On Mon, 2007-07-23 at 03:35 +0200, Hendrik Helmvoigt wrote:
> This night it seems like we're beeing spammed again by xml documents,
> but this time neatly packed into a zipfile:
>
> I'm really excited whats going to happen next. Maybe psd files embedded
> in pdf and then rar'ed.
>
> And i'd sti
On Monday 23 July 2007, David Baron wrote:
>>I mean the obvious stuff like "viagra" and such. Usually the spam is caught
>>but sporadically it does get through.
>>
>>What is happening.
>
>Simply, there are no X-Spam headers on these (and none or some of the "ham"
> as well). In other words, message
> Hendrik Helmvoigt wrote:
> >This night it seems like we're beeing spammed again by xml documents,
> >but this time neatly packed into a zipfile:
> >
> >I'm really excited whats going to happen next. Maybe psd files embedded
> >in pdf and then rar'ed.
> >
> >And i'd still like to meet the person
> > which MTA are you using? The clamav plugin should reject the e-mail the
> > same way SA plugin does that (with much less CPU time spent)
On 22.07.07 15:32, Robert - eLists wrote:
> Uhlar
... and I thought that spelling my surname in capitals would preserver from
this title ... :)
> I use qma
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Matus UHLAR - fantomas schrieb:
>> Hendrik Helmvoigt wrote:
>>> This night it seems like we're beeing spammed again by xml documents,
>>> but this time neatly packed into a zipfile:
>>>
>>> I'm really excited whats going to happen next. Maybe psd file
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Robert Schetterer schrieb:
> Matus UHLAR - fantomas schrieb:
>>> Hendrik Helmvoigt wrote:
This night it seems like we're beeing spammed again by xml documents,
but this time neatly packed into a zipfile:
I'm really excited whats go
On Mon, 23 Jul 2007 11:08:47 +0200, Matus UHLAR - fantomas
<[EMAIL PROTECTED]> wrote:
>> > which MTA are you using? The clamav plugin should reject the e-mail the
>> > same way SA plugin does that (with much less CPU time spent)
>
>On 22.07.07 15:32, Robert - eLists wrote:
>> Uhlar
>
>... and I th
> >On 22.07.07 15:32, Robert - eLists wrote:
> >> I use qmail-scanner-queue.pl, clamav, spamassassin and qmail
> >>
> >> I can reject spam over a certain scoring threshold this way, yet I have not
> >> figured out a way to just reject email based upon having a virus signature
> >> per clamav.
> O
Hello,
I have spamassassin configured and running fine with postfix,
amavisd-new and clamav. However, I would like to have spamassassin
attach the spam message and report it to my recipient when I receive a
spam message. I think it is the same message that appears when you:
spamassassin -tD < ma
On Mon, 23 Jul 2007 11:32:21 +0200, Matus UHLAR - fantomas
<[EMAIL PROTECTED]> wrote:
>> >On 22.07.07 15:32, Robert - eLists wrote:
>> >> I use qmail-scanner-queue.pl, clamav, spamassassin and qmail
>> >>
>> >> I can reject spam over a certain scoring threshold this way, yet I have
>> >> not
>>
On Monday 23 July 2007, Gene Heskett wrote:
> On Monday 23 July 2007, David Baron wrote:
> >>I mean the obvious stuff like "viagra" and such. Usually the spam is
> >> caught but sporadically it does get through.
> >>
> >>What is happening.
> >
> >Simply, there are no X-Spam headers on these (and no
Hello all,
I was wondering if any of you know if the following is possible :
It would be nice to tell SA to use certain rule sets or exclude certain
rulesets depending on the domain a mail is sent to.
If at all possible , then a MySQL based list to tell which rules to use for
a domain would be
On 07/23/07 11:56, Yousef Raffah wrote:
Hello,
I have spamassassin configured and running fine with postfix,
amavisd-new and clamav. However, I would like to have spamassassin
attach the spam message and report it to my recipient when I receive a
spam message.
