load the pages
Especially the t.co behavior hurts a lot and limits the use of
SHORT_URL_200
Greetings, Wolfgang
tachments.
Greetings, Wolfgang
Hi!
Is there a way with SA4 to process inline images (SRC=data;image/...) as
images (like attachments)? eg. to feed them to ExtractText.
I see that SA tries to call URI canonicalization, but that's it so far?
Greetings, Wolfgang
NS for akadeus(dot)com
I've no idea how to handle entries on util_rb_2tld for NS lookup results
and urinsrhsbl/sub. At least in my case it would have been better to ignore
them;-)
Greetings, Wolfgang
PS: Sorry Henrik that I replied to you directly first. Messed up hitting
the "reply list" button while debugging.
hssub is used as
well? I felt quite comfortable to do so since it was the easiest way to add
support for NS listings with an existing uribl.
Greetings, Wolfgang
earn=unavailable version=4.0.0-r1904221
... and the rest of the email.
It doesn't finish any other rules and doesn't display final results at all.
And then I start it simply again and everything is fine.
Has anybody else seen this odd behavior?
Greetings, Wolfgang
--
Wolfgang Breyha
bg: rules-all: unrun dependencies prevented meta
SPF_PASS_SPAM from running: URIBL_BLACK
Greetings, Wolfgang
On 11/10/2022 15:08, Henrik K wrote:
This is because __RCVD_IN_DNSWL is not supposed to be a meta. KAM channel
overrides it to "disable" the rule. I just posted on the list about that..
Oh, right! Thanks for the pointer. Didn't catch up to this point yet.
Greetings, Wolfgang
-all: unrun dependencies prevented meta
WLCOMPENSATE4 from running: RCVD_IN_DNSWL_HI
This looks like __RCVD_IN_DNSWL gets evaluated, but not hit. But
RCVD_IN_DNSWL_* are "unrun", what looks very odd.
Greetings, Wolfgang
iticism on your work! I followed your call to test a release candidate of
SA4 ... and here we are. Let's get rid of those issues.
Greetings, Wolfgang
f/Parser.pm
patching file lib/Mail/SpamAssassin/Conf.pm
patching file lib/Mail/SpamAssassin/Plugin/Check.pm
patching file t/basic_meta2.t
Greetings, Wolfgang
a rule __META2 ==> got hit (8)
I have
meta __META_NO (__SUBMETAZ || . || _SUBMETAZN )
which is not hit.
And finally
meta RESULT ((! __META_NO) && __META1 > 1 && __META2 > 6)
score RESULT 3
And RESULT is not hit/evaluated.
There is something really odd
On 11/10/2022 06:59, Henrik K wrote:
On Tue, Oct 11, 2022 at 12:50:38AM +0200, Wolfgang Breyha wrote:
And another quite simple ruleset...
meta __SA4TA3_1 6
meta __SA4TA3_2 2
meta __SA4TA3(__SA4TA3_1 > 2) && (__SA4TA3_2 > 1)
doesn't set __SA4TA3. This was working an SA3
ags should not be an issue. But I also see no
reason why a meta rule that does not exclusively depend on "net" sub rules
should inherit this flag? Currently it is propagated if a single sub rule
has the flag. Not a big issue on my side since I do not plan to use SA
without net rules.
Greetings,
Wolfgang Breyha
--
Wolfgang Breyha | https://www.blafasel.at/
Vienna University Computer Center | Austria
On 02/04/2021 13:46, Wolfgang Breyha wrote:
Hi!
It seems that 3.4.5 changed the behavior of URIBL lookups in a quite bad
way compared to 3.4.4.
Just as a pointer:
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7897
Greetings,
Wolfgang
3.4.5 as well.
But if I use a meta rule like:
meta DENYTEST( URIBL_DENY || )
I see the rule triggering on 3.4.4 but not on 3.4.5 anymore.
I tested this on RHEL6 with 3.4.4, RHEL8 3.4.4 and 3.4.5, RHEL7 3.4.5.
Is this a know bug?
