). No

Re: more spam gets through since SA 3.x

Hi Martin, how did you install SA - source, CPAN, or apt? Source. pick one with a rule in it that SA complains about in the "spamassassin -D --lint". They are 'text' files so you can grep the rule names. warning: description for PORN_URL_SEX is over 50 chars # grep -r "PORN_URL_SEX" /usr/local/sha

F.P. with SARE rule

Good morning everyone,   I just got a F.P. using one of the SARE rulesets, looks like the SARE_SUB_PENIS_OB rule might need some tweaking. Seems like it fired from the word pennies:   Content preview:  Pennies From Heaven The Daily Reckoning [...]   Content analysis details:   (7.9 p

OT found this and thought of y'all

http://scoot.net/gallery/bbs/1823137550.jpg -- Michael H. Collins Admiral, Penguinista Navy http://linuxlink.com /"\ASCII Ribbon Campaign \ / No HTML/RTF in email x No Word docs in email / \ Respect for open standards Take your laptop and yell out: "Can a brother get a ip ad

Re: more spam gets through since SA 3.x

Florian yes I think it's the de locale stuff that's causing the problems. I can't believe no-ones come across this before -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Florian Effenberger wrote: Hi Martin, how did you install SA - source, CPAN, or apt?

Re: more spam gets through since SA 3.x

Hi Shane, To check bayes do spamassassin -D --lint and look for bayes info. Also, check your logs for BAYES entries. debug: config: read file /usr/local/share/spamassassin/23_bayes.cf debug: bayes: no dbs present, cannot tie DB R/O: /root/.spamassassin/bayes_toks I guess that means, no Bayes runnin

Re: more spam gets through since SA 3.x

Florian Effenberger wrote: Hi Martin, what about the SA, CPAN or apt? how did you install SA - source, CPAN, or apt? sorry, I don't understand the question? Default files look OK.anything in the comments at the top of the rule files (the .cf files in /usr/local/share/spamassassin) Which fil

Re: more spam gets through since SA 3.x

Florian Effenberger wrote: Hi Rakesh, Well i cannot help much in your problem apart from saying what Jeff had said earlier, that you need to upgrade some of your Perl modules. the problem is that I run on a Debian 3.0 system that has older Perl modules. :-) But I couldn't help my curiosity as t

Re: more spam gets through since SA 3.x

Florian Florian Effenberger wrote: Hi Martin, ok - updayte Ne:DNS to 0.48 (latest) and the URI checking will start to kick in...this helps alot.. Okay, will try to do that. Anyone knows how I can tell SA to look Perl modules up in one additional directory? I don't want to erase the Debian packa

Re: more spam gets through since SA 3.x

Florian how did you install - apt or cpan??? Wonders if the apt package is confused... -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Florian Effenberger wrote: Hi, Well is it possible that the above warnings are coming because the cf files in /usr/share/s

Re: more spam gets through since SA 3.x

Florian what about the SA, CPAN or apt? Default files look OK.anything in the comments at the top of the rule files (the .cf files in /usr/local/share/spamassassin) also your network tests won't work till Net::DNS is at version 0.48... I presume you've stopped amavis-new/spamd etc before you'

Re: more spam gets through since SA 3.x

To check bayes do spamassassin -D --lint and look for bayes info. Also, check your logs for BAYES entries. I noticed alot of spam that was getting through had invoked the all_trusted rule. Which, gives a -3.000 to the final score. I disabled this rule, for now at least. Hope this helps, Shane

Re: more spam gets through since SA 3.x

Hi, Your install files ;) Yup. :) And the active rulesets. Exactly. Could be. Some perl modules like Net::DNS are known to give issues, when using a older version. So you could do a checkup on that also. I have filed a bug report, ID 4038. Thanks Florian

Re: more spam gets through since SA 3.x

Hi! Locate .cf will show them i guess ;) /root/Mail-SpamAssassin-3.0.2/masses/mass-check.cf /root/Mail-SpamAssassin-3.0.2/rules/30_text_pl.cf /root/Mail-SpamAssassin-3.0.2/rules/20_fake_helo_tests.cf Your install files ;) /usr/local/share/spamassassin/20_body_tests.cf /usr/local/share/spamassassin

