Re: bayes sql error.

2006-07-21 Thread Loren Wilton

Is there a LANG=UTF-8 or some such setting that you could maybe use?

   Loren



Razor - Does it Work thru Spamc

2006-07-21 Thread John Andersen
I've been looking for any indication that Razor hit on any spam I've received.

Grepping /var/log/mail, I never see that razor has ever shown up in the list 
of tests per the spamd output.

I have Razor 2.82 installed, registered and tested.  If I hand feed it spam it
properly indicates a spam status.  It even lets me report spam thru
razor via spamassassin -r

But my razor logs show no entries or indication that razor was used, and no
mail has razor reports in the headers. 

Spamassassin 3.13 --lint --debug indicates that it is calling razor.

Setting my procmailrc script to call spamassassin directly instead
of spamc cause my razor logs to indicate razor is being hit.

I remember this issue several versions ago, but thought it was
fixed and that spamc would do everything spamassassin would
do.

-- 
_
John Andersen


pgpweIL4qW1eS.pgp
Description: PGP signature


Rule for mail contains bad email ids

2006-07-21 Thread Ramprasad
There are now a few spams passing thru with plain emailids ( not mailto
links ) 

There is noting else in the mail  that can be caught. How can I check
such ids

Show I do a body check after all
Thanks
Ram


Sample spam mail 

---
I have a new email address!
You can now email me at: [EMAIL PROTECTED]

Sir/MA 


I am Abbott Hayes Iam contacting you on business transaction of US$23M 

into a safe AC

- abbott hayes

--





Re: Razor - Does it Work thru Spamc (NEVER MIND)

2006-07-21 Thread John Andersen
On Thursday 20 July 2006 23:49, John Andersen wrote:
 
 Setting my procmailrc script to call spamassassin directly instead
 of spamc cause my razor logs to indicate razor is being hit.

Doh!

Yast still sets spamd to run with the -L flag.

I knew I'd seen this before...


-- 
_
John Andersen


pgp1NLYIrB1QQ.pgp
Description: PGP signature


Bayes Always On

2006-07-21 Thread Duane Hill
I recently upgraded SA to v3.1.3 on FreeBSD 6.0. I have also ran 
sa-update.


I have found that no matter what I do to the local.cf with turning off 
bayes, it is still being used. I have searched the system over and have 
only found local.cf contained within /etc/mail/spamassassin.


Any ideas?

--
This message was sent using 100% recycled electrons.


RE: Rule for mail contains bad email ids

2006-07-21 Thread Michael Scheidell
 -Original Message-
 From: Ramprasad [mailto:[EMAIL PROTECTED] 
 Sent: Friday, July 21, 2006 4:16 AM
 To: spamassassin-users
 Subject: Rule for mail contains bad email ids
 
 
 There are now a few spams passing thru with plain emailids ( 
 not mailto links ) 
 
 There is noting else in the mail  that can be caught. How can 
 I check such ids
 
 Show I do a body check after all

That's like playing whack-a-mole with spammers.
You would be entering in email addreses all day long.

Anything similar?
All yahoo.com.sg?
(all yahoo.com.[a-z]. ?

Also, feed them to bayes, feed them to dcc, razor and spamcop.
Eventually, they will hit enough points to be blocked by semi-automated
methods.

-- 
Michael Scheidell, CTO
561-999-5000, ext 1131
SECNAP Network Security Corporation
Keep up to date with latest information on IT security: Real time
security alerts: http://www.secnap.com/news


SpamAssassin on Windows(win32)

2006-07-21 Thread Haren Kodagoda

Dear All,

Has any one implemented SA 3.1.2 or 3 on MS Windows (win32)?
If so are they stable on win32?

Thanks in advance,
Haren.




RE: Bayes Always On

2006-07-21 Thread Bowie Bailey
Duane Hill wrote:
 I recently upgraded SA to v3.1.3 on FreeBSD 6.0. I have also ran
 sa-update.
 
 I have found that no matter what I do to the local.cf with turning off
 bayes, it is still being used. I have searched the system over and
 have only found local.cf contained within /etc/mail/spamassassin.
 
 Any ideas?

spamassassin -D config --lint

This will show you all of the configuration files that SA is reading.

Also, double-check that your mail processing is running the same SA as
your command line tests and that you are running as the same user.

-- 
Bowie


RE: Bayes Always On

2006-07-21 Thread Duane Hill

On Fri, 21 Jul 2006, Bowie Bailey wrote:


Duane Hill wrote:

I recently upgraded SA to v3.1.3 on FreeBSD 6.0. I have also ran
sa-update.

I have found that no matter what I do to the local.cf with turning off
bayes, it is still being used. I have searched the system over and
have only found local.cf contained within /etc/mail/spamassassin.

Any ideas?


spamassassin -D config --lint

This will show you all of the configuration files that SA is reading.

Also, double-check that your mail processing is running the same SA as
your command line tests and that you are running as the same user.


Thanks much! I was simply looking for local.cf. Had I been looking for 
local.cf.sample I would have found it. And, now that I think about it. I 
do remember seeing a number of messages posted to this list that did state 
the default is moved to /usr/local/etc/mail/spamassassin upon running 
sa-update. Sorry to have bothered.


--
This message was sent using 100% recycled electrons.


Re: Bayes Always On

2006-07-21 Thread Jim Maul

Duane Hill wrote:

On Fri, 21 Jul 2006, Bowie Bailey wrote:


Duane Hill wrote:

I recently upgraded SA to v3.1.3 on FreeBSD 6.0. I have also ran
sa-update.

I have found that no matter what I do to the local.cf with turning off
bayes, it is still being used. I have searched the system over and
have only found local.cf contained within /etc/mail/spamassassin.

Any ideas?


spamassassin -D config --lint

This will show you all of the configuration files that SA is reading.

Also, double-check that your mail processing is running the same SA as
your command line tests and that you are running as the same user.


Thanks much! I was simply looking for local.cf. Had I been looking for 
local.cf.sample I would have found it. And, now that I think about it. I 
do remember seeing a number of messages posted to this list that did 
state the default is moved to /usr/local/etc/mail/spamassassin upon 
running sa-update. Sorry to have bothered.





Wait, I thought SA loaded all .cf files automatically.  Now your telling 
me it loads .sample files as well?  Is this correct?


-Jim


RE: Bayes Always On

2006-07-21 Thread Bowie Bailey
Jim Maul wrote:
 Duane Hill wrote:
  On Fri, 21 Jul 2006, Bowie Bailey wrote:
  
   Duane Hill wrote:
I recently upgraded SA to v3.1.3 on FreeBSD 6.0. I have also
ran sa-update. 

I have found that no matter what I do to the local.cf with
turning off bayes, it is still being used. I have searched the
system over and have only found local.cf contained within
/etc/mail/spamassassin. 

Any ideas?
   
   spamassassin -D config --lint
   
   This will show you all of the configuration files that SA is
   reading. 
   
   Also, double-check that your mail processing is running the same
   SA as your command line tests and that you are running as the
   same user. 
  
