On 28.06.2007 08:14, Lindsay Haisley wrote:
> On Wed, 2007-06-27 at 22:24 -0500, Lindsay Haisley wrote:
>> I just upgraded from SA 3.1.8-gr1 to SA 3.2.1-gr1 (Gentoo) and notice
>> that I'm no longer getting any BAYES_NN test notices in my X-Spam-Status
>> summary in my mail headers, or in the conte
I occasionally get mails bounced due to a "syntax error".
They dont look suspicious to me, however.
Is there a tool to"validate" mails?
Wolfgang
sample message
From: [EMAIL PROTECTED]
Subject: BETROFFEN
To: "scanner" <[EMAIL PROTECTED]>, [EMAIL PROTECTED]
Date: Wed, 27 Jun 2007 13:38
On Wed, 2007-06-27 at 22:24 -0500, Lindsay Haisley wrote:
> I just upgraded from SA 3.1.8-gr1 to SA 3.2.1-gr1 (Gentoo) and notice
> that I'm no longer getting any BAYES_NN test notices in my X-Spam-Status
> summary in my mail headers, or in the content analysis details in
> intercepted spam. Under
Raymond Dijkxhoorn wrote:
Hi!
Jun 27 14:50:03 vmx80 MailScanner[4491]: Message l5RCnxP8019756 from
212.127.254.149 ([EMAIL PROTECTED]) to quicknet.nl is spam,
SpamAssassin (not cached, score=24.191, required 5, BAYES_50 0.00,
BODY_EMPTY 0.50, GMD_PDF_BAD_FUZZY 20.00, GMD_PDF_HORIZ 0.25,
GMD_PD
Is there a way to configure it to block emails incoming-or-outgoing so
that
realms A,B and C will only allow relay based off of two conditions: A:
user
SA itself can't do what you want, for one very simple reason: SA is merely a
message filter that adds markup to a message, SA is not a message
I just upgraded from SA 3.1.8-gr1 to SA 3.2.1-gr1 (Gentoo) and notice
that I'm no longer getting any BAYES_NN test notices in my X-Spam-Status
summary in my mail headers, or in the content analysis details in
intercepted spam. Under 3.1.8 I was getting Bayesian filter scores on
everything since I'
arni wrote:
Hi,
its come up several times now that people ask for a way to directly
detect pdf spam by the pdf content and not only through headers or
other means (hashes, bayes).
I've found a solution that should be pretty easy to realise in a
Fuzzy-OCR like plugin. Here is what it should do
I am currently working with a postfix cluster with 15 nodes in it. A few of
the domains hosted are filtered via a different (non-spamassassin) filtering
service. Most of the domains are not.
The user-accounts when sending mail use a combination of SMTP Auth and a DB
table that stores the IP they
Hi,
its come up several times now that people ask for a way to directly
detect pdf spam by the pdf content and not only through headers or other
means (hashes, bayes).
I've found a solution that should be pretty easy to realise in a
Fuzzy-OCR like plugin. Here is what it should do:
Use xpdf
[EMAIL PROTECTED] wrote:
John Rudd wrote:
Robert Schetterer wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
arni schrieb:
Raymond Myren schrieb:
Hello,
Just today I started receiving spam mails with attached .pdf files
with a spam image.
Any ideas how to stop this spam type?
\raymond
[EMAIL PROTECTED] schrieb:
Actually it did, take away the spamtrap fed blackholes (PBL and SPAMCOP)
and the spamtrap fed BAYES as well and it scores a whopping 3.1 thanks
to the BOTNET plugin (which is amazing btw). That hit was all from
late-receiver effect.
That sounds a bit like "if we stoppe
Leonardo Magallon wrote:
>
> How do I enable the Botnet check in my spamassassin?
>
>
>
> Thanks.
>
First, get the botnet plugin, this is a third-party add-on to SA.
As far as I know the proper source for botnet is:
http://people.ucsc.edu/~jrudd/spamassassin/Botnet.tar
Follow the directions in
John Rudd wrote:
> Robert Schetterer wrote:
>> -BEGIN PGP SIGNED MESSAGE-
>> Hash: SHA1
>>
>> arni schrieb:
>>> Raymond Myren schrieb:
Hello,
Just today I started receiving spam mails with attached .pdf files
with a spam image.
