Re: iXhash zone transfer?

Rosenbaum, Larry M. schrieb: Is it possible to get zone transfers of the iXhash data? Which one? The one run by Heise Verlag, Germany? Then I suggest you you contact Bert Ungerer (un at ix dot de) there. If you mean any of the currently three lists, I run two of them and I can provide you a r

Re: FW: AWARD NOTIFICATION:

On Wednesday 08 August 2007 5:33 pm, John D. Hardin wrote: > On Wed, 8 Aug 2007, Martin.Hepworth wrote: > > As requested... > > Sending a 700KB attachment to a popular mailing list? Please don't do > that again, even if somebody asks you to. > > It's much better to post samples larger than 1-2 KB t

Re: Problem with RDJ

geoff.squirrelmail_07080 wrote: > I'm running Spamassassin (3.1.1) with RDJ and when RDJ runs overnight I > get the following problem reported by e-mail: > > > ***NOTICE***: spamassassin --lint failed. This means that you have an > error somwhere in your SpamAssassin configuration. To determin

Problem with RDJ

I'm running Spamassassin (3.1.1) with RDJ and when RDJ runs overnight I get the following problem reported by e-mail: ***NOTICE***: spamassassin --lint failed. This means that you have an error somwhere in your SpamAssassin configuration. To determine what the problem is, please run 'spamassass

Re: Number spam (grey listing)

On 07/08/07 11:18, John Andersen wrote: > Ok, what is this stuff. > All it contains is 6 digit numbers. What's up with that stuff? > my guess is: just to break grey listing... seems the real stuff was a mailshot of "ecards" a few hours later dave -- Dave Mifsud Systems Engineer Computing Ser

Re: FW: AWARD NOTIFICATION:

On Wed, 8 Aug 2007, Martin.Hepworth wrote: > As requested... Sending a 700KB attachment to a popular mailing list? Please don't do that again, even if somebody asks you to. It's much better to post samples larger than 1-2 KB to a website and send the URL to the list. Apart from saving everybody

Re: rule for empty text + GIF or PDF ?

On Wed, Aug 08, 2007 at 01:19:47PM -0700, clsgis wrote: > I want to give those a really high score. False positives when there is no > text in > the message are acceptable. Hoping someone has a rule to do it. Sure, one for PDF has been available via sa-update for weeks. -- Randomly Selected Ta

Re: Training SPAM Assassin and keeping it upto date automatically

Bowie Bailey wrote: > Rick Zeman wrote: > > ... but doesn't indicate that > > anything else needs to be done. Is it really that easy? > > I would do it this way: > > - Drop the rule file in /etc/mail/spamassassin > - Run "spamassassin --lint" to check for errors (no output is normal) > - Fix any

Re: Botnet 0.8 Plugin is available (FINALLY!!!)

Hi John, Thanks for maintaining this excellent plugin! But I'm just wondering if ... On 6-Aug-2007 04:39, John Rudd wrote: -- changed complex dsl clientword to .*dsl.* (too many variations of 'dsl' in hostnames, since it's word bounded, the .*'s only match as far as the end of a wo

Re: Training SPAM Assassin and keeping it upto date automatically

On Wed, 8 Aug 2007, Bob Proulx wrote: > John D. Hardin wrote: > > As far as the greeting card spams are concerned, here's a specific > > rule that appears to work well: > > > > http://www.impsec.org/~jhardin/antispam/postcards.cf > > Hmm... Only POSTCARD_01 was given a score. Was that inten

rule for empty text + GIF or PDF ?

I'm seeing a huge spam run from well distributed bots. Multi part MIME messages with an empty (three blank lines) text/plain part, *no* text/html part, and an attachment in GIF or PDF format. I want to give those a really high score. False positives when there is no text in the message are acce

RE: Training SPAM Assassin and keeping it upto date automatically

Rick Zeman wrote: > Hiya, > > Silly newbie question, but how does one go about adding a rule like > this to a 3.2.1 installation (in a Maia/amavis solution)? > http://wiki.apache.org/spamassassin/WhereDoLocalSettingsGo says to > drop the .cf file in /etc/mail/spamassassin but doesn't indicate that

Re: Training SPAM Assassin and keeping it upto date automatically

John D. Hardin wrote: > As far as the greeting card spams are concerned, here's a specific > rule that appears to work well: > > http://www.impsec.org/~jhardin/antispam/postcards.cf Hmm... Only POSTCARD_01 was given a score. Was that intentional? Bob

Re: Training SPAM Assassin and keeping it upto date automatically

Hiya, Silly newbie question, but how does one go about adding a rule like this to a 3.2.1 installation (in a Maia/amavis solution)? http://wiki.apache.org/spamassassin/WhereDoLocalSettingsGo says to drop the .cf file in /etc/mail/spamassassin but doesn't indicate that anything else needs to be d

Re: Updates ?