  Thanks much! I was simply looking for local.cf. Had I been looking
  for local.cf.sample I would have found it. And, now that I think
  about it. I do remember seeing a number of messages posted to this
  list that did state the default is moved to
  /usr/local/etc/mail/spamassassin upon running sa-update. Sorry to
  have bothered. 
 
 Wait, I thought SA loaded all .cf files automatically.  Now your
 telling me it loads .sample files as well?  Is this correct?

No, it only loads the .cf and .pre files.

-- 
Bowie


Re: Bayes Always On

2006-07-21 Thread Duane Hill

On Fri, 21 Jul 2006, Jim Maul wrote:


Duane Hill wrote:

On Fri, 21 Jul 2006, Bowie Bailey wrote:


Duane Hill wrote:

I recently upgraded SA to v3.1.3 on FreeBSD 6.0. I have also ran
sa-update.

I have found that no matter what I do to the local.cf with turning off
bayes, it is still being used. I have searched the system over and
have only found local.cf contained within /etc/mail/spamassassin.

Any ideas?


spamassassin -D config --lint

This will show you all of the configuration files that SA is reading.

Also, double-check that your mail processing is running the same SA as
your command line tests and that you are running as the same user.


Thanks much! I was simply looking for local.cf. Had I been looking for 
local.cf.sample I would have found it. And, now that I think about it. I do 
remember seeing a number of messages posted to this list that did state the 
default is moved to /usr/local/etc/mail/spamassassin upon running 
sa-update. Sorry to have bothered.





Wait, I thought SA loaded all .cf files automatically.  Now your telling me 
it loads .sample files as well?  Is this correct?


No. I simply meant had I been looking either for a simular match to 
local.cf or local.cf.sample, I would have found where the new base was 
located. I was not implying local.cf.sample was being loaded. Sorry if 
that was the case.


--
This message was sent using 100% recycled electrons.


Re: SpamAssassin on Windows(win32)

2006-07-21 Thread Rob McEwen (PowerView Systems)
 Haren Kodagoda asked:
 Has any one implemented SA 3.1.2 or 3 on MS Windows (win32)?
 If so are they stable on win32?

Yes.

1st of all, there as been an emulation mode version out for a long time. But 
just last month someone ported it to native win32 code:

http://physics.ucsd.edu/~epivovar/anti-spam.htm

I've found this fully win32 port to be very stable in my testing... but I 
haven't yet battle tested it.

Rob McEwen
PowerView Systems
[EMAIL PROTECTED]



Re: SpamAssassin on Windows(win32)

2006-07-21 Thread Haren Kodagoda

Thanks Rob,

Have you run mass-check / nighty mass-check in it successfully, by any chance?

Thanks,
Haren.

At 07:20 PM 7/21/2006, Rob McEwen (PowerView Systems) wrote:

 Haren Kodagoda asked:
 Has any one implemented SA 3.1.2 or 3 on MS Windows (win32)?
 If so are they stable on win32?

Yes.

1st of all, there as been an emulation mode version out for a long time. 
But just last month someone ported it to native win32 code:


http://physics.ucsd.edu/~epivovar/anti-spam.htm

I've found this fully win32 port to be very stable in my testing... but 
I haven't yet battle tested it.


Rob McEwen
PowerView Systems
[EMAIL PROTECTED]





Re: Bayes Always On

2006-07-21 Thread Theo Van Dinter
On Fri, Jul 21, 2006 at 01:16:01PM +, Duane Hill wrote:
 local.cf.sample I would have found it. And, now that I think about it. I 
 do remember seeing a number of messages posted to this list that did state 
 the default is moved to /usr/local/etc/mail/spamassassin upon running 
 sa-update. Sorry to have bothered.

No, it's not.  sa-update changes where SA finds its default
rules (usually /usr/share/spamassassin -- afterwards becomes
/var/lib/spamassassin/version).  Your local site config (typically
/etc/mail/spamassassin) stays the same.

http://wiki.apache.org/spamassassin/RuleUpdates may be of use.

-- 
Randomly Generated Tagline:
A book is like a mirror.  If an ass peers in, you can't exactly expect
 an apostle to peer out.- Unknown


pgpmzGk8gjX6F.pgp
Description: PGP signature


Integration of SA, Messaging Server and LDAP

2006-07-21 Thread e2rd

Hi,

I try to integrate SA with Messaging Server.
I need to load white/black lists from LDAP.

In debug output from spamd I have:
ldap: entering handle_user_ldap(nobody)
config: load_scoreonly_ldap(nobody)
ldap: URL is
ldap://192.168.90.116:2389/ou=People,o=eranet.pl,o=eranet.pl?spamassassin?sub?uid=__USERNAME__
ldap: host=192.168.90.116, port=2389,
base='ou=People,o=eranet.pl,o=eranet.pl', attr=spamassassin, scope=sub,
filter='uid=nobody'

In spamd.log is:
info: spamd: checking message [EMAIL PROTECTED] for
(unknown):0

Why username is 'nobody' and not mail-to user?
What I need to configure to get proper username?
Any ideas?

Greetings
e2rd
-- 
View this message in context: 
http://www.nabble.com/Integration-of-SA%2C-Messaging-Server-and-LDAP-tf1980623.html#a5435031
Sent from the SpamAssassin - Users forum at Nabble.com.



Re: Bayes Always On

2006-07-21 Thread Duane Hill

On Fri, 21 Jul 2006, Theo Van Dinter wrote:


On Fri, Jul 21, 2006 at 01:16:01PM +, Duane Hill wrote:

local.cf.sample I would have found it. And, now that I think about it. I
do remember seeing a number of messages posted to this list that did state
the default is moved to /usr/local/etc/mail/spamassassin upon running
sa-update. Sorry to have bothered.


No, it's not.  sa-update changes where SA finds its default
rules (usually /usr/share/spamassassin -- afterwards becomes
/var/lib/spamassassin/version).  Your local site config (typically
/etc/mail/spamassassin) stays the same.

http://wiki.apache.org/spamassassin/RuleUpdates may be of use.


Then it was the install I ran from the ports collection in FreeBSD that 
caused the shift to /usr/local/etc. It was always running out of /etc 
prior to my installing via the ports collection. I had originally 
installed SA v3.1.1 via the download from spamassassin.apache.org.


--
This message was sent using 100% recycled electrons.


3.0.0 to 3.1.3 upgrade

2006-07-21 Thread Obantec Support
Hi

is they anything i need to watch out for or can i just stop SA and build the
newer version.

i am thinking of bayes database files. (not using Mysql).

i have read the upgrade file but just want to cross the i's and dot the t's
before jumping in.

Mark



Newbie question

2006-07-21 Thread Golden, James




Hi all,

I just took over the administration of spamassassin, since my coworker moved on. I'm not really familiar with a lot of this. The problem I am having is this:

A user has a legitimatly high AWL score (because of rules determined by management). Now they want the user to be reset. I tried using this command (spamassassin [EMAIL PROTECTED]) and several variations, but It doesn't seem to work. I finally ran the command with a debug and this is what I got:

[EMAIL PROTECTED] .spamassassin]# spamassassin -D -R --remove-addr-from-whitelist=[EMAIL PROTECTED]
debug: SpamAssassin version 3.0.3
debug: Score set 0 chosen.
debug: running in taint mode? yes
debug: Running in taint mode, removing unsafe env vars, and resetting PATH
debug: PATH included '/usr/kerberos/sbin', keeping.
debug: PATH included '/usr/kerberos/bin', keeping.
debug: PATH included '/usr/local/sbin', keeping.
debug: PATH included '/usr/local/bin', keeping.
debug: PATH included '/sbin', keeping.
debug: PATH included '/bin', keeping.
debug: PATH included '/usr/sbin', keeping.
debug: PATH included '/usr/bin', keeping.
debug: PATH included '/usr/X11R6/bin', keeping.
debug: PATH included '/usr/local/oracle/OraHome1/bin', keeping.
debug: PATH included '/usr/local/oracle/jre/bin', which doesn't exist, dropping.
debug: PATH included '/root/bin', keeping.
debug: Final PATH set to: /usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin:/usr/local/oracle/OraHome1/bin:/root/bin
debug: using /usr/share/spamassassin for default rules dir
debug: config: read file /usr/share/spamassassin/10_misc.cf
debug: config: read file /usr/share/spamassassin/20_anti_ratware.cf
debug: config: read file /usr/share/spamassassin/20_body_tests.cf
debug: config: read file /usr/share/spamassassin/20_compensate.cf
debug: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
debug: config: read file /usr/share/spamassassin/20_drugs.cf
debug: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
debug: config: read file /usr/share/spamassassin/20_head_tests.cf
debug: config: read file /usr/share/spamassassin/20_html_tests.cf
debug: config: read file /usr/share/spamassassin/20_meta_tests.cf
debug: config: read file /usr/share/spamassassin/20_phrases.cf
debug: config: read file /usr/share/spamassassin/20_porn.cf
debug: config: read file /usr/share/spamassassin/20_ratware.cf
debug: config: read file /usr/share/spamassassin/20_uri_tests.cf
debug: config: read file /usr/share/spamassassin/23_bayes.cf
debug: config: read file /usr/share/spamassassin/25_body_tests_es.cf
debug: config: read file /usr/share/spamassassin/25_hashcash.cf
debug: config: read file /usr/share/spamassassin/25_spf.cf
debug: config: read file /usr/share/spamassassin/25_uribl.cf
debug: config: read file /usr/share/spamassassin/30_text_de.cf
debug: config: read file /usr/share/spamassassin/30_text_fr.cf
debug: config: read file /usr/share/spamassassin/30_text_nl.cf
debug: config: read file /usr/share/spamassassin/30_text_pl.cf
debug: config: read file /usr/share/spamassassin/50_scores.cf
debug: config: read file /usr/share/spamassassin/60_whitelist.cf
debug: config: read file /usr/share/spamassassin/99_bogus-virus-warnings.cf
debug: using /etc/mail/spamassassin for site rules dir
debug: config: read file /etc/mail/spamassassin/local.cf
debug: using /root/.spamassassin for user state dir
debug: using /root/.spamassassin/user_prefs for user prefs file
debug: config: read file /root/.spamassassin/user_prefs
debug: config: SpamAssassin failed to parse line, skipping: scor LOCAL_nasty_image_link_RULE 1
debug: config: SpamAssassin failed to parse line, skipping: rewrite_subject 1
debug: config: SpamAssassin failed to parse line, skipping: subject_tag [SPAM]
debug: using /root/.spamassassin for user state dir
debug: bayes: no dbs present, cannot tie DB R/O: /root/.spamassassin/bayes_toks
debug: Score set 1 chosen.
debug: using /root/.spamassassin for user state dir
debug: lock: 24237 created /root/.spamassassin/auto-whitelist.lock.(server).24237
debug: lock: 24237 trying to get lock on /root/.spamassassin/auto-whitelist with 0 retries
debug: lock: 24237 link to /root/.spamassassin/auto-whitelist.lock: link ok
debug: Tie-ing to DB file R/W in /root/.spamassassin/auto-whitelist
debug: auto-whitelist (db-based): [EMAIL PROTECTED]|ip=none scores 0/0
SpamAssassin auto-whitelist: removing address: [EMAIL PROTECTED]
debug: DB addr list: untie-ing and unlocking.
debug: DB addr list: file locked, breaking lock.
debug: unlock: 24237 unlink /root/.spamassassin/auto-whitelist.lock

Even after this, the score still remains the same. I am running this on Fedora Core 1. 

Any help would be greatly appreciated.





Re: Newbie question

2006-07-21 Thread Duncan Hill
On Friday 21 July 2006 16:07, Golden, James wrote:
 Hi all,

 I just took over the administration of spamassassin, since my coworker
 moved on.  I'm not really familiar with a lot of this.  The problem I am
 having is this:

 A user has a legitimatly high AWL score (because of rules determined by
 management).  Now they want the user to be reset.  I tried using this
 command (spamassassin [EMAIL PROTECTED])
 and several variations, but It doesn't seem to work.  I finally ran the
 command with a debug and this is what I got:

 on /root/.spamassassin/auto-whitelist with 0 retries
 debug: lock: 24237 link to /root/.spamassassin/auto-whitelist.lock: link
 ok
 debug: Tie-ing to DB file R/W in /root/.spamassassin/auto-whitelist
 debug: auto-whitelist (db-based): [EMAIL PROTECTED]|ip=none scores
 0/0

If SA doesn't run as root when scanning mail (and it probably doesn't), 
adjusting root's whitelist file won't help.  You need to find what user SA 
runs as, and execute the same command when su'd to them.


Re: Newbie question

2006-07-21 Thread Andy Jezierski

Golden, James [EMAIL PROTECTED]
wrote on 07/21/2006 10:07:33 AM:

 Hi all,
 
 I just took over the administration of spamassassin, since my 
 coworker moved on. I'm not really familiar with a lot of this.
The
 problem I am having is this:
 
 A user has a legitimatly high AWL score (because of rules determined
 by management). Now they want the user to be reset.
I tried 
 using this command (spamassassin --remove-addr-from-
 [EMAIL PROTECTED]) and several variations, but It doesn't

 seem to work. I finally ran the command with a debug and this
is what I got:
 
 [EMAIL PROTECTED] .spamassassin]# spamassassin -D -R --remove-addr-from-whitelist=
 [EMAIL PROTECTED]
[snip]
 debug: config: SpamAssassin failed to parse line,
skipping: scor 
 LOCAL_nasty_image_link_RULE 1
 debug: config: SpamAssassin failed to parse line, skipping: rewrite_subject
1
 debug: config: SpamAssassin failed to parse line, skipping: subject_tag
[SPAM]

First fix your local rule and update your subject tagging. See the UPGRADE
doc.


 debug: Tie-ing to DB file R/W in /root/.spamassassin/auto-whitelist
 debug: auto-whitelist (db-based): [EMAIL PROTECTED]|ip=none scores
0/0
 SpamAssassin auto-whitelist: removing address: [EMAIL PROTECTED]
 debug: DB addr list: untie-ing and unlocking.
 debug: DB addr list: file locked, breaking lock.
 debug: unlock: 24237 unlink /root/.spamassassin/auto-whitelist.lock
 
 Even after this, the score still remains the same.  I
am running 
 this on Fedora Core 1. 
 
