On Fri, 15 Dec 2017 13:52:32 -0500
Alex wrote:
> Hi,
>
> I have a bunch of rules that rely on the results of pyzor, razor or
> DCC. The problem is that they also match on an empty or nearly empty
> body.
You can use
pyzor local_whitelist < email.txt
at very least it&#x
Alex skrev den 2017-12-15 19:52:
Other ideas?
whitelist ?, dcc have whitelist, pyzor have whitelist if you run own
pyzord, razor have whitelist
how ?, all the 3 seen before content checkers should know your
internal_networks ips just like spamassin does
its not relevant imho on empty ema
Hi,
I have a bunch of rules that rely on the results of pyzor, razor or
DCC. The problem is that they also match on an empty or nearly empty
body.
I believe we may have discussed something similar in the past, but is
there a way to avoid these digest rules from hitting on empty emails
or emails
On 12/09/17 12:33, RW wrote:
On Tue, 12 Sep 2017 08:41:01 +0100
Sebastian Arcus wrote:
The confusing part is that left to its devices, Pyzor creates
a .pyzor dir in the home dir of the user it is run as. But if
--homedir is specified, it dumps stuff directly there, instead of
creating a .pyzo
On 2017-09-12 12:33, RW wrote:
> It is a bit confusing, but it's not that the .pyzor directory is use
> inconsistently, it's that pyzor defines
>
> --homedir=HOMEDIR configuration directory
The confusing part is the spelling of the option. The mistake is clear
from the last line quoted a
On Tue, 12 Sep 2017 08:41:01 +0100
Sebastian Arcus wrote:
> The confusing part is that left to its devices, Pyzor creates
> a .pyzor dir in the home dir of the user it is run as. But if
> --homedir is specified, it dumps stuff directly there, instead of
> creating a .pyzor dir.In the end I got ri
On 12/09/17 00:56, RW wrote:
On Tue, 12 Sep 2017 00:37:40 +0100
Sebastian Arcus wrote:
On 11/09/17 20:20, RW wrote:
This is why pyzor has the local_whitelist command. At very least
it's a good idea to pipe an empty string through
"pyzor local_whitelist" (probably as the user running
spamass
On Tue, 12 Sep 2017 00:37:40 +0100
Sebastian Arcus wrote:
> On 11/09/17 20:20, RW wrote:
> > This is why pyzor has the local_whitelist command. At very least
> > it's a good idea to pipe an empty string through
> > "pyzor local_whitelist" (probably as the user running
> > spamassassin).
>
> I
On 11/09/17 20:20, RW wrote:
On Mon, 11 Sep 2017 17:39:16 +0100
Sebastian Arcus wrote:
Is there any way to tell SA to skip pyzor checks on emails with an
empty body (even if there are attachments). I've noticed for a while
now that emails which don't contain any text in their bodi
On Mon, 11 Sep 2017 17:39:16 +0100
Sebastian Arcus wrote:
> Is there any way to tell SA to skip pyzor checks on emails with an
> empty body (even if there are attachments). I've noticed for a while
> now that emails which don't contain any text in their bodies seem to
>
On 09/11/2017 11:39 AM, Sebastian Arcus wrote:
Is there any way to tell SA to skip pyzor checks on emails with an empty
body (even if there are attachments). I've noticed for a while now that
emails which don't contain any text in their bodies seem to
automatically trigger PYZOR_C
Is there any way to tell SA to skip pyzor checks on emails with an empty
body (even if there are attachments). I've noticed for a while now that
emails which don't contain any text in their bodies seem to
automatically trigger PYZOR_CHECK (even if they have an attachment) -
althoug
On Tue, 20 Jun 2017 13:07:24 -0400
Alex wrote:
> https://pastebin.com/inS6qiiG
> ...
> Can someone also explain what NML_ADSP_CUSTOM_MED is? It appears to
> involve DKIM. This message appears to have been signed by gmail
> successfully.
The linked email didn't actually have NML_ADSP_CUSTOM_MED.
