Re: Another candidate for the hall of Shame: Eschelon

2008-04-18 Thread Arvid Ephraim Picciani
On Saturday 19 April 2008 03:10:42 Philip Prindeville wrote: > Which S/X/RBL would be most > effective in this case? spamhaus. If it's a known spammer, the ISP will get in trouble pretty fast. No clue how you submit anything to them though :/ mabe they already know, if the problem is big enough. I

Another candidate for the hall of Shame: Eschelon

2008-04-18 Thread Philip Prindeville
Well, I got a bunch of spams from 66.213.228.51 about some non-existent stock (that's considered Wire Fraud, and it's a federal felony offense in the US). It was also unsolicited. I went to Eschelon.com, the ISP, and provided them with examples and asked them to shutdown the spammer. They i

Re: SPF and Hotmail

2008-04-18 Thread Jari Fredriksson
> I can't employ what you've told me as upgrading to 3.2.4 > is out of the question until I rebuild the mail server > (Debian Sarge), but the advice is appreciated. > > Cheers, > Michael Hutchinson I have installed SpamAssassin on Debian Sarge & Etch via cpan and no problem has followed. As lon

Re: Extend DNSEval.pm?

2008-04-18 Thread William Taylor
On Fri, Apr 18, 2008 at 06:22:58PM +0100, Justin Mason wrote: > > William Taylor writes: > > Is there anyway to extend this in DNSEval.pm locally without patching? > > Maybe with a plugin or something? > > > > my @originating = (); > > for my $header ('X-Originating-IP', 'X-Apparently-From')

Re: Extend DNSEval.pm?

2008-04-18 Thread Justin Mason
William Taylor writes: > Is there anyway to extend this in DNSEval.pm locally without patching? Maybe > with a plugin or something? > > my @originating = (); > for my $header ('X-Originating-IP', 'X-Apparently-From') { > my $str = $pms->get($header); > next unless $str; > push (@

Extend DNSEval.pm?

2008-04-18 Thread William Taylor
Is there anyway to extend this in DNSEval.pm locally without patching? Maybe with a plugin or something? my @originating = (); for my $header ('X-Originating-IP', 'X-Apparently-From') { my $str = $pms->get($header); next unless $str; push (@originating, ($str =~ m/($IP_ADDRESS)/g)

Re: gpg failure on sa-update due to non-cross-certified key

2008-04-18 Thread D Hill
On Fri, 18 Apr 2008 at 10:30 -0500, [EMAIL PROTECTED] confabulated: On Fri, 2008-04-18 at 13:51 +, D Hill wrote: Re-download a GPG key and import: wget http://spamassassin.apache.org/updates/GPG.KEY sa-update --import GPG.KEY This is in the wiki: http://wiki.apache.org/spamassassin

Re: ways to react faster to spam attacks

2008-04-18 Thread Benny Pedersen
On Wed, March 19, 2008 13:53, Henrik K wrote: > Also: http://ixhash.sourceforge.net/ > Using all three lists works great here. it olso calc the md5 sum pr lists :/ so internal it can imho be speeded up by a rewrite :) flow: md5 sum rule test #1 test sum on all lists you define md5 sum rule te

Re: gpg failure on sa-update due to non-cross-certified key

2008-04-18 Thread McDonald, Dan
On Fri, 2008-04-18 at 13:51 +, D Hill wrote: > Re-download a GPG key and import: > >wget http://spamassassin.apache.org/updates/GPG.KEY >sa-update --import GPG.KEY > > This is in the wiki: > > http://wiki.apache.org/spamassassin/SaUpdateKeyNotCrossCertified?highlight=%28update%29 >

Re: help!

2008-04-18 Thread DAve
CC'd to the SA list for the archives. ToTheCenter.com wrote: Dave, Admittedly, I'm TOTALLY confused. :) What exactly should I be doing? :) My knowledge of unix is limited. Would you be willing to talk me through it? Would AIM be easier? I am up to my butt in alligators this morning, I sug

Re: help!

