When spamprogs go wrong...

2007-06-20 Thread Matthias Keller
That's a nice one :) but looks like a sophisticated prog... max_grabnew_if_bad = 250 debug_unk_user = false num_dns_tries = 6 slow_start_count = 8000 user_agent_in_alt_position = true debug_to_console = false #use_helo_isphost = true proxy_account_per_email = false filter_hosts = true #defer_fi

pyzor: check failed: internal error

2007-06-20 Thread Marc Perkel
Yes - I googled it and found a lot of messages pointing to some patches - and they didn't wotk. What do I really have to do to get rid of this error? pyzor: check failed: internal error Thanks in advance

Re: stock spam with pdf

2007-06-20 Thread arni
Robert Schetterer schrieb: http://www.forbes.com/security/2007/06/20/stock-spam-internet-tech-security-cx_ag_0620spam.html Got like 7 of them, all look pretty much like this: X-Spam-Report: * 5.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 0.9998]

stock spam with pdf

2007-06-20 Thread Robert Schetterer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi @ll, here is some more info http://www.forbes.com/security/2007/06/20/stock-spam-internet-tech-security-cx_ag_0620spam.html - -- Mit freundlichen Gruessen Best Regards Robert Schetterer https://www.schetterer.org Germany -BEGIN PGP SIGNATURE

RE: My Newly Expanded DNS Blacklist - Who wants to try it?

2007-06-20 Thread Robert - eLists
> > This is a personal mail server, so I know exactly who sends mail on > it, and "we" don't have a spam problem (unless you mean all the spam > we're fighting to keep out). Of course, since it's a dynamic address, > I can't be certain that other users of this address haven't sent spam, > but a

Re: Nice one: Stocks à la PDF

2007-06-20 Thread Robert Schetterer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Yet Another Ninja schrieb: > Nice one Spammy! > > Yihaaa! > > Stock spams with PDF attachments (118Kb) so be prepared. > > (nice the traits) > jep youre right , just the one arrives here are there plans/rules to mark it ? - -- Mit freundl

Re: a rule to allow authenticated users stopped working, unless run at user level

2007-06-20 Thread Daryl C. W. O'Shea
digitalsushi wrote: I've changed my sendmail configuration to be more verbose about the authentication information. To add to this, I've discovered that it can match any token in the Received: line that does NOT include an equals sign in it: spamass-milter probably isn't checking the macros fo

Re: SA 3.2.1 not using SQL for bayes

2007-06-20 Thread Duane Hill
On Wed, 20 Jun 2007, Hamie wrote: On Wednesday 20 June 2007 18:09, Rosenbaum, Larry M. wrote: From: Hamie [mailto:[EMAIL PROTECTED] Small problem with SA 3.2.1... I'm using a mysql database. The DB works fine for amavisd-new, and SA AWL. e.g. [438288] dbg: auto-whitelist: sql-based connec

Re: SA 3.2.1 not using SQL for bayes

2007-06-20 Thread Hamie
On Wednesday 20 June 2007 18:09, Rosenbaum, Larry M. wrote: > > From: Hamie [mailto:[EMAIL PROTECTED] > > > > Small problem with SA 3.2.1... I'm using a mysql database. The DB > > works > > > fine for amavisd-new, and SA AWL. e.g. > > > > [438288] dbg: auto-whitelist: sql-based connected to > > DBI

ldap: failed to load user scores from LDAP server

2007-06-20 Thread Philip S. Hempel
I have been getting this error for some time now and have been trying to find the root cause of it. spamd[2681]: ldap: failed to load user scores from LDAP server, ignored (Can't locate object method "schema" via package "URI::ldap" at /usr/share/perl5/Mail/SpamAssassin/Conf/LDAP.pm line 133, li

RE: SA 3.2.1 not using SQL for bayes

2007-06-20 Thread Rosenbaum, Larry M.
> From: Hamie [mailto:[EMAIL PROTECTED] > > Small problem with SA 3.2.1... I'm using a mysql database. The DB works > fine for amavisd-new, and SA AWL. e.g. > > [438288] dbg: auto-whitelist: sql-based connected to > DBI:mysql:sadb:ixx: > [438288] dbg: auto-whitelist: sql-based using username:

SA 3.2.1 not using SQL for bayes

2007-06-20 Thread Hamie
Small problem with SA 3.2.1... I'm using a mysql database. The DB works fine for amavisd-new, and SA AWL. e.g. [438288] dbg: auto-whitelist: sql-based connected to DBI:mysql:sadb:ixx: [438288] dbg: auto-whitelist: sql-based using username: vscan01 [438288] dbg: auto-whitelist: sql-based get_

Re: a rule to allow authenticated users stopped working, unless run at user level

2007-06-20 Thread John D. Hardin
On Wed, 20 Jun 2007, digitalsushi wrote: > header LOCAL_AUTH_RCVD2ALL =~ /(authenticated bits=0)/ That's vulnerable to forgery. If you're checking Received headers this way to whitelist, you *really* want to include your local hostname and/or IP information in the RE. That will make it

Re: a rule to allow authenticated users stopped working, unless run at user level

2007-06-20 Thread John D. Hardin
On Wed, 20 Jun 2007, digitalsushi wrote: > header BLAH Received =~ /blah/ > score BLAH -800.0 > > And it's not picking it up. So I really have no idea what the > pattern is. N.B.: if you're using a plugin/milter to have the MTA pass messages to SA during the SMTP phase (i.e. before the

Re: a rule to allow authenticated users stopped working, unless run at user level

2007-06-20 Thread digitalsushi
One last update and I'll shut up for a bit. I've updated my server to make my Received headers look literally like this: Received: from [132.177.124.246] (doombox.iol.unh.edu [132.177.124.246]) (user=mikecrelay mech=PLAIN bits=0) blah by postal.iol.unh.edu (8.14.0/8.14.0) with ESMTP