Greetings,
Wolfgang
--
Wolfg
X-Spam-Report: ... postmaster for details.\n \n Content previ[...]
my only add_header line is:
add_header all Status "_YESNO_, score=_SCORE_ required=_REQD_
tests=_TESTS_ shortcircuit=_SCTYPE_ autolearn=_AUTOLEARN_ version=_VERSION_"
glue is spamd called from exim
BR
Wolfgang
Am 29.08.2014 1
h SSL support (IO::Socket::SSL 1.38)
with zlib support (Compress::Zlib 2.064)
Thanks in advance
Wolfgang
--
-
Wolfgang Fürtbauer Tel:+43 7612 77620
Steinbichlstrasse 58d Mobil: +43 664 83
In an older episode, on 2014-03-14 23:10, Leveau Stanislas wrote:
I have tested this rule but it does not work, it's starnge
uri __SPAMS_URI_7 /\.webs\.com\//
describe __SPAMS_URI_7 url vers formulaire
score __SPAMS_URI_7 15.0
rules with names starting with __ do _not_ get scored
Try
meta
sin -d -t -D 2>&1 | grep -i bayes | tee /tmp/sa.bayes-debug.out
In this second command you _did_ redirect STDERR to STDOUT via
"2>&1"
My experience has been that I need to redirect STDERR to STDOUT in order
to catch the full output of
spamassassin -D -t
Hope this helps,
wolfgang
In an older episode, on 2013-06-25 19:37, Celene wrote:
Hi,
I am currently getting lots of messages with just a single url in them.
Is there a way for spamassassin to match those?
Are they different URLs/domains?
In an older episode, on 2013-06-14 01:36, Amir 'CG' Caspi wrote:
(I am relatively new to SA's internal workings and don't know how to
make such a rule, however.)
For basics of writing SA rules, maybe look at
http://wiki.apache.org/spamassassin/WritingRules
Hope this helps,
wolfgang
In an older episode, on 2013-06-07 00:17, Rejaine Monteiro wrote:
tala was only an example, thanks for the tip, I will test here
For basics of writing SA rules, maybe look at
http://wiki.apache.org/spamassassin/WritingRules
Hope this helps,
wolfgang
la{5}/ would match
la instead of lalalalala ...
Cheers,
wolfgang
currently, hundreds of mails with said sender domain are being
rejected here due to RBLs.
Regards,
wolfgang
of (@, followed by 5-30 non-@
characters), repeated 3 times?
I wasn't sure about that earlier.
Regards,
wolfgang
domains, not only 5
recipients, just a wild guess from me since i am not good at perl yet
At least 3 domains rather. IMHO, the regexp means:
{3} repetitions of (@ followed by 5 to 30 characters that are _not_ @)
Hope this helps.
Cheers,
wolfgang
he message body.
Hope this helps,
wolfgang
not familiar with amavis, but I know that it calls spamassassin in
a special way, depending on the amavis config. Wild guess: could it be
that RBL/URIBL queries are disabled in your amavis config?
Hope this helps.
Cheers,
wolfgang
istics.
> Regardless, this looks more like an Exim question than a SA question.
All the google search results for "X-Identified-User" that I have viewed
show Exim being involved, I think you should rather post your question
to an Exim related mailing list.
Hope this helps,
wolfgang
On 2012-06-12 20:52, Martin Gregorie wrote:
> so its probably worth treating .gg
> the same way as .cn and .ru, though for slightly different reasons.
Unless you're in .cn, .ru or vicinity or have correspondence partners
there, you may be right.
wolfgang
In an older episode, on 2012-05-26 22:38, Wolfgang Zeikat wrote:
We had so many false positives
Oops, I used your term "false positives" by accident. I and many others
tend no call false Ham classifications
false negatives
(negative scores change the classification towards ham)
g the
machine's hostname to ip.game-point.net because it started happening
just after that.
I doubt that.
Regards,
wolfgang
-- Forwarded Message --
Subject: Re: Suddenly getting lots of false positives.
