Re: _TOKENSUMMARY_ not working in 3.3.0?

On Mon, 2010-02-01 at 21:44 +0100, Mark Martinec wrote: > Sorry, reposting: the || should have been an &&, > the patch below is ok now: > > > On Saturday 30 January 2010 23:00:45 Michael Schaap wrote: > > In other words, _TOKENSUMMARY_ is consistently replaced by "Bayes not > > run.". Bayes *is*

Re: Hostkarma whitelist FP

Hi, > Can we get this IP removed? > > (I was going to report this directly, but I lost the email address and > wasn't able to find anything on the junkemailfilter website.) I hoped I could use this thread to ask about emediausa.com. This is currently blacklisted on HK, but not on URIBL. This isn

Re: How should this tricky spam be filtered?

ring it might decide against it). Concur. http://ruleqa.spamassassin.org/20100201-r905213-n/T_FROM_URI/detail?srcpath=jhardin -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2

Re: warn: reporter: DCC report via dccproc failed

On Mon, 2010-02-01 at 17:49 +0100, Matus UHLAR - fantomas wrote: > > > On 1/31/10 9:03 PM, Chris wrote: > > > > SA 3.3.0, just installed via CPAN this afternoon. When running my spam > > > > reporter script I noticed this: > > > > > > > > warn: reporter: DCC report via dccproc failed: Can't locate

Re: more troubles with DCC on SA 3.30 : dccifd options? dcc_options sent to wrong place?

On Mon, 2010-02-01 at 08:19 -0500, Michael Scheidell wrote: > On 2/1/10 8:16 AM, Mark Martinec wrote: > >> Thanks, that fixed mine. > >> > > Thanks for testing. Please open the bug report nevertheless, > > so that the fix is documented and can be properly rolled into 3.3.1. > > > > > bug

Re: warn: reporter: DCC report via dccproc failed

On Mon, 2010-02-01 at 14:14 +0100, Mark Martinec wrote: > Chris, > > > SA 3.3.0, just installed via CPAN this afternoon. When running my spam > > reporter script I noticed this: > > > > warn: reporter: DCC report via dccproc failed: Can't locate object > > method "close_pipe_fh" via package "Mail:

Re: warn: reporter: DCC report via dccproc failed

On Mon, 2010-02-01 at 07:13 -0500, Michael Scheidell wrote: > On 2/1/10 7:07 AM, Chris wrote: > > > > I have the standard (free) version of DCC. There were no issues when I > > ran the script a few days previously with 3.2.5. > > > > > > > cdcc -V exit > > what do you get? > > at least > 1.3.

Re: SA 3.3.0 spamassassin taint issue

Russ, > I have not gotten this into the bugzilla, but ... as it appears > a 3.3 release is imminent, I though I should mention seeing > this in my log files: > > I am getting this: > Jan 20 18:17:40 vm049244181 spamd[14023]: spamd: > Insecure dependency in chown while running with -T switch

Re: Status of Freebsd 3.30 port

So, it looks as if I'm misunderstanding the issue. Per a private email, the dependency will only come into play for amavisd-new if it's detected to be in use. Thus, if I'm understanding correctly, if you use amavisd-new, it'll force a dependency of 2.6.4, but if you don't have amavisd-new install

Re: 90_2tld.cf / / 90_3tld.cf

Karsten Bräckelmann wrote: > On Mon, 2010-02-01 at 22:33 +0100, Yet Another Ninja wrote: >> - If someone knows how to put these two rule sets in one file and >> "activate" according to SA version, pls let me know... I'm stumped. > > Preprocessing Options [1] in the SA Conf documentation. :) > >

Re: Status of Freebsd 3.30 port

Kurt, > Any thoughts about interoperability with Maia Mailguard? > Wouldn't forcing a dependency on amavisd-new break that? No. Maia split from amavisd-new somewhere around 2.2.1. > Any thoughts about interoperability with Maia Mailguard? See also: https://issues.apache.org/SpamAssassin/show

