Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
On Thursday, July 04, 2024 02:01 AEST, Benny Pedersen wrote: > Simon Wilson via users skrev den 2024-07-03 15:54: > > > header AUTHRES_DKIM_PASS eval:check_authres_result('dkim', 'pass') > > header USER_IN_DKIM_WHITELIST eval:check_for_dkim_whitelist_from() > > kee

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
On Thursday, July 04, 2024 01:11 AEST, Bill Cole wrote: > On 2024-07-03 at 10:19:28 UTC-0400 (Thu, 04 Jul 2024 00:19:28 +1000) > Simon Wilson via users > is rumored to have said: > > > On 03.07.24 23:54, Simon Wilson via users wrote: > >> Simon Wilson via users

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
Simon Wilson via users skrev den 2024-07-03 14:56: > Do I also need to disable the normal SA DKIM plugin evaluation, i.e. > trusting my upstream authres_trusted_authserv only? both works in paralel, so no need to disable, best results came from  both enabled its up to you to ad

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
On 03.07.24 23:54, Simon Wilson via users wrote: >Simon Wilson via users skrev den 2024-07-03 14:56: >> Do I also need to disable the normal SA DKIM plugin evaluation, i.e. >> trusting my upstream authres_trusted_authserv only? > >both works in paralel, so no need to disab

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
Simon Wilson via users skrev den 2024-07-03 14:56: > Do I also need to disable the normal SA DKIM plugin evaluation, i.e. > trusting my upstream authres_trusted_authserv only? both works in paralel, so no need to disable, best results came from  both enabled its up to you to ad

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
  Simon Wilson via users skrev den 2024-07-03 14:13: > I don't think SA 3.4.6 on RH8 has AuthRes plugin: take it from spamassassin trunc, this plugin works on 3.4.6 aswell, but  was not released or tested on it, i have verify it does work #!/bin/sh svn checkout http://svn.apache.org/repos/

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
On Wednesday, July 03, 2024 22:06 AEST, "Simon Wilson via users" wrote:   Dave Funk skrev den 2024-07-03 09:29: > On Wed, 3 Jul 2024, Simon Wilson via users wrote: > You say "passing SPF and DKIM" however in the SA rules report it  > clearly says: > D

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
Dave Funk skrev den 2024-07-03 09:29: > On Wed, 3 Jul 2024, Simon Wilson via users wrote: > You say "passing SPF and DKIM" however in the SA rules report it  > clearly says: > DKIM_SIGNED=0.1, DKIM_INVALID=0.1 >  > So eventho you think 'passed DKIM' SA cl

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
On Wed, 3 Jul 2024, Simon Wilson via users wrote: > Does whitelist_auth work on From header, or Return-Path? Reason I ask: > >  >  > I have two emails from “support .at. wasabi.com”. Due to their emails usually > triggering KAM rules I have (in > /etc/mail/

whitelist_auth return_path / from

2024-07-02 Thread Simon Wilson via users
: Subject: [SPAM] Wasabi Technologies LLC Invoice Reply-To: supp...@wasabi.com Do I need to add the return-path, i.e.:   ## Whitelist Wasabi, subject to passing of auth whitelist_auth supp...@wasabi.com whitelist_auth *@mmemail.wasabi.com ?   Thanks. Simon.

Re: DMARC Aggregate reports - false positives

2023-06-22 Thread Simon Wilson via users
On Thursday, June 22, 2023 23:05 AEST, Bill Cole wrote:  On 2023-06-22 at 06:29:53 UTC-0400 (Thu, 22 Jun 2023 20:29:53 +1000) Simon Wilson via users is rumored to have said: > I find most DMARC reports I receive are flagged as spam by SA.  > > How do people work around this? I'v

Re: DMARC Aggregate reports - false positives

2023-06-22 Thread Simon Wilson via users
On Thursday, June 22, 2023 20:37 AEST, Damian wrote:   I find most DMARC reports I receive are flagged as spam by SA.> Which submitters? I looked at a bunch of my reports and they are all MIME_GOOD. That one was from microsoft. --  Simon Wilson M: 0400 121 116