Date: Thursday, 24. May 2012
From: "corpus.def
ion 3.3.2
Jan 1 19:55:45.157 [6360] dbg: channel: update
directory /usr/pkg/var/spamassassin/3.003002/updates_spamassassin_org)
Hope this helps,
wolfgang
nation
matched in your rule. With many rules scanning many mails using many
alternations, that can make a signficant difference in memory usage /
performance.
Hope this helps.
Regards,
wolfgang
g like
mimeheader LOCAL_BAD_CHARSETSContent-Type =~ /charset=whatever/
score LOCAL_BAD_CHARSETS 1
Replace whatever with the unwanted charset(s) and adjust the score as
wanted.
Hope this helps,
wolfgang
am not mistaken, a score of -100 indicates that a
whitelist_from_rcvd rule has matched - that is a combination of sender
address plus received header, see
man Mail::SpamAssassin::Conf
Maybe try to grep for whitelist_from_rcvd in your configuration direcotries.
Hope this helps,
wolfgang
John Hardin wrote:
On Fri, 19 Mar 2010, Wolfgang Zeikat wrote:
I have written some body rules to catch cyrillic text, using a utf-8
aware editor. They work fine in mails with
Content-Type: text/html; charset=UTF-8
They do not catch the same strings in mails like
Content-Type: text/plain
Hans-Werner Friedemann wrote:
how can I adjust in SA, that eMails with a certain subject
are listed in my blacklist and filtered out?
Have you read
http://wiki.apache.org/spamassassin/WritingRules ?
Hope this helps.
wolfgang
stion here instead of asking "them"
who would probably be the only ones able to answer that?
Regards,
wolfgang
stion here instead of asking "them"
who would probably be the only ones able to answer that?
Regards,
wolfgang
In an older episode (Sunday, 24. January 2010), Evan Platt wrote:
> On 1/23/2010 11:56 AM, wolfgang wrote:
> > I sent an unsubscription request for the address in question to
> > users-ow...@spamassassin.apache.org.
>
> Won't work, AFAIK. You need to reply to the uns
In an older episode (Saturday, 23. January 2010), Benny Pedersen wrote:
> just hoped that maillist-owner is a subscriber aswell and post more
> here to see the problem
I sent an unsubscription request for the address in question to
users-ow...@spamassassin.apache.org.
I hope that's more effective
ot to the
smtp envelope sender - so only the authors notice the bounces.
I guess you wanted to express your desire to have the account(s)
unsubscribed - good idea in my view.
Regards,
wolfgang
Benny Pedersen wrote:
postfix reject_unverified_sender does a vrfy
Nope. It opens an SMTP connection and waits what the receiving MTA
answers to "RCPT TO"
Then it closes the connection.
That is not vrfy.
Hope this helps,
wolfgang
s are unique, their negative AWL score
won't hurt much IMHO - except for increasing the size of the
auto_whitelist.
So, removing them may be a good idea, but I don't think it is necessary
for sa-learn to be effective.
My 0.02 EUR.
Regards,
wolfgang
>
> To prevent manualy lea
nux and Solaris at work).
So, the point is that the facileOCR.pm code in it's current state does
not simply require Perl, SA and ocrad, but *also* Linux. And Henrik
suggests to make that more clear in the documentation.
Best regards,
wolfgang
, 24. May 2009
From: wolfgang
To: uribl-disc...@lists.maddoc.net
I have just noticed that URIBL_BLACK lookups have apparently stopped
working lately on my home computer (dial-up IP, currently 91.5.253.15).
Other SpamAssassin URIBL* rules are working. In SA debug output, I see
dbg: uridnsbl
x with SA 3.2.4 and Perl 5.8.8.
I miss an option to adjust the score, though. My test got a FOCR score
of 17 which is far more than I want.
To my surprise, setting a different FOCR score in a *.cf file
in /etc/mail/spamassassin/ did not change the result.
Regards,
wolfgang
e sense of "email messages"?
Regards,
wolfgang
Michelle Konzack wrote:
Does someone know HOW to reject this crap eectively?
SpamAssassin does not reject mail. But with the clamav plugin and the
3rd party clamav signatures from sanesecurity.com, it detects them
pretty well here.