Re: Status of Freebsd 3.30 port

On Mon, Feb 1, 2010 at 12:57, Michael Scheidell wrote: > On 2/1/10 11:42 AM, Mark Martinec wrote: >>> >>> Any adjustments required in amavisd-new? >>> >> >> No, should be fine with 2.6.4.  Some of the new 3.3.0 features are >> already recognized and used by this version. See also my posting >> on

permission denied error keeps coming back

ever since I did a bayes learn on 200 spams and 200 hams a couple of days ago I've had the following error appearing in my mail log: 'mimedefang-multiplexor[13951]: Slave 0 stderr: bayes: locker: safe_lock: cannot create tmp lockfile /var/lib/spamassassin/bayes/bayes.lock.home.svr5.13952 for /var/

Re: Hostkarma whitelist FP

On Mon, 2010-02-01 at 10:52 -0800, Marc Perkel wrote: > > > Mike Cardwell wrote: > > > On 01/02/2010 17:31, Marc Perkel wrote: > > > > > > > > > Yep - sutterhealth.org is a hospital. Making sure good email gets > > > through is more important than a little bit of occasional spam. > > >

Re: 90_2tld.cf / / 90_3tld.cf

On Mon, 2010-02-01 at 22:33 +0100, Yet Another Ninja wrote: > - If someone knows how to put these two rule sets in one file and > "activate" according to SA version, pls let me know... I'm stumped. Preprocessing Options [1] in the SA Conf documentation. :) if (version >= 3.003000) # util_rb_3t

90_2tld.cf / / 90_3tld.cf

For those using SA 3.3.x I've split the tld files : SA > 3.3.x ONLY! http://www.rulesemporium.com/rules/90_3tld.cf SA > 3.2.4 http://www.rulesemporium.com/rules/90_2tld.cf SA 3.3.x users will require both files. - If someone knows how to put these two rule sets in one file and "activate" a

Re: Hostkarma whitelist FP

Mike Cardwell wrote: On 01/02/2010 17:31, Marc Perkel wrote: Yep - sutterhealth.org is a hospital. Making sure good email gets through is more important than a little bit of occasional spam. http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists "And if you never send spam we want

Re: Status of Freebsd 3.30 port

On 2/1/10 11:42 AM, Mark Martinec wrote: Any adjustments required in amavisd-new? No, should be fine with 2.6.4. Some of the new 3.3.0 features are already recognized and used by this version. See also my posting on the amavis list: http://marc.info/?l=amavis-user&m=126452700028360

Re: _TOKENSUMMARY_ not working in 3.3.0?

Sorry, reposting: the || should have been an &&, the patch below is ok now: On Saturday 30 January 2010 23:00:45 Michael Schaap wrote: > In other words, _TOKENSUMMARY_ is consistently replaced by "Bayes not > run.". Bayes *is* running OK. Messages are scored correctly, and the > _HAMMYTOKENS(5

Re: _TOKENSUMMARY_ not working in 3.3.0?

On Saturday 30 January 2010 23:00:45 Michael Schaap wrote: > In other words, _TOKENSUMMARY_ is consistently replaced by "Bayes not > run.". Bayes *is* running OK. Messages are scored correctly, and the > _HAMMYTOKENS(5)_ and _SPAMMYTOKENS(5)_ placeholders are correctly filled > in. Please open

SA 3.30 and 0 scores?

don't know if this is meant to be 0. if 0, and really should be zero, why not make it a meta rule only? 20_drugs.cf:meta DRUGS_ANXIETY_EREC (DRUGS_ERECTILE && DRUGS_ANXIETY) 20_drugs.cf:describe DRUGS_ANXIETY_EREC Refers to both an erectile and an anxiety drug 50_scores.cf:score DRUGS_ANX

