Writing custom plugins

2008-05-07 Thread ram
http://wiki.apache.org/spamassassin/PluginWritingTips Gives plugin writing tips. But is there a beginners plugin-writing-howto. What are requisites. I am fairly comfortable writing in perl, will that be enough. I want to call a web api for a third party scanner within SA Thanks Ram

RE: 2 strange fatal SA errors

2008-05-07 Thread Christoph Petersen
Christoph Petersen wrote: Hey guys, got some strange problem during my vacation the last week. For once it seems that the network stack of SA crashed so no new processes could be spawned or that the spamd crashed and blocked the port. The second problem looks very cryptic to me

Backscattng filter?

2008-05-07 Thread Geert Batsleer
Hi, over the last couple of days I seem to get more and more spam wich looks like a bounced email with subjects like MAILER DAEMON ... and other variations, where the emails are bounced from mostly russian servers and where my email address has been spoofed so that I recieve the bounced mail

Re: typo in 20_vbounce.cf?

2008-05-07 Thread Robert Müller
Fine - thanks for the quick reply. I assume there's no need for a bug report regarding this issue, correct? So I'll do nothing more but waiting for the fix via sa-update :-) Robert Justin Mason schrieb: =?ISO-8859-15?Q?Robert_M=FCller?= writes: Hi all, as I'm facing raising amount of

Re: typo in 20_vbounce.cf?

2008-05-07 Thread Justin Mason
actually, if you could open a bug that'd be great -- I wasn't planning on backporting the fix to 3.2.x updates. --j. =?ISO-8859-15?Q?Robert_M=FCller?= writes: Fine - thanks for the quick reply. I assume there's no need for a bug report regarding this issue, correct? So I'll do nothing more

Re: typo in 20_vbounce.cf?

2008-05-07 Thread Justin Mason
actually, if you could open a bug that'd be great -- I wasn't planning on backporting the fix to 3.2.x updates. --j. =?ISO-8859-15?Q?Robert_M=FCller?= writes: Fine - thanks for the quick reply. I assume there's no need for a bug report regarding this issue, correct? So I'll do nothing more

Re: typo in 20_vbounce.cf?

2008-05-07 Thread Justin Mason
actually, if you could open a bug that'd be great -- I wasn't planning on backporting the fix to 3.2.x updates. --j. =?ISO-8859-15?Q?Robert_M=FCller?= writes: Fine - thanks for the quick reply. I assume there's no need for a bug report regarding this issue, correct? So I'll do nothing more

Re: Backscattng filter?

2008-05-07 Thread Justin Mason
use the VBounce plugin. see faq Geert Batsleer writes: Hi, over the last couple of days I seem to get more and more spam wich looks like a bounced email with subjects like MAILER DAEMON ... and other variations, where the emails are bounced from mostly russian servers and

Re: joe jobbed or hacked?

2008-05-07 Thread Jonas Eckerman
Jason Esman wrote: What are people doing about joe jobs at this point? What custom rules, and or pluggins? We 1) Use VBounce 2) For any message hitting ANY_BOUNCE_MESSAGE our MD filter tries to extract the original message from the bounce and run that through SpamAssassin and then use the

Re: Writing custom plugins

2008-05-07 Thread Christian Recktenwald
On Wed, May 07, 2008 at 12:13:19PM +0530, ram wrote: http://wiki.apache.org/spamassassin/PluginWritingTips Gives plugin writing tips. But is there a beginners plugin-writing-howto. I took perldoc Mail::SpamAssassin::Plugin -- Christian Recktenwald : voice +49 711 601 2091 :

Re: whitelist mail from own host

2008-05-07 Thread mouss
Benny Pedersen wrote: On Tue, May 6, 2008 23:02, Stefan Jakobs wrote: Yes, that's a possibility, but I can not do that. At least not in the near future. Any other ideas? depends, but i like to know why spf can't work for you ? I don't speak for OP, but here is an example: I

Re: whitelist mail from own host

2008-05-07 Thread mouss
Benny Pedersen wrote: On Tue, May 6, 2008 23:06, mouss wrote: you rely on the sender address, make sure to reject it in your smtpd (you don't want to give spammers an open road). that was why i sugested spf blocking a sender in postfix is trivial. adding SPF support requires

Re: Spoofed Email But Different User Name

2008-05-07 Thread mouss
mhildebr wrote: Is there a way to have Spamassassin look for spoofed email addresses being used as the sender's address ([EMAIL PROTECTED]) but using a different user name (Viagra instead of myname)? It seems like it would be simple to check the user name and filter results from that. Thanks

Re: Spoofed Email But Different User Name

2008-05-07 Thread Chris St. Pierre
On Tue, 6 May 2008, mhildebr wrote: Is there a way to have Spamassassin look for spoofed email addresses being used as the sender's address ([EMAIL PROTECTED]) but using a different user name (Viagra instead of myname)? It seems like it would be simple to check the user name and filter results

Re: Spoofed Email But Different User Name

2008-05-07 Thread mouss
Chris St. Pierre wrote: On Tue, 6 May 2008, mhildebr wrote: Is there a way to have Spamassassin look for spoofed email addresses being used as the sender's address ([EMAIL PROTECTED]) but using a different user name (Viagra instead of myname)? It seems like it would be simple to check the