Hope this helps,
wolfgang
bmitted to
URI(BL) rules, so that those mails can more easily be classified as what
they are: spam - no matter what final recipients might "deserve" or do
with them (or not).
Regards,
wolfgang
In an older episode (Monday, 2. February 2009), Caleb Cushing wrote:
> On Monday 02 February 2009 15:23:34 wolfgang wrote:
> > My idea: try "...cur/*" instead of ".../cur" when calling sa-learn.
> > Thus it should learn each file in that directory IMHO.
>
>
ve no idea why it's not examining any of 2k messages in
> that
> folder (maildir)
My idea: try "...cur/*" instead of ".../cur" when calling sa-learn. Thus
it should learn each file in that directory IMHO.
Hope this helps,
wolfgang
en able to get this to work correctly. I have the
> following:
>
> /\bP\.?O\.?[:#]? [#]?/i
/\bP\.?O\.?[:#]? ?[#]?/i should work:
$ echo 'PO#'|perl -pe 's/\bP\.?O\.?[:#]? ?[#]?/blah/i'
blah
> Thanks in advance.
My pleasure.
wolfgang
Ned Slider wrote:
Wolfgang Zeikat wrote:
Ned Slider wrote:
For those using RHEL5/CentOS5 and wanting to update,
We use Scientific Linux 5 which is a re-compiled RHEL 5
*erm*, actually it's Scientific Linux 4 (RHEL 4), the rest is true tho ;)
- with Dag's
3.56 rpm in
em :)
Could you describe more elaborately how you did that?
Regards,
wolfgang
Wolfgang Zeikat wrote:
We have set -s for spamc to 350k - and we can use spamassassin -t on
messages of that size, but we can not sa-learn them, sa-learn -D -t puts
out:
Sorry, it's late here. What I meant is
sa-learn -D --spam puts out:
[17460] info: archive-iterator: skipping
-learn somehow?
Regards,
wolfgang
when login-solutions was
apparently mostly unreachable for our SA machines.
Do others also see that effect with ctyme.ixhash.net?
Regards,
wolfgang
REJECT (554)
errors, but keep coming back with the same sender-recipient pairs.
Regards,
wolfgang
and/or SA 3.1.8?
If I am not mistaken, full rules will also match the headers of the
bounce that contains the attachment and are therefore no option either,
apparently.
Regards,
wolfgang
w version of MSRBL-Images.hdb found
Tue Apr 29 21:47:12 2008 -> new version of MSRBL-Images.hdb found
Wed Apr 30 10:47:11 2008 -> new version of MSRBL-Images.hdb found
Wed Apr 30 12:47:43 2008 -> new version of MSRBL-Images.hdb found
Regards,
wolfgang
n the next calls.
Now I want to use two different spamfilters for two different users. Is
there any parameter to tell spamassassin to use an other folder to store
the bayes filter?
Best regards
Wolfgang
ader was tagged as spam with a rather high score. Could
it be you sent test mails that got scored very high?
For more info see:
http://wiki.apache.org/spamassassin/AutoWhitelist
Regards,
wolfgang
On 24.10.2007 17:08, Emmanuel Seyman wrote:
How can I fix that?
Install the perl-MLDBM rpm which should be provided by your distribution.
Yep, it is. Thanks!
wolfgang
BM.pm
How can I fix that?
Regards,
wolfgang
spamd error from maillog:
spamd[8110]: Can't locate MLDBM.pm in @INC (@INC contains: ..
/etc/mail/spamassassin lib ../lib
/usr/lib/perl5/vendor_perl/5.8.5/i386-linux-thread-multi
/usr/lib/perl5/vendor_perl/5.8.5
/usr/lib/perl5/5.8.5/i386-lin
e
bot?
Regards,
wolfgang
--
Bad typists of the world, UNTIE!
it.
>
> Or does that only work with mailto: URIs?
There is no /mailto:\S+\.info/ in that mbox file, the only mailto's are
way up in the list headers ...
Regards,
wolfgang
>
> > Correct me if I am wrong, experts.