DMARC Aggregate reports - false positives

2023-06-22 Thread Simon Wilson via users
=0.79, PYZOR_CHECK=1.392, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, T_TVD_MIME_NO_HEADERS=0.01] --  Simon Wilson M: 0400 121 116

Re: SHOPIFY_IMG_NOT_RCVD_SFY but from Shopify

2021-11-15 Thread Simon Wilson
is triggering a lot on emails which are not Spam, reducing score from 2.497 score SHOPIFY_IMG_NOT_RCVD_SFY1.8 Simon -- Simon Wilson M: 0400 12 11 16

Re: CHAOS: v1.2.2: Of Documentation

2021-07-23 Thread Simon Wilson
- Message from Jared Hall - Date: Fri, 23 Jul 2021 00:07:52 -0400 From: Jared Hall Subject: CHAOS: v1.2.2: Of Documentation To: users@spamassassin.apache.org Simon Wilson wrote: could you, please, finally, describe what does this module do, here to the list

Re: CHAOS: v1.2.1 Released

2021-07-22 Thread Simon Wilson
ith the easy parts and follow with those more compliated functionality, because I feel the description starts with thelatter. I'm guessing from the silence in response that this will remain a mystery. Simon. ___ Simon Wilson M: 0400 12 11 16

Re: KAM_SENDGRID and SPF_HELO_NONE

2021-05-20 Thread Simon Wilson
result by applying the check_host() function to the "MAIL FROM" identity as the . A HELO SPF check is most certainly not a "fall-back". Whether the SPF checking tool used follows the RFC is another matter entirely :-) Simon. -- Simon Wilson M: 0400 12 11 16

Re: KAM_DMARC_REJECT on internal emails

2021-04-20 Thread Simon Wilson
ON INBOUND -- Simon Wilson M: 0400 12 11 16

Re: KAM_DMARC_REJECT on internal emails

2021-04-20 Thread Simon Wilson
> On Mon, Apr 19, 2021 at 10:05:21PM +1000, Simon Wilson wrote: rather than change the channel distributed KAM.cf, what needs to go in local.cf to tell that not to run? *CAN* it be disabled from local.cf, or can it only be done by commenting out the entry in KAM.cf? It would not make any se

Re: KAM_DMARC_REJECT on internal emails

2021-04-20 Thread Simon Wilson
relevant milters have run and added trusted headers on inbound email. Simon. -- Simon Wilson M: 0400 12 11 16

Re: Senderscore

2021-04-20 Thread Simon Wilson
And btw, usually on the DNS infos of Senderscores, you can see about 3 days of lag compared to their online interface, dunno if expected on their side, or they're facing perf issues, but that service is not a top priority at all at least On Mon, Apr 19, 2021 at 7:29 PM Simon Bressier wrote

Re: KAM_DMARC_REJECT on internal emails

2021-04-20 Thread Simon Wilson
- Message from Henrik K - Date: Mon, 19 Apr 2021 17:11:41 +0300 From: Henrik K Reply-To: users@spamassassin.apache.org Subject: Re: KAM_DMARC_REJECT on internal emails To: users@spamassassin.apache.org On Mon, Apr 19, 2021 at 10:05:21PM +1000, Simon Wilson wrote

Re: Senderscore

2021-04-19 Thread Simon Bressier
And btw, usually on the DNS infos of Senderscores, you can see about 3 days of lag compared to their online interface, dunno if expected on their side, or they're facing perf issues, but that service is not a top priority at all at least On Mon, Apr 19, 2021 at 7:29 PM Simon Bressier wrote

Re: Senderscore

2021-04-19 Thread Simon Bressier
Hi Simon, For info for few days now, the Senderscore DNS server is failing to answer. I've pinged one relation I have at Validity so they can dig on it. Senderscore via DNS is a legacy service they just maintain but dunno for how long... They are more on a mood to stop that service in the future

Re: KAM_DMARC_REJECT on internal emails

2021-04-19 Thread Simon Wilson
assin ?, it have to know all wan ips for your own server / servers Yes, my trusted_networks, internal_networks and msa_networks are all set correctly... I had a long discussion with this mailing list on the subject last year and got excellent help on resolving that! :) - End message from

