Rule updates

2011-10-04 Thread Lars Jørgensen
Hi, Is it me or has it been a long time since there has been an update to the spamassassin ruleset? -- Lars

Re: Rule matching in a wrapped header

2011-10-04 Thread Frank Leonhardt
On 04/10/2011 01:58, RW wrote: On Mon, 03 Oct 2011 23:12:57 +0100 Frank Leonhardt wrote: I'm having a great deal of trouble writing a rule to match something in a Received: header. The problem is that sendmail(?) is whitespace wrapping the header. In other words, instead of: Headers are

Re: Rule updates

2011-10-04 Thread Michael Scheidell
On 10/4/11 3:07 AM, Lars Jørgensen wrote: Hi, Is it me or has it been a long time since there has been an update to the spamassassin ruleset? what is 'long'? ls -lt *.tar.gz | grep 'gz$' | head -rw-r--r-- 1 rsync rsync 170211 Oct 4 04:51 1178724.tar.gz -- 3.4.0 -rw-r--r-- 1 rsync

Re: Rule matching in a wrapped header

2011-10-04 Thread John Hardin
On Tue, 4 Oct 2011, Frank Leonhardt wrote: So, doing this using the actual rule and an actual header it *does* work. It's only when its run through the milter that it fails to match. Are you attempting to match the Received: header added by your MTA? Your MTA may not have added the Received:

Re: Rule updates

2011-10-04 Thread Jim Popovitch
On Tue, Oct 4, 2011 at 09:39, Michael Scheidell michael.scheid...@secnap.com wrote: On 10/4/11 3:07 AM, Lars Jørgensen wrote: Hi, Is it me or has it been a long time since there has been an update to the spamassassin ruleset? what is 'long'? Since 27-Aug-2011 ? $ ll

Re: Rule matching in a wrapped header

2011-10-04 Thread Frank Leonhardt
On 04/10/2011 14:41, John Hardin wrote: On Tue, 4 Oct 2011, Frank Leonhardt wrote: So, doing this using the actual rule and an actual header it *does* work. It's only when its run through the milter that it fails to match. Are you attempting to match the Received: header added by your MTA?

Re: Rule updates

2011-10-04 Thread Frank Leonhardt
On 04/10/2011 14:39, Michael Scheidell wrote: On 10/4/11 3:07 AM, Lars Jørgensen wrote: Hi, Is it me or has it been a long time since there has been an update to the spamassassin ruleset? Most common reasons for a problem (IME, on FreeBSD) Incorrect permissions on directory Incorrect

Re: Rule matching in a wrapped header

2011-10-04 Thread Kris Deugau
Frank Leonhardt wrote: So, doing this using the actual rule and an actual header it *does* work. It's only when its run through the milter that it fails to match. Yep. The Received: header on a milter-using system is added *after* the milter processing is complete. Any processing that

Re: Rule matching in a wrapped header

2011-10-04 Thread Dave Funk
On Tue, 4 Oct 2011, Frank Leonhardt wrote: On 04/10/2011 14:41, John Hardin wrote: On Tue, 4 Oct 2011, Frank Leonhardt wrote: So, doing this using the actual rule and an actual header it *does* work. It's only when its run through the milter that it fails to

How do I stop SA checking mail from authenticated users

2011-10-04 Thread Frank Leonhardt
Here's the problem: I have a single mail server (not commercial) using sendmail to accept incoming mail from all sources, and filtering using spamassassin. It also accepts mail from roaming users - encrypted mail using port 465 and authenticating users with SASL, and is expected to relay

Re: How do I stop SA checking mail from authenticated users

2011-10-04 Thread Noel
On 10/4/2011 12:48 PM, Frank Leonhardt wrote: Here's the problem: I have a single mail server (not commercial) using sendmail to accept incoming mail from all sources, and filtering using spamassassin. It also accepts mail from roaming users - encrypted mail using port 465 and authenticating

RE: How do I stop SA checking mail from authenticated users

2011-10-04 Thread Kelson Vibber
-Original Message- From: Frank Leonhardt [mailto:fra...@extremecomputing.org.uk] I have a single mail server (not commercial) using sendmail to accept incoming mail from all sources, and filtering using spamassassin. It also accepts mail from roaming users - encrypted mail using port

Re: How do I stop SA checking mail from authenticated users

2011-10-04 Thread Kris Deugau
Frank Leonhardt wrote: Here's the problem: I have a single mail server (not commercial) using sendmail to accept incoming mail from all sources, and filtering using spamassassin. It also accepts mail from roaming users - encrypted mail using port 465 and authenticating users with SASL, and is

Re: How do I stop SA checking mail from authenticated users

2011-10-04 Thread Frank Leonhardt
On 04/10/2011 19:22, Kris Deugau wrote: Frank Leonhardt wrote: Here's the problem: I have a single mail server (not commercial) using sendmail to accept incoming mail from all sources, and filtering using spamassassin. It also accepts mail from roaming users - encrypted mail using port 465 and

Re: Help with tagging hotmail spam

2011-10-04 Thread Ned Slider
On 04/10/11 05:50, Alex wrote: Hi, I have a fedora15 box with v3.3.2 and I have some hotmail spam that I can't figure out how to catch: http://pastebin.com/kkUUvYQp It's hitting BAYES_00 and no blacklists or other significant spam rules and not sure how to tag it. The user has reported

Re: How do I stop SA checking mail from authenticated users

2011-10-04 Thread Kris Deugau
Frank Leonhardt wrote: Thanks Kris, Kelson and Noel - pretty unanimous answer - just don't call the milter for stuff on 465! Unfortunately I don't know how to achieve this, but I'll go off and do some research now I know what I'm trying to find. As far as I'm aware you can't bypass a milter -

Re: How do I stop SA checking mail from authenticated users

2011-10-04 Thread Noel
On 10/4/2011 1:59 PM, Frank Leonhardt wrote: Thanks Kris, Kelson and Noel - pretty unanimous answer - just don't call the milter for stuff on 465! Unfortunately I don't know how to achieve this, but I'll go off and do some research now I know what I'm trying to find. The alternative is to

Re: How do I stop SA checking mail from authenticated users

2011-10-04 Thread Frank Leonhardt
On 04/10/2011 20:17, Kris Deugau wrote: Frank Leonhardt wrote: Thanks Kris, Kelson and Noel - pretty unanimous answer - just don't call the milter for stuff on 465! Unfortunately I don't know how to achieve this, but I'll go off and do some research now I know what I'm trying to find. As far

Re: How do I stop SA checking mail from authenticated users

2011-10-04 Thread Kris Deugau
Frank Leonhardt wrote: I think there's a terminology mis-match here. To me milter is a sendmail mail filter, of which there can be any number configured (this is me making no assumptions about Postfix c). In this case it's just spamass-milter (Georg C. F. Greve 2002) Nope, you've got the

Re: How do I stop SA checking mail from authenticated users

2011-10-04 Thread Ted Mittelstaedt
This question comes up enough so that it ought to be in the FAQ. spamass-milter as others have said does not pay attention to authenticated mail. Other milters do - but other milters are often a lot more complicated, and can run slower, to say nothing of having to learn additional

Re: How do I stop SA checking mail from authenticated users

2011-10-04 Thread Frank Leonhardt
On 04/10/2011 22:52, Kris Deugau wrote: Frank Leonhardt wrote: I think there's a terminology mis-match here. To me milter is a sendmail mail filter, of which there can be any number configured (this is me making no assumptions about Postfix c). In this case it's just spamass-milter (Georg C. F.

Re: How do I stop SA checking mail from authenticated users

2011-10-04 Thread Karsten Bräckelmann
On Tue, 2011-10-04 at 15:10 -0700, Ted Mittelstaedt wrote: This question comes up enough so that it ought to be in the FAQ. While I believe a FAQ does really not help all that much on and by itself, but instead serves as a handy place to point people to... It's a wiki. Please feel free to add

Re: How do I stop SA checking mail from authenticated users

2011-10-04 Thread Frank Leonhardt
On 04/10/2011 23:10, Ted Mittelstaedt wrote: This question comes up enough so that it ought to be in the FAQ. spamass-milter as others have said does not pay attention to authenticated mail. Other milters do - but other milters are often a lot more complicated, and can run slower, to say

Re: How do I stop SA checking mail from authenticated users - Solved

2011-10-04 Thread Frank Leonhardt
On 04/10/2011 23:45, Karsten Bräckelmann wrote: On Tue, 2011-10-04 at 15:10 -0700, Ted Mittelstaedt wrote: This question comes up enough so that it ought to be in the FAQ. While I believe a FAQ does really not help all that much on and by itself, but instead serves as a handy place to point

Re: How do I stop SA checking mail from authenticated users

2011-10-04 Thread David F. Skoll
On Tue, 04 Oct 2011 15:10:20 -0700 Ted Mittelstaedt t...@ipinc.net wrote: There is something to be said for the UNIX philosophy of small is beautiful You may love your MIMEdefang but why do I have to run it when this problem is so easily fixed? This (alone) is no reason to run MIMEDefang.