Hi, all.
From: [EMAIL PROTECTED] (Justin Mason)
Subject: Re: problem of extracting IP string from header (bug?)
Date: Tue, 16 Aug 2005 19:05:19 -0700
> > For example, below header string, SA failed to execute DNSBLs.
> >
> > | Received: from makorsha.biz ([218.64.103.25])by mxg509.nifty.com wi
Here is another way to do it as well. www.blackholes.us/docs/usage.html
(Above example makes more sense to me though.)
It's also been pointed out that none of the blackholes.us websites load
and some of their rbls have been timing out. :(
Dear;
Thank you very much for the URLs.
I tried to install Mail-SpamAssassin-2.64 to my production environment.
And I tried to install Mail-SpamAssassin-3.0.4 to my test environment.
Both are Raq4s.
I cannot upgrade the perl 5.005 on the production macines at this time.
Because many CGIs are run
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
MATSUDA Yoh-ichi writes:
> Hello, spamassassiners.
>
> Nowadays, many people discuss 'uk.geocities.com' redirecting spam.
> I also received the many spams, too.
>
> By the way, I found a problem of SpamAssassin's extracting IP string
> function.
>
Hello, spamassassiners.
Nowadays, many people discuss 'uk.geocities.com' redirecting spam.
I also received the many spams, too.
By the way, I found a problem of SpamAssassin's extracting IP string
function.
My SpamAssassin (3.0.4) failed to detect almost of all 'uk.geo' spam's
host IP and execut
From a direct mail answer to him:
===8<
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
[EMAIL PROTECTED]
SMTP error fr
mouss wrote:
what about adding geocities and the like to the list of domains for
which lookup uses 3 labels instead of 2?
This way, it would be possible to list domains like uk.geocities.com in
uribl/surbl. after all, the logic that applies to com.uk and friends
also applies to hosters.
The p
This question is getting asked over and over, it's probably about time to
start referring to the archives to not annoy the list users.
But, one more time...Here is another rule that will help catch the Geocities
spam. (reposted twice now)
Here is an RBL test for china IP addresses that connect to
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Chr. v. Stuckrad writes:
> Not yet, because it seems 'too variable' to be caught by
> simple rules. (But who ever would 'click' on such nonsense?)
Isn't that the real mystery? Of course, we don't know if anyone actually
*does*...
- --j.
-BEGIN
On Tuesday 16 August 2005 03:47 pm, Jon Drukman wrote:
> I'm getting a lot of spams slipping thru the net lately. They hit
> BAYES_99 and nothing else, usually, because they contain almost no
> content other than a URL:
>
> http://uk.geocities.com/Robt_Bright/?M0v=Make.your.day_enjoyable.without
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Rick Macdougall writes:
> > Rick Macdougall writes:
> >>Justin Mason wrote:
> >>I'm seeing this in my log files from time to time
> >>
> >>Aug 16 17:07:13 spa001 spamassassin[29154]: Can't locate LMAP/CID2SPF.pm
> >>in @INC
> >> (@INC contains: ../l
what about adding geocities and the like to the list of domains for
which lookup uses 3 labels instead of 2?
This way, it would be possible to list domains like uk.geocities.com in
uribl/surbl. after all, the logic that applies to com.uk and friends
also applies to hosters.
On Tue, Aug 16, 2005 at 02:47:41PM -0700, Jon Drukman wrote:
> I'm getting a lot of spams slipping thru the net lately. They hit
Here too, I have about 150 since 1st of August when
this 'series' seems to have begun. And already users
begin to complain about 'too many of those'...
Always like:
This was discussed a week or 2 ago.
Here is what I am using per somebody's post
uri GEOCITIES /^http:\/\/uk\.geocities\.com\b/i
describe GEOCITIES GEOCITIES with uk.geocities.com
score GEOCITIES 3.1
Brian
- Original Message -
From: "Jon Drukman" <[EMAIL PROTECTED]>
To:
Sent: Tuesday
Jon Drukman wrote:
I'm getting a lot of spams slipping thru the net lately. They hit
BAYES_99 and nothing else, usually, because they contain almost no
content other than a URL:
Have you tried: http://antispam.imp.ch/rules/asciispam.cf ?
