recent sa-update rules (for 3.3.1) break plugin?

2011-02-18 Thread Frank Reppin
Hi list, I've written a small plugin which will output some timing details in order to check whether a mail comes in with severe delay... ... not 100% complete at this stage - but it gives some timing clues in the log. However... ... for some weird reason will this plugin only work by using the

[SOLVED] Re: date_received for previous hop

2011-02-18 Thread Frank Reppin
Hi list, Ok - think of it as beeing solved. I could make something 'useful' after digging more in HeaderEval.pm. But later then... this raises another issue. I'll open a separate thread on this one. Thanks. frank\ -- 43rd Law of Computing: Anything that can go wr fortune: Segmentation

Re: Tonns of russian DOT info spam

2011-02-18 Thread Karsten Bräckelmann
On Fri, 2011-02-18 at 15:53 -0800, Adam Katz wrote: > > Ah, good one. Though unfortunately, and I hate to admit that, both our > > rules will never match. The # hash needs to be escaped... *sigh* > > > > [/:?\#] > > > > Or just ignore it by leaving it out. It's pretty rare, anyway. > > Hash (#

Re: Tonns of russian DOT info spam

2011-02-18 Thread Adam Katz
> Ah, good one. Though unfortunately, and I hate to admit that, both our > rules will never match. The # hash needs to be escaped... *sigh* > > [/:?\#] > > Or just ignore it by leaving it out. It's pretty rare, anyway. Hash (#), like At (@) and sometimes Dollar ($), has an inconsistent behavio

Re: Tonns of russian DOT info spam

2011-02-18 Thread Karsten Bräckelmann
On Fri, 2011-02-18 at 15:01 -0800, Adam Katz wrote: > > > uri__TD_DOT_INFO m'^http://[^/]*\.info[/:?#]'i > > On 02/18/2011 02:55 PM, Karsten Bräckelmann wrote: > > Way better. And actually a uri rule. :) It's missing a bare domain URI, > > though. The "end of the domain part" sub-RE alternat

Re: My messages never got to this list, even though I'm subscribed etc.

2011-02-18 Thread jidanni
> "j" == jidanni writes: j> Well let's see if at least this reply gets through without needing to j> resort to Nabble. OK, it got through. ANOTHER_JIDANNI_STUPID_POST did not fire ☺

Re: My messages never got to this list, even though I'm subscribed etc.

2011-02-18 Thread jidanni
Well let's see if at least this reply gets through without needing to resort to Nabble.

Re: Freemail problem

2011-02-18 Thread Noel Butler
Mark, On Fri, 2011-02-18 at 15:20 +0100, Mark Martinec wrote: > Jeremy, Noel, > It's a bug in the FreeMail.pm plugin. It forgets to reset the rule description > text with every message, to the addresses listed in a rule description > just accumulate from one message to the next. I think this on

Re: My messages never got to this list, even though I'm subscribed etc.

2011-02-18 Thread Karsten Bräckelmann
On Fri, 2011-02-18 at 14:49 -0800, John Hardin wrote: > On Fri, 18 Feb 2011, jidanni wrote: > > > My recent messages never got to this list, even though I'm subscribed > > etc. Could it be it thinks they are ... spam? Possible -- did you by chance include URIs in your recent attempts to post, th

Re: Tonns of russian DOT info spam

2011-02-18 Thread Adam Katz
>> If you really want to do something that bold, at least limit it to the >> debian list (note, that list-id is a guess, check your headers): >> >> header __TD_DEB_LIST List-Id =~ // >> uri__TD_DOT_INFO m'^http://[^/]*\.info[/:?#]'i On 02/18/2011 02:55 PM, Karsten Bräckelmann wrote: > Way bett

Re: Tonns of russian DOT info spam

2011-02-18 Thread Karsten Bräckelmann
On Fri, 2011-02-18 at 14:04 -0800, Adam Katz wrote: > On 02/18/2011 01:46 PM, Michelle Konzack wrote: > > Since three weeks the Debian Mailinglist are hit be several 1000 russian > > DOTinfo spams and spamassassin score this crap with -4 Spam scoring -4. The .info URI is not your problem, neither

Re: My messages never got to this list, even though I'm subscribed etc.

2011-02-18 Thread John Hardin
On Fri, 18 Feb 2011, jidanni wrote: My recent messages never got to this list, even though I'm subscribed etc. Could it be it thinks they are ... spam? Or maybe the Nabble -> SA glue was temporarily broken for some reason. We aren't going to troubleshoot Nabble for you. Post directly to the l

Re: Tonns of russian DOT info spam

2011-02-18 Thread John Hardin
On Fri, 18 Feb 2011, Adam Katz wrote: On 02/18/2011 01:46 PM, Michelle Konzack wrote: Since three weeks the Debian Mailinglist are hit be several 1000 russian DOTinfo spams and spamassassin score this crap with -4 Can you post the offending message to a pastebin? +1 on the samples. I only

My messages never got to this list, even though I'm subscribed etc.