 Any help would be greatly appreciated.

How are you invoking SA? The command you ran was run
under the root account, SA doesn't run using that account. You need to
run that command using the same ID.

Andy 

Re: Rules getting bypassed?

2006-07-21 Thread Rick van Vliet

jdow wrote:

From: Rick van Vliet [EMAIL PROTECTED]


jdow wrote:

From: Rick van Vliet [EMAIL PROTECTED]


Hello. New to the list, I have a question that I hope isn't too 
newbie.

Running SA 3.1.2  with a qmail server for a small (50) group of users.
Vpopmail handling virtuals, and procmail.
(auto_whitelist is disabled)

I have one user who is getting creamed and no matter how much we do 
sa-learn --spam...on the IMAP folder we move his spam into...this 
user's mail somehow gets through with low scores, and he's averaging 




Rick, you do not have ANY BAYES_xx rule hitting at all. So Bayes is not
working. It looks like you have been carefully training individual user's
BAYES databases but not the global one. You must update the database
as the UID that owns the database.


Had a few A-ha moments, and have figured out how I need to su as teh 
virtual (vpopmail) user.

Doing some feeding now, and I'll see how things go.
Thanks for everyone's help and suggestions,
Rick



[Fwd: Undeliverable:RE: Rule for mail contains bad email ids]

2006-07-21 Thread Michael Scheidell




SA email admin?

Wondering why SA mailing list  isn't using SRS or something.

Any mailing list subscriber who sends to the list could get their email
bounced at another list subscriber's if that list subscriber uses
HARDFAIL bounces and the list user has -all type spf records.



 Original Message 

  

  Subject: 
  Undeliverable:RE: Rule for mail contains bad email ids


  Date: 
  Fri, 21 Jul 2006 13:23:49 -0400


  From: 
  System Administrator [EMAIL PROTECTED]


  To: 
  Michael Scheidell [EMAIL PROTECTED]

  



Your message

  To:  Ramprasad; spamassassin-users
  Subject: RE: Rule for mail contains bad email ids
  Sent:Fri, 21 Jul 2006 08:32:26 -0400

did not reach the following recipient(s):

users@spamassassin.apache.org on Fri, 21 Jul 2006 13:18:27 -0400
The e-mail system was unable to deliver the message, but did not
report a specific reason.  Check the address and try again.  If it still
fails, contact your system administrator.
potap01.accessintel.com #5.0.0 smtp;550 SPF forgery: Please see
http://www.openspf.org/why.html?sender=scheidell%40secnap.netip=12.145.
52.121receiver=asf.osuosl.org




-- 
Michael Scheidell, CTO
SECNAP Network Security / www.secnap.com
[EMAIL PROTECTED]  / 1+561-999-5000, x 1131



Reporting-MTA: dns; secnap2.secnap.com

Final-Recipient: RFC822; users@spamassassin.apache.org
Action: failed
Status: 5.0.0
X-Supplementary-Info: potap01.accessintel.com #5.0.0 smtp;550 SPF forgery: Please see http://www.openspf.org/why.html?sender=scheidell%40secnap.netip=12.145.52.121receiver=asf.osuosl.org
X-Display-Name: users@spamassassin.apache.org

---BeginMessage---
Title: RE: Rule for mail contains bad email ids






 -Original Message-
 From: Ramprasad [mailto:[EMAIL PROTECTED]]
 Sent: Friday, July 21, 2006 4:16 AM
 To: spamassassin-users
 Subject: Rule for mail contains bad email ids


 There are now a few spams passing thru with plain emailids (
 not mailto links )

 There is noting else in the mail that can be caught. How can
 I check such ids

 Show I do a body check after all

That's like playing whack-a-mole with spammers.
You would be entering in email addreses all day long.

Anything similar?
All yahoo.com.sg?
(all yahoo.com.[a-z]. ?

Also, feed them to bayes, feed them to dcc, razor and spamcop.
Eventually, they will hit enough points to be blocked by semi-automated
methods.

--
Michael Scheidell, CTO
561-999-5000, ext 1131
SECNAP Network Security Corporation
Keep up to date with latest information on IT security: Real time
security alerts: http://www.secnap.com/news






---End Message---


Re: Newbie question

2006-07-21 Thread Golden, James




Thanks for that! I kinda was heading in that direction. Now at the risk of sounding really stupid. How can I figure that out? I know we are running MailScanner, and spamassassin is setup through MailScanner to scan the mail. 

Thanks for the answers. You are great!


On Fri, 2006-07-21 at 16:19 +0100, Duncan Hill wrote:


On Friday 21 July 2006 16:07, Golden, James wrote:
 Hi all,

 I just took over the administration of spamassassin, since my coworker
 moved on.  I'm not really familiar with a lot of this.  The problem I am
 having is this:

 A user has a legitimatly high AWL score (because of rules determined by
 management).  Now they want the user to be reset.  I tried using this
 command (spamassassin [EMAIL PROTECTED])
 and several variations, but It doesn't seem to work.  I finally ran the
 command with a debug and this is what I got:

 on /root/.spamassassin/auto-whitelist with 0 retries
 debug: lock: 24237 link to /root/.spamassassin/auto-whitelist.lock: link
 ok
 debug: Tie-ing to DB file R/W in /root/.spamassassin/auto-whitelist
 debug: auto-whitelist (db-based): [EMAIL PROTECTED]|ip=none scores
 0/0

If SA doesn't run as root when scanning mail (and it probably doesn't), 
adjusting root's whitelist file won't help.  You need to find what user SA 
runs as, and execute the same command when su'd to them.






Update: Newbie Question (AWL score reset)

2006-07-21 Thread Golden, James




I have a little more information. I figured out I could get ps to tell me what the process is running as. It looks to be running as a daemon, and is running as root. I didn't think it was supposed to be run this way. Even so, shouldn't the prior command have reset the AWL score then?

# ps -eo pid,user,fname |grep spamd
 1599 root spamd
 1706 root spamd
 1707 root spamd
 1708 root spamd
 1709 root spamd
 1711 root spamd





Re: Bayes Always On

2006-07-21 Thread jdow

From: Duane Hill [EMAIL PROTECTED]

I recently upgraded SA to v3.1.3 on FreeBSD 6.0. I have also ran 
sa-update.


I have found that no matter what I do to the local.cf with turning off 
bayes, it is still being used. I have searched the system over and have 
only found local.cf contained within /etc/mail/spamassassin.


Any ideas?


You override it in the various user_prefs files in each user's
directory?

{^_^}


Update: Newbie Question (AWL score reset)

2006-07-21 Thread Golden, James




Hi all,

OK a little more info I discovered. From the Book on MailScanner, I found that when using Mailscanner with sendmail you have to run it as root. Thus spamd is also called root. I also checked the Mailscanner.conf file for the spamassassin settings and found that Auto whitelist was turned off.

