Re: Botnet 0.8 Plugin is available (FINALLY!!!)

2007-08-06 Thread John D. Hardin
On Mon, 6 Aug 2007, John Rudd wrote: > What I understood is that he'd like the contents of the tar file to be: > > > ./Botnet-X.Y/Botnet.pm > ./Botnet-X.Y/Botnet.cf > etc > > instead of > > ./Botnet.pm > ./Botnet.cf Correct. > And that's going to require a re-working of how/where I do the >

Re: Botnet 0.8 Plugin is available (FINALLY!!!)

2007-08-06 Thread Kai Schaetzl
John Rudd wrote on Mon, 06 Aug 2007 15:05:31 -0700: > And that's going to require a re-working of how/where I do the > development of the plugin. No, it just requires to copy those 7 files (I didn't count again) to a location where you collect and store your release files. For instance to /what

Re: Botnet 0.8 Plugin is available (FINALLY!!!)

2007-08-06 Thread John Rudd
René Berber wrote: John Rudd wrote: Kai Schaetzl wrote: John Rudd wrote on Mon, 06 Aug 2007 10:18:30 -0700: I'll look into re-working it. Thanks! You just need to tar it up including the enclosing directory. No, that's not all I have to do. THAT part is the trivial part. But in order to

Re: Botnet 0.8 Plugin is available (FINALLY!!!)

2007-08-06 Thread René Berber
John Rudd wrote: > Kai Schaetzl wrote: >> John Rudd wrote on Mon, 06 Aug 2007 10:18:30 -0700: >> >>> I'll look into re-working it. >> >> Thanks! You just need to tar it up including the enclosing directory. >> > > No, that's not all I have to do. > > THAT part is the trivial part. > > But in or

anyone else unable to compile NetAddr for SPF module?

2007-08-06 Thread cantelow
Hi, list. I am unable to compile Mail::SPF for SpamAssassin 3.2.2 due to being unable to compile the required NetAddr cpan module first. It is giving a "can't figure out ENDIANness" error. I'm on a little endian machine, Tru64 5.1B, using native compile. I'm about to file a bug report to cpan

Re: Botnet 0.8 Plugin is available (FINALLY!!!)

2007-08-06 Thread John Rudd
Kai Schaetzl wrote: John Rudd wrote on Mon, 06 Aug 2007 10:18:30 -0700: I'll look into re-working it. Thanks! You just need to tar it up including the enclosing directory. No, that's not all I have to do. THAT part is the trivial part. But in order to get there, I have to alter my develo

Re: Botnet 0.8 Plugin is available (FINALLY!!!)

2007-08-06 Thread Kai Schaetzl
John Rudd wrote on Mon, 06 Aug 2007 10:18:30 -0700: > I'll look into re-working it. Thanks! You just need to tar it up including the enclosing directory. Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com

RE: Botnet 0.8 Plugin is available (FINALLY!!!)

2007-08-06 Thread Brent Kennedy
Yes, I use a local DNS server.. Which does cache. It was a little while ago, so I don't know if I still have mail logs that I can look at. -Brent -Original Message- From: John Rudd [mailto:[EMAIL PROTECTED] Sent: Monday, August 06, 2007 1:17 PM To: Brent Kennedy Cc: users@spamassassin.a

Re: Botnet 0.8 Plugin is available (FINALLY!!!)

2007-08-06 Thread Vernon Webb
the instruction basically said to through the files into the spamassassin folder and restart -- Original Message --- From: "Loren Wilton" <[EMAIL PROTECTED]> To: Sent: Mon, 6 Aug 2007 09:28:45 -0700 Subject: Re: Botnet 0.8 Plugin is available (FINALLY!!!) > > I added thi

Re: Botnet 0.8 Plugin is available (FINALLY!!!)

2007-08-06 Thread John Rudd
Kai Schaetzl wrote: John Rudd wrote on Sun, 05 Aug 2007 19:39:07 -0700: http://people.ucsc.edu/~jrudd/spamassassin/Botnet-0.8.tar Hi John, just checking out your plugin the first time. I notice that it just untars all files to the current location. It would be nice if you could encapsulate

Re: Botnet 0.8 Plugin is available (FINALLY!!!)

2007-08-06 Thread John Rudd
I use it on a large installation (up to a 2 million messages per day). Do you have at least a caching name server running on the hosts where you do the scanning? It does do quite a few DNS checks, which could/would affect latency. Brent Kennedy wrote: I don't mean to rain on the botnet pl

Re: Botnet 0.8 Plugin is available (FINALLY!!!)

2007-08-06 Thread Loren Wilton
I added this and everything came back labled as SPAM Did you configure it too, or just add it? Loren

Re: DK_POLICY_SIGNSOME

2007-08-06 Thread Mark Martinec
Rob, > > Yes, this is normal. An absence of a policy record implies > > a default policy, which is a neutral 'signs some mail'. > > Personally, I find it strange to call 'signs some mail' neutral if > there's nothing that indicates that we might actually do 'sign some > mail'. But I haven't read a

Re: Botnet 0.8 Plugin is available (FINALLY!!!)

2007-08-06 Thread Vernon Webb
I added this and everything came back labled as SPAM -- Original Message --- From: John Rudd <[EMAIL PROTECTED]> To: SpamAssassin Users Sent: Sun, 05 Aug 2007 19:39:07 -0700 Subject: Botnet 0.8 Plugin is available (FINALLY!!!) > Botnet 0.8 is up and available.  It took me

Re: Botnet 0.8 Plugin is available (FINALLY!!!)