Re: Experimental - use my server for your high fake MX record

2008-05-07 Thread mouss
Marc Perkel wrote: Looking for a few volunteers who want to reduce their spambot spam and at the same time help me track spambots for my black list. This is free and mutual benefit. I (junkemailfilter.com) want to be your highest numbered fake MX record. Here's how you would configure your

Re: Experimental - use my server for your high fake MX record

2008-05-07 Thread DAve
Marc Perkel wrote: Looking for a few volunteers who want to reduce their spambot spam and at the same time help me track spambots for my black list. This is free and mutual benefit. I (junkemailfilter.com) want to be your highest numbered fake MX record. Here's how you would configure your

Change subject depending on score

2008-05-07 Thread pingu22
Hi, what I want to do is: If score = 5 = 15 change subject to ***SPAM*** If score = 15 change subject to HIGH_SPAM*** with procmail I can control the score level and p.e. put the mail in a different folder. But I'm using a database and I just want to change the subject and depending on

Re: Change subject depending on score

2008-05-07 Thread Luis Hernán Otegui
Hi 2008/5/7 pingu22 [EMAIL PROTECTED]: Hi, what I want to do is: If score = 5 = 15 change subject to ***SPAM*** If score = 15 change subject to HIGH_SPAM*** with procmail I can control the score level and p.e. put the mail in a different folder. The question here is how do

Re: Change subject depending on score

2008-05-07 Thread pingu22
Hi, I'm using Postfix and I call SA from procmail. I'm changing the subject already in local.cf with rewrite_header subject , but I want to change depending on score. in procmail where I have :0: * ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*\*\*\*\*\* I'd like to change subject here for example

Re: Change subject depending on score

2008-05-07 Thread pingu22
I did it already... With procmail... It's working now. thanks anyway Luis. pingu22 wrote: Hi, I'm using Postfix and I call SA from procmail. I'm changing the subject already in local.cf with rewrite_header subject , but I want to change depending on score. in procmail where I have

Re: Experimental - use my server for your high fake MX record

2008-05-07 Thread Kevin W. Gagel
- Original Message - Marc Perkel wrote: Looking for a few volunteers who want to reduce their spambot spam and at the same time help me track spambots for my black list. This is free and mutual benefit. I (junkemailfilter.com) want to be your highest numbered fake MX record. Here's

Re: typo in 20_vbounce.cf?

2008-05-07 Thread JP Kelly
where is this line found? On May 6, 2008, at 3:01 PM, Robert Müller wrote: So for testing purposes I modified the line old: header __BOUNCE_FROM_DAEMON From =~ /(?:(?:daemon|deamon|majordomo| postmaster|virus|scanner|devnull|automated-response|SMTP.gateway|

Re: typo in 20_vbounce.cf?

2008-05-07 Thread JP Kelly
doh! I guess if I read the subject line that would have helped. On May 7, 2008, at 11:15 AM, JP Kelly wrote: where is this line found? On May 6, 2008, at 3:01 PM, Robert Müller wrote: So for testing purposes I modified the line old: header __BOUNCE_FROM_DAEMON From =~

Re: Experimental - use my server for your high fake MX record

2008-05-07 Thread Randy Ramsdell
DAve wrote: Marc Perkel wrote: Looking for a few volunteers who want to reduce their spambot spam and at the same time help me track spambots for my black list. This is free and mutual benefit. I (junkemailfilter.com) want to be your highest numbered fake MX record. Here's how you would

Re: typo in 20_vbounce.cf?

2008-05-07 Thread Jari Fredriksson
doh! I guess if I read the subject line that would have helped. You are not alone with this ;D It's a good practise to include all data in the body of the message, and not to refer to the subject. I once learned that in school and it seems to be true.. jarif On May 7, 2008, at 11:15

Re: Experimental - use my server for your high fake MX record

2008-05-07 Thread DAve
Randy Ramsdell wrote: DAve wrote: Marc Perkel wrote: Looking for a few volunteers who want to reduce their spambot spam and at the same time help me track spambots for my black list. This is free and mutual benefit. I (junkemailfilter.com) want to be your highest numbered fake MX record.

Re: typo in 20_vbounce.cf?

2008-05-07 Thread Robert Müller
I've opened bug 5901. Thanks, Robert Justin Mason schrieb: actually, if you could open a bug that'd be great -- I wasn't planning on backporting the fix to 3.2.x updates. --j. =?ISO-8859-15?Q?Robert_M=FCller?= writes: Fine - thanks for the quick reply. I assume there's no need for a bug

Re: typo in 20_vbounce.cf?

2008-05-07 Thread Robert Müller
Sorry for missing the most important part of the information in the body - I fully agree with you. On the other side, I learned at school to carefully read all parts of the document - seems also to be true :-) Robert Jari Fredriksson schrieb: doh! I guess if I read the subject line that

Re: Experimental - use my server for your high fake MX record

2008-05-07 Thread Marc Perkel
Randy Ramsdell wrote: DAve wrote: Marc Perkel wrote: Looking for a few volunteers who want to reduce their spambot spam and at the same time help me track spambots for my black list. This is free and mutual benefit. I (junkemailfilter.com) want to be your highest numbered fake MX record.