Re: a rule to allow authenticated users stopped working, unless run at user level

2007-06-20 Thread digitalsushi
I've changed my sendmail configuration to be more verbose about the authentication information. To add to this, I've discovered that it can match any token in the Received: line that does NOT include an equals sign in it: Received: from [132.177.124.246] (doombox.iol.unh.edu [132.177.124.246])

Nice one: Stocks à la PDF

2007-06-20 Thread Yet Another Ninja
Nice one Spammy! Yihaaa! Stock spams with PDF attachments (118Kb) so be prepared. (nice the traits)

Spamassassin & Mysql

2007-06-20 Thread Jordi
Some weeks ago I put a message but no one answer it. Two days ago I install Spamassassin 3.2.1 to see if the problem were corrected and it continues. Anybody have the same problem or have a solution? -- Hi, Since today I'm using Spamsassasin 3.1.8 in a machine with two mysql serve

Re: Correct way to deactive AWL checks

2007-06-20 Thread Gary V
> > How is the correct way to deactive AWL? > > > > found in my amavisd.conf: > > $sa_auto_whitelist = 0; # turn on AWL in SA 2.63 or older (irrelevant > # for SA 3.0, cf option is > 'use_auto_whitelist') > Yes, I know it. I think is the same than

a rule to allow authenticated users stopped working, unless run at user level

2007-06-20 Thread digitalsushi
Greetings and salutations, We use sendmail, spamassassin, and the spamass-milter at our site. If a user authenticates, we give them -100 spam points. After a somewhat recent update, we discovered our rule is not matched any longer. The details: Using $ spamassassin --version SpamAssassin vers

Re: Correct way to deactive AWL checks

2007-06-20 Thread Gary V
Angel L. Mateo wrote: > Hello, > >I have a problem deactivating autowhitelist in my postfix + amavis + > spamassassin servers. We have servers running postfix (2.3.8-2) and > spamassassin (3.1.7-2) through amavisd-new (2.4.2-6) in a debian etch > (4.0) operating system. > >The problem is t

Re: CPAN - failed install: t/spamc_optC & t/spamc_optL errors

2007-06-20 Thread Peter Farrell
My apologies - saw the same issue appended to the announce email for 3.2 The fix was to run a manual build - ... As non-root user: perl Makefile.PL make make test As root: make install ... And it compiled successfully. -Peter On 20/06/07, Daniel J McDonald <[EMAIL PROTECTED]> wrote: On Wed,

NetBSD, OpenBSD, Windows users -- please test something...

2007-06-20 Thread Justin Mason
We have a patch in development which fixes some platform-specific perl setuid brokenness, but it needs testing on those 3 platforms with spamd. The patch is at: http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5518#c18 and applies to SpamAssassin 3.2.1. It should be possible to start a spam

Re: Correct way to deactive AWL checks

2007-06-20 Thread Angel L. Mateo
El mié, 20-06-2007 a las 12:06 +0200, Uwe Kiewel escribió: > Angel L. Mateo wrote: > > Hello, > > > > [...] > > > > > How is the correct way to deactive AWL? > > > > found in my amavisd.conf: > > $sa_auto_whitelist = 0; # turn on AWL in SA 2.63 or older (irrelevant >

Re: Correct way to deactive AWL checks

2007-06-20 Thread Matt Kettler
Angel L. Mateo wrote: > Hello, > > I have a problem deactivating autowhitelist in my postfix + amavis + > spamassassin servers. We have servers running postfix (2.3.8-2) and > spamassassin (3.1.7-2) through amavisd-new (2.4.2-6) in a debian etch > (4.0) operating system. > > The problem

Re: CPAN - failed install: t/spamc_optC & t/spamc_optL errors

2007-06-20 Thread Daniel J McDonald
On Wed, 2007-06-20 at 12:04 +0100, Peter Farrell wrote: > Having problems re-installing SA. > Blew away my previous installation cat'ing the .packlist to xargs rm. > As root, start perl -MCPAN -e shell and 'install SpamAssassin' > All of the errors in t/logs/* relate to either one of three things:

CPAN - failed install: t/spamc_optC & t/spamc_optL errors

2007-06-20 Thread Peter Farrell
Having problems re-installing SA. Blew away my previous installation cat'ing the .packlist to xargs rm. As root, start perl -MCPAN -e shell and 'install SpamAssassin' All of the errors in t/logs/* relate to either one of three things: # cannot run 1. error: spamd: cannot run as nonexistent user o

Re: Correct way to deactive AWL checks

2007-06-20 Thread Uwe Kiewel
Angel L. Mateo wrote: > Hello, > [...] > > How is the correct way to deactive AWL? > found in my amavisd.conf: $sa_auto_whitelist = 0; # turn on AWL in SA 2.63 or older (irrelevant # for SA 3.0, cf option is 'use_auto_whitelist') HTH, Uwe

Correct way to deactive AWL checks

2007-06-20 Thread Angel L. Mateo
Hello, I have a problem deactivating autowhitelist in my postfix + amavis + spamassassin servers. We have servers running postfix (2.3.8-2) and spamassassin (3.1.7-2) through amavisd-new (2.4.2-6) in a debian etch (4.0) operating system. The problem is that we want to deactivate A

RE: Any way to bypass authenticated users?

2007-06-20 Thread Leon Kolchinsky
> fc4, sendmail, sa 3.0.6, spamass-milter > > some clients get mail rejected from my server (which they are using to > send) because sa is checking all mail. I use smtp auth - Is there any > way to bypass SA if they have been authenticated? Check this howto: http://www200.pair.com/mecham/spam/b