Re: KAM_DMARC_REJECT on internal emails

2021-04-19 Thread Simon Wilson
- Message from RW - Date: Mon, 19 Apr 2021 12:47:02 +0100 From: RW Subject: Re: KAM_DMARC_REJECT on internal emails To: users@spamassassin.apache.org On Mon, 19 Apr 2021 16:36:58 +1000 Simon Wilson wrote: Hi list, - I'm running KAM rules in Spamassassin - Postfix

Re: KAM_DMARC_REJECT on internal emails

2021-04-19 Thread Simon Wilson
I'd say that a proper solution would be to DKIM-sign mail before it's spam-scanned. On 19.04.21 19:39, Simon Wilson wrote: Good point. If DKIM is signed it should pass DMARC, even if SPF fails. Amavisd handles both pieces, including DKIM signing... from looking at the headers it looks like

Re: KAM_DMARC_REJECT on internal emails

2021-04-19 Thread Simon Wilson
On 19.04.21 16:36, Simon Wilson wrote: - I'm running KAM rules in Spamassassin - Postfix port 587-submitted email is sent to Amavisd (as a content_filter) on port 10026 (tagged as ORIGINATING/MYNETS) and is spam-checked and DKIM-signed on its way out the door, sent back to Postfix at port

KAM_DMARC_REJECT on internal emails

2021-04-19 Thread Simon Wilson
arn advises tokens learned, but it still seems to struggle with these. Other than that my Bayes is excellent, very effective and accurate. Any advice would be appreciated. Simon. -- Simon Wilson M: 0400 12 11 16

Senderscore

2021-04-18 Thread Simon Wilson
inbound email. From what I can see it's a genuine blocklist lookup by SA... (RCVD_IN_RP_RNBL in 20_dnsbl_tests.cf) but the error rate is strange. Am I the only one with high volume of lookup errors from that bl? :-) or do I need to be looking for an issue locally... Simon. -- Simon Wilson M

Re: Update SA on CentOS

2021-04-04 Thread Simon Wilson
- Message from Bill Cole -    Date: Sun, 04 Apr 2021 15:16:32 -0400    From: Bill Cole Subject: Re: Update SA on CentOS      To: users@spamassassin.apache.org On 4 Apr 2021, at 0:19, Simon Wilson wrote: CentOS / RHEL backport critical security fixes into the stock versions

Re: Update SA on CentOS

2021-04-03 Thread Simon Wilson
- Message from Amir Caspi - Date: Sat, 3 Apr 2021 22:06:03 -0600 From: Amir Caspi Subject: Re: Update SA on CentOS To: si...@simonandkate.net Cc: users@spamassassin.apache.org On Apr 3, 2021, at 9:15 PM, Simon Wilson wrote: And then you are not stepping away

Re: Update SA on CentOS

2021-04-03 Thread Simon Wilson
(and teaching it when it fails to get it right) resulted in excellent spam prevention on CentOS 7 with its standard packaged SA. And then you are not stepping away from one of CentOS's main advantages - stable packages not built outside of RPM. Simon -- Simon Wilson M: 0400 12 11 16

Re: SA DKIM check

2021-04-02 Thread Simon Wilson
properly configured SpamAssassin, please open a bug report. Yep, been through all of that with making sure SA knows what is internal and external, and what it can trust and not. No issues there. Simon -- Simon Wilson M: 0400 12 11 16

SA DKIM check

2021-04-01 Thread Simon Wilson
Does SA always do its "own" DKIM check, or can it be told to use an already written trusted AuthservId-written Authentication-Results header, e.g. from OpenDKIM? Thanks -- Simon Wilson M: 0400 12 11 16

Spamassassin reading inbound filter results; WAS: Re: Optimising DNS-based checks

2021-03-30 Thread Simon Wilson
best practice for using DMARC results in Spamassassin? Simon -- Simon Wilson M: 0400 12 11 16

