spurious __alarm__ messages in spamd log

2005-08-19 Thread Steve Martin
Sat Aug 20 00:28:36 2005 [16014] info: spamd: processing message <[EMAIL PROTECTED]> for filter:88 Sat Aug 20 00:28:42 2005 [16014] error: __alarm__ Sat Aug 20 00:28:42 2005 [16014] error: __alarm__ Sat Aug 20 00:28:49 2005 [16014] info: spamd: identified spam (35.1/5.0) for filter:88 in 13.7

Re: mail bouncing for ever - i'm about to suicide (joke)

2005-08-19 Thread Noel Jones
On 8/19/05, Thomas Manson <[EMAIL PROTECTED]> wrote: > And the mail keeps bouncing for ever in the active queue of postfix (i can > see it changing of queue) ... > Aug 19 23:31:35 dell1 sendmail[23733]: j7JLVYcj023733: > [EMAIL PROTECTED], ctladdr=root (0/0), delay=00:00:01, > xdelay=00:00:01, ma

protecting SQL login info

2005-08-19 Thread Dan Mahoney, System Admin
Hey all, I'm doing everything (bayes, AWL, userprefs) in SQL. Is there some way to protect the values I've got in /etc/mail/spamassassin/local.cf such as my mysql username and password from casual snoopage? Only think I could think of was to make SA setGID, and have the file chmod 750. An

Re: zombies

2005-08-19 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jim Knuth writes: > Hallo und Guten Tag Justin, > > Gestern (am 18.08.2005 - 22:39 Uhr) >schriebst Du: > > > -BEGIN PGP SIGNED MESSAGE- > > Hash: SHA1 > > > hmm -- sounds like a bug. > > > If you can capture an "strace" trace of a spa

Re: Trojan infected FN

2005-08-19 Thread Chris
On Friday 19 August 2005 09:54 am, Matt Kettler wrote: > > Setting up clamav is quick and easy, and best of all, free. > > If you've got SA 3.x, there's even a clamAV plugin so you can get SA to > call clamav while it's scanning for spam. > > http://wiki.apache.org/spamassassin/ClamAVPlugin > > I

RE: Help with RR DNS for spamd?

2005-08-19 Thread email builder
> > > Telnet uses the built-in resolver -- most ordinary > > applications work > > > this way. > > > > Hrm. Any tips on how to make it aware of my new "spam." subdomain? > > If a application uses a resolver (it's own or the built > in resovler) that points solely to a DNS server (set) > WITH

Re: Sudden Increase in Spam Mails

2005-08-19 Thread jdow
SURBL, tweaked scores for image only, and some custom recipient rules have kept it to virtually zero here. {^_^} - Original Message - From: "Bruno S. Delbono" <[EMAIL PROTECTED]> To: "Anton Krall" <[EMAIL PROTECTED]>; Sent: 2005 August, 19, Friday 11:37 Subject: Re: Sudden Increase in

Re: Sudden Increase in Spam Mails

2005-08-19 Thread jdow
From: "Loren Wilton" <[EMAIL PROTECTED]> Is it just me or has spam increased for the past few days? Its like amavis and SA are not caching a lot anymore... Haven't seen it here, but that doesn't mean a whole lot. Different people seem to get different kinds of spam. Actually in the last tw

Re: mail bouncing for ever - i'm about to suicide (joke)

2005-08-19 Thread wolfgang
In an older episode (Saturday, 20. August 2005 00:09), wolfgang wrote: > in my view you should UNinstall sendmail, then reinstall postfix - or maybe > even better UNinstall sendmail, then UNinstall postfix. oops, forgot the last step: then install postfix again ;) > > hope this helps, > > wo

Re: mail bouncing for ever - i'm about to suicide (joke)

2005-08-19 Thread wolfgang
your log show entries from both postfix and sendmail - that looks bad to me - from my experience, they can *not* co-exist on a machine. in my view you should UNinstall sendmail, then reinstall postfix - or maybe even better UNinstall sendmail, then UNinstall postfix. hope this helps, wolfgang

mail bouncing for ever - i'm about to suicide (joke)

2005-08-19 Thread Thomas Manson
Hi, I've a strang issue: I send a mail from root to [EMAIL PROTECTED]. The user actually recieve the mail, but as an undelivered  mail return to sender . And the mail keeps bouncing for ever in the active queue of postfix (i can see it changing of queue) (note: this server is not in production, s

Re: New License terms for DCC/Razor2

2005-08-19 Thread Theo Van Dinter
On Fri, Aug 19, 2005 at 05:19:28PM -0400, Dan Mahoney, System Admin wrote: > Okay, I just looked over the sites for both those products, as well as the > wiki. How has the license changed? As a service provider, what do I need > to do to comply with that license? You ought to ask the providers