On Wed, Aug 08, 2007 at 05:40:29PM +0100, Graham Murray wrote: > So would it not make more sense to have the automatic update generation > operate on the latest stable version? Patches welcome. :) ie: it's not a policy/etc decision to do this. the current automated system doesn't have support f

Re: spamd is invoked 3 times / forgot the subject

Am 08.08.2007 um 01:41 schrieb Expertsites, Inc.: - Original Message - From: "Stein Magne Bjorklund" <[EMAIL PROTECTED]> To: "Michael Worobcuk" <[EMAIL PROTECTED]>; Sent: Tuesday, August 07, 2007 1:11 AM Subject: Re: spamd is invoked 3 times / forgot the subject On 8/7/07, Micha

Re: lottery spam as .doc files

On Wed, 08 Aug 2007 17:59:41 +0100, "Martin.Hepworth" <[EMAIL PROTECTED]> wrote: >It's huge 660KB for the attachments... > >I'll dig out a place to drop it to.. I did wonder when the size trump card was gonna get played with SA. I guess it's now. Here's hoping the folk at SANE can help - they've

RE: lottery spam as .doc files

It's huge 660KB for the attachments... I'll dig out a place to drop it to.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Banyan He [mailto:[EMAIL PROTECTED] > Sent: 08 August 2007 17:12 > To: Martin.Hepworth > Cc: [

Re: Updates ?

Theo Van Dinter <[EMAIL PROTECTED]> writes: > They're both done manually. 3.2 used to automatic, now it's 3.3 that's > automatic. It follows the development tree. Pardon me for saying so, but is that not backwards? People following the development branch (which I have done in the past) normally

Re: lottery spam as .doc files

Hi Martin, For test, can you please send us the original message you got? Regards, Martin.Hepworth wrote: Heads up, the pdf stock spam has morphed to ms-word files for lottery winnings.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 **

Re: lottery spam as .doc files

Wait! You mean those are spam!? :) Haven't seen those yet, thanks for the heads up. I'll keep my eye out for those. -Jeff Martin.Hepworth wrote: Heads up, the pdf stock spam has morphed to ms-word files for lottery winnings.. -- Martin Hepworth Snr Systems Administrator Solid State Logic

lottery spam as .doc files

Heads up, the pdf stock spam has morphed to ms-word files for lottery winnings.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 ** Confidentiality : This e-mail and any attachments ar

Re: Updates ?

On Wed, Aug 08, 2007 at 10:31:30AM -0400, Kevin Plested wrote: > I'm using sa-update with SA 3.2.1. I think I was told on this list whe I was > using 3.1.8 that updates weren't as frequent with the 3.1.8 version because > they had to be done manually, but with 3.2.x they are more frequent due to >

Re: unsubscribe

According to the headers of all list messages: list-unsubscribe: On Wed, 8 Aug 2007 at 08:12 -0700, [EMAIL PROTECTED] confabulated: --- _|_ (_| |

unsubscribe

Re: Botnet 0.8 Plugin is available (FINALLY!!!)

John, >>> On 8/6/2007 at 1:18 PM, John Rudd <[EMAIL PROTECTED]> wrote: Kai Schaetzl wrote: > John Rudd wrote on Sun, 05 Aug 2007 19:39:07 -0700: > >> http://people.ucsc.edu/~jrudd/spamassassin/Botnet-0.8.tar > > Hi John, just checking out your plugin the first time. I notice that it > just unta

pdfinfo - how to prove it is working

>I have inherited an Apple Xserve running Server 10.4.9 >Postfix: mail_version = 2.1.5 >SpamAssassin version 3.0.1 >ClamAV 0.88.5 >(yes I know that various apps require updating) >I have obtained from http://www.rulesemporium.com/plugins.htm >PDFInfo.pm and pdfinfo.cf >I have placed pdfinfo.cf

Updates ?