Re: Experimental - use my server for your high fake MX record

2008-05-07 Thread Randy Ramsdell
Marc Perkel wrote: Randy Ramsdell wrote: DAve wrote: Marc Perkel wrote: Looking for a few volunteers who want to reduce their spambot spam and at the same time help me track spambots for my black list. This is free and mutual benefit. I (junkemailfilter.com) want to be your highest

Re: Experimental - use my server for your high fake MX record

2008-05-07 Thread Aaron Wolfe
On Wed, May 7, 2008 at 5:11 PM, Marc Perkel [EMAIL PROTECTED] wrote: Randy Ramsdell wrote: DAve wrote: Marc Perkel wrote: Looking for a few volunteers who want to reduce their spambot spam and at the same time help me track spambots for my black list. This is free

Re: whitelist mail from own host

2008-05-07 Thread Stefan Jakobs
On Tuesday 06 May 2008 23:06, mouss wrote: snip I see from your headers that you use postfix and amavdis-new, and that such messages are submitted with the sendmail command. if you trust the machine (no php mail to outside), then you can skip filtering for mail submitted via sendmail. to do

possible idea for backscatter problem

2008-05-07 Thread .rp
One of the users (actually the boss) had the email address harvested and we got clobbered by backscatter. Looking at the emails of the various 'unable to deliver' type messages, I saw what these could be filtered on, but don't know how to write up and implement the rule outside of procmail.

Re: Experimental - use my server for your high fake MX record

2008-05-07 Thread John Hardin
On Wed, 7 May 2008, Aaron Wolfe wrote: If you just want IPs, maybe instead of running an SMTP service that 450s, you would want to use a packet filter like iptables instead. You could get the IPs simply by what packets you saw come in to port 25 and noone would have to worry you were

Re: Experimental - use my server for your high fake MX record

2008-05-07 Thread Aaron Wolfe
On Wed, May 7, 2008 at 5:44 PM, John Hardin [EMAIL PROTECTED] wrote: On Wed, 7 May 2008, Aaron Wolfe wrote: If you just want IPs, maybe instead of running an SMTP service that 450s, you would want to use a packet filter like iptables instead. You could get the IPs simply by what packets

Re: Experimental - use my server for your high fake MX record

2008-05-07 Thread John Hardin
On Wed, 7 May 2008, Aaron Wolfe wrote: On Wed, May 7, 2008 at 5:44 PM, John Hardin [EMAIL PROTECTED] wrote: (1) Mark is trying to collect data on how the remote MTA behaves when presented with a 451 tmpfail result. A firewall rule can't do that. From his message: I'm not interested in the

Re: Experimental - use my server for your high fake MX record

2008-05-07 Thread DAve
John Hardin wrote: On Wed, 7 May 2008, Aaron Wolfe wrote: On Wed, May 7, 2008 at 5:44 PM, John Hardin [EMAIL PROTECTED] wrote: (1) Mark is trying to collect data on how the remote MTA behaves when presented with a 451 tmpfail result. A firewall rule can't do that. From his message: I'm not

Re: IE Parse bug olso in SpamAssassin ?

2008-05-07 Thread Joseph Brennan
p class=3DMsoNormala href=3Dhttp://{MACCCLINK=3Dtestmaclink,3,http://= 67.228.184.50/links1.txt,www.easyaddedvivacecreation.com}/?asdfdwrt2qxfpm= 7DuzjjB82iEozsAEajsqbEHave a look at our site/a/p Do you have a reference for more on this? Is this just obfuscation or does it do something bad

mandgled spam

2008-05-07 Thread Jon L. Miller
I'm new to SA so bear with me. I've got a Debian server as a gateway server that has SA installed. I tried to release some mail that was marked as spam. When the user got the mail it was a merged email with the attachment and the original email. How do I instruct SA not to merge attachments

Re: mandgled spam

2008-05-07 Thread Bob Proulx
Jon L. Miller wrote: I'm new to SA so bear with me. You have posted to the right place for SA questions. Welcome! I've got a Debian server as a gateway server that has SA installed. I tried to release some mail that was marked as spam. If it was marked as spam it would have had the report

Shortcircuit Question

2008-05-07 Thread Clayton Keller
I have been reading throught the Shortcircuit manpage as well as some articles within the Wiki, and the manner in which I see it performing within our install does not seem to coincide with how I am reading and presumably understanding it to work. First off, we are using SpamAssassin 3.2.4

Re: IE Parse bug olso in SpamAssassin ?

2008-05-07 Thread Benny Pedersen
On Thu, May 8, 2008 05:00, Joseph Brennan wrote: p class=3DMsoNormala href=3Dhttp://{MACCCLINK=3Dtestmaclink,3,http://= 67.228.184.50/links1.txt,www.easyaddedvivacecreation.com}/?asdfdwrt2qxfpm= 7DuzjjB82iEozsAEajsqbEHave a look at our site/a/p Do you have a reference for more on this? Is