Re: FreeMail.pm

2009-01-28 Thread Alan Munday
Henrik K wrote the following on 28/01/09 18:54:
 On Wed, Jan 28, 2009 at 10:35:44AM -0800, John Hardin wrote:
 On Wed, 28 Jan 2009, Henrik K wrote:

 http://sa.hege.li/FreeMail.pm
 I notice the list of freemail providers has changed - how frequently  
 should we be updating this plugin? Is there an sa-update channel for it?
 
 Haven't updated it in a long time..
 
 Someone could easily host a freemail.cf with only freemail_domains lines if
 they wanted. Unfortunately I don't have the resources to detect/find/update
 such domains currently.
 
 Cheers,
 Henrik

Henrik

A list of freemail address has been maintained for a long time at
http://www.oryx.com/spam/freemail/domains.txt

Not sure how often they update, but I've been using their list for some
years now.

Alan


DKIM

2007-01-10 Thread Alan Munday

The DKIM plugin files have all but disappeared on one of my mx's..I'm left 
with

/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/DKIM.pm
/usr/share/man/man3/Mail::SpamAssassin::Plugin::DKIM.3pm.gz

I've tried re-installing/upgrading from the rpm (spamassassin-3.1.7-1.fc5) but 
this has not fixed things.

Is there another way I can re-install this plugins files?

Thanks

Alan



Re: DKIM

2007-01-10 Thread Alan Munday

Mark Martinec wrote the following on 10/01/2007 16:45:

The Plugin/DKIM.pm is all there is to it. No other files
in SA plugins directory is associated with DKIM.

There is however a Mail/DKIM.pm and Mail/DKIM/* perl module
in the usual modules places that you may be looking for.

  Mark


Thanks Mark.

When I saw the lint fail I just started comparing file lists

Too busy looking at a VoIP problem to think that the perl module had 
disappeared.

Alan



Re: RelayCountry plugin doesn't add header

2007-01-02 Thread Alan Munday

Nick Radov wrote the following on 02/01/2007 18:35:
I am running SpamAssassin 3.1.7 in serial mode on Windows 2003. I would 
like to use the RelayCountry plugin and have enabled it as described on 
this web page: http://wiki.apache.org/spamassassin/RelayCountryPlugin. 
But when I ran a test message through, the X-Relay-Countries header wasn't 
added. Can anyone suggest how to fix this?


The IP::Country::Fast module is installed. And here is a filtered excerpt 
from the SpamAssassin debugging output which seems to show the plugin is 
being loaded correctly. 

[18136] dbg: plugin: loading Mail::SpamAssassin::Plugin::RelayCountry from 
@INC
[18136] dbg: plugin: registered 
Mail::SpamAssassin::Plugin::RelayCountry=HASH(0x29b40b0)
[18136] dbg: plugin: 
Mail::SpamAssassin::Plugin::RelayCountry=HASH(0x29b40b0) implements 
'extract_metadata'
[18136] dbg: plugin: 
Mail::SpamAssassin::Plugin::RelayCountry=HASH(0x29b40b0) implements 
'parsed_metadata'


The particular test message that I used has this Received header.

Received: from 14.9.17.81.nexcom.ru ([81.17.9.14])
  by ax7.axolotl.com (Lotus Domino Release 7.0.2)
  with ESMTP id 2006122820 http://www.snapanumber.com/563462-40926 ;
  Thu, 28 Dec 2006 20:56:34 -0800 

I did a manual whois lookup on IP address 81.17.9.14 and it is registered 
to Russia, so I think I should get a X-Relay-Countries: RU header. But 
it doesn't work.



If you just want a header added with the relay countries listed then you'll 
need to patch SA (3.1x) see the wiki (or review recent threads here).


Otherwise you need to specify in either local.cf or a dedicated conf file those 
countries you want to see in the headers and with which score.