AFAIK, with amavisd-new, you n
Here is what I found out:
You only need the DKIM SpamAssassin plugin activated (you don't need the
DomainKeys plugin) BUT, you need BOTH Mail-DKIM (> .20) perl AND
Mail-DomainKkeys perl functions loaded.
I suppose the SA DKIM plugin works for both.
(I am not sure that was clear on INSTALL)
Than
> -Original Message-
> From: Matt Kettler [mailto:[EMAIL PROTECTED]
> Sent: Sunday, July 22, 2007 11:21 AM
> To: Michael Scheidell
> Cc: users@spamassassin.apache.org
> Subject: Re: DKIM vs DomainKeys plugins
>
>
> Looking at the messages, apparently verizon re-arranges the
> message h
> On Mon, 23 Jul 2007 11:32:21 +0200, Matus UHLAR - fantomas
> <[EMAIL PROTECTED]> wrote:
> >however according to his informations, his qmail queue scanner rejects the
> >mail if it's spam, but not if it's virus (which is sick and a bug imho)
On 23.07.07 10:59, Nigel Frankcom wrote:
> Ahh - it's n
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
> Sent: Monday, July 23, 2007 3:03 AM
> To: Hendrik Helmvoigt
> Cc: users@spamassassin.apache.org
> Subject: Re: Now its zip attachments ^^
>
> 1) Spammers just want to exasperate the smaller spam filter
> provider
> -Original Message-
> From: Matus UHLAR - fantomas [mailto:[EMAIL PROTECTED]
> Sent: Monday, July 23, 2007 7:27 AM
> To: users@spamassassin.apache.org
> Subject: Re: migrating from clamav before mta to SA ClamAV
> plugin experiences
>
> On 23.07.07 10:59, Nigel Frankcom wrote:
> > Ahh -
On 23.07.07 12:56, Yousef Raffah wrote:
> I have spamassassin configured and running fine with postfix,
> amavisd-new and clamav. However, I would like to have spamassassin
> attach the spam message and report it to my recipient when I receive a
> spam message. I think it is the same message that a
I am using Spamassassin 3.1.8 which is the most recent available of the 3.1.x
series to Gentoo users.
Using qmail, vpopmail, and qmail-scanner to invoke spamassassin.
I am using verbose spamassassin mode, and am trying to get mails tagged with
rewrite_subject [Spam] to be auto-delivered to the M
Michael Scheidell wrote:
> Here is what I found out:
>
> You only need the DKIM SpamAssassin plugin activated (you don't need the
> DomainKeys plugin) BUT, you need BOTH Mail-DKIM (> .20) perl AND
> Mail-DomainKkeys perl functions loaded.
> I suppose the SA DKIM plugin works for both.
>
> (I am
Hi
In to my smtp-relay (debian dabsed) I've installed spamassassin from
debian-package and after upgrade it by the follow command:
/usr/bin/cpan Mail::SpamAssassin
Now when I trying to upgrade spamassassin v3.1.7 to v3.2.1 with the same
command I saw the following messages:
t/spamc_optC
On Mon, 2007-07-23 at 14:58 +0200, Balzi Andrea wrote:
> Hi
>
> In to my smtp-relay (debian dabsed) I've installed spamassassin from
> debian-package and after upgrade it by the follow command:
>
> /usr/bin/cpan Mail::SpamAssassin
>
> Now when I trying to upgrade spamassassin v3.1.7 to v3.2.1 wi
Michael Scheidell wrote:
>> -Original Message-
>> From: Matt Kettler [mailto:[EMAIL PROTECTED]
>> Sent: Sunday, July 22, 2007 11:21 AM
>> To: Michael Scheidell
>> Cc: users@spamassassin.apache.org
>> Subject: Re: DKIM vs DomainKeys plugins
>>
>>
>> Looking at the messages, apparently veriz
Balzi Andrea wrote:
> Hi
>
> In to my smtp-relay (debian dabsed) I've installed spamassassin from
> debian-package and after upgrade it by the follow command:
>
> /usr/bin/cpan Mail::SpamAssassin
>
> Now when I trying to upgrade spamassassin v3.1.7 to v3.2.1 with the same
> command I saw the follow
Yousef Raffah wrote:
> Hello,
>
> I have spamassassin configured and running fine with postfix,
> amavisd-new and clamav. However, I would like to have spamassassin
> attach the spam message and report it to my recipient when I receive a
> spam message. I think it is the same message that appears w
Is there an ETA for 3.2.2 yet?
