Getting odd messages since yesterday
Hi everyone. I run a batch file to learn spam and ham that I manually place into folders. As of yesterday, I started getting the error message below. Please advise! John > Parsing of undecoded UTF-8 will give garbage when decoding entities at /usr/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/HTML.pm line 182. Parsing of undecoded UTF-8 will give garbage when decoding entities at /usr/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/HTML.pm line 182. Parsing of undecoded UTF-8 will give garbage when decoding entities at /usr/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/HTML.pm line 182. Parsing of undecoded UTF-8 will give garbage when decoding entities at /usr/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/HTML.pm line 182.
Re: spamd process using to much cpu (again)
On Fri, Dec 03, 2004 at 01:05:38PM -0300, Matias Lopez Bergero wrote: > > How often do I need to run sa-lern --force-expire? > That highly depends on your email traffic. Turn off auto expiration and watch your database for a day or so and determine how long it takes to learn enough to go over the token threshold, then setup your cron job accordingly. Michael pgpJdkclB1Uft.pgp Description: PGP signature
Re: quarantine how?
On Fri, Dec 03, 2004 at 06:13:42PM -0500, Peter Matulis wrote: > How does one begin using the quarantine? I am using SA 3.01 with milter > smtp-vilter. SpamAssassin has no quarantine capability in and of itself. You have to ask the smtp-vilter people how their milter works. -- Randomly Generated Tagline: "If you want to make an apple pie from scratch, you must first create the universe." - Carl Sagan pgpzRnSadBusn.pgp Description: PGP signature
quarantine how?
How does one begin using the quarantine? I am using SA 3.01 with milter smtp-vilter. __ Post your free ad now! http://personals.yahoo.ca
Re: setrgid() not implemented at /usr/bin/spamd line 702. (more info)
On Fri, Dec 03, 2004 at 05:18:34PM -0500, Rob Kudyba wrote: > I was able to start spamd using: > '/usr/bin/spamd -d -x' > rather than: > '/usr/bin/spamd -d -x -u nobody' > SA 3.01 on OS X 10.2.5: > setrgid() not implemented at /usr/bin/spamd line 702. None of the Mac OS X perls seem to implement the set*id() functions. It's heavily recommended you compile up your own perl with support and use that instead. -- Randomly Generated Tagline: "If English was good enough for Jesus Christ, it ought to be good enough for the children of Texas." - Texas Governor Miriam "Ma" Ferguson, 1924 pgpij7f0bqfbQ.pgp Description: PGP signature
setrgid() not implemented at /usr/bin/spamd line 702. (more info)
I was able to start spamd using: '/usr/bin/spamd -d -x' rather than: '/usr/bin/spamd -d -x -u nobody' More info: finger nobody Login: nobody Name: Unprivileged User Directory: /dev/nullShell: /dev/null Never logged in. No Plan. id nobody uid=4294967294(nobody) gid=4294967294(nobody) groups=4294967294(nobody) perl -V Summary of my perl5 (revision 5 version 8 subversion 5) configuration: Platform: osname=darwin, osvers=6.8, archname=darwin uname='darwin ccsd89.org 6.8 darwin kernel version 6.8: wed sep 10 15:20:55 pdt 2003; root:xnuxnu-344.49.obj~2release_ppc power macintosh powerpc ' config_args='-de -Dprefix=/usr [EMAIL PROTECTED] [EMAIL PROTECTED]' hint=recommended, useposix=true, d_sigaction=define usethreads=undef use5005threads=undef useithreads=undef usemultiplicity=undef useperlio=define d_sfio=undef uselargefiles=define usesocks=undef use64bitint=undef use64bitall=undef uselongdouble=undef usemymalloc=n, bincompat5005=undef Compiler: cc='cc', ccflags ='-fno-common -DPERL_DARWIN -no-cpp-precomp -fno-strict-aliasing -pipe', optimize='-Os', cppflags='-no-cpp-precomp -fno-common -DPERL_DARWIN -no-cpp-precomp -fno-strict-aliasing -pipe' ccversion='', gccversion='3.1 20020420 (prerelease)', gccosandvers='' intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=4321 d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=8 ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8 alignbytes=8, prototype=define Linker and Libraries: ld='cc', ldflags =' -flat_namespace -L/usr/local/lib' libpth=/usr/local/lib /usr/lib libs=-lm -lc perllibs=-lm -lc libc=/usr/lib/libc.dylib, so=dylib, useshrplib=false, libperl=libperl.a gnulibc_version='' Dynamic Linking: dlsrc=dl_dyld.xs, dlext=bundle, d_dlsymun=undef, ccdlflags=' ' cccdlflags=' ', lddlflags=' -flat_namespace -bundle -undefined suppress -L/usr/local/lib' Characteristics of this binary (from libperl): Compile-time options: USE_LARGE_FILES Built under darwin Compiled at Dec 3 2004 15:14:55 @INC: /System/Library/Perl/5.8.5/darwin /System/Library/Perl/5.8.5 /Library/Perl/5.8.5/darwin /Library/Perl/5.8.5 /Library/Perl /Network/Library/Perl/5.8.5/darwin /Network/Library/Perl/5.8.5 /Network/Library/Perl SA 3.01 on OS X 10.2.5: /usr/bin/spamd -d -x -u nobody -D trying to connect to syslog/unix... no error connecting to syslog/unix logging enabled: facility: mail socket: unix output: syslog creating INET socket: Listen: 128 LocalAddr: 127.0.0.1 LocalPort: 783 Proto: 6 ReuseAddr: 1 Type: 1 setrgid() not implemented at /usr/bin/spamd line 702. Any ideas?
setrgid() not implemented at /usr/bin/spamd line 702.
SA 3.01 on OS X 10.2.5: /usr/bin/spamd -d -x -u nobody -D trying to connect to syslog/unix... no error connecting to syslog/unix logging enabled: facility: mail socket: unix output: syslog creating INET socket: Listen: 128 LocalAddr: 127.0.0.1 LocalPort: 783 Proto: 6 ReuseAddr: 1 Type: 1 setrgid() not implemented at /usr/bin/spamd line 702. Any ideas?
Re: Bayes question
On Fri, 3 Dec 2004 19:37:05 +, Ricardo Oliveira <[EMAIL PROTECTED]> wrote: > What about joining several databases together? > > I'd like to use a "general" bayes DB, and join it with some clients's > particular DB's. > > TIA, > Ricardo > Never tried it, but it should be possible with sa-learn --backup and sa-learn --restore. Mike
Re: Bayes question
What about joining several databases together? I'd like to use a "general" bayes DB, and join it with some clients's particular DB's. TIA, Ricardo
Re: reporting to bogusmx at rfc-ignorant
John Hardin wrote:
On Fri, 2004-12-03 at 00:21, Andrzej Adam Filip wrote:
Would it be possible to make spamassassin sumbit candidates to bogusmx list at
RFC-Ingorant.org?
How would we use that list in SA?
The list is used by SpamAssassin-3:
20_dnsbl_tests.cf:
header __RFC_IGNORANT_ENVFROM
eval:check_rbl_envfrom('rfci_envfrom', 'fulldom.rfc-ignorant.org.'
header DNS_FROM_RFC_BOGUSMX eval:check_rbl_sub('rfci_envfrom', '127.0.0.8')
describe DNS_FROM_RFC_BOGUSMX Envelope sender in bogusmx.rfc-ignorant.org
tflags DNS_FROM_RFC_BOGUSMX net
50_scores.cf:
score DNS_FROM_RFC_BOGUSMX 0 1.463 0 2.630
URL(s):
http://rfc-ignorant.org/policy-bogusmx.php
--
Andrzej [en:Andrew] Adam Filip [EMAIL PROTECTED] [EMAIL PROTECTED]
Home Page http://anfi.homeunix.net/ [ PageRank 6 ]
Re: How to block rolex spam
At 11:10 AM 12/3/2004, Glenn Jackman wrote: On 2004-12-02 10:10, Matt Kettler wrote: > At 05:37 AM 12/2/2004 -0800, Loren Wilton wrote: > > >body __LW_OBREPLICA /\brepIicas?\b/i > >body __LW_REPLICA /\breplicas?\b/i > > Loren..might I suggest using a lower-case I for the OB version? In some > sans-serif fonts (ie: Arial) lower case l and upper case I are drawn the > same. At first glance I thought you'd made a typo and had entered the same > regex twice :) Or use just one rule: /\brep[li]icas?\b/i If you look, the reason for two rules is the obfuscated one scores higher.
Re: RBLs, URIBLs questions
On Fri, 3 Dec 2004 12:13:07 -0500, Theo Van Dinter <[EMAIL PROTECTED]> wrote:
> I'd go verify that the plugin is actually 3.0.1 versus 3.0.0. The only
> (or easiest?) way you can tell is looking at line 169.
-- /usr/lib/perl5/site_perl/5.8.1/Mail/SpamAssassin/Plugin/URIDNSBL.pm, line 169
next unless ($scanner->{conf}->is_rule_active('body_evals',$rulename));
Yes, that's 3.0.1, whatever it says about the tar file.
--
Matthew 'Shandower' Romanek
IDS Analyst
Re: RBLs, URIBLs questions
On Fri, Dec 03, 2004 at 09:08:01AM -0800, Matthew Romanek wrote:
> > > CPAN_FILEF/FE/FELICITY/Mail-SpamAssassin-3.0.0.tar.gz
> >
> > but you're running 3.0.0...?
>
> No, that's just what cpan says for the URIDNSBL plug in. That was one
> of those confusing bits, but I figured if cpan says it's up to date,
> it knows what it's talking about.
>
> $ spamassassin -V
> SpamAssassin version 3.0.1
> running on Perl version 5.8.1
I'd go verify that the plugin is actually 3.0.1 versus 3.0.0. The only
(or easiest?) way you can tell is looking at line 169.
next unless ($scanner->{conf}->is_rule_active('body_evals',$rulename));
If it's body_evals, it's 3.0.1+. If it's head_evals, it's 3.0.0.
--
Randomly Generated Tagline:
But let me put this on the record: I specifically disrecommend use of
grammar tweaks that will incite lynch mobs. You have been warned. :-)
-- Larry Wall in <[EMAIL PROTECTED]>
pgp0rb3zx1nYG.pgp
Description: PGP signature
Re: RBLs, URIBLs questions
On Fri, 3 Dec 2004 12:02:02 -0500, Theo Van Dinter <[EMAIL PROTECTED]> wrote:
> On Fri, Dec 03, 2004 at 08:51:57AM -0800, Matthew Romanek wrote:
> > bodyURIBL_SBL eval:check_uridnsbl('URIBL_SBL')
>
> Ok, so that's a 3.0.1 uridnsbl call (3.0.0 was header, 3.0.1+ is body).
>
> > cpan> i Mail::SpamAssassin::Plugin::URIDNSBL
> > CPAN_FILEF/FE/FELICITY/Mail-SpamAssassin-3.0.0.tar.gz
>
> but you're running 3.0.0...?
No, that's just what cpan says for the URIDNSBL plug in. That was one
of those confusing bits, but I figured if cpan says it's up to date,
it knows what it's talking about.
$ spamassassin -V
SpamAssassin version 3.0.1
running on Perl version 5.8.1
Re: RBLs, URIBLs questions
On Fri, Dec 03, 2004 at 08:51:57AM -0800, Matthew Romanek wrote:
> bodyURIBL_SBL eval:check_uridnsbl('URIBL_SBL')
Ok, so that's a 3.0.1 uridnsbl call (3.0.0 was header, 3.0.1+ is body).
> cpan> i Mail::SpamAssassin::Plugin::URIDNSBL
> CPAN_FILEF/FE/FELICITY/Mail-SpamAssassin-3.0.0.tar.gz
but you're running 3.0.0...?
--
Randomly Generated Tagline:
"Stop stealing my blanket. You're an arctic wolf for god sakes. You're
getting soft." - Due South
pgpxTVAtU58eP.pgp
Description: PGP signature
RE: Understanding the AWL (was Upgrade to 3.0.1 results in false
> Excellent. I applaud you for being a user who is really > willing to try to help themselves (along with other users who > do the same) The hard part was knowing what the problem was. Once I figured out it was the AWL, the rest wasn't so tough. I think I shot myself in the foot, actually. I was using the '-t' switch in my testing, but I didn't disable the AWL. So the address I used to send the tests got progressively spammier in AWL until it was always tagged. > Also, for future reference, the wiki on the spamassassin > website can be a real treasure trove of information. That's where the answer ultimately came from. It was linked in one of the posts on the topic. In fact, the Wiki entry it says you wrote it. So thanks for the info! :) -Aaron
RBLs, URIBLs questions
I've been following along for a while and looking around the archives,
but I can't find an answer to a problem I've been having since
upgrading from 2.x to 3.x. Namely, none of the DNSBL or URIBL seem to
be working. I've verified a number of things from previous posts on
the subject, see below.
I've tried using the http://www.surbl-org-permanent-test-point.com/
test email, no avail.
I don't see where it's even trying to do the DNSBL tests, but niether
do I see any reason it shouldn't.. The only thing I see is the DNS
timeout?
Another oddity is that this is on Fedora Core 1, and when I redirect
from spamassassin, it goes straight to the console and ignores any
redirects (which is a pain when you're trying to compare logs). I
doubt it's related, but I'm not really concerned with that particular
oddity at the moment. It just struck me as similar to what someone
else was describing..
Any help would be greatly appreciated.
_
-- startup options
/usr/bin/spamd -d
_
-- local.cf
skip_rbl_checks 0
_
-- spamassassing --lint -D (snippets)
debug: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
...
debug: config: read file /usr/share/spamassassin/25_uribl.cf
...
debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x86ebb3c)
debug: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::Hashcash=HASH(0x90e0978)
debug: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::SPF=HASH(0x90bc604)
...
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x86ebb3c)
implements 'parsed_metadata'
debug: is Net::DNS::Resolver available? yes
debug: Net::DNS version: 0.48
debug: trying (3) mit.edu...
debug: looking up NS for 'mit.edu'
debug: NS lookup of mit.edu succeeded => Dns available (set
dns_available to hardcode)
debug: is DNS available? 1
debug: URIDNSBL: domains to query:
debug: all '*From' addrs: [EMAIL PROTECTED]
debug: Running tests for priority: 0
...
debug: RBL: success for 0 of 1 queries
debug: DNS: timeout for ahbl after 15 seconds
_
-- 20_dnsbl_tests.cf (for instance)
header __RCVD_IN_SBL_XBLeval:check_rbl('sblxbl',
'sbl-xbl.spamhaus.org.')
describe __RCVD_IN_SBL_XBL Received via a relay in Spamhaus SBL+XBL
tflags __RCVD_IN_SBL_XBLnet
# SBL is the Spamhaus Block List: http://www.spamhaus.org/sbl/
header RCVD_IN_SBL eval:check_rbl_sub('sblxbl', '127.0.0.2')
describe RCVD_IN_SBLReceived via a relay in Spamhaus SBL
tflags RCVD_IN_SBL net
# XBL is the Exploits Block List: http://www.spamhaus.org/xbl/
header RCVD_IN_XBL eval:check_rbl('sblxbl-notfirsthop',
'sbl-xbl.spamhaus.org.', '127.0.0.[456]')
describe RCVD_IN_XBLReceived via a relay in Spamhaus XBL
tflags RCVD_IN_XBL net
_
-- 25_uribl.cf
ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
# URI-DNSBL lookups can take a *maximum* of this many seconds past the
# normal DNSBL lookups.
uridnsbl_timeout2
uridnsblURIBL_SBL sbl.spamhaus.org. TXT
bodyURIBL_SBL eval:check_uridnsbl('URIBL_SBL')
describeURIBL_SBL Contains an URL listed in the SBL blocklist
tflags URIBL_SBL net
_
cpan> i Mail::SpamAssassin::Plugin::URIDNSBL
Strange distribution name [Mail::SpamAssassin::Plugin::URIDNSBL]
Module id = Mail::SpamAssassin::Plugin::URIDNSBL
CPAN_USERID FELICITY (Theo Van Dinter <[EMAIL PROTECTED]>)
CPAN_VERSION undef
CPAN_FILEF/FE/FELICITY/Mail-SpamAssassin-3.0.0.tar.gz
MANPAGE URIDNSBL - look up URLs against DNS blocklists This
works by analysing message text and HTML for URLs, extracting the
domain names from those, querying their NS records in DNS, resolving
the hostnames used therein, and querying various DNS blocklists for
those IP addresses. This is quite effective.
