Re: Sa-update and proxy servers

2011-02-18 Thread Daniel Lemke
Michael Scheidell wrote: [...] I now need to set a proxy server to do sa-updates through, but could not find any information on settings for a proxy server. [...] Added cmd options: -x --proxy -U --proxy-user -P --proxy-password -t --connect-timeout. [...] Hi, just

Re: Sa-update and proxy servers

2011-02-18 Thread Warren Togami Jr.
On 2/17/2011 11:44 PM, Daniel Lemke wrote: Michael Scheidell wrote: [...] I now need to set a proxy server to do sa-updates through, but could not find any information on settings for a proxy server. [...] Added cmd options: -x --proxy -U --proxy-user -P --proxy-password -t

Re: date_received for previous hop

2011-02-18 Thread Bowie Bailey
On 2/17/2011 8:27 PM, Frank Reppin wrote: Hi list, for some weird reasons... ... I need to know the date where a mail was sent by the previous host (in the mail header chain) to our MTA. From checking HeaderEval.pm I conclude that: (if I'm correct) date_received - gives me the date

Re: Freemail problem

2011-02-18 Thread Mark Martinec
Jeremy, Noel, I'm using SpamAssassin 3.2.5, and the FreeMail.pm plugin v2.001 from http://sa.hege.li, along with the rules from the 20_freemail.cf file at the same location. My first question is why does (mr.anthonywalter2010[at]gmail.com) appear twice within the FREEMAIL_FROM entry

Re: using spamhaus droplist with sa ?

2011-02-18 Thread Ken A
On 2/17/2011 6:52 PM, Warren Togami Jr. wrote: On 2/17/2011 5:40 AM, RW wrote: The suggestion is that it be scored higher for that reason. Or just outright block all MTA connections from anything listed in zen.spamhaus.org, which seems to be safe. Large sites I know have been doing that

Re: using spamhaus droplist with sa ?

2011-02-18 Thread Bowie Bailey
On 2/18/2011 9:30 AM, Ken A wrote: On 2/17/2011 6:52 PM, Warren Togami Jr. wrote: On 2/17/2011 5:40 AM, RW wrote: The suggestion is that it be scored higher for that reason. Or just outright block all MTA connections from anything listed in zen.spamhaus.org, which seems to be safe. Large

Re: date_received for previous hop

2011-02-18 Thread Frank Reppin
Hi Bowie, On 18.02.2011 15:10, Bowie Bailey wrote: [...] You want the date the mail was sent to your MTA? How is that different than the date it was received by your MTA? No - this would be really the same then. :) But let me clarify... ... each received header contains the date where a

Re: Freemail problem

2011-02-18 Thread Henrik K
On Fri, Feb 18, 2011 at 03:20:32PM +0100, Mark Martinec wrote: Jeremy, Noel, I'm using SpamAssassin 3.2.5, and the FreeMail.pm plugin v2.001 from http://sa.hege.li, along with the rules from the 20_freemail.cf file at the same location. My first question is why does

Re: date_received for previous hop

2011-02-18 Thread Bowie Bailey
On 2/18/2011 9:38 AM, Frank Reppin wrote: Hi Bowie, On 18.02.2011 15:10, Bowie Bailey wrote: [...] You want the date the mail was sent to your MTA? How is that different than the date it was received by your MTA? No - this would be really the same then. :) But let me clarify... ...

Re: date_received for previous hop

2011-02-18 Thread Frank Reppin
Hi Bowie, hi list, On 18.02.2011 16:25, Bowie Bailey wrote: [...] That information should be in the headers. For example, from your email: Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 18 Feb 2011 14:39:31 + It

Re: Freemail problem

2011-02-18 Thread Mark Martinec
Henrik, Hmm yes I was wondering about this... so $pms-{conf} isn't actually per message then? Too busy to dive into that right now.. No, the $pms-{conf} is just another ref or shortcut to $main-{conf}. Changes there affect the global configuration. The calls to $pms-clear_test_state and

Re: date_received for previous hop

2011-02-18 Thread Bowie Bailey
On 2/18/2011 10:58 AM, Frank Reppin wrote: On 18.02.2011 16:25, Bowie Bailey wrote: [...] That information should be in the headers. For example, from your email: Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Fri,

TVD_SPACED_SUBJECT_WORD3

2011-02-18 Thread Leonard den Ottolander
Hi, I was wondering what the rationale behind the rule TVD_SPACED_SUBJECT_WORD3 is. http://spamassassin.apache.org/tests_3_2_x.html does not give a description. This rule bit me when sending a mail with the subject Re: MySQL. Regards, Leonard.