To test these I wrote a simple script (I'm no programmer) below which writes 
Relay_Countries.cf which you can put in your spamassassin directory. You can 
enable/disable each entry by toggling the value of the 1st field and adjust the 
scores by amending the last field. You can then tweak to just track those 
countries you are interested in. I did include all the country codes as listed 
on the ISO site.

Alan




#! /bin/bash

echo start


# shopt -s -o xtrace


OUTPUT_FILE=Relay_Countries.cf
OUTPUT_DIR=.
#OUTPUT_DIR=/etc/mail/spamassassin


#
# Fields:  
#

USE=1   # yes=1, no=0
CODE=2  # Country Code
DESCRIPTION=3   # Description
SCORE=4 # Score

NUM_FIELDS=4

#
# Data:
#
COUNTRY[1]=1~AD~Andorra~0.001
COUNTRY[2]=1~AE~United Arab Emirates~0.001
COUNTRY[3]=1~AF~Afghanistan~0.001
COUNTRY[4]=1~AG~Antigua and Barbuda~0.001
COUNTRY[5]=1~AI~Anguilla~0.001
COUNTRY[6]=1~AL~Albania~0.001
COUNTRY[7]=1~AM~Armenia~0.001
COUNTRY[8]=1~AN~Netherlands Antilles~0.001
COUNTRY[9]=1~AO~Angola~0.001
COUNTRY[10]=1~AQ~Antarctica~0.001
COUNTRY[11]=1~AR~Argentina~0.001
COUNTRY[12]=1~AS~American Samoa~0.001
COUNTRY[13]=1~AT~Austria~0.001
COUNTRY[14]=1~AU~Australia~0.001
COUNTRY[15]=1~AW~Aruba~0.001
COUNTRY[16]=1~AX~Åland Islands~0.001
COUNTRY[17]=1~AZ~Azerbaijan~0.001
COUNTRY[18]=1~BA~Bosnia and Herzegovina~0.001
COUNTRY[19]=1~BB~Barbados~0.001
COUNTRY[20]=1~BD~Bangladesh~0.001
COUNTRY[21]=1~BE~Belgium~0.001
COUNTRY[22]=1~BF~Burkina Faso~0.001
COUNTRY[23]=1~BG~Bulgaria~0.001
COUNTRY[24]=1~BH~Bahrain~0.001
COUNTRY[25]=1~BI~Burundi~0.001
COUNTRY[26]=1~BJ~Benin~0.001
COUNTRY[27]=1~BM~Bermuda~0.001
COUNTRY[28]=1~BN~Brunei Darussalam~0.001
COUNTRY[29]=1~BO~Bolivia~0.001
COUNTRY[30]=1~BR~Brazil~0.001
COUNTRY[31]=1~BS~Bahamas~0.001
COUNTRY[32]=1~BT~Bhutan~0.001
COUNTRY[33]=1~BV~Bouvet Island~0.001
COUNTRY[34]=1~BW~Botswana~0.001
COUNTRY[35]=1~BY~Belarus~0.001
COUNTRY[36]=1~BZ~Belize~0.001
COUNTRY[37]=1~CA~Canada~0.001
COUNTRY[38]=1~CC~Cocos (Keeling) Islands~0.001
COUNTRY[39]=1~CD~Congo, the Democratic Republic of the~0.001
COUNTRY[40]=1~CF~Central African Republic~0.001
COUNTRY[41]=1~CG~Congo~0.001
COUNTRY[42]=1~CH~Switzerland~0.001
COUNTRY[43]=1~CI~Côte d'Ivoire~0.001
COUNTRY[44]=1~CK~Cook Islands~0.001
COUNTRY[45]=1~CL~Chile~0.001
COUNTRY[46]=1~CM~Cameroon~0.001
COUNTRY[47]=1~CN~China~0.001
COUNTRY[48]=1~CO~Colombia~0.001
COUNTRY[49]=1~CR~Costa Rica~0.001
COUNTRY[50]=1~CU~Cuba~0.001
COUNTRY[51]=1~CV~Cape Verde~0.001
COUNTRY[52]=1~CX~Christmas Island~0.001
COUNTRY[53]=1~CY~Cyprus~0.001
COUNTRY[54]=1~CZ~Czech Republic~0.001
COUNTRY[55]=1~DE~Germany~0.001
COUNTRY[56]=1~DJ~Djibouti~0.001
COUNTRY[57]=1~DK~Denmark~0.001
COUNTRY[58]=1~DM~Dominica~0.001
COUNTRY[59]=1~DO~Dominican Republic~0.001
COUNTRY[60]=1~DZ~Algeria~0.001
COUNTRY[61]=1~EC~Ecuador~0.001
COUNTRY[62]=1~EE~Estonia~0.001
COUNTRY[63]=1~EG~Egypt~0.001
COUNTRY[64]=1~EH~Western Sahara~0.001
COUNTRY[65]=1~ER~Eritrea~0.001
COUNTRY[66]=1~ES~Spain~0.001
COUNTRY[67]=1~ET~Ethiopia~0.001
COUNTRY[68]=1~FI~Finland~0.001
COUNTRY[69]=1~FJ~Fiji~0.001
COUNTRY[70]=1~FK~Falkland Islands (Malvinas)~0.001
COUNTRY[71]=1~FM~Micronesia, Federated States of~0.001
COUNTRY[72]=1~FO~Faroe Islands~0.001
COUNTRY[73]=1~FR~France~0.001
COUNTRY[74]=1~GA~Gabon~0.001
COUNTRY[75]=1~GB~United 

