Re: [dns-operations] negative caching of throwaway spam domains

2006-06-24 Thread Jeff Chan
On Friday, June 23, 2006, 5:09:55 PM, jdow jdow wrote: Jeff, it's probably quite good when the lookup is implemented on spam traps and a small collection of servers. The domain registrars who are honest might like it. It'd reduce the incentive and value of domain kiting. Presumably the list

Re: [dns-operations] negative caching of throwaway spam domains

2006-06-24 Thread Maurice Lucas
On Sat, 2006-06-24 at 05:08 -0700, Jeff Chan wrote: On Friday, June 23, 2006, 5:09:55 PM, jdow jdow wrote: Jeff, it's probably quite good when the lookup is implemented on spam traps and a small collection of servers. The domain registrars who are honest might like it. It'd reduce the

Re: spamd / logging to terminal

2006-06-24 Thread Matt Kettler
numE wrote: Now i have just a small issue left. i use the following /etc/init.d/spamd script: http://kmail.kde.org/unsupported/spamd unfortunately now i get the log messages from spamd always on my root account (displayed in terminal) how may i change this behavior? Edit your

Noob config question

2006-06-24 Thread carnold5
Hello all! I am using SA-3.1.0 for OES-Linux (novell distro based on SLES9); mail server using Hula (Netmail) also a novell product. Clients are thunderbird. I guess my first problem is, i don't seem to have SA configured right, let me explain. I goto my yahoo account and send an email to me

Why does FORGE_RCV_HELO not working for this email...

2006-06-24 Thread Screaming Eagle
All, I am getting this type of email: Return-Path: [EMAIL PROTECTED] X-Spam-Checker-Version: SpamAssassin 3.1.3 (2006-06-01) X-Spam-Virus: No X-Spam-Status: No, score=1.1 required=7.0 tests=BAYES_50,HTML_50_60, HTML_MESSAGE autolearn=no version=3.1.3 X-Spam-Level: * Received: from com

Re: Various plugins for Windows version?

2006-06-24 Thread Loren Wilton
There are some other plugins that i would also like to implement (for example iXhash and OCR Plugin or OCR scanner and image validator SA-plugin), but i don't know whether they work on windows installations. How can i find out if these are meant to function on windows? FWIW the ocr plugin

SPF_SOFTFAIL not working properly

2006-06-24 Thread Jim Hermann - UUN Hostmaster
How do I debug the SPF Module during SA Operations? I have had another email marked as SPF_SOFTFAIL during the first receipt and the From domain does not have a TXT SPF record. When I isolated the message and ran it again, it was processed without any errors. I suspect that there is a problem

Re: Why does FORGE_RCV_HELO not working for this email...

2006-06-24 Thread Loren Wilton
Perhaps a problem with trusted_networks setting? Loren - Original Message - From: Screaming Eagle To: spam mailling list Sent: Saturday, June 24, 2006 7:46 AM Subject: Why does FORGE_RCV_HELO not working for this email... All,I am getting this type of

Sa-update and proxy servers

2006-06-24 Thread Michael Scheidell
I think I noticed small change in sa-update for 3.13. It is now using port 8090 for outgoing connections. (or did it always?) This happened to make it immediately fail on servers in the DMZ which have a strict set of outgoing egress rules. I now need to set a proxy server to do sa-updates

Re: Why does FORGE_RCV_HELO not working for this email...

2006-06-24 Thread Screaming Eagle
Hi, most unlikely, since it is commented out by default. On 6/24/06, Loren Wilton [EMAIL PROTECTED] wrote: Perhaps a problem with trusted_networks setting? Loren - Original Message - From: Screaming Eagle To: spam mailling list Sent: Saturday, June 24, 2006

my own email is in the BAYES_50...

2006-06-24 Thread Screaming Eagle
How do i take my self out of the BAYES_50 test. Thanks.

RE: Sa-update and proxy servers

2006-06-24 Thread Michael Scheidell
-Original Message- From: Michael Scheidell Sent: Saturday, June 24, 2006 11:28 AM To: users@spamassassin.apache.org Subject: Sa-update and proxy servers Patch attached. (works here(tm)) In fact, my nightly cronjob runs 'sa-cover' script: (exit code 4 is for timeouts) Just in

Re: Why does FORGE_RCV_HELO not working for this email...

2006-06-24 Thread Loren Wilton
Then you should perhaps read the documentation on the setting for trusted_networks. - Original Message - From: Screaming Eagle To: Loren Wilton Cc: users@spamassassin.apache.org Sent: Saturday, June 24, 2006 8:28 AM Subject: Re: Why does FORGE_RCV_HELO not

Re: Bayes corrupt?

2006-06-24 Thread Loren Wilton
One of our SA 3.1.0 installations is giving BAYES_00=-2.599 for this definite spam. Does that mean our Bayes database is corrupt? I'd say that it is at the very least mis-trained as far as this spam is concerned. Without further evidence I'd hesitate to state outright that it is corrupt. If

Re: [dns-operations] negative caching of throwaway spam domains

2006-06-24 Thread John D. Hardin
On Sat, 24 Jun 2006, Jeff Chan wrote: Michael gives some good possibilities and a discussion of the difference with greylisting. Note that whois can't really be done on an automated, high-frequency basis. Back when I first suggested this a couple of years ago, it was possible to download a

Re: Adding Phishing Link rule

2006-06-24 Thread Philip Prindeville
What about combining this with a whitelist? I.e. I regularly get emails from target.bifn0.com that contain links that point to themselves, but say they are target.com And in fact, this is a 3rd party that Target has contracted to do outsource mailings for them, so in that respect they are