>
> Shirly you have a rules testbed set up so that
, experts.
Regards,
wolfgang
In an older episode (Friday, 3. August 2007 01:46), Theo Van Dinter
wrote:
> BTW: full rules are horrible. You want mimeheader (and the
> MIMEheader plugin), part of the standard distribution.
Thanks for the info!
wolfgang
In an older episode (Thursday, 2. August 2007 08:22), wolfgang wrote:
> > I would
> > like to know how can I write a spamassassin rule to assign a score
> > to just having a zip attachment.
>
> Try something like
>
> fullLOCAL_ZIP_ATT m/Content-(?:Di
\"?.{1,50}\.)?zip\"?/is
That is one line, no whitespace between "m/" and "/is" (no matter what
out email clients make of it).
Regards,
wolfgang
On 07/24/07 15:00, Wolfgang Zeikat wrote:
> In SA 3.1.8, I am trying to use the clamav plugin from
> http://wiki.apache.org/spamassassin/ClamAVPlugin
>
> spamassassin -t -D output includes dbg: ClamAV: Detected virus:
> Email.Stk.Gen596.Sanesecurity.07071900.pdf
>
> It
9998
header __MY_CLAMAV_SANE X-Spam-Virus =~ /Yes.{1,50}Sanesecurity/i
priority __MY_CLAMAV_SANE 9998
meta MY_CLAMAV_SANE (__CLAMAV && __MY_CLAMAV_SANE)
priority MY_CLAMAV_SANE
score MY_CLAMAV_SANE 5
wolfgang
.{1,50}Sanesecurity/i
priority __MY_CLAMAV_SANE
meta MY_CLAMAV_SANE (__MY_CLAMAV && __MY_CLAMAV_SANE)
score MY_CLAMAV_SANE 5
(typo fixed)
Hope this helps!
Yes, it does! Thanks a lot,
wolfgang
5
Any suggestions what is going wrong?
Regards,
wolfgang
On 07/23/07 11:56, Yousef Raffah wrote:
Hello,
I have spamassassin configured and running fine with postfix,
amavisd-new and clamav. However, I would like to have spamassassin
attach the spam message and report it to my recipient when I receive a
spam message.
AFAIK, with amavisd-new, you n
On 07/18/07 01:21, René Berber wrote:
Wolfgang Zeikat wrote:
In an older episode (Tuesday, 17. July 2007 21:43), René Berber wrote:
Wolfgang Zeikat wrote:
You can add a line to FuzzyOcr.pm :
use POSIX;
That line is already there.
Sorry, I should have said:
use POSIX qw(SIGTERM);
yes
In an older episode (Tuesday, 17. July 2007 21:43), René Berber wrote:
> Wolfgang Zeikat wrote:
> > 2. What can I do to solve that?
>
> You can add a line to FuzzyOcr.pm :
>
> use POSIX;
That line is already there.
>
> or you can update from SVN that module
Thank
.pm line 19
1. Is that anything to worry about that should keep me from installing
that on our productive machines?
2. What can I do to solve that?
Regards,
wolfgang
Hi Dallas,
On 07/17/07 15:17, Dallas Engelken wrote:
Wolfgang Zeikat wrote:
Line 272 is (after the earlier changes):
dbg("pdfinfo: MD5 results for ".($name ? $name : '')." - md5=$md5
fuzzy1=$fuzzy_md5 fuzzy2=$tags_md5");
Line 283 is:
$pms->{pdfin
Hello again,
On 07/12/07 16:22, Dallas Engelken wrote:
Wolfgang Zeikat wrote:
I noticed that some of the latest pdf spam mails do not contain a
filename in the mime headers, could that be a reason for the above
behaviour?
Possibly, but seeing that line 300 is just a dbg() line itself, you
oring some local.cf options. You can try and put them into the
amavisd config file with something like
$sa_report_safe = 1;
I don't have amavisd-new installed, but learned lately that the $sa_*
way works with some options, see the sample / default cf files in the
documentation.
HTH,
wolfgang
ould that be a reason for the above
behaviour?
Can I debug that closer to see what's going wrong?
