In article [EMAIL PROTECTED], [EMAIL PROTECTED]
says...
Alexis Manning wrote:
The glaring weirdness with this email is obviously the RSET in the To
field - I don't know whether that was originally in the email or
inserted by Mercury when it downloaded it from my POP account.
Works fine
Could the next person passing the record player give it a jolt? It
seems to be stuck on the same track... and I wasn't too keen on this
track the 1st few times I heard it either ;-D
Hi friends,
Which rules catch these spams?
Regards,
Suhas I
_
From: Gabriela Gordon [mailto:[EMAIL PROTECTED]
Sent: Thursday, February 22, 2007 3:56 PM
To: hosting
Subject: Be bumblebee do shaft
Just take a look at this one..
Campaign for: CBRJ
Price: $1.70
Your best bets at the moment are FuzzyOCR and the SARE_STOCKS ruleset.
FuzzyOCR would have a real good chance of catching that image. You didn't
include the headers, so it is hard to say what is in there. If you aren't
running the net rules you should be. The Botnet plugin might be another
Feb 21 22:26:10 Luke spamd[5590]: spamd: setuid to elizabeth succeeded
Feb 21 22:26:10 Luke spamd[5590]: bayes: cannot open bayes databases
/var/.spamassassin/bayes_* R/O: tie failed: Permission denied
1) are you using bayes_path ?
2) have you set bayes_file_mode 0777 in your local.cf?
YES
Hallo List
i try to compile SA 3.1.8 under FreeBSD 4.8 with perl 5.8.8
i do:
/usr/local/bin/perl ./Makefile.PL
make
and
make test
with folowing result:
Failed TestStat Wstat Total Fail List of Failed
- Original Message -
From: David Morton [EMAIL PROTECTED]
To: Jim Knuth [EMAIL PROTECTED]
Cc: John Fleming [EMAIL PROTECTED]; [EMAIL PROTECTED]
Sent: Thursday, February 22, 2007 2:03 AM
Subject: Re: tie failed
Could someone please translate this to n00bese with helpful
Alexis,
Thanks Jason. If this malformed email isn't crashing other people's
setups then perhaps it's an issue with the SAWin32 port.
Looks fine here too, SA 3.1.8 on Unix, collects 30 points.
Mark
On Feb 22, 2007, at 6:06 AM, Loren Wilton wrote:
Your best bets at the moment are FuzzyOCR and the SARE_STOCKS
ruleset. FuzzyOCR would have a real good chance of catching that
image. You didn't include the headers, so it is hard to say what
is in there. If you aren't running the net
That made the sa-rule to catch these spams rather trivial to produce :-)
Cheers,
Phil
--
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK
-Original Message-
From: Ben Wylie [mailto:[EMAIL PROTECTED]
Sent: 22 February 2007 01:59
To: SpamAssassin Users List
David Morton wrote:
Matt Kettler wrote:
Also, make sure that /var/.spamassassin has world rwx privileges.
Doesn't this create a potential or real giant type security risk?
Well, regardless, the current user SA is running as has to be able to
read and write to the bayes DB. It
yeah -- getting access to a spammer's templates is a gold-mine! (And
getting your hands on the source for a spamming app is even better...)
--j.
Randal, Phil writes:
That made the sa-rule to catch these spams rather trivial to produce :-)
Cheers,
Phil
--
Phil Randal
Network Engineer
Jo Rhett [EMAIL PROTECTED] 02/22/07 01:20AM
Loren Wilton wrote:
4.He then COMPLAINS that rules are causing him FPs and demands that
the rules be changed.
Your rule is matching against messages which it shouldn't.
5.He THEN claims I am lying and making false assertions when I
This might be identical to one I got today. I put it up clean at:
http://2chronicles36.org/spam/stock.txt
I'm also on 3.1.7 with latest update, all the network tests, plus
FuzzyOcr.cf and KAM.cf, otherwise no extras.
Andy Figueroa
David Goldsmith wrote:
-BEGIN PGP SIGNED MESSAGE-
I put a clean copy of this up at:
http://2chronicles36.org/spam/nigeria.txt
in hopes that it will contribute to it being caught in the future.
My own setup is 3.1.7 with latest update, all the network tests, plus
FuzzyOcr.cf and KAM.cf, otherwise no extras.