That doesn't sound right. How is it that it was turned off but working?

James




Re: Update: Newbie Question (AWL score reset)

2006-07-21 Thread John Rudd

Um.. mailscanner doesn't use spamd...

in your last message, you said you're using mailscanner.

Might be a good idea to ask all of this on the mailscanner list.

(see www.mailscanner.info )


On Jul 21, 2006, at 12:23, Golden, James wrote:

 I have a little more information.  I figured out I could get ps to 
tell me what the process is running as.  It looks to be running as a 
daemon, and is running as root.  I didn't think it was supposed to be 
run this way.  Even so, shouldn't the prior command have reset the AWL 
score then?


 # ps -eo pid,user,fname |grep spamd
 1599 root spamd
 1706 root spamd
 1707 root spamd
 1708 root spamd
 1709 root spamd
 1711 root spamd





Re: [Fwd: Undeliverable:RE: Rule for mail contains bad email ids]

2006-07-21 Thread Daryl C. W. O'Shea
Michael Scheidell wrote:
 SA email admin?
 
 Wondering why SA mailing list  isn't using SRS or something.

Really, who does.  Besides SRS would be the wrong solution for a simple
mailing list.


 Any mailing list subscriber who sends to the list could get their email 
 bounced at another list subscriber's if that list subscriber uses 
 HARDFAIL bounces and the list user has -all type spf records.

Nope, apparently potap01.accessintel.com has x821 and x822 identities
confused as ezmlm correctly rewrites the envelope.  It's the receivers
SPF implementation that is broken.


Daryl


Re: 3.0.0 to 3.1.3 upgrade

2006-07-21 Thread Daryl C. W. O'Shea

Obantec Support wrote:

Hi

is they anything i need to watch out for or can i just stop SA and build the
newer version.

i am thinking of bayes database files. (not using Mysql).

i have read the upgrade file but just want to cross the i's and dot the t's
before jumping in.

Mark



Nothing interesting.  I believe a couple of dependency versions were 
bumped up, that's about it.  Bayes should work fine.  Feel free to make 
a backup of your bayes and awl databases... which is always a good idea 
anyway.


A few things were moved to plugins too.  3.1.3's plugins should be 
enabled by default similarly to a 3.0 install though.



Daryl


FSCKED UP MAIL BOUNCES FROM THIS LIST

2006-07-21 Thread jdow

Hey guys, the Apache email system is hosed.

It has bounced two recent emails, one because it supposedly already had
list headers on it, which as it went out of here it did not. The other
had the system's spamassassin filter barfing on the direct output of
sa-stats.pl which included several BAYES tags.

Can't the bozoids there do SOMETHING to make this list useable again?
This is getting ridiculous and has passed mere annoying for its
properties.

DAMNIT FIX IT!

{+_+}


Re: FSCKED UP MAIL BOUNCES FROM THIS LIST

2006-07-21 Thread Evan Platt

At 03:01 PM 7/21/2006, you wrote:

Hey guys, the Apache email system is hosed.

It has bounced two recent emails, one because it supposedly already had
list headers on it, which as it went out of here it did not. The other
had the system's spamassassin filter barfing on the direct output of
sa-stats.pl which included several BAYES tags.

Can't the bozoids there do SOMETHING to make this list useable again?
This is getting ridiculous and has passed mere annoying for its
properties.



I was tempted to reply with a fake bounce message to you, but that 
would be too mean. :-D




Re: FSCKED UP MAIL BOUNCES FROM THIS LIST

2006-07-21 Thread jdow

From: Evan Platt [EMAIL PROTECTED]


At 03:01 PM 7/21/2006, you wrote:

Hey guys, the Apache email system is hosed.

It has bounced two recent emails, one because it supposedly already had
list headers on it, which as it went out of here it did not. The other
had the system's spamassassin filter barfing on the direct output of
sa-stats.pl which included several BAYES tags.

Can't the bozoids there do SOMETHING to make this list useable again?
This is getting ridiculous and has passed mere annoying for its
properties.



I was tempted to reply with a fake bounce message to you, but that 
would be too mean. :-D


I am pretty good at detecting fakes, I believe. Besides bounces from
individual people get a procmail rule to bypass all further testing
on all future emails from that domain on their way to /dev/null. I am
not forgiving of mail bounces.

Of course, since it is easy for something as dumb old tech as procmail
to skip spamassassin tests on the SpamAssassin mailing lists it's
pretty easy to get VERY upset that the weenies at Apache.org can't
get their heads straight enough to fix the problems engendered by
their feeding this list through the same SpamAssassin filters as
every other list.

And a mail loop - why that's something as amateur as what I might do
setting up a mail service open to outside input. I've never done that
yet. But gee, they have.

{+_+}


Re: FSCKED UP MAIL BOUNCES FROM THIS LIST

2006-07-21 Thread James Butler
On 7/21/06 at 3:04 PM Evan Platt wrote:

At 03:01 PM 7/21/2006, you wrote:
Hey guys, the Apache email system is hosed.

It has bounced two recent emails, one because it supposedly already had
list headers on it, which as it went out of here it did not. The other
had the system's spamassassin filter barfing on the direct output of
sa-stats.pl which included several BAYES tags.

Can't the bozoids there do SOMETHING to make this list useable again?
This is getting ridiculous and has passed mere annoying for its
properties.


I was tempted to reply with a fake bounce message to you, but that
would be too mean. :-D

This was a possible explanation for my Snort installation picking up the messed 
up headers, a few days ago, too. Maybe there is a problem with the Apache.org 
installation munging stuff?

James



Re: FSCKED UP MAIL BOUNCES FROM THIS LIST

2006-07-21 Thread John Andersen
On Friday 21 July 2006 14:01, jdow wrote:
 Hey guys, the Apache email system is hosed.

 It has bounced two recent emails, one because it supposedly already had
 list headers on it, which as it went out of here it did not. The other
 had the system's spamassassin filter barfing on the direct output of
 sa-stats.pl which included several BAYES tags.

 Can't the bozoids there do SOMETHING to make this list useable again?
 This is getting ridiculous and has passed mere annoying for its
 properties.

 DAMNIT FIX IT!

 {+_+}

Yup, I'm seeing the same thing.  And sometimes the failures are happening
many hours after the message was sent.


---
Pasted in the headers Below

Hi. This is the qmail-send program at apache.org.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

users@spamassassin.apache.org:
ezmlm-send: fatal: message already has a Mailing-List header (maybe I should 
be a sublist) (#5.7.2)
ezmlm-gate: fatal: fatal error from child

--- Below this line is a copy of the message.