-Original Message-
From: Matt Kettler [mailto:[EMAIL PROTECTED]
Sent: Monday, July 23, 2007 8:08 AM
To: Balzi Andrea
Cc: users@spamassassin.apache.org
Subject: Re: Upgrade problem from 3.1.7 to 3.2.1
Balzi Andrea wrote:
> Hi
>
> In to my smtp-relay (debian
There are a number of qmail specific programs that use clamav other
than qmail-scanner (which, based on a quick skim of their page,
doesn't seem to support SMTP-time rejection). The ClamAV website has
several alternatives, a couple of which appear to do SMTP-time
rejection, listed at
http://www.c
>>> On 7/23/2007 at 6:38 AM, in message <[EMAIL PROTECTED]>, smeevil <[EMAIL
>>> PROTECTED]> wrote:
Hello all,
I was wondering if any of you know if the following is possible :
It would be nice to tell SA to use certain rule sets or exclude certain
rulesets depending on the domain a mail is sen
Matus UHLAR - fantomas wrote:
On 22.07.07 18:47, John Rudd wrote:
As I've said for years: we should just ban attachments. They're not
really useful for anything that can't be done a better way. Which only
leaves them being useful for attacks of one form or another.
some people just want, s
> "some just need" -- no, I can't agree there. I have yet to come across
> ANY situation where a person _NEEDED_ attachments. As I said above,
> there's nothing that can be done with attachments that you can't do
> another way.
In fact, nobody _NEEDS_ email, because we could just FTP text files
I would start by banning Outlook along with attachments.
Why stop there, ban -all- Microsoft products from the internet.
Next, I would ban smoking, unhealthy foods, and moronic neo-cons.
Come on, this is Earth we are talking about.
The whole point of SpamAssassin is to attempt to make ordinary
Why would I be all of a sudden getting a terse report in the body of
my messages?
This is with 3.2.0
John Rudd wrote:
Matus UHLAR - fantomas wrote:
On 22.07.07 18:47, John Rudd wrote:
As I've said for years: we should just ban attachments. They're not
really useful for anything that can't be done a better way. Which
only leaves them being useful for attacks of one form or another.
some p
On Monday 23 July 2007, David Baron wrote:
>On Monday 23 July 2007, Gene Heskett wrote:
>> On Monday 23 July 2007, David Baron wrote:
[...]
>> Humm, with my lashup here that Joanne helped me setup, S78spamassassin
>> starts a few copies of spamd, and fetchmail is started much later in
>> S99local.
On Monday 23 July 2007, Jerry Glomph Black wrote:
>I would start by banning Outlook along with attachments.
>Why stop there, ban -all- Microsoft products from the internet.
>
>Next, I would ban smoking, unhealthy foods, and moronic neo-cons.
>
>Come on, this is Earth we are talking about.
>
>The wh
Wait, would that ban on smoking include cigars too?
Are regular neo-cons okay?
Please delete.
-Original Message-
From: Jerry Glomph Black [mailto:[EMAIL PROTECTED]
Sent: Monday, July 23, 2007 10:32 AM
To: John Rudd
Cc: users@spamassassin.apache.org
Subject: Re: Now its zip attachments ^
Hi, I'm trying to disable spamassassin (spamd) attempts
to use ~/.spamassassin all configurations are in cf files.
I invoking with:
exec spamd --nouser-config --username=qmaild -m ${MAX} --syslog=stderr 2>&1
and config includes:
use_bayes 0
auto-whitelist 0
use_auto_whitelist 0
Yet my logs st
On 7/20/07 12:55 PM, "Skip Brott" <[EMAIL PROTECTED]> ostensibly wrote:
> If I send an email to a valid
> address, I find it a bit offensive that they send a challenge back. Why is
> it my responsibility as the sender to teach another system to accept mail
> from me?
