RE: ANNOUNCE: Apache SpamAssassin 3.2.2 available

2007-07-25 Thread Robert - eLists
> > Just as in 3.2.1, I still get this error when trying to build: > > REQUIRED module out of date: HTML::Parser > > But I already installed HTML::Parser 3.56 with no errors. > > I can't be the only one who has received this error, but nothing is > indicating that I am missing any other depende

rpmbuild -tb error ---- WAS --- RE: ANNOUNCE: Apache SpamAssassin 3.2.2 available

2007-07-25 Thread Robert - eLists
> > RHEL3, perl 5.8.8, sendmail 8.13, SA 3.1.9 > > rpmbuild -tb Mail-SpamAssassin-3.2.2.tar.gz throws the error > > Thanks. > > - Skip Skip, When I do this rpm -qa | grep arser I get this perl-XML-Parser-2.34-5 perl-HTML-Parser-3.55-1.el4.rf you might go to http://dag.wieers.com/rpm/pa

RE: ANNOUNCE: Apache SpamAssassin 3.2.3 available

2007-08-09 Thread Robert - eLists
> > Check in a day or so. > Last time there was a release update someone posted a good link that I cannot find in the list archives quite yet. Someone please feel free to repost. Thanks! - rh

RE: how to upgrade 3.1.7 to higer version

2007-08-09 Thread Robert - eLists
Now I using SA 3.1.7. How to update the higher versions. Please help me. -- Sg Hi Sg, Um if you are using CentOS just do this Backup your /etc/mail/spamassassin directory and all of it's file contents, mainly for safety and good admin work protection Then if you have

RE: Rule for PDF and eCard Spam Needed

2007-08-14 Thread Robert - elists
> > Just to make it clear what I and others keep saying on this topic: > I'm using 4 different systems that have various 3.x versions of > spamassassin, all of which use sa-update, and none of which are doing > an adequate job of catching gif, pdf or ecard spam. It's upwards of > 20 an hour on se

RE: Rule for PDF and eCard Spam Needed

2007-08-14 Thread Robert - elists
> > Apparently with alternate virus files, which I had not yet tested. > Someone mentioned that earlier today and I'm investigating it. > > -- > Jo Rhett Jo I don't use alternative files that I am aware of anyways... just stock clamav And... I hear ya, yet clamav plugin *integration* into SA

RE: Rule for PDF and eCard Spam Needed

2007-08-15 Thread Robert - elists
> > I'm using stock clamav with freshclam, and getting 10-12 an hour in > each maibox. So no, stock clamav does not catch these. > > -- > Jo Rhett Hmm interesting I was telling the same thing recently on this same thread. YES, they do catch and quarantine them all them rotten buggers. Wh

RE: Rule for PDF and eCard Spam Needed

2007-08-15 Thread Robert - elists
> > I'm using stock clamav with freshclam, and getting 10-12 an hour in > each maibox. So no, stock clamav does not catch these. > > -- > Jo Rhett Hmm interesting I was telling the same thing recently on this same thread. YES, they do catch and quarantine them all them rotten buggers. Wh

RE: Rule for PDF and eCard Spam Needed

2007-08-15 Thread Robert - elists
> > Sigh, I give up. > > Kai > Give up what? Trying to run destructive interference or consider helping Jo ? :-) - rh

RE: v3.2.3 isn't recognizing local.cf custom rules

2007-08-18 Thread Robert - elists
> > I have *always* run SA through MailScanner. This configuration is not new, > I > have run it this way for *years*. The only thing that's new is the version > of SA. As soon as I upgraded to v3.2.3, the problems started. > > If you can't be helpful, I can certainly understand. But I don't nee

RE: v3.2.3 isn't recognizing local.cf custom rules

2007-08-18 Thread Robert - elists
> > I've read this list for a long time. I've seen some really, truly STUPID > questions come through...and seen them be answered, civilly, helpfully. > The > only difference is I don't have a masculine username. I truly hate coming > off as a cranky feminist who complains I am being treated unf

RE: v3.2.3 isn't recognizing local.cf custom rules

2007-08-19 Thread Robert - elists
> > What's with this? There's no need for this on this list. > Maybe not... pray for victory over the moron stick for me please. > > You've asked many a question here that the above would have applied to > No kiddin? :-) Im sure I would agree... I imagine the ESR smart questions faq wou

RE: How do I temporarily disable SpamAssassin?

