Re: custom URIDNSBL rules

2005-02-08 Thread Jeff Chan
On Tuesday, February 8, 2005, 3:37:05 PM, Matt Kettler wrote: > At 02:56 PM 2/8/2005, Shane Metler wrote: >>debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x898ffe4) >>implements 'check_tick' >>debug: URIDNSBL: query for broadcastemail.us took 1 seconds to look up >>(auth2.homes.com.:br

Re: custom URIDNSBL rules

2005-02-08 Thread Matt Kettler
At 02:56 PM 2/8/2005, Shane Metler wrote: debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x898ffe4) implements 'check_tick' debug: URIDNSBL: query for broadcastemail.us took 1 seconds to look up (auth2.homes.com.:broadcastemail.us)" debug: URIDNSBL: domain "broadcastemail.us" listed (UR

Re: Side-warning about the new proxy zombies...

2005-02-08 Thread Brian Godette
On Tuesday 08 February 2005 2:14 pm, Kenneth Porter wrote: > --On Tuesday, February 08, 2005 11:14 AM -0700 Brian Godette > > <[EMAIL PROTECTED]> wrote: > > care must be taken to have the expiry times > > reasonable or the iptables rule lists becomes much too large and > > eventually chews up all

Apache mail list archives

2005-02-08 Thread Thomas Schulz
Does anyone know the email address of the correct person to report problems with the Apache mailing list archives? The mailing list archives have been sick for over a week. Fortunately the MARC archives have come back to life. I tried sending a report to [EMAIL PROTECTED] some 3 days ago, but not

SHA1

2005-02-08 Thread Lightology Postmaster
RH 9.0 SA 3.02 what is the correct way to install SHA1 on perl 5.8.0, where do I get it from and how to install it. My sa-learn is stopping at sha1 and I believe this module may not be installed correctly.  

Re: Side-warning about the new proxy zombies...

2005-02-08 Thread Kenneth Porter
--On Tuesday, February 08, 2005 1:14 PM -0800 Kenneth Porter <[EMAIL PROTECTED]> wrote: Have you seen the "ipset" stuff on the netfilter-devel list? This is a new set of modules that works with sets of addresses. It should allow you to have a much larger rejection list. Just checked, this project

Re: bayes db version error

2005-02-08 Thread Matias Lopez Bergero
Michael Parker wrote: On Tue, Feb 08, 2005 at 05:28:51PM -0300, Matias Lopez Bergero wrote: 2) Throttle the calls to spamd to reduce lock contention. Sorry to ask this again, but I'm not native English speaker :-P Did you mean to increase the number of spamd children processes, like spamd -m x? I

Re: Side-warning about the new proxy zombies...

2005-02-08 Thread Kenneth Porter
--On Tuesday, February 08, 2005 11:14 AM -0700 Brian Godette <[EMAIL PROTECTED]> wrote: care must be taken to have the expiry times reasonable or the iptables rule lists becomes much too large and eventually chews up all available CPU. Have you seen the "ipset" stuff on the netfilter-devel list?

Re: bayes db version error

2005-02-08 Thread Michael Parker
On Tue, Feb 08, 2005 at 05:28:51PM -0300, Matias Lopez Bergero wrote: > > >2) Throttle the calls to spamd to reduce lock contention. > > Sorry to ask this again, but I'm not native English speaker :-P > Did you mean to increase the number of spamd children processes, like > spamd -m x? I have cu

Re: bayes db version error

2005-02-08 Thread Matias Lopez Bergero
Michael Parker wrote: On Tue, Feb 08, 2005 at 04:37:50PM -0300, Matias Lopez Bergero wrote: I'm seeing a lot of messages about and version error in the bayes db in my log file: spamd[6562]: bayes: bayes db version 0 is not able to be used, aborting! at /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAss

RE: disabling ALL_TRUSTED

2005-02-08 Thread Bowie Bailey
From: Arvinn Løkkebakken [mailto:[EMAIL PROTECTED] > > Bowie Bailey wrote: > > >From: Arvinn Løkkebakken [mailto:[EMAIL PROTECTED] > > > >>jdow wrote: > >> > >>>Do not disable it. Fix the cause. > >>> > >>>It's time to hit the wiki and learn how. > >>>{^_^} > >> > >>I hit the wiki and found this

