Re: Botnet and SA 3.2.0

2007-05-07 Thread Patrick Sneyers
Op 4-mei-07, om 17:19 heeft Justin Mason het volgende geschreven: Jason Bertoch [Electronet] writes: Have the Botnet rules been absorbed into SA 3.2.0, or are the new rules compliamentary? Specifically, I'm looking at FH_HOST_EQ_D_D_D_D and FH_HOST_EQ_D_D_D_DB. They're complementary (as f

Problem upgrading from 3.1.8 to 3.1.20, check.pm

2007-05-07 Thread lists
Hi, I've been upgrading several stable servers running 3.1.8 for months without any issues to 3.1.20, and got a problem in one of them. When trying to restart spamd, I get this: @4000463ee4f622539324 [5532] error: check: no loaded plugin implements 'check_main': cannot scan! at /u

RE: Problem upgrading from 3.1.8 to 3.1.20, check.pm

2007-05-07 Thread Michael Scheidell
> -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > Sent: Monday, May 07, 2007 4:47 AM > To: users@spamassassin.apache.org > Subject: Problem upgrading from 3.1.8 to 3.1.20, check.pm > > > Hi, > >I've been upgrading several stable servers running 3.1.8 > for

Re: Problem upgrading from 3.1.8 to 3.2.0, check.pm

2007-05-07 Thread Ruben Cardenal
Michael Scheidell wrote: -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Monday, May 07, 2007 4:47 AM To: users@spamassassin.apache.org Subject: Problem upgrading from 3.1.8 to 3.1.20, check.pm Hi, I've been upgrading several stable servers running 3.1.8

How to use dnswl.org whitelisting with SA 3.2.0 (quick-fix)

2007-05-07 Thread Matthias Leisi
[Disclosure: I'm involved with the dnswl.org project] SA 3.2.0 misses one rule to get the actual dnswl.org lookup rules working (reported in http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5450, targetted for resolution in 3.2.1). In order to use dnswl.org lookups already today, add the fol

Re: Problem upgrading from 3.1.8 to 3.2.0, check.pm

2007-05-07 Thread Michael Scheidell
Ruben Cardenal wrote: Michael Scheidell wrote: -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Monday, May 07, 2007 4:47 AM To: users@spamassassin.apache.org Subject: Problem upgrading from 3.1.8 to 3.1.20, check.pm Hi, I've been upgrading several stabl

Re: Problem upgrading from 3.1.8 to 3.2.0, check.pm

2007-05-07 Thread Ruben Cardenal
Michael Scheidell wrote: Ruben Cardenal wrote: Michael Scheidell wrote: -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Monday, May 07, 2007 4:47 AM To: users@spamassassin.apache.org Subject: Problem upgrading from 3.1.8 to 3.1.20, check.pm Hi, I've be

Re: How to use dnswl.org whitelisting with SA 3.2.0 (quick-fix)

2007-05-07 Thread Jack L. Stone
At 01:46 PM 5.7.2007 +0200, Matthias Leisi wrote: >[Disclosure: I'm involved with the dnswl.org project] > >SA 3.2.0 misses one rule to get the actual dnswl.org lookup rules working >(reported in http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5450, >targetted for resolution in 3.2.1). > >In

Re: How to use dnswl.org whitelisting with SA 3.2.0 (quick-fix)

2007-05-07 Thread Matt Kettler
Jack L. Stone wrote: > At 01:46 PM 5.7.2007 +0200, Matthias Leisi wrote: > >> [Disclosure: I'm involved with the dnswl.org project] >> >> SA 3.2.0 misses one rule to get the actual dnswl.org lookup rules working >> (reported in http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5450, >> targe

Re: Evaluating how good is a rule

2007-05-07 Thread Luis Hernán Otegui
Well, it all depends on how do you run SA (as a content filter, through AMAVIS, via procmail, etc). Via AMAVIS you could use the log parser which MrC wrote, which works like a charm here. It could work as a control, since it tell you which rules hitted harder, which ones didn't, etc. SA cannot cop

Re: Problem upgrading from 3.1.8 to 3.1.20, check.pm

2007-05-07 Thread Michael Parker
[EMAIL PROTECTED] wrote: > Hi, > > I've been upgrading several stable servers running 3.1.8 for months > without any issues to 3.1.20, and got a problem in one of them. When > trying to restart spamd, I get this: > > @4000463ee4f622539324 [5532] error: check: no loaded plugin > implements '

Spamass-Milter Help

2007-05-07 Thread dougp23
I am trying to get all my spam forwarded to one box on my system. Seems easy enough. (Sendmail is my MTA) Anyways, my optional flags in spamass milter look like this: -b [EMAIL PROTECTED] -r 15 So all spam is being sent to [EMAIL PROTECTED] which is working great! The problem becomes when a s

R: Evaluating how good is a rule

2007-05-07 Thread Giampaolo Tomassoni
> -Messaggio originale- > Da: Luis Hernán Otegui [mailto:[EMAIL PROTECTED] > > Well, it all depends on how do you run SA (as a content filter, > through AMAVIS, via procmail, etc). Via AMAVIS you could use the log > parser which MrC wrote, which works like a charm here. It could work > as