On 6/22/2017 7:38 PM, RW wrote:
Maybe Kevin or someone with knowledge of this could comment, as it
effectively eliminates the effectiveness of the __EMPTY_BODY and
__HAS_ANY_URI.
I have followed the thread a bit and agree it's likely a bug. Could you
please open something in bugzilla?
Regards
On Fri, 23 Jun 2017, RW wrote:
On Thu, 22 Jun 2017 18:59:55 -0400
Alex wrote:
Maybe Kevin or someone with knowledge of this could comment, as it
effectively eliminates the effectiveness of the __EMPTY_BODY and
__HAS_ANY_URI.
It looks like there might need to be a separate URI store for that
On Thu, 22 Jun 2017 18:59:55 -0400
Alex wrote:
> >> Maybe Kevin or someone with knowledge of this could comment, as it
> >> effectively eliminates the effectiveness of the __EMPTY_BODY and
> >> __HAS_ANY_URI.
> >
> > It looks like there might need to be a separate URI store for that,
> > which
Hi Kevin,
On Wed, Jun 21, 2017 at 8:31 PM, John Hardin wrote:
> On Wed, 21 Jun 2017, Alex wrote:
>> On Wed, Jun 21, 2017 at 8:06 PM, Reindl Harald
>> wrote:
>>> Am 22.06.2017 um 01:55 schrieb Alex:
Can someone else confirm this? John was unable to reproduce it on his
system,
On Wed, 21 Jun 2017, Alex wrote:
Hi,
On Wed, Jun 21, 2017 at 8:06 PM, Reindl Harald wrote:
Am 22.06.2017 um 01:55 schrieb Alex:
Can someone else confirm this? John was unable to reproduce it on his
system, but I just installed the latest svn 3.4.2 branch and it's
doing it here. I'd apprec
Hi,
On Wed, Jun 21, 2017 at 8:06 PM, Reindl Harald wrote:
>
>
> Am 22.06.2017 um 01:55 schrieb Alex:
>>
>> Can someone else confirm this? John was unable to reproduce it on his
>> system, but I just installed the latest svn 3.4.2 branch and it's
>> doing it here. I'd appreciate if someone could h
Hi,
This one wasn't blocked at the time it was received, but somehow is now.
https://pastebin.com/inS6qiiG
I noticed despite there being no actual URI that I can see in the
body, it still hits __BODY_URI_ONLY. Even if I remove the div tags it
still hits. Just wha
On Tue, 20 Jun 2017, Alex wrote:
Hi,
On Tue, Jun 20, 2017 at 1:40 PM, John Hardin wrote:
On Tue, 20 Jun 2017, Alex wrote:
Hi,
We've been receiving empty messages (or what appear to be empty body
messages) delivered to undisclosed-recips and I wanted to figure out
how to block them.
Hi,
On Tue, Jun 20, 2017 at 1:40 PM, John Hardin wrote:
> On Tue, 20 Jun 2017, Alex wrote:
>
>> Hi,
>>
>> We've been receiving empty messages (or what appear to be empty body
>> messages) delivered to undisclosed-recips and I wanted to figure out
>>
On Tue, 20 Jun 2017, Alex wrote:
Hi,
We've been receiving empty messages (or what appear to be empty body
messages) delivered to undisclosed-recips and I wanted to figure out
how to block them.
This one wasn't blocked at the time it was received, but somehow is now.
https://pa
Hi,
We've been receiving empty messages (or what appear to be empty body
messages) delivered to undisclosed-recips and I wanted to figure out
how to block them.
This one wasn't blocked at the time it was received, but somehow is now.
https://pastebin.com/inS6qiiG
I noticed despite t
On Thu, 2 Aug 2007 12:24:37 -0700 (PDT)
User for SpamAssassin Mail List <[EMAIL PROTECTED]> wrote:
>
> Hello,
>
> We are running a Debian Sarge system here with spamassassin version
> Version: 3.0.3-2sarge1.