Re: New License terms for DCC/Razor2

2005-08-19 Thread Matt Kettler
Dan Mahoney, System Admin wrote: >> From the 3.1 features list: > > > - Razor: disable Razor2 support by default per our policy, since the > service is not free for non-personal use. It's trivial to reenable. > > - DCC: disable DCC for similar reasons, due to new license terms. > > Okay, I j

New License terms for DCC/Razor2

2005-08-19 Thread Dan Mahoney, System Admin
From the 3.1 features list: - Razor: disable Razor2 support by default per our policy, since the service is not free for non-personal use. It's trivial to reenable. - DCC: disable DCC for similar reasons, due to new license terms. Okay, I just looked over the sites for both those products,

RE: Sudden Increase in Spam Mails

2005-08-19 Thread Matthew Yette
Do you use Bayes? Are you using sa-learn to teach the message as spam? -- Matthew Yette Senior Engineer - NOC/Operations MA Polce Consulting, Inc. [EMAIL PROTECTED] 315-838-1644 (w) 315-356-0597 (f) AIM/Yahoo: MAPolceNOC MSN: [EMAIL PROTECTED] -Original Message- From: Anton Krall [mailto

RE: Ham not auto-learning?

2005-08-19 Thread Matthew Yette
That sounds about right. I did get those thresholds from somewhere on this list, though, I believe. No biggie. Bayes has been pretty spot on so far (I can post the rules chart if anyone is interested.), so I'm pretty confident in allowing it to continue to learn. Thanks for your help. -- Matthe

Re: Sudden Increase in Spam Mails

2005-08-19 Thread Bruno S. Delbono
Anton Krall wrote: Im getting very low scores.. Smapm emails are passing thru, containing just 1 big jpg inside or text with one html link... These spam could easily be confused with normal email... Which files would I need to post here? - The mail with full content headers + sa score - SA v

RE: Sudden Increase in Spam Mails

2005-08-19 Thread Anton Krall
Im getting very low scores.. Smapm emails are passing thru, containing just 1 big jpg inside or text with one html link... These spam could easily be confused with normal email... Which files would I need to post here? |-Original Message- |From: Matthias Fuhrmann |[mailto:[EMAIL PROTEC

Re: Ham not auto-learning?

2005-08-19 Thread Steve Martin
I'm going to guess that whitelist isn't taken into consideration. -12 for autolearning of ham is pretty extreme, I'm not surprised you aren't seeing any autolearning. The default is .1 On Aug 19, 2005, at 1:24 PM, Matthew Yette wrote: Running the sa-stats.pl version 0.9 that produces a char

Re: Ham not auto-learning?

2005-08-19 Thread Craig McLean
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Matthew Yette wrote: | Running the sa-stats.pl version 0.9 that produces a chart with stats on | what rules are hit for spam and ham most frequently, I notice that of | all 13,411 autolearns performed, every one of them was for spam. Ham has | 0 messa

How long should a bayes_expire take?

2005-08-19 Thread Steve Martin
spamd is running on an old 400Mhz iMac, using MySQL for its bayes database, which look like this... sa-learn --dump magic 0.000 0 3 0 non-token data: bayes db version 0.000 0 1851 0 non-token data: nspam 0.000 0 28155 0

Ham not auto-learning?

2005-08-19 Thread Matthew Yette
Running the sa-stats.pl version 0.9 that produces a chart with stats on what rules are hit for spam and ham most frequently, I notice that of all 13,411 autolearns performed, every one of them was for spam. Ham has 0 messages autolearned. Wouldn't, for example, a message that comes in and has been

Re: rpm -Uvh problem

2005-08-19 Thread Kelson
Bryan Hepworth wrote: The original update was from an rpm that was pre-built because there wasn't an official redhat rpm around at the time and there was a torrent of guff coming through, so it's more than just the perl rpm it was a whole 9 yards install from the latest one I could find at the

Re: Trojan infected FN

2005-08-19 Thread Matt Kettler
Loren Wilton wrote: >>The main reason is adding rules to catch or not catch viruses would wind > > up > >>diluting the scores of the spam rules. This would weaken SA's spam >>detecting abilities, in order to grant it rather lame virus catching > > abilities. > > Hum. Interesting philosophy, bu

Re: Sudden Increase in Spam Mails

2005-08-19 Thread Matthias Fuhrmann
On Fri, 19 Aug 2005, Anton Krall wrote: > Guys. > > Is it just me or has spam increased for the past few days? Its like amavis > and SA are not caching a lot anymore... > > Any ideas? does it mean, there are no tags set in the header of emails, or just low scorings? no tags means, there were time

