Re: Email with attachment caused 100% CPU usage.

2016-06-09 Thread Bill Cole
On 9 Jun 2016, at 0:53, Henrik K wrote: Garbage text/plain is known problem.. text/html too. From GMail. Last week I had a *perfectly legitimate* message with a 151KB logical single line of HTML (QP encoded of course) freeze up a server scaled for 10k users. It did it slowly over a day, bec

What "Snowshoe spam" is (was Re: RCVD_IN_SBL_CSS and "deep headers")

2016-06-09 Thread Bill Cole
On 8 Jun 2016, at 9:10, RW wrote: On Wed, 8 Jun 2016 13:48:13 +0200 Reindl Harald wrote: [...] but that don't mean when my machine is hacked, sending snowshoe spam and it *has* a dynamic IP that it don't get listed at css.spamhaus.org for that reason one hour later you or anybody else could

Re: SA bayes file db permission issue

2016-06-09 Thread Martin Gregorie
On Thu, 2016-06-09 at 15:01 -0700, John Hardin wrote: > On Thu, 9 Jun 2016, Martin Gregorie wrote: > > > On Thu, 2016-06-09 at 16:54 -0400, Yu Qian wrote: > >> Ok, I found out. so the db files generated on Mac can not be used > on > >> Linux. vice versa. > > > > Newline symbols differ: '/n' is 0x0

Re: SA bayes file db permission issue

2016-06-09 Thread John Hardin
On Thu, 9 Jun 2016, Martin Gregorie wrote: On Thu, 2016-06-09 at 16:54 -0400, Yu Qian wrote: Ok, I found out. so the db files generated on Mac can not be used on Linux. vice versa. Newline symbols differ: '/n' is 0x0a (LF) for Linux, 0x0d (CR) for Macs.  WTF? I thought Mac's OS was based on

Re: SA bayes file db permission issue

2016-06-09 Thread Larry Rosenman
On 2016-06-09 16:25, Martin Gregorie wrote: On Thu, 2016-06-09 at 16:54 -0400, Yu Qian wrote: Ok, I found out. so the db files generated on Mac can not be used on Linux. vice versa. Newline symbols differ: '/n' is 0x0a (LF) for Linux, 0x0d (CR) for Macs.  The bad news is that this screws up m

Re: spamassassin --lint errors like Subroutine File::Spec::Unix::canon path

2016-06-09 Thread kud...@netzero.com
I was just trying to see if pyzor was working. I saw that there were 2 Pyzor installs in /usr/bin and /usr/local/bin so I even just tried to move /user/local/bin/pyzor* into /usr/bin no difference same warnings so perhaps the warnings aren't related. Please note: message attached From: Tom Hend

Re: SA bayes file db permission issue

2016-06-09 Thread Martin Gregorie
On Thu, 2016-06-09 at 16:54 -0400, Yu Qian wrote: > Ok, I found out. so the db files generated on Mac can not be used on > Linux. vice versa. > Newline symbols differ: '/n' is 0x0a (LF) for Linux, 0x0d (CR) for Macs.  The bad news is that this screws up many programs. The good news is that its ea

Re: SA bayes file db permission issue

2016-06-09 Thread Yu Qian
Good point, David, I will try as you suggested, that makes more sense. --- Yu Qian Ottawa Ontario Phone: (514)-553-0198 On Thu, Jun 9, 2016 at 5:01 PM, David B Funk wrote: > On Thu, 9 Jun 2016, Yu Qian wrote: > > Yes, I am sure the path is correct, also, if the path is not correct, it >> will

Re: SA bayes file db permission issue

2016-06-09 Thread David B Funk
On Thu, 9 Jun 2016, Yu Qian wrote: Yes, I am sure the path is correct, also, if the path is not correct, it will show 'db not present'. I tried to write a small perl script to open the db file, it failed too. so I think it maybe the file damaged during the mounting. but I don't know why this c

Re: SA bayes file db permission issue

2016-06-09 Thread Yu Qian
Ok, I found out. so the db files generated on Mac can not be used on Linux. vice versa. I think this is related to the way how perl DBM module processing the db files on different system. I am totally new to perl. But it's good to know that. thanks all. --- Yu Qian Ottawa Ontario Phone: (514)-55