Re: How to use dnswl.org whitelisting with SA 3.2.0 (quick-fix)

2007-05-07 Thread Matthias Leisi
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jack L. Stone wrote: > When I run manual test: > [EMAIL PROTECTED]>> host 2.0.0.127.list.dnswl.org > ...I get > 2.0.0.127.list.dnswl.org has address 127.0.10.0 > Not return of 127.0.0.2??? There was a doc error on http://www.dnswl.org/tech tell

Re: R: Evaluating how good is a rule

2007-05-07 Thread Luis Hernán Otegui
Well, you could try asking the amavis list, tough. I think you could actually tell amavis to copy the messages which hit a certain rule to a certain directory, or to look for a specific tag by SA. But this is getting kinda off-toopic, I think... Regards, Luix 2007/5/7, Giampaolo Tomassoni <[EM

3.2.0 on Mac OS X Server

2007-05-07 Thread Jerry Durand
I've been running 3.2.0 on our Mac Server for a few days now and it seems to be working fairly well, I'm surprised (updating Mac Server isn't straight forward). The exceptions are the following two problems: During sa-update: [20781] info: rules: meta test HS_PHARMA_1 has dependency 'H

RE: ANNOUNCE: Apache SpamAssassin 3.2.0 available

2007-05-07 Thread Duane Hill
On Sat, 5 May 2007, Michael Scheidell wrote: [SNIP] There are a LOT of subtle changes... But for the brave, here is a tarball. cd /usr/ports/mail/p5-Mail-SpamAssassin rm -rf Untar this there: http://www.secnap.com/downloads/sa320.tgz Just an FYI followup. I have upgraded without any errors. I

R: R: Evaluating how good is a rule

2007-05-07 Thread Giampaolo Tomassoni
> -Messaggio originale- > Da: Luis Hernán Otegui [mailto:[EMAIL PROTECTED] > > Well, you could try asking the amavis list, tough. I think you could > actually tell amavis to copy the messages which hit a certain rule to > a certain directory, or to look for a specific tag by SA. But this i

AWL Troubles

2007-05-07 Thread Clay Davis
I need a quickie on the AWL. It looks like some spam is getting assigned a negative score because of an AWL rule(?). The messages are text and not too spammy otherwise, but from a layman's perspective, definitely not something that should be on a whitelist. I know how to remove from the white

Re: AWL Troubles

2007-05-07 Thread Craig Carriere
AWL is not a whitelist as I think you are referring to it as.  AWL is a weighting that applies a +/- score to mail  that it sees as spam or ham  from repeated learning of similar mail types.  If AWL is routinely assigning the wrong weight to your mail then I would delete the table in your datab

Re: AWL Troubles

2007-05-07 Thread Clay Davis
Craig, Thanks for the advise. Is there a way to view the contents of the AWL? How do I remove the table? Thanks, Clay >>> On 5/7/2007 at 1:28 PM, in message <[EMAIL PROTECTED]>, Craig Carriere >>> <[EMAIL PROTECTED]> wrote: AWL is not a whitelist as I think you are referring to it as. AWL

RE: AWL Troubles

2007-05-07 Thread Abba Communications - www.abbacomm.net
Thanks for the advise. Is there a way to view the contents of the AWL? How do I remove the table? Thanks, Clay Clay, I dunno about tables, yet I have this in local.cf use_auto_whitelist 0 - rh -- Abba Communications Spokane, WA www.abbacomm.net

Re: AWL Troubles

2007-05-07 Thread John D. Hardin
On Mon, 7 May 2007, Craig Carriere wrote: > AWL is not a whitelist ...rats. We missed a perfect chance (in the 3.2 release) to rename that bloody thing and save no end of FAQs... :) -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ [EMAIL PROTECTED]FALaholic #11174

RE: ANNOUNCE: Apache SpamAssassin 3.2.0 available

2007-05-07 Thread Duane Hill
On Mon, 7 May 2007, Jack L. Stone wrote: At 04:51 PM 5.7.2007 +, you wrote: On Sat, 5 May 2007, Michael Scheidell wrote: [SNIP] There are a LOT of subtle changes... But for the brave, here is a tarball. cd /usr/ports/mail/p5-Mail-SpamAssassin rm -rf Untar this there: http://www.secnap.co

RE: ANNOUNCE: Apache SpamAssassin 3.2.0 available

2007-05-07 Thread Michael Scheidell
> -Original Message- > From: Duane Hill [mailto:[EMAIL PROTECTED] > Sent: Monday, May 07, 2007 12:51 PM > To: users@spamassassin.apache.org > Subject: RE: ANNOUNCE: Apache SpamAssassin 3.2.0 available > > On Sat, 5 May 2007, Michael Scheidell wrote: > > [SNIP] > > There are a LOT of s

Re: KANA damage and locales

2007-05-07 Thread Philip Prindeville
Philip Prindeville wrote: > I'm looking at the headers I just got from a Canadian > ISP's autoresponder I guess the software is called > "KANA". Anyone know who owns this? (Yes, "someone > not very clueful", I know... let's be more specific than > that...) > > >> Date: sam., 05 mai 2007 1