2011-02-18 Thread jidanni
My recent messages never got to this list, even though I'm subscribed etc. Could it be it thinks they are ... spam? -- View this message in context: http://old.nabble.com/My-messages-never-got-to-this-list%2C-even-though-I%27m-subscribed-etc.-tp30962942p30962942.html Sent from the SpamAssassin -

Re: Tonns of russian DOT info spam

2011-02-18 Thread Adam Katz
On 02/18/2011 01:46 PM, Michelle Konzack wrote: > Since three weeks the Debian Mailinglist are hit be several 1000 russian > DOTinfo spams and spamassassin score this crap with -4 > > Does someone have a working rule for this crap? > > I tried : > > describe TD_INFO dot info spam > body __

Tonns of russian DOT info spam

2011-02-18 Thread Michelle Konzack
Hello *, Since three weeks the Debian Mailinglist are hit be several 1000 russian DOTinfo spams and spamassassin score this crap with -4 Does someone have a working rule for this crap? I tried : describe TD_INFO dot info spam body __TD_INFO /http:\/\/.*\.info/i scoreTD_INFO 4.0 but

Re: TVD_SPACED_SUBJECT_WORD3

2011-02-18 Thread Bowie Bailey
On 2/18/2011 4:09 PM, Raymond Dijkxhoorn wrote: > Hi! > >> For the regexp challenged: >> >> This rule hits a subject with an optional "Re:" or "Fw:" followed by one >> word starting with at least one uppercase letter followed by at least >> one lowercase letter followed by at least one uppercase le

Re: TVD_SPACED_SUBJECT_WORD3

2011-02-18 Thread Raymond Dijkxhoorn
Hi! For the regexp challenged: This rule hits a subject with an optional "Re:" or "Fw:" followed by one word starting with at least one uppercase letter followed by at least one lowercase letter followed by at least one uppercase letter. It will not match if there are multiple words or any non

Re: TVD_SPACED_SUBJECT_WORD3

2011-02-18 Thread Bowie Bailey
On 2/18/2011 1:59 PM, Raymond Dijkxhoorn wrote: > Hi! > TVD_SPACED_SUBJECT_WORD3 is. http://spamassassin.apache.org/tests_3_2_x.html does not give a > >>> This rule can hit about anything. > >> As per the link I included I did see *what* the rule looks like. >> However, I would like to un

Re: TVD_SPACED_SUBJECT_WORD3

2011-02-18 Thread John Hardin
On Fri, 18 Feb 2011, Raymond Dijkxhoorn wrote: Hi! > > TVD_SPACED_SUBJECT_WORD3 is. > > http://spamassassin.apache.org/tests_3_2_x.html does not give a > This rule can hit about anything. As per the link I included I did see *what* the rule looks like. However, I would like to under

Re: TVD_SPACED_SUBJECT_WORD3

2011-02-18 Thread Raymond Dijkxhoorn
Hi! TVD_SPACED_SUBJECT_WORD3 is. http://spamassassin.apache.org/tests_3_2_x.html does not give a This rule can hit about anything. As per the link I included I did see *what* the rule looks like. However, I would like to understand why it is there and what it is supposed to filter. Thats

Re: TVD_SPACED_SUBJECT_WORD3

2011-02-18 Thread Leonard den Ottolander
Hello Raymond, On Fri, 2011-02-18 at 19:27 +0100, Raymond Dijkxhoorn wrote: > > TVD_SPACED_SUBJECT_WORD3 is. > > http://spamassassin.apache.org/tests_3_2_x.html does not give a > > This rule can hit about anything. As per the link I included I did see *what* the rule looks like. However, I would

Re: TVD_SPACED_SUBJECT_WORD3

2011-02-18 Thread Raymond Dijkxhoorn
Hi! TVD_SPACED_SUBJECT_WORD3 is. http://spamassassin.apache.org/tests_3_2_x.html does not give a description. This rule bit me when sending a mail with the subject "Re: MySQL". This rule can hit about anything. 72_active.cf:##{ TVD_SPACED_SUBJECT_WORD3 72_active.cf:header TVD_SPACED_SUBJECT_W

TVD_SPACED_SUBJECT_WORD3

2011-02-18 Thread Leonard den Ottolander
Hi, I was wondering what the rationale behind the rule TVD_SPACED_SUBJECT_WORD3 is. http://spamassassin.apache.org/tests_3_2_x.html does not give a description. This rule bit me when sending a mail with the subject "Re: MySQL". Regards, Leonard.