Re: TVD_SPACED_SUBJECT_WORD3

2011-02-18 Thread Raymond Dijkxhoorn
Hi! TVD_SPACED_SUBJECT_WORD3 is. http://spamassassin.apache.org/tests_3_2_x.html does not give a description. This rule bit me when sending a mail with the subject Re: MySQL. This rule can hit about anything. 72_active.cf:##{ TVD_SPACED_SUBJECT_WORD3 72_active.cf:header

Re: TVD_SPACED_SUBJECT_WORD3

2011-02-18 Thread Leonard den Ottolander
Hello Raymond, On Fri, 2011-02-18 at 19:27 +0100, Raymond Dijkxhoorn wrote: TVD_SPACED_SUBJECT_WORD3 is. http://spamassassin.apache.org/tests_3_2_x.html does not give a This rule can hit about anything. As per the link I included I did see *what* the rule looks like. However, I would like

Re: TVD_SPACED_SUBJECT_WORD3

2011-02-18 Thread Raymond Dijkxhoorn
Hi! TVD_SPACED_SUBJECT_WORD3 is. http://spamassassin.apache.org/tests_3_2_x.html does not give a This rule can hit about anything. As per the link I included I did see *what* the rule looks like. However, I would like to understand why it is there and what it is supposed to filter.

Re: TVD_SPACED_SUBJECT_WORD3

2011-02-18 Thread John Hardin
On Fri, 18 Feb 2011, Raymond Dijkxhoorn wrote: Hi! TVD_SPACED_SUBJECT_WORD3 is. http://spamassassin.apache.org/tests_3_2_x.html does not give a This rule can hit about anything. As per the link I included I did see *what* the rule looks like. However, I would like to

Re: TVD_SPACED_SUBJECT_WORD3

2011-02-18 Thread Bowie Bailey
On 2/18/2011 1:59 PM, Raymond Dijkxhoorn wrote: Hi! TVD_SPACED_SUBJECT_WORD3 is. http://spamassassin.apache.org/tests_3_2_x.html does not give a This rule can hit about anything. As per the link I included I did see *what* the rule looks like. However, I would like to understand why it is

Re: TVD_SPACED_SUBJECT_WORD3

2011-02-18 Thread Raymond Dijkxhoorn
Hi! For the regexp challenged: This rule hits a subject with an optional Re: or Fw: followed by one word starting with at least one uppercase letter followed by at least one lowercase letter followed by at least one uppercase letter. It will not match if there are multiple words or any

Re: TVD_SPACED_SUBJECT_WORD3

2011-02-18 Thread Bowie Bailey
On 2/18/2011 4:09 PM, Raymond Dijkxhoorn wrote: Hi! For the regexp challenged: This rule hits a subject with an optional Re: or Fw: followed by one word starting with at least one uppercase letter followed by at least one lowercase letter followed by at least one uppercase letter. It will

Tonns of russian DOT info spam

2011-02-18 Thread Michelle Konzack
Hello *, Since three weeks the Debian Mailinglist are hit be several 1000 russian DOTinfo spams and spamassassin score this crap with -4 Does someone have a working rule for this crap? I tried : describe TD_INFO dot info spam body __TD_INFO /http:\/\/.*\.info/i scoreTD_INFO 4.0

Re: Tonns of russian DOT info spam

2011-02-18 Thread Adam Katz
On 02/18/2011 01:46 PM, Michelle Konzack wrote: Since three weeks the Debian Mailinglist are hit be several 1000 russian DOTinfo spams and spamassassin score this crap with -4 Does someone have a working rule for this crap? I tried : describe TD_INFO dot info spam body __TD_INFO

Re: Tonns of russian DOT info spam

2011-02-18 Thread John Hardin
On Fri, 18 Feb 2011, Adam Katz wrote: On 02/18/2011 01:46 PM, Michelle Konzack wrote: Since three weeks the Debian Mailinglist are hit be several 1000 russian DOTinfo spams and spamassassin score this crap with -4 Can you post the offending message to a pastebin? +1 on the samples. I only

Re: My messages never got to this list, even though I'm subscribed etc.