Re: Hostkarma whitelist FP

Alex wrote: That's a bad thing for anyone, not just hospitals, but I doubt if the system that sends regular email is in any way connected to the internal patient system. Not knowing what their system is I have to make sure that email sent from hospitals gets delivered. Passing ham take

Re: how can i finetune to spamassassin to handle spams

ram wrote: > > > On Mon, Feb 1, 2010 at 10:23 PM, Bowie Bailey > wrote: > > ram wrote: > > hi > > > > what i am looking is > > > > iam looking sitewide, not userwide > > > > so if the user feel its spam mail, he will send that mail to an

Re: Hostkarma whitelist FP

>> That's a bad thing for anyone, not just hospitals, but I doubt if the >> system that sends regular email is in any way connected to the >> internal patient system. >> > Not knowing what their system is I have to make sure that email sent from > hospitals gets delivered. Passing ham takes precede

Re: Hostkarma whitelist FP

Alex wrote: Hi, They are the kind of people I email about these problems because it could signal they've been hacked. And that's a bad thing for hospitals. The sooner they know the sooner they can clean house. That's a bad thing for anyone, not just hospitals, but I doubt if the sys

Re: Hostkarma whitelist FP

Hi, > They are the kind of people I email about these problems because it could > signal they've been hacked. And that's a bad thing for hospitals. The > sooner they know the sooner they can clean house. That's a bad thing for anyone, not just hospitals, but I doubt if the system that sends regul

Re: Hostkarma whitelist FP

Mike Cardwell wrote: On 01/02/2010 17:31, Marc Perkel wrote: Yep - sutterhealth.org is a hospital. Making sure good email gets through is more important than a little bit of occasional spam. http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists "And if you never send spam we wan

Re: how can i finetune to spamassassin to handle spams

On Mon, Feb 1, 2010 at 10:23 PM, Bowie Bailey wrote: > ram wrote: > > hi > > > > what i am looking is > > > > iam looking sitewide, not userwide > > > > so if the user feel its spam mail, he will send that mail to another > > email of local account, > > from there i want to choose the bayes learn

Re: Status of Freebsd 3.30 port

Michael Scheidell wrote: I am almost ready to post the pr to upgrade SA 3.2.5 to SA 3.3.0 which is the first step in getting the SA 3.30 port officially on FreeBsd ports system. Prior to this, please update your dependencies, specifically, upgrade p5-Mail-DKIM to at least 0.37, and if you are u

Re: Hostkarma whitelist FP

On 01/02/2010 17:31, Marc Perkel wrote: > Yep - sutterhealth.org is a hospital. Making sure good email gets > through is more important than a little bit of occasional spam. http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists "And if you never send spam we want you to be on our whitelist."

Re: How should this tricky spam be filtered?

On Mon, 2010-02-01 at 12:09 -0500, Adam Katz wrote: > It might be nice to have the URI rule check From, Reply-to, and > Subject. We'd have to be careful so as to not include /all/ headers > as many different mailing lists use various headers for subscription > management and PGP systems often use

Re: Hostkarma whitelist FP

They are the kind of people I email about these problems because it could signal they've been hacked. And that's a bad thing for hospitals. The sooner they know the sooner they can clean house. {^_^} - Original Message - From: "Marc Perkel" Sent: Monday, 2010/February/01 09:31 Yep -

Re: Hostkarma whitelist FP

Yep - sutterhealth.org is a hospital. Making sure good email gets through is more important than a little bit of occasional spam. Bowie Bailey wrote: Even if they are emailing me regarding the amazingly large sum of money some unknown person apparently left me in his will? :) Marc Perkel wro

Re: How should this tricky spam be filtered?