On bichromatic GIF stock spam

2006-06-24 Thread Philip Prindeville
I get a lot of spam that looks like: http://pastebin.com/729105 on the alsa-devel mailing list, amongst others... And noticed the following. If you decompress the GIF file and decode it into a pixmap image, then do a color histogram of the image, you notice two things immediately. There are

RE: On bichromatic GIF stock spam

2006-06-24 Thread Michael Scheidell
-Original Message- From: Philip Prindeville [mailto:[EMAIL PROTECTED] Sent: Saturday, June 24, 2006 2:10 PM To: users@spamassassin.apache.org Subject: On bichromatic GIF stock spam I get a lot of spam that looks like: http://pastebin.com/729105 on the alsa-devel mailing

Re: On bichromatic GIF stock spam

2006-06-24 Thread Philip Prindeville
Michael Scheidell wrote: -Original Message- From: Philip Prindeville [mailto:[EMAIL PROTECTED] Sent: Saturday, June 24, 2006 2:10 PM To: users@spamassassin.apache.org Subject: On bichromatic GIF stock spam I get a lot of spam that looks like: http://pastebin.com/729105 on the

Re: SPF_SOFTFAIL not working properly

2006-06-24 Thread Michael Monnerie
On Samstag, 24. Juni 2006 17:14 Jim Hermann - UUN Hostmaster wrote: When spf_timeout is set to 5 (default), during the initial email receipt, I think that Mail::SPF::Query exceeds the timeout and the timeout routine does not work properly.  The timeout error causes

Re: my own email is in the BAYES_50...

2006-06-24 Thread Michael Monnerie
On Samstag, 24. Juni 2006 17:30 Screaming Eagle wrote: How do i take my self out of the BAYES_50 test. man sa-learn man spamassassin-run mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at // Tel: 0660/4156531 .network.your.ideas. // PGP Key:

ZMI_GERMAN and using ifplugin: diskussion

2006-06-24 Thread Michael Monnerie
Dear users, I am getting reports that the ifplugin statements in the ZMI_GERMAN ruleset are making lint errors for SA version 2.64, so some people seem to use such an old version. Currently the only use of ifplugin is to find an attachment namen ebay-rechnung.pdf.zip, which contains a virus.

razor is not working ...

2006-06-24 Thread Screaming Eagle
I thought I had razor2 working. From the debug output, it does not seem so. Am i missing something? If so, where can I download it and install it? Thanks. [4133] dbg: config: read file /usr/share/spamassassin/25_razor2.cf [4133] dbg: plugin: loading Mail::SpamAssassin::Plugin::Razor2 from @INC

Re: my own email is in the BAYES_50...

2006-06-24 Thread Michael Monnerie
On Sonntag, 25. Juni 2006 00:55 Screaming Eagle wrote: sa-learn can unlearn a message, but I do not have that message. Would this work if I dump out a backup of it and take out any instances of my email, then use sa-learn to restore back from it.  Thanks. Please keep answers on the list.

Re: razor is not working ...

2006-06-24 Thread Matt Kettler
Screaming Eagle wrote: I thought I had razor2 working. From the debug output, it does not seem so. Am i missing something? If so, where can I download it and install it? Thanks. From the looks of it, you enabled the plugin, but you never installed razor itself. http://razor.sf.net [4133]

pyzor

2006-06-24 Thread Spamassassin List
Hi, Is there a port which I have to open to allow pyzor to run properly? I keep having the below error. [26217] dbg: util: executable for pyzor was found at /usr/bin/pyzor [26217] dbg: pyzor: pyzor is available: /usr/bin/pyzor [26217] dbg: info: entering helper-app run mode [26217] dbg:

Re: pyzor

2006-06-24 Thread Ed Kasky
At 06:51 PM Saturday, 6/24/2006, Somebody wrote -= Hi, Is there a port which I have to open to allow pyzor to run properly? I keep having the below error. Try opening udp port 24441 ... . . . . . . . . . . . . . . . . . . Randomly Generated Quote (474 of 1056): Every time I close the door

Re: On bichromatic GIF stock spam

2006-06-24 Thread Loren Wilton
If, after excluding black, we find that 100% of the color map is that nasty pastel pink or pastel lime green (etc) then it's a spam and we toss it. Sound reasonable? I was thinking about this the other day. I think the concept is reasonable, but as stated doesn't go far enough, and would be

RE: SPF_SOFTFAIL not working properly

2006-06-24 Thread Jim Hermann - UUN Hostmaster
On 6/24/2006 11:14 AM, Jim Hermann - UUN Hostmaster wrote: How do I debug the SPF Module during SA Operations? I have had another email marked as SPF_SOFTFAIL during the first receipt and the From domain does not have a TXT SPF record. When I isolated the message and ran it again,

Re: ZMI_GERMAN and using ifplugin: diskussion

2006-06-24 Thread Loren Wilton
We unfortunately don't have any scripts to deal with version differences. Our technique has been to make two (or more) versions of a file, typically a less aggressive version for 2.6x and older, and one using new features for the newer releases. Its a shame that there is no if clause that is

Re: On bichromatic GIF stock spam

2006-06-24 Thread Philip Prindeville
Loren Wilton wrote: If, after excluding black, we find that 100% of the color map is that nasty pastel pink or pastel lime green (etc) then it's a spam and we toss it. Sound reasonable? I was thinking about this the other day. I think the concept is reasonable, but as stated doesn't go