Any ideas how to stop this spam type?
Kontakt: [EMAIL PROTECTED]
Gotta admire the spammer's honesty...
Loren
This morning, i see where i got hit with 20-30 undelivered or returned
emails. All these emails had different from's ([EMAIL PROTECTED])
and all were addressed to me but had fake real names. Clearly these are
spam emails as the bodies had something like the following:
Dobrogo vremeni sytok dami i g
How do I enable the Botnet check in my spamassassin?
Thanks.
Leonardo Magallon
Network Security and Sytems Administrator
Integrated Trade Systems, Inc.
713-430-3146
Micro 846-3146
This message and any attachments are CONFIDENTIAL. If you received this
email in error DO NOT read the
Nigel Frankcom wrote:
On Wed, 27 Jun 2007 08:48:02 -0400, David Boltz <[EMAIL PROTECTED]>
wrote:
I?ve been getting the lint failures found below on my Rules Du Jour
updates for a few weeks now. Yes this would be since the DDoS attacks
on rulesemporium. It looks like the same problem people ha
Hi!
Jun 27 14:50:03 vmx80 MailScanner[4491]: Message l5RCnxP8019756 from
212.127.254.149 ([EMAIL PROTECTED]) to quicknet.nl is spam,
SpamAssassin (not cached, score=24.191, required 5, BAYES_50 0.00,
BODY_EMPTY 0.50, GMD_PDF_BAD_FUZZY 20.00, GMD_PDF_HORIZ 0.25, GMD_PDF_STOX
1.00, PROLO_NO_URI 0.
Eagerly awaiting your latest treat! ;-)
Dallas Engelken wrote:
>
> The cats out of the bag now! :)
>
> More details on this will be made available later today hopefully.
>
Raymond Dijkxhoorn wrote:
>
> Jun 27 14:50:03 vmx80 MailScanner[4491]: Message l5RCnxP8019756 from
> 212.127.254.149 ([EMAIL PROTECTED]) to quicknet.nl is spam,
> SpamAssassin (not cached, score=24.191, required 5, BAYES_50 0.00,
> BODY_EMPTY 0.50, GMD_PDF_BAD_FUZZY 20.00, GMD_PDF_HORIZ 0.25,
As many of you know, I do front end spam filtering and I block a lot of
spam. I have been feeding some of this blocked spam to others who can
use it to mine for information like IPs to block, virus infected hosts,
URIBL etc. I also have several feeds as to what kind of spam you want
and I add h
John Rudd wrote the following on 6/27/2007 10:27 AM -0800:
> Bret Miller wrote:
>>> Perhaps more a clamav question, but does anyone use the additional
>>> definitions for clam from SaneSecurity and are they helpful in the
>>> Spam Wars?
>>
>> You're in luck! I just installed them yesterday. Had bee
I'm using it and I really like it. Very effective.
Craig Carriere schrieb:
Perhaps more a clamav question, but does anyone use the additional
definitions for clam from SaneSecurity and are they helpful in the Spam
Wars?
Thanks
very effective"
M. Häker
> Bret Miller wrote:
> >> Perhaps more a clamav question, but does anyone use the additional
> >> definitions for clam from SaneSecurity and are they helpful
> >> in the Spam Wars?
> >
> > You're in luck! I just installed them yesterday. Had been
> meaning to for
> > a while, but things have been t
> -Original Message-
> From: John Rudd [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, June 27, 2007 1:27 PM
> To: Bret Miller
> Cc: users@spamassassin.apache.org
> Subject: Re: SaneSecurity
>
> Bret Miller wrote:
> >> Perhaps more a clamav question, but does anyone use the addit
Bret Miller wrote:
Perhaps more a clamav question, but does anyone use the additional
definitions for clam from SaneSecurity and are they helpful
in the Spam Wars?
You're in luck! I just installed them yesterday. Had been meaning to for
a while, but things have been too busy to get the script
Robert Schetterer wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
arni schrieb:
Raymond Myren schrieb:
Hello,
Just today I started receiving spam mails with attached .pdf files
with a spam image.
Any ideas how to stop this spam type?
\raymond
as i said several times on this maillist no
Hello all,
Could somebody point out how to fix the following errors (getting them when
running spamassassin --lint)
[12449] warn: config: 'uridnsbl_timeout' is obsolete, use 'rbl_timeout'
instead at
/usr/lib/perl5/vendor_perl/5.8.5/Mail/SpamAssassin/Pl
I have a mailing list with a single user who randomly bounces spam to
the mailing list because his filters tag it as spam.
Do the bounces have his return address on them?
Matt
His poorly performing spam filter (no clue if it's SA or not) is
affecting 100's or 1000's of users who generally wan
> Perhaps more a clamav question, but does anyone use the additional
> definitions for clam from SaneSecurity and are they helpful
> in the Spam Wars?
You're in luck! I just installed them yesterday. Had been meaning to for
a while, but things have been too busy to get the script written to
update
Perhaps more a clamav question, but does anyone use the additional
definitions for clam from SaneSecurity and are they helpful in the Spam
Wars?
Thanks
On Wed, Jun 27, 2007 at 04:30:12PM +0100, Nix wrote:
> But I'm glad to hear that it's meant to work and is working :) I guess
> I hit a glitch in the updates-updating process.
IIRC, there were some issues back before 3.2.0 was released, where the
3.2 branch was different than trunk but wasn't cons
It depends on the version that the 3.2-branch announces itself as, I
think, since that determines the DNS name that's checked within the
SA channel.
Good point.
Then, just FYI, here (for the moment),
> spamassassin --version
SpamAssassin version 3.2.2-r547235
running on Perl version 5
FYI.
After chatting in #irc, checking execution with DEBUG enabled
spamassassin --debug --remove-addr-from-whitelist ...
clearly shows the problem,
[24453] dbg: auto-whitelist: tie-ing to DB file of type DB_File R/W in
/var/root/.spamassassin/auto-whitelist
Checking the documentatio
On 27 Jun 2007, JT DeLys said:
>> The same thing is true if you install from the 3.2-branch, or at least
>> it was in the 3.2.0 days
>
> I'm currently running a build from svn 3.2-branch, and it /seems/ to
> be working correctly. There are, at least, files being pulled into my
> LOCALSTATEDIR for
Peter Clark wrote:
> You might wanna try thinking like a spam engine when sending an email!
> I think this probably got stuck in everyones junk box :)
>
Of course not, the list is whitelisted and never gets to SA in the first place.
Hmm, except in the second place, when as HAM it is directed to
You might wanna try thinking like a spam engine when sending an email!
I think this probably got stuck in everyones junk box :)
Peter Clark [EMAIL PROTECTED]
Innovia Technology
St Andrews House, St Andrews Road
Cambridge, CB4 1DL
T: 01223 24
"Bears are dang
Robert Schetterer wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
arni schrieb:
Raymond Myren schrieb:
Hello,
Just today I started receiving spam mails with attached .pdf files
with a spam image.
Any ideas how to stop this spam type?
\raymond
as i said several times on this maillist no
The same thing is true if you install from the 3.2-branch, or at least
it was in the 3.2.0 days
I'm currently running a build from svn 3.2-branch, and it /seems/ to
be working correctly. There are, at least, files being pulled into my
LOCALSTATEDIR for both SARE & SA-Distrib rules.
--lint pass
Robert Schetterer schrieb:
arni schrieb:
aymond
as i said several times on this maillist now, i've never had any of
these mails get through, here is how the current ones score:
you are in a luck,
you are a "late reciever" of that spam, so it was detected
by others before ( look
On 25 Jun 2007, Theo Van Dinter stated:
> I've asked that he open a bugzilla ticket asking for 3.3 updates, and in the
> mean time reverting to a non-development is a good idea for a non-testing
> environment.
