RE: rules and configuration not running correctly

2014-10-24 Thread David B Funk
Two things, are you using 1) "amavis" (OLD original) 2) "amavis-new" 3) "amavis-ng" If "amavis-new" are you managing -its- config files, NOT 'spamd's config files? Please look at the docs for "amavis-new", it instanciates its own SA instance within its perl damon, it does not use 'spamd'. If you

Re: .link TLD spammer haven?

2014-10-24 Thread John Hardin
On Fri, 24 Oct 2014, John Hardin wrote: On Sat, 25 Oct 2014, Martin Gregorie wrote: Less obviously, it doesn't seem to matter whether you write the rule as /\.link\b/ or /\.link$/ - both give identical matches. Both match the following regexes just as you'd expect: http: //www.linkedin.com

Re: .link TLD spammer haven?

2014-10-24 Thread John Hardin
On Sat, 25 Oct 2014, Martin Gregorie wrote: Less obviously, it doesn't seem to matter whether you write the rule as /\.link\b/ or /\.link$/ - both give identical matches. Both match the following regexes just as you'd expect: http://www.linkedin.com/home/user/data.link http://www.example.li

Re: .link TLD spammer haven?

2014-10-24 Thread Martin Gregorie
On Fri, 2014-10-24 at 17:27 -0700, John Hardin wrote: > On Sat, 25 Oct 2014, Martin Gregorie wrote: > > > . Does \b match end of string? That > > never occurred to me. I've always used $ to do that and it certainly > > works as part of a URI rule. > > No, \b matches the transition from a word

Re: .link TLD spammer haven?

2014-10-24 Thread Benny Pedersen
On October 25, 2014 2:30:32 AM John Hardin wrote: >>uri __MG_LTD1 /(\.link$|\.link\/)/i > There is still a match on unancored match, remove |\.link\/ and () ...leaving /\.link$/i ? You only want to match on a URL that is solely a bare domain in the .link TLD? Its a subrule for

RE: rules and configuration not running correctly

2014-10-24 Thread dave
Anyone have any ideas?? -Original Message- From: dave Sent: Friday, October 24, 2014 11:51 AM To: users@spamassassin.apache.org >> SA Mailing list Subject: RE: rules and configuration not running correctly (Sorry about the list thing realized after sending) It is launched from amavis --

Re: .link TLD spammer haven?

2014-10-24 Thread John Hardin
On Sat, 25 Oct 2014, Benny Pedersen wrote: On October 24, 2014 9:20:14 PM Quanah Gibson-Mount wrote: uri __MG_LTD1 /(\.link$|\.link\/)/i There is still a match on unancored match, remove |\.link\/ and () ...leaving /\.link$/i ? You only want to match on a URL that is solel

Re: .link TLD spammer haven?

2014-10-24 Thread John Hardin
On Sat, 25 Oct 2014, Martin Gregorie wrote: On Fri, 2014-10-24 at 19:48 -0400, Daniel Staal wrote: If it does it's behaving oddly. Still, I might try this instead: uri __MG_LTD1 /\.link\b/i That should be faster and more general than the second one above, and shouldn't grab lin

Re: .link TLD spammer haven?

2014-10-24 Thread Benny Pedersen
On October 24, 2014 9:20:14 PM Quanah Gibson-Mount wrote: uri __MG_LTD1 /(\.link$|\.link\/)/i There is still a match on unancored match, remove |\.link\/ and ()

Re: .link TLD spammer haven?

2014-10-24 Thread Martin Gregorie
On Fri, 2014-10-24 at 19:48 -0400, Daniel Staal wrote: > If it does it's behaving oddly. Still, I might try this instead: > > uri __MG_LTD1 /\.link\b/i > > That should be faster and more general than the second one above, and > shouldn't grab linkedin either. > The problem is that

Re: .link TLD spammer haven?