Re: date_received for previous hop

2011-02-18 Thread Bowie Bailey
On 2/18/2011 10:58 AM, Frank Reppin wrote: > > On 18.02.2011 16:25, Bowie Bailey wrote: > [...] >> That information should be in the headers. For example, from your >> email: >> >> Received: from athena.apache.org (HELO athena.apache.org) >> (140.211.11.136) >>by apache.org (qpsmtpd/0.29) with

Re: Freemail problem

2011-02-18 Thread Mark Martinec
Henrik, > Hmm yes I was wondering about this... so $pms->{conf} isn't actually "per > message" then? Too busy to dive into that right now.. No, the $pms->{conf} is just another ref or shortcut to $main->{conf}. Changes there affect the global configuration. The calls to $pms->clear_test_state

Re: date_received for previous hop

2011-02-18 Thread Frank Reppin
Hi Bowie, hi list, On 18.02.2011 16:25, Bowie Bailey wrote: [...] That information should be in the headers. For example, from your email: Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 18 Feb 2011 14:39:31 + It

Re: date_received for previous hop

2011-02-18 Thread Bowie Bailey
On 2/18/2011 9:38 AM, Frank Reppin wrote: > Hi Bowie, > > On 18.02.2011 15:10, Bowie Bailey wrote: > [...] >> You want the date the mail was sent to your MTA? How is that different >> than the date it was received by your MTA? > No - this would be really the same then. :) > > But let me clarify...

Re: Freemail problem

2011-02-18 Thread Henrik K
On Fri, Feb 18, 2011 at 03:20:32PM +0100, Mark Martinec wrote: > Jeremy, Noel, > > > I'm using SpamAssassin 3.2.5, and the "FreeMail.pm" plugin v2.001 from > > http://sa.hege.li, along with the rules from the 20_freemail.cf file at the > > same location. > > > > My first question is why does (mr

Re: date_received for previous hop

2011-02-18 Thread Frank Reppin
Hi Bowie, On 18.02.2011 15:10, Bowie Bailey wrote: [...] You want the date the mail was sent to your MTA? How is that different than the date it was received by your MTA? No - this would be really the same then. :) But let me clarify... ... each received header contains the date where a mail

Re: using spamhaus droplist with sa ?

2011-02-18 Thread Bowie Bailey
On 2/18/2011 9:30 AM, Ken A wrote: > > > On 2/17/2011 6:52 PM, Warren Togami Jr. wrote: >> On 2/17/2011 5:40 AM, RW wrote: >>> >>> The suggestion is that it be scored higher for that reason. >> >> Or just outright block all MTA connections from anything listed in >> zen.spamhaus.org, which seems to

Re: using spamhaus droplist with sa ?

2011-02-18 Thread Ken A
On 2/17/2011 6:52 PM, Warren Togami Jr. wrote: On 2/17/2011 5:40 AM, RW wrote: The suggestion is that it be scored higher for that reason. Or just outright block all MTA connections from anything listed in zen.spamhaus.org, which seems to be safe. Large sites I know have been doing that for

Re: Freemail problem

2011-02-18 Thread Mark Martinec
Jeremy, Noel, > I'm using SpamAssassin 3.2.5, and the "FreeMail.pm" plugin v2.001 from > http://sa.hege.li, along with the rules from the 20_freemail.cf file at the > same location. > > My first question is why does (mr.anthonywalter2010[at]gmail.com) appear > twice within the FREEMAIL_FROM ent

Re: date_received for previous hop

2011-02-18 Thread Bowie Bailey
On 2/17/2011 8:27 PM, Frank Reppin wrote: > Hi list, > > for some weird reasons... > ... I need to know the date where a mail was sent > by the previous host (in the mail header chain) to > our MTA. > > From checking HeaderEval.pm I conclude that: > (if I'm correct) > > date_received -> gives me

Re: Sa-update and proxy servers

2011-02-18 Thread Warren Togami Jr.
On 2/17/2011 11:44 PM, Daniel Lemke wrote: Michael Scheidell wrote: [...] I now need to set a proxy server to do sa-updates through, but could not find any information on settings for a proxy server. [...] Added cmd options: -x --proxy -U --proxy-user -P --proxy-password -t --connect

Re: Sa-update and proxy servers

2011-02-18 Thread Daniel Lemke
Michael Scheidell wrote: > > [...] > I now need to set a proxy server to do sa-updates through, but could not > find any information on settings for a proxy server. > > [...] > Added cmd options: > -x --proxy > -U --proxy-user > -P --proxy-password > -t --connect-timeout. > > [...] > Hi