Re: rpm -Uvh problem

2005-08-19 Thread Kelson
Bryan Hepworth wrote: I've built the latest version as suggested on the main site which all went very well, however when I come to do the upgrade I get this error:- file /usr/share/spamassassin/20_porn.cf from install of perl-Mail-SpamAssassin-3.0.4-1 conflicts with file from package spamassa

Re: Trojan infected FN

2005-08-19 Thread Loren Wilton
> The main reason is adding rules to catch or not catch viruses would wind up > diluting the scores of the spam rules. This would weaken SA's spam > detecting abilities, in order to grant it rather lame virus catching abilities. Hum. Interesting philosophy, but I don't know that it is actually tr

Re: Sudden Increase in Spam Mails

2005-08-19 Thread Loren Wilton
> Is it just me or has spam increased for the past few days? Its like amavis > and SA are not caching a lot anymore... Haven't seen it here, but that doesn't mean a whole lot. Different people seem to get different kinds of spam. Loren

Re: Trojan infected FN

2005-08-19 Thread Matt Kettler
At 07:16 AM 8/19/2005, Chris wrote: On Thursday 18 August 2005 11:46 pm, Matt Kettler wrote: > At 11:20 PM 8/18/2005, you wrote: > >Got three of these tonight with the same trojan, SA detected the other two > > as spam, this one slipped through just a bit under the wire. > > Spamassassin doesn't

Sudden Increase in Spam Mails

2005-08-19 Thread Anton Krall
Guys. Is it just me or has spam increased for the past few days? Its like amavis and SA are not caching a lot anymore... Any ideas?

Re: zombies

2005-08-19 Thread Mark Martinec
> > > http://bugzilla.spamassassin.org/show_bug.cgi?id=4518 > I expect the scenario goes like that: > - SA spawns a pyzor process, which does not finish in 5 seconds; > - due to #4518 the pipe is not auto-closed by SA until a next > mail-to-be-checked by this process comes around, which may >

Re: rpm -Uvh problem

2005-08-19 Thread Theo Van Dinter
On Fri, Aug 19, 2005 at 10:47:44AM +0100, Bryan Hepworth wrote: > file /usr/share/spamassassin/20_porn.cf from install of > perl-Mail-SpamAssassin-3.0.4-1 conflicts with file from package > spamassassin-3.0.1-0_19.rh9.at This usually happens if you're not trying to upgrade/install both perl-Mail

Re: Trojan infected FN

2005-08-19 Thread Menno van Bennekom
I got spam like that (posted that here some time ago), all with the specific port= helo= characteristic in the header. Since there was no FP during testing I now discard them all in Postfix with: /^Received: from \[[0-9\.]*\] \(port\=[0-9][0-9][0-9][0-9] helo\=\[[a-zA-Z]*\]\)/ DISCARD Regards Menn

RE: Trojan infected FN

2005-08-19 Thread Herb Martin
> -Original Message- > From: Chris [mailto:[EMAIL PROTECTED] > > On Thursday 18 August 2005 11:46 pm, Matt Kettler wrote: > > At 11:20 PM 8/18/2005, you wrote: > > >Got three of these tonight with the same trojan, SA detected the > > >other two as spam, this one slipped through just a b

Re: Trojan infected FN

2005-08-19 Thread Chris
On Thursday 18 August 2005 11:46 pm, Matt Kettler wrote: > At 11:20 PM 8/18/2005, you wrote: > >Got three of these tonight with the same trojan, SA detected the other two > > as spam, this one slipped through just a bit under the wire. > > Spamassassin doesn't try to detect viruses. That's what vir

Re: Trojan infected FN

2005-08-19 Thread JamesDR
Matt Kettler wrote: At 11:20 PM 8/18/2005, you wrote: Got three of these tonight with the same trojan, SA detected the other two as spam, this one slipped through just a bit under the wire. Spamassassin doesn't try to detect viruses. That's what virus scanners are best at. I've been s

rpm -Uvh problem

2005-08-19 Thread Bryan Hepworth
Hi Everyone I've built the latest version as suggested on the main site which all went very well, however when I come to do the upgrade I get this error:- file /usr/share/spamassassin/20_porn.cf from install of perl-Mail-SpamAssassin-3.0.4-1 conflicts with file from package spamassassin-3.0.

Re: zombies

2005-08-19 Thread Mark Martinec
> > > > Since I use SpamAssassin 3.001000, I have sometimes zombies. And > > > > I`ve found out it. The zombie was pyzor. > > My first guess it that it is a symptom of: > > http://bugzilla.spamassassin.org/show_bug.cgi?id=4518 > Yep, that's a possibility... I expect the scenario goes like that