2014-10-24 Thread Daniel Staal
--As of October 25, 2014 12:45:31 AM +0200, Reindl Harald is alleged to have said: Am 25.10.2014 um 00:42 schrieb RW: On Fri, 24 Oct 2014 21:31:51 +0200 Reindl Harald wrote: Am 24.10.2014 um 21:20 schrieb Quanah Gibson-Mount: --On Thursday, October 23, 2014 11:56 PM +0100 Martin Gregorie

Re: .link TLD spammer haven?

2014-10-24 Thread Reindl Harald
Am 25.10.2014 um 00:42 schrieb RW: On Fri, 24 Oct 2014 21:31:51 +0200 Reindl Harald wrote: Am 24.10.2014 um 21:20 schrieb Quanah Gibson-Mount: --On Thursday, October 23, 2014 11:56 PM +0100 Martin Gregorie Thanks for that. I've now installed it and have been running tests against my spam cor

Re: .link TLD spammer haven?

2014-10-24 Thread RW
On Fri, 24 Oct 2014 21:31:51 +0200 Reindl Harald wrote: > > > Am 24.10.2014 um 21:20 schrieb Quanah Gibson-Mount: > > --On Thursday, October 23, 2014 11:56 PM +0100 Martin Gregorie > >> Thanks for that. I've now installed it and have been running tests > >> against my spam corpus to make sure th

Re: trusted networks getting marked as spam

2014-10-24 Thread Kris Deugau
micah anderson wrote: > > Hi, > > I've got some machines that are running logcheck, they periodically send > mail to us with reports. Sometimes those mails have some spammy stuff in > them, because they are mail server logs, or web logs with some spammy > stuff in them. > > I don't want spamass

Re: .link TLD spammer haven?

2014-10-24 Thread Reindl Harald
Am 24.10.2014 um 21:20 schrieb Quanah Gibson-Mount: --On Thursday, October 23, 2014 11:56 PM +0100 Martin Gregorie Thanks for that. I've now installed it and have been running tests against my spam corpus to make sure that this subrule: uri __MG_LTD1 /\.link/i was now working corr

Re: trusted networks getting marked as spam

2014-10-24 Thread Reindl Harald
Am 24.10.2014 um 21:18 schrieb John Hardin: On Fri, 24 Oct 2014, Reindl Harald wrote: Am 24.10.2014 um 17:59 schrieb micah anderson: I've got some machines that are running logcheck, they periodically send mail to us with reports. Sometimes those mails have some spammy stuff in them, becau

Re: .link TLD spammer haven?

2014-10-24 Thread Quanah Gibson-Mount
--On Thursday, October 23, 2014 11:56 PM +0100 Martin Gregorie wrote: On Thu, 2014-10-23 at 17:20 +0200, Axb wrote: As there's a bunch of other new TLDs being abused I would higly recomend updating RegistrarBoundaries.pm from http://svn.apache.org/repos/asf/spamassassin/trunk/lib/Mail/SpamAs

Re: trusted networks getting marked as spam

2014-10-24 Thread John Hardin
On Fri, 24 Oct 2014, Reindl Harald wrote: Am 24.10.2014 um 17:59 schrieb micah anderson: I've got some machines that are running logcheck, they periodically send mail to us with reports. Sometimes those mails have some spammy stuff in them, because they are mail server logs, or web logs with

RE: rules and configuration not running correctly

2014-10-24 Thread dave
(Sorry about the list thing realized after sending) It is launched from amavis -Original Message- From: Axb [mailto:axb.li...@gmail.com] Sent: Friday, October 24, 2014 11:42 AM To: users@spamassassin.apache.org >> SA Mailing list Subject: Re: rules and configuration not running correctly

RE: rules and configuration not running correctly

2014-10-24 Thread dave
Still no go ... I just sent this to myself--X-virus gets added X-Spam does not Received: from mailgate.example.org (x.x.x.1) by exchangeserver.example.org (x.x.x.2) with Microsoft SMTP Server id 14.1.438.0; Fri, 24 Oct 2014 11:38:31 -0500 Received: from localhost (mailgate.example.org [127.0.0.1

