Re: sa-compile and backlashes

2007-06-01 Thread Loren Wilton
It's consistently interpreting escaped backslashes (\\) as either \" or \"", which screws re2c up because that creates an incorrect amount of "'s. I even tried escaping it has hex "\x52" (or whatever the right number was--don't have my ascii table handy anymore :). Sounds like opening a Bugz

Re: sa-compile and backlashes

2007-06-01 Thread Gus
Loren Wilton wrote: rule work, but the ones with the "\|\\\|" (matching "|\|") all choke: "fro|\""|"{RET("__XM_Sft_Ms_Fp_L33T");} It produces the above output, instead of "fro|\|". Not sure what it's doing. Any solution other than commenting out the offending rules? What version

Re: custom rules within user_prefs

2007-06-01 Thread ian douglas
Thanks, Matt and Loren for your responses. Since I'm hosting with a shared hosting environment company myself, I was asking those questions more on a hunt for information so I could suggest to my provider to allow it. But I definitely get Loren's warning about having performance issues if pars

Re: How To Kill Spam Dead?

2007-06-01 Thread jdow
From: "Justin Mason" <[EMAIL PROTECTED]> Matt Kettler writes: [lots of correct stuff] ... Anyone telling you spammers only or mostly use bogus return addresses either hasn't studied spam extensively or is deluding themselves. Well, they *used* to use bogus addresses -- that was the case 2 or

Re: custom rules within user_prefs

2007-06-01 Thread Loren Wilton
While I agree completely with Matt that user rules are in general pretty safe, there is one more thing to be aware of. A badly-written regex can end up being a DOS attack on SA itself, and by implication on the system and mail processing path. Something with lots of * lengths and backtracking

Re: sa-compile and backlashes

2007-06-01 Thread Loren Wilton
rule work, but the ones with the "\|\\\|" (matching "|\|") all choke: "fro|\""|"{RET("__XM_Sft_Ms_Fp_L33T");} It produces the above output, instead of "fro|\|". Not sure what it's doing. Any solution other than commenting out the offending rules? What version of re2c? There repo

Re: custom rules within user_prefs

2007-06-01 Thread Matt Kettler
ian douglas wrote: > > "Note: if you use spamd, rules placed in user_prefs will be IGNORED by > default. If you add the allow_user_rules option to your local.cf you > can get spamd to honor them. However, before you enable it, you should > know that this is disabled by default for security reasons.

custom rules within user_prefs

2007-06-01 Thread ian douglas
Hi all, long-time SpamAssassin user. I released an open-source web-based training script for CPanel hosting users to train spam/ham based on various configurations, and it's been very well received with a handful of CPanel-based hosting groups that I've shown it to. Check out http://iandouglas.

Re: POPAuth plugin & 3.20?

2007-06-01 Thread Daryl C. W. O'Shea
Henry Kwan wrote: Hi, I've been running the POPAuth plugin on 3.18 with good results but noticed that 3.20 seems to break it. I tried searching the wiki and didn't see an update to the plugin. Is one needed or did I fubar something during 3.18 to 3.20 upgrade? Am currently running CentOS 4.4

POPAuth plugin & 3.20?

2007-06-01 Thread Henry Kwan
Hi, I've been running the POPAuth plugin on 3.18 with good results but noticed that 3.20 seems to break it. I tried searching the wiki and didn't see an update to the plugin. Is one needed or did I fubar something during 3.18 to 3.20 upgrade? Am currently running CentOS 4.4 with Perl 5.85. Wi

Re: zen.spamhaus.org

2007-06-01 Thread Ken A
Jerry Durand wrote: On Jun 1, 2007, at 11:54 AM, Richard Frovarp wrote: That's assuming you aren't using it intelligently. SA checks all received headers via Zen to see if they are in the SBL. PBL and XBL are only checked against last external header, via Zen. Ah, nobody mentioned that S

Re: zen.spamhaus.org

2007-06-01 Thread Jerry Durand
At 12:05 PM 6/1/2007, Rob McEwen wrote: Did you mean to say, "SBL is fine for that." ?? I was going by old info, my server's had a separate rule to use SBL-XBL for years, but since SA now uses pieces of Zen, I killed that rule. -- Jerry Durand, Durand Interstellar, Inc. www.interstellar.c