Re: Spamassassin doesn't ding sender for saying HELO i-am-you

2006-12-07 Thread Alan Munday

Justin Mason wrote the following on 07/12/2006 13:21:


This is a great spam-sign alright, but I don't know of a way to detect
what the local site's HELO is, bar each site writing their own rules to do
so.

Bayes does a good job of figuring this out, btw.

Any suggestions?


A script that telnets into the mail system to discover helo name and the 
associated IP?

Then it can write a system specific rule.

Alan



Re: rules_du_jour not working confusion?

2006-12-06 Thread Alan Munday

Daryl C. W. O'Shea wrote the following on 06/12/2006 00:31:


Advantage over sa-update?  Other than the issue with 3.1.6 (only), there 
shouldn't be any issues with how sa-update lints rules. 


This is not obvious as there is no mention of linting in the docs http://spamassassin.apache.org/full/3.1.x/doc/sa-update.html 

If so is there a migration guide somewhere on moving from RDJ to 
sa-update?


- remove existing SARE rules from wherever you've got them
- decide on which provider of the SARE channel(s) you're going to use
- follow that providers directions


And while there is good information on using sa-update for SARE rules, there 
don't appear to be any references on how-to migrate to it from RDJ.

The only other thing (AFAIK) that would hold someone from moving is that RDJ 
still covers some rule sets that are not available via sa-update.

Alan





Re: rules_du_jour not working confusion?

2006-12-05 Thread Alan Munday

By default, there is no duplication.  sa-update will update only the stock
rules.  However, there have been additional channels created for sa-update
to allow it to update the SARE rules as well.  You just add the ones you
want to your sa-update channels file.


One advantage RDJ seems to have is that it won't leave you in the situation of 
a non functional SA because your updated rules don't lint.

If using sa-update for SARE rules, are these stored in the same location as the 
originals or are they downloaded to the /var/lib/spamassassin tree?

If so is there a migration guide somewhere on moving from RDJ to sa-update?

Alan



Score=x+5

2006-11-29 Thread Alan Munday

I've just seen a mail marked as spammy (amavisd-new) where the score header had 
Score=x+5 where x was the sum of the SA tests.

