Re: Malware URI rule

2015-11-09 Thread Reindl Harald
Am 09.11.2015 um 20:18 schrieb Benny Pedersen: Reindl Harald skrev den 2015-11-09 19:16: spamassassin is usually only *one part *of a whole spamfiltering solution and in most serious setups there is a threshold where high scored junk is *not* delivered to any spam-folder i dont care of your

Re: Malware URI rule

2015-11-09 Thread Benny Pedersen
Reindl Harald skrev den 2015-11-09 19:16: spamassassin is usually only *one part *of a whole spamfiltering solution and in most serious setups there is a threshold where high scored junk is *not* delivered to any spam-folder i dont care of your glues dspam is dead so you say so, that makes

Re: Debian jessie - new setup, missing data directory

2015-11-09 Thread Phil Reynolds
On Mon, 9 Nov 2015 16:27:22 + RW wrote: > > > and which user does spamassassin run as on your system? > > > > root - which I'm slightly surprised at. > > You're probably looking at the main process, rather than child > processes that scan the mail. > > When you look at the output of ps,

Re: Debian jessie - new setup, missing data directory

2015-11-09 Thread Phil Reynolds
On Mon, 9 Nov 2015 08:12:20 -0800 Ian Zimmerman wrote: > On 2015-11-09 16:42 +0100, Antony Stone wrote: > > > What did Jessie install it as? > > > > > > /var/mail/.spamassassin/user_prefs > > This is very strange. Are you really sure it is not operator error? > > I run wheezy, so I can't fla

Re: Debian jessie - new setup, missing data directory

2015-11-09 Thread Phil Reynolds
On Mon, 9 Nov 2015 16:42:43 +0100 Antony Stone wrote: > On Monday 09 November 2015 at 16:23:52, Phil Reynolds wrote: > > > On Mon, 9 Nov 2015 15:11:16 +0100 Antony Stone wrote: > > > > > > What are the ownership & permissions on: > > > > > > /var/mail/,spamassassin > > > > Tried root.root and

Re: Malware URI rule

2015-11-09 Thread Reindl Harald
Am 09.11.2015 um 19:13 schrieb Benny Pedersen: Amir Caspi skrev den 2015-11-09 18:32: A score of 6 is a poison pill for a threshold of 5 unless there are significant negative-score rules that hit. spamassassin never reject so there is no point there blabla spamassassin is usually only *o

Re: Malware URI rule

2015-11-09 Thread Axb
On 11/09/2015 06:09 PM, John Hardin wrote: Folks: https://isc.sans.edu/diary/Malicious+spam+with+links+to+CryptoWall+3.0+-+Subject%3A+Domain+%5Bname%5D+Suspension+Notice/20333 This may not do well enough in masscheck to get published, so it's probably a good idea to just put it in your local r

Re: Malware URI rule

2015-11-09 Thread Martin Gregorie
Thanks John, Installed on my test system: - score incremented by 1 (I use +6 in place of +5) - noddy test mail created - rule working as expected - exported to my live system Many thanks, Martin

Re: Malware URI rule

2015-11-09 Thread Benny Pedersen
Amir Caspi skrev den 2015-11-09 18:32: A score of 6 is a poison pill for a threshold of 5 unless there are significant negative-score rules that hit. spamassassin never reject so there is no point there If an email is otherwise "neutral" (Bayes 50, no whitelist, no DNSWL, etc) this easily bi

Re: Malware URI rule

2015-11-09 Thread Amir Caspi
On Nov 9, 2015, at 10:20 AM, Benny Pedersen wrote: > > and it was the only rule that hitted ? > > think again A score of 6 is a poison pill for a threshold of 5 unless there are significant negative-score rules that hit. If an email is otherwise "neutral" (Bayes 50, no whitelist, no DNSWL, et

Re: Malware URI rule

2015-11-09 Thread Joe Quinn
On 11/9/2015 12:15 PM, Amir Caspi wrote: On Nov 9, 2015, at 10:09 AM, John Hardin wrote: score URI_MALWARE_CWALL6.000 Is your threshold higher than 5? Otherwise this is a poison pill for a "potential" hit. --- Amir thumbed via iPhone There's a lot of things that can bring