Re: zen.spamhaus.org

2007-06-01 Thread Rob McEwen
Jerry, I think I'm in totally agreement with you, except when you said: >>"SBL-XBL is fine for that." SBL is fine for checking all the headers... but, per my original message, I think that, like PBL, XBL will trigger too many FPs when checked against all IPs in the headers, not just the sendi

Re: zen.spamhaus.org

2007-06-01 Thread Jerry Durand
On Jun 1, 2007, at 11:54 AM, Richard Frovarp wrote: That's assuming you aren't using it intelligently. SA checks all received headers via Zen to see if they are in the SBL. PBL and XBL are only checked against last external header, via Zen. Ah, nobody mentioned that SA was only using a

Re: sa-compile and backlashes

2007-06-01 Thread Gus
Gus wrote: Sorry if this has come up at all, but I have a few rules that sa-compile chokes on. Wondering if there's a way around it... Here's an example. Original rule: /(?:fr(?:o|0|\(\))(?:n|\|\\\|)[EMAIL PROTECTED])/i Sa-compile seems to interpret every branch of this, so we end up with

Re: zen.spamhaus.org

2007-06-01 Thread Richard Frovarp
Jerry Durand wrote: On Jun 1, 2007, at 9:48 AM, Ken A wrote: see http://www.spamhaus.org/zen/ Quote from that page: "Do not use ZEN in filters that do any ‘deep parsing’ of Received headers, or for other than checking IP addresses that hand off to your mailservers." That's assuming you

Re: zen.spamhaus.org

2007-06-01 Thread Jerry Durand
On Jun 1, 2007, at 10:03 AM, Rob McEwen wrote: Now, if you want to use SBL-XBL, that's fine (I do). "Normal" users on dynamic addresses don't show up on those lists. I disagree. True for SBL, but not for XBL. Consider that there are MANY situations where a small-to-large office will all sh

Re: How to avoid filtering twice when having mail-groups

2007-06-01 Thread Kris Deugau
Manu wrote: > Great, that's what I want. > Currently my .qmail-Files look like this: > > | /opt/psa/bin/psa-spamc accept > | preline /usr/bin/procmail -m -o .procmailrc > > So I have to insert a line before the first line, right? I have no idea. I'm a sendmail+procmail guy. > Would you be so

Re: zen.spamhaus.org

2007-06-01 Thread Jerry Durand
On Jun 1, 2007, at 9:48 AM, Ken A wrote: see http://www.spamhaus.org/zen/ Quote from that page: "Do not use ZEN in filters that do any ‘deep parsing’ of Received headers, or for other than checking IP addresses that hand off to your mailservers."

Re: sa-compile and sa-update

2007-06-01 Thread Daryl C. W. O'Shea
Pete 'Wolfy' Hanson wrote: Should I re-run sa-compile after a rules update by sa-update? Yes.

sa-compile and sa-update

2007-06-01 Thread Pete 'Wolfy' Hanson
Should I re-run sa-compile after a rules update by sa-update? -- Pete Hanson http://www.well.com/user/wolfy http://www.fotolog.net/wolfy

Re: zen.spamhaus.org

2007-06-01 Thread Rob McEwen
> Now, if you want to use SBL-XBL, that's fine (I do). "Normal" users on > dynamic addresses don't show up on those lists. I disagree. True for SBL, but not for XBL. Consider that there are MANY situations where a small-to-large office will all share an IP to the outside world. Maybe we are ta

Re: zen.spamhaus.org

2007-06-01 Thread Ken A
Jerry Durand wrote: At 08:47 AM 6/1/2007, Ken A wrote: Jerry Durand wrote: On Jun 1, 2007, at 6:48 AM, Luis Hernán Otegui wrote: Search through the archives, there was a patch to add it to SA. Also note, do NOT use Zen to evaluate headers or anything in the body. Unless of course you need

Re: zen.spamhaus.org

2007-06-01 Thread Jerry Durand
At 08:47 AM 6/1/2007, Ken A wrote: Jerry Durand wrote: On Jun 1, 2007, at 6:48 AM, Luis Hernán Otegui wrote: Search through the archives, there was a patch to add it to SA. Also note, do NOT use Zen to evaluate headers or anything in the body. Unless of course you need to. ;-) http://wiki.a