X-Spam-Status:  Yes, score=0.917+5 tagged_above=0 required=5 
tests=[AWL=0.727,BAYES_00=-2.599, BOTNET_SERVERWORDS=-0.01, 
FORGED_RCVD_HELO=0.135,HTML_MESSAGE=0.001, P0F_UNIX=-0.001, 
SARE_HTML_MANY_BR05=0.5,SARE_HTML_TD_BR=0.934, SARE_UNA=1.231, SPF_PASS=-0.001]

I'm curious as to where the 5 came from as the the mail report does not look like spam: 


Content analysis details:   (0.9 points, 5.0 required)

pts rule name  description
 -- --
-0.0 P0F_UNIX   OS fingerprint BSD/Solaris/HP-UX/Tru64
0.1 FORGED_RCVD_HELO   Received: contains a forged HELO
-0.0 SPF_PASS   SPF: sender matches SPF record
-0.0 BOTNET_SERVERWORDS Hostname contains server-like substrings
-2.6 BAYES_00   BODY: Bayesian spam probability is 0 to 1%
   [score: 0.]
0.0 HTML_MESSAGE   BODY: HTML included in message
1.2 SARE_UNA   RAW: SARE_UNA
0.9 SARE_HTML_TD_BRFULL: Multiple line breaks in spammer pattern
0.5 SARE_HTML_MANY_BR05Tooo many br's!
0.7 AWLAWL: From: address is in the auto white-list



I've not seen this before (in over 4 years) and could not see and answer from a 
quick search.

Thanks

Alan


Re: FuzzyOCR request

2006-10-04 Thread Alan Munday

decoder wrote the following on 04/10/2006 21:38:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Alan Munday wrote:

Chris

Could you consider adding a configuration parameter which would have
the effect of scoring all results as zero?

This would allow people to configure FuzzyOCR for their systems in
the knowledge that it will not affect the current running state. It
will also allow people to test the effects of FuzzyOCR on their
current traffic before taking it live.

regards

Alan


This seems like a very good idea, I will implement this as soon as I
am able to continue the development again. At the moment I am busy
with unversity stuff but in some weeks I will have more time again :)

Best regards,


Chris


Chris

Thank you for considering this. 


I've been following your developments and looking at how to integrate with my 
(few) systems. But as I don't have a test environment (until I have built a 
VMWare one) I was cautious at trying this with one of the live box's. Zero 
scoring seemed to be a good way round this.

regards

Alan


Re: URIBL?

2005-08-26 Thread Alan Munday

jdow wrote the following on 26/08/2005 22:08:

Ask an amavisd-new expert. It's already part of SpamAssassin. Perhaps
amavisd-new overrides some of the SpamAssassin configurations? Good
luck with it.

{^_^}

From: Thomas Deliduka [EMAIL PROTECTED]


But what configuration do I need to do to add it?

On 8/26/05 5:01 PM this was written:


From: Thomas Deliduka [EMAIL PROTECTED]

I couldn't find an answer to this in the archives. My apologies if 
this is

there.

I ran a test on a spam (spamassassin -t spam) and within the rules 
that

matched it outputted these:

0.6 URIBL_SBL  Contains an URL listed in the SBL blocklist
3.9 URIBL_SC_SURBL Contains an URL listed in the SC SURBL
blocklist
2.0 URIBL_OB_SURBL Contains an URL listed in the OB SURBL
blocklist
0.5 URIBL_WS_SURBL Contains an URL listed in the WS SURBL
blocklist
2.0 URIBL_AB_SURBL Contains an URL listed in the AB SURBL
blocklist
1.5 URIBL_JP_SURBL Contains an URL listed in the JP SURBL
blocklist

However, the mail server when using amavisd-new checks spam, it never
checks
against this SURBL blocklist. I see in init.pre this line:

loadplugin Mail::SpamAssassin::Plugin::URIDNSBL

Which I think is related. But in either case. Why would it check within
the
testing system but not when the actual program checks? Is there a 
way to

enable it?



I don't know about amavisd-new from shucked corn; but, I understand it
runs its own daemonized spamassassin. If so then you may have to restart
it. With spamd you certainly have to restart the daemon to get it to
read changes to the configuration files, with the exception of the
user's configuration files.





Spamd is not called from amavisd-new. It calls spamassassin directly.

