Re: exclude from freemail_domains

2011-06-29 Thread Tom Kinghorn
On 29/06/2011 19:28, Lawrence @ Rogers wrote: A proper From header would be: From: lawrencewilli...@nl.rogers.com or From: "Lawrence Williams" lawrencewilli...@nl.rogers.com This is most likely a bug in the e-mail system you are using. Regards, Lawrence Thank you to everyone who has respond

Re: BOTNET IPv6 patch

2011-06-29 Thread Mark Martinec
On Wednesday June 29 2011 21:59:52 Yves Goergen wrote: > On 29.06.2011 21:03 CE(S)T, Yves Goergen wrote: > > Could somebody please just send me a message from an IPv6 > > mail server to my address? (Preferably from a host that should not be > > caught by Botnet...) > [...] > Doesn't seem to work. I

Re: BOTNET IPv6 patch

2011-06-29 Thread Yves Goergen
On 29.06.2011 21:03 CE(S)T, Yves Goergen wrote: > Could somebody please just send me a message from an IPv6 > mail server to my address? (Preferably from a host that should not be > caught by Botnet...) Here's a mail I just received: (thank you to the sender) > Received: from sp***ck.di***ie.com

Re: [Q] Writing rule for career opportunity type messages

2011-06-29 Thread Lawrence @ Rogers
On 29/06/2011 4:58 PM, JKL wrote: select count(spam_count) from bayes_vars Run this query SELECT username,spam_count,ham_count FROM bayes_vars This will give a list of usernames that have been used to learn ham and spam into SpamAssassin's Bayes MySQL DB. For a site-wide installation, this s

Re: [Q] Writing rule for career opportunity type messages

2011-06-29 Thread JKL
On 06/29/2011 09:15 PM, John Hardin wrote: > On Wed, 29 Jun 2011, JKL wrote: > >> mysql> select count(spam_count) from bayes_vars; >> +---+ >> | count(spam_count) | >> +---+ >> | 185 | >> +---+ >> >> mysql> select count(ham_count) from b

Re: [Q] Writing rule for career opportunity type messages

2011-06-29 Thread John Hardin
On Wed, 29 Jun 2011, JKL wrote: mysql> select count(spam_count) from bayes_vars; +---+ | count(spam_count) | +---+ | 185 | +---+ mysql> select count(ham_count) from bayes_vars; +--+ | count(ham_count) | +-

Re: [Q] Writing rule for career opportunity type messages

2011-06-29 Thread John Hardin
On Wed, 29 Jun 2011, Simon Loewenthal wrote: Just checked and am now unsure whether it is enables or not: oot@logout:/etc/spamassassin# grep -i bay local.cf Use Bayesian classifier (default: 1) ayes_auto_learn 1 I suggest you disable auto-learn until you have a good manually collected an

Re: [Q] Writing rule for career opportunity type messages

2011-06-29 Thread JKL
On 06/29/2011 08:50 PM, Lawrence @ Rogers wrote: > On 29/06/2011 3:59 PM, JKL wrote: >> On 06/29/2011 04:59 PM, John Hardin wrote: >>> On Wed, 29 Jun 2011, J4K wrote: >>> Over the past few months I noticed an increase in 'Start New Employment Today | Career Opportunity' style email.

Re: BOTNET IPv6 patch

2011-06-29 Thread Yves Goergen
On 13.06.2011 13:51 CE(S)T, Matthew Newton wrote: >> Can you post the patched Botnet.pm and Botnet.cf, that would be cool. > > I've put the patched Botnet.pm here: > > http://www.le.ac.uk/users/mcn4/botnet/ Hi, I was looking for an IPv6 fix for Botnet before but nobody (including me) was able t

Re: [Q] Writing rule for career opportunity type messages

2011-06-29 Thread Lawrence @ Rogers
On 29/06/2011 3:59 PM, JKL wrote: On 06/29/2011 04:59 PM, John Hardin wrote: On Wed, 29 Jun 2011, J4K wrote: Over the past few months I noticed an increase in 'Start New Employment Today | Career Opportunity' style email. The rules I use, that are pretty much stock rules, correctly tag the ema

Re: [Q] Writing rule for career opportunity type messages

2011-06-29 Thread JKL
On 06/29/2011 04:59 PM, John Hardin wrote: > On Wed, 29 Jun 2011, J4K wrote: > >> Over the past few months I noticed an increase in 'Start New Employment >> Today | Career Opportunity' style email. The rules I use, that are >> pretty much stock rules, correctly tag the email as spam. Usually the >>

Re: exclude from freemail_domains

2011-06-29 Thread Lawrence @ Rogers
On 29/06/2011 8:37 AM, Tom Kinghorn wrote: Good afternoon list. is there a way to exclude a domain from the fremail_domain checks in the local.cf? I do not want to have to manually remove our domain (which does not offer freemail) from the 20_freemail_domains.cf file every time we update.

Re: exclude from freemail_domains

2011-06-29 Thread Benny Pedersen
On Wed, 29 Jun 2011 16:32:12 +0300, Henrik K wrote: In any case I think it is valid to open up a bug so we can implement the "unlisting" config feature for FreeMail plugin. freemail_whielist ? what about freemail_whitelist_auth ? i do read source :=)

Re: exclude from freemail_domains

2011-06-29 Thread Benny Pedersen
On Wed, 29 Jun 2011 13:34:16 +0200, Axb wrote: On 2011-06-29 13:07, Tom Kinghorn wrote: Good afternoon list. is there a way to exclude a domain from the fremail_domain checks in the local.cf? I do not want to have to manually remove our domain (which does not offer freemail) from the 20_free

Re: exclude from freemail_domains

2011-06-29 Thread Benny Pedersen
On Wed, 29 Jun 2011 13:27:58 +0200, Tom Kinghorn wrote: On 29/06/2011 13:20, Benny Pedersen wrote: On Wed, 29 Jun 2011 13:07:24 +0200, Tom Kinghorn wrote: our own mail is matching: FROM_MISSP_FREEMAIL so fix the mua, none have asked to use brokken email clients I do not have access to the

Re: [Q] Writing rule for career opportunity type messages

2011-06-29 Thread John Hardin
On Wed, 29 Jun 2011, J4K wrote: Over the past few months I noticed an increase in 'Start New Employment Today | Career Opportunity' style email. The rules I use, that are pretty much stock rules, correctly tag the email as spam. Usually the Spam score hovers between 5.5 and 6.9. Is there some

[Q] Writing rule for career opportunity type messages

2011-06-29 Thread J4K
Dear all, Over the past few months I noticed an increase in 'Start New Employment Today | Career Opportunity' style email. The rules I use, that are pretty much stock rules, correctly tag the email as spam. Usually the Spam score hovers between 5.5 and 6.9. I would like to add a rule that adds mo

Re: exclude from freemail_domains

2011-06-29 Thread Henrik K
On Wed, Jun 29, 2011 at 02:54:26PM +0200, Tom Kinghorn wrote: > On 29/06/2011 14:50, John Hardin wrote: > >and the rules are hit > the domain which our clients use is vodamail.co.za > > So the outbound servers, which use SpamAssassin, are hitting the > rule mentioned. > > As such, a lot of our cl

Re: exclude from freemail_domains

2011-06-29 Thread John Hardin
On Wed, 29 Jun 2011, Tom Kinghorn wrote: On 29/06/2011 14:50, John Hardin wrote: and the rules are hit the domain which our clients use is vodamail.co.za Is that your domain also? -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #1

Re: exclude from freemail_domains

2011-06-29 Thread Tom Kinghorn
On 29/06/2011 14:50, John Hardin wrote: and the rules are hit the domain which our clients use is vodamail.co.za So the outbound servers, which use SpamAssassin, are hitting the rule mentioned. As such, a lot of our clients outbound mail are being rejected. It is a GSM network and a lot of m

Re: exclude from freemail_domains

2011-06-29 Thread John Hardin
On Wed, 29 Jun 2011, Tom Kinghorn wrote: I do not want to have to manually remove our domain (which does not offer freemail) from the 20_freemail_domains.cf file every time we update. refer to bug 6542 Is your domain vodamail.co.za or are you just offering that bug as an example of the clas

Re: X-Spam-Relays-External

2011-06-29 Thread Ned Slider
On 29/06/11 12:50, Henrik K wrote: On Wed, Jun 29, 2011 at 01:28:48PM +0300, Henrik K wrote: On Wed, Jun 29, 2011 at 11:02:13AM +0100, Ned Slider wrote: Hi List, I see the useful X-Spam-Relays-External pseudo header but what I'd really like to be able to specifically check is the Last External

Re: exclude from freemail_domains

2011-06-29 Thread Tom Kinghorn
On 29/06/2011 13:34, Axb wrote: afaik you can't disable a domain atm but you could use a rule doing something like (untested): header NICE_ENVFROM_YOURDOMAIN eval:check_freemail_header('EnvelopeFrom', '\@YOUR_DOMAIN') describe NICE__ENVFROM_YOURDOMAIN Envelope-from YOUR_DOMAIN score NICE__ENV

Re: Issuing rollback() due to DESTROY without explicit disconnect() of DBD::mysql::db handle

2011-06-29 Thread Mark Martinec
On 28/06/2011 11:20 PM, Marc Perkel wrote: > Now I'm seeing these error messages in the logs: > > Issuing rollback() due to DESTROY without explicit disconnect() of > DBD::mysql::db handle > > I'm beginning to wonder if MySQL bays actually works. I'm just geeing > too many strange errors. Which

Re: X-Spam-Relays-External

2011-06-29 Thread Henrik K
On Wed, Jun 29, 2011 at 01:28:48PM +0300, Henrik K wrote: > On Wed, Jun 29, 2011 at 11:02:13AM +0100, Ned Slider wrote: > > Hi List, > > > > I see the useful X-Spam-Relays-External pseudo header but what I'd > > really like to be able to specifically check is the Last External > > header as DNSBL

Re: X-Spam-Relays-External

2011-06-29 Thread RW
On Wed, 29 Jun 2011 12:01:54 +0100 Ned Slider wrote: > > Yes, _LASTEXTERNALRDNS_ would certainly work as the connecting IP has > rDNS that matches the string I was trying to match. > > Where might I find examples of TEMPLATE TAGS usage? It's unclear to > me how to use these options so some exa

Re: exclude from freemail_domains

2011-06-29 Thread Axb
On 2011-06-29 13:07, Tom Kinghorn wrote: Good afternoon list. is there a way to exclude a domain from the fremail_domain checks in the local.cf? I do not want to have to manually remove our domain (which does not offer freemail) from the 20_freemail_domains.cf file every time we update. refer

Re: exclude from freemail_domains

2011-06-29 Thread Tom Kinghorn
On 29/06/2011 13:20, Benny Pedersen wrote: On Wed, 29 Jun 2011 13:07:24 +0200, Tom Kinghorn wrote: our own mail is matching: FROM_MISSP_FREEMAIL so fix the mua, none have asked to use brokken email clients I do not have access to the clients mua... and this was not what I asked. Please kee

Re: exclude from freemail_domains

2011-06-29 Thread Benny Pedersen
On Wed, 29 Jun 2011 13:07:24 +0200, Tom Kinghorn wrote: our own mail is matching: FROM_MISSP_FREEMAIL so fix the mua, none have asked to use brokken email clients

Re: X-Spam-Relays-External

2011-06-29 Thread Benny Pedersen
On Wed, 29 Jun 2011 12:05:58 +0100, Ned Slider wrote: Who said anything about trusting the IP ? I simply want to verify that the email was relayed to me from a particular ISP as part of a meta rule. The very fact that the hostname(s) do have many IPs is the reason for matching that rather than

exclude from freemail_domains

2011-06-29 Thread Tom Kinghorn
Good afternoon list. is there a way to exclude a domain from the fremail_domain checks in the local.cf? I do not want to have to manually remove our domain (which does not offer freemail) from the 20_freemail_domains.cf file every time we update. refer to bug 6542 http://old.nabble.com/-Bu

Re: X-Spam-Relays-External

2011-06-29 Thread Ned Slider
On 29/06/11 11:24, Benny Pedersen wrote: On Wed, 29 Jun 2011 11:02:13 +0100, Ned Slider wrote: header __RCVD_FROM_SOMEISP X-Spam-Relays-Last-External =~ /someisp\.com/i bad rule, hostnames can have more then one ip, would you trust every ip now ? Who said anything about trusting the IP ?

Re: X-Spam-Relays-External

2011-06-29 Thread Ned Slider
On 29/06/11 11:12, Axb wrote: On 2011-06-29 12:02, Ned Slider wrote: Hi List, I see the useful X-Spam-Relays-External pseudo header but what I'd really like to be able to specifically check is the Last External header as DNSBL rules are able to do with -lastexternal. Is there a X-Spam-Relays-L

Re: X-Spam-Relays-External

2011-06-29 Thread Henrik K
On Wed, Jun 29, 2011 at 11:02:13AM +0100, Ned Slider wrote: > Hi List, > > I see the useful X-Spam-Relays-External pseudo header but what I'd > really like to be able to specifically check is the Last External > header as DNSBL rules are able to do with -lastexternal. > > Is there a X-Spam-Relays

Re: X-Spam-Relays-External

2011-06-29 Thread Benny Pedersen
On Wed, 29 Jun 2011 11:02:13 +0100, Ned Slider wrote: header __RCVD_FROM_SOMEISP X-Spam-Relays-Last-External =~ /someisp\.com/i bad rule, hostnames can have more then one ip, would you trust every ip now ? better would be to extend ASN plugin to have whitelist specific ASN or blacklist

Re: X-Spam-Relays-External

2011-06-29 Thread Axb
On 2011-06-29 12:02, Ned Slider wrote: Hi List, I see the useful X-Spam-Relays-External pseudo header but what I'd really like to be able to specifically check is the Last External header as DNSBL rules are able to do with -lastexternal. Is there a X-Spam-Relays-Last-External option that I'm mi

X-Spam-Relays-External

2011-06-29 Thread Ned Slider
Hi List, I see the useful X-Spam-Relays-External pseudo header but what I'd really like to be able to specifically check is the Last External header as DNSBL rules are able to do with -lastexternal. Is there a X-Spam-Relays-Last-External option that I'm missing, and if not would it be possib