2008-04-18 Thread DAve
ToTheCenter.com wrote: Wow, how's that for a vague title. Here's the situation, our server is crashing lately once a week. Purely for fun i decided to stop anything related to mail: 1057 /etc/rc.d/init.d/MailScanner stop 1058 /etc/init.d/sendmail stop 1059 service spamassassin stop W

Re: help!

2008-04-18 Thread Robert Schetterer
ToTheCenter.com schrieb: Wow, how's that for a vague title. Here's the situation, our server is crashing lately once a week. Purely for fun i decided to stop anything related to mail: 1057 /etc/rc.d/init.d/MailScanner stop 1058 /etc/init.d/sendmail stop 1059 service spamassassin stop

help!

2008-04-18 Thread ToTheCenter.com
Wow, how's that for a vague title. Here's the situation, our server is crashing lately once a week. Purely for fun i decided to stop anything related to mail: 1057 /etc/rc.d/init.d/MailScanner stop 1058 /etc/init.d/sendmail stop 1059 service spamassassin stop Then I ran the TOP comman

Re: gpg failure on sa-update due to non-cross-certified key

2008-04-18 Thread D Hill
Re-download a GPG key and import: wget http://spamassassin.apache.org/updates/GPG.KEY sa-update --import GPG.KEY This is in the wiki: http://wiki.apache.org/spamassassin/SaUpdateKeyNotCrossCertified?highlight=%28update%29 I had the same thing happen and all is well now. -d On Fri, 18 Apr

Re: Different vbounce results between 3.2.2 and 3.2.4

2008-04-18 Thread Matus UHLAR - fantomas
On 18.04.08 12:54, Stefan Jakobs wrote: > I have two servers, one is running Spamassassin 3.2.2 and the other one is > running 3.2.4. For each I have enabled the vbounce plug-in in v320.pre and > have added the following line to my local.cf: > whitelist_bounce_relays server.domain.tld > If

gpg failure on sa-update due to non-cross-certified key

2008-04-18 Thread McDonald, Dan
I recently installed Mandriva 2008.1 on one of my spamfilters. It includes gpg version 1.4.9. When I try to run sa-update, I get: [EMAIL PROTECTED] ~]$ sudo sa-update Password: gpg: WARNING: unsafe permissions on homedir `/etc/mail/spamassassin/sa-update-keys' gpg: WARNING: unsafe permissions o

Re: Returned mail spam

2008-04-18 Thread Justin Mason
Matus UHLAR - fantomas writes: > > Richard Smits wrote: > > >Hos safe is it to pump up the score for the ANY_BOUNCE_MESSAGE ? > > >Is it bug free, so I can give it 5 or 10 points ? > > On 18.04.08 09:19, Jason Haar wrote: > > So you are wanting to mark ANY bounce, out of office, or mailing-list

Different vbounce results between 3.2.2 and 3.2.4

2008-04-18 Thread Stefan Jakobs
Hello list, I have two servers, one is running Spamassassin 3.2.2 and the other one is running 3.2.4. For each I have enabled the vbounce plug-in in v320.pre and have added the following line to my local.cf: whitelist_bounce_relays server.domain.tld If I now send this message (http://pa

Re: Returned mail spam

2008-04-18 Thread Matus UHLAR - fantomas
> Richard Smits wrote: > >Hos safe is it to pump up the score for the ANY_BOUNCE_MESSAGE ? > >Is it bug free, so I can give it 5 or 10 points ? On 18.04.08 09:19, Jason Haar wrote: > So you are wanting to mark ANY bounce, out of office, or mailing-list > related email into your organization as sp

RE: False Negatives

2008-04-18 Thread Koopmann, Jan-Peter
> It really doesn't matter to me whether it was on urisbl/surbl when he > sent it. I provided what our server marked this as as an example of > rules that he could look at as to why it was scored low. Other people > that don't use "unwanted language" may not need it, but in some cases > it > helps,