I'm using sa-update with SA 3.2.1. I think I was told on this list whe I was using 3.1.8 that updates weren't as frequent with the 3.1.8 version because they had to be done manually, but with 3.2.x they are more frequent due to it being done automatically ? I could be wrong with that, but since I

pdfinfo - how to prove it is working

Hi I have inherited an Apple Xserve running Server 10.4.9 Postfix: mail_version = 2.1.5 SpamAssassin version 3.0.1 ClamAV 0.88.5 (yes I know that various apps require updating) I have obtained from http://www.rulesemporium.com/plugins.htm PDFInfo.pm and pdfinfo.cf I have placed pdfinfo.cf int

Spamd trying to write to root

It seems this has been covered a bunch of times, and I've tried a lot of solutions: Invoking the -u flag for spamd Invoking the -u flag for spamc Creating a symbolic link to /root to the actual user's home dir And STILL, in maillog, there's spamd trying to write to /root and being denied! My sy

Gocr gives an error while it is trying to read a pic sometimes

I use spamassassin3.1.7, fuzzyocr, gocr0.44 ( Before I used gocr 0.41 and 0.43 ) Gocr gives an error while it is trying to read a picture sometimes as below; 1 - gocr -l 180 -d 2 -i italic.gif giftopnm: Reading Image Sequence 0 giftopnm: EOF or error reading data portion of 59 byte DataBlock from

Re: Training SPAM Assassin and keeping it upto date automatically

On Tue, 7 Aug 2007, Netdynamix wrote: > I am getting a HUGE amount of Spam which basically states that a > Friend, Collegue, Worshipper, Fan, etc has sent me an eCard... > > This is happening to a number of my clients as well... As far as the greeting card spams are concerned, here's a specific

Re: spam leaks, high server load!?

Which MTA are you using? Exim? Well I had the same problem last month and everything got fixed when I limited the message scan size to 80k. SA was sacanning everything even 10mb messages so I reduced the scan to 80K by adding a rule to exim.conf. Now I dont see spikes at all. Load is around 3 no

Re: spamassassin gets stucked in extra info

Néher Márton wrote: Hi all! I have upgraded to 3.2.2, checked out every network test, turned off bayes, and still not better. SA comsumes extremely lot of memory, and pushes the load to the sky, and because it servers about 8000-1 users , we are really scared, that what shall we do. Shall

Re: spamassassin gets stucked in

Also, remove additional rulesets, and run spamd with -D to see where it's getting stuck... --j. Martin.Hepworth writes: > Hi > > Turn off the RBL's (or only use a couple). DNS checks can take along time. > > Yes SA is very memory hungry.. > > > > -- > Martin Hepworth > Snr Systems Admin

RE: spamassassin gets stucked in

Hi Turn off the RBL's (or only use a couple). DNS checks can take along time. Yes SA is very memory hungry.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Néher Márton [mailto:[EMAIL PROTECTED] > Sent: 08 August

Re: spamassassin gets stucked in

Hi all! I have upgraded to 3.2.2, checked out every network test, turned off bayes, and still not better. SA comsumes extremely lot of memory, and pushes the load to the sky, and because it servers about 8000-1 users , we are really scared, that what shall we do. Shall we just use another

Re: PDF-Spam passing SA

On 8/8/2007 10:54 AM, Starckjohann, Ove wrote: Hi! The following PDF-Spam is passing through: http://ghds.de/20070808074441242.eml.txt System ist Debian Sarge with SA 3.1.7. I'm already using: PDFInfo 0.7 80_additional.cf Anyone scoring over 5? How to get it caught ? With PDFinfo you can g

Bayesian db per domain

Hi for all, this is mi first messagge to the list, thanks for your time and sorry for my English (I'm Spanish) ;-) My problem is this: I would like have a first server with postfix and spamassassin only for check spam an virus (with clamd) and relay the mail to the optimum server with a private D

PDF-Spam passing SA

Hi! The following PDF-Spam is passing through: http://ghds.de/20070808074441242.eml.txt System ist Debian Sarge with SA 3.1.7. I'm already using: PDFInfo 0.7 80_additional.cf Anyone scoring over 5? How to get it caught ? Ove Starckjohann

Re: iXhash zone transfer?

Rosenbaum, Larry M. schrieb: Is it possible to get zone transfers of the iXhash data? you can get the zone, if you made it available to the hole world ... and you need to handle ixfr ... just ask them for more information! \jd

Re: Training SPAM Assassin and keeping it upto date automatically

You need to look at sa-update and sa-learn. Make sure you're using a recent version of SpamAssassin. On 08/08/07, Netdynamix <[EMAIL PROTECTED]> wrote: > > Hi There, > > I am getting a HUGE amount of Spam which basically states that a Friend, > Collegue, Worshipper, Fan, etc has sent me an eCard..