The same thing is true if you install from the 3.2-branch, or at least
it was in the 3.2
On Wed, 27 Jun 2007 16:18:28 +0200, Matthias Haegele
<[EMAIL PROTECTED]> wrote:
>Nigel Frankcom schrieb:
>> On Wed, 27 Jun 2007 08:48:02 -0400, David Boltz <[EMAIL PROTECTED]>
>> wrote:
>>
>>> I?ve been getting the lint failures found below on my Rules Du Jour
>>> updates for a few weeks now. Ye
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
arni schrieb:
> Raymond Myren schrieb:
>> Hello,
>>
>> Just today I started receiving spam mails with attached .pdf files
>> with a spam image.
>> Any ideas how to stop this spam type?
>>
>> \raymond
> as i said several times on this maillist now, i've
Nigel Frankcom schrieb:
On Wed, 27 Jun 2007 08:48:02 -0400, David Boltz <[EMAIL PROTECTED]>
wrote:
I?ve been getting the lint failures found below on my Rules Du Jour
updates for a few weeks now. Yes this would be since the DDoS attacks
on rulesemporium. It looks like the same problem people
I think SQL is probably the way to go...
Spamassassin -> MPP (messagepartners) -> CommuniGate
On Jun 27, 2007, at 3:09 PM, John D. Hardin wrote:
On Wed, 27 Jun 2007, Peter Clark wrote:
There are over 3000 individual email addresses - if each was added
individually to the local.cf - huge con
On Wed, 27 Jun 2007, Peter Clark wrote:
> There are over 3000 individual email addresses - if each was added
> individually to the local.cf - huge config! :)
whitelisting is best done in whatever calls SA. How is SA hooked up to
your MTA?
--
John Hardin KA7OHZhttp://www.imp
Raymond Myren schrieb:
Hello,
Just today I started receiving spam mails with attached .pdf files
with a spam image.
Any ideas how to stop this spam type?
\raymond
as i said several times on this maillist now, i've never had any of
these mails get through, here is how the current ones score:
On Wed, 27 Jun 2007, Peter Clark wrote:
We run an in house contacts program, I've exported every email address in it
to a text file - My intention is to white list every individual email, what's
the easiest way to do this? Ideally I'd be able to point the config to "look"
at a text file that c
Peter Clark wrote:
> We run an in house contacts program, I've exported every email
> address in it to a text file - My intention is to white list every
> individual email, what's the easiest way to do this? Ideally I'd be
> able to point the config to "look" at a text file that contains all
> thes
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Dallas Engelken schrieb:
> Raymond Dijkxhoorn wrote:
>> Hi!
>>
>>> We just caught one:
>>>
>>> Content analysis details: (5.0 points, 4.0 required)
>>>
>>> pts rule name description
>>> - --
>>> - ---
We run an in house contacts program, I've exported every email
address in it to a text file - My intention is to white list every
individual email, what's the easiest way to do this? Ideally I'd be
able to point the config to "look" at a text file that contains all
these emails, and it'll a
On Wed, 27 Jun 2007 08:48:02 -0400, David Boltz <[EMAIL PROTECTED]>
wrote:
>
>I?ve been getting the lint failures found below on my Rules Du Jour
>updates for a few weeks now. Yes this would be since the DDoS attacks
>on rulesemporium. It looks like the same problem people have been
>having with
Raymond Dijkxhoorn wrote:
Hi!
We just caught one:
Content analysis details: (5.0 points, 4.0 required)
pts rule name description
- --
- --
0.6 SPF_SOFTFAIL SPF: sender does not match SPF record
(
zigniew szalbot wrote:
> Hi,
>
> > I tried to learn SA and used the following syntax:
> >
> > sa-learn --spam -f /usr/home/zbyszek/june.txt
> > I guess I made a mistake with the syntax but how should I change it
> > so that I can train SA?
>
> I already found out:
> sa-learn --spam --no-sync /us
David Boltz schrieb:
I?ve been getting the lint failures found below on my Rules Du Jour
updates for a few weeks now. Yes this would be since the DDoS attacks
[RDJ Problems ...]
btw:
Are there any additional things to know/caveats if i want to use
sa-update channels for RDJ:
(besides adding t
Henry Weber wrote:
Hello,
We are an email hosting provider and are interested in finding
sometime who could help tighten the spamassassin setup on our servers.
We are willing to pay for services as long as there is a good result.