2007-08-06 Thread Mark Martinec
John, > Botnet 0.8 is up and available. It took me a while (things have been > REALLY busy at work for the last 6 months), but it's there. > http://people.ucsc.edu/~jrudd/spamassassin/Botnet-0.8.tar Thanks, very nice. > What changed between 0.7 and 0.8: It seems a patch by Daniel J McDonald was

Re: DK_POLICY_SIGNSOME

2007-08-06 Thread Kai Schaetzl
Rob Sterenborg wrote on Mon, 6 Aug 2007 15:38:24 +0200: > Sorry, I, of course, have no explanation for that. I didn't demand an explanation from you ;-) was just musing. But thanks for the URL. That indeed clarifies that it got used specifically to avoid clashes with real hostnames. Btw, it see

RE: Botnet 0.8 Plugin is available (FINALLY!!!)

2007-08-06 Thread Brent Kennedy
I don't mean to rain on the botnet plugin parade, but when I tried it, my mail queue slowed to a crawl. Mail became backed up pretty quickly with processing taking upwards of 10 minutes a message. Is there something in the config that I missed or it this plugin only meant for small installations?

Re: Botnet 0.8 Plugin is available (FINALLY!!!)

2007-08-06 Thread Ralf Hildebrandt
* Kai Schaetzl <[EMAIL PROTECTED]>: > John Rudd wrote on Sun, 05 Aug 2007 19:39:07 -0700: > > > http://people.ucsc.edu/~jrudd/spamassassin/Botnet-0.8.tar > > Hi John, just checking out your plugin the first time. I notice that it > just untars all files to the current location. It would be nice

RE: DK_POLICY_SIGNSOME

2007-08-06 Thread Rob Sterenborg
Kai Schaetzl wrote: > Rob Sterenborg wrote on Mon, 6 Aug 2007 14:32:57 +0200: > >> Didn't look it up but this is not a hostname, is a TXT record so I >> guess it's treated differently.. > > Good explanation, but looking it up I see there *is* an A record > (actually, two). Sorry, I, of course, h

Re: Botnet 0.8 Plugin is available (FINALLY!!!)

2007-08-06 Thread Kai Schaetzl
John Rudd wrote on Sun, 05 Aug 2007 19:39:07 -0700: > http://people.ucsc.edu/~jrudd/spamassassin/Botnet-0.8.tar Hi John, just checking out your plugin the first time. I notice that it just untars all files to the current location. It would be nice if you could encapsulate it in a directory, so

Re: DK_POLICY_SIGNSOME

2007-08-06 Thread Mark Martinec
Rob, > > When the domainkey policy record for the domain in question says the > > domain signs some of its email. > > Heheh.. Yeah, I guessed that much, but, we *don't* sign email. Not > DK(IM) or anything else. Yes, this is normal. An absence of a policy record implies a default policy, which is

Re: DK_POLICY_SIGNSOME

2007-08-06 Thread Kai Schaetzl
Rob Sterenborg wrote on Mon, 6 Aug 2007 14:32:57 +0200: > Didn't look it up but this is not a hostname, is a TXT record so I guess > it's treated differently.. Good explanation, but looking it up I see there *is* an A record (actually, two). This may be an error, though. It probably expliticely

RE: DK_POLICY_SIGNSOME

2007-08-06 Thread Rob Sterenborg
Kai Schaetzl wrote: > Kai Schaetzl wrote on Mon, 06 Aug 2007 14:03:42 +0200: > >> _domainkey > > BTW, doesn't the use of an underscore in a hostname violate RFC? Didn't look it up but this is not a hostname, is a TXT record so I guess it's treated differently.. Grts, Rob

Re: DK_POLICY_SIGNSOME

2007-08-06 Thread Kai Schaetzl
Kai Schaetzl wrote on Mon, 06 Aug 2007 14:03:42 +0200: > _domainkey BTW, doesn't the use of an underscore in a hostname violate RFC? Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com

RE: DK_POLICY_SIGNSOME

2007-08-06 Thread Rob Sterenborg
Matt Kettler wrote: > Rob Sterenborg wrote: >> Hi, >> >> I was looking around to see if I could find what >> >> DK_POLICY_SIGNSOME >> Domain Keys: policy says domain signs some mails >> >> actually means, but I can't find it. >> >> When I send an email fromy work email address to my home email

Re: DK_POLICY_SIGNSOME

2007-08-06 Thread Kai Schaetzl
Matt Kettler wrote on Mon, 06 Aug 2007 07:19:16 -0400: > dig txt _domainkey. doing a host -t TXT _domainkey.example.com should do the same, right? I also started wondering why I see that on so many mails. Actually, it seems I get the DK_POLICY_SIGNSOME on all mail that is not whitelisted in

Re: DK_POLICY_SIGNSOME

2007-08-06 Thread Matt Kettler
Rob Sterenborg wrote: > Hi, > > I was looking around to see if I could find what > > DK_POLICY_SIGNSOME > Domain Keys: policy says domain signs some mails > > actually means, but I can't find it. > > When I send an email fromy work email address to my home email server, > this rule is hit for that

DK_POLICY_SIGNSOME

2007-08-06 Thread Rob Sterenborg
Hi, I was looking around to see if I could find what DK_POLICY_SIGNSOME Domain Keys: policy says domain signs some mails actually means, but I can't find it. When I send an email fromy work email address to my home email server, this rule is hit for that email, but I'm quite sure that we have n