Return-Path: [EMAIL PROTECTED]
Received: (qmail 42380 invoked by uid 99); 21 Jul 2006 22:20:26 -
Received: from asf.osuosl.org (HELO asf.osuosl.org) (140.211.166.49)
by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 21 Jul 2006 15:20:26 -0700
X-ASF-Spam-Status: No, hits=2.1 required=10.0
tests=X_MESSAGE_FLAG_ODD
X-Spam-Check-By: apache.org
Received-SPF: neutral (asf.osuosl.org: local policy)
Received: from [12.145.52.121] (HELO potap01.accessintel.com) (12.145.52.121)
by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 21 Jul 2006 15:20:24 -0700
Received: from mail pickup service by potap01.accessintel.com with Microsoft 
SMTPSVC;
 Fri, 21 Jul 2006 18:18:59 -0400
Received: from potmgw01.accessintel.com ([10.10.0.109]) by 
potap01.accessintel.com with Microsoft SMTPSVC(5.0.2195.6713);
 Fri, 21 Jul 2006 03:49:50 -0400
Received: from mail.apache.org ([209.237.227.199])
 by potmgw01.accessintel.com (SMSSMTP 4.1.9.35) with SMTP id 
M2006072103494928300
 for [EMAIL PROTECTED]; Fri, 21 Jul 2006 03:49:49 -0400
Received: (qmail 91437 invoked by uid 500); 21 Jul 2006 07:49:47 -
Mailing-List: contact [EMAIL PROTECTED]; run by ezmlm
Precedence: bulk
list-help: mailto:[EMAIL PROTECTED]
list-unsubscribe: mailto:[EMAIL PROTECTED]
List-Post: mailto:users@spamassassin.apache.org
List-Id: users.spamassassin.apache.org
Delivered-To: mailing list users@spamassassin.apache.org
Received: (qmail 91428 invoked by uid 99); 21 Jul 2006 07:49:47 -
Received: from asf.osuosl.org (HELO asf.osuosl.org) (140.211.166.49)
by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 21 Jul 2006 00:49:47 -0700
X-ASF-Spam-Status: No, hits=2.1 required=10.0
tests=X_MESSAGE_FLAG_ODD
Received-SPF: neutral (asf.osuosl.org: local policy)
Received: from [209.165.130.11] (HELO msgmmp-1.gci.net) (209.165.130.11)
by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 21 Jul 2006 00:49:45 -0700
Received: from 90-72-174-206.gci.net ([206.174.72.90])
 by msgmmp-1.gci.net (Sun Java System Messaging Server 6.2-3.03 (built Jun 27
 2005)) with ESMTP id [EMAIL PROTECTED] for
 users@spamassassin.apache.org; Thu, 20 Jul 2006 23:49:23 -0800 (AKDT)
Date: Thu, 20 Jul 2006 23:49:12 -0800
From: John Andersen [EMAIL PROTECTED]
Subject: Razor - Does it Work thru Spamc
To: users@spamassassin.apache.org
Message-id: [EMAIL PROTECTED]
MIME-version: 1.0
Content-type: multipart/signed; boundary=nextPart4260436.ihrHRsPluK;
 protocol=application/pgp-signature; micalg=pgp-sha1
Content-transfer-encoding: 7bit
User-Agent: KMail/1.9.1
X-Message-flag: Outlook Sucks
X-Virus-Checked: Checked by ClamAV on apache.org
X-OriginalArrivalTime: 21 Jul 2006 07:49:50.0434 (UTC) 
FILETIME=[3EBFDC20:01C6AC9A]
X-Virus-Checked: Checked by ClamAV on apache.org
X-Old-Spam-Check-By: apache.org

-- 
_
John Andersen


pgppZ4PKvxcJb.pgp
Description: PGP signature


Re: FSCKED UP MAIL BOUNCES FROM THIS LIST

2006-07-21 Thread John Andersen
On Friday 21 July 2006 14:28, John Andersen wrote:

Replying to myself...  

It looks upon further inspection that this guy is the problem.  He
seems to be routing mail back to the list or something:

  for [EMAIL PROTECTED]; Fri, 21 Jul 2006 03:49:49 -0400

-- 
_
John Andersen


pgpnqRtcNNmtj.pgp
Description: PGP signature


Re: FSCKED UP MAIL BOUNCES FROM THIS LIST

2006-07-21 Thread Daryl C. W. O'Shea

John Andersen wrote:

On Friday 21 July 2006 14:01, jdow wrote:

Hey guys, the Apache email system is hosed.

It has bounced two recent emails, one because it supposedly already had
list headers on it, which as it went out of here it did not. The other
had the system's spamassassin filter barfing on the direct output of
sa-stats.pl which included several BAYES tags.

Can't the bozoids there do SOMETHING to make this list useable again?
This is getting ridiculous and has passed mere annoying for its
properties.

DAMNIT FIX IT!

{+_+}


Yup, I'm seeing the same thing.  And sometimes the failures are happening
many hours after the message was sent.



First, the Apache infra folks are all volunteers who do an awesome job, 
for free.


Second, although the Apache ezmlm is eventually bouncing the message 
back when it discovers the message is a dupe, it's not really the fault 
of the Apache MXes.  It's whoever runs potap01.accessintel.com that is 
apparently seriously screwed up.



The best immediate course of action is probably unsubscribing 
[EMAIL PROTECTED] from this list.  Unfortunately I'm not a list 
admin so I can't do it.  I suppose I probably should be helping out with 
that.  :o



Daryl





---
Pasted in the headers Below

Hi. This is the qmail-send program at apache.org.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

users@spamassassin.apache.org:
ezmlm-send: fatal: message already has a Mailing-List header (maybe I should 
be a sublist) (#5.7.2)

ezmlm-gate: fatal: fatal error from child

--- Below this line is a copy of the message.

Return-Path: [EMAIL PROTECTED]
Received: (qmail 42380 invoked by uid 99); 21 Jul 2006 22:20:26 -
Received: from asf.osuosl.org (HELO asf.osuosl.org) (140.211.166.49)
by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 21 Jul 2006 15:20:26 -0700
X-ASF-Spam-Status: No, hits=2.1 required=10.0
tests=X_MESSAGE_FLAG_ODD
X-Spam-Check-By: apache.org
Received-SPF: neutral (asf.osuosl.org: local policy)
Received: from [12.145.52.121] (HELO potap01.accessintel.com) (12.145.52.121)
by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 21 Jul 2006 15:20:24 -0700
Received: from mail pickup service by potap01.accessintel.com with Microsoft 
SMTPSVC;

 Fri, 21 Jul 2006 18:18:59 -0400
Received: from potmgw01.accessintel.com ([10.10.0.109]) by 
potap01.accessintel.com with Microsoft SMTPSVC(5.0.2195.6713);