INST_FILE
/usr/lib/perl5/site_perl/5.8.1/Mail/SpamAssassin/Plugin/URIDNSBL.pm
INST_VERSION undef
_
cpan> i Net::DNS
Strange distribution name [Net::DNS]
Module id = Net::DNS
DESCRIPTION Interface to the DNS resolver
CPAN_USERID CREIN (Chris Reinhardt <[EMAIL PROTECTED]>)
CPAN_VERSION 0.48
CPAN_FILEC/CR/CREIN/Net-DNS-0.48.tar.gz
DSLI_STATUS RmhO (released,mailing-list,hybrid,object-oriented)
MANPAGE Net::DNS - Perl interface to the DNS resolver
INST_FILE
/usr/lib/perl5/site_perl/5.8.1/i386-l
Re: RulesDuJour web site?
On Thu, 2 Dec 2004 10:15:20 +0100 "C-Store Christoph Peter" <[EMAIL PROTECTED]> wrote: > Hello, > > can anyone tell a me what this can be used for ? I have SA 3.01 > set up and running fine now - what does this script acutally > update ? > > Thanks, > > Chris In conjuction with my_rules_du_jour, it maintains custom rulesets. When the publicly available rulesets are updated, they will update the rulesets you use for your server. -- Raquel The surest way to corrupt a youth is to instruct him to hold in higher regard those who think alike than those who think differently. --Friedrich Nietzche pgpKD6yjk16Hk.pgp Description: PGP signature
Re: Sober.I virus variant gets Malformed SA reply. SPAMD/1.0 76 Bad header line: (Content-Length mismatch: Expected...
On Fri, Dec 03, 2004 at 11:07:48AM -0500, Rob Kudyba wrote: > "Malformed SA reply. SPAMD/1.0 76 Bad header line: (Content-Length > mismatch: Expected 77970 bytes, got 77972 bytes)" > > This doesn't seem to happen on other OS'es, e.g., OS X/Darwin or > Solaris, and of course an upgrade to ClamAV 0.80 correctly catches the > file as a Sober.I virus...anything else to do as we've seen this error > with non-virus mails as well... The only interesting thing I see is that there are 2 NULL chars (raw binary) at the end of the pif attachment, making the whole message completely invalid per the RFC. That is very likely confusing something in the system since nulls aren't ever supposed to be there. You should just have your MTA drop mails that have raw null characters in them. -- Randomly Generated Tagline: Be warned that typing \fBkillall \fIname\fP may not have the desired effect on non-Linux systems, especially when done by a privileged user. (From the killall manual page) pgp1Xqc7ieGmi.pgp Description: PGP signature
Re: How to block rolex spam
On 2004-12-02 10:10, Matt Kettler wrote: > At 05:37 AM 12/2/2004 -0800, Loren Wilton wrote: > > >body __LW_OBREPLICA /\brepIicas?\b/i > >body __LW_REPLICA /\breplicas?\b/i > > Loren..might I suggest using a lower-case I for the OB version? In some > sans-serif fonts (ie: Arial) lower case l and upper case I are drawn the > same. At first glance I thought you'd made a typo and had entered the same > regex twice :) Or use just one rule: /\brep[li]icas?\b/i -- Glenn Jackman CF Sysadmin
Sober.I virus variant gets Malformed SA reply. SPAMD/1.0 76 Bad header line: (Content-Length mismatch: Expected...
We're running ClamAV .75 and SA 3.01 on RH8 and 9 boxes and we are
finding that mails with the Sober.I variant get pass ClamAV 0.75 and
then SA replies with:
"Malformed SA reply. SPAMD/1.0 76 Bad header line: (Content-Length
mismatch: Expected 77970 bytes, got 77972 bytes)"
Per this thread:
http://www.redhat.com/archives/redhat-list/2003-June/msg01995.html I did
both of these:
"I added a line to /etc/init.d/spamassassin: export LANG=en_US"
and:
"Another approach for RH 8/9 is to add
export LANG=en_US SUPPORTED="en_US" LC_MESSAGES=C LC_ALL=C
to /etc/bashrc. That pretty well picks up all utf-8 probs."
Sample file avaialble at
ftp://herbie.raeinternet.com:/pub/20041203_073721_27721400c.49866.tar.gz
I see that from this URL:
http://spamassassin.rediris.es/full/3.0.x/dist/spamd/spamd.raw, the part
of the code is here:
# Check length if we're supposed to.
if ( defined $expected_length && $actual_length != $expected_length ) {
protocol_error(
"(Content-Length mismatch: Expected $expected_length bytes, got
$actual_length bytes)"
);
$mail->finish();
return 1;
}
This doesn't seem to happen on other OS'es, e.g., OS X/Darwin or
Solaris, and of course an upgrade to ClamAV 0.80 correctly catches the
file as a Sober.I virus...anything else to do as we've seen this error
with non-virus mails as well...
Re: spamd process using to much cpu (again)
Michael Parker wrote: On Thu, Dec 02, 2004 at 05:07:48PM -0300, Matias Lopez Bergero wrote: Depending on your setup you could turn off bayes_auto_expire and do the expiration manually (ie sa-learn --force-expire), at a time that you control. Unfortunately, unless you are running a sitewide bayes config, this may not work well with a lot of individual bayes dbs. I am running sitewide installation. But now I got another question. I need to run sa-learn by hand? There is no way to configure spamd to do that?? You can script it, or run it via cron. spamd doesn't have this ability. How often do I need to run sa-lern --force-expire? BR, Matías.
Re: how to debug/diagnose a tight loop?
Michael Barnes wrote: > On Fri, Dec 03, 2004 at 10:26:10AM +0100, Per Jessen wrote: >> I'm running a number of SA2.64 and spampd instances - every now and >> then one the children spawned will enter a tight loop. Not being much > > Odds are its due to the bayes db going through its expiratory stage. > When I ran 2.6x, I had a cronjob that ran 'sa-learn --force-expire' from > time to time and the periodic CPU burning went away. OK, sounds interesting. However, there doesn't appear to anything periodic about these loops - i.e. a couple of child-threads will start looping, and that's it. I don't really keep an eye on it every day, so occasionally one of these might be looping for a day or two till I kill it. I'll try the force-expire though. thanks, -- Per Jessen, Zurich Let your spam stop here -- http://www.spamchek.com
Re: how to debug/diagnose a tight loop?
