Re: Stuff getting through

2007-07-24 Thread David Baron
On Wednesday 25 July 2007, Bob Proulx wrote: > David Baron wrote: > > >   /etc/rc0.d/S35networking > > >   /etc/rc6.d/S35networking > > >   /etc/rcS.d/S40networking > > > > Is not the final run level 5. > > The default runlevel is 2 in Debian. Unless otherwise modified all > run levels have the sa

Re: Stuff getting through

2007-07-24 Thread Bob Proulx
David Baron wrote: > >   /etc/rc0.d/S35networking > >   /etc/rc6.d/S35networking > >   /etc/rcS.d/S40networking > > Is not the final run level 5. The default runlevel is 2 in Debian. Unless otherwise modified all run levels have the same configuration and are identical to each other in Debian.

sa-update error

2007-07-24 Thread Sg
Hi I am using SA 3.1.7. I want to update it. I tried this command sa-update --nogpg --channel updates.spamassassin.org --channel saupdates.openprotect.com But i got this error ""Argument "1.26_01" isnt numeric in subroutine entry at sa-update line 91"" -- Sg

Re: scam spam fwds to [EMAIL PROTECTED] bouncing

2007-07-24 Thread SM
Hi Chris, At 20:02 24-07-2007, Chris wrote: Ever since changing from my Earthlink account to my Embarq account scam fwds to the above bounce: <[EMAIL PROTECTED]>: host mail-gw.usss.treas.gov[10.119.253.67] said: 550 <[EMAIL PROTECTED]>: Recipient address rejected: Blocked (in reply to

scam spam fwds to [EMAIL PROTECTED] bouncing

2007-07-24 Thread Chris
Ever since changing from my Earthlink account to my Embarq account scam fwds to the above bounce: <[EMAIL PROTECTED]>: host mail-gw.usss.treas.gov[10.119.253.67] said: 550     <[EMAIL PROTECTED]>: Recipient address rejected: Blocked (in reply to     RCPT TO command) One reason that the Embarq QA

RE: Why DUL hit?

2007-07-24 Thread Dan Barker
The DUL account, relayed through the ISP. The ISP's IP should be checked in the DUL, not the end-user. I agree about all the RFC junk, but Bellsouth.net is not my domain. They are a fairly large (in the Southeast US) ISP and really should have a clue. Unfortunately, they don't. The REPORT showed th

RE: Why DUL hit?

2007-07-24 Thread Michael Scheidell
The reverse dns. (and helo) Received: from hubert382f6e2f (adsl-065-012-175-061.sip.asm.bellsouth.net[65.12.175.61]) by bellsouth.net (frfwmhc01) with SMTP Aol won't accept email from something like that either. To fix: assign a dns name, fwd and reverse, then set it up in your mail se

Why DUL hit?

2007-07-24 Thread Dan Barker
My sister-in-law is using the appropriate outbound SMTP server. Why'd SORBS_DUL misfire? (Oh, not misfire, but fire. The 65... Address is a dial-up, but the 207... Is not. I wonder why SORBS has it listed? Dan HEADERS: Received: from fmailhost01.isp.att.net [207.115.11.51] by mail.visioncomm.n

Re: Stuff getting through

2007-07-24 Thread David Baron
On Tuesday 24 July 2007, Bob Proulx wrote: > Those init.d files are not stock Debian.  They have been modified. > > However since the rc0.d and rcS.d files still exists with low numbers > then networking will start very early.  Those S99 files are simply red > herrings for you distracting you from

Re: graphic spam

2007-07-24 Thread John Rudd
Jerry Durand wrote: At 11:43 PM 7/23/2007, Nigel Frankcom wrote: ClamD with http://www.sanesecurity.co.uk/ work pretty well here. Be sure and read http://www.sanesecurity.co.uk/clamav/usage.htm Warning to Mac users: I tried to use their automated script in OS X Server and got a script error

Re: graphic spam

2007-07-24 Thread Jerry Durand
At 11:43 PM 7/23/2007, Nigel Frankcom wrote: ClamD with http://www.sanesecurity.co.uk/ work pretty well here. Be sure and read http://www.sanesecurity.co.uk/clamav/usage.htm Warning to Mac users: I tried to use their automated script in OS X Server and got a script error (SED error). I cont

Re: Stuff getting through

2007-07-24 Thread Bob Proulx
David Baron wrote: > Gene Heskett wrote: > > >I have: > > >/etc/rc0.d/S35networking > > >/etc/rc2.d/S99networking > > >/etc/rc3.d/S99networking > > >/etc/rc5.d/S99networking > > >/etc/rc6.d/S35networking > > >/etc/rcS.d/S40networking > > > > > >S99 is what is being hit. > > > > And I would call ANY

Re: Can I examinate results?