Martin Gregorie wrote: > Apparently putting the spam's payload in the "personal name" part > of the From: header is as old a trick as putting it in the Subject: > header though I hadn't seen it used until recently. > > There was a recent suggestion that 'personal name' text from the > From: header

Re: Hostkarma whitelist FP

Even if they are emailing me regarding the amazingly large sum of money some unknown person apparently left me in his will? :) Marc Perkel wrote: > That's the outgoing email gateway for a hospital. It stays whitelisted. > > Bowie Bailey wrote: >> This was listed in the Hostkarma whitelist: >> >>

Re: Magical mystery colon

On 02/01/2010 05:35 AM, Mark Martinec wrote: > On Saturday January 30 2010 21:16:01 Philip A. Prindeville wrote: > >> Also, how come the eval block: >> unless (eval "require $thing") {...} >> doesn't contain a terminating ';', i.e.: >> eval "require $thing;" instead? >> > It is not needed

Re: how can i finetune to spamassassin to handle spams

ram wrote: > hi > > what i am looking is > > iam looking sitewide, not userwide > > so if the user feel its spam mail, he will send that mail to another > email of local account, > from there i want to choose the bayes learn and decide what is spam > and what is not spam > > hope i explaine

Re: warn: reporter: DCC report via dccproc failed

> > On 1/31/10 9:03 PM, Chris wrote: > > > SA 3.3.0, just installed via CPAN this afternoon. When running my spam > > > reporter script I noticed this: > > > > > > warn: reporter: DCC report via dccproc failed: Can't locate object > > > method "close_pipe_fh" via package "Mail::SpamAssassin::Report

Re: Status of Freebsd 3.30 port

> Any adjustments required in amavisd-new? No, should be fine with 2.6.4. Some of the new 3.3.0 features are already recognized and used by this version. See also my posting on the amavis list: http://marc.info/?l=amavis-user&m=126452700028360 For other versions the release notes tell: - ve

Re: Sought Rules Back?

Thanks for this info and good idea about this meta rule! Kai -- Get your web at Conactive Internet Services: http://www.conactive.com

Re: Status of Freebsd 3.30 port

-- Original Message -- From: Michael Scheidell Date: Mon, 01 Feb 2010 10:11:36 -0500 >I am almost ready to post the pr to upgrade SA 3.2.5 to SA 3.3.0 which >is the first step in getting the SA 3.30 port officially on FreeBsd >ports system. >Prior to thi

Re: Sought Rules Back?

On 2/1/10 9:59 AM, "Jason Bertoch" wrote: > On 2/1/2010 10:58 AM, RW wrote: >> On Mon, 1 Feb 2010 16:30:04 +0100 >> Mark Martinec wrote: >> > Update returned sought rules 1/31/2010. Actually back since Jan 6. :) Re-viewed about 1k fraud spam the following days, for the Sought Fra

Re: Sought Rules Back?

On 2/1/2010 10:58 AM, RW wrote: On Mon, 1 Feb 2010 16:30:04 +0100 Mark Martinec wrote: Update returned sought rules 1/31/2010. Actually back since Jan 6. :) Re-viewed about 1k fraud spam the following days, for the Sought Fraud sub-set. Btw, the three rules JM_SOUGHT_FRAUD_{1,2,3} have a sc

Re: Sought Rules Back?

On Mon, 1 Feb 2010 16:30:04 +0100 Mark Martinec wrote: > > > Update returned sought rules 1/31/2010. > > > > Actually back since Jan 6. :) Re-viewed about 1k fraud spam the > > following days, for the Sought Fraud sub-set. > > Btw, the three rules JM_SOUGHT_FRAUD_{1,2,3} have a score of zero >

Re: Sought Rules Back?

On 2/1/10 9:30 AM, "Mark Martinec" wrote: >>> Update returned sought rules 1/31/2010. >> >> Actually back since Jan 6. :) Re-viewed about 1k fraud spam the >> following days, for the Sought Fraud sub-set. > > Btw, the three rules JM_SOUGHT_FRAUD_{1,2,3} have a score of zero > as per Justin's r

Re: Hostkarma whitelist FP

That's the outgoing email gateway for a hospital. It stays whitelisted. Bowie Bailey wrote: This was listed in the Hostkarma whitelist: [198.217.64.52 listed in hostkarma.junkemailfilter.com] Can we get this IP removed? (I was going to report this directly, but I lost the email address and wa

Re: Sought Rules Back?