RE: AWL Troubles

2007-05-07 Thread Abba Communications - www.abbacomm.net
> > ...rats. We missed a perfect chance (in the 3.2 release) to rename > that bloody thing and save no end of FAQs... > > :) > > -- > John Hardin Might as well go and do it now, why wait? -- Abba Communications Spokane, WA www.abbacomm.net

RE: AWL Troubles

2007-05-07 Thread Brian Wilson
On Mon, 7 May 2007, Abba Communications - www.abbacomm.net wrote: Thanks for the advise. Is there a way to view the contents of the AWL? How do I remove the table? Go into your source directory Mail-SpamAssassin-3.2.0/tools and look for check_whitelist. This will dump the contents of

Re: Spamass-Milter Help

2007-05-07 Thread Shane Williams
Perhaps you're looking for the -i option, especially in the form of "-i 127.0.0.1"? Or am I not understanding your situation? On Mon, 7 May 2007, dougp23 wrote: I am trying to get all my spam forwarded to one box on my system. Seems easy enough. (Sendmail is my MTA) Anyways, my optional fla

Re: ANNOUNCE: Apache SpamAssassin 3.2.0 available

2007-05-07 Thread Justin Mason
Duane Hill writes: > On Sat, 5 May 2007, Michael Scheidell wrote: > > [SNIP] > > There are a LOT of subtle changes... But for the brave, here is a > > tarball. > > cd /usr/ports/mail/p5-Mail-SpamAssassin > > rm -rf > > > > Untar this there: http://www.secnap.com/downloads/sa320.tgz > > Just an F

DKIM_POLICY_SIGNSOME matches all mail

2007-05-07 Thread Ken A
According to: http://svn.apache.org/repos/asf/spamassassin/tags/spamassassin_release_3_2_0/Changes - separate a signature verification from fetching a policy, which makes it possible to avoid one DNS lookups (by not fetching a policy) for each unverified message by setting score to 0 for al

Re: ANNOUNCE: Apache SpamAssassin 3.2.0 available

2007-05-07 Thread Duane Hill
On Mon, 7 May 2007, Justin Mason wrote: Duane Hill writes: On Sat, 5 May 2007, Michael Scheidell wrote: [SNIP] There are a LOT of subtle changes... But for the brave, here is a tarball. cd /usr/ports/mail/p5-Mail-SpamAssassin rm -rf Untar this there: http://www.secnap.com/downloads/sa320.tg

[Possible SPAM] Malformed UTF-8 character (unexpected non-continuation byte 0x00

2007-05-07 Thread Chris
The entire error line reads: Malformed UTF-8 character (unexpected non-continuation byte 0x00, immediately after start byte 0xce) in pattern match (m//) at /var/lib/spamassassin/3.002000/72_sare_bml_post25x_cf_sare_sa-update_dostech_net/20050602.cf, rule SARE_OBFUMONEY1, line 1. I saw t

Re: [Possible SPAM] Malformed UTF-8 character (unexpectednon-continuation byte 0x00

2007-05-07 Thread Loren Wilton
rule SARE_OBFUMONEY1, line 1. I saw the same thing earlier this weekend but passed it off to possibly something I didn't have configured right. No. Its a combination of a perl bug and a change in SA to allow rules in other than the ascii character set. Previous versions of SA had 'use bytes

[Possible SPAM] Re: [Possible SPAM] Malformed UTF-8 character (unexpectednon-continuation byte 0x00

2007-05-07 Thread Chris
On Monday 07 May 2007 8:51 pm, Loren Wilton wrote: > > rule SARE_OBFUMONEY1, line 1. > > > > I saw the same thing earlier this weekend but passed it off to possibly > > something I didn't have configured right. > > No. Its a combination of a perl bug and a change in SA to allow rules in > other th

Re: [Possible SPAM] Re: [Possible SPAM] Malformed UTF-8 character (unexpectednon-continuation byte 0x00

2007-05-07 Thread Daryl C. W. O'Shea
Chris wrote: Thanks Loren, I doubt then that this accounts for the strange sa-update run I had this morning which I've posted the cron output here: http://mediasafe.embarq.com/chris1948/Hosted/saupdate0507.tar.bz2 I don't see anything strange at all in that output. Yesterdays update was a

RE: ANNOUNCE: Apache SpamAssassin 3.2.0 available

2007-05-07 Thread Jack L. Stone
At 06:45 PM 5.7.2007 +, Duane Hill wrote: >On Mon, 7 May 2007, Jack L. Stone wrote: > >> At 04:51 PM 5.7.2007 +, you wrote: >>> On Sat, 5 May 2007, Michael Scheidell wrote: >>> >>> [SNIP] There are a LOT of subtle changes... But for the brave, here is a tarball. cd /usr/ports

per-user rules from mysql

2007-05-07 Thread Duane Hill
I'm trying to get SA to read user rules from MySQL. I've exhausted all testing and have not found a way. I have spamd starting with the following parameters: --username=spamd --groupname=spamd --min-children=2 --max-children=8 --min-spare=4 --max-spare=6 --max-conn-per-child=120 --timeout