Re: SA bayes file db permission issue

2016-06-09 Thread Alan Hodgson
On Thursday 09 June 2016 16:26:26 Yu Qian wrote: > Yes, I am sure the path is correct, also, if the path is not correct, it > will show 'db not present'. > > I tried to write a small perl script to open the db file, it failed too. so > I think it maybe the file damaged during the mounting. but I d

Re: spamassassin --lint errors like Subroutine File::Spec::Unix::canonpath

2016-06-09 Thread Tom Hendrikx
On 09-06-16 22:04, kud...@netzero.com wrote: > I installed Pyzor from source now getting the below. Fedora 22 with sendmail > and procmail, SA 3.4.1 > > spamassassin --lint > Subroutine File::Spec::Unix::canonpath redefined at > /usr/share/perl5/XSLoader.pm line 92. > Subroutine File::Spec::Unix

Re: SA bayes file db permission issue

2016-06-09 Thread Yu Qian
Yes, I am sure the path is correct, also, if the path is not correct, it will show 'db not present'. I tried to write a small perl script to open the db file, it failed too. so I think it maybe the file damaged during the mounting. but I don't know why this can happen --- Yu Qian Ottawa Ontario P

Re: SA bayes file db permission issue

2016-06-09 Thread John Hardin
On Thu, 9 Jun 2016, Yu Qian wrote: My spam assassin works pretty well if I run it on a single machine, either mac or linux. that means I update my rules and train my bayes model on the same machine. But when I tried to train the model and generate bayes file db on mac, and I mounted them to a

Re: SA bayes file db permission issue

2016-06-09 Thread Yu Qian
Ok, I think it is just because the db file can not be open by perl DBM module, but I am confused why it can't be open --- Yu Qian Ottawa Ontario Phone: (514)-553-0198 On Thu, Jun 9, 2016 at 4:11 PM, Yu Qian wrote: > My spam assassin works pretty well if I run it on a single machine, either >

SA bayes file db permission issue

2016-06-09 Thread Yu Qian
My spam assassin works pretty well if I run it on a single machine, either mac or linux. that means I update my rules and train my bayes model on the same machine. But when I tried to train the model and generate bayes file db on mac, and I mounted them to a docker container, then sa-learn failed

spamassassin --lint errors like Subroutine File::Spec::Unix::canonpath

2016-06-09 Thread kud...@netzero.com
I installed Pyzor from source now getting the below. Fedora 22 with sendmail and procmail, SA 3.4.1 spamassassin --lint Subroutine File::Spec::Unix::canonpath redefined at /usr/share/perl5/XSLoader.pm line 92. Subroutine File::Spec::Unix::catdir redefined at /usr/share/perl5/XSLoader.pm line 92

Re: Advice: why one relay evaluated and not the other

2016-06-09 Thread jimimaseye
On 09/06/2016 16:57, Sidney Markowitz [via SpamAssassin] wrote: > As to why you should have to list all the internal ip addresses again > in the > list of trusted ones ... Because the people who designed this had to > keep all > this in their head at one time and they did by thinking "This is the

Re: SPF should always hit?

2016-06-09 Thread Robert Fitzpatrick
Joe Quinn wrote: On 6/9/2016 11:23 AM, Robert Fitzpatrick wrote: Excuse me if this is too lame a question, but I have the SPF plugin enabled and it hits a lot. Should SPF_ something hit on every message if the domain has an SPF record in DNS? Furthermore, a message found as Google phishing did

Re: SPF should always hit?

2016-06-09 Thread Joe Quinn
On 6/9/2016 11:23 AM, Robert Fitzpatrick wrote: Excuse me if this is too lame a question, but I have the SPF plugin enabled and it hits a lot. Should SPF_ something hit on every message if the domain has an SPF record in DNS? Furthermore, a message found as Google phishing did not get a hit on

Re: Advice: why one relay evaluated and not the other

2016-06-09 Thread RW
On Thu, 9 Jun 2016 06:50:55 -0700 (MST) jimimaseye wrote: > (Note: For clarity, the > https://spamassassin.apache.org/full/3.4.x/doc/Mail_SpamAssassin_Conf.html > link you provided IS the page I refer to when I say "reading the > wiki".) > > Ok, reading it again: it says > / > //"trusted_netwo

Re: SPF should always hit?

2016-06-09 Thread Reindl Harald
Am 09.06.2016 um 17:23 schrieb Robert Fitzpatrick: Excuse me if this is too lame a question, but I have the SPF plugin enabled and it hits a lot. Should SPF_ something hit on every message if the domain has an SPF record in DNS? and if it's SPF_NONE Furthermore, a message found as Google ph

SPF should always hit?