On 2/1/2010 10:30 AM, Mark Martinec wrote: Btw, the three rules JM_SOUGHT_FRAUD_{1,2,3} have a score of zero as per Justin's request (Bug 6155 c 38, c72, c89, c124). Not sure if people using the channel realize that scores need to be bumped up. Btw, I prefer to avoid them monopolizing the score

Re: Sought Rules Back?

> > Update returned sought rules 1/31/2010. > > Actually back since Jan 6. :) Re-viewed about 1k fraud spam the > following days, for the Sought Fraud sub-set. Btw, the three rules JM_SOUGHT_FRAUD_{1,2,3} have a score of zero as per Justin's request (Bug 6155 c 38, c72, c89, c124). Not sure if p

Re: Sought Rules Back?

On Mon, 2010-02-01 at 00:10 -0500, Jared Hall wrote: > Update returned sought rules 1/31/2010. Actually back since Jan 6. :) Re-viewed about 1k fraud spam the following days, for the Sought Fraud sub-set. > Had to pinch myself 2.5 times (1 per month) > to be sure. > > Thanks. -- char *t="\10p

Status of Freebsd 3.30 port

I am almost ready to post the pr to upgrade SA 3.2.5 to SA 3.3.0 which is the first step in getting the SA 3.30 port officially on FreeBsd ports system. Prior to this, please update your dependencies, specifically, upgrade p5-Mail-DKIM to at least 0.37, and if you are using amavisd-new, upgrade

90_sare_freemail.cf.sare.sa-update.dostech.net

Is there still a reason for this update channel? 90_sare_freemail.cf.sare.sa-update.dostech.net Or is it now built in to SA v3.3.0?

Hostkarma whitelist FP

This was listed in the Hostkarma whitelist: [198.217.64.52 listed in hostkarma.junkemailfilter.com] Can we get this IP removed? (I was going to report this directly, but I lost the email address and wasn't able to find anything on the junkemailfilter website.) -- Bowie

Re: Magical mystery colon

On Saturday January 30 2010 21:16:01 Philip A. Prindeville wrote: > Also, how come the eval block: > unless (eval "require $thing") {...} > doesn't contain a terminating ';', i.e.: > eval "require $thing;" instead? It is not needed. It is an 'eval EXPR', not 'eval BLOCK'. A semicolon in perl is

Re: more troubles with DCC on SA 3.30 : dccifd options? dcc_options sent to wrong place?

On 2/1/10 8:16 AM, Mark Martinec wrote: Thanks, that fixed mine. Thanks for testing. Please open the bug report nevertheless, so that the fix is documented and can be properly rolled into 3.3.1. bug opened, patch documented! thanks for help across the big pond! bet the snow capped m

Re: more troubles with DCC on SA 3.30 : dccifd options? dcc_options sent to wrong place?

> Thanks, that fixed mine. Thanks for testing. Please open the bug report nevertheless, so that the fix is documented and can be properly rolled into 3.3.1. > won't help 'chris's problem, will it? No, its is unrelated. Mark

Re: warn: reporter: DCC report via dccproc failed

Chris, > SA 3.3.0, just installed via CPAN this afternoon. When running my spam > reporter script I noticed this: > > warn: reporter: DCC report via dccproc failed: Can't locate object > method "close_pipe_fh" via package "Mail::SpamAssassin::Reporter" > at /etc/mail/spamassassin/DCC.pm line 803,

Re: PORTERS QUESTION: SA 3.3.0 and rules

On 31-Jan-2010, at 14:21, Michael Scheidell wrote: > > maybe I should have read ../INSTALL file :-) > Install rules from a compressed tar archive: > >sa-update --install Mail-SpamAssassin-rules-xxx.tgz Does this mean 3.3.0 should now show up in ports? -- What are you, Ghouls? There are no

Re: more troubles with DCC on SA 3.30 : dccifd options? dcc_options sent to wrong place?