Re: Spam from own domain

2007-06-01 Thread Martin Hochreiter
(1) As was said earlier, but in greater detail: tell your MTA to look at the SMTP client's IP address, and trust (do not give to SA) any mail where the client IP address is in your local network(s) (this is the best solution), or (2) Modify the above to check your local network IP range(s), and

Re: zen.spamhaus.org

2007-06-01 Thread Ken A
Jerry Durand wrote: On Jun 1, 2007, at 6:48 AM, Luis Hernán Otegui wrote: Search through the archives, there was a patch to add it to SA. Also note, do NOT use Zen to evaluate headers or anything in the body. Unless of course you need to. ;-) http://wiki.apache.org/spamassassin/TrustedRel

Re: How to avoid filtering twice when having mail-groups

2007-06-01 Thread Manu
Kris Deugau wrote: > > I'm using SpamAssassin 3.0.2 and Qmail on a Debian Sarge Server. > > Administrative hosting panel is Plesk 8.1. > > Between qmail and Plesk, what you're looking for may not be possible > with the obvious exposed controls; you may need to manually dig into > configuration fil

Re: Spam from own domain

2007-06-01 Thread John D. Hardin
On Fri, 1 Jun 2007, Martin Hochreiter wrote: > I have the following option in the local.cf > > header LOCAL_RCVD Received =~ /\S+\.rk-lilienfeld\.at\s+\(.*\[.*\]\)/ > score LOCAL_RCVD -500 > > How can I ensure that at least mails from our local clients are > automatically whitelisted? (1) As w

sa-compile and backlashes

2007-06-01 Thread Gus
Sorry if this has come up at all, but I have a few rules that sa-compile chokes on. Wondering if there's a way around it... Here's an example. Original rule: /(?:fr(?:o|0|\(\))(?:n|\|\\\|)[EMAIL PROTECTED])/i Sa-compile seems to interpret every branch of this, so we end up with multiple re

Re: zen.spamhaus.org

2007-06-01 Thread Jerry Durand
On Jun 1, 2007, at 6:48 AM, Luis Hernán Otegui wrote: Search through the archives, there was a patch to add it to SA. Also note, do NOT use Zen to evaluate headers or anything in the body. Zen is ONLY for approving the server that contacted your server. See the notes on the Spamhaus.org

Re: zen.spamhaus.org

2007-06-01 Thread Martin Jürgens
Thanks, I will search for it. Am Freitag, den 01.06.2007, 10:50 -0300 schrieb Luis Hernán Otegui: > Or, if you could, upgrade to SA 3.2, which includes it. > > > Luix > > 2007/6/1, Martin Jürgens <[EMAIL PROTECTED]>: > > Hi, > > I am running Debian Etch, Exim4 and Spamassassin 3.1.7. > > > > No

Re: Fwd: how to move user_prefs path

2007-06-01 Thread Kris Deugau
Pradeep Mishra wrote: > Dear All > > I have ovserved that iostat on one of my servers running spamassassin > is aprox 12% and when i moved $Home/.spamassassin to somewhere else it > comes down to 2%. I would like to know where can i change the path to > /somehere/.spamassassin ?? > OR How do i cha

Re: How to avoid filtering twice when having mail-groups

2007-06-01 Thread Kris Deugau
Manu wrote: > I'm using SpamAssassin 3.0.2 and Qmail on a Debian Sarge Server. > Administrative hosting panel is Plesk 8.1. Between qmail and Plesk, what you're looking for may not be possible with the obvious exposed controls; you may need to manually dig into configuration files to get the beh

Re: zen.spamhaus.org

2007-06-01 Thread Luis Hernán Otegui
Search through the archives, there was a patch to add it to SA. Luix 2007/6/1, Martin Jürgens <[EMAIL PROTECTED]>: Hi, I am running Debian Etch, Exim4 and Spamassassin 3.1.7. Now I am trying to find out how to make Spamassassin use Spamhaus Zen. I am stuck. Could anyone please tell me what

zen.spamhaus.org

2007-06-01 Thread Martin Jürgens
Hi, I am running Debian Etch, Exim4 and Spamassassin 3.1.7. Now I am trying to find out how to make Spamassassin use Spamhaus Zen. I am stuck. Could anyone please tell me what I have to add to my local.cf in order to use it? Thanks! Martin signature.asc Description: Dies ist ein digital sign