2011-02-18 Thread John Hardin
On Fri, 18 Feb 2011, jidanni wrote: My recent messages never got to this list, even though I'm subscribed etc. Could it be it thinks they are ... spam? Or maybe the Nabble - SA glue was temporarily broken for some reason. We aren't going to troubleshoot Nabble for you. Post directly to the

Re: Tonns of russian DOT info spam

2011-02-18 Thread Karsten Bräckelmann
On Fri, 2011-02-18 at 14:04 -0800, Adam Katz wrote: On 02/18/2011 01:46 PM, Michelle Konzack wrote: Since three weeks the Debian Mailinglist are hit be several 1000 russian DOTinfo spams and spamassassin score this crap with -4 Spam scoring -4. The .info URI is not your problem, neither the

Re: Tonns of russian DOT info spam

2011-02-18 Thread Adam Katz
If you really want to do something that bold, at least limit it to the debian list (note, that list-id is a guess, check your headers): header __TD_DEB_LIST List-Id =~ /debian-user.lists.debian.org/ uri__TD_DOT_INFO m'^http://[^/]*\.info[/:?#]'i On 02/18/2011 02:55 PM, Karsten

Re: My messages never got to this list, even though I'm subscribed etc.

2011-02-18 Thread Karsten Bräckelmann
On Fri, 2011-02-18 at 14:49 -0800, John Hardin wrote: On Fri, 18 Feb 2011, jidanni wrote: My recent messages never got to this list, even though I'm subscribed etc. Could it be it thinks they are ... spam? Possible -- did you by chance include URIs in your recent attempts to post, that

Re: Freemail problem

2011-02-18 Thread Noel Butler
Mark, On Fri, 2011-02-18 at 15:20 +0100, Mark Martinec wrote: Jeremy, Noel, It's a bug in the FreeMail.pm plugin. It forgets to reset the rule description text with every message, to the addresses listed in a rule description just accumulate from one message to the next. I think this only

Re: My messages never got to this list, even though I'm subscribed etc.

2011-02-18 Thread jidanni
Well let's see if at least this reply gets through without needing to resort to Nabble.

Re: My messages never got to this list, even though I'm subscribed etc.

2011-02-18 Thread jidanni
j == jidanni jida...@jidanni.org writes: j Well let's see if at least this reply gets through without needing to j resort to Nabble. OK, it got through. ANOTHER_JIDANNI_STUPID_POST did not fire ☺

Re: Tonns of russian DOT info spam

2011-02-18 Thread Karsten Bräckelmann
On Fri, 2011-02-18 at 15:01 -0800, Adam Katz wrote: uri__TD_DOT_INFO m'^http://[^/]*\.info[/:?#]'i On 02/18/2011 02:55 PM, Karsten Bräckelmann wrote: Way better. And actually a uri rule. :) It's missing a bare domain URI, though. The end of the domain part sub-RE alternatively

Re: Tonns of russian DOT info spam

2011-02-18 Thread Adam Katz
Ah, good one. Though unfortunately, and I hate to admit that, both our rules will never match. The # hash needs to be escaped... *sigh* [/:?\#] Or just ignore it by leaving it out. It's pretty rare, anyway. Hash (#), like At (@) and sometimes Dollar ($), has an inconsistent behavior of

Re: Tonns of russian DOT info spam

2011-02-18 Thread Karsten Bräckelmann
On Fri, 2011-02-18 at 15:53 -0800, Adam Katz wrote: Ah, good one. Though unfortunately, and I hate to admit that, both our rules will never match. The # hash needs to be escaped... *sigh* [/:?\#] Or just ignore it by leaving it out. It's pretty rare, anyway. Hash (#), like At

[SOLVED] Re: date_received for previous hop

2011-02-18 Thread Frank Reppin
Hi list, Ok - think of it as beeing solved. I could make something 'useful' after digging more in HeaderEval.pm. But later then... this raises another issue. I'll open a separate thread on this one. Thanks. frank\ -- 43rd Law of Computing: Anything that can go wr fortune:

recent sa-update rules (for 3.3.1) break plugin?

2011-02-18 Thread Frank Reppin
Hi list, I've written a small plugin which will output some timing details in order to check whether a mail comes in with severe delay... ... not 100% complete at this stage - but it gives some timing clues in the log. However... ... for some weird reason will this plugin only work by using the