Re: Malware URI rule

2015-11-09 Thread John Hardin
On Mon, 9 Nov 2015, Amir Caspi wrote: On Nov 9, 2015, at 10:09 AM, John Hardin wrote: score URI_MALWARE_CWALL6.000 Is your threshold higher than 5? Otherwise this is a poison pill for a "potential" hit. My Spam threshold is 5 and my Quarantine threshold is 10. I'd sugge

Re: Malware URI rule

2015-11-09 Thread Benny Pedersen
Amir Caspi skrev den 2015-11-09 18:15: On Nov 9, 2015, at 10:09 AM, John Hardin wrote: score URI_MALWARE_CWALL6.000 Is your threshold higher than 5? Otherwise this is a poison pill for a "potential" hit. and it was the only rule that hitted ? think again

Re: Malware URI rule

2015-11-09 Thread Amir Caspi
On Nov 9, 2015, at 10:09 AM, John Hardin wrote: > > score URI_MALWARE_CWALL6.000 Is your threshold higher than 5? Otherwise this is a poison pill for a "potential" hit. --- Amir thumbed via iPhone

Malware URI rule

2015-11-09 Thread John Hardin
Folks: https://isc.sans.edu/diary/Malicious+spam+with+links+to+CryptoWall+3.0+-+Subject%3A+Domain+%5Bname%5D+Suspension+Notice/20333 This may not do well enough in masscheck to get published, so it's probably a good idea to just put it in your local ruleset: uriURI_MALWARE_CWALL

Re: Debian jessie - new setup, missing data directory

2015-11-09 Thread RW
On Mon, 9 Nov 2015 15:23:52 + Phil Reynolds wrote: > > /var/mail/.spamassassin/user_prefs spamd seems to be treating /var/mail/ as a home directory. I would have expected .spamassassin to be in a directory owned by the spamd user. > Not there at all. > > > and which user does spamassas

Re: Debian jessie - new setup, missing data directory

2015-11-09 Thread Ian Zimmerman
On 2015-11-09 16:42 +0100, Antony Stone wrote: > What did Jessie install it as? > > > > /var/mail/.spamassassin/user_prefs This is very strange. Are you really sure it is not operator error? I run wheezy, so I can't flat out exclude it, but it flies in the face of too much Debian tradition. /v

Re: Debian jessie - new setup, missing data directory

2015-11-09 Thread Matus UHLAR - fantomas
On 09.11.15 13:23, Phil Reynolds wrote: I have recently transferred all of my email system to a new machine, but spamassassin is not yet fully functional. It seems that it is trying to use /var/mail/.spamassassin as a data directory - this is fine, but it does not appear to be correctly set up.

Re: Debian jessie - new setup, missing data directory

2015-11-09 Thread Antony Stone
On Monday 09 November 2015 at 16:23:52, Phil Reynolds wrote: > On Mon, 9 Nov 2015 15:11:16 +0100 Antony Stone wrote: > > > > What are the ownership & permissions on: > > > > /var/mail/,spamassassin > > Tried root.root and debian-spamd.debian.spamd, 755. What did Jessie install it as? > > /var

Re: Debian jessie - new setup, missing data directory

2015-11-09 Thread Phil Reynolds
On Mon, 9 Nov 2015 15:11:16 +0100 Antony Stone wrote: > On Monday 09 November 2015 at 14:23:04, Phil Reynolds wrote: > > > I have recently transferred all of my email system to a new machine, > > but spamassassin is not yet fully functional. > > > > It seems that it is trying to use /var/mail/.

Re: Debian jessie - new setup, missing data directory

2015-11-09 Thread Antony Stone
On Monday 09 November 2015 at 14:23:04, Phil Reynolds wrote: > I have recently transferred all of my email system to a new machine, > but spamassassin is not yet fully functional. > > It seems that it is trying to use /var/mail/.spamassassin as a data > directory - this is fine, but it does not a

Debian jessie - new setup, missing data directory

2015-11-09 Thread Phil Reynolds
I have recently transferred all of my email system to a new machine, but spamassassin is not yet fully functional. It seems that it is trying to use /var/mail/.spamassassin as a data directory - this is fine, but it does not appear to be correctly set up. Errors like these are appearing in my sys