2007-08-19 Thread Robert - elists
> > I have a FreeBSD machine running qmail, SpamAssassin and ClamAV. The > machine is receiving 200,000 e-mail messages per day, courtesy of > Rumpelstiltskin attacks from thousands of different IP addresses each day, > and SpamAssassin appears to be overwhelmed. I have about 50,000 e-mail > mes

RE: How do I temporarily disable SpamAssassin?

2007-08-19 Thread Robert - elists
> > I've read Life with qmail and the SpamAssassin documentation at > http://spamassassin.apache.org/ but I'm not connecting the dots. > Unfortunately, I didn't set up this machine and I don't have a good grasp > of qmail, SpamAssassin and ClamAV. > > Thanks in advance for any guidance and all pr

RE: How do I temporarily disable SpamAssassin?

2007-08-19 Thread Robert - elists
> > #/usr/local/etc/rc.d/sa-spamd stop > > > If anyone knows how to temporarily disable ClamAV too, I'd be > > ecstatic to learn how to do that too. > > Disable the daemon: > #/usr/local/etc/rc.d/clamav-clamd stop > > Disable the sendmail milter: > #/usr/local/etc/rc.d/clamav-milter stop > > Y

RE: How do I temporarily disable SpamAssassin?

2007-08-19 Thread Robert - elists
> > > Bingo! SpamAssassin and ClamAV are supposedly stopped. > Right, problem is, there is code or a codeset on your machine that requires they be present and activated or your server will barf on incoming messages. I sent a coupla posts last night to direct you towards looking for a file cal

RE: How do I temporarily disable SpamAssassin?

2007-08-19 Thread Robert - elists
> > > > I would think stopping these may prevent any mail from passing through > your > system. If you can't figure out how to reconfigure qmail to stop sending > mail to spamd then you might consider adding the --local argument to the > spamd daemon. This would make spamd run considerably faster

RE: How do I temporarily disable SpamAssassin?

2007-08-19 Thread Robert - elists
> > > > It's not a solution. It's an attempt to get the toilet unplugged while the > plumber is on the way. The change should be reverted one the system is > properly configured. The main problem is all we really know is that the > MTA > is qmail. > Gary, U it doesn't unplug the toilet... y

RE: Who wants my spam - seriously!

2007-09-06 Thread Robert - elists
snipsnipsnip None of this spam is the really easy to catch stuff. We all can block the easy stuff. I hate spam and spammers. I'm already sending these feeds to several URIBL lists and IP Blacklists. Many of the blacklists you use is running off of this data. But - if anyone else wants some of thi

RE: Who wants my spam - seriously!

2007-09-06 Thread Robert - elists
> > Please do not feed the trolls. > > Michael I understand... One problem though, filtering, ignoring, or not feeding the trolls doesn't change their purposing, thinking, or behaviors (plural) Can I be list daddy? ;-> - rh

RE: URIWhois-0.02

2007-09-26 Thread Robert - elists
> > DOB, for example, is run by ar.com, who are a registrar. Since they are a > domain registrar, they have full, direct access to the whois database. > > Jeff C. > Well there ya go Jeff... Become a registrar and bam! More data to help you cause - rh

RE: URIWhois-0.02

2007-09-26 Thread Robert - elists
> > Thats the easy answer, but do you know what it costs to become a > registrar? > > Just for com/net from verisign you have $6500 up front, and $4k > recurring. To get your icann credentials, you have $2500 up front with > application, $4k yearly. A variable fee to icann once you start > re

RE: New PayPal phish?

2007-09-28 Thread Robert - elists
> > At 08:10 AM 9/28/2007, Kenneth Porter wrote: > >Is there a new PayPal phish going about? This almost looks > >legitimate, and I imagine it would have a lot of appeal to the > >survey-lovers. (I had no communication with PayPal this week, so I > >know this is bogus.) some time ago when set

RE: High Qmail-Server Load

2007-10-31 Thread Robert - elists
If you need to reject unknown accounts at smtp time, go to http://qmail.jms1.net and check out validrcptto patch among other things please read site in full to make good decisions re qmail i.e. browser will not work there. - rh

RE: It's a fine line...

2007-11-06 Thread Robert - elists
> > But hey, that is a too big cut from Internet, so in some way it is > cultural imperialism. > > Bests, > > Olivier Oliver uu, by default, all organizations get to specifically (or not) define network policies on their own networks. Like it or not that is the way it is. I don't know

RE: Pretty good, Paypal are making their own phish these days!

2007-11-06 Thread Robert - elists
> > Just got a thing that claims to come from "email-109.paypal.com". It > backtracks to there, too. > (Snip) > > Clam seems to think it is a phish. I think it is a phish. It looks like > a > phish. > > The disturbing thing is it seems to have come from the real Paypal > servers, > AND, it h

RE: Rule(s) to tie From and To addresses together?

2007-11-23 Thread Robert - elists
> > As part of my efforts to track and control spam, I bought a domain and > created a unique alias to give to every distinct company with which I > do business. For example, the address I gave to my bank might be > [EMAIL PROTECTED], while the one I gave to an online bookseller > might be [EMAI

RE: Rule(s) to tie From and To addresses together?

2007-11-23 Thread Robert - elists
> > Not exactly, just looking to set up a rule that says (per the earlier > example) any mail to [EMAIL PROTECTED] that is *not* coming from > mybank.com is almost certainly spam. Likewise, I would like to set up > a rule to say that mail from [EMAIL PROTECTED] to that address is > more likely (b

RE: SpamAssassin on Exchange 2007

2007-11-24 Thread Robert - elists
I was happily humming along with Spamassassin on Win2k3 with Exchange 2003 for some time now (yes, you can do it all on one box). I was using Chris Lewis' ESA sink which worked great. However, after an upgrade to Exchange 2007, I've come to realize that the old smtp sinks have been deprecated

RE: Utility to dump public corpus to outlook folder

2007-12-16 Thread Robert - elists
Ummm you could always try the outlook import function ;-> - rh

RE: DDOS, Dictionary Attack... not sure what it is...

2008-01-01 Thread Robert - elists
> > When I say "tarpit" I don't mean an MTA-native "slow the SMTP > conversation down" model, I mean a genuine TCP tarpit that plays games > with window sizes to trap the attacker - that's what LaBrea does. > > I don't think the MTA should be tasked with tarpitting. Tarpitting is > a job for a

RE: Plagued by spamassassin

2008-01-04 Thread Robert - elists
> > I have asked before but have been unable to get a usable solution. I am > running qmail, spamassassin, clamav, etc from the qmr package on one of > our FBSD 6.2 servers. If you email via squirrelmail, your outbound email > does not get labeled spam. If you send out via a client with smtp,

RE: BOTNET 0.8 + SA 3.2.3

2008-01-11 Thread Robert - elists
> > Nope sorry... > > Here's what I did: > I removed the botnet files from /etc/mail/spamassassin and restarted > spamd. > I ran --lint which confirmed that no there was no botnet installation. > I downloaded Botnet 0.8 *again* from > http://people.ucsc.edu/~jrudd/spamassassin/Botnet-0.8.tar > I

RE: BOTNET 0.8 + SA 3.2.3

2008-01-12 Thread Robert - elists
> > Well here is what I have... > > [EMAIL PROTECTED] ~]# ls -la /etc/mail/spamassassin/ > total 148 > drwxr-xr-x 3 root root 4096 2008-01-11 22:54 . > drwxr-xr-x 3 root root 4096 2007-12-29 19:48 .. > -r--r--r-- 1 root root 4706 2008-01-11 22:54 Botnet.cf > -r--r--r-- 1 root root 28616 2008-

RE: Testing Botnet

2008-01-12 Thread Robert - elists
> > Sounds like you've been hit by bug 5519 [1] before the upgrade in Oct. > Setting rules scores to 0 did *not* prevent these tests from being > evaluated for SA 3.2.x before 3.2.3. > > Fixed since 3.2.3. Plugin eval rules with 0 scores are meant no not be > evaluated, and of course to not sho

RE: more efficent big scoring

2008-01-18 Thread Robert - elists
> > You can't run the rules in score-order without driving SA's performance > into the ground. > > The key here is SA doesn't run tests sequentially, it runs them in > parallel as it works its way through the body. this allows for good, > efficient use of memory cache. > > By running rules in sc

RE: more efficent big scoring

2008-01-23 Thread Robert - elists
> > Just wanted to point out, this topic came out when site dns > cache service started to fail due to excessive dnsbl queries. My > slowdown was due to multiple timeouts and/or delay, probably > related to "answering joe-job rbldns backscatter" -- that's the > reason I was looking for early exit

sa-compile format the standard now?