If you are interested, please email [EMAIL PROTECTED]
Hi!
We just caught one:
Content analysis details: (5.0 points, 4.0 required)
pts rule name description
- --
- --
0.6 SPF_SOFTFAIL SPF: sender does not match SPF record
(softfail)
0.4 BAYES_60
amassassin --lint failed.
Rolling configuration files back, not restarting SpamAssassin.
Rollback command is: mv -f /etc/mail/spamassassin/70_sare_adult.cf
/etc/mail/spamassassin/RulesDuJour/70_sare_adult.cf.2; mv -f
/etc/mail/spamassassin/RulesDuJour/70_sare_adult.cf.20070627-0524
/etc/mail/sp
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Wael Shahin wrote:
> On Wed, 2007-06-27 at 09:18 +0200, Robert Schetterer wrote:
> Stéphane LEPREVOST schrieb:
Hi,
Got one yesterday too here. Seems to be a new way for spammers ...
>> I have two servers one is running DCC and one
* Jerry Durand:
> Just had a client demand a big discount on a device he tested for 2
> months as a prototype, approved production of, THEN decided he didn't
> like the function of the lid latch.
What a bummer! That's one more example of why it is sometimes easier to
be a consultant than a manufa
hi,
when i'm putting this ("|/usr/local/bin/spamassassin -P | maildir
./Maildir/")line in .qmail-default mails are get stuck in the queue...
can anayone tell me why...
/tarak
hi,
when i'm putting this ("|/usr/local/bin/spamassassin -P | maildir
./Maildir/")line in .qmail-default mails are get stuck in the queue...
can anayone tell me why...
/tarak
spamassassin --lint doesn't report any errors.
However, I think I have found the source of the problem.
spamassassin seems to regard all X-Spam headers as its personal domain
and ignores them for
processing. The relevant line in PerMsgStatus.pm is
$self->{msg}->delete_header('X-Spam-.*');
I
On a related note--
I have a mailing list with a single user who randomly bounces spam to
the mailing list because his filters tag it as spam.
His poorly performing spam filter (no clue if it's SA or not) is
affecting 100's or 1000's of users who generally want him hurt.
Additionally, he d
On Wed, 27 Jun 2007, Wael Shahin wrote:
> I have two servers one is running DCC and one is not, the one that is
> running DCC didn't pass the message or maybe I am mistaken but it didn't
> go through (Maybe didn't get there at all from the first place).
> On the other server that is not running DC
Alex
In order to work around the Net::DNS issues Theo mentioned it's best to
run a local caching nameserver on the server itself.
That way resolv.onf contains a single nameserver line which solves the
problem.
As an aside this also increases the Spamassassin DNS speed incredibly.
I'm
not kiddin
Robert Schetterer schrieb:
Perhaps it would be easier to use clamav to filter
such mails out, i think i will asked there
- --
Sanesecurity has a CLAMAV signature
Email.Stk.Gen522.Sanesecurity.07062102.pdf
MH
On Wed, 2007-06-27 at 09:18 +0200, Robert Schetterer wrote:
> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA1
>
> Stéphane LEPREVOST schrieb:
> > Hi,
> >
> > Got one yesterday too here. Seems to be a new way for spammers ...
> >
I have two servers one is running DCC and one is not, the one that
hi,
i m getting lots of pills related(viagra and all) spams
can anyone tell me how to stop all those..
qmail+vpopmail+spamassassin
/tarak
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Stéphane LEPREVOST schrieb:
> Hi,
>
> Got one yesterday too here. Seems to be a new way for spammers ...
>
> -Message d'origine-
> De : Raymond Myren [mailto:[EMAIL PROTECTED]
> Envoyé : mercredi 27 juin 2007 08:09
> À : users@spamassassin.
Hi,
Got one yesterday too here. Seems to be a new way for spammers ...
-Message d'origine-
De : Raymond Myren [mailto:[EMAIL PROTECTED]
Envoyé : mercredi 27 juin 2007 08:09
À : users@spamassassin.apache.org
Objet : Spam PDF
Hello,
Just today I started receiving spam mails with attache
72 matches
Mail list logo
