Few errors.

2005-12-11 Thread Its Azfar
1. I am getting following errors in my maillog. spamd[6203]: connection from localhost.mydomain.com [127.0.0. 1] at port 52118 spamd[6203]: info: setuid to clamav succeeded spamd[6203]: Creating default_prefs [/nonexistent/.spamassa ssin/user_prefs] spamd[6203]: Cannot write to /nonexistent/.spamas

Custom DCC Header Rules

2005-12-11 Thread Paul R. Ganci
I am using DCC-1.3.23 to do greylisting (dccd greylisting server with the dccm sendmail milter). As a result DCC checksums are performed prior to the Spamassassin 3.1.0 scan. Therefore rather than repeat the DCC checks in Spamassassin I have constructed a custom ruleset to perform the check off

Re: trusted_networks

2005-12-11 Thread mouss
Matt Kettler a écrit : That really makes me wonder if DJB is intentionally trying to make plain qmail an unusable POS so that nobody will be able to use it without patching. Or is it a purely accidental side effect? Any MTA that can ever fail to report the local hostname in the "by" clause

Re: trusted_networks

2005-12-11 Thread DAve
Matt Kettler wrote: At 09:48 AM 12/10/2005, List Mail User wrote: >> Received: from unknown (HELO 207.96.139.179) (unknown) >> by unknown with SMTP; 9 Dec 2005 23:37:06 - > >That's a pretty scary Received: line. At least two of those unknown's should be >known. At absolute minimum the "

Re: message with drug ad image only

2005-12-11 Thread hamann . w
Hi, while I o not ilke neither html mails nor outlook stationery, they seem to ne a fact of life. A rule that drops mails with an image might drop mails using stationary Wolfgang Hamann >> On 12/11/2005 08:31 pm, Kai Schaetzl wrote: >> > Pollywog wrote on Sun, 11 Dec 2005 17:42:38 +: >> >

Re: message with drug ad image only

2005-12-11 Thread Pollywog
On 12/11/2005 08:31 pm, Kai Schaetzl wrote: > Pollywog wrote on Sun, 11 Dec 2005 17:42:38 +: > > they do use different names for > > their files > > well, not according to his posting. The only thing I could think of to deal with it was to add a Maildrop rule to send such files to the spam fo

Re: message with drug ad image only

2005-12-11 Thread Kai Schaetzl
Pollywog wrote on Sun, 11 Dec 2005 17:42:38 +: > they do use different names for > their files well, not according to his posting. Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com

Re: Pyzor timing out

2005-12-11 Thread Pollywog
On 12/11/2005 07:27 pm, Daryl C. W. O'Shea wrote: > SickBoy wrote: > > Pollywog wrote: > >> I checked another machine that has not been patched and is also running > >> the same software versions and there were no errors there, which > >> surprised me, since I had not applied the patch there. > > T

Re: pyzor: failure to parse response?

2005-12-11 Thread OpenMacNews
-BEGIN PGP SIGNED MESSAGE- Hash: RIPEMD160 hi, > Well, the first thing U have to do after installing the pyzor is to > issue command (prefferably after su-ing to user that will be actually > used to invoke the spam scanning) pyzor discover > > That will download the server address (the r

Re: pyzor: failure to parse response?

2005-12-11 Thread SickBoy
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 OpenMacNews wrote: > hi all, > > i've just installed Pyzor for the first time w/ SA -HEAD on OSX. > > grep pyzor on SA --lint's output shows: > > [15236] dbg: pyzor: network tests on, attempting Pyzor > [15236] dbg: pyzor: pyzor is available: /usr/

pyzor: failure to parse response?

2005-12-11 Thread OpenMacNews
-BEGIN PGP SIGNED MESSAGE- Hash: RIPEMD160 hi all, i've just installed Pyzor for the first time w/ SA -HEAD on OSX. grep pyzor on SA --lint's output shows: [15236] dbg: pyzor: network tests on, attempting Pyzor [15236] dbg: pyzor: pyzor is available: /usr/local/pyzor/bin/pyzor [15236] d

Re: Pyzor timing out

2005-12-11 Thread Daryl C. W. O'Shea
SickBoy wrote: Pollywog wrote: I checked another machine that has not been patched and is also running the same software versions and there were no errors there, which surprised me, since I had not applied the patch there. The 'patched errors' only happen in a select few messages. So it's

Re: Pyzor timing out

2005-12-11 Thread Ed Kasky
Pyzor is back up from this end: $ pyzor ping 66.250.40.33:24441 (200, 'OK') Ed . . . . . . . . . . . . . . . Randomly generated quote: "Let no one come to you without leaving better and happier." - Mother Teresa

Re: Pyzor timing out

2005-12-11 Thread Jim Knuth
Heute (am 11.12.2005) schrieb Pollywog ([EMAIL PROTECTED]), > I checked another machine that has not been patched and is also running the > same software versions and there were no errors there, which surprised me, > since I had not applied the patch there. I`ve patched nothing. And I have no

Re: Pyzor timing out

2005-12-11 Thread SickBoy
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Pollywog wrote: > > I checked another machine that has not been patched and is also running the > same software versions and there were no errors there, which surprised me, > since I had not applied the patch there. > > > 8) > As far as I'm con

Re: Pyzor timing out

2005-12-11 Thread Pollywog
On 12/11/2005 06:46 pm, SickBoy wrote: > > In the time of our lil' conversation pyzor got back from dead and it's > functioning properly now. > > The thing I ment was that the pyzor suddenly died few days ago, and > finnaly got back this afternoon; applying a patch has nothing to do with > the ser

Re: Pyzor timing out

2005-12-11 Thread SickBoy
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Pollywog wrote: > > Mine says this, but I applied the 3 in 1 patch that I learned about in this > thread: > > > sending: 'User: anonymous\nTime: 1134325707\nSig: > 177d0df77c0b91197da93b41c85c4f5f3d9b823b\n\nOp: ping\nThread: 31207\nPV: > 2.0\n\n

Re: Pyzor timing out

2005-12-11 Thread Pollywog
On 12/11/2005 11:13 am, SickBoy wrote: > pyzor -d ping Mine says this, but I applied the 3 in 1 patch that I learned about in this thread: sending: 'User: anonymous\nTime: 1134325707\nSig: 177d0df77c0b91197da93b41c85c4f5f3d9b823b\n\nOp: ping\nThread: 31207\nPV: 2.0\n\n' received: 'Thread: 312

Re: message with drug ad image only

2005-12-11 Thread Pollywog
On 12/11/2005 05:31 pm, Kai Schaetzl wrote: > Craig Zeigler wrote on Sun, 11 Dec 2005 11:11:15 -0500: > > The filename is Part 1.1.jpg. > > Use MailScanner or another tool to reject/delete mail with that name. If > it is coming from zombies, just disallow zombies at MTA level. Not > everything anti

Re: message with drug ad image only

2005-12-11 Thread Kai Schaetzl
Craig Zeigler wrote on Sun, 11 Dec 2005 11:11:15 -0500: > The filename is Part 1.1.jpg. Use MailScanner or another tool to reject/delete mail with that name. If it is coming from zombies, just disallow zombies at MTA level. Not everything anti-spam should be done with SA. Kai -- Kai Schätzl,

Re: message with drug ad image only

2005-12-11 Thread Pollywog
On 12/11/2005 04:11 pm, Craig Zeigler wrote: > I have been getting hundreds of these messages per day and don't know > how to stop them. The bayes is only come back at 60%. > > They are the messages advertising drugs with a random subject (yes, I > know, one of the many) The filename is Part 1.1.jp

message with drug ad image only

2005-12-11 Thread Craig Zeigler
I have been getting hundreds of these messages per day and don't know how to stop them. The bayes is only come back at 60%. They are the messages advertising drugs with a random subject (yes, I know, one of the many) The filename is Part 1.1.jpg. There is no virus that I can find. Does anyon

Re: A thought about phone numbers and URIBLs

2005-12-11 Thread Magnus Holmgren
Craig McLean skrev: > Hey folks, I was having a thought about phone numbers in spam messages, > and the old brain pinged an idea at me. I'd really appreciate any feedback! > > It occurred to me that I get a fair amount of spam which includes > phone/fax numbers. It also occurred to me that given a

Re: trusted_networks

2005-12-11 Thread hamann . w
Hi, I had a look at the relevant code - qmail is just receiving the info via env vars. So it might be possible to get the effect by calling qmail-smtpd from inetd rather than from the tcpserver program, or a broken implementation of setting env vars, or by adding an rblsmtpd type process that uns

Re: trusted_networks

2005-12-11 Thread mouss
M. Lewis a écrit : Maybe we should qualify that a little bit more Mouss, "maybe SA should not set ALL_TRUSTED if fetchmail is used and the upstream server is using qmail". my ISP uses qmail, but provides correct Received headers. so it shouldn't be related to qmail. I think it should be li

Re: Pyzor timing out

2005-12-11 Thread SickBoy
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jim Knuth wrote: > Heute (am 11.12.2005) schrieb Chris, > > >>This may be OT, but has anyone noticed that pyzor has been timeing out for >>the past three days? If so, anyone have any idea as to why? > > > > no problems here > > Hmm, are you SU