2008-02-13 Thread Robert - elists
Greetings Is using sa-compile the standard now? ... or are most organizations still just using the stock formatted rulesets? If not the standard, is it the SA recommended standard? I know there can be problems or issues, yet if we do use sa-compile as instructed by the documentation, should we

RE: sa-compile format the standard now?

2008-02-13 Thread Robert - elists
> > I would say that sa-compile is the preferred method due to its > performance benefits. There aren't many (any?) drawbacks to using it. > > That said, I still cannot get it to work on my system. Everything works > fine with the standard rulesets, but as soon as I enable the compiled > rules

RE: sa-compile format the standard now?

2008-02-14 Thread Robert - elists
> > I don't use it here because it takes too long (over 20 minutes) to > compile. > (This is with SA v3.2.4, which is a big improvement over v3.2.3) > > L Why would how long it takes to compile matter as long as you get some return on investment? Is the machine heavily loaded or just a small u

RE: telnet port 783 from external network

2008-02-19 Thread Robert - elists
> > Probably /var/log/maillog or wherever syslog logs your mail facility. > > Daryl Daryl, Hey, that is kinda neat... telnet localhost 783 Trying 127.0.0.1... Connected to localhost.localdomain (127.0.0.1). Escape character is '^]'. PING SPAMC/1.0 SPAMD/1.4 0 PONG Connection closed by foreign

RE: [WRONG PLACE TO ASK THIS] WHM/Cpanel: Where are the Server-wide SpamAssassin settings?

2008-02-19 Thread Robert - elists
> > This is the SpamAssassin users list. For people who are using SpamAssassin > and having trouble with it. > > My post was absolutely within the remit of this list. And I provided as > much > information as I thought was relevant, including the header tags added by > SA, the local.cf file, the

RE: [WRONG PLACE TO ASK THIS] WHM/Cpanel: Where are the Server-wide SpamAssassin settings?

2008-02-19 Thread Robert - elists
> > Funnily enough that's the useful response. This would be a much more > useful > list if instead of pouncing on non-experts with tangential rants people > simply offered a link or two, or said precisely what kind of test info is > needed. > > I have now seen these pages: > > http://wiki.apac

RE: Why SA don't use bayes for some e-mails?

2008-02-20 Thread Robert - elists
> > > (sorry my poor english) > > Hi, > > I have a machine with qmail+qmail-scanner+spamassassin 3.0.0. Some time > ago, > I have saw that some spam are passing through filter with 0 score. Then, I > activated sa_debug='1' and sa_hdr_report='1' in qmail-scanner for see how > SA > are giving th

RE: Time to make multi.uribl.org optional rather than default?

2008-02-20 Thread Robert - elists
> This was way too long but I'm waiting on a couple buildworlds and the more > I think about this the more shady it feels to me. > > Good luck regardless, > --- > Andy Dills Andy Think about it like this... in terms of just your immediate family or businesses If you are so overloaded helping ot

RE: bounces

2008-02-20 Thread Robert - elists
> but I don't send "messages to you from the users mailing list seem to > have been bouncing". > What do I have to do to resolve the problem? > > Andrea Andrea If you are using SA on your mail server, make sure that you whitelist all the lists that you are subscribed to... sometimes they will b

RE: Time to make multi.uribl.org optional rather than default?

2008-02-20 Thread Robert - elists
> > I'll defer to the wisdom of the people who invest their time and effort to > provide the services and develop the software that the rest of us have > come to rely on. If you guys don't have a problem with it, then that's > good enough for me. > --- > Andy Dills Andy You are a smart person, j

RE: [OT] Bogus MX opinions

2008-02-20 Thread Robert - elists
> > Quotes from this thread (and the nolisting site which was posted as a > response): > > Michael Scheidell -> "Do NOT use a bogus mx as your lowest priority." > Bowie Bailey -> "I would say that it is too risky to put a non-smtp > host as your primary > MX" > > nolisting.org -> "longterm us

RE: Pbl.spamhaus.org down?