Michele
On Tue, Aug 16, 2005 at 02:20:16PM -0700, Justin Mason wrote:
Justin from the next release of 3.1X, can you document some compile flags?
Also, is anyone using a perl 5.8.8per yet?
--
Member - Liberal International
This is [EMAIL PROTECTED] Ici [EMAIL PROTECTED]
God Queen and country! B
I'm getting a lot of spams slipping thru the net lately. They hit
BAYES_99 and nothing else, usually, because they contain almost no
content other than a URL:
http://uk.geocities.com/Robt_Bright/?M0v=Make.your.day_enjoyable.without
URIDNSBL is apparently skipping that due to it being geocitie
Justin Mason wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Rick Macdougall writes:
Justin Mason wrote:
I'm seeing this in my log files from time to time
Aug 16 17:07:13 spa001 spamassassin[29154]: Can't locate LMAP/CID2SPF.pm
in @INC
(@INC contains: ../lib /usr/local/lib/perl5/si
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Rick Macdougall writes:
> Justin Mason wrote:
> I'm seeing this in my log files from time to time
>
> Aug 16 17:07:13 spa001 spamassassin[29154]: Can't locate LMAP/CID2SPF.pm
> in @INC
> (@INC contains: ../lib /usr/local/lib/perl5/site_perl/5.8.2
Justin Mason wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
*** THIS IS A RELEASE CANDIDATE ONLY, NOT THE FINAL 3.1.0 RELEASE ***
SpamAssassin 3.1.0-rc1 is released! SpamAssassin 3.1.0 is a major update.
SpamAssassin is a mail filter which uses advanced statistical and
heuristic tests
You can access all the available versions from the distribution page. A
link to the distribution page can be found in the search results or in
the header of the module page and will look like:
http://search.cpan.org/~felicity/Mail-SpamAssassin-3.0.4/
jdow wrote:
How does one search there fo
On Tue, Aug 16, 2005 at 11:48:26AM -0700, Richard Ozer wrote:
> Search your drive for stray copies of local.cf. See if you ended up with
> an etc/spamassassin directory or have a local.cf in your home directory.
Or even better, as with anytime you have a question about what's going on with
SA,
Search your drive for stray copies of local.cf. See if you ended up with an
etc/spamassassin directory or have a local.cf in your home directory.
RO
- Original Message -
From: "Christopher Scott" <[EMAIL PROTECTED]>
To:
Sent: Tuesday, August 16, 2005 11:30 AM
Subject: Re: question
On Aug 16, 2005, at 1:51 PM, Kevin Peuhkurinen wrote:
Christopher Scott wrote:
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH
(0x8430ec8) implements 'parse_config'
debug: plugin: Mail::SpamAssassin::Plugin::Hashcash=HASH
(0x8e687ec) implements 'parse_config'
config: SpamAssass
Richard Hobbs wrote:
> Hello,
>
> In an attempt to always allow emails from particular domains, I have added
> the following lines into "/etc/spamassassin/local.cf":
>
> def_whitelist_from_rcvd [EMAIL PROTECTED] inmac.co.uk
> def_whitelist_from_rcvd [EMAIL PROTECTED] Inmac.co.uk
> d
Christopher Scott wrote:
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8430ec8)
implements 'parse_config'
debug: plugin: Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8e687ec)
implements 'parse_config'
config: SpamAssassin failed to parse line, skipping: rewrite_subject 1
config
I've got SA 3.04 running on a RH Linux 2.1AS server and it is running
properly Razor2 is installed; DCC and Pyzor are not, as they won't
compile). So far though, it's not doing a very good job of catching
spam; only a small percentage is getting marked.
In an effort to improve it's function
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Steve Martin writes:
> Can someone explain what is going on with this SPF check?
>
> Aug 16 10:36:22 x spamassassin[6873]: spf: checking HELO
> (helo=mail01.infostations.net, ipi.19.135.50)
> Aug 16 10:36:22 x spamassassin[6873]: spf: query
Can someone explain what is going on with this SPF check?