Re: more spam gets through since SA 3.x

Hi Martin, what about the SA, CPAN or apt? sorry, I don't understand the question? Default files look OK.anything in the comments at the top of the rule files (the .cf files in /usr/local/share/spamassassin) Which files to check? also your network tests won't work till Net::DNS is at version 0

Re: more spam gets through since SA 3.x

Hi Loren, Hi Raymond, Locate .cf will show them i guess ;) Relevant occurrences: /root/libnet-1.19/libnet.cfg /root/libnet-1.19/blib/lib/Net/libnet.cfg /root/Mail-SpamAssassin-3.0.2/masses/mass-check.cf /root/Mail-SpamAssassin-3.0.2/rules/30_text_pl.cf /root/Mail-SpamAssassin-3.0.2/rules/20_fake_he

Re: more spam gets through since SA 3.x

Hi Shane, I had a similar prob. Check to make sure Bayes is working. Also, check the all trusted rule. How can I check that? GTUBE? Thanks Florian

Re: more spam gets through since SA 3.x

Hi! somewhere that is pointing to the 2.6 install, and SA is finding the rules there, rather than in the new directory where you installed. What "locate" string could I use to locate SA rules? Locate .cf will show them i guess ;) Bye, Raymond.

Re: more spam gets through since SA 3.x

Hi Loren, I don't think so, but perhaps possible. I think more likely you have a path somewhere that is pointing to the 2.6 install, and SA is finding the rules there, rather than in the new directory where you installed. What "locate" string could I use to locate SA rules? Thanks Florian

Re: more spam gets through since SA 3.x

Hi Martin, how did you install - apt or cpan??? Wonders if the apt package is confused... I have installed all Perl modules from APT. Net-Server and libnet are manually installed into /usr/local/share/amavisd-new, because I needed them for amavisd-new. Florian

Re: more spam gets through since SA 3.x

Hi Loren, From a quick scan of that, it looks like you have a somewhat messed up install. You shouldn't be getting those over-length warnings on the standard rules for 3.0. This makes me believe that somehow it is maybe finding your 2.6x rules, which will give this sort of error. I did a updatedb

Re: more spam gets through since SA 3.x

Hi Martin, Can't find it in my email system, and gmames search doesn't want to work right now... can you repost.. of course! insgesamt 576 -rw-r--r--1 root staff6018 17. Dez 11:21 10_misc.cf -rw-r--r--1 root staff1605 17. Dez 11:21 20_anti_ratware.cf -rw-r--r--1

Re: more spam gets through since SA 3.x

I had a similar prob. Check to make sure Bayes is working. Also, check the all trusted rule. Shane - Original Message - From: "Florian Effenberger" <[EMAIL PROTECTED]> To: Sent: Friday, December 17, 2004 3:44 AM Subject: more spam gets through since SA 3.x Hello fellow SA users, may

Learning from forwarded messages

Hello all, I stuck with the problem that incorrectly tagged mail to a dedicated "spam" and "non-spam" mailbox, now comes from the user, seeing as outlook strips out pretty much every useful header. I went through the archives and came upon a script (included below) posted by Ryan Moore. Rya

Re: more spam gets through since SA 3.x

> I have tested this by deleting the folders contents and re-installing SA > - same problem. > > Maybe its because of too old Perl modules that this error message occurs? I don't think so, but perhaps possible. I think more likely you have a path somewhere that is pointing to the 2.6 install, and

Re: more spam gets through since SA 3.x

Hi Jeff, This means you're using old pre-3.X rules. Hm... where are they located? I never modified the rules and installed 3.0.2 just some minutes ago. /usr/local/share/spamassassin lists -rw-r--r--1 root root 6018 17. Dez 09:24 10_misc.cf -rw-r--r--1 root root 160

Re: more spam gets through since SA 3.x

Hi Rakesh, Well i cannot help much in your problem apart from saying what Jeff had said earlier, that you need to upgrade some of your Perl modules. the problem is that I run on a Debian 3.0 system that has older Perl modules. :-) But I couldn't help my curiosity as to why you have disabled Baye

Re: more spam gets through since SA 3.x

Hi, Well is it possible that the above warnings are coming because the cf files in /usr/share/spamassassin are that of the old 2.6X version and not that of 3.x. I have tested this by deleting the folders contents and re-installing SA - same problem. Maybe its because of too old Perl modules tha