2008-02-23 Thread Robert - elists
> Can't find commercial pricing, but 'corporate' pricing is $168,000 per > year > for unlimited use. (100,000 per year is only $10,000 per year) Michael Corporate up to 100 users is $500 a year http://www.spamhaus.org/datafeed/index.html click on the service price check button then select appr

RE: Email with no "hits" and "required"

2008-02-26 Thread Robert - elists
> > System: Debian with Qmail + QmailScanner + SpamAssassins + ClamAV > Installation: qmailrocks.org > > I've updated SA (original from qmailrocks.org 3.0.2) to 3.2.4 > my locale.cf is : > > rewrite_header Subject *SPAM* > report_safe 0 > required_score 4 > required_hits 5 > use_bayes 1 > > Que

RE: SA gets slow.

2008-02-28 Thread Robert - elists
> > Dear List > > I am running qmail + SA + Clamav on FC 5, my problem is when ever > concurrent smtp connections cross 30+ SA gets slow and take too much > time to process mails through qmailscaner > > qmail-queue.log > === > Fri,

some custom ruleset rule info please

2008-02-29 Thread Robert - elists
In regards to backhair.cf backhair is a set of rules designed to catch those ugly, unsightly HTML tags. Created by: Jennifer Wheeler are unsightly HTML tags just referring to basic HTML coding or something else we should better understand as spam fighting warriors Thank you - rh

RE: Sorry for the duplicate messages

2008-02-29 Thread Robert - elists
> > The last two messages I sent were duplicated on this list. I'm not sure > why and I hope this one isn't duplicated. I'm using Exim and I'm only > seeing one entry in my log. If anyone knows what might be causing this > I'd be more than happy to fix the problem. Until then, I apologize for > t

RE: some custom ruleset rule info please

2008-02-29 Thread Robert - elists
> > If I understand your question correctly... The latter. Obfuscation. > > You did have a look at the rules file and the rules description, right? > It's about injected HTML tags "inside" words or to hide part of the > gibberish as a means of preventing plain word matching, IIRC. It's been > a w

RE: some custom ruleset rule info please

2008-02-29 Thread Robert - elists
> > Not with any 3.x version. > > guenther > :-) Oops, my fault... I missed that part even though I was looking for it What about this Chinese ruleset, anyone in the USA using it to help with occasional or massive incoming foreign spam? I would guess it puts quite a load on the system eh?

RE: ok_locales (was: Re: some custom ruleset rule info please)

2008-02-29 Thread Robert - elists
> > On Fri, 2008-02-29 at 14:42 -0800, Robert - elists wrote: > > What about this Chinese ruleset, anyone in the USA using it to help with > > occasional or massive incoming foreign spam? > > Is there any particular need for additional rules, or are you just > fish

RE: meta rules doesn't work on some special version.

2008-03-05 Thread Robert - elists
> > Thanks very much for your kindly help. I have done some testing this > morning. > > And found that, all the SA 3.2.x versions are unworkable. > > Here are some output: > > #spamassassin -V > > SpamAssassin version 3.2.4 > running on Perl version 5.8.5 > > The OS is CentOS 4.4 with perl

RE: Whitelisting IP's

2008-03-07 Thread Robert - elists
> > I have a file that contains a list of all the IP's that have > successfully POP3'ed there email within last 15 minutes. Its used for > POPB4SMTP. Naturally the IP's in the file are constantly changing. > > /etc/virtual/pophosts > > Is there anyway to setup Spamassassin to whitelist all IP

RE: [spamassassin] Re: [spamassassin] Re: How to report 120,000 spams a day

2008-03-09 Thread Robert - elists
> Hi, > > Thanks for the reply. In as much as I'd like to help the community, > I'm under a set of constraints. Starting a whole other server to start > doing > this isn't something that fits under those constraints. It looks like > I'll probably just end up having to /dev/null them as I hav

RE: [spamassassin] Re: How to report 120,000 spams a day

2008-03-10 Thread Robert - elists
Seriously... How hard is it to setup the MX boxen to only allow 4 email addresses to pass for that particular domain, rejecting all others in the SMTP conversation? Unless the customer is dropping BIG DADDY $$$ with you, tell him policy change and that he isn't losing any email if you do not do a

RE: using submission port

2008-03-20 Thread Robert - elists
Well, you could always change QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue" ; export QMAILQUEUE To this QMAILQUEUE="/var/qmail/bin/qmail-queue" ; export QMAILQUEUE And bypass the scanner logic on valid auth Couldn't you? ;-> Otherwise, it would appear you need to better understand qmail an

RE: Howto stop SPF_FAIL from internal network?

2008-03-25 Thread Robert - elists
> > ok; fixed it by removing the 192.168.0.0/16 from > 'internal_networks'. But problem still persists that senders > from the private 192.168.0.0/16 network are tagged with > SPF_FAIL. > > Enrico Having watched the thread and not fully recalling every post... I have not checked this,

RE: Howto stop SPF_FAIL from internal network?

2008-03-25 Thread Robert - elists
> > aha, so you should check now, why do those fail. Is that your domain SPF > checks fail for? If so, your users should probably use SMTP authentication > when sending e-mail. > -- > Matus UHLAR Matus You are bright, and as you know, that will not fix SPF issue if they are still SA scanning

RE: :DNS .060 allows remote attackers to cause DOS

2008-03-27 Thread Robert - elists
From: http://search.cpan.org/src/OLAF/Net-DNS-0.63/Changes Fix rt.cpan.org #30316 Security issue with Net::DNS Resolver. Net/DNS/RR/A.pm in Net::DNS 0.60 build 654 allows remote attackers to cause a denial of service (program "croak") via a crafted DNS response (http://nvd.nist.gov/n

dns tests and scoring info for modification

2008-04-04 Thread Robert - elists
My searching came up a tad short on this... I am guessing there is a howto already on this, I just didn't find it, so I went digging in the internals some more. Are all tests for DNS type RBL's in this default 20_dnsbl_tests.cf SA file? Do I need to grep all the other files to check for where th

RE: dns tests and scoring info for modification

2008-04-04 Thread Robert - elists
> > don't modify "standard" rule files. > > instead, create a /path/to/site/rules/scores.cf (same directory where > you have local.cf) and override the scores there (use a 0 score to > disable a test). look at 50_scores.cf to get an idea. > > I hope you have valid reasons to disable network te

RE: dns tests and scoring info for modification

2008-04-04 Thread Robert - elists
> > You probably know this, but make sure you put the zeroed-out scores in > your local config dir (i.e. /etc/mail/spamassassin or the like) so that > they won't be overwritten the next time you upgrade and/or run sa-update. > > -- > Kelson Vibber > SpeedGate Communications Kelson Thanks, I h

ccache and sought.cf SA rules compilation

2008-04-10 Thread Robert - elists
I am not a ccache expert... I came across it in the last few months and just today had some time to install it on a centos 4.6 box and play for a second or two. If anyone on the list is familiar with using it? If so, then the questions would be, is it appropriate to use it, or something similar,

RE: Looking for hosts to white list

2008-04-23 Thread Robert - elists
Snip > If anyone has tested HostKarma already... and found it promising, but a > little lacking... I suggest testing it again. It is even better now. > > In fact, most DNSBLs do not suddenly come on the scene "perfect". Most > have had MUCH growing pains. Therefore, all newer DNBSLs shoul

RE: Looking for hosts to white list

2008-04-23 Thread Robert - elists
Yes Marc Please start a JMF general support maillist for those that want to be part of it. Make sure it cannot become a spam forum in itself and is truly opt in with verify I highly suggest that you post to it frequently, before any major or minor changes to JMF hardware or software

fractional scores and syntax

2008-05-09 Thread Robert - elists
I am not sure how to ask this We have a test URIBL # # # ### # urirhssub URIBL_TEST uri.test.local.A 2 body URIBL_TEST eval:check_uridnsbl('URIBL_TEST') describe URIBL_TEST Contains an URL listed in the TEST blackl

RE: fractional scores and syntax

2008-05-09 Thread Robert - elists
> > If you are referring to this: > > [42778] warn: config: SpamAssassin failed to parse line, "test_rule .1" is > not valid for "score", skipping: score test_rule .1 > [42778] warn: lint: 1 issues detected, please rerun with debug enabled for > more information > > You have to prefix all decima

RE: dsbl.org dying?

