Re: [Mimedefang] SURBL lookups no longer happening after upgrade to 2.48

2004-12-10 Thread Lew E. Lefton
David F. Skoll wrote:
On Fri, 10 Dec 2004, Rob MacGregor wrote:

Similarly with MD 2.48 (the latest on FreeBSD ports) and SpamAssassin
3.0.1 under FreeBSD 5.3-STABLE I don't see the SURBL lookups working
when MD is calls SA.  When SA is called directly however the lookups
do work.

MD 2.49 and SA 3.0.1 works fine for me, with SURBL.
I have $SALocalTestsOnly = 0; in the filter, and it works like a charm.
Do you have anything odd in sa-mimedefang.cf ?
I am having the same problem with MD 2.49 and SA 3.0.1 on Solaris 9.  I 
think it must be related to config files but I haven't been able to 
pinpoint it.  Here are some lines from my configs:

# grep SALocal /etc/mail/mimedefang-filter
$SALocalTestsOnly = 0;
# grep -v ^# /etc/mail/sa-mimedefang.cf | grep -v '^$'
required_hits   5
ok_locales  en
rewrite_subject 0
skip_rbl_checks 0
use_bayes   1
bayes_auto_learn 1
bayes_learn_to_journal 1
bayes_path  /etc/mail/spamassassin/bayes/bayes
bayes_file_mode 0700
bayes_use_hapaxes   1
bayes_auto_learn_threshold_nonspam0.0
bayes_auto_learn_threshold_spam   8.0
urirhssub URIBL_JP_SURBL multi.surbl.org.   A   64
body  URIBL_JP_SURBL eval:check_uridnsbl('URIBL_JP_SURBL')
describe  URIBL_JP_SURBL Contains a URL listed in the JP SURBL blocklist
tflagsURIBL_JP_SURBL net
score URIBL_JP_SURBL 4.0
When a message with body containing 
http://surbl-org-permanent-test-point.com-MUNGED/
(with no -MUNGED of course) is piped as follows

cat surbl_test | spamassassin -tD
I get a lot of stuff that includes this:
debug: running body-text per-line regexp tests; score so far=0
debug: running uri tests; score so far=0
debug: registering glue method for check_uridnsbl 
(Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x52d71c))
debug: Razor2 is not available
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x52d71c) 
implements 'check_tick'
debug: URIDNSBL: domain surbl-org-permanent-test-point.com listed 
(URIBL_SC_SURBL): 127.0.0.2
debug: URIDNSBL: query for surbl-org-permanent-test-point.com took 1 
seconds to look up (multi.surbl.org.:surbl-org-permanent-test-point.com)
debug: URIDNSBL: queries completed: 2 started: 0
debug: URIDNSBL: queries active:  at Fri Dec 10 12:42:44 2004
debug: running raw-body-text per-line regexp tests; score so far=0
debug: running full-text regexp tests; score so far=0
debug: Razor2 is not available
debug: Current PATH is: 
/bin:/usr/bin:/usr/sbin:/opt/local/bin:/opt/local/sbin:/usr/local/bin:/usr/ccs/bin:/usr/openwin/bin:/usr/ucb
debug: Pyzor is not available: pyzor not found
debug: DCCifd is not available: no r/w dccifd socket found.
debug: DCC is not available: no executable dccproc found.
debug: Running tests for priority: 500
debug: RBL: success for 21 of 21 queries
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x52d71c) 
implements 'check_post_dnsbl'
debug: running meta tests; score so far=4.271

but when I explicitly use sa-mimedefang.cf
cat surbl_test | spamassassin --config-file=/etc/mail/sa-mimedefang.cf -tD
I get
debug: running body-text per-line regexp tests; score so far=0
debug: running uri tests; score so far=0
debug: registering glue method for check_uridnsbl 
(Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0xae5614))
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0xae5614) 
implements 'check_tick'
debug: URIDNSBL: query for surbl-org-permanent-test-point.com took 0 
seconds to look up (multi.surbl.org.:surbl-org-permanent-test-point.com)
debug: URIDNSBL: queries completed: 2 started: 0
debug: URIDNSBL: queries active:  at Fri Dec 10 12:42:25 2004
debug: running raw-body-text per-line regexp tests; score so far=0
debug: running full-text regexp tests; score so far=0
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0xae5614) 
implements 'check_post_dnsbl'
debug: auto-learn: currently using scoreset 3, recomputing score based 
on scoreset 1.
debug: auto-learn: message score: 0, computed score for autolearn: 0
debug: auto-learn? ham=0, spam=8, body-points=0, head-points=0, 
learned-points=0
debug: auto-learn? no: inside auto-learn thresholds, not considered ham 
or spam
debug: is spam? score=0 required=5

Any suggestions?
Cheers,
Lew Lefton
___
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang


Re: [Mimedefang] SURBL lookups no longer happening after upgrade to 2.48

2004-12-10 Thread Lew E. Lefton
David F. Skoll wrote:
On Fri, 10 Dec 2004, Rob MacGregor wrote:

This file loads modules for URIDNSBL, hashcash and SPF by default.
Putting the same lines in the SA config file doesn't have the same
effect - the modules don't seem to be loaded.

Aha!  This is what my /etc/mail/spamassassin/init.pre file contains:
loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
You have to put the init.pre file in the LOCAL_RULES_DIR directory,
I believe.
Thanks!  That worked for me.  I copied the init.pre installed by 
spamassassin to /etc/mail/spamassassin and SURBL testpoints are scoring 
agin.

Lew
___
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang


Re: [Mimedefang] Virus Definition Question / Bagle.H alert

2004-03-02 Thread Lew E. Lefton
On Tue, 2 Mar 2004, Kevin A. McGrail wrote:

 OK, as stupid as it may sound, I typically am on the leading edge for
 receiving viruses but I have no idea how to submit them to anyone.  Does
 anyone know the fastest, easiest way for a legit technical person to submit
 a virus email?

 As a note, the new Bagle.H is detected by Symantec 3/1/04 rev22 defs but
 McAfee with 4330 dat does NOT detect it.  I *had* to download the Daily Dat
 (Beta) from
 http://download.nai.com/products/mcafee-avert/daily_dats/DAILYDAT.ZIP.

This is an OT followup, but it may be relevant to this issue.  We found
that NAI's uvscan did not correctly detect a recent Netsky variant until
after we upgraded our scan engine from v4.1.60 (?) to  v4.3.20.  This was
uvscan on Solaris.

Lew Lefton

___
Visit http://www.mimedefang.org and http://www.canit.ca
MIMEDefang mailing list
[EMAIL PROTECTED]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang