Re: UCE not stopped

2015-08-11 Thread Martin Skjöldebrand
On Tue, 2015-08-11 at 19:23 +0200, Reindl Harald wrote: > Am 11.08.2015 um 19:17 schrieb Martin Skjöldebrand: > > On Tue, 2015-08-11 at 14:10 +0200, Martin Skjöldebrand wrote: > > > On Tue, 2015-08-11 at 10:09 +0200, Reindl Harald wrote: > > > > > > > than fix /etc/passwd and give that user a sehl

Re: UCE not stopped

2015-08-11 Thread Reindl Harald
Am 11.08.2015 um 19:17 schrieb Martin Skjöldebrand: On Tue, 2015-08-11 at 14:10 +0200, Martin Skjöldebrand wrote: On Tue, 2015-08-11 at 10:09 +0200, Reindl Harald wrote: than fix /etc/passwd and give that user a sehll (as i did for spamass-milter user on Fedora), after that you can "su - debi

Re: UCE not stopped

2015-08-11 Thread Martin Skjöldebrand
On Tue, 2015-08-11 at 14:10 +0200, Martin Skjöldebrand wrote: > On Tue, 2015-08-11 at 10:09 +0200, Reindl Harald wrote: > > > than fix /etc/passwd and give that user a sehll (as i did for > > spamass-milter user on Fedora), after that you can "su - debian > > -spamd" > > or just use http://wiki.

Re: Phishtank and SpamAssassin

2015-08-11 Thread Raymond Dijkxhoorn
Hai! SURBL looks at the importance of the site. Is it lets for example a phishing page on a large isp we will not blacklist the whole isp. Too much collateral damage. SURBL has also a non RBL product for this called UriQ. Specificly for full uri lookups (eg also hacked and phishing pages) tha

Re: spf rfc 7208 checkers

2015-08-11 Thread Reindl Harald
Am 11.08.2015 um 15:41 schrieb Benny Pedersen: Reindl Harald skrev den 2015-08-11 15:29: Am 11.08.2015 um 15:26 schrieb Benny Pedersen: anyone know where one is ? i fear all i have is for rfc 4408 :/ http://www.openspf.net/Why?s=mfrom;id=m...@junc.eu;ip=176.58.121.172 if the SPF is invalid

Re: spf rfc 7208 checkers

2015-08-11 Thread Benny Pedersen
Reindl Harald skrev den 2015-08-11 15:29: Am 11.08.2015 um 15:26 schrieb Benny Pedersen: anyone know where one is ? i fear all i have is for rfc 4408 :/ http://www.openspf.net/Why?s=mfrom;id=m...@junc.eu;ip=176.58.121.172 if the SPF is invalid or there would be warnings you would see them t

Re: spf rfc 7208 checkers

2015-08-11 Thread Reindl Harald
Am 11.08.2015 um 15:26 schrieb Benny Pedersen: anyone know where one is ? i fear all i have is for rfc 4408 :/ http://www.openspf.net/Why?s=mfrom;id=m...@junc.eu;ip=176.58.121.172 if the SPF is invalid or there would be warnings you would see them there signature.asc Description: OpenPGP

spf rfc 7208 checkers

2015-08-11 Thread Benny Pedersen
anyone know where one is ? i fear all i have is for rfc 4408 :/

RE: Phishtank and SpamAssassin

2015-08-11 Thread Sujit Acharyya-choudhury
Unfortunately, most of the phishes are under many layers of the main domain. Google, Web of Trust (WOT) and many other virus scanner seem to find it, as was rightly pointed out SaneSecurity's signatures of Phishtank. So as far as phishes we are getting, so far it has not being proved to be very us

Re: UCE not stopped

2015-08-11 Thread Martin Skjöldebrand
On Tue, 2015-08-11 at 13:19 +0200, Matus UHLAR - fantomas wrote: > this just cays how spamd runs (user debian-spamd), but how do you > connect > your mail system to spamassassin? > Seems I should have been cleared in former message > > and please don't send me personal replies - I read the list

Re: UCE not stopped

2015-08-11 Thread Martin Skjöldebrand
On Tue, 2015-08-11 at 10:09 +0200, Reindl Harald wrote: > than fix /etc/passwd and give that user a sehll (as i did for > spamass-milter user on Fedora), after that you can "su - debian > -spamd" > or just use http://wiki.apache.org/spamassassin/SiteWideBayesSetup I've changed my configuration