Andy Figueroa
Andy
This scores 7.1 for me..
Content analysis details: (7.1 points, 5.0 required)
pts rule name description
--
--
1.0 L_DRUGS12 L_DRUGS12
0.1 FORGED_RCVD_HELO Received: contains a
First of all, do rawbody emails literally scan the raw email including
massive attachments?
I received an email today with a 7MB MS Word attachment. This email
completely bogged down the system, as if there were rules scanning the
raw attachment (which wouldn't be very fruitful and takes
On 02/22/07 Andy wrote:
I put a clean copy of this up at:
http://2chronicles36.org/spam/nigeria.txt
Content analysis details: (18.4 points, 5.0 required)
-0.0 SPF_PASS SPF: sender matches SPF record
4.0 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
I upgraded my SA from 3.1.7 to 3.1.8. I ran --lint with no problems and
then restarted the daemon. SA is working, but I'm seeing the following
errors in my log when SA starts up:
spamd[16137]: Can't locate DBD/mysql.pm in @INC ...
spamd[16137]: Can't locate Tie/Cache.pm in @INC ...
On Thu, Feb 22, 2007 at 04:28:26PM +, Ben Wylie wrote:
First of all, do rawbody emails literally scan the raw email including
massive attachments?
What are rawbody emails? Do you mean rawbody rules? They only look at
text and message parts. Full rules run on the whole message.
I
On Thu, Feb 22, 2007 at 11:29:30AM -0500, Bowie Bailey wrote:
spamd[16137]: Can't locate DBD/mysql.pm in @INC ...
spamd[16137]: Can't locate Tie/Cache.pm in @INC ...
spamd[16137]: Can't locate Tie/Cache.pm in @INC ...
spamd[16137]: BEGIN failed--compilation aborted at (eval 759) line 1.
My
On Thu, 22 Feb 2007 16:28:26 +, Ben Wylie wrote
First of all, do rawbody emails literally scan the raw email
including massive attachments? I received an email today with a 7MB
MS Word attachment. This email completely bogged down the system, as
if there were rules scanning the raw
Thanks!
I was thinking just in an optimization
Oliver
Theo Van Dinter wrote:
second, current released versions of SA run all rules, so the ordering doesn't
really matter for that one.)
--
Oliver Schulze L. | Get my e-mail after a captcha in:
Asuncion - Paraguay |
Theo Van Dinter wrote:
On Thu, Feb 22, 2007 at 11:29:30AM -0500, Bowie Bailey wrote:
spamd[16137]: Can't locate DBD/mysql.pm in @INC ...
spamd[16137]: Can't locate Tie/Cache.pm in @INC ...
spamd[16137]: Can't locate Tie/Cache.pm in @INC ...
spamd[16137]: BEGIN failed--compilation aborted
I received an odd email that makes spamd fall over. I'm
using the SAWin32 port, and was wondering whether other users
could also see the same problem with this message or whether
the problem is peculiar to the Windows port.
The glaring weirdness with this email is obviously the RSET
in the
Bowie Bailey wrote:
[snip]
The FuzzyOCR installation docs only list DBD::mysql as required if you
are using it for the hash database and I've got that set to use
digest_db.
FuzzyOCR.cf:
# 2 ... use digest_db w/digest_hash import (see requirements,
# recommended)
John Fleming wrote:
I also see an occasional message header that includes
autolean=unavailable - It that what ends up in the messages where the
tie fails?? I don't get the intermittent nature of this.
Yes. Learning is slow. If two spamd children try to learn at the same
time only one
On Thu, 22 Feb 2007, Daryl C. W. O'Shea wrote:
John Fleming wrote:
I also see an occasional message header that includes
autolean=unavailable - It that what ends up in the messages where the
tie fails?? I don't get the intermittent nature of this.
Yes. Learning is slow. If two spamd
David B Funk wrote:
On Thu, 22 Feb 2007, Daryl C. W. O'Shea wrote:
John Fleming wrote:
I also see an occasional message header that includes
autolean=unavailable - It that what ends up in the messages where the
tie fails?? I don't get the intermittent nature of this.
Yes. Learning is
René Berber wrote:
Bowie Bailey wrote:
[snip]
The FuzzyOCR installation docs only list DBD::mysql as required if
you are using it for the hash database and I've got that set to use
digest_db.