Re: Optimising DNS-based checks

2021-03-30 Thread Simon Wilson
ved-SPF filter using python-policyd-spf (called as last check in smtpd_recipient_restrictions), so yes it would make sense for spamassassin to trust the check already made - I'll see if I can work out how to do that. Simon. -- Simon Wilson M: 0400 12 11 16

Optimising DNS-based checks

2021-03-29 Thread Simon Wilson
and consistent average < 0.4s Simon SA Timing Percentiles % TimeTotal (ms)0% 5% 25% 50% 75% 95%

Re: AWL on 3.4

2021-03-21 Thread Simon Wilson
tended (TM). I've not set txrep_autolearn on yet, will monitor for a while. Simon On Sun, Mar 21, 2021 at 3:04 AM Simon Wilson wrote: - Message from John Hardin - Date: Sat, 20 Mar 2021 08:08:17 -0700 (PDT) From: John Hardin Subject: Re: AWL on 3.4

Re: AWL on 3.4

2021-03-21 Thread Simon Wilson
- Message from John Hardin - Date: Sat, 20 Mar 2021 08:08:17 -0700 (PDT) From: John Hardin Subject: Re: AWL on 3.4 To: users@spamassassin.apache.org On Sun, 21 Mar 2021, Simon Wilson wrote: I've just migrated and updated to SA 3.4, and have moved the Bayes db

AWL on 3.4

2021-03-20 Thread Simon Wilson
interested in comments on its usefulness? Simon -- Simon Wilson M: 0400 12 11 16

Re: sa-update error 3 no mirrors.sought.rules.yerp.org

2021-03-13 Thread Simon Wilson
You've not stated your OS but on a RHEL/CentOS 7 box the correct way to remove is to go to /etc/mail/spamassassin/channel.d and delete sought.conf. -- Simon Wilson M: 0400 12 11 16

Re: Mailspike rules all return 0.0

2020-07-29 Thread Simon Harwood
sassin/local.cf <http://local.cf>*, just add > something like this: > > score RCVD_IN_MSPIKE_BL 0 4 0 4 > score RCVD_IN_MSPIKE_L5 0 4 0 4 > > This would add 4 points to the scoring when these rules matched. > > On Wed, Jul 29, 2020 at 3:28 PM Simon Harwoo

Mailspike rules all return 0.0

2020-07-29 Thread Simon Harwood
, Simon

Re: Trusted network mail spam detection

2019-10-17 Thread Simon Wilson
e working OK, but I'll keep an eye on it. trusted_networks 192.168.1. 119.18.34.29 internal_networks 192.168.1. 119.18.34.29 msa_networks 192.168.1.230 score ALL_TRUSTED -1.4 Thanks again. -- Simon Wilson M: 0400 12 11 16

Re: Trusted network mail spam detection

2019-10-16 Thread Simon Wilson
Quoting Bill Cole : On 16 Oct 2019, at 7:55, Simon Wilson wrote: Quoting Tom Hendrikx : [...] RDNS_DYNAMIC tries to exclude authenticated email. Are you accepting email from senders without authentication? Or maybe your trusted_networks/internal_networks are misconfigured, so

Re: Trusted network mail spam detection

2019-10-16 Thread Simon Wilson
Quoting Simon Wilson : Quoting Tom Hendrikx : On 16-10-19 12:19, Simon Wilson wrote: Hi, I have a Horde system submitting to a postfix/amavisd-new/spamassassin server for spam detection (different servers, same subnet). I *do* consciously run SA over internally submitted emails to catch

Re: Trusted network mail spam detection

2019-10-16 Thread Simon Wilson
Quoting Tom Hendrikx : On 16-10-19 12:19, Simon Wilson wrote: Hi, I have a Horde system submitting to a postfix/amavisd-new/spamassassin server for spam detection (different servers, same subnet). I *do* consciously run SA over internally submitted emails to catch compromised accounts

Trusted network mail spam detection

2019-10-16 Thread Simon Wilson
g more scientific?? Simon. -- Simon Wilson M: 0400 12 11 16