2007-07-24 Thread Paul Lenz
"Meng Weng Wong" <[EMAIL PROTECTED]> wrote: > > Is it possible to write some rules, get their results and > > examinate these results in other rules? > > you probably want a meta-rule, see manpage for > Mail::SpamAssassin::Conf I don't mean the spam point results of __RULE1 + __RULE2, I mean re

Re: Can I examinate results?

2007-07-24 Thread Theo Van Dinter
On Tue, Jul 24, 2007 at 06:47:06PM +0300, Paul Lenz wrote: > 1.) Phishing: > (a href="DANGEROUS_LINK")LINK_OF_YOUR_BANK(/a) > rule 1 grabs DANGEROUS_LINK and LINK_OF_YOUR_BANK > rule 2 compares the results whether both have the same domain, > if not --> seems to be phishing, give some spam points

Re: Now its zip attachments ^^

2007-07-24 Thread Kelson
John Rudd wrote: Chr. v. Stuckrad wrote: I have a 'political problem' with that. We 'drop' knowv viruses into a quarantine directory without further notice, and only once in years somebody complained and wanted his virus back :-) You could even do it as 5 different instances (1 for base clama

Re: Can I examinate results?

2007-07-24 Thread Meng Weng Wong
you probably want a meta-rule, see manpage for Mail::SpamAssassin::Conf On Jul 24, 2007, at 11:47 PM, Paul Lenz wrote: I hope this is not a FAQ... Is it possible to write some rules, get their results and examinate these results in other rules?

Can I examinate results?

2007-07-24 Thread Paul Lenz
I hope this is not a FAQ... Is it possible to write some rules, get their results and examinate these results in other rules? Two examples (I used round brackets for correct display): 1.) Phishing: (a href="DANGEROUS_LINK")LINK_OF_YOUR_BANK(/a) rule 1 grabs DANGEROUS_LINK and LINK_OF_YOUR_BANK

Re: Stuff getting through

2007-07-24 Thread David Baron
On Tuesday 24 July 2007, Gene Heskett wrote: > On Tuesday 24 July 2007, David Baron wrote: > >> >> Humm, with my lashup here that Joanne helped me setup, > >> >> S78spamassassin starts a few copies of spamd, and fetchmail is > >> >> started much later in S99local. Its fetchmail that calls procmail

Re: Any mailbox-challenge plugin?

2007-07-24 Thread Jonas Eckerman
Giampaolo Tomassoni wrote: anyone knows of a SA plugin to score mails based on challenging the sender e-mail? I've got an experimental caching SAV plugin (wich tries to mitigate the general obnoxiousness of SAV a tinty bit) for SA at http://whatever.frukt.org. I'm not recommending using SAV

Re: migrating from clamav before mta to SA ClamAV plugin experiences

2007-07-24 Thread Matus UHLAR - fantomas
> > what does clamav checking in that scanner do then? It should call > > clamdscan > > asap (before SA) and when a virus is found, the mail should be imediately > > rejected, the same way it's rejected when SA tells so. On 23.07.07 20:31, Robert - eLists wrote: > It quarantines and notifies admin

Re: Stuff getting through

2007-07-24 Thread Gene Heskett
On Tuesday 24 July 2007, David Baron wrote: >> >> Humm, with my lashup here that Joanne helped me setup, S78spamassassin >> >> starts a few copies of spamd, and fetchmail is started much later in >> >> S99local. Its fetchmail that calls procmail, and its procmail that >> >> calls the spamd's, so t

Re: Now its zip attachments ^^

2007-07-24 Thread Jonas Eckerman
Chr. v. Stuckrad wrote: Did somebody of you create an extra 'instance' of clamad-filter to fight spam with spam-sigs only, without scaning for virus-sigs? I'm running two instances of clamd in our mail gateway. One instance has the stock signatures (minus phishing sigs) and is used before Sp