Re: more spam gets through since SA 3.x

Hi Loren, Are you running bayes and getting a lot of bayes_99 hits? If so, the score for bayes-99 is a lot lower in 3.0. This has caused problems for some people. I don't run Bayes. Did not run it with 2.64 as well, and it worked fine without. Have you run lint to make sure that all of your rul

Re: more spam gets through since SA 3.x

Florian Effenberger wrote: warning: description for TO_ADDRESS_EQ_REAL is over 50 chars warning: description for PRIORITY_NO_NAME is over 50 chars warning: description for HTML_MIME_NO_HTML_TAG is over 50 chars warning: description for MSGID_FROM_MTA_HEADER is over 50 chars warning: description for

Re: more spam gets through since SA 3.x

Hi Wolfgang, there have been numorous threads about ALL_TRUSTED networks - have a look at the details whether it appears there too unfortunately, the SA site seems to be down at the moment, so I could not look it up. Could you please point me to the right page? Do you mean that some of the Spam

Re: more spam gets through since SA 3.x

Hi Martin, what extra rules have you in /etc/mail/spamassassin. This directory contains two files: init.pre and local.cf init.pre contains (I have not changed this file): === # This is the right place to customize your installation of SpamAssassin. # # See 'perldoc Mail::SpamAssassin::Conf' for det

Re: more spam gets through since SA 3.x

Florian Effenberger wrote: Hi Loren, Are you running bayes and getting a lot of bayes_99 hits? If so, the score for bayes-99 is a lot lower in 3.0. This has caused problems for some people. I don't run Bayes. Did not run it with 2.64 as well, and it worked fine without. Well i cannot help much

Re: more spam gets through since SA 3.x

Are you running bayes and getting a lot of bayes_99 hits? If so, the score for bayes-99 is a lot lower in 3.0. This has caused problems for some people. Alternately, do you *think* you are running bayes, but maybe it isn't working? The database format changed and you need to upgrade it forward

Re: some messages just arent scanned

Hi... --On Thursday, December 16, 2004 4:05 PM + Ronan McGlue <[EMAIL PROTECTED]> wrote: Hi I have a situation where some of the time some messages get through without being scanned at all, and some other get through but without specific headers... eg X-Spam-Score-Int: 174 X-Spam-Report:

Re: more spam gets through since SA 3.x

On Friday, December 17, 2004, 1:44:28 AM, Florian Effenberger wrote: [...] > warning: description for __RCVD_IN_SBL_XBL is over 50 chars > warning: description for EXCUSE_REMOVE is over 50 chars > warning: description for T_DNS_FROM_SECURITYSAGE is over 50 chars This means you're using old pre-3.X

Re: more spam gets through since SA 3.x

Hi Florian, there have been numorous threads about ALL_TRUSTED networks - have a look at the details whether it appears there too Wolfgang >> Hello fellow SA users, >> >> maybe it is a pure coincidence that I receive more spam, but I have the >> feeling that more spam gets through since SA 3

Re: more spam gets through since SA 3.x

Florian what extra rules have you in /etc/mail/spamassassin. Do you use bayes and did you --sync the database... have you enabled the URI scanning? i find this helps alot... Also does spamassassin -D --lint show any problems.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +4

Insecure dependency still

Hi, I've just upgraded to 3.0.2 to see if this would ease my problem, but I'm still getting the same errors as I was with 3.0 I'm running spamd on a Fedora Core 2 machine with perl 5.8.3, connecting remotely from a Solaris server running exim. Some mails get scanned fine, some get the followi

more spam gets through since SA 3.x

Hello fellow SA users, maybe it is a pure coincidence that I receive more spam, but I have the feeling that more spam gets through since SA 3.x. When I look at the untagged spam, it often has only a rating of 1.6 or 3.0, although it looks clearly like spam. In SA 2.x, I had a threshold of 7, now I'

Re: cannot write and parse errors

On Thu, 16 Dec 2004, Richard Ozer wrote: It looks like your port had a 2.x local.cf file Thanks very much to all who responded. The port in question is 3.0.1 on FreeBSD 5.2.1. I had CVSUP'd the system before installing SA, so I'm reasonably sure what I got was current. Note for the FBSD ports ma