2008-05-21 Thread Robert - elists
> From: mouss > > http://www.dnsbl.com/ > I have never paid attention to it so... questions.. Was dsbl.org widely used? In general, is it considered a major and necessary dnsbl tool for the war against spam? Does anyone have any idea how much sustained bandwidth in and out that it took to r

RE: Testing DNSRBLs using SA

2008-05-23 Thread Robert - elists
> > I am trying to use SA to test a DNSBL and I am not having any luck > getting the rule to hit. I've looked through 20_dnsbl_tests.cf, and read > the appropriate section in the docs. > > http://spamassassin.apache.org/full/3.2.x/doc/Mail_SpamAssassin_Conf.html# > rule_definitions_and_privileged

RE: Developing SpamAssassin

2008-06-02 Thread Robert - elists
> > It's great how far SA is already, I give props to all the developers that > spend their free time on it. But just imagine what it could be, if for > example Justin would be paid to work on it 8 hours a day? :) Henrik, Decent money isn't really that hard to come by overall... The legal lan

google netblocks records etc

2008-06-02 Thread Robert - elists
Since they seem to have zillions of outbound mx machines I did this in response to some email latency issues. dig google.com txt google.com. 31 IN TXT "v=spf1 include:_netblocks.google.com ~all" then i dig _netblocks.google.com txt _netblocks.google.com. 47 IN

RE: google netblocks records etc

2008-06-02 Thread Robert - elists
Ok Yellow then. What I am talking about is not greylisting google based upon those addresses and sending right to SA for scoring - rh

RE: google netblocks records etc

2008-06-03 Thread Robert - elists
> > I think he meant whitelisting when the rDNS is verified (FcrDNS) by a > "double lookup". That's what a postfix check_client_access will do. > > [snip] Mouss I think I wanted to whitelist inside my greylist the google IP netblocks space. They have a zillion outbound MX servers and some cli

sought rules compile faster in 3.2.5

2008-06-16 Thread Robert - elists
I noticed that the sought rules compile faster in 3.2.5 Typically 5 to 7 minutes faster which translates to roughly 1/3 Does anyone else notice this? Is there a specific reason why? :-) - rh

RE: SARE fraud rulesets rotted?

2008-06-16 Thread Robert - elists
> > Yeah, it's easy enough doing that conversion -- let us know if he's > happy for that to happen. It'd be a good way to "port" those sigs > to SpamAssassin > > --j. JM, Would that be announced on the list somehow? Many of us use the CLAMAV SA plugin with those sigs already, and I think

bayes db size and processing cycles

2008-06-16 Thread Robert - elists
Does a larger Bayes DB add significant processing overhead to SA cpu needs? Or are people mainly talking about it today only because of size reduction needs? - rh

sare rule updates ?

2008-06-16 Thread Robert - elists
Seeing that Jari posted a large channels.txt file with lots of sare rule updates... I am wondering... When was the last time any of the sare rules were updated? I actually do not recall any of the ones we use being updated in many months, and it appears he checks hourly... Anyone? - rh

RE: sare rule updates ?

2008-06-17 Thread Robert - elists
> > - rh > > lol.. Maybe I should put them in a separate sare_channels.txt and run it > yearly? > Heheh Ummm, it isn't a knock on the sare rules. We appreciate them a lot. I am truly wondering if maybe we just are updating from the wrong place by going directly to the rulesemporium website ma

RE: sare rule updates ?

2008-06-17 Thread Robert - elists
> > They are not being updated and they won't in the close future. > Any update would be announced *loudly* all over the place. > > Running any type of updates (sa-update with SARE channel or > rules_du_jour) is a waste of bandwidth and useless load on donated > server resources. > > SARE recom

RE: SARE fraud rulesets rotted?

2008-06-17 Thread Robert - elists
> > > I have made some early progress on this (I don't want to make it > generally avalaible yet until Steve from Sane gets back off vacation). > The biggest problem I have at the moment is the size of the rule set > that it generates - a subset of the rules (i.e. the ones that I have > managed t

RE: script to upgrade SpamAssassin (itself, not just rule sets)

2008-06-19 Thread Robert - elists
Typically we do something like this basic outline login to non-root account and change to proper directory wget http://www.apache.org/dist/spamassassin/source/Mail-SpamAssassin-3.2.5.tar.g z rpmbuild -tb Mail-SpamAssassin-3.2.5.tar.gz su to root and change to proper directory yum localinstall

FM_BIG_REASON scoring

2008-06-21 Thread Robert - elists
Does anyone think that 10 FM_BIG_REASON Lot's of CAP words, BIG, REASON, BEST Is scored high or? - rh