Re: tests_pri on new server

2017-04-30 Thread Simon Wilson
longer to complete them. Complete timing results are below. Is this just how long it takes now, or is there any tweaking I can be doing? Simon ** Full DNS timings Old server May 1 14:40:37.266 [14560] dbg: async: timing: 0.010 . dns:A:us-west-2.amazonses.com May 1 14:40:37.266 [14560

Re: tests_pri on new server

2017-04-30 Thread Simon Wilson
takes about 4000ms. On each server it is tests_pri_0 that takes the majority of the time, which I understand from reading is to be expected. Is the extended duration to be expected with newer SA, or do I need to be digging deeper to try and find out why it's so much slower? Simon -- Simon

tests_pri on new server

2017-04-28 Thread Simon Wilson
, the identical email takes about 4000ms. On each server it is tests_pri_0 that takes the majority of the time, which I understand from reading is to be expected. Is the extended duration to be expected with newer SA, or do I need to be digging deeper to try and find out why it's so much slower? Simon

Re: USPS Spam

2013-08-30 Thread Simon Loewenthal
Plenty this week. I've just been sending to spamcop, but not a lot else. Matt matt.mailingli...@gmail.com wrote: I am seeing tons of junk getting through claiming to be from the USPS about a missed delivery package. Anyone else seeing this? I am running SpamAssassin 3.3.1 and execute sa-update

SA Bugzilla – Bug 6558

2013-08-13 Thread Simon Loewenthal
Hi, Did this make it into 3.3.2? ( e.g mended ) https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6558 Cheers, S

Re: SA Bugzilla – Bug 6558

2013-08-13 Thread Simon Loewenthal
Great. Thanks Anthony. -- as silly as fun simon@klunky / .co.uk / .net pgp 4BA78604 Antony Stone antony.st...@spamassassin.open.source.it wrote: On Tuesday 13 August 2013 at 17:17, Simon Loewenthal wrote: Hi, Did this make it into 3.3.2? ( e.g mended ) https://issues.apache.org

Test email hitting BAYES_00

2013-07-24 Thread Simon Loewenthal
http://pastebin.com/5N0xhWms [1] Thanks, Simon. _*_ _# sa-learn --forget --username=spammyd aaa_ _Forgot tokens from 0 message(s) (1 message(s) examined)_ Links: -- [1] http://pastebin.com/5N0xhWms

Re: Test email hitting BAYES_00

2013-07-24 Thread Simon Loewenthal
On 2013-07-24 14:41, RW wrote: On Wed, 24 Jul 2013 14:04:36 +0200 JK4 wrote: On 2013-07-24 13:31, RW wrote: This isn't a GTUBE email, it's an email with lots of innocuous text and the obfuscated name of a drug claiming to be a GTUBE email. http://spamassassin.apache.org/gtube/ [1]

Re: Test email hitting BAYES_00

2013-07-24 Thread Simon Loewenthal
On 2013-07-24 15:59, RW wrote: On Wed, 24 Jul 2013 15:15:01 +0200 Simon Loewenthal wrote: I rewrote this (not GTUBE anymore) and had the same bayes score http://pastebin.com/ATqch32Y [1] [3] It's not particularly surprising it hits BAYES_00, aside from the obfuscated words it's

Re: IP Blacklisting

2013-07-12 Thread Simon Loewenthal
of weeks. I kept myself amused all that time jumping in and out of a gin and tonic. simon@klunky .co.uk / .org

Just interested: MIME validation ruleset and ASCII-0

2013-05-30 Thread Simon Loewenthal
! Simon

Re: CLAMAV skipped on same email when sent from spamd, yet not skipped when sent from spamc.

2013-05-29 Thread Simon Loewenthal
On 2013-05-29 9:21, Matus UHLAR - fantomas wrote: On 28.05.13 17:30, Simon Loewenthal wrote: I looked at scoring for an email on an SA installation and noticed differences between hand scanning with spamc and scanning with spamd. My manually scanned email hit CLAMAV sane security

Re: CLAMAV skipped on same email when sent from spamd, yet not skipped when sent from spamc.