On 2/1/10 8:01 AM, Mark Martinec wrote: Wrong options. Please open a bug report. I believe this is the fix: Thanks, that fixed mine. won't help 'chris's problem, will it? -- Michael Scheidell, CTO Phone: 561-999-5000, x 1259 > *| *SECNAP Network Security Corporation * Certified SNORT I

Re: more troubles with DCC on SA 3.30 : dccifd options? dcc_options sent to wrong place?

Michael, > was using this on SA 3.2.5 in local.cf > dcc_options -R -x 0 > dcc_home /usr/local/dcc > dcc_dccifd_path /usr/local/dcc/dccifd > > now, on SA 3.30, I get this (constantly). > > Feb 1 07:19:14 mx1 dccifd[10069]: unrecognized option value: "-R -x 0" > > note, that dcc_options are opti

more troubles with DCC on SA 3.30 : dccifd options? dcc_options sent to wrong place?

was using this on SA 3.2.5 in local.cf dcc_options -R -x 0 dcc_home /usr/local/dcc dcc_dccifd_path /usr/local/dcc/dccifd now, on SA 3.30, I get this (constantly). Feb 1 07:19:14 mx1 dccifd[10069]: unrecognized option value: "-R -x 0" note, that dcc_options are options that are supposed to be s

Re: Summary Tokens

Reading at least a few of the latest messages helps reduce postings about duplicate issues. Kai -- Get your web at Conactive Internet Services: http://www.conactive.com

Re: warn: reporter: DCC report via dccproc failed

On 2/1/10 7:07 AM, Chris wrote: I have the standard (free) version of DCC. There were no issues when I ran the script a few days previously with 3.2.5. cdcc -V exit what do you get? at least 1.3.111? -- Michael Scheidell, CTO Phone: 561-999-5000, x 1259 > *| *SECNAP Network Security

Re: warn: reporter: DCC report via dccproc failed

On Mon, 2010-02-01 at 06:38 -0500, Michael Scheidell wrote: > On 1/31/10 9:03 PM, Chris wrote: > > SA 3.3.0, just installed via CPAN this afternoon. When running my spam > > reporter script I noticed this: > > > > warn: reporter: DCC report via dccproc failed: Can't locate object > > method "close_

Re: warn: reporter: DCC report via dccproc failed

On 1/31/10 9:03 PM, Chris wrote: SA 3.3.0, just installed via CPAN this afternoon. When running my spam reporter script I noticed this: warn: reporter: DCC report via dccproc failed: Can't locate object method "close_pipe_fh" via package "Mail::SpamAssassin::Reporter" at /etc/mail/spamassassin/D

Re: PORTERS QUESTION: SA 3.3.0 and rules

it's a "release version" -- each release's version of that file and its sigs will never change. On Mon, Feb 1, 2010 at 10:55, Michael Scheidell wrote: > > > On 2/1/10 5:52 AM, Justin Mason wrote: > > In this case, I would use the sa-update --install option. > > > > thanks, yes, I think during the

Re: PORTERS QUESTION: SA 3.3.0 and rules

On 2/1/10 5:52 AM, Justin Mason wrote: In this case, I would use the sa-update --install option. thanks, yes, I think during the freebsd fetch, I will fetch both tarballs, install the default rule set so that if they start spamd or run SA, it won't fail. (so that it is consistent with e

Re: PORTERS QUESTION: SA 3.3.0 and rules

In this case, I would use the sa-update --install option. On Sun, Jan 31, 2010 at 19:56, Michael Scheidell wrote: > Working on official SA 3.3.0 port for Freebsd, have a Question: > if user who installs SA 3.3.0 does NOT install or use sa-update, then I have > to install the default ruleset. > wh