Re: bayes db version error

2005-02-08 Thread Michael Parker
On Tue, Feb 08, 2005 at 04:37:50PM -0300, Matias Lopez Bergero wrote: > I'm seeing a lot of messages about and version error in the bayes db in > my log file: > > spamd[6562]: bayes: bayes db version 0 is not able to be used, aborting! > at /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/BayesS

custom URIDNSBL rules

2005-02-08 Thread Shane Metler
Title: Message Hi SA Users,   I have a question for anyone who may have added their own custom URIDNSBL lookups.   I have set up RBLDNSD (successfully as far as I can see) to support both IPs and URIs.   A command line DNS call returns the expected results, but SA 3.0.0 and URIDNSBL do not

Re: Incredibly slow SA checks

2005-02-08 Thread Gary MacKay
ClamAV is running and the amavis log_level=5 setting shows it scanning very very fast. It is whatever takes place next that is boggin things down. - Gary Richard Ozer wrote: Is clamd running? Is clamav.conf set up to scan via a tcp socket? If neither of those are happening, then you may be expe

Re: Incredibly slow SA checks

2005-02-08 Thread Richard Ozer
Is clamd running? Is clamav.conf set up to scan via a tcp socket? If neither of those are happening, then you may be experiencing an amavis timeout while it tries to communicate with clamd. RO To: Sent: Tuesday, February 08, 2005 11:23 AM Subject: Incredibly slow SA checks What process takes

Re: AWL

2005-02-08 Thread Michael Parker
On Tue, Feb 08, 2005 at 11:55:38AM -0700, Jason Bennett wrote: > > I had to change to the user I actually run as and it removed fine. Is > there a spamassassin command line option to specify a whitelist database > file when I use the --remove... option? > Check out auto_whitelist_path in perldo

How SpamAssassin Works ? How to improve Spam Detection

2005-02-08 Thread Farid Izem
Hi all, I'm new to this mailling lists and to SpamAssassin too. In the past mounths, i have built severals smtp gatewas using the followings : - Postfix 2.13 - Amavisd-new (The lastest Stable Version) - Clamav (0.80) - Mail::SpamAssassin (Lastest Version) Every works great, no crash,

bayes db version error

2005-02-08 Thread Matias Lopez Bergero
Hi I'm seeing a lot of messages about and version error in the bayes db in my log file: spamd[6562]: bayes: bayes db version 0 is not able to be used, aborting! at /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/BayesStore/DBM.pm line 160. I'm using SA 3.0.2. The output of sa-learn show a bay

Incredibly slow SA checks

2005-02-08 Thread Gary MacKay
What process takes place during the "Calling SA checks" routine? I have amavis-new and spamassassin 3.02 running, with SA configured to use SQL. I cranked up the amavis log_level to 5 and watched the logs. They show a message coming in at what I guess to be acceptable speed until just after the

RE: AWL

2005-02-08 Thread Jason Bennett
Actually, I just figured it out. The database for my autowhitelist was not in root's home directory. I didn't realize the "--remove-from-whitelist" option was trying to remove it from a .spamassassin/auto-whitelist from the current user's home directory. I had to change to the user I actually

Re: AWL

2005-02-08 Thread Michael Parker
On Tue, Feb 08, 2005 at 11:46:33AM -0700, Jason Bennett wrote: > > Any other help would be greatly appreciated. > Do you by chance have a sitewide auto-whitelist setup? If so, are you sure that you are reading the correct database with check_whitelist? Run with -D and see if that gives you any

RE: AWL

2005-02-08 Thread Jason Bennett
Thanks! Ok, I used the check-whitelist tool and sure enough, my entry that I'm trying to remove is: 16.5 (329.3/20) -- [EMAIL PROTECTED]|ip=142.179 So I still have the same problem - I run: # spamassassin [EMAIL PROTECTED] Re-check with the "check-whitelist" and I get: 16.5

Re: disabling ALL_TRUSTED

2005-02-08 Thread Jim Maul
Arvinn Løkkebakken wrote: Bowie Bailey wrote: From: Arvinn Løkkebakken [mailto:[EMAIL PROTECTED] jdow wrote: Do not disable it. Fix the cause. It's time to hit the wiki and learn how. {^_^} I hit the wiki and found this patch: http://bugzilla.spamassassin.org/attachment.cgi?id=2508 Is

Re: AWL

2005-02-08 Thread Kris Deugau
Jason Bennett wrote: > I'm having a little trouble with my Spamassassin v3 and the > autowhitelist. I'm trying to remove an email address from the list, > but it is not working. If anyone has any ideas, please let me know. > > Here is what I'm doing: > > #cat auto-whitelist | strings | grep jas

Re: [sa-list] Re: detecting brute-force spams

2005-02-08 Thread Dan Mahoney, System Admin
On Tue, 8 Feb 2005, Dennis Davis wrote: While I like the idea of using an RBL for these types of things, since in theory it would save a lot of load if these emails never even hit spamassassin...my custom rule mentality was more or less for *submitting* to that RBL. This is outside the scope of

Re: disabling ALL_TRUSTED

2005-02-08 Thread Arvinn Løkkebakken
Bowie Bailey wrote: From: Arvinn Løkkebakken [mailto:[EMAIL PROTECTED] jdow wrote: Do not disable it. Fix the cause. It's time to hit the wiki and learn how. {^_^} I hit the wiki and found this patch: http://bugzilla.spamassassin.org/attachment.cgi?id=2508 Is it the fix you were thi

Re: Side-warning about the new proxy zombies...

2005-02-08 Thread Brian Godette
On Thursday 03 February 2005 4:22 pm, Matt Kettler wrote: > At 06:13 PM 2/3/2005, Brian Godette wrote: > >Those sorts of mail servers end up in my firewall rules till some point in > >the > >future. > > I started off using a shun on them as a short-term fix, but then went to a > 500 error message f

AWL

2005-02-08 Thread Jason Bennett
Hi all, I'm having a little trouble with my Spamassassin v3 and the autowhitelist. I'm trying to remove an email address from the list, but it is not working. If anyone has any ideas, please let me know. Here is what I'm doing: #cat auto-whitelist | strings | grep jason [EMAIL PROTECTED]|ip=14

Re: detecting brute-force spams

2005-02-08 Thread Dennis Davis
On Tue, 8 Feb 2005, Rich Puhek wrote: > From: Rich Puhek <[EMAIL PROTECTED]> > To: "Dan Mahoney, System Admin" <[EMAIL PROTECTED]> > Cc: users@spamassassin.apache.org > Date: Tue, 08 Feb 2005 10:29:57 -0600 > Subject: Re: detecting brute-force spams > > Dan Mahoney, System Admin wrote: > > Hey al

RE: disabling ALL_TRUSTED

2005-02-08 Thread Bowie Bailey
From: Arvinn Løkkebakken [mailto:[EMAIL PROTECTED] > > jdow wrote: > > >Do not disable it. Fix the cause. > > > >It's time to hit the wiki and learn how. > >{^_^} > > I hit the wiki and found this patch: > > http://bugzilla.spamassassin.org/attachment.cgi?id=2508 > > Is it the fix you were thi

Re: disabling ALL_TRUSTED

2005-02-08 Thread Arvinn Løkkebakken
jdow wrote: Do not disable it. Fix the cause. It's time to hit the wiki and learn how. {^_^} I hit the wiki and found this patch: http://bugzilla.spamassassin.org/attachment.cgi?id=2508 Is it the fix you were thinking about? Can anyone advice me on how to apply the patch correctly? Thanks. Arvi

Re: detecting brute-force spams

2005-02-08 Thread Rich Puhek
Dan Mahoney, System Admin wrote: Hey all, I host about 500 domains, and every once in a while I see something where a domain gets hammered for a bunch of non-existent users (in my setup, this results in all the emails going to the same place). Is there a custom rule that can be kicked in to dete

[OT] Spamhaus charges that MCI earns $5M a year from "spam gangs"

2005-02-08 Thread Kang, Joseph S.
MCI 'makes $5m a year from spam gangs' By John Leyden Published Monday 7th February 2005 18:29 GMT Spamhaus has slammed MCI for hosting a website selling spamming software that is allegedly integral to the illegal trade in compromised PCs. The site - send-safe.com - sells spamware called Send Safe

RE: SPF troubles with users@spamassassin....list

2005-02-08 Thread Philipp Snizek, seaan.net ag
> $ host -t txt belfin.ch > belfin.ch text "v=spf1 mx:mx.seaan.net -all" > belfin.ch text "v=spf1 a:mx.seaan.net -all" > > There's only supposed to be 1 record, but there are 2. Since > there are no MX RRs for mx.seaan.net, the message fails. > > I think you want the single: > > v=spf1 a:mx

Re: SPF troubles with users@spamassassin....list

2005-02-08 Thread Theo Van Dinter
On Tue, Feb 08, 2005 at 07:32:44AM +0100, Philipp Snizek, seaan.net ag wrote: > mx.seaan.net is approved for belfin.ch, so that mail should have been > accepted. > What should I do? > > Well, I did wait a while but I just got back NDRs. Could you please > investigate that? From a quick check, bel