My word, get yourself 3.1.7 from Sarge backports and run sa-update
before you do anythi
On Thu, 2 Aug 2007 12:24:37 -0700 (PDT)
User for SpamAssassin Mail List <[EMAIL PROTECTED]> wrote:
>
> Hello,
>
> We are running a Debian Sarge system here with spamassassin
> version Version: 3.0.3-2sarge1.
>
> I tried to put these plugins (ImageInfo and loadplugin) into my
> system and got th
Thanks,
>
> Ken
>
>
>
>
> On Thu, 2 Aug 2007, Jeroen Tebbens wrote:
>
> > Hi,
> >
> > Get the plugin PDFinfo
> >
> > http://www.rulesemporium.com/plugins/
> >
> > And it will give you more control about PDF spam. It has a rule for em
ail::SpamAssassin::Plugin::PDFInfo" at (eval 29) line 1.
---
What am I missing here to make this work?
Thanks,
Ken
On Thu, 2 Aug 2007, Jeroen Tebbens wrote:
> Hi,
>
> Get the plugin PDFinfo
>
> http://www.rulesemporium.com/plugins/
&g
On Thu, Aug 02, 2007 at 04:15:21AM -0400, Michael W Cocke wrote:
> These blasted PDF spams are driving me mad! Any ideas for a rule that
> would trip if there's no text in the body, just a PDF attachment ?
run sa-update. There's been a rule in the channel for a while now.
--
Randomly Selected
Jeremy Fairbrass escribió:
If you're using the PDFinfo plugin, you should see a rule called GMD_PDF_EMPTY_BODY on those spams - it should fire on any message
containing a PDF and a blank body. Obviously you can modify that rule's score if you want to make it higher, or meta it with other
rules.
Answer to my own question...
#PDFInfo - tags pdf based spam
#
loadplugin Mail::SpamAssassin::Plugin::PDFInfo
/usr/local/saplugins/PDFInfo.pm
:-)
on 8/2/07 6:30 AM, MIKE YRABEDRA at [EMAIL PROTECTED] wrote:
> on 8/2/07 5:55 AM, Justin Mason at [EMAIL PROTECTED] wrote:
>
>>> In my Debian et
on 8/2/07 5:55 AM, Justin Mason at [EMAIL PROTECTED] wrote:
>> In my Debian etch installation it's
>> /usr/share/perl5/Mail/SpamAssassin/Plugin/
>
> actually, it's better not to use that location. That's where
> SpamAssassin installs its distribution-packaged modules, and it
> may delete the con
Probably a stupid question, but where do I put the PDFInfo.pm file?
I put it is /etc/mail/plugins/...
But that does not work.
I will continue googling in the meantime
on 8/2/07 5:09 AM, Michael W Cocke at [EMAIL PROTECTED] wrote:
> Thanks, both of you. Looks like an update to pdfinfo snuc
Sebastian Ries writes:
> Hi
>
> > Excume my lack of knowlegde but where is the plugin directory for SA?
> >
> > I tried putting it in /usr/local/etc/mail/spamassassin/
> > then in /etc/mail and then in /usr/local/share/spamassassin
> >
> > When I restart spamd, it does not like when I put the pat
Hi
> Excume my lack of knowlegde but where is the plugin directory for SA?
>
> I tried putting it in /usr/local/etc/mail/spamassassin/
> then in /etc/mail and then in /usr/local/share/spamassassin
>
> When I restart spamd, it does not like when I put the path to
> /usr/local/share/spamassassin in
PROTECTED]> wrote:
>> Hi,
>>
>> Get the plugin PDFinfo
>>
>> http://www.rulesemporium.com/plugins/
>>
>> And it will give you more control about PDF spam. It has a rule for
> empty
>> body emails with PDF attachment (GMD_PDF_EMPTY_BODY) and give it a sco
Hello,
On Thu, 2 Aug 2007 10:37:27 +0200 (CEST), Jeroen Tebbens
<[EMAIL PROTECTED]> wrote:
> Hi,
>
> Get the plugin PDFinfo
>
> http://www.rulesemporium.com/plugins/
>
> And it will give you more control about PDF spam. It has a rule for empty
> b
Thanks, both of you. Looks like an update to pdfinfo snuck out while
I wasn't looking. I've made the adjustments.
Mike-
On Thu, 2 Aug 2007 10:39:20 +0200, you wrote:
>"Michael W Cocke" <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED]
>> These blasted PDF spams are driving me mad!
"Michael W Cocke" <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED]
> These blasted PDF spams are driving me mad! Any ideas for a rule that
> would trip if there's no text in the body, just a PDF attachment ?
>
> (I'm using the PDFinfo plugin now, but I don't really understand it)
>
> Th
Hi,
Get the plugin PDFinfo
http://www.rulesemporium.com/plugins/
And it will give you more control about PDF spam. It has a rule for empty
body emails with PDF attachment (GMD_PDF_EMPTY_BODY) and give it a score
to your liking.
/Jeroen
On Thu, 2 Aug 2007, Michael W Cocke wrote:
These
These blasted PDF spams are driving me mad! Any ideas for a rule that
would trip if there's no text in the body, just a PDF attachment ?
(I'm using the PDFinfo plugin now, but I don't really understand it)
Thanks!
Mike-
--
If you're not confused, you're not trying hard enough.
--
Please note -
Daryl C. W. O'Shea a écrit :
On 09/12/2005 5:17 PM, mouss wrote:
should I consider their "pop" server as an MX (I query it via
fetchmail) or is SA aware of fetchmail?
It's between their MX and you, so include it (along with their actual
MX, and any other hosts in between).
thanks a lo
a EMPTY_MESSAGE !__MIME_ATTACHMENT && !__NONEMPTY_BODY
>> describe EMPTY_MESSAGE Message appears to be empty with no Subject: text
>> score EMPTY_MESSAGE 2
>>
>> Any hint's?
>>
>> Ingo
>>
>> - Original Message - From: &quo
t Kettler" <[EMAIL PROTECTED]>
To: "Ingo Reinhart" <[EMAIL PROTECTED]>;
Sent: Thursday, January 13, 2005 6:30 PM
Subject: Re: empty body
At 06:27 AM 1/13/2005, Ingo Reinhart wrote:
Hello!
How can I test for an empty Mailbody?
Any existing rule?
Best Regards,
Ingo
G
2
Any hint's?
Ingo
- Original Message -
From: "Matt Kettler" <[EMAIL PROTECTED]>
To: "Ingo Reinhart" <[EMAIL PROTECTED]>;
Sent: Thursday, January 13, 2005 6:30 PM
Subject: Re: empty body
At 06:27 AM 1/13/2005, Ingo Reinhart wrote:
Hello!
How can I t
TECTED]>
To: "Ingo Reinhart" <[EMAIL PROTECTED]>;
Sent: Thursday, January 13, 2005 6:30 PM
Subject: Re: empty body
At 06:27 AM 1/13/2005, Ingo Reinhart wrote:
Hello!
How can I test for an empty Mailbody?
Any existing rule?
Best Regards,
Ingo
Grab the latest SVN imag
> >How can I test for an empty Mailbody?
>
> Grab the latest SVN image from the downloads page and look at
EMPTY_MESSAGE.
Or grab some of the SARE rules, which also have a test for this.
Loren
At 06:27 AM 1/13/2005, Ingo Reinhart wrote:
Hello!
How can I test for an empty Mailbody?
Any existing rule?
Best Regards,
Ingo
Grab the latest SVN image from the downloads page and look at EMPTY_MESSAGE.
From: "Ingo Reinhart" <[EMAIL PROTECTED]>
Subject: empty body
Date: Thu, 13 Jan 2005 12:27:05 +0100
> Hello!
>
> How can I test for an empty Mailbody?
>
> Any existing rule?
I don't know caching rule for 'empty mailbody spam'.
But, you can use R
Hello!
How can I test for an empty Mailbody?
Any existing rule?
Best Regards,
Ingo
50 matches
Mail list logo