Re: Fwd: how to move user_prefs path

2007-06-01 Thread Matt Kettler
Pradeep Mishra wrote: > Dear All > > I have ovserved that iostat on one of my servers running spamassassin > is aprox 12% and when i moved $Home/.spamassassin to somewhere else it > comes down to 2%. I would like to know where can i change the path to > /somehere/.spamassassin ?? If it's IO, it's p

Fwd: how to move user_prefs path

2007-06-01 Thread Pradeep Mishra
Dear All I have ovserved that iostat on one of my servers running spamassassin is aprox 12% and when i moved $Home/.spamassassin to somewhere else it comes down to 2%. I would like to know where can i change the path to /somehere/.spamassassin ?? OR How do i change the userstate_dir path to /some

Re: Bayes combining and OCR (Was Re: SpamAssassin 3.2 compatiblity)

2007-06-01 Thread Matthias Keller
Justin Mason wrote: Matthias Keller writes: Nix wrote: On 31 May 2007, Graham Murray said: Nix <[EMAIL PROTECTED]> writes: (And, let's be blunt, the pure this-word-is-spammy recognition part of FuzzyOCR is much less smart than the Bayesian system already pres

RE: Installing 3.20 in FreeBSD

2007-06-01 Thread Michael Scheidell
> -Original Message- > From: LuKreme [mailto:[EMAIL PROTECTED] > Sent: Friday, June 01, 2007 3:17 AM > To: users@spamassassin.apache.org > Subject: Installing 3.20 in FreeBSD > > > OK, so I downloaded the test sa320.tgz file and followed the > instructions and when I go to make I get:

Re: Spam from own domain

2007-06-01 Thread Martin Hochreiter
Jonas Eckerman schrieb: Martin Hochreiter wrote: How can I ensure that at least mails from our local clients are automatically whitelisted? Don't feed mail from local clients through SpamAssassin. That's what I want, but how to learn that spamassassin / amavis ?

Re: Spam from own domain

2007-06-01 Thread Jonas Eckerman
Martin Hochreiter wrote: > How can I ensure that at least mails from our local clients are > automatically whitelisted? Don't feed mail from local clients through SpamAssassin. (I guess you also could do this by giving a very low score for ALL_TRUSTED.) /Jonas -- Jonas Eckerman, FSDB & Frukttr

Re: Mail::SpamAssassin::PerMsgStatus::finish "failing" after upgrade from 3.1.7 to 3.2.0

2007-06-01 Thread Joe Flowers
Thanks a lot Justin. This is a big relief. I was worried that SA may fall apart on me today and this makes me feel a lot better. Thank you! Joe Justin Mason wrote: hi Joe -- yep, it is. In fact you should probably use the G_ flag for calling a method in void context, can't recall which one

Re: Mail::SpamAssassin::PerMsgStatus::finish "failing" after upgrade from 3.1.7 to 3.2.0

2007-06-01 Thread Justin Mason
hi Joe -- yep, it is. In fact you should probably use the G_ flag for calling a method in void context, can't recall which one that is ;) --j. Joe Flowers writes: > Thanks Justin. I am embedding Perl inside a C program, so I hope this is > still true. It used to return a non-NULL or at least t

Re: Mail::SpamAssassin::PerMsgStatus::finish "failing" after upgrade from 3.1.7 to 3.2.0

2007-06-01 Thread Joe Flowers
Thanks Justin. I am embedding Perl inside a C program, so I hope this is still true. It used to return a non-NULL or at least the following call used to always return a "count" of 1 and not 0 like it is now after the SA upgrade. count = perl_call_method("Mail::SpamAssassin::PerMsgStatus::finis

Re: Mail::SpamAssassin::PerMsgStatus::finish "failing" after upgrade from 3.1.7 to 3.2.0

2007-06-01 Thread Justin Mason
hi Joe -- just ignore the return value of finish() -- it's a void method. (note how it doesn't mention a return value in its POD doc ;) --j. Joe Flowers writes: > Hello Everyone, > > I'm getting a weird error message that I have never gotten before over > several versions of SA. I just upgrad

Bayes combining and OCR (Was Re: SpamAssassin 3.2 compatiblity)

2007-06-01 Thread Justin Mason
Matthias Keller writes: > Nix wrote: > > On 31 May 2007, Graham Murray said: > > > > > >> Nix <[EMAIL PROTECTED]> writes: > >> > >> > >>> (And, let's be blunt, the pure this-word-is-spammy recognition part of > >>> FuzzyOCR is much less smart than the Bayesian system already present > >>>

Re: How To Kill Spam Dead?