RE: FM_BIG_REASON scoring

2008-06-21 Thread Robert - elists
> > Seems high to me, but needs to be put in the context of your threshold. > > -- > Sahil Tandon <[EMAIL PROTECTED]> Threshold? Huh? You are joking right? The default SA scoring spam tagging threshold is half that... :-) - rh

RE: Fake MX Record(s) Trick

2008-06-25 Thread Robert - elists
> > mouss is french, you must know ;-) > French mouse? ;-) http://disney.go.com/disneyvideos/animatedfilms/ratatouille/ No offense intended of course... it really was a cute movie... Time for vacations! - rh

perl error on TVD_STOCK1 after 3.2.5 update

2008-06-25 Thread Robert - elists
Is anyone else currently seeing this since 3.2.5 upgrade? We updated when it came out and have only seen the error a few times since... Centos 4.6 and perl 5.8.8 and SA 3.2.5 with sought rules and compiled Jun 25 09:22:57 mxi spamd[18530]: rules: failed to run TVD_STOCK1 test, skipping: Jun 25

RE: perl error on TVD_STOCK1 after 3.2.5 update

2008-06-25 Thread Robert - elists
Please forgive me for top post and replying to my own, yet I forgot to add the code from line 243 in the BodyEval.pm file foreach ( $rnd =~ /^\s*([^:\s][^:\n]{2,29})\s*:\s*\S/mg ) { :-) - rh > > Is anyone else currently seeing this since 3.2.5 upgrade? > > We updated when it came out and h

RE: i'm unable to catch these

2008-07-02 Thread Robert - elists
> > you seem not to reject viruses at SMTP level ;) otherwise clamav couldn't > score them :) > One can score an email and still reject during the SMTP session if the systems are setup to do so. - rh

RE: i'm unable to catch these

2008-07-02 Thread Robert - elists
> > one does need to score viruses in SA if (s)he can reject them directly > -- Yes, we do that. See the SA clamav plugin - rh

RE: i'm unable to catch these

2008-07-03 Thread Robert - elists
> > no, you do not do that. See the clamav-milter or other apropriate program. > SA is very CPU intensive so it's better to scan with clamav directly, > instead of using SA clamav plugin Matus... You are smart person. Maybe you could tell the clamav plugin people... ;-) Actually, yes, we do

RE: Detecting the Registrar of the sending host?

2008-07-03 Thread Robert - elists
The registrars I'm talking about are extremely expensive and very exclusive. Spammers couldn't afford it. Hmm, check out markmonitor.com The really interesting point is this. Since so much spam is about getting brand recognition in the peoples faces and not necessarily gettin

RE: bad rules that likely to result in more false positives

2008-07-04 Thread Robert - elists
> > I'm sorry, but what MUA recognizes those? Why don' t you set Reply- > To: which will be honored by all MUAs? > snip > > > He is acted as is common and expected. Others who, like you, don't > want private copies set Reply-To. > > -- > Jo Rhett > Net Consonance : consonant endings by net

RE: collecting mail for sa-learn, how to?

2008-07-15 Thread Robert - elists
> > > Heh, in my case I really don't like having to re-train anything. I like > to be sure when I train that if I tell sa-learn that a mail is spam, it > is 100% spam. That's why I weekly collect spammy mail from a bunch of > trusted users and re filter it myself before passing it to sa-learn. >

change from compiled SA mode back to regular SA mode

2008-07-21 Thread Robert - elists
I didn't see anything on the www, so after a lil investigation, it appears that on a centos 4.6 box with SA 3.2.5, that the default compiled SA ruleset is in /var/lib/spamassassin/compiled And below... Question(s) So, to go back to standard SA processing config, basically I just need to admin

RE: change from compiled SA mode back to regular SA mode

2008-07-21 Thread Robert - elists
> > Robert - elists wrote: > > > > I didn't see anything on the www, so after a lil investigation, it > appears > > that on a centos 4.6 box with SA 3.2.5, that the default compiled SA > ruleset > > is in > > > > /var/lib/spamassassin/compile

RE: Memory Leak?

2008-07-25 Thread Robert - elists
Ron You are kinda shooting in the dark on the memory leak thread stuff. You need to get a lil deeper in the system(s) to know. I don't know what programming tools you are familiar with yet you could do some tracing and know exactly what is going on and when it is happening and then you can immed

  1   2   >