On Fri, Dec 03, 2004 at 10:26:10AM +0100, Per Jessen wrote: > I'm running a number of SA2.64 and spampd instances - every now and > then one the children spawned will enter a tight loop. Not being much > of a Perl programmer, I'm at a loss when it comes to debugging and/or > diagnosing this - it is not reproducable, except it happens perhaps > 1-2/week. I would prefer to fix the problem rather than writing a > little watchdog to keep an eye on spampd/SA. (which would be the easy > way out for me). Odds are its due to the bayes db going through its expiratory stage. When I ran 2.6x, I had a cronjob that ran 'sa-learn --force-expire' from time to time and the periodic CPU burning went away. Now I run 3.0.1 with a mysql db backend for the bayes database, and it runs much better that way for me, and I don't have to do the manual expire. > Can I eg. kill such a looping thread and get a coredump I can gdb or > something? You could, but at best it would give you debug information about the perl binary itself, and not the script that it is running. I would check the force-expire option first. Mike -- /-\ | Michael Barnes <[EMAIL PROTECTED]> | | UNIX Systems Administrator | | College of William and Mary | | Phone: (757) 879-3930 | \-/
RE: Image Composition Analysis
I forget to be paranoid and suspicious some times. :( <> > -Original Message- > From: Chris Santerre [mailto:[EMAIL PROTECTED] > Sent: Friday, December 03, 2004 9:12 AM > To: Smart,Dan; users@spamassassin.apache.org > Subject: RE: Image Composition Analysis > > > > >-Original Message- > >From: Smart,Dan [mailto:[EMAIL PROTECTED] > >Sent: Friday, December 03, 2004 9:59 AM > >To: users@spamassassin.apache.org > >Subject: RE: Image Composition Analysis > > > > > >Agree on DCC, it only tells if bulk and doesn't > discriminate on Spam or > >not. > >I have whitelists, and some home made rules which fix most real > >newsletters. > > > *SNIP* > > Oh dear! Its usually not a good idea to post negative > scoring rules to the list. Guess what we are going to see in > the next week of spam? :) > > --Chris > >
RE: Image Composition Analysis
>-Original Message- >From: Smart,Dan [mailto:[EMAIL PROTECTED] >Sent: Friday, December 03, 2004 9:59 AM >To: users@spamassassin.apache.org >Subject: RE: Image Composition Analysis > > >Agree on DCC, it only tells if bulk and doesn't discriminate >on Spam or not. >I have whitelists, and some home made rules which fix most >real newsletters. > *SNIP* Oh dear! Its usually not a good idea to post negative scoring rules to the list. Guess what we are going to see in the next week of spam? :) --Chris
RE: Image Composition Analysis
Agree on DCC, it only tells if bulk and doesn't discriminate on Spam or not. I have whitelists, and some home made rules which fix most real newsletters. header VMC_S_HAS_DATE Subject =~ /[01]?\d[-\/][0-3]?\d[-\/](20)?0[3-9]/ describe VMC_S_HAS_DATE VMC-Subject contains a date scoreVMC_S_HAS_DATE -3.0 header VMC_F_NEWS_LISTFrom =~ /([EMAIL PROTECTED]|[EMAIL PROTECTED])/i describe VMC_F_NEWS_LISTVMC-From: news or list hostname in FQDN scoreVMC_F_NEWS_LIST-2.0 header VMC_S_IS_NEWS Subject =~ /\b(in review|news|list)/i describe VMC_S_IS_NEWS VMC-Sub news newsletter list scoreVMC_S_IS_NEWS -2.0 header VMC_S_FREQ Subject =~ /\b(monday|daily|week|monthly)\b/i describe VMC_S_FREQ VMC-Sub monday daily week or monthly scoreVMC_S_FREQ -2.5 header VMC_S_MONTHSubject =~ /\b(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)/ describe VMC_S_MONTHVMC-Sub has month probable newsletter scoreVMC_S_MONTH-2.5 <> > -Original Message- > From: Michael Barnes [mailto:[EMAIL PROTECTED] > Sent: Thursday, December 02, 2004 9:18 AM > To: Matt Kettler > Cc: Smart,Dan; users@spamassassin.apache.org > Subject: Re: Image Composition Analysis > > On Tue, Nov 30, 2004 at 07:25:45PM -0500, Matt Kettler wrote: > > Yes, but DCC is still more reliable and faster. (I use both) > > I had to score DCC with 0.1 because it has way too many > false positives. > My local.cf section dealing with this: > > > # too many false posives with this guy, meta corrected below > > score DCC_CHECK 0.1 > > metaDCC_PYZOR (DCC_CHECK && PYZOR_CHECK) > score DCC_PYZOR 2.9 > > > DCC seems to have a large number of _solicited_ bulk email > in its database, and my users get very upset when they sign > up for junk email and it gets marked anywhere near spam. > > Just in my experience, I've noticed that there is a high > correlation between DCC positive hits & Pyzor positive hits > & real spam, so I scored it that way. > > Mike > > -- > /-\ > | Michael Barnes <[EMAIL PROTECTED]> | > | UNIX Systems Administrator | > | College of William and Mary | > | Phone: (757) 879-3930 | > \-/ > >
RE: spamd does not start
Search for the .pm and .so components of the installed packages. I found that I had more than one version saved in different perl library locations. When I did a locate DNS.pm, etc, I found them, then made sure I was left with one copy of the most recent version. That fixed my SPAMD problem (actually was a problem with Time::HiRes and Net::DNS) <> > -Original Message- > From: xoops?? [mailto:[EMAIL PROTECTED] > Sent: Friday, December 03, 2004 1:00 AM > To: users@spamassassin.apache.org > Subject: spamd does not start > > Hi, > > I have newly installed spamassassin-3.0.1 into linux box > 2.4.18-22 running qmail with qmail-queue patch. > Having a trouble to start spamd with SPAMDOPTIONS="-x -u > spamd -H /home/spamd -d": > > "Starting spamd: Bareword "SO_REUSEPORT" not allowed while > "strict subs" in use at > /usr/lib/perl5/5.6.1/IO/Socket/INET.pm line 160. > Compilation failed in require at > /usr/lib/perl5/5.6.1/i386-linux-thread-multi/IO/Socket.pm line 21. > Compilation failed in require at /usr/bin/spamd line 38. > BEGIN failed--compilation aborted at /usr/bin/spamd line 38. > > I installed prerequisited modules, HTML::Parser, DB_File > Net::DNS, BerkeleyDB, Net::SMTP, Mail::SPF::Query, IP::Country::Fast. > And it's wonder another linux box with the same > configuration is running allright. > > Thanks for any help. > > Hodaka > >
RE: What is up with surbl.org?
> -Original Message- > From: Jeff Chan [mailto:[EMAIL PROTECTED] > Sent: vrijdag 3 december 2004 7:51 > To: SpamAssassin Users > Subject: Re: What is up with surbl.org? > > >> Perhaps he should. Seriously, I heavily rely on the rating. > >> cloudmark.com data; surbl.org should *never* have been in there. > >> The folks at cloudmark really need to manually inspect their entries; > >> next thing this list has a bad rep too. > > > Hi Mark, > > I've not familiar with Cloudmark. Would you mind contacting them > > for us, with some of the possible explanations why they probably > > have an error, as already mentioned here? > > FWIW I tried to send a note to Vipul. No idea if he will get it. rating.cloudmark.com is a new reputation service. In general, I am quite happy with them. I will contact them, too. > Mark, it could still help if you contact Cloudmark for us, since > you're a customer of theirs and familiar with the issues. FWIW > I can't email you: > > >- The following addresses had permanent fatal errors - > > <[EMAIL PROTECTED]> > > (reason: 550 5.7.1 <[EMAIL PROTECTED]>... Cloudmark > Status of MAIL FROM Domain [surbl.org]: Bad) > > > >- Transcript of session follows - > > ... while talking to mail.asarian-host.net.: > MAIL From:<[EMAIL PROTECTED]> SIZE=1648 > > <<< 550 5.7.1 <[EMAIL PROTECTED]>... Cloudmark Status of MAIL > FROM Domain [surbl.org]: Bad 554 5.0.0 Service unavailable That just goes to show never to rely too heavily on a reputation service, no matter how reputable they may be. :) - Mark System Administrator Asarian-host.org --- "If you were supposed to understand it, we wouldn't call it code." - FedEx
Re: spamd does not start
jdow wrote:
(B> From: "alan premselaar" <[EMAIL PROTECTED]>
(B> To: "xoops$B
(B> Cc:
(B> Sent: 2004 December, 02, Thursday 23:27
(B> Subject: Re: spamd does not start
(B>
(B>
(B>
(B>>xoops$B>
(B>>>Hi,
(B>>>
(B>>>I have newly installed spamassassin-3.0.1 into linux box 2.4.18-22
(B>
(B> running qmail with qmail-queue patch.
(B>
(B>>>Having a trouble to start spamd with SPAMDOPTIONS="-x -u spamd -H
(B>
(B> /home/spamd -d":
(B>
(B>>> "Starting spamd: Bareword "SO_REUSEPORT" not allowed while "strict
(B>
(B> subs" in use at /usr/lib/perl5/5.6.1/IO/Socket/INET.pm line 160.
(B>
(B>>>Compilation failed in require at
(B>
(B> /usr/lib/perl5/5.6.1/i386-linux-thread-multi/IO/Socket.pm line 21.
(B>
(B>>>Compilation failed in require at /usr/bin/spamd line 38.
(B>>>BEGIN failed--compilation aborted at /usr/bin/spamd line 38.
(B>>>
(B>>>I installed prerequisited modules, HTML::Parser, DB_File Net::DNS,
(B>
(B> BerkeleyDB, Net::SMTP, Mail::SPF::Query, IP::Country::Fast.
(B>
(B>>>And it's wonder another linux box with the same configuration is
(B>
(B> running allright.
(B>
(B>>>Thanks for any help.