RE: Tracking Rule Hits

2005-02-08 Thread Gray, Richard
Hrm, this may be a reason to upgrade to 3.0 then From: Ben Story [mailto:[EMAIL PROTECTED] Sent: 08 February 2005 13:55To: Gray, Richard; users@spamassassin.apache.orgSubject: RE: Tracking Rule Hits I believe you could do this using the information that SA puts in syslog now.  It lists e

RE: Tracking Rule Hits

2005-02-08 Thread Ben Story
I believe you could do this using the information that SA puts in syslog now.  It lists each rule hit for a spam as well as the score.   --Benjamin Story, CCNA CCDAClient Server Technical Analystwww.dotfoods.comIT Helpdesk x2312    From: Gray, Richard [mailto:[EMAIL PROTECTED] Sent: Tuesd

RE: Upgrading to 3.0

2005-02-08 Thread Gray, Richard
Thanks for the feedback loren. We do use a *lot* of custom rules, so I'll make it a more long term target I think.   Richard From: Loren Wilton [mailto:[EMAIL PROTECTED] Sent: 08 February 2005 11:10To: users@spamassassin.apache.orgSubject: Re: Upgrading to 3.0 Certainly better spam catch

Tracking Rule Hits

2005-02-08 Thread Gray, Richard
Is there a way to log the number of times a specific rule has hit within spamassassin. Ideally I'd like to see how often a rule hits, and the average score of the messages that it hit on, but anything along those lines would help   At the minute the best idea I have come up with is to use an

Re: Question about URIDNSBL

2005-02-08 Thread Jeff Chan
On Tuesday, February 8, 2005, 5:08:32 AM, Jeff Chan wrote: > Please complain to Barak that their customer walla.com is sending > spam. The problem is not really with SpamHaus but that Barak > apparently continues to allow walla.com to be mentioned in > thousands of reported spam (and probably many

Re: Question about URIDNSBL

2005-02-08 Thread Jeff Chan
On Tuesday, February 8, 2005, 2:58:32 AM, Eli Yukelzon wrote: > http://www.spamhaus.org/SBL/sbl.lasso?query=SBL22121 > The problem is - barak.net.il is one of the MAJOR Israel's ISPs, > and since MANY hosts have NS record matching it, this SBL record > block ALL sites hosted on it. Please compla

Question about URIDNSBL

2005-02-08 Thread Eli Yukelzon
Good day. I've been having some problems with URIDNSBL plugin for Spam Assassin. One of blocked mail came from emailframer.com . After investigating issue this came up: host -t ns emailframer.com emailframer.com name server ns1.barak.net.il. emailframer.com name server ns.barak.net.il. host -t

Re: Upgrading to 3.0

2005-02-08 Thread Loren Wilton
Certainly better spam catching if you aren't using addon rules. Probably better spam catching if you are. Gives you a chance to tell your boss you need to upgrade all the email servers to 3GHz/4GB, and thus you need a pay raise! Version is supported.   Basically, 2.64 is now old and dead, and

Upgrading to 3.0

2005-02-08 Thread Gray, Richard
Apologies for asking this if the answer is obvious, but I couldn't see it anywhere in the wiki   we currently use 2.64   What are the reasons for upgrading to 3.0?   TIA   R --- This email from dns has been validated by dnsMSS Managed Email Sec

dead statesmen

2005-02-08 Thread hamann . w
Hi, is there already a list of dead statesmen - there are occasional messages from people who claim to be widows, sons or whatever. The last two I saw were from Daniel Arap Moi's son and Yassir Arafat's widow :) Wolfgang Hamann

AWL

2005-02-08 Thread Jason Bennett
Hi all, I'm having a little trouble with my Spamassassin v3 and the autowhitelist. I'm trying to remove an email address from the list, but it is not working. If anyone has any ideas, please let me know. Here is what I'm doing: #cat auto-whitelist | strings | grep jason [EMAIL PROTECTED]|ip=14

SPF troubles with users@spamassassin....list

2005-02-08 Thread Philipp Snizek, seaan.net ag
Hi Yesterday I tried to post from my general mailinglist account (mailinglists -at- belfin.ch) a question to [EMAIL PROTECTED] I got back a NDR saying: < mx.seaan.net #5.0.0 X-SecureMail; host mail.apache.org[209.237.227.199] said: 550SPF forgery: Please see http://spf.pobox.com/why.html?send