Cheers,
wolfgang
s for them if the recipient does not exist?
Cheers,
wolfgang
Klaus Heinz wrote:
> Wolfgang Breyha wrote:
>
>> But after restarting spamd I get lots of message complaining about missing
>> body_400.pm up to body_1000.pm and same for body_neg400.pm to
>> body_neg1000.pm.
> ^^^
> Are you sure about this one? I ha
Is 0.10(.8) really a
requirement, or is 0.12.0 ok, too?
Regards, Wolfgang Breyha
--
Wolfgang Breyha <[EMAIL PROTECTED]> | http://www.blafasel.at/
Vienna University Computer Center | Austria
Am Montag, 2. April 2007 17:09 schrieb Scott Lockwood:
> On Mon, 2007-04-02 at 17:01 +0200, Wolfgang Jeltsch wrote:
> > I’m sending my mails via my DSL provider’s SMTP server.
>
> Which puts in the headers that it came from a node in it's network,
> which makes the machine t
Am Montag, 2. April 2007 17:01 schrieb Wolfgang Jeltsch:
> Hello,
>
> what does HELO_DYNAMIC_IPADDR mean? Why is it rated that high?
>
> The reason behind my question is that most of my e-mails seem to get
> HELO_DYNAMIC_IPADDR assigned to them.
Okay, maybe not most of them.
server while I’m sending my mails via my DSL provider’s SMTP server. Since
my provider seems to do sender rewriting, I’d say that the domain of the
address in the From: field shouldn’t be an issue.
Any help would be greatly appreciated.
Best wishes,
Wolfgang
Hello
Sorry, but I don't be able to find an answer, either in the
documentation or in the faq.
In a mail-redirection, all SA tests schould be driven on to the second
Received-Line. Is there any parameter to handle this situation?
Thanks for all help.
Best regards
Wolfgang
in the "To" and the "cc" line.
Best regard
Wolfgang Uhr
ion but to score the age of an url.
< 5 days -> 5 Points
< 10 days -> 3 Points
< 15 Tage -> 1 Point
>> 15 Tage -> 0 Points
May be that this test is interesting for you.
Best regards
Wolfgang
If you want to read the text in German:
Subject: Mehr Spam
Newsgroup: de.admin.net-abuse.mail
MessageID: <[EMAIL PROTECTED]>
On 10/13/06 17:34, Wolfgang Zeikat wrote:
Received =~ /from \S{1,30} \(unknown
\[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\]\)\s+by\s+your\.smtp\.server\.desy/
Replace "your.smtp.server" by your server's name ...
Oops, and leave out "\.desy" of course ;)
And - just to ma
like:
Received =~ /from \S{1,30} \(unknown
\[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\]\)\s+by\s+your\.smtp\.server\.desy/
Replace "your.smtp.server" by your server's name ...
Cheers,
wolfgang
Am Dienstag, 8. August 2006 23:54 schrieb Logan Shaw:
> On Tue, 8 Aug 2006, Wolfgang Jeltsch wrote:
> [...]
> > Second, I often have a message of the following form in my mail log:
> >
> > courierlocal: [...] Cannot open bayes databases
> > /home/wolfgang/.
Am Dienstag, 8. August 2006 23:04 schrieb Bowie Bailey:
> Wolfgang Jeltsch wrote:
> > Hello,
> >
> > I use Courier MTA. Courier MTA replaces certain mailformed mails
> > with mails which contain some explaination and the original mail as
> > an attachment. The a
Am Dienstag, 8. August 2006 22:51 schrieb Michael Scheidell:
> Wolfgang Jeltsch wrote:
> > Hello,
> >
> > I use Courier MTA. Courier MTA replaces certain mailformed mails with
> > mails which contain some explaination and the original mail as an
> > attachment.
his?
Best wishes,
Wolfgang
--- Begin Message ---
CORRUPTED MESSAGE
This is the Courier Mail Server 0.47 on v791.vanager.de.
I received the following message for delivery to your address. This message
contains several internal formatting errors. This is often caused
1 - 100 of 215 matches
Mail list logo