2016-06-09 Thread Robert Fitzpatrick
Excuse me if this is too lame a question, but I have the SPF plugin enabled and it hits a lot. Should SPF_ something hit on every message if the domain has an SPF record in DNS? Furthermore, a message found as Google phishing did not get a hit on a email address where the domain has SPF setup.

Re: Advice: why one relay evaluated and not the other

2016-06-09 Thread Sidney Markowitz
jimimaseye wrote on 10/06/16 1:50 AM: > CONCLUSION: it was working as the book says (even though the book is not > clear WHY the book says what it says). It's been a very long while since I worked with this code and I have to kind of twist my mind up funny to keep it in my head all at once, but t

Re: SA 3.4.1 on FC22/sendmail with a .procmailrc not triiggering spamc

2016-06-09 Thread Kris Deugau
kud...@netzero.com wrote: > OK sounds great. I also wanted to mention that the test email does not get > marked. Is the rule here below not correct in the users' .procmailrc file? > > .:0fw: > | /usr/bin/spamc > :0: > * ^X-Spam-Status: Yes > mail/Caughtspam That looks correct. Check the log to

Re: ClamAV plugin and SpamAssassin (UPDATE)

2016-06-09 Thread Reindl Harald
Am 09.06.2016 um 15:10 schrieb Bill Cole: stream(127.0.0.1@1858): OK. That should have been your strongest clue: "stream(127.0.0.1@1858)" is clearly describing a connection via TCP on localhost, not a socket node in the filesystem i doubt that anything is "clearly" in that context - look in

Re: Advice: why one relay evaluated and not the other

2016-06-09 Thread jimimaseye
(Note: For clarity, the https://spamassassin.apache.org/full/3.4.x/doc/Mail_SpamAssassin_Conf.html link you provided IS the page I refer to when I say "reading the wiki".) Ok, reading it again: it says / //"trusted_networks IPaddress[/masklen] ... (default: none)// // //What networks or hos

Re: Where to find DETAIL for spamassassin default RULES

2016-06-09 Thread Bowie Bailey
On 6/9/2016 7:55 AM, jimimaseye wrote: Once upon a time the include rules for spamassassin was published in its wiki (example here: http://spamassassin.apache.org/tests_3_3_x.html) which in turn gave a link to an 'explanation' detail of the individual rules. However, as you know, these wiki ages

Re: ClamAV plugin and SpamAssassin (UPDATE)

2016-06-09 Thread Bill Cole
On 8 Jun 2016, at 9:42, Carlo Manuali wrote: It works with no changes by using TCP socket (on localhost). —Carlo On 8 Jun 2016, at 6:02, Carlo Manuali wrote: In particular I’ve adopted the local mode, that uses a local socket (file) in order to establish the communication between them. [..

Re: Advice: why one relay evaluated and not the other

2016-06-09 Thread RW
On Thu, 9 Jun 2016 02:54:34 -0700 (MST) jimimaseye wrote: > FEEDBACK for all who have contributed: > > I have a result. > > It seems that the 'internal_networks' is only adhered to *in the > absence* of a 'trusted_networks' entry. If I remove the > 'trusted_networks', and simply leave: > > i

Re: Where to find DETAIL for spamassassin default RULES

2016-06-09 Thread Joe Quinn
On 6/9/2016 7:55 AM, jimimaseye wrote: Once upon a time the include rules for spamassassin was published in its wiki (example here: http://spamassassin.apache.org/tests_3_3_x.html) which in turn gave a link to an 'explanation' detail of the individual rules. However, as you know, these wiki ages

Where to find DETAIL for spamassassin default RULES

2016-06-09 Thread jimimaseye
Once upon a time the include rules for spamassassin was published in its wiki (example here: http://spamassassin.apache.org/tests_3_3_x.html) which in turn gave a link to an 'explanation' detail of the individual rules. However, as you know, these wiki ages are no longer updated due to "rules bein

Re: Advice: why one relay evaluated and not the other

2016-06-09 Thread jimimaseye
FEEDBACK for all who have contributed: I have a result. It seems that the 'internal_networks' is only adhered to *in the absence* of a 'trusted_networks' entry. If I remove the 'trusted_networks', and simply leave: internal_networks 195.26.90. then it is correctly applied: X-Spam-Report: