Security update for iXhash plugin

2007-10-02 Thread Dirk Bonengel
Important info for all those who use the iXhash plugin Karsten Bräckelmann discovered a problem with some regular expressions, causing SA/Perl to segfault on some installations when processing certain malformed mails. Everyone using the plugin is encouraged to go to ixhash.sf.net and download

Re: Robert Sexton filter

2007-10-02 Thread Steven Stern
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 10/02/2007 11:06 AM, Theo Van Dinter wrote: > On Tue, Oct 02, 2007 at 10:58:26AM -0500, Steven Stern wrote: >> We get many, many emails from a "Robert Sexton" who claims he'll do >> wonders with search engine placement. As fast as I add an address

RE: pyzor check failed (can't fork at Util.pm)

2007-10-02 Thread Frank Niedermann
Hi Gary, Gary V-2 wrote: > > You will get better response time from a server other than the one > provided via the 'pyzor discover' command. > http://marc.info/?l=spamassassin-users&m=117907371211470 > Gary V > wow that was some great info! The ping command to the default server provided wit

Re: [qmailtoaster] Duplicate emails and increased spam getting through

2007-10-02 Thread Justin Mason
upgrade, this bug was fixed in 3.2.0. --j. Steve Ingraham writes: > More information: Below are a few lines from the > /var/log/qmail/spamd/current file. This information does not look good > but I do not know what it means. Can someone give me some idea of what > this means and what I should

Re: MySpace

2007-10-02 Thread Jules M
Am 02.10.2007 um 18:05 schrieb Peter P. Benac: Greetings, More and more of my clients are using MySpace. The spam filters put them in the 4-5 point range. Your opinions are needed. Is it worth white listing MySpace? Regards, Pete Hi, i had the same problem some times ago. Here the

Re: Duplicate emails and increased spam getting through

2007-10-02 Thread John D. Hardin
On Tue, 2 Oct 2007, Steve Ingraham wrote: > Most of the new spam is very raw adult sex spam emails some with > pictures in the body of the text. Images, huh? Have they passed the spamc message size limit and aren't being scanned at all? -- John Hardin KA7OHZhttp://www.impsec

Re: Robert Sexton filter

2007-10-02 Thread John D. Hardin
On Tue, 2 Oct 2007, Steven Stern wrote: > We get many, many emails from a "Robert Sexton" who claims he'll do > wonders with search engine placement. As fast as I add an address to > the blacklist, he comes in with another. > Does anyone have a rule handy that would replace my "blacklist_from"

Re: is lock needed when using spamd/c combo

2007-10-02 Thread John D. Hardin
On Tue, 2 Oct 2007, Obantec Support wrote: > From: "Matthias Häker" <[EMAIL PROTECTED]> > > > SPAM='spam' > > > > :0fw: $SPAM$LOGNAME.lock > > > > this will scan only one message for one user at a time. > > i thought the reason for using spamd/spamc was to provide a more > efficient processing o

Re: Robert Sekston filter

2007-10-02 Thread Igor Chudov
I have my own add-on filter that looks for patterns (perl regexps) in the entire email, if it finds such patterns, the messages go to a certain junk folder that I review periodically. That's exactly where this discussion is. I simply added word "Robert" followed by "Sexton" to that filter. Works g

RE: [qmailtoaster] Duplicate emails and increased spam getting through

2007-10-02 Thread Steve Ingraham
More information: Below are a few lines from the /var/log/qmail/spamd/current file. This information does not look good but I do not know what it means. Can someone give me some idea of what this means and what I should be looking at? @4000470285c9110f939c [19049] warn: prefork: select ret

RE: pyzor check failed (can't fork at Util.pm)

2007-10-02 Thread Gary V
> From: fbn > Hi Matthias,> > > Matthias Haegele-2 wrote:> > > >> where do I have to look > for this parameter? I grepped through /etc> >> recursive> >> but there was no > value pyzor_timeout.> > > > Where did you configure it?> > > >> with amavis > its here:> >> > >> /var/lib/amavis/.pyzor/> >

Duplicate emails and increased spam getting through

2007-10-02 Thread Steve Ingraham
I have a couple of problems that had shown up about a month ago and now are showing up again yesterday and today in our domain. Many of my users are reporting quite a few duplicate emails and many are receiving a great number of spam emails that they were not receiving before. We are running Qma

Re: Robert Sexton filter

2007-10-02 Thread Jerry Durand
At 10:01 AM 10/2/2007, Bob Proulx wrote: But then how would we discuss Myst? :-) http://en.wikipedia.org/wiki/Robyn_Miller Using single rules like that often have too much collateral damage. How would this message and discussion get through such a filter? Bob Ah, not a Myst player. I gue

Re: Robert Sexton filter

2007-10-02 Thread Bob Proulx
Jerry Durand wrote: > We've had that problem with "Robyn Miller" messages for quite some time. > I simply put a rule in that gives any message with "Robyn Miller" > anywhere in it a +100. But then how would we discuss Myst? :-) http://en.wikipedia.org/wiki/Robyn_Miller Using single rules like

Re: Robert Sexton filter

2007-10-02 Thread Jerry Durand
On Tue, 2007-10-02 at 10:58 -0500, Steven Stern wrote: > Does anyone have a rule handy that would replace my "blacklist_from" > entries with something more versatile? > We've had that problem with "Robyn Miller" messages for quite some time. I simply put a rule in that gives any message with "Ro

Re: Localize Rule

2007-10-02 Thread Jari Fredriksson
> Hi, > there are any repository of localize rules? I recieved > some spam in italian... > Thanks In local.cf: ok_locales en fi

MySpace

2007-10-02 Thread Peter P. Benac
Greetings, More and more of my clients are using MySpace. The spam filters put them in the 4-5 point range. Your opinions are needed. Is it worth white listing MySpace? Regards, Pete Peter P. Benac, CCNA Emacolet Networking Services, Inc Web and Mail Hosting. Phone: 252-657-9591 We

Re: Robert Sexton filter

2007-10-02 Thread Matthias Haegele
Steven Stern schrieb: We get many, many emails from a "Robert Sexton" who claims he'll do wonders with search engine placement. As fast as I add an address to the blacklist, he comes in with another. For example, from the AWL tables on one of our MX servers: Its useless to filter for (forge

Re: Robert Sexton filter

2007-10-02 Thread Theo Van Dinter
On Tue, Oct 02, 2007 at 10:58:26AM -0500, Steven Stern wrote: > We get many, many emails from a "Robert Sexton" who claims he'll do > wonders with search engine placement. As fast as I add an address to > the blacklist, he comes in with another. For example, from the AWL > tables on one of our

Robert Sexton filter

2007-10-02 Thread Steven Stern
We get many, many emails from a "Robert Sexton" who claims he'll do wonders with search engine placement. As fast as I add an address to the blacklist, he comes in with another. For example, from the AWL tables on one of our MX servers: +--+-+-

Re: pyzor check failed (can't fork at Util.pm)

2007-10-02 Thread Frank Niedermann
Hi Matthias, Matthias Haegele-2 wrote: > >> where do I have to look for this parameter? I grepped through /etc >> recursive >> but there was no value pyzor_timeout. > > Where did you configure it? > >> with amavis its here: >> >> /var/lib/amavis/.pyzor/ > > man pyzor > /usr/share/doc/pyzor/

Re: pyzor check failed (can't fork at Util.pm)

2007-10-02 Thread Frank Niedermann
Hi Mark, Mark Martinec wrote: > >> > pyzor_timeout 5 >> where do I have to look for this parameter? I grepped through /etc >> recursive but there was no value pyzor_timeout. > > $ man Mail::SpamAssassin::Plugin::Pyzor > > A different question is why pyzor took longer than 5 seconds. > Make

Re: pyzor check failed (can't fork at Util.pm)

2007-10-02 Thread Matthias Haegele
Frank Niedermann schrieb: Hi Mark, Mark Martinec wrote: run mode Oct 2 09:16:02 localhost spamd[6032]: pyzor: check timed out after 5 seconds But I have no idea why pyzor get's terminated :( Because you told it to. You probably have a pyzor_timeout 5 somewhere in config files. Mark

Re: pyzor check failed (can't fork at Util.pm)

2007-10-02 Thread Mark Martinec
Frank, > > pyzor_timeout 5 > where do I have to look for this parameter? I grepped through /etc > recursive but there was no value pyzor_timeout. $ man Mail::SpamAssassin::Plugin::Pyzor A different question is why pyzor took longer than 5 seconds. Make sure pyzor works from a command line fir

Re: pyzor check failed (can't fork at Util.pm)

2007-10-02 Thread Frank Niedermann
Hi Mark, Mark Martinec wrote: > >> run mode Oct 2 09:16:02 localhost spamd[6032]: pyzor: check timed out >> after 5 seconds >> >> But I have no idea why pyzor get's terminated :( > > Because you told it to. You probably have a > pyzor_timeout 5 > somewhere in config files. > > Mark > >

Re: pyzor check failed (can't fork at Util.pm)

2007-10-02 Thread Mark Martinec
Frank, > Oct 2 09:15:57 localhost spamd[6032]: info: entering helper-app run mode > Oct 2 09:15:57 localhost spamd[6032]: pyzor: opening pipe: /usr/bin/pyzor > check < /tmp/.spamassassin6032naLz9htmp > Oct 2 09:15:57 localhost spamd[6033]: util: setuid: ruid=0 euid=0 > Oct 2 09:16:02 localhost

Re: Botnet 0.8 Plugin is available (FINALLY!!!)

2007-10-02 Thread hanz
Actually, I have them set correctly. I receive email straight from the internet and most mail do not go thru internal forwarders. I have no trusted machines outside of my department as many machines outside the department is not under my control and a few of them is known to have generated spam an

[no subject]

2007-10-02 Thread mj romero
Hello Spamassassin's users,For Spamassassin and DSPAM, in Bayes, it is possible to keep tokens by user? In which formats? It supports Oracle, MySQL, PostgreSQL…?Sorry for my english and thanks. _ Express yourself instantly with MSN M

[no subject]

2007-10-02 Thread mj romero
Hello Spamassassin's users,For Spamassassin and DSPAM, in Bayes, it is possible to keep tokens by user? In which formats? It supports Oracle, MySQL, PostgreSQL…?Sorry for my english and thanks. _ Express yourself instantly with MSN M

Re: is lock needed when using spamd/c combo

2007-10-02 Thread Obantec Support
- Original Message - From: "Matthias Häker" <[EMAIL PROTECTED]> To: "spamassassin-users" Sent: Monday, October 01, 2007 4:49 PM Subject: Re: is lock needed when using spamd/c combo John D. Hardin schrieb: On Mon, 1 Oct 2007, Obantec Support wrote: DROPPRIVS=yes :0fw * < 512000

Re: pyzor check failed (can't fork at Util.pm)

2007-10-02 Thread Frank Niedermann
Hi, thanks for your reply. In the file /etc/spamassassin/v310.pre there are the lines # Pyzor - perform Pyzor message checks. loadplugin Mail::SpamAssassin::Plugin::Pyzor which are enabling pyzor I think. If I enable -D I see the following: Oct 2 09:15:57 localhost spamd[6032]: util: executa

Re: Purpose for SpamAssassin using MySQL

2007-10-02 Thread Michał Jęczalik
On Wed, 26 Sep 2007, James Lay wrote: I saw a post a couple days ago about converting to MySQL with SpamAssassin and wondered what the purpose would be for that? Just reporting? And if There are many. It allows you to share data between user accounts (IMHO it doesn't make much sense to have

Re: pyzor check failed (can't fork at Util.pm)

2007-10-02 Thread Matthias Haegele
Frank Niedermann schrieb: Hi, on a fresh Debian 4.0 installation with Spamassassin 3.1.7 I get to following message: Oct 2 06:01:20 zoidberg spamd[17975]: spamd: connection from localhost [127.0.0.1] at port 58519 Oct 2 06:01:21 zoidberg spamd[17975]: spamd: processing message <[EMAIL PROTE