The configuration information with respect to individual SURBL's needs to go 
into SURBL.cf in the directory you store your spamassassin information (e.g. 
/etc/mail/spamassassin).

To use SURBL's you need the load plugin statement in init.pre.

So if it works from calling spamassasin on the command line it should be the same as when amavisd-new calls it. 


My last guess at why the difference, is that you were not logged in as the 
amavis user when you ran spamassassin.

HTH

Alan


Re: Cannot get rid of new online pharmacy spams

2005-05-25 Thread Alan Munday

Eddy Beliveau wrote the following on 25/05/2005 14:19:


Hi!

I'm running spamassassin 2.4 with pamCopURI 0.24 and it work perfectly.  
Thanks  ;-)



Eddy

Have you tried updating to a newer version?

I suspect it will be many peoples first suggestion.

Alan


AWL - SQL

2005-05-13 Thread Alan Munday
Is it possible to move the awl data when migrating to SQL?
Thanks
Alan


Re: AWL - SQL

2005-05-13 Thread Alan Munday
Michael Parker wrote the following on 13/05/2005 17:32:
On Fri, May 13, 2005 at 05:28:14PM +0100, Alan Munday wrote:
Is it possible to move the awl data when migrating to SQL?

tools/convert_awl_dbm_to_sql
Michael
Michael
Ah ha, I did not have the tools installed.
Maybe a reference to this could be added to the sql/README.awl ?
Thanks.
Alan



Re: AWL - SQL

2005-05-13 Thread Alan Munday
Alan Munday wrote the following on 13/05/2005 17:48:
Michael Parker wrote the following on 13/05/2005 17:32:
On Fri, May 13, 2005 at 05:28:14PM +0100, Alan Munday wrote:
Is it possible to move the awl data when migrating to SQL?

tools/convert_awl_dbm_to_sql
Michael

Michael
Ah ha, I did not have the tools installed.
Maybe a reference to this could be added to the sql/README.awl ?
Thanks.
Alan
Just to report the the conversion script worked without problem.
Thanks
Alan



SQL Question

2005-05-12 Thread Alan Munday
I've been looking through the SA SQL docs and can only see references to 
spamc/spamd use of SQL.
Can I just confirm that SQL can be used with spamassassin as well?
Thanks
Alan


Re: SQL Question

2005-05-12 Thread Alan Munday
Michael Parker wrote the following on 12/05/2005 17:37:
On Thu, May 12, 2005 at 05:16:19PM +0100, Alan Munday wrote:
I've been looking through the SA SQL docs and can only see references to 
spamc/spamd use of SQL.

Can I just confirm that SQL can be used with spamassassin as well?

Only for Bayes and AWL, userprefs in SQL requires the use of spamd.
Michael
Michael
Thanks, though I can't seem to find the Docs that cover bayes/AWL setup on the 
Wiki or apache site.
Are there any docs that are considered definitive around?
Alan



Re: SQL Question

2005-05-12 Thread Alan Munday
Kevin Peuhkurinen wrote the following on 12/05/2005 18:03:
Alan Munday wrote:
Look at http://spamassassin.apache.org/full/3.0.x/dist/doc/ for file 
names that end in SQL.

Kevin
Thanks, they did not come up when googling.
Alan


Re: SQL Question

2005-05-12 Thread Alan Munday
Kevin Peuhkurinen wrote the following on 12/05/2005 18:12:
Actually, scratch that.  Those are not the documents I was thinking they 
were.Instead, download the latest copy of SA and you will find a 
folder in the distribution called sql.  In there, there is some README 
files that describe how to set everything up.

That's better thanks
Alan


Re: amavisd-new

2005-04-21 Thread Alan Munday
Kevin Peuhkurinen wrote the following on 21/04/2005 16:05:
The expected results of this, as I say, is that ALL emails will be 
tagged as spam; will have SA headers inserts; will have a copy placed 
into the the quarantine folder; and finally will be passed on back to 
the MTA for delivery.   This should suffice for the type of testing you 
want to do.   Anything more complicated and you will need to use your 
MTA to help sort things out.