Why is it my responsibility
and isn't
considered to be that much better than C/R (it doesn't clutter a
forged-sender's mail box, but it can bog down a forged-sender's mail
server with verification requests).
Well, it may be. I know, however, that a lot of people is doing this at the
MTA level in order to reject mail
I have to mention how pleased we are with the sanesecurity clamav tool. We
have always used spamassassin with many custom rule sets, dcc and rbls, with
clamd for virus scanning.
We have been getting a large number (~4,500 per day) of these PDF and other
attachment spams making it through SA, even
> OK - Thanks for your help on that one, Still need the DNS stuff figured
> out, That's the last piece in what will be an extrodinarilly powerful
> whitelisting system. I'll publish the code once it is tested. I think a
> lot of people will want to use it and improve it.
Using Net::DNS, here is a
John Rudd wrote:
> "some just need" -- no, I can't agree there. I have yet to come
> across
> ANY situation where a person _NEEDED_ attachments. As I said above,
> there's nothing that can be done with attachments that you can't do
> another way.
That is very similar to saying that a person doe
Hi all,
I had to rebuild my machine and , although I have the 70_ rules, and have run
sa-update, I think I'm missing the CF that catches the gif image spam- the
pharmacy specials
Can someone tell me which one that was
TIA
Jean-Paul Natola
Network Administrator
Information Technology
F
On Fri, 20 Jul 2007, Robot Terror wrote:
> Why is it my responsibility as a holder of a valid email address
> to accept mail from anyone who wants to send me the mail?
Who ever said *that*?
--
John Hardin KA7OHZhttp://www.impsec.org/~jhardin/
[EMAIL PROTECTED]FALaholic
I apologize if this is a duplicate. I posted the original using Nabble, but
there was an error message and not sure if it went through or not. Here
goes:
I am using Qmail-Scanner 1.25 and Spamassassin 3.1.8 which is the most
recent available of the 3.1.x series to Gentoo users.
Using qmail, v
On Mon, 23 Jul 2007, John Scully wrote:
>... After adding the sanesecurity sigs to clamd last
> week not one PDF has made it through. And since clamd unpacks and examines
> every attachment anyway it is no additional load. In fact, due to the
> messages not hitting SA it pr
Chr. v. Stuckrad wrote:
On Mon, 23 Jul 2007, John Scully wrote:
... After adding the sanesecurity sigs to clamd last
week not one PDF has made it through. And since clamd unpacks and examines
every attachment anyway it is no additional load. In fact, due to the
message
On Mon, 23 Jul 2007, Chr. v. Stuckrad wrote:
> On Mon, 23 Jul 2007, John Scully wrote:
>
> >... After adding the sanesecurity sigs to clamd last
> > week not one PDF has made it through. And since clamd unpacks and examines
> > every attachment anyway it is no additional loa
Hello,
I completed configuring all my network tests and the bayes database has
passed 200 ham messages and is being used. The bayes database has been
accumulating knowledge so far through autolearn.
I was concerned about how one sided the autolearning has been since over 90%
of our email is spa
> -Original Message-
> From: Robot Terror [mailto:[EMAIL PROTECTED]
> Sent: Friday, July 20, 2007 4:28 PM
> To: Skip Brott; spamd
> Subject: Re: not everyone is happy with SA
>
>
> On 7/20/07 12:55 PM, "Skip Brott" <[EMAIL PROTECTED]> ostensibly wrote:
>
> > If I send an email to a val
> -Original Message-
> From: Bill Landry [mailto:[EMAIL PROTECTED]
> Sent: Monday, July 23, 2007 8:56 AM
> To: Michael Scheidell
> Cc: users@spamassassin.apache.org
> Subject: Re: Solved: Was: DKIM vs DomainKeys plugins
>
>
> Michael Scheidell wrote:
> > Here is what I found out:
> >
>
On Mon, Jul 23, 2007 at 11:46:58AM -0400, George Georgalis wrote:
>How can I disable the use of ~/.spamassassin altogether?
nevermind...