FuzzyOCR.cf:
# 2 ... use digest_db w/digest_hash import (see requirements,
#
On Thu, 22 Feb 2007, Daryl C. W. O'Shea wrote:
David B Funk wrote:
On Thu, 22 Feb 2007, Daryl C. W. O'Shea wrote:
Yes. Learning is slow. If two spamd children try to learn at the same
time only one will get a lock to write to the database. The child who
doesn't get the lock (tie
On Thu, Feb 22, 2007 at 03:30:24PM -0500, Daryl C. W. O'Shea wrote:
If he enabled it, sure, it'd help reduce the frequency that this occurs.
There's still only a single journal, though, so it's still possible
that a spamd child process won't get a tie on it during busy periods.
The journal
I received an odd email that makes spamd fall over. I'm using the
SAWin32 port, and was wondering whether other users could also see
the
same problem with this message or whether the problem is peculiar to
the Windows port.
The glaring weirdness with this email is obviously the
I received an odd email that makes spamd fall over. I'm using the
SAWin32 port, and was wondering whether other users could also see
the
same problem with this message or whether the problem is peculiar
to
the Windows port.
The glaring weirdness with this email is
Bowie Bailey wrote:
[snip]
No, I'm using the latest development build of 3.5.1 from
http://fuzzyocr.own-hero.net/wiki/Downloads.
I upgraded to 3.5.1 from 2.3b less than a month ago.
Perhaps you didn't upgrade everything, the precise location of the error you are
seeing is in file
Bowie Bailey wrote:
[snip]
No, I'm using the latest development build of 3.5.1 from
http://fuzzyocr.own-hero.net/wiki/Downloads.
I upgraded to 3.5.1 from 2.3b less than a month ago.
Perhaps you didn't upgrade everything, the precise location of the error you are
seeing is in file
René Berber wrote:
Bowie Bailey wrote:
[snip]
No, I'm using the latest development build of 3.5.1 from
http://fuzzyocr.own-hero.net/wiki/Downloads.
I upgraded to 3.5.1 from 2.3b less than a month ago.
Perhaps you didn't upgrade everything, the precise location of the
error you are
On 02/22/07 Bowie wrote:
spamd[16137]: Can't locate DBD/mysql.pm in @INC ...
spamd[16137]: Can't locate Tie/Cache.pm in @INC ...
spamd[16137]: Can't locate Tie/Cache.pm in @INC ...
spamd[16137]: BEGIN failed--compilation aborted at (eval 759) line 1.
root# perl -MCPAN -e shell
cpan[1]
an additional test, with a 'sent/recd' email, rather than just a file
test @ cmd_line, shows similarly,
with this image,
http://img181.imageshack.us/img181/2156/spamsc2.gif
attached to an otherwise blank email, on receipt, i see in FuzzyOCR.log,
2007-02-22 14:22:57 [27803] Processing
remedy dependencies
{^_^}
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Igor Chudov wrote:
Example is here
http://igor.chudov.com/tmp/spam001.txt
They go past spamassassin. I use latest sare rules, run rules du jour
nightly etc.
I catch them after spamassassin, using my own filter, using regex
On Thu, Feb 22, 2007 at 10:07:31PM -0500, David Goldsmith wrote:
Hash: SHA1
Igor Chudov wrote:
Example is here
http://igor.chudov.com/tmp/spam001.txt
They go past spamassassin. I use latest sare rules, run rules du jour
nightly etc.
I catch them after spamassassin, using my
David Goldsmith wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Igor Chudov wrote:
I also got these errors:
Feb 22 21:18:41 manifold spamd[5132]: rules: meta test SARE_RD_SAFE
has undefined dependency 'SARE_RD_SAFE_MKSHRT'
Feb 22 21:18:41 manifold spamd[5132]: rules: meta test
David B Funk wrote:
On Thu, 22 Feb 2007, Daryl C. W. O'Shea wrote:
David B Funk wrote:
On Thu, 22 Feb 2007, Daryl C. W. O'Shea wrote:
Yes. Learning is slow. If two spamd children try to learn at the same
time only one will get a lock to write to the database. The child who
doesn't get
44 matches
Mail list logo