Kevin
Thanks Kevin
This is pretty close but I don't really want all the mail to the end users 
marked as spam.
My current live box's use anomy where I've amended the scripts to copy mail 
into mbox's non-spam, marked-spam and not-delivered-spam.
This means it has been really easy to check for false positives/negatives and 
to feed corrections back into SA.
This was one of the reasons for trying to replicate this with amavisd-new. 
Being new to amavisd-new I'm still getting used to its architecture. Which 
while I've been doing this I've been trying to figure out how to handle 
corrections to SA when I don't have a copy of the source mail.
Right now my thinking was to add an -o always_bcc = [EMAIL PROTECTED] to 
master.cf for when amavisd-new passes the mail back to postfix for delivery.
regards
Alan



Re: How do I whitelist this list?

2005-03-22 Thread Alan Munday
I'll mention this again since i have yet to come up with a solution. 
While the above works great for people using procmail, does anyone have 
a solution that works without procmail?  Im stuck passing all list 
traffic through SA because of this.  Just this morning someone on this 
list posted a spam that they received.  It was autolearned as ham on my 
system because it came across on the list.  Then the message gets popped 
down to my workstation and i cant even get the original message back to 
the server to re-learn it.  Theres gotta be a solution out there for the 
non-procmail people.  Surely somebody is doing it??

Qmail/qmail-scanner/clamav/spamassassin on rh9
-Jim
Use dedicated e-mail addresses for mail lists.
As mail for that address arrives, don't send it through whatever filtering you 
have.
Alan


Re: pyzor

2005-02-28 Thread Alan Munday
Matt Kettler wrote the following on 28/02/2005 12:32:
At 07:14 AM 2/28/2005, Slava Garaschenko wrote:
But, then I run spamassassin in daemon mode by 
/etc/rc.d/init.d/spamassassinstart
I dont' see any request to port 24441 which is used by pyzor.

This means that pyzor completely don't work with spamassassin. At 
least then spamassassin is used in daemon mode.

When you did this test, did you actually feed a message to spamc?
Merely starting spamd does nothing until spamc has a message to check.
Matt
I've been wondering if there has been a problem with pyzor for a while.
On reading this I've just checked my firewall logs for traffic to the pyzor 
servers.
In the last 2 hours there have been 46 requests sent to the servers from one 
spamd daemon.
Of these there have been no responses from the pyzor servers. 

While a test using spamassassin -D --lint usually shows a response from pyzor, 
right now they are timing out.
The problem the OP has is probably due to the remote end timing out.
I would be interested if anyone knows if there has been a change in  status for 
the pyzor project as I have not seen a hit from them in a long while.
regards
Alan



Re: pyzor

2005-02-28 Thread Alan Munday
martin smith wrote the following on 28/02/2005 15:33:
Just found this, could be the cause of some of the problems. 

2005-02-04 
The public server changed its address; please re-run 'pyzor discover' to
find the new server. 

http://pyzor.sourceforge.net/
Martin
Martin 

As the date shows, this is an old notice. However I did run a discover before I 
did the testing.
Nothing coming back from the pyzor servers.
Alan



Re: pyzor

2005-02-28 Thread Alan Munday
Matt Kettler wrote the following on 28/02/2005 15:48:
Alan,
Slava is running tcpdump, and claims to not see *any* pyzor traffic at 
all, not even the outbound request.

Their problem is almost certainly not due to remote-side timeouts.
The only thing I can think of is the -H parameter to spamd... With no 
parameter the docs claim it will use the spamc caller's home dir for 
razor/pyzor/dcc user config files.

Slava, does the user vilter have a home directory, and rwx permissions 
to it?