Re: rules and configuration not running correctly

2014-10-24 Thread Axb
On 10/24/2014 06:34 PM, dave wrote: Thanks... I am looking to have x-spam status and associated scores added to the headers of all messages ... also my custom and sought rules do not seem to fire Please keep list mail on the list. - How are you using SA? (pls specify: amavis, MIMEDefang, a

Re: rules and configuration not running correctly

2014-10-24 Thread Axb
On 10/24/2014 06:17 PM, dave wrote: Hello all I am running Spamassassin 3.4 on an Ubuntu 14.04 build. The server installation is working as a spam\ email Gateway. It does not host mail at all, but simply forwards email to exchange server. It serves pretty much as a prefilter for exchange. Th

rules and configuration not running correctly

2014-10-24 Thread dave
Hello all I am running Spamassassin 3.4 on an Ubuntu 14.04 build. The server installation is working as a spam\ email Gateway. It does not host mail at all, but simply forwards email to exchange server. It serves pretty much as a prefilter for exchange. The problem with them having is that I c

Re: trusted networks getting marked as spam

2014-10-24 Thread Axb
On 10/24/2014 05:59 PM, micah anderson wrote: Hi, I've got some machines that are running logcheck, they periodically send mail to us with reports. Sometimes those mails have some spammy stuff in them, because they are mail server logs, or web logs with some spammy stuff in them. I don't want

Re: trusted networks getting marked as spam

2014-10-24 Thread Reindl Harald
Am 24.10.2014 um 17:59 schrieb micah anderson: I've got some machines that are running logcheck, they periodically send mail to us with reports. Sometimes those mails have some spammy stuff in them, because they are mail server logs, or web logs with some spammy stuff in them. I don't want spam

trusted networks getting marked as spam

2014-10-24 Thread micah anderson
Hi, I've got some machines that are running logcheck, they periodically send mail to us with reports. Sometimes those mails have some spammy stuff in them, because they are mail server logs, or web logs with some spammy stuff in them. I don't want spamassassin to deal with these messages, I wan

Re: KAM_BODY_URIBL_PCCC - multi.pccc.com - listing btconnect.com

2014-10-24 Thread Martin Gregorie
On Fri, 2014-10-24 at 14:12 +0100, Paul Stead wrote: > Being UK based we get a lot of email from these connections. > In the past I've received a lot of 'commercial messages', IOW spam by another name, that claimed to be from BT and probably was although it came from apparently unrelated UK-based

Re: KAM_BODY_URIBL_PCCC - multi.pccc.com - listing btconnect.com

2014-10-24 Thread Reindl Harald
Am 24.10.2014 um 15:23 schrieb Paul Stead: Was more curious as to the general thoughts on this, whilst I don't deal directly with the support tickets, I wouldn't wish that situation on anyone. On 24/10/14 14:16, Axb wrote: Considering Zen's size I wouldn't do it unless you want to generate you

Re: KAM_BODY_URIBL_PCCC - multi.pccc.com - listing btconnect.com

2014-10-24 Thread Paul Stead
Was more curious as to the general thoughts on this, whilst I don't deal directly with the support tickets, I wouldn't wish that situation on anyone. On 24/10/14 14:16, Axb wrote: Considering Zen's size I wouldn't do it unless you want to generate yourself a huge amount of support tickets. On

Re: KAM_BODY_URIBL_PCCC - multi.pccc.com - listing btconnect.com

2014-10-24 Thread Reindl Harald
Am 24.10.2014 um 15:12 schrieb Paul Stead: Being UK based we get a lot of email from these connections. I've just done a quick check and we get a lot of (seemingly) legit email from servers with generic BT PTRs - how wide spread is rejecting email based upon generic PTR rules? don't know how

Re: KAM_BODY_URIBL_PCCC - multi.pccc.com - listing btconnect.com

2014-10-24 Thread Kevin A. McGrail
On 10/24/2014 9:12 AM, Paul Stead wrote: Being UK based we get a lot of email from these connections. Agreed. Tell BT to put up something on www.btconnect.com that redirects to let silly Americans know that it's a real company... I've just done a quick check and we get a lot of (seemingly) le

Re: KAM_BODY_URIBL_PCCC - multi.pccc.com - listing btconnect.com

2014-10-24 Thread Axb
On 10/24/2014 03:12 PM, Paul Stead wrote: Being UK based we get a lot of email from these connections. I've just done a quick check and we get a lot of (seemingly) legit email from servers with generic BT PTRs - how wide spread is rejecting email based upon generic PTR rules? Considering Zen's

Re: KAM_BODY_URIBL_PCCC - multi.pccc.com - listing btconnect.com

2014-10-24 Thread Paul Stead
Being UK based we get a lot of email from these connections. I've just done a quick check and we get a lot of (seemingly) legit email from servers with generic BT PTRs - how wide spread is rejecting email based upon generic PTR rules? Paul On 24/10/14 13:52, Reindl Harald wrote: Am 24.10.201

Re: procmail (was Re: Spam messages bypassing SA)

2014-10-24 Thread Kevin A. McGrail
On 10/24/2014 8:43 AM, David F. Skoll wrote: ...I would recommend Email::Filter instead. Definitely will try it out! Thanks.

Re: KAM_BODY_URIBL_PCCC - multi.pccc.com - listing btconnect.com

2014-10-24 Thread Reindl Harald
Am 24.10.2014 um 14:34 schrieb Joe Quinn: On 10/24/2014 7:25 AM, Paul Stead wrote: Not sure if this is a legit listing, however it's causing problems for some of my user base. I've added btconnect.com to my uridnsbl_skip_domain list Nothing legit came up when we were spot-checking the domain

Re: KAM_BODY_URIBL_PCCC - multi.pccc.com - listing btconnect.com

2014-10-24 Thread Joe Quinn
On 10/24/2014 7:25 AM, Paul Stead wrote: Not sure if this is a legit listing, however it's causing problems for some of my user base. I've added btconnect.com to my uridnsbl_skip_domain list Paul -- *Paul Stead* Systems Engineer *Zen Internet* Nothing legit came up when we were spot-checking t

procmail (was Re: Spam messages bypassing SA)

2014-10-24 Thread David F. Skoll
On Thu, 23 Oct 2014 18:00:29 -0400 "Kevin A. McGrail" wrote: > Procmail has some weird syntax Procmail is also unmaintained abandonware, as far as I can tell. If you use SpamAssassin, you probably like Perl, so I would recommend Email::Filter instead. It's far more flexible than procmail and le

Re: KAM_BODY_URIBL_PCCC - multi.pccc.com - listing btconnect.com

2014-10-24 Thread Kevin A. McGrail
On 10/24/2014 7:25 AM, Paul Stead wrote: Not sure if this is a legit listing, however it's causing problems for some of my user base. I've added btconnect.com to my uridnsbl_skip_domain list Paul -- *Paul Stead* Systems Engineer *Zen Internet* Looks like it's compromised accounts on a place ca

KAM_BODY_URIBL_PCCC - multi.pccc.com - listing btconnect.com

2014-10-24 Thread Paul Stead
Not sure if this is a legit listing, however it's causing problems for some of my user base. I've added btconnect.com to my uridnsbl_skip_domain list Paul -- Paul Stead Systems Engineer Zen Internet

RE: SpamCop Not Reporting

2014-10-24 Thread Scott Hollenbeck
> -Original Message- > From: users@spamassassin.apache.org > [mailto:users@spamassassin.apache.org] > Sent: Friday, October 24, 2014 3:03 AM > To: sah62 > Subject: Re: SpamCop Not Reporting > > On 2014-10-23 22:40, sah62 wrote: > > I'm running SpamAssassin version 3.4.0 with Perl version 5