--siteconfigpath=$CONF
// George
--
George Georgalis, information system scientist <
hi,
On Mon, Jul 23, 2007 at 10:13:22PM +0200, Matthias Keller told us:
> Using amavisd-new...
actually, with amavisd-new, you can treat virus names in a special
way via regexes, so that it doesn't get recognized as a virus, but
instead you can add extra points to the spamassassin score.
This fea
David Baron wrote:
Problem is that the S78 will start spamassassin but that start does not
necessarily get a valid rule-set.
This is the bit puzzling me: Why must sa-update complete sucessfully
for spamd to start? The default SA rules should be shipped in the
package, and be placed in (typi
Michael Scheidell wrote:
>> -Original Message-
>> From: Bill Landry [mailto:[EMAIL PROTECTED]
>> Sent: Monday, July 23, 2007 8:56 AM
>> To: Michael Scheidell
>> Cc: users@spamassassin.apache.org
>> Subject: Re: Solved: Was: DKIM vs DomainKeys plugins
>>
>>
>> Michael Scheidell wrote:
>>> H
The ridiculousness of that sentiment that prompted my first post to this
list came from the following comments:
> I have found this whole line of debate somewhat interesting, but it has
> clearly strayed from the real core question:
>
> Who is responsible?
>
> Is it the responsibility of the se
Robert Nicholson wrote:
> Why would I be all of a sudden getting a terse report in the body of
> my messages?
>
> This is with 3.2.0
Were you getting a fuller report before? or none at all?
Has anyone changed your "report" options in your config to use _REPORT_
instead of _SUMMARY_?
Are you actu
dalchri wrote:
> Hello,
>
> I completed configuring all my network tests and the bayes database has
> passed 200 ham messages and is being used. The bayes database has been
> accumulating knowledge so far through autolearn.
>
> I was concerned about how one sided the autolearning has been since ov
"Knowing I have CR"? Hah!
I have Greylisting and SA. That's it. Oh, I also block Spamhaus.org's DROP
list net blocks. Other than that, nothing.
I just resent being told I have the "burden" of verifying senders,
regardless of the context. You wanna send a message to me? Prove yourself
worthy. (Not
On Mon, 23 Jul 2007, Robot Terror wrote:
> It is to that ³absolute standard² of recipient is responsible to
> verify sender that I made my reply.
Okay, but that is vastly different from:
> "[it is] my responsibility as a holder of a valid email address
> to accept mail from anyone who wants to s
Per Jessen wrote:
John Rudd wrote:
"some just need" -- no, I can't agree there. I have yet to come
across
ANY situation where a person _NEEDED_ attachments. As I said above,
there's nothing that can be done with attachments that you can't do
another way.
That is very similar to saying that
Chr. v. Stuckrad wrote:
On Mon, 23 Jul 2007, John Scully wrote:
... After adding the sanesecurity sigs to clamd last
week not one PDF has made it through. And since clamd unpacks and examines
every attachment anyway it is no additional load. In fact, due to the
messages n
Robot Terror wrote:
On 7/20/07 12:55 PM, "Skip Brott" <[EMAIL PROTECTED]> ostensibly wrote:
If I send an email to a valid
address, I find it a bit offensive that they send a challenge back. Why is
it my responsibility as the sender to teach another system to accept mail
from me?
Why is it my
George Georgalis wrote:
> On Mon, Jul 23, 2007 at 11:46:58AM -0400, George Georgalis wrote:
>
>> How can I disable the use of ~/.spamassassin altogether?
>>
>
> nevermind...
>
> --siteconfigpath=$CONF
Actually, that over-rides the site config, which would normally be
/etc/mail/spamassassin
From: "John Rudd" <[EMAIL PROTECTED]>
Matus UHLAR - fantomas wrote:
On 22.07.07 18:47, John Rudd wrote:
As I've said for years: we should just ban attachments. They're not
really useful for anything that can't be done a better way. Which only
leaves them being useful for attacks of one for
From: "Dave Pooser" <[EMAIL PROTECTED]>
"some just need" -- no, I can't agree there. I have yet to come across
ANY situation where a person _NEEDED_ attachments. As I said above,
there's nothing that can be done with attachments that you can't do
another way.
