On Monday 02 January 2006 23:16, jdow wrote:
>From: "Gene Heskett" <[EMAIL PROTECTED]>
>
>> On Monday 02 January 2006 00:50, Chris Purves wrote:
>>>On Sunday 01 January 2006 12:24, Gene Heskett wrote:
>>>> On Saturday 31 December 2005 20:21, Chris Purves wrote:
>>>> >On Sun, January 1, 2006 3:28 am, Gene Heskett said:
>>>> >> On Saturday 31 December 2005 13:38, Rick Macdougall wrote:
>>>> >>>Gene Heskett wrote:
>>>> >>>> On Saturday 31 December 2005 12:42, Gene Heskett wrote:
>>>> >>>>> This morning I'm going thru my JunqueMail folder and find
>>>> >>>>> that about a dozen msgs to the OpenOffice list, 5 or 6 to
>>>> >>>>> the fedeora list, and one to the gimp-print-devel list were
>>>> >>>>> flaged and sorted as *****SPAN*****. With one exception,
>>>> >>>>> all were in english.
>>>> >>>
>>>> >>>Would help if you let us know what rules got hit.
>>>> >>
>>>> >> Content analysis details: (5.7 points, 5.0 required)
>>>> >>
>>>> >> pts rule name description
>>>> >> ---- ----------------------
>>>> >> --------------------------------------------------
>>>> >> 3.8 HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious
>>>> >> hostname (IP addr
>>>> >> 2)
>>>> >> 1.8 FORGED_YAHOO_RCVD 'From' yahoo.com does not match
>>>> >> 'Received' headers
>>>> >> -0.2 BAYES_40 BODY: Bayesian spam probability is
>>>> >> 20 to 40%
>>>> >> [score: 0.3369]
>>>> >> 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in
>>>> >> abuse.rfc-ignorant.org
>>>> >
>>>> >Is that the entire header? You're missing a bunch of "Received"
>>>> > lines.
>>>>
>>>> FWIW, fetchmail sucks it and dumps it to /var/spool/mail/gene, &
>>>> kmail sucks it from there. This is due to a bug in the kmail
>>>> suck from servers code of quite long duration, 3 or 4 years now.
>>>> Humm, headers do seem to be getting lost!
>>>
>>>If some of the header is being removed, then that might be a
>>> problem. That could definitely trigger the FORGED_YAHOO_RCVD rule
>>> if the received header listing the Yahoo! server was removed.
>>
>> In that event, how do I go about telling fetchmail that the
>> mailfile it generates in /var/spool/mail/gene is to be a verbatum
>> copy of what was sucked in the vz's server. My fetchmailrc is
>> comparatively clean, with no options that I know about set that
>> would encourage the shrunken headers. There are no OPTIONS
>> currently defined.
>
>Fetchmail is verbatim in the sense needed. Does fetchmail go through
>the tool that fires off SpamAssassin or is this done up in KMail as
>it reads? If so KMail may have sanitized off headers in much the same
>way as Outlook or Exchange. This makes KMail pretty useless IMAO if
>this is what they do.
>
>{^_^}
Nope, its two seperate processes, Joanne. Fetchmail is run from
rc.local, and is totally independant of kmail. Where I made that
statement was that I was compareing an old message that kmail had
sucked directly, to the contents of the /var/spool/mail/gene file.
Kmail in turn, and completely asynchronously, grabs and processes
the /var/spool/mail/gene file and sorts it a bit, then calls
spamassasin on what I haven't sorted out, then looks at the output of
the spamassassin pipe when its done and finishes the sorting.
But it was obviously two seperate messages, hence the ambiguity from
that alone. Over the next few days I will stop the auto fwd to vz
from gmail so that I can set the fetchmail output to other than "as
gene" & then send myself a message at the gmail address. As soon as
it comes back, copy it to a tmp file, wait for kmail to pick it up,
and then compare the contents of the tmp file with the message shown
me by kmail. Then stop the fetchmail scan of gmail, send another
message and look at it with the web interface before I tell kmail to
suck it directly. Somewhere in there, I hope to be able to "red dot"
the perp, if indeed there is one. I could very well be barking at the
moon and chaseing rabbits, but hopefully I'll also be a little smarter
too.
Right now I'm watching GA show the home team how its done. WV31-GA27,
but GA has closed the door on us after the first 15 minutes.
Seriously slammed it, and our guys are fumbling the ball away 4 times
now. Later, it looks like maybe we might pull one off, WV38-GA35,
1:45 to go with WV in possession. 1:10 left, new 1st down by WV. Rich
called for a fake punt and pulled it off very well. And with about 25
secs to go, GA walked out on the field to make it official, WV has won
the Sugar Bowl!
--
Cheers, Gene
People having trouble with vz bouncing email to me should add the word
'online' between the 'verizon', and the dot which bypasses vz's
stupid bounce rules. I do use spamassassin too. :-)
Yahoo.com and AOL/TW attorneys please note, additions to the above
message by Gene Heskett are:
Copyright 2005 by Maurice Eugene Heskett, all rights reserved.
