Rules for original headers in attachments of Content-Type: message/rfc822

2008-05-05 Thread wolfgang
Hi, in order to separate backscatter from "real" bounces, I would like to write rules that match only the headers within attachments > Content-Description: Undelivered Message > Content-Type: message/rfc822 body rules appear not to catch them ... can this be done in SA 3.2.3 and/or SA 3.1.8? I

Re: vbounce false positive on CommuniGate group message

2008-05-05 Thread JP Kelly
nevermind. i replaced the subroutine in VBounce.pm with the modified one on https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5884 hopefully this will work. thanks. jp On May 5, 2008, at 12:52 PM, JP Kelly wrote: Pardon my ignorance, but can someone explain how to implement the fix for th

Re: vbounce false positive on CommuniGate group message

2008-05-05 Thread JP Kelly
Pardon my ignorance, but can someone explain how to implement the fix for this? JP Kelly On May 2, 2008, at 9:37 AM, Jesse Stroik wrote: Stefan, Fantastic. This works. Thanks for pointing me in the right direction. Best, Jesse Stefan Jakobs wrote: On Friday 02 May 2008 17:24, Jesse S

Re: MIME_QP and other rules directory question

2008-05-05 Thread Martin Gregorie
> Sun May 4 16:57:17 2008 [2609] info: config: SpamAssassin failed to parse > line, no value provided for "score", skipping: > score MIME_QP_LONG_LINE RAW 0.9 > > I don't understand the message as there is a value provided for score > , 0.9 > The score number should be the 3rd word on the l

Re: joe jobbed or hacked?

2008-05-05 Thread Lars Magne Ingebrigtsen
Jon-Paul Kelly <[EMAIL PROTECTED]> writes: > I just received around 2000 bounce messages from various servers > rejecting messages (supposedly) coming from my email address. It's most likely just a joe-job thing. While backscatter is nothing new, I haven't seen backscatter on the current scale b

Re: MIME_QP and other rules directory question

2008-05-05 Thread John Hardin
On Mon, 5 May 2008, Tech Color printer wrote: Sun May 4 16:57:17 2008 [2609] info: config: score: requires a symbolic rule name and 1 or 4 scores Sun May 4 16:57:17 2008 [2609] info: config: SpamAssassin failed to parse line, no value provided for "score", skipping: score MIME_QP_LONG_LINE RAW

SA timed out with IP::Country

2008-05-05 Thread Stefan Jakobs
Hello list, I'm using spamassassin 3.2.4 (running on PERL 5.8.3) with amavisd-new 2.5.4 and IP::Country 2.23. From time to time (~ twice a day) I see the following error in my logfile: amavis[9384]: (09384-07) (!)SA TIMED OUT, backtrace: at /usr/lib/perl5/site_perl/5.8.3/IP/Country/Fast.pm lin

MIME_QP and other rules directory question

2008-05-05 Thread Tech Color printer
Return-Path: <[EMAIL PROTECTED]> Received: (qmail 73832 invoked by uid 99); 5 May 2008 00:31:15 - Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230) by apache.org (qpsmtpd/0.29) with ESMTP; Sun, 04 May 2008 17:31:15 -0700 X-ASF-Spam-Status: No, hits=-1.0 required=10.0 ~

Re: joe jobbed or hacked?

2008-05-05 Thread Kelson
Jon-Paul Kelly wrote: I just received around 2000 bounce messages from various servers rejecting messages (supposedly) coming from my email address. This has happened to me before but not on this scale. Any ideas on how to tell if this is just a joe job or if someone has actually used my server

Re: joe jobbed or hacked?

2008-05-05 Thread Rubin Bennett
Read the headers in the bounce messages; look for the originating IP address. If it's the address of your server, then you know it's not a joe job (but it probably is). Rubin On Mon, 2008-05-05 at 09:45 -0700, Jon-Paul Kelly wrote: > I just received around 2000 bounce messages from various serve

joe jobbed or hacked?

2008-05-05 Thread Jon-Paul Kelly
I just received around 2000 bounce messages from various servers rejecting messages (supposedly) coming from my email address. This has happened to me before but not on this scale. Any ideas on how to tell if this is just a joe job or if someone has actually used my server as a spam sending p

Re: 2 strange fatal SA errors

2008-05-05 Thread Bookworm
Christoph Petersen wrote: Hey guys, got some strange problem during my vacation the last week. For once it seems that the network stack of SA crashed so no new processes could be spawned or that the spamd crashed and blocked the port. The second problem looks very cryptic to me maybe some Perl g

Re: sa-compile problem

2008-05-05 Thread Expertsites, Inc.
- Original Message - From: "Ralf Hildebrandt" <[EMAIL PROTECTED]> To: Sent: Monday, May 05, 2008 7:21 AM Subject: Re: sa-compile problem * Jared Hall <[EMAIL PROTECTED]>: Symptoms are typical re2c problems. Try version 0.12.3 http://sourceforge.net/project/showfiles.php?group_id=96

Re: sa-compile problem

2008-05-05 Thread Ralf Hildebrandt
* Jared Hall <[EMAIL PROTECTED]>: > Symptoms are typical re2c problems. Try version 0.12.3 > http://sourceforge.net/project/showfiles.php?group_id=96864&package_id=103574&release_id=534536 I'm using 0.13.3-1, so I should downgrade? -- Ralf Hildebrandt (i.A. des IT-Zentrums) [EMAIL PROT

Re: sa-compile problem

2008-05-05 Thread Jared Hall
Ralf Hildebrandt wrote: # spamassassin -V SpamAssassin version 3.2.4 running on Perl version 5.8.8 >From my /usr/local/scripts/update_spamassassin cronjob /usr/bin/sa-update --channelfile /etc/mail/spamassassin/sare-sa-update-channels.txt \ --gpgkey 856AA88A \ --gpgkey 6C6191E3 follo

sa-compile problem

2008-05-05 Thread Ralf Hildebrandt
# spamassassin -V SpamAssassin version 3.2.4 running on Perl version 5.8.8 From my /usr/local/scripts/update_spamassassin cronjob /usr/bin/sa-update --channelfile /etc/mail/spamassassin/sare-sa-update-channels.txt \ --gpgkey 856AA88A \ --gpgkey 6C6191E3 followed by: /usr/bin/sa-compile

Re: whitelisting webmail application

2008-05-05 Thread Paul Griffith
On Sat, 03 May 2008 11:51:32 -0400, Leonardo Rodrigues Magalhães <[EMAIL PROTECTED]> wrote: > Hello Guys, > > im running SA 3.2.4 and, on the same machine, horde/imp as webmail > application. > > Sometimes, mails sent through imp are getting flagged as SPAM > because of RBL checks, fo