(B>>>
(B>>>Hodaka
(B>>>
(B>>
(B>>Hodaka-san,
(B>>
(B>> what version of IO::Socket do you have installed? you may need to
(B>>update it. I haven't personally experienced this problem, but i've got
(B>>the latest IO::Socket installed from CPAN.
(B>>
(B>>hope this helps
(B>>
(B>>alan
(B>
(B>
(B> Please, could you use a smaller font. This one spreads the message all over
(B> my screen and I can't read it. It's like
(B> one word per line.
(B>
(B> {O.O}(And that's sarcasm if you don't get it.)
(B>
(B>
(Bdon't know what you're talking about. I only use plain text email so
(Bthere shouldn't be any font size control. The only thing I can think of
(Bis that in replying to the original message, the charset (ISO-2022-JP)
(Bwas retained and perhaps you have really small fonts settings for
(BISO-2022-JP type mail in your mail client :p
(B
(Balan
how to debug/diagnose a tight loop?
I'm running a number of SA2.64 and spampd instances - every now and then one the children spawned will enter a tight loop. Not being much of a Perl programmer, I'm at a loss when it comes to debugging and/or diagnosing this - it is not reproducable, except it happens perhaps 1-2/week. I would prefer to fix the problem rather than writing a little watchdog to keep an eye on spampd/SA. (which would be the easy way out for me). Can I eg. kill such a looping thread and get a coredump I can gdb or something? thanks, Per -- Per Jessen, Zurich Let your spam stop here -- http://www.spamchek.com
Re: reporting to bogusmx at rfc-ignorant
Daryl C. W. O'Shea wrote: Andrzej Adam Filip wrote: Would it be possible to make spamassassin sumbit candidates to bogusmx list at RFC-Ingorant.org? RFC-Ignorant submissions are supposed to be by hand ONLY. http://www.rfc-ignorant.org/policy.php "Also, before a site is submitted, the submitter must have made a due diligence effort to notify the system maintainer of the problem. In some cases, this may be impossible, and this is understood, but some effort must have been made." bogusmx is the only RFC-Ignorant list that checks/confirms listings automatically - it was designed to behave this way. It makes it "slightly" different than other RFCI lists. To cut short this discussion I have also asked for opinions/comments (about auto submissions to bogusmx by spamassassin) at the RFCI mailing list. -- Andrzej [en:Andrew] Adam Filip [EMAIL PROTECTED] [EMAIL PROTECTED] Home Page http://anfi.homeunix.net/ [ PageRank 6 ]
Re: Fetchmail, Spamassassin, and Maildrop
On Friday 03 December 2004 06:39, Rob Blomquist might have typed: > I have been working on getting Fetchmail, Spamassassin, and maildrop to > work together to allow me to download my mail by fetchmail, pass it through > spamassassin, and then let maildrop drop it in a place where I can let > Kmail pick it up, and run all its filters on the mail (I have like 20 > filters), including SA. >user '**' there with password '' is 'robbo' here > mda /usr/bin/maildrop The fact that you use maildrop as the MDA means that maildrop will deal with the message (SA it etc) before it ever gets written to the spool, so KMail will not see it before SA sees it.
reporting to bogusmx at rfc-ignorant
Would it be possible to make spamassassin sumbit candidates to bogusmx list at RFC-Ingorant.org? Subissions are possible via web form (HTTP::Form ?) or email. http://www.rfc-ignorant.org/policy-bogusmx.php http://www.rfc-ignorant.org/tools/submit_form.php?table=bogusmx -- Andrzej [en:Andrew] Adam Filip [EMAIL PROTECTED] [EMAIL PROTECTED] Home Page http://anfi.homeunix.net/ [ PageRank 6 ]
Re: spamd does not start
My IO::Socket version is 1.26 which is up to date, CPAN says. Alan, is my font readable in your screen ? Thanks. > > Hi, > > > > I have newly installed spamassassin-3.0.1 into linux box 2.4.18-22 running > > qmail with qmail-queue patch. > > Having a trouble to start spamd with SPAMDOPTIONS="-x -u spamd -H > > /home/spamd -d": > > > > "Starting spamd: Bareword "SO_REUSEPORT" not allowed while "strict subs" > > in use at /usr/lib/perl5/5.6.1/IO/Socket/INET.pm line 160. > > Compilation failed in require at > > /usr/lib/perl5/5.6.1/i386-linux-thread-multi/IO/Socket.pm line 21. > > Compilation failed in require at /usr/bin/spamd line 38. > > BEGIN failed--compilation aborted at /usr/bin/spamd line 38. > > > > I installed prerequisited modules, HTML::Parser, DB_File Net::DNS, > > BerkeleyDB, Net::SMTP, Mail::SPF::Query, IP::Country::Fast. > > And it's wonder another linux box with the same configuration is running > > allright. > > > > Thanks for any help. > > > > Hodaka > > > > Hodaka-san, > > what version of IO::Socket do you have installed? you may need to > update it. I haven't personally experienced this problem, but i've got > the latest IO::Socket installed from CPAN. > > hope this helps > > alan > [EMAIL PROTECTED]
Re: Fetchmail, Spamassassin, and Maildrop
I have a similar setup, however, I do not use or prefer client side rules. I prefer to write all of my rules in procmail, because I use several different imap clients, depending on my location. I'm not familiar with maildrop, so this message is biased. But, with procmail, you can run your mails through spamc before they reach /var/spool/mail/robbo, which would make it impossible for kmail to get to the messages before SA. This would be more efficient, in my opinion. Here's a simple .procmailrc example that will run messages less than 256K through spamc. You could probably do the same with maildrop. :0fw * < 256000 | /path/to/spamc :0: * ^X-Spam-Status: Yes $MAILDIR/spam This would send only non-spam messages to /var/spool/mail/robbo for kmail. Also, If you're using imap, and your kmail rules are strictly for sorting, rewrite them in procmail -- you'll be much happier. Brian Byers [EMAIL PROTECTED] Rob Blomquist wrote: I have been working on getting Fetchmail, Spamassassin, and maildrop to work together to allow me to download my mail by fetchmail, pass it through spamassassin, and then let maildrop drop it in a place where I can let Kmail pick it up, and run all its filters on the mail (I have like 20 filters), including SA. I am thinking that this is going to have fetchmail grab my mail and drop it in /var/spool/mail/robbo, then maildrop will invoke spamc to mark it while it sits in /var/spool/mail/robbo. I would like to have it moved to another location (say, ~/.markedmail) so that kmail can grab it at its leisure and filter it into my directories. What would I need to do to invoke that? Is there an easier way to handle this fetchmail and spamassassin alone? The reason I want to change directories is to avoid the probability that mail is picked up by fetchmail and uploaded by kmail before SA has had its turn with it. Your thoughts? I am not all that familiar with MDAs and would like some second comments before I proceed. Rob ~/.fetchmailrc: # Configuration created Tue Oct 19 23:20:59 2004 by fetchmailconf set postmaster "postmaster" set bouncemail set no spambounce set properties "" set daemon 5 poll incoming.verizon.net with proto POP3 user '**' there with password '' is 'robbo' here mda /usr/bin/maildrop ~/.mailfilter: logfile "~/logs/maildroplog" `reformail -D 8192 .duplicate.cache` if ( $RETURNCODE == 0 ) exit if ($SIZE > 0) xfilter "spamc"
Re: spamd does not start
From: "alan premselaar" <[EMAIL PROTECTED]>
(BTo: "xoops$B
(BCc:
(BSent: 2004 December, 02, Thursday 23:27
(BSubject: Re: spamd does not start
(B
(B
(B> xoops$B > Hi,
(B> >
(B> > I have newly installed spamassassin-3.0.1 into linux box 2.4.18-22
(Brunning qmail with qmail-queue patch.
(B> > Having a trouble to start spamd with SPAMDOPTIONS="-x -u spamd -H
(B/home/spamd -d":
(B> >
(B> > "Starting spamd: Bareword "SO_REUSEPORT" not allowed while "strict
(Bsubs" in use at /usr/lib/perl5/5.6.1/IO/Socket/INET.pm line 160.
(B> > Compilation failed in require at
(B/usr/lib/perl5/5.6.1/i386-linux-thread-multi/IO/Socket.pm line 21.
(B> > Compilation failed in require at /usr/bin/spamd line 38.
(B> > BEGIN failed--compilation aborted at /usr/bin/spamd line 38.
(B> >
(B> > I installed prerequisited modules, HTML::Parser, DB_File Net::DNS,
(BBerkeleyDB, Net::SMTP, Mail::SPF::Query, IP::Country::Fast.
(B> > And it's wonder another linux box with the same configuration is
(Brunning allright.
(B> >
(B> > Thanks for any help.
(B> >
(B> > Hodaka
(B> >
(B>
(B> Hodaka-san,
(B>
(B> what version of IO::Socket do you have installed? you may need to
(B> update it. I haven't personally experienced this problem, but i've got
(B> the latest IO::Socket installed from CPAN.
(B>
(B> hope this helps
(B>
(B> alan
(B
(BPlease, could you use a smaller font. This one spreads the message all over
(Bmy screen and I can't read it. It's like
(Bone word per line.
(B
(B{O.O}(And that's sarcasm if you don't get it.)
Re: spamd does not start
xoops$B Hi, (B> (B> I have newly installed spamassassin-3.0.1 into linux box 2.4.18-22 running (B> qmail with qmail-queue patch. (B> Having a trouble to start spamd with SPAMDOPTIONS="-x -u spamd -H /home/spamd (B> -d": (B> (B> "Starting spamd: Bareword "SO_REUSEPORT" not allowed while "strict subs" in (B> use at /usr/lib/perl5/5.6.1/IO/Socket/INET.pm line 160. (B> Compilation failed in require at (B> /usr/lib/perl5/5.6.1/i386-linux-thread-multi/IO/Socket.pm line 21. (B> Compilation failed in require at /usr/bin/spamd line 38. (B> BEGIN failed--compilation aborted at /usr/bin/spamd line 38. (B> (B> I installed prerequisited modules, HTML::Parser, DB_File Net::DNS, (B> BerkeleyDB, Net::SMTP, Mail::SPF::Query, IP::Country::Fast. (B> And it's wonder another linux box with the same configuration is running (B> allright. (B> (B> Thanks for any help. (B> (B> Hodaka (B> (B (BHodaka-san, (B (B what version of IO::Socket do you have installed? you may need to (Bupdate it. I haven't personally experienced this problem, but i've got (Bthe latest IO::Socket installed from CPAN. (B (Bhope this helps (B (Balan
spamd does not start
Hi, (B (BI have newly installed spamassassin-3.0.1 into linux box 2.4.18-22 running (Bqmail with qmail-queue patch. (BHaving a trouble to start spamd with SPAMDOPTIONS="-x -u spamd -H /home/spamd (B-d": (B (B "Starting spamd: Bareword "SO_REUSEPORT" not allowed while "strict subs" in (Buse at /usr/lib/perl5/5.6.1/IO/Socket/INET.pm line 160. (BCompilation failed in require at (B/usr/lib/perl5/5.6.1/i386-linux-thread-multi/IO/Socket.pm line 21. (BCompilation failed in require at /usr/bin/spamd line 38. (BBEGIN failed--compilation aborted at /usr/bin/spamd line 38. (B (BI installed prerequisited modules, HTML::Parser, DB_File Net::DNS, BerkeleyDB, (BNet::SMTP, Mail::SPF::Query, IP::Country::Fast. (BAnd it's wonder another linux box with the same configuration is running (Ballright. (B (BThanks for any help. (B (BHodaka
Re: What is up with surbl.org?
On Thursday, December 2, 2004, 9:57:28 PM, Jeff Chan wrote: > On Thursday, December 2, 2004, 1:14:33 PM, Mark Mark wrote: >>> -Original Message- >>> From: Chris Santerre [mailto:[EMAIL PROTECTED] >>> Sent: donderdag 2 december 2004 21:56 >>> To: 'Mark'; SURBL Discussion list (E-mail) >>> Subject: RE: What is up with surbl.org? >>> >>> > How come surbl.org has a "Bad" status at rating.cloudmark.com? (see >>> > below). This is not good. >>> Perhaps Jeff should contact them with a "What up, dude?" email? >> Perhaps he should. Seriously, I heavily rely on the rating.cloudmark.com >> data; surbl.org should *never* have been in there. The folks at cloudmark >> really need to manually inspect their entries; next thing this list has a >> bad rep too. > Hi Mark, > I've not familiar with Cloudmark. Would you mind contacting them > for us, with some of the possible explanations why they probably > have an error, as already mentioned here? FWIW I tried to send a note to Vipul. No idea if he will get it. Mark, it could still help if you contact Cloudmark for us, since you're a customer of theirs and familiar with the issues. FWIW I can't email you: >- The following addresses had permanent fatal errors - > <[EMAIL PROTECTED]> > (reason: 550 5.7.1 <[EMAIL PROTECTED]>... Cloudmark Status of MAIL FROM > Domain [surbl.org]: Bad) > >- Transcript of session follows - > ... while talking to mail.asarian-host.net.: MAIL From:<[EMAIL PROTECTED]> SIZE=1648 > <<< 550 5.7.1 <[EMAIL PROTECTED]>... Cloudmark Status of MAIL FROM Domain > [surbl.org]: Bad > 554 5.0.0 Service unavailable Jeff C. -- Jeff Chan mailto:[EMAIL PROTECTED] http://www.surbl.org/
Fetchmail, Spamassassin, and Maildrop
I have been working on getting Fetchmail, Spamassassin, and maildrop to work together to allow me to download my mail by fetchmail, pass it through spamassassin, and then let maildrop drop it in a place where I can let Kmail pick it up, and run all its filters on the mail (I have like 20 filters), including SA. I am thinking that this is going to have fetchmail grab my mail and drop it in /var/spool/mail/robbo, then maildrop will invoke spamc to mark it while it sits in /var/spool/mail/robbo. I would like to have it moved to another location (say, ~/.markedmail) so that kmail can grab it at its leisure and filter it into my directories. What would I need to do to invoke that? Is there an easier way to handle this fetchmail and spamassassin alone? The reason I want to change directories is to avoid the probability that mail is picked up by fetchmail and uploaded by kmail before SA has had its turn with it. Your thoughts? I am not all that familiar with MDAs and would like some second comments before I proceed. Rob ~/.fetchmailrc: # Configuration created Tue Oct 19 23:20:59 2004 by fetchmailconf set postmaster "postmaster" set bouncemail set no spambounce set properties "" set daemon 5 poll incoming.verizon.net with proto POP3 user '**' there with password '' is 'robbo' here mda /usr/bin/maildrop ~/.mailfilter: logfile "~/logs/maildroplog" `reformail -D 8192 .duplicate.cache` if ( $RETURNCODE == 0 ) exit if ($SIZE > 0) xfilter "spamc" -- Mountlake Terrace, WA USA
Re: SURBL Reporting/Scoring Question
On Thursday, December 2, 2004, 1:15:14 PM, Tim Donahue wrote: > I was wondering if subdomains need to be reported for SURBL rules to get > triggered. I just found an address in a spam that I grabbed from one of > my umm... "throw away" accounts that is a subdomain of a domain that is > listed in the SURBL lists. I was using the spam (on that is advertizing > software at discount rates) to test my new SA 3.01 setup and I when that > the following domain wasn't triggering the SURBL rules even though its > parent was listed. SURBL applications are supposed to strip URI domains down to a base, registrar domain. If they do that, then they should match. What was the full URI please?Munge it if needed. Jeff C. -- Jeff Chan mailto:[EMAIL PROTECTED] http://www.surbl.org/
Re: What is up with surbl.org?