 Fri, 21 Jul 2006 03:49:50 -0400
Received: from mail.apache.org ([209.237.227.199])
 by potmgw01.accessintel.com (SMSSMTP 4.1.9.35) with SMTP id 
M2006072103494928300

 for [EMAIL PROTECTED]; Fri, 21 Jul 2006 03:49:49 -0400
Received: (qmail 91437 invoked by uid 500); 21 Jul 2006 07:49:47 -
Mailing-List: contact [EMAIL PROTECTED]; run by ezmlm
Precedence: bulk
list-help: mailto:[EMAIL PROTECTED]
list-unsubscribe: mailto:[EMAIL PROTECTED]
List-Post: mailto:users@spamassassin.apache.org
List-Id: users.spamassassin.apache.org
Delivered-To: mailing list users@spamassassin.apache.org
Received: (qmail 91428 invoked by uid 99); 21 Jul 2006 07:49:47 -
Received: from asf.osuosl.org (HELO asf.osuosl.org) (140.211.166.49)
by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 21 Jul 2006 00:49:47 -0700
X-ASF-Spam-Status: No, hits=2.1 required=10.0
tests=X_MESSAGE_FLAG_ODD
Received-SPF: neutral (asf.osuosl.org: local policy)
Received: from [209.165.130.11] (HELO msgmmp-1.gci.net) (209.165.130.11)
by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 21 Jul 2006 00:49:45 -0700
Received: from 90-72-174-206.gci.net ([206.174.72.90])
 by msgmmp-1.gci.net (Sun Java System Messaging Server 6.2-3.03 (built Jun 27
 2005)) with ESMTP id [EMAIL PROTECTED] for
 users@spamassassin.apache.org; Thu, 20 Jul 2006 23:49:23 -0800 (AKDT)
Date: Thu, 20 Jul 2006 23:49:12 -0800
From: John Andersen [EMAIL PROTECTED]
Subject: Razor - Does it Work thru Spamc
To: users@spamassassin.apache.org
Message-id: [EMAIL PROTECTED]
MIME-version: 1.0
Content-type: multipart/signed; boundary=nextPart4260436.ihrHRsPluK;
 protocol=application/pgp-signature; micalg=pgp-sha1
Content-transfer-encoding: 7bit
User-Agent: KMail/1.9.1
X-Message-flag: Outlook Sucks
X-Virus-Checked: Checked by ClamAV on apache.org
X-OriginalArrivalTime: 21 Jul 2006 07:49:50.0434 (UTC) 
FILETIME=[3EBFDC20:01C6AC9A]

X-Virus-Checked: Checked by ClamAV on apache.org
X-Old-Spam-Check-By: apache.org





Re: FSCKED UP MAIL BOUNCES FROM THIS LIST

2006-07-21 Thread jdow

From: Daryl C. W. O'Shea [EMAIL PROTECTED]



John Andersen wrote:

On Friday 21 July 2006 14:01, jdow wrote:

Hey guys, the Apache email system is hosed.

It has bounced two recent emails, one because it supposedly already had
list headers on it, which as it went out of here it did not. The other
had the system's spamassassin filter barfing on the direct output of
sa-stats.pl which included several BAYES tags.

Can't the bozoids there do SOMETHING to make this list useable again?
This is getting ridiculous and has passed mere annoying for its
properties.

DAMNIT FIX IT!

{+_+}


Yup, I'm seeing the same thing.  And sometimes the failures are happening
many hours after the message was sent.



First, the Apache infra folks are all volunteers who do an awesome job, 
for free.


Second, although the Apache ezmlm is eventually bouncing the message 
back when it discovers the message is a dupe, it's not really the fault 
of the Apache MXes.  It's whoever runs potap01.accessintel.com that is 
apparently seriously screwed up.



The best immediate course of action is probably unsubscribing 
[EMAIL PROTECTED] from this list.  Unfortunately I'm not a list 
admin so I can't do it.  I suppose I probably should be helping out with 
that.  :o



Daryl



In light of this my apologies to the Apache list folks. (Although I am
still rather griped that they feed this list through the same filters
as the other lists. It's SO easy to bypass SA for one list, at least
with procmail. If other filters/milters/whatevers can't then they are
basically worthless silliness.)

{^_^}



---
Pasted in the headers Below

Hi. This is the qmail-send program at apache.org.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

users@spamassassin.apache.org:
ezmlm-send: fatal: message already has a Mailing-List header (maybe I should 
be a sublist) (#5.7.2)

ezmlm-gate: fatal: fatal error from child

--- Below this line is a copy of the message.

Return-Path: [EMAIL PROTECTED]
Received: (qmail 42380 invoked by uid 99); 21 Jul 2006 22:20:26 -
Received: from asf.osuosl.org (HELO asf.osuosl.org) (140.211.166.49)
by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 21 Jul 2006 15:20:26 -0700
X-ASF-Spam-Status: No, hits=2.1 required=10.0
tests=X_MESSAGE_FLAG_ODD
X-Spam-Check-By: apache.org
Received-SPF: neutral (asf.osuosl.org: local policy)
Received: from [12.145.52.121] (HELO potap01.accessintel.com) (12.145.52.121)
by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 21 Jul 2006 15:20:24 -0700
Received: from mail pickup service by potap01.accessintel.com with Microsoft 
SMTPSVC;

 Fri, 21 Jul 2006 18:18:59 -0400
Received: from potmgw01.accessintel.com ([10.10.0.109]) by 
potap01.accessintel.com with Microsoft SMTPSVC(5.0.2195.6713);

 Fri, 21 Jul 2006 03:49:50 -0400
Received: from mail.apache.org ([209.237.227.199])
 by potmgw01.accessintel.com (SMSSMTP 4.1.9.35) with SMTP id 
M2006072103494928300

 for [EMAIL PROTECTED]; Fri, 21 Jul 2006 03:49:49 -0400
Received: (qmail 91437 invoked by uid 500); 21 Jul 2006 07:49:47 -
Mailing-List: contact [EMAIL PROTECTED]; run by ezmlm
Precedence: bulk
list-help: mailto:[EMAIL PROTECTED]
list-unsubscribe: mailto:[EMAIL PROTECTED]
List-Post: mailto:users@spamassassin.apache.org
List-Id: users.spamassassin.apache.org
Delivered-To: mailing list users@spamassassin.apache.org
Received: (qmail 91428 invoked by uid 99); 21 Jul 2006 07:49:47 -
Received: from asf.osuosl.org (HELO asf.osuosl.org) (140.211.166.49)
by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 21 Jul 2006 00:49:47 -0700
X-ASF-Spam-Status: No, hits=2.1 required=10.0
tests=X_MESSAGE_FLAG_ODD
Received-SPF: neutral (asf.osuosl.org: local policy)
Received: from [209.165.130.11] (HELO msgmmp-1.gci.net) (209.165.130.11)
by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 21 Jul 2006 00:49:45 -0700
Received: from 90-72-174-206.gci.net ([206.174.72.90])
 by msgmmp-1.gci.net (Sun Java System Messaging Server 6.2-3.03 (built Jun 27
 2005)) with ESMTP id [EMAIL PROTECTED] for
 users@spamassassin.apache.org; Thu, 20 Jul 2006 23:49:23 -0800 (AKDT)
Date: Thu, 20 Jul 2006 23:49:12 -0800
From: John Andersen [EMAIL PROTECTED]
Subject: Razor - Does it Work thru Spamc
To: users@spamassassin.apache.org
Message-id: [EMAIL PROTECTED]
MIME-version: 1.0
Content-type: multipart/signed; boundary=nextPart4260436.ihrHRsPluK;
 protocol=application/pgp-signature; micalg=pgp-sha1
Content-transfer-encoding: 7bit
User-Agent: KMail/1.9.1
X-Message-flag: Outlook Sucks
X-Virus-Checked: Checked by ClamAV on apache.org
X-OriginalArrivalTime: 21 Jul 2006 07:49:50.0434 (UTC) 
FILETIME=[3EBFDC20:01C6AC9A]

X-Virus-Checked: Checked by ClamAV on apache.org
X-Old-Spam-Check-By: apache.org





Delivery failure notification (fwd)

2006-07-21 Thread John D. Hardin

The folks over at accessintel (the server bouncing list traffic) don't
seem to know what they are doing.

I got a bounce and tried to let them know about it, and got the below
in return.

I hope the listadmins unsub them.

--
 John Hardin KA7OHZICQ#15735746http://www.impsec.org/~jhardin/
 [EMAIL PROTECTED]FALaholic #11174pgpk -a [EMAIL PROTECTED]
 key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
---
  ...every time I sit down in front of a Windows machine I feel as
  if the computer is just a place for the manufacturers to put their
  advertising.  -- fwadling on Y! SCOX
--
 3 days until The 37th anniversary of Apollo 11 landing on the Moon


-- Forwarded message --
Date: Fri, 21 Jul 2006 19:49:26 -0400
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: [utf-8] Delivery failure notification@

Your message with Subject: Delivery Status Notification (Failure) (fwd) 
could not be delivered to the following recipients:

[EMAIL PROTECTED], [EMAIL PROTECTED]

Please do not resend your original message.

Delivery attempts will continue to be made for 5  day(s).





Re: Delivery failure notification (fwd)

2006-07-21 Thread John Andersen
On Friday 21 July 2006 18:03, John D. Hardin wrote:
 The folks over at accessintel (the server bouncing list traffic) don't
 seem to know what they are doing.

 I got a bounce and tried to let them know about it, and got the below
 in return.

 I hope the listadmins unsub them.

Its a microsoft smtp server.  What would you expect!!??!

-- 
_
John Andersen


pgpfUqTtS0g1J.pgp
Description: PGP signature


Re: Delivery failure notification (fwd)

2006-07-21 Thread jdow

Ah - spamming the list this way, I suspect.
{^_^}
- Original Message - 
From: John D. Hardin [EMAIL PROTECTED]

To: SpamAssassin Users List users@spamassassin.apache.org
Sent: Friday, July 21, 2006 19:03
Subject: Delivery failure notification (fwd)




The folks over at accessintel (the server bouncing list traffic) don't
seem to know what they are doing.

I got a bounce and tried to let them know about it, and got the below
in return.

I hope the listadmins unsub them.

--
John Hardin KA7OHZICQ#15735746http://www.impsec.org/~jhardin/
[EMAIL PROTECTED]FALaholic #11174pgpk -a [EMAIL PROTECTED]
key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
---
 ...every time I sit down in front of a Windows machine I feel as
 if the computer is just a place for the manufacturers to put their
 advertising.  -- fwadling on Y! SCOX
--
3 days until The 37th anniversary of Apollo 11 landing on the Moon


-- Forwarded message --
Date: Fri, 21 Jul 2006 19:49:26 -0400
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: [utf-8] Delivery failure notification@

Your message with Subject: Delivery Status Notification (Failure) (fwd) 
could not be delivered to the following recipients:


[EMAIL PROTECTED], [EMAIL PROTECTED]

Please do not resend your original message.

Delivery attempts will continue to be made for 5  day(s).




Re: Delivery failure notification (fwd)

2006-07-21 Thread John D. Hardin
On Fri, 21 Jul 2006, John Andersen wrote:

 On Friday 21 July 2006 18:03, John D. Hardin wrote:
  The folks over at accessintel (the server bouncing list traffic) don't
  seem to know what they are doing.
 
  I got a bounce and tried to let them know about it, and got the below
  in return.
 
  I hope the listadmins unsub them.
 
 Its a microsoft smtp server.  What would you expect!!??!

Well, yeah, but does that prevent them from defining postmaster and
abuse aliases?

--
 John Hardin KA7OHZICQ#15735746http://www.impsec.org/~jhardin/
 [EMAIL PROTECTED]FALaholic #11174pgpk -a [EMAIL PROTECTED]
 key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
---
 So Microsoft's invented the ASCII equivalent to ugly ink spots that
 appear on your letter when your pen is malfunctioning.
 -- Greg Andrews, about Microsoft's way to encode apostrophes
--
 3 days until The 37th anniversary of Apollo 11 landing on the Moon



Re: Delivery failure notification (fwd)

2006-07-21 Thread jdow

From: John D. Hardin [EMAIL PROTECTED]


On Fri, 21 Jul 2006, John Andersen wrote:


On Friday 21 July 2006 18:03, John D. Hardin wrote:
 The folks over at accessintel (the server bouncing list traffic) don't
 seem to know what they are doing.

 I got a bounce and tried to let them know about it, and got the below
 in return.

 I hope the listadmins unsub them.

Its a microsoft smtp server.  What would you expect!!??!


Well, yeah, but does that prevent them from defining postmaster and
abuse aliases?


I suppose you sent a suitably scathing note to [EMAIL PROTECTED],
their listed technical contact, didn't you?

{^_^}


Re: Delivery failure notification (fwd)

2006-07-21 Thread John Rudd


On Jul 21, 2006, at 10:51 PM, jdow wrote:


From: John D. Hardin [EMAIL PROTECTED]


On Fri, 21 Jul 2006, John Andersen wrote:

On Friday 21 July 2006 18:03, John D. Hardin wrote:
 The folks over at accessintel (the server bouncing list traffic) 
don't

 seem to know what they are doing.

 I got a bounce and tried to let them know about it, and got the 
below

 in return.

 I hope the listadmins unsub them.
Its a microsoft smtp server.  What would you expect!!??!

Well, yeah, but does that prevent them from defining postmaster and
abuse aliases?


I suppose you sent a suitably scathing note to 
[EMAIL PROTECTED],

their listed technical contact, didn't you?



And perhaps a report to the people at RFC-Ignorant?



RE: Delivery failure notification (fwd)

2006-07-21 Thread Michael Scheidell
 -Original Message-
 From: John D. Hardin [mailto:[EMAIL PROTECTED] 
 Sent: Saturday, July 22, 2006 1:43 AM
 To: John Andersen
 Cc: users@spamassassin.apache.org
 Subject: Re: Delivery failure notification (fwd)
 
 Well, yeah, but does that prevent them from defining 
 postmaster and abuse aliases?

You could also do them a favor and sign them up for the rfc-ignorant
blacklists, right?
www.rfc-ignorant.org

Wait of course 5 days for the permanent bounce, not just the warning.

I am sure they don't want to bother conversing with anyone who uses
those blacklists.

SA rules: in 20_dnsbl_tests.cf

50_scores.cf:score DNS_FROM_RFC_ABUSE 0 0.479 0 0.200
50_scores.cf:score DNS_FROM_RFC_POST 0 1.440 0 1.708
50_scores.cf:score DNS_FROM_RFC_WHOIS 0 0.879 0 1.447