Aug 16 10:36:22 x spamassassin[6873]: spf: checking HELO
(helo=mail01.infostations.net, ip=69.19.135.50)
Aug 16 10:36:22 x spamassassin[6873]: spf: query for /
69.19.135.50/mail01.infostations.net: result: none, comment: SPF:
That was it. I had for some reason has removed the R flag in the
postfix filter that was sending the mail to spamc.
That of course broke spf's ability to do lookups on Return-Path.
On Aug 16, 2005, at 9:29 AM, Steve Martin wrote:
Running spamd with --debug=spf I'm getting some clues
In th
Running spamd with --debug=spf I'm getting some clues
In the spamd log, I'm seeing...
Aug 16 09:16:37 xx spamassassin[6390]: spf: cannot get Envelope-
From, cannot use SPF
But, after I receive the email and run it through, it has no problem
finding Envelope-From.
Anyone know what may
> Do not use 3.0 with PostgreSQL. It's known to have problems. Actually,
> the problem you're seeing might be DBD::Pg related. Did you possibly
> just install a new version? Make sure you are using the version listed
> in sql/README.bayes.
I haven't noticed anything out of the ordinary after I mad
Andre Nicholson wrote:
>This happens when scanning incoming messages and trying to sa-learn them
>manually. The
>errors cause no tokens to be available and thus bayes is ignored. Other than
>reverting
>to a backup of the database, is there something I can do or look at to fix
>this? I've
>never
For the last several days, all messages scanned have not been using bayes
because of an
error:
debug: bayes: tok_get: SQL Error: ERROR: unterminated quoted string at or near
"'" at
character 145
debug: bayes: _put_token: SQL Error: ERROR: unterminated quoted string at or
near "'"
at character
I still have something strange going on that I can't figure out.
When your mail came this morning, it did NOT have SPF_PASS, but if I
run things manually now, I get it.
Here is what I'm seeing when I run things manually now...
The HELO fails like this...
[5056] dbg: spf: checking HELO (helo
Well, that one failed and it wasn't the list-posted copy. That was my direct
email.
And the HELO *should* pass due to the inclusion of IP address.
It looks like you've got a broken trust path and SA is checking the wrong
Received: header.
Is your mailserver NATed?
Do you have trusted_networks
Hello,
In an attempt to always allow emails from particular domains, I have added
the following lines into "/etc/spamassassin/local.cf":
def_whitelist_from_rcvd [EMAIL PROTECTED] inmac.co.uk
def_whitelist_from_rcvd [EMAIL PROTECTED] Inmac.co.uk
def_whitelist_from_rcvd [EMAIL PROTEC
Hi Mouss
mouss wrote:
amavisd regenerates SA headers. you need to "patch" amavisd.
In amavisd (/usr/*/sbin/amavisd), look for X-Spam-Score and uncomment
the corresponding statement.
(you may want to do the same with the checker version header to enable
SA version header).
I forgot to mention
--- Begin Message ---
[EMAIL PROTECTED] wrote:
sarge/perl5.8/i386/spamassassin 3.0.4
Hi list,
I'm training my bayesian base after a disk crash.
sudo /usr/bin/sa-learn --mbox /var/mail/spams --no-sync --spam
sudo /usr/bin/sa-learn --mbox /var/mail/spams --no-sync --ham
sudo /usr/bin/sa-lea
sarge/perl5.8/i386/spamassassin 3.0.4
Hi list,
I'm training my bayesian base after a disk crash.
sudo /usr/bin/sa-learn --mbox /var/mail/spams --no-sync --spam
sudo /usr/bin/sa-learn --mbox /var/mail/spams --no-sync --ham
sudo /usr/bin/sa-learn --sync
and
sudo /usr/bin/sa-learn --dump magic
gi
On Tue, 2005-08-16 at 05:31, jdow wrote:
> From: "Kenneth Porter" <[EMAIL PROTECTED]>
>
> > --On Saturday, August 13, 2005 6:58 PM -0400 Theo Van Dinter
> > <[EMAIL PROTECTED]> wrote:
> >
> >> On Sat, Aug 13, 2005 at 03:07:14PM +0530, Ramprasad A Padmanabhan wrote:
> >>> When I build the rpm from
41 matches
Mail list logo