2007-06-01 Thread Justin Mason
Matt Kettler writes: > [lots of correct stuff] > ... > Anyone telling you spammers only or mostly use bogus return addresses > either hasn't studied spam extensively or is deluding themselves. Well, they *used* to use bogus addresses -- that was the case 2 or 3 years ago, before Sender Address Ve

Mail::SpamAssassin::PerMsgStatus::finish "failing" after upgrade from 3.1.7 to 3.2.0

2007-06-01 Thread Joe Flowers
Hello Everyone, I'm getting a weird error message that I have never gotten before over several versions of SA. I just upgraded from "SpamAssassin version 3.1.7 running on Perl version 5.8.8" to "SpamAssassin version 3.2.0 running on Perl version 5.8.8". Now, my calls to Mail::SpamAssassin::Pe

Re: SpamAssassin 3.2 compatiblity

2007-06-01 Thread Matthias Keller
Nix wrote: On 31 May 2007, Graham Murray said: Nix <[EMAIL PROTECTED]> writes: (And, let's be blunt, the pure this-word-is-spammy recognition part of FuzzyOCR is much less smart than the Bayesian system already present in SA: FuzzyOCR should really use the Bayesian system to determine

Re: How to avoid filtering twice when having mail-groups

2007-06-01 Thread Matthias Haegele
Manu schrieb: Hi all, I'm using SpamAssassin 3.0.2 and Qmail on a Debian Sarge Server. Administrative hosting panel is Plesk 8.1. Imagine the following situation: [EMAIL PROTECTED] forwards to [EMAIL PROTECTED], [EMAIL PROTECTED],... Now if SpamAssassin checks [EMAIL PROTECTED] and each user

Re: +36% incomining spam

2007-06-01 Thread Matthias Haegele
Giampaolo Tomassoni schrieb: With respect to the previous Monday. Just wondering why. Are they close to vacation and need to rise some money to bring their children in vacation? Here i can always watch an increase through holidays, seems the botnets get new "feed" when kids power up their viru

Re: create script sa-learn

2007-06-01 Thread LuKreme
On 14-May-2007, at 05:46, Bruno Henrique de Oliveira wrote: Necessary of aid to create one script that it reads the folder .Trainings inside of the Maildir of the user and train as Spam. Soon after the trainings the same script has that to move this message for the Inbox of a called user Spam. On

Re: How To Kill Spam Dead?

2007-06-01 Thread Per Jessen
Dennis Kavadas wrote: > why isn't it useful in a business context ? > there sender gets a challange once ! ...how is that a problem ? > Hi Dennis, It's not a problem per se, just not very useful. In a business context, in particular in a non-English speaking country, the challenge will often ca

Re: OBSCURED_EMAIL ?

2007-06-01 Thread Per Jessen
Daryl C. W. O'Shea wrote: > Yeah, I could. I'd rather just point you at the text you quoted above > (^ really is substituted for @) or the email Theo sent earlier > suggesting the same thing. Combine that with rot13, or any other > rotNN you prefer. Last comment from my side - what I'm having a

Re: SpamAssassin 3.2 compatiblity

2007-06-01 Thread Nix
On 31 May 2007, Graham Murray said: > Nix <[EMAIL PROTECTED]> writes: > >> (And, let's be blunt, the pure this-word-is-spammy recognition part of >> FuzzyOCR is much less smart than the Bayesian system already present >> in SA: FuzzyOCR should really use the Bayesian system to determine the >> spa

Installing 3.20 in FreeBSD

2007-06-01 Thread LuKreme
OK, so I downloaded the test sa320.tgz file and followed the instructions and when I go to make I get: NOTE: the optional libnet module is not installed. Trouble is, libnet11-1.1.2.1_1,1 is installed. I even deleted it and reinstalled it. I also get: NOTE: the optional Compress::Zlib modu

Re: VBounce not working in 3.2.0

2007-06-01 Thread Bob Mortimer
On Wednesday 30 May 2007 21:36, Justin Mason wrote: > Guys -- could you open a bugzilla entry about this, attaching > (a) sample messages that are missed and (b) your relevant configuration > lines? it sounds like it may have something to do with how the > bounces are formatted, I'd guess. Done,