Re: Phishtank and SpamAssassin

2015-08-11 Thread Reindl Harald
Am 11.08.2015 um 14:02 schrieb Sujit Acharyya-choudhury: The URIBL_PH_SURBL is actually not very useful. I have checked a real phishing site with SURBL and it shows clean in SURBL - I think, SURBL only looks at the part of the domain. every URIBL check only tests the main-domain of a link, t

RE: Phishtank and SpamAssassin

2015-08-11 Thread Sujit Acharyya-choudhury
The URIBL_PH_SURBL is actually not very useful. I have checked a real phishing site with SURBL and it shows clean in SURBL - I think, SURBL only looks at the part of the domain. -Original Message- From: RW [mailto:rwmailli...@googlemail.com] Sent: 11 August 2015 12:57 To: users@spamassas

Re: Phishtank and SpamAssassin

2015-08-11 Thread RW
On Tue, 11 Aug 2015 11:11:56 + Sujit Acharyya-choudhury wrote: > I have seen lot of Phishes submitted in Phishtank.com and yet there > is no rule to check Phishtank.com. There is via URIBL_PH_SURBL. It doesn't score much though.

Re: UCE not stopped

2015-08-11 Thread Matus UHLAR - fantomas
On Tue, 2015-08-11 at 09:06 +0200, Matus UHLAR - fantomas wrote: 2. how do you run SA? If you are using amavis or other system that uses single account for scoring, you must train that account On 11.08.15 10:04, Martin Skjöldebrand wrote: This is the output of ps aux | grep spamd root 21

RE: Phishtank and SpamAssassin

2015-08-11 Thread Sujit Acharyya-choudhury
Many thanks for the info. -Original Message- From: Reindl Harald [mailto:h.rei...@thelounge.net] Sent: 11 August 2015 12:14 To: users@spamassassin.apache.org Subject: Re: Phishtank and SpamAssassin Am 11.08.2015 um 13:11 schrieb Sujit Acharyya-choudhury: > I have seen lot of Phishes sub

Re: UCE not stopped

2015-08-11 Thread RW
On Tue, 11 Aug 2015 10:04:41 +0200 Martin Skjöldebrand wrote: > The main instance is running as root, (and sa-learn has been run as > root) but the children are run as debian-spamd but I can't "su" to > that user, I'm still root. Use su -m

Re: Phishtank and SpamAssassin

2015-08-11 Thread Reindl Harald
Am 11.08.2015 um 13:11 schrieb Sujit Acharyya-choudhury: I have seen lot of Phishes submitted in Phishtank.com and yet there is no rule to check Phishtank.com. Would it be a good idea to give some points to phishes submitted to phishtank – even if they are not verified? that's way better plac

Phishtank and SpamAssassin

2015-08-11 Thread Sujit Acharyya-choudhury
I have seen lot of Phishes submitted in Phishtank.com and yet there is no rule to check Phishtank.com. Would it be a good idea to give some points to phishes submitted to phishtank - even if they are not verified? smime.p7s Description: S/MIME cryptographic signature

Re: UCE not stopped

2015-08-11 Thread Reindl Harald
Am 11.08.2015 um 10:04 schrieb Martin Skjöldebrand: On Tue, 2015-08-11 at 09:06 +0200, Matus UHLAR - fantomas wrote: 2. how do you run SA? If you are using amavis or other system that uses single account for scoring, you must train that account This is the output of ps aux | grep spamd roo

Re: UCE not stopped

2015-08-11 Thread Martin Skjöldebrand
On Tue, 2015-08-11 at 09:06 +0200, Matus UHLAR - fantomas wrote: > 2. how do you run SA? If you are using amavis or other system that > uses > single account for scoring, you must train that account This is the output of ps aux | grep spamd root 21807 0.0 1.9 170008 80528 ?Ss 06

Re: UCE not stopped

2015-08-11 Thread Martin Skjöldebrand
On Tue, 2015-08-11 at 09:06 +0200, Matus UHLAR - fantomas wrote: > On 11.08.15 07:05, Martin Skjöldebrand wrote: > > I've run sa-learn on my spam folder (containing over 700 mails) and > > random ham folder (at least as much). And still a horrible amount > > of > > UCE (mainly loans and gambling s

Re: UCE not stopped

2015-08-11 Thread Matus UHLAR - fantomas
On 11.08.15 07:05, Martin Skjöldebrand wrote: I've run sa-learn on my spam folder (containing over 700 mails) and random ham folder (at least as much). And still a horrible amount of UCE (mainly loans and gambling sites, is it a conspiracy? =) ) are allowed through with a score of 2.4 or somethin