2013-05-29 Thread Simon Loewenthal
On 2013-05-29 11:40, Mark Martinec wrote: Simon, I looked at scoring for an email on an SA installation and noticed differences between hand scanning with spamc and scanning with spamd. My manually scanned email hit CLAMAV sane security, (ignore Bayes because the user had Bayes

Re: CLAMAV skipped on same email when sent from spamd, yet not skipped when sent from spamc.

2013-05-29 Thread Simon Loewenthal
On 2013-05-29 12:43, Matus UHLAR - fantomas wrote: On 29.05.13 12:29, Simon Loewenthal wrote: The socket seems ok to me: srw-rw-rw- 1 clamav clamav 0 May 14 21:43 /var/run/clamav/clamd.ctl what are permissions for /var/run/clamav ? drwxr-xr-x Since the enabling of debug, I am

CLAMAV skipped on same email when sent from spamd, yet not skipped when sent from spamc.

2013-05-28 Thread Simon Loewenthal
Hallo there, I looked at scoring for an email on an SA installation and noticed differences between hand scanning with spamc and scanning with spamd. My manually scanned email hit CLAMAV sane security, (ignore Bayes because the user had Bayes process this and then asked me about this),

Bayes sa-learn training question - How to exclude certain URLs found in emails

2013-05-16 Thread Simon Loewenthal
Hi all, I turned shortcircuit for BAYES_00 on a server, and noticed that LinkedIn invitation emails hit BAYES_00. A bit strange I thought being unlikely someone had run sa-learn on LinkedIn emails. I grepped on all the Ham and Spam directories and hit lots of linkedin,com in URLs in the

Re: Bayes sa-learn training question - How to exclude certain URLs found in emails

2013-05-16 Thread Simon Loewenthal
On 2013-05-16 16:17, RW wrote: On Thu, 16 May 2013 15:17:14 +0200 Simon Loewenthal wrote: Hi all, I turned shortcircuit for BAYES_00 on a server, and noticed that LinkedIn invitation emails hit BAYES_00. When you say email, I presume you mean spam. Yep A bit strange I thought being

Re: Bayes sa-learn training question - How to exclude certain URLs found in emails

2013-05-16 Thread Simon Loewenthal
Thank-you everyone. I shall have Bayes forget emails, then retrain with a rule that counts linkedin invitations as spam. I have one I wrote earlier and implemented after Bayes had gone off track. Cheers, S. -- as silly as fun simon@klunky / .co.uk / .org / .net pgp 4BA78604 Benny

Re: Norwegian language spam

2013-05-02 Thread Simon Loewenthal
that I was a lemon for a couple of weeks. I kept myself amused all that time jumping in and out of a gin and tonic. simon@klunky .co.uk / .org On 2013-05-02 12:45, Martin Gregorie wrote: The last two days I've started to get a small amount of spam with these characteristics: - its of the you've

Re: Upgrade from SA 3.3.1 to 3.3.2 - increase in memory requirements on Debian 6

2013-03-06 Thread Simon Loewenthal
, which is a relief, but this happened after I did a update on the server from squeeze/updates, squeeze, and security. Before time I just had security configured. Cheers, S On 2013-03-06 14:57, Kevin A. McGrail wrote: On 3/5/2013 7:36 AM, Simon Loewenthal wrote: I just upgraded a small

Re: Upgrade from SA 3.3.1 to 3.3.2 - increase in memory requirements on Debian 6

2013-03-06 Thread Simon Loewenthal
shall drop some rule sets. An sa-compile is run every time the automatically downloaded rulesets change, but this won't necessarily cut here when so tight on ram. On 2013-03-06 15:36, Kevin A. McGrail wrote: On 3/6/2013 9:17 AM, Simon Loewenthal wrote: Options are : /usr/sbin/spamd --create

Re: Upgrade from SA 3.3.1 to 3.3.2 - increase in memory requirements on Debian 6

2013-03-06 Thread Simon Loewenthal
Guess what? After removal of, local_phishing_reply.cf 99_anonwhois.cf malware.blocklist.cf the memory usage dropped to 15% of RAM. Time to add more children into the mix. Cheers, S On 2013-03-06 15:55, Kevin A. McGrail wrote: On 3/6/2013 9:53 AM, Simon Loewenthal wrote: Hi

Re: pyzor 401/unauthorized?