Also, what user does spamc get called as?
Matt/Bill
My issue is that although a pyzor discover has updated the servers file, and 
shows the new server address Bill pointed out, when called in debug mode the 
old address is still being used.
Alan


Re: pyzor

2005-02-28 Thread Alan Munday
And my problem, should anyone find this useful:
pyzor discover was correctly updating the servers file for the user account it 
was called from.
However I have a --homedir set for pyzor in local.cf and as this is not the 
same dir as the user file hence the failure to update.
Deleting/renaming the servers file in the --homedir and then running 
spamassasin in debug mode sees this copy of servers being updated correctly.
Alan



Re: Addition Problem?

2005-02-02 Thread Alan Munday
Matt Kettler wrote the following on 02/02/2005 17:12:
Bonus points if you use the add_header feature to create a secondary 
X-Spam-Status header that is X-Server1-Spam-Status:

OK Matt
I liked the idea of this so have been looking through the config docs to find 
the answer.
But I've failed to do so.
So how do you use add_header to modify the X-Spam headers?
Thanks
Alan
And I really wanted that bonus point.


Re: Addition Problem?

2005-02-02 Thread Alan Munday
Matt Kettler wrote the following on 02/02/2005 22:02:
Actually, it's limit in SA's header generation that I forgot about. I 
forgot that it forces X-Spam as a prefix.

Does that mean I can have the bonus point after all?


RH9 Insecure dependency on reporting to spamcop (SA 3.0.2)

2005-01-16 Thread Alan Munday
I wondered if anyone had tracked down a cause/solution to the insecure 
dependency on reporting to spamcop with RH9?
I have 3 RH9 servers here. One, which has been upgraded from RH7 progressively 
through to RH9, which does not report this insecure dependency. While I have 2 
others, installed with RH9 as new builds, which do show this insecure 
dependency.
I know its not an SA problem just wondered if someone had tracked down a 'fix'
Thanks
Alan


Re: Postfix relay problem with SA ?

2005-01-11 Thread Alan Munday
Ronald I. Nutter wrote the following on 11/01/2005 16:43:
I am noticing entries in the maillog like the following.  This tells me
that somehow mail is relaying through my system.  I followed the Scott
Henderson setup document and havent noticed this before.
Jan 11 11:24:33 SA2 postfix/smtp[12722]: 8FE98F4280:
to=[EMAIL PROTECTED],
relay=milter1.store.vip.sc5.yahoo.com[216.136.232.238], delay=22,
status=bounced (host milter1.store.vip.sc5.yahoo.com[216.136.232.238]
said: 550 5.0.0 [EMAIL PROTECTED]... [EMAIL PROTECTED]: User
unknown (in reply to RCPT TO command))
Ron
Are you sure you have a problem?
The mail log shows postfix bouncing the message.
Alan


AWL not working on 3.02

2004-12-22 Thread Alan Munday
I have a couple new installs of SA3 (on RH9 from rpm) where I knew AWL did not 
run and today I decided to see why.
The output from -D --lint is:
debug: lock: 31719 created 
/var/spool/spamassassin/auto-whitelist.lock.mx1.domain.com.31719
debug: lock: 31719 trying to get lock on /var/spool/spamassassin/auto-whitelist 
with 0 retries
debug: lock: 31719 link to /var/spool/spamassassin/auto-whitelist.lock: link ok
debug: Tie-ing to DB file R/W in /var/spool/spamassassin/auto-whitelist
debug: unlock: 31719 unlink /var/spool/spamassassin/auto-whitelist.lock
debug: open of AWL file failed: Cannot open auto_whitelist_path 
/var/spool/spamassassin/auto-whitelist: Inappropriate ioctl for device
debug: Post AWL score: 0.2990001
So I've done the obvious and checked the user settings and permissions are set 
correctly, indeed I opened the permissions up on the AWL directory.
One thing I thought could be a problem is that I have two versions of DB on 
this system:
db4-4.0.14-20
db4-4.1.25-14
And I also have:
gdbm-1.8.0-20
So I've set auto_whitelist_db_modules to DB_File and GDBM_File separately 
and retested.
None of which is having any effect on the lint output. I've done a fair bit of 
searching for others showing this error but the postings I'm finding relate to 
older versions of SA.
Currently I have the following re. AWL in local.cf:
# Auto  Whitelist
use_auto_whitelist  1
auto_whitelist_path /var/spool/spamassassin/auto-whitelist
auto_whitelist_file_mode  0777
auto_whitelist_db_modules GDBM_File
Does anyone have any thoughts on why AWL is not working here? Are there some 
initiation procedures that need to be run?
Thanks
Alan