In fact, nobody _NEEDS_ email,
You mean my not smoking and never have smoked status gets me drummed
out of the neo-con corps? What will those who know me and think I am
somewhere off to the right of would be
astonished. But then my friends on the right figure I am quite
"squishy" as a "conservative." Ah well. I grew up outside
Greetings;
It looks like uol dot com dot br is back. I just added two more procmail
rules to /dev/null that crap before it ever gets to SA. Has anyone else been
getting it today?, he's hitting most of the linux mailing lists again.
Can't someone send them a box of Alfreds Finest?
--
Cheers,
From: "John D. Hardin" <[EMAIL PROTECTED]>
On Fri, 20 Jul 2007, Robot Terror wrote:
Why is it my responsibility as a holder of a valid email address
to accept mail from anyone who wants to send me the mail?
Who ever said *that*?
Anyone who holds to the snail mail analogy certainly would.
He is bouncing emails. (See attachment.)
Scroom and the camel he rode in on.
{`,'}
--- Begin Message ---
The original message was received at Mon, 23 Jul 2007 22:30:06 -0400
from localhost.localdomain [127.0.0.1]
- The following addresses had permanent fatal errors -
[EMAIL PROTECTED
Hi,
Other than FuzzyOCR, is there other way to filter graphic spams? I had
ImageInfo but seem like it is not working.
regards
LC
He is bouncing emails. (See attachment.)
Scroom and the camel he rode in on.
I am getting the same thing
Nigel
SA integrated via qmail-scanner-queue.pl allows smtp rejection based upon
score thresholds
- rh
>
> what does clamav checking in that scanner do then? It should call
> clamdscan
> asap (before SA) and when a virus is found, the mail should be imediately
> rejected, the same way it's rejected when SA tells so.
>
Matus
It quarantines and notifies admin via email. Real PAIN
If you read the
removed
On Mon, Jul 23, 2007 at 07:59:41PM -0700, jdow wrote:
> He is bouncing emails. (See attachment.)
>
> Scroom and the camel he rode in on.
>
> {`,'}
> Date: Mon, 23 Jul 2007 22:31:06 -0400
> From: Mail Delivery Subsystem <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Subject: Returned ma
On Monday 23 July 2007, jdow wrote:
>He is bouncing emails. (See attachment.)
>
>Scroom and the camel he rode in on.
>
>{`,'}
not the same jerk that's bugging me, and the camel?, that's the camel that
rode in on him...
--
Cheers, Gene
"There are four boxes to be used in defense of liberty:
soa
Hello,
I'd be glad for your suggestions re sa-update error.
$ sa-update
can't resolve "l27.0.0.1" to address at
/usr/local/lib/perl5/site_perl/5.8.8/mach/Net/DNS/Resolver/Base.pm line
751.
I think the issue started when I switched from my ISP DNS server to using
my own caching name server at lo
On Tue, 24 Jul 2007 11:04:23 +0800, "Spamassassin List"
<[EMAIL PROTECTED]> wrote:
>Hi,
>
>Other than FuzzyOCR, is there other way to filter graphic spams? I had
>ImageInfo but seem like it is not working.
>
>regards
>LC
ClamD with http://www.sanesecurity.co.uk/ work pretty well here.
Be sure
On Tue, 24 Jul 2007 11:04:23 +0800, "Spamassassin List"
<[EMAIL PROTECTED]> wrote:
>Hi,
>
>Other than FuzzyOCR, is there other way to filter graphic spams? I had
>ImageInfo but seem like it is not working.
>
>regards
>LC
PS... also check out ImageInfo.pm
http://www.rulesemporium.com/plugins.h
Zbigniew Szalbot wrote:
Hello,
I'd be glad for your suggestions re sa-update error.
$ sa-update
can't resolve "l27.0.0.1" to address at
L27.0.0.1 isn't quite the same as 127.0.0.1.
Daryl
/usr/local/lib/perl5/site_perl/5.8.8/mach/Net/DNS/Resolver/Base.pm line
751.
I think the issue starte
81 matches
Mail list logo