On Thursday, December 2, 2004, 1:14:33 PM, Mark Mark wrote: >> -Original Message- >> From: Chris Santerre [mailto:[EMAIL PROTECTED] >> Sent: donderdag 2 december 2004 21:56 >> To: 'Mark'; SURBL Discussion list (E-mail) >> Subject: RE: What is up with surbl.org? >> >> > How come surbl.org has a "Bad" status at rating.cloudmark.com? (see >> > below). This is not good. >> > >> >> Jealousy? :) Maybe they are related to that fifth dentist? >> >> Perhaps Jeff should contact them with a "What up, dude?" email? > Perhaps he should. Seriously, I heavily rely on the rating.cloudmark.com > data; surbl.org should *never* have been in there. The folks at cloudmark > really need to manually inspect their entries; next thing this list has a > bad rep too. > - Mark > System Administrator Asarian-host.org Hi Mark, I've not familiar with Cloudmark. Would you mind contacting them for us, with some of the possible explanations why they probably have an error, as already mentioned here? Jeff C. -- Jeff Chan mailto:[EMAIL PROTECTED] http://www.surbl.org/
RE: SURBLS
Yeah we pretty much did, but I was replying to his response. I am going to fix my syntax stuff and then run it for a while and see if I have any changes. Thanks, --Mike -Original Message- From: Dallas L. Engelken [mailto:[EMAIL PROTECTED] Sent: Thursday, December 02, 2004 9:13 PM To: SpamAssassin Users Subject: RE: SURBLS > Here is everything I got from debug. I ran it as root so there is a > Bayes error that normally wouldn't pop up. > Mike, didn't we already rule out SA off-list? You might want to try the MIMEDefang list. d
RE: SURBLS
> Here is everything I got from debug. I ran it as root so > there is a Bayes error that normally wouldn't pop up. > Mike, didn't we already rule out SA off-list? You might want to try the MIMEDefang list. d
RE: SURBLS
At 09:35 PM 12/2/2004, Mike Carlson wrote: debug: config: SpamAssassin failed to parse line, skipping: rewrite_subject 1 debug: config: SpamAssassin failed to parse line, skipping: subject_tag (SPAM) _HITS_ debug: config: SpamAssassin failed to parse line, skipping: use_terse_report0 Suggestion: fix your syntax errors real quick by killing all of those lines. Those three are all obsolete. See the UPGRADE file for details on the rewrite_subject bit. While they may not sound bad, I've seen parse failures cause other oddities in SA's behavior in the past. debug: dns_available set to yes in config file, skipping test Ok, you've hardcoded dns_available.. debug: RBL: success for 1 of 1 queries Hmm, that looks not so good I get things more like: debug: RBL: success for 14 of 14 queries
RE: SURBLS
Here is everything I got from debug. I ran it as root so there is a Bayes error that normally wouldn't pop up. hades# spamd -D -p 800 | grep postcard trying to connect to syslog/unix... no error connecting to syslog/unix logging enabled: facility: mail socket: unix output: syslog creating INET socket: Listen: 128 LocalAddr: 127.0.0.1 LocalPort: 800 Proto: 6 ReuseAddr: 1 Type: 1 debug: SpamAssassin version 3.0.1 debug: Score set 0 chosen. debug: Storable module v2.13 found debug: Preloading modules with HOME=/tmp/spamd-2121-init debug: ignore: test message to precompile patterns and load modules debug: using "/usr/local/etc/mail/spamassassin/init.pre" for site rules init.pre debug: config: read file /usr/local/etc/mail/spamassassin/init.pre debug: using "/usr/local/share/spamassassin" for default rules dir debug: config: read file /usr/local/share/spamassassin/10_misc.cf debug: config: read file /usr/local/share/spamassassin/20_anti_ratware.cf debug: config: read file /usr/local/share/spamassassin/20_body_tests.cf debug: config: read file /usr/local/share/spamassassin/20_compensate.cf debug: config: read file /usr/local/share/spamassassin/20_dnsbl_tests.cf debug: config: read file /usr/local/share/spamassassin/20_drugs.cf debug: config: read file /usr/local/share/spamassassin/20_fake_helo_tests.cf debug: config: read file /usr/local/share/spamassassin/20_head_tests.cf debug: config: read file /usr/local/share/spamassassin/20_html_tests.cf debug: config: read file /usr/local/share/spamassassin/20_meta_tests.cf debug: config: read file /usr/local/share/spamassassin/20_phrases.cf debug: config: read file /usr/local/share/spamassassin/20_porn.cf debug: config: read file /usr/local/share/spamassassin/20_ratware.cf debug: config: read file /usr/local/share/spamassassin/20_uri_tests.cf debug: config: read file /usr/local/share/spamassassin/23_bayes.cf debug: config: read file /usr/local/share/spamassassin/25_body_tests_es.cf debug: config: read file /usr/local/share/spamassassin/25_hashcash.cf debug: config: read file /usr/local/share/spamassassin/25_spf.cf debug: config: read file /usr/local/share/spamassassin/25_uribl.cf debug: config: read file /usr/local/share/spamassassin/30_text_de.cf debug: config: read file /usr/local/share/spamassassin/30_text_fr.cf debug: config: read file /usr/local/share/spamassassin/30_text_nl.cf debug: config: read file /usr/local/share/spamassassin/30_text_pl.cf debug: config: read file /usr/local/share/spamassassin/50_scores.cf debug: config: read file /usr/local/share/spamassassin/60_whitelist.cf debug: using "/usr/local/etc/mail/spamassassin" for site rules dir debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_adult.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_bayes_poison_nxm.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_genlsubj.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_genlsubj_eng.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_header.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_header_eng.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_highrisk.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_html.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_html4.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_html_eng.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_oem.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_random.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_ratware.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_specific.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_spoof.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_unsub.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_uri.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sc_top200.cf debug: config: read file /usr/local/etc/mail/spamassassin/72_sare_bml_post25x.cf debug: config: read file /usr/local/etc/mail/spamassassin/72_sare_redirect_post3.0.0.cf debug: config: read file /usr/local/etc/mail/spamassassin/99_sare_fraud_post25x.cf debug: config: read file /usr/local/etc/mail/spamassassin/evilnumbers.cf debug: config: read file /usr/local/etc/mail/spamassassin/local.cf debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC debug: plugin: registered Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8c7c6d0) debug: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC debug: plugin: registered Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8c3587c) debug: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC debug: plugin: registered Mail::SpamAssassin::Plugin::SPF=HASH(0x8c36f2c) debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x8c7c6d0) impleme
RE: SURBLS
At 07:47 PM 12/2/2004, Mike Carlson wrote: debug: URIDNSBL: domains to query: debug: is Net::DNS::Resolver available? yes debug: Net::DNS version: 0.48 debug: all '*From' addrs: [EMAIL PROTECTED] Ok, that much is good. We can tell you did install Net::DNS and you have a recent version. However, from those lines we still can't tell if DNS works.. Did you get this line anywhere in your debug output: debug: is DNS available? 1 Or can you at least try a test resolve using host on the command line? $ host test.surbl.org.multi.surbl.org test.surbl.org.multi.surbl.org has address 127.0.0.2
Re: SURBLS
On Thursday, December 2, 2004, 4:47:59 PM, Mike Carlson wrote: > Here is a snippet of what I got: > debug: URIDNSBL: domains to query: > debug: is Net::DNS::Resolver available? yes > debug: Net::DNS version: 0.48 > debug: all '*From' addrs: [EMAIL PROTECTED] Looks like 0.48 is the latest Net::DNS and should be fine. Your other options sound good. FWIW quite a few of these questions are in the SURBL FAQ: http://www.surbl.org/faq.html#nettest Perhaps it may have some other things to try. Jeff C. -- Jeff Chan mailto:[EMAIL PROTECTED] http://www.surbl.org/
Re: SURBLS
On Thursday, December 2, 2004, 12:18:19 PM, Mike Carlson wrote: > If I run that command I get this: > hades# spamd -D -p 800 2>&1 | grep postcard > Ambiguous output redirect. > hades# > --Mike What shell are you using? Standard output and error redirection syntax is a little different between shells. (ssh doesn't describe the shell you're using when you log in interactively; root shells are often sh or bash or tcsh.) See for example: http://sc.tamu.edu/help/general/unix/redirection.html or the manual pages. ;-) Jeff C. -- Jeff Chan mailto:[EMAIL PROTECTED] http://www.surbl.org/
Re: How to block rolex spam
Same as I am - hmm.
ok, check the /etc/mail/spamassassin.init.pre file for this list
loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
Andrew Xiang wrote:
3.01
- Original Message - From: "Tim Litwiller" <[EMAIL PROTECTED]>
To: "Andrew Xiang" <[EMAIL PROTECTED]>
Sent: Thursday, December 02, 2004 7:51 PM
Subject: Re: How to block rolex spam
which version of spamassassin are you using?
comment out the URIBL sections and then test again
Andrew Xiang wrote:
I failed lint when I added:
spamassassin --lint
config: SpamAssassin failed to parse line, skipping: urirhssub
URIBL_JP_SURBL multi.surbl.org.A 64
Failed to run URIBL_JP_SURBL SpamAssassin test, skipping:
(Can't locate object method "check_uridnsbl" via package
"Mail::SpamAssassin::PerMsgStatus" (perhaps you forgot to load
"Mail::SpamAssassin::PerMsgStatus"?) at
/usr/local/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin/PerMsgStatus.pm
line
2296.