x_headers 1.19 lint fail for SA 3.xx

2004-11-24 Thread Alan Munday
Brent - for information:
Version line: # $Revision: 1.19 $
Lint output: warning: description for BCS_XMFLAG_AUTH is over 50 chars
Unless x_headers should not be used in 3.xx?
Alan


FW: Lint fails on latest bogus0virus-warnings.cf

2004-11-01 Thread Alan Munday
 -Original Message-
 From: Mike Zanker [mailto:[EMAIL PROTECTED] 
 Sent: Monday, November 01, 2004 6:43 AM
 To: users@spamassassin.apache.org
 Subject: Lint fails on latest bogus0virus-warnings.cf
 
 
  From RulesDuJour last night:
 
 Lint output: Relative score without previous setting in SpamAssassin 
 configuration, skipping: score VIRUS_WARNING412   
 Unhelpful 'virus 
 warning' (412)
 
 Thanks,
 
 Mike.
 

Just for clarification, after this update:

Lint fails on 3.0.1 here 

Lint does not fail for 2.6.3 here.

Alan



[OT] hascash

2004-10-21 Thread Alan Munday

Does anyone have any knowledge on how the development of hascash is going?
I've been searching around this afternoon and can find only a little
information (2 pages of Google search results) out there. Particularly
looking to see if any plugins are available (or will be) for outlook clients
(the hashcash guy's don't seem to keen on supporting M$) or MTA's e.g.
postfix (though there does seem to be the odd alpha out there).

As I can see no references to hashcash in my logs;  Is hashcash like SURBL,
I'm on RH9 here, in that there are some modules required before SA will test
for it? I noticed a reference on a Debian site to a hashcash application. Or
is it sufficient to have sha1sum loaded?

Thanks

Alan



[OT] Spammer behaviour

2004-10-13 Thread Alan Munday

I'm in the process of building a couple of new servers and to run some test
mail through, put one of them on the tertiary address for a domain. While I
know this topic was discussed a while ago I was surprised at what I was
seeing in the logs namely;

- all traffic to the tertiary was UCE
- there was a very low percentage of the total UCE for this domain hitting
the tertiary
- most of the UCE is hitting the secondary
- not a single connection to the tertiary, that was greylisted, was
re-presented.

NRR

Alan

PS Has Chris been on the happy pill's?



RE: upgrade not going to plan

2004-10-13 Thread Alan Munday
 -Original Message-
 From: Ronan [mailto:[EMAIL PROTECTED] 
 Sent: Wednesday, October 13, 2004 11:32 AM
 To: spam
 Subject: upgrade not going to plan
 
 
 Just completed an upgrade to v3.0 from 2.63.
 SA not accepting *any* external connections on the one mailhub i 
 upgraded on.
 The other 2 hubs are running fine but still using 2.63.
 all hubs are solaris sun boxes.
 
 Is there any configuration changes needed for version3 cause i havent 
 seen any refernce to it in the sourece or readmes...

Did you try here?

http://spamassassin.apache.org/full/3.0.x/dist/UPGRADE



Building SA3 on RH9

2004-10-05 Thread Alan Munday

I've built a set of rpm's from the SA3 tar.gz

I've used yum for updates and have installed the perl modules which means I
have perl-Mail-SpamAssassin and spamassassin installed.

I have however not found perl(Parse::Syslog) or
perl(Statistics::Distributions) needed for spamassassin-tools.

I just wanted to check the best method of getting these modules as I know RH
can be a bit fussy and I want to avoid getting modules in the wrong part of
the perl tree. 

Thanks

Alan