Re: sa-update is failing on update.spamassassin.org

2007-07-24 Thread Theo Van Dinter
updates.spamassassin.org has no A record. It has a TXT record though. :) On Tue, Jul 24, 2007 at 07:44:59AM -0700, Gary W. Smith wrote: > Theo, > > I just checked it out on dnsstuff.com (which is where I should have also > checked earlier but sleep depervation...). It's also failing there as

RE: sa-update is failing on update.spamassassin.org

2007-07-24 Thread Gary W. Smith
Theo, I just checked it out on dnsstuff.com (which is where I should have also checked earlier but sleep depervation...). It's also failing there as well. You might have a cached record. How I am searching: Searching for updates.spamassassin.org A record at b.root-servers.net [192.228.79

Re: sa-update is failing on update.spamassassin.org

2007-07-24 Thread Theo Van Dinter
As far as I know, DNS is working fine for the channel (tested from random work machine): $ host -t txt 1.1.3.updates.spamassassin.org 1.1.3.updates.spamassassin.org descriptive text "555165" On Tue, Jul 24, 2007 at 07:34:44AM -0700, Gary W. Smith wrote: > Sorry, should have been update instead o

RE: sa-update is failing on update.spamassassin.org

2007-07-24 Thread Gary W. Smith
Sorry, should have been update instead of users in subject... From: Gary W. Smith [mailto:[EMAIL PROTECTED] Sent: Tue 7/24/2007 7:25 AM To: users@spamassassin.apache.org Subject: sa-update is failing on users.spamassassin.org Running the below command starting f

Re: Writing a rule to access SA ClamAV Plugin Header

2007-07-24 Thread Wolfgang Zeikat
On 07/24/07 15:00, Wolfgang Zeikat wrote: > In SA 3.1.8, I am trying to use the clamav plugin from > http://wiki.apache.org/spamassassin/ClamAVPlugin > > spamassassin -t -D output includes dbg: ClamAV: Detected virus: > Email.Stk.Gen596.Sanesecurity.07071900.pdf > > It adds a header X-Spam-Viru

Re: Problem with clamav plugin

2007-07-24 Thread Wolfgang Zeikat
On 07/24/07 15:43, OliverScott wrote: full CLAMAV eval:check_clamav() describe CLAMAV Clam AntiVirus detected something... score CLAMAV 0.001 If you don't want CLAMAV to score (high), apparently you can rename it to __CLAMAV, works fine here. To make the meta rule work too, I had to giv

sa-update is failing on users.spamassassin.org

2007-07-24 Thread Gary W. Smith
Running the below command starting failing in the last couple days saying it can't find updates.spamassassin.org DNS entry /usr/bin/sa-update --nogpg --channel updates.spamassassin.org --channel saupdates.openprotect.com saupdates.openprotect.com is working fine though. Are we having a DNS i

Re: Problem with clamav plugin

2007-07-24 Thread Wolfgang Zeikat
On 07/24/07 15:43, OliverScott wrote: You need to set a high priority for the meta rules as otherwise they are evaluated BEFORE the ClamAV plugin is used (I think?). I am not an expert in how SA works, but I eventually came up with the following solution (for using several different 3rd party c

Re: graphic spam

2007-07-24 Thread Duane Hill
On Tue, 24 Jul 2007 at 20:48 +0800, [EMAIL PROTECTED] confabulated: Other than FuzzyOCR, is there other way to filter graphic spams? I had ImageInfo but seem like it is not working. PS... also check out ImageInfo.pm http://www.rulesemporium.com/plugins.htm Yes I had that, but it is not working

Re: Problem with clamav plugin

2007-07-24 Thread OliverScott
You need to set a high priority for the meta rules as otherwise they are evaluated BEFORE the ClamAV plugin is used (I think?). I am not an expert in how SA works, but I eventually came up with the following solution (for using several different 3rd party clamav signatures): This is my clamav.cf

FW: RE: Solved: Was: DKIM vs DomainKeys plugins

2007-07-24 Thread Michael Scheidell
and can we find and drop this idiot too? Microsoft Mail Internet Headers Version 2.0 Received: from mail.secnap.net ([10.70.1.3]) by secnap2.secnap.com with Microsoft SMTPSVC(5.0.2195.6713); Tue, 24 Jul 2007 08:54:23 -0400 Received: by mail.secnap.net (Postfix, from userid 1001) id DA07716484D

Re: not everyone is happy with SA

2007-07-24 Thread John D. Hardin
On Mon, 23 Jul 2007, jdow wrote: > With snail mail it is nigh on to impossible to interrupt the > reception process and reject a piece of mail. I simply place it > into the trash on my way into the house. (Some things, like > unwanted subscription offers or credit card offers, I tear in > half. On

Problem with clamav plugin

2007-07-24 Thread Wolfgang Zeikat
In SA 3.1.8, I am trying to use the clamav plugin from http://wiki.apache.org/spamassassin/ClamAVPlugin spamassassin -t -D output includes dbg: ClamAV: Detected virus: Email.Stk.Gen596.Sanesecurity.07071900.pdf It adds a header X-Spam-Virus: Yes (Email.Stk.Gen596.Sanesecurity.07071900.pdf) all

Re: graphic spam

2007-07-24 Thread Spamassassin List
Other than FuzzyOCR, is there other way to filter graphic spams? I had ImageInfo but seem like it is not working. PS... also check out ImageInfo.pm http://www.rulesemporium.com/plugins.htm Yes I had that, but it is not working for me. [26559] dbg: config: read file /etc/mail/spamassassin/imagei

Re: graphic spam

2007-07-24 Thread Matthias Keller
Spamassassin List wrote: Other than FuzzyOCR, is there other way to filter graphic spams? I had ImageInfo but seem like it is not working. PS... also check out ImageInfo.pm http://www.rulesemporium.com/plugins.htm Yes I had that, but it is not working for me. [26559] dbg: config: read file /et

RE: Solved: Was: DKIM vs DomainKeys plugins

2007-07-24 Thread Michael Scheidell
> -Original Message- > From: Bill Landry [mailto:[EMAIL PROTECTED] > Sent: Monday, July 23, 2007 6:16 PM > To: Michael Scheidell > Cc: users@spamassassin.apache.org > Subject: Re: Solved: Was: DKIM vs DomainKeys plugins > > > Michael Scheidell wrote: > What version of Mail::DKIM are you

Re: Stuff getting through

2007-07-24 Thread David Baron
>> >Problem is that the S78 will start spamassassin but that start does not >> >necessarily get a valid rule-set. For that, the internet connection must >> > be up at the time. >> >> And why would it not be when the network start is S10network? > >I have: >/etc/rc0.d/S35networking >/etc/rc2.d/S99ne

Re: Stuff getting through

2007-07-24 Thread David Baron
> >> Humm, with my lashup here that Joanne helped me setup, S78spamassassin > >> starts a few copies of spamd, and fetchmail is started much later in > >> S99local. Its fetchmail that calls procmail, and its procmail that > >> calls the spamd's, so there is no time that SA can be bypassed. > >> >

R: Any mailbox-challenge plugin?

2007-07-24 Thread Giampaolo Tomassoni
> -Messaggio originale- > Da: Koopmann, Jan-Peter [mailto:[EMAIL PROTECTED] > > ...omissis... > > My personal recommendation: I used SAV several years with EXIM and > simply added a header with the SAV result. This header was scored in SA > with a custom rule. No plugin necessary. Intere

Re: graphic spam

2007-07-24 Thread Spamassassin List
Other than FuzzyOCR, is there other way to filter graphic spams? I had ImageInfo but seem like it is not working. PS... also check out ImageInfo.pm http://www.rulesemporium.com/plugins.htm Yes I had that, but it is not working for me. [26559] dbg: config: read file /etc/mail/spamassassin

RE: Any mailbox-challenge plugin?

2007-07-24 Thread Koopmann, Jan-Peter
> > and isn't > > considered to be that much better than C/R (it doesn't clutter a > > forged-sender's mail box, but it can bog down a forged-sender's mail > > server with verification requests). > > Well, it may be. I know, however, that a lot of people is doing this at > the > MTA level in order

Re: sa-update error

2007-07-24 Thread Zbigniew Szalbot
Hi Daryl, On Tue, 24 Jul 2007 02:56:02 -0400, "Daryl C. W. O'Shea" <[EMAIL PROTECTED]> wrote: > Zbigniew Szalbot wrote: >> Hello, >> >> I'd be glad for your suggestions re sa-update error. >> >> $ sa-update >> can't resolve "l27.0.0.1" to address at > > L27.0.0.1 isn't quite the same as 127.0.0.