)
lint: 2 issues detected. please rerun with debug enabled for more
information.
local.cf:
urirhssub URIBL_JP_SURBL multi.surbl.org.A 64
body URIBL_JP_SURBL eval:check_uridnsbl('URIBL_JP_SURBL')
describe URIBL_JP_SURBL Has URI in JP at
http://www.surbl.org/lists.html
tflagsURIBL_JP_SURBL net
score URIBL_JP_SURBL4.0
- Original Message - From: "Tim Litwiller" <[EMAIL PROTECTED]>
To: "Andrew Xiang" <[EMAIL PROTECTED]>
Sent: Thursday, December 02, 2004 4:44 PM
Subject: Re: How to block rolex spam
It is a personal preference - I think it helps some but i wouldn't use
it as the only bayes learning
The SURBL plugin in SA 3* take urls found in email and compares
those to
a url black list - if the url of an advertised site is listed in SURBL
it is most likely spam
The rules are already in 3.0 but they are scored way to low.
Andrew Xiang wrote:
is it a good idea to autolearn, the key file can get pretty large?
And what are those blacklist? how does it work?
# set bayes autolearning levels
bayes_auto_learn_threshold_nonspam -2.0
bayes_auto_learn_threshold_spam8.0
# blacklist
#
urirhssub URIBL_PH_SURBL multi.surbl.org.A 8
headerURIBL_PH_SURBL eval:check_uridnsbl('URIBL_PH_SURBL')
describe URIBL_PH_SURBL Contains a URL listed in PH
tflagsURIBL_PH_SURBL net
score URIBL_PH_SURBL5.0
urirhssub URIBL_JP_SURBL multi.surbl.org.A 64
headerURIBL_JP_SURBL eval:check_uridnsbl('URIBL_JP_SURBL')
describe URIBL_JP_SURBL Contains a URL listed in JP
tflagsURIBL_JP_SURBL net
score URIBL_JP_SURBL4.0
#-
#Global WBL entries
whitelist_from [EMAIL PROTECTED]
#-
---snip---
Andrew Xiang wrote:
can you send me your local.cf file?
thanks
Andrew
- Original Message - From: "Tim Litwiller"
<[EMAIL PROTECTED]>
To: "Andrew Xiang" <[EMAIL PROTECTED]>
Sent: Thursday, December 02, 2004 3:23 PM
Subject: Re: How to block rolex spam
in you local.cf file add lines like
score RCVD_IN_BL_SPAMCOP_NET #
score RCVD_IN_DSBL #
score RCVD_IN_SORBS_HTTP #
score RCVD_IN_SORBS_MISC #
where # is the score you want that rule to use
I have spamcop at 5
dsbl at 3.8
and I'm not using sorbs so I don't know what those actually
contribure
to the score.
I did look thru the rolex spam in my quarentine and they average a
score
of 29.7
here are the SA headers from an averave rolex spam - Note the
SURBL is
really pushing the score up on the linked domain.
X-Spam-Prev-Subject: Order Rolex or other Swiss watches online
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on
mailhost.bccwebhosting.com
X-Spam-DCC: xmailer: mailhost 1192; Body=many Fuz1=many Fuz2=many
X-Spam-Report:
* 1.9 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
* [score: 1.]
* 3.0 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
* 3.8 RCVD_IN_DSBL RBL: Received via a relay in list.dsbl.org
* []
* 5.0 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in
bl.spamcop.net
* [Blocked - see
]
* 1.0 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
* []
* 0.0 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web
server
* [84.24.207.174 listed in dnsbl.sorbs.net]
* 2.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP
address
* [84.24.207.174 listed in dnsbl.sorbs.net]
* 1.0 URIBL_SBL Contains an URL listed in the SBL blocklist
* [URIs: bhex.com]
* 4.3 URIBL_SC_SURBL Contains an URL listed in the SC SURBL
blocklist
* [URIs: bhex.com]
* 1.5 URIBL_WS_SURBL Contains an URL listed in the WS SURBL
blocklist
* [URIs: bhex.com]
* 3.2 URIBL_OB_SURBL Contains an URL listed in the OB SURBL
blocklist
* [URIs: bhex.com]
* 0.4 URIBL_AB_SURBL Contains an URL listed in the AB SURBL
blocklist
*
RE: SURBLS
Here is a snippet of what I got: debug: URIDNSBL: domains to query: debug: is Net::DNS::Resolver available? yes debug: Net::DNS version: 0.48 debug: all '*From' addrs: [EMAIL PROTECTED] --Mike -Original Message- From: Matt Kettler [mailto:[EMAIL PROTECTED] Sent: Thursday, December 02, 2004 6:30 PM To: Mike Carlson; users@spamassassin.apache.org Subject: RE: SURBLS At 06:13 PM 12/2/2004, Mike Carlson wrote: >I have Net::DNS installed. > >It's a FreeBSD 4.9 with SA being called by MIMEDefang. > >I am not sure if any of the RBL stuff is working. I figured I would >work on one thing at a time. Well, I'd start with at least verifying you have a fully working DNS setup for SA to work with: Try running spamassasssin --lint -D and look for lines like these: debug: is Net::DNS::Resolver available? yes debug: trying (3) gmx.net... debug: looking up MX for 'gmx.net' debug: MX for 'gmx.net' exists? 1 debug: MX lookup of gmx.net succeeded => Dns available (set dns_available to hardcode) debug: is DNS available? 1 In particular, the "is DNS available? 1" is important. If SA concludes 0 here, then no RBLS or URIBLS will work.
RE: SURBLS
At 06:13 PM 12/2/2004, Mike Carlson wrote: I have Net::DNS installed. It's a FreeBSD 4.9 with SA being called by MIMEDefang. I am not sure if any of the RBL stuff is working. I figured I would work on one thing at a time. Well, I'd start with at least verifying you have a fully working DNS setup for SA to work with: Try running spamassasssin --lint -D and look for lines like these: debug: is Net::DNS::Resolver available? yes debug: trying (3) gmx.net... debug: looking up MX for 'gmx.net' debug: MX for 'gmx.net' exists? 1 debug: MX lookup of gmx.net succeeded => Dns available (set dns_available to hardcode) debug: is DNS available? 1 In particular, the "is DNS available? 1" is important. If SA concludes 0 here, then no RBLS or URIBLS will work.
RE: Understanding the AWL (was Upgrade to 3.0.1 results in false
At 06:10 PM 12/2/2004, Aaron Grewell wrote: Nevermind. I found it in the list archives. Excellent. I applaud you for being a user who is really willing to try to help themselves (along with other users who do the same) Also, for future reference, the wiki on the spamassassin website can be a real treasure trove of information.
Re: Is it not recommanded to learn a message already flaged as spam?
On Thu, Dec 02, 2004 at 10:04:27AM -0500, Matt Kettler wrote: > At 10:17 AM 12/2/2004 +0100, Nicolas wrote: > >With mutt, I'd like to define a macro which learn the mail as spam, > >report it to razor, and delete it. > > > >I'd like to know if it is not recommanded to learn a mail as spam, while > >it's already flaged as spam by SA? > > It IS recommended to learn mail that's already been flagged. Even if it's > flagged BAYES_99 SA can still learn worthwhile tokens from a message. > > sa-learn recognizes SA's own spam tags, and will automatically strip those > out before learning it. > > The only thing I'd avoid in training messages is I'd not intentionally > train the same message twice. But even this is only because it's a minor > waste of time.. SA will just ignore them, no harm done, but it's pointless > to go out of your way to retrain the same message. > > Also, if you use spamassassin -r on the message, it will strip tags, learn > as spam, and report it to razor, spamcop and any other hash systems you > have installed (ie: dcc or pyzor.) > > So all your macro needs to do is call spamssassin -r delete the message. Thanks for the help, guys! Nicolas -- --- OxStOnE -- O - Z750 & Linux --- ._ /\_> --- Powered -- (x)> (x) ~~~