2013-03-06 Thread Simon Loewenthal
or don't simon@klunky / .co.uk / .org pgp 4BA78604 Dan Mahoney, System Admin d...@prime.gushi.org wrote: I was in the process of linting my SA config when I discovered that the pyzor servers are handing back this response to all commands: /usr/local/bin/pyzor --homedir /usr/local/etc/mail

Upgrade from SA 3.3.1 to 3.3.2 - increase in memory requirements on Debian 6

2013-03-05 Thread Simon Loewenthal
performance related dependencies on other packages? Currently, Perl is 5.10.1-17squeeze4. Regards, S -- I decided that I was a lemon for a couple of weeks. I kept myself amused all that time jumping in and out of a gin and tonic. simon@klunky .co.uk / .org

sa-learn splice() offset past end of array at /usr/share/perl5/Mail/SpamAssassin/HTML.pm line 492 and 502.

2013-02-27 Thread Simon Loewenthal
, etc. $new{'style_'.$1} = $2; } } } sa-learn still exits with a zero. Does any one know what may have tripped this up? Is it a bug, or some strange formatting in the email message? Not a big deal for me, but perhaps interesting for someone else. (/shrug) :D Cheers, Simon. -- I decided

Re: sa-learn splice() offset past end of array at /usr/share/perl5/Mail/SpamAssassin/HTML.pm line 492 and 502.

2013-02-27 Thread Simon Loewenthal
Mark Martinec mark.martinec...@ijs.si wrote: Simon Loewenthal wrote: Just notcied sa-learn kick up a fuss with some files fed into it from a user's HAM directory in a dovecot directory. I put a copy of the ham on http://pastebin.com/MLEhYsG7 Could you go to the SpamAssassin

Re: White Text Rule

2013-02-05 Thread Simon Loewenthal
Hi Mark, maybe this works. This I stole it from someone who posted here. # HTML - White text on a white background. What is the point? rawbody HTML_TEXT_WHITE_SHORT /style=.color#FFF;/ describe HTML_TEXT_WHITE_SHORT White html txt on white bg score HTML_TEXT_WHITE_SHORT 0.1 Simon --- I

Question about rule: 2.0 DEAR_SOMETHING BODY: Contains 'Dear (something)'

2012-10-25 Thread Simon Loewenthal
Evening all, A great majority of our ham starts with Dear Sir/ Dear Madam / Dear Bob. Therefore I've always wondered why this this is scored so highly: * 2.0 DEAR_SOMETHING BODY: Contains 'Dear (something)' Does anyone know the rational behind this, or is our user base simply

Re: Question about rule: 2.0 DEAR_SOMETHING BODY: Contains 'Dear (something)'

2012-10-25 Thread Simon Loewenthal
+0200 Simon Loewenthal wrote: Evening all, A great majority of our ham starts with Dear Sir/ Dear Madam / Dear Bob. Therefore I've always wondered why this this is scored so highly: * 2.0 DEAR_SOMETHING BODY: Contains 'Dear (something)' Does anyone know the rational behind

Re: Question about rule: 2.0 DEAR_SOMETHING BODY: Contains 'Dear (something)'

2012-10-25 Thread Simon Loewenthal
dar...@chaosreigns.com wrote: But more importantly, it's because we do not have have the rule hit statistics from your email .. Which has been on my personal backlog for over a year. (It is self-serving should have a higher priority thus) .

Re: Academic interested in interviewing you for research paper.

2012-08-18 Thread Simon Loewenthal
... for their own protection. What do we need protection from? s -- Dogs are tough. I've been interrogating this one for hours and he still won't tell me who's a good boy. simon@klunky / .co.uk / .org jonathonb jonny.ch.b...@gmail.com wrote: Hi All, Some interesting responses already

Re: spamassassin bayesian training on foreign characters

2012-07-24 Thread Simon Loewenthal
Hi I have Bayes correctly scoring BAYES_99 on Dutch and French straight out of the box. No problems. -- Dogs are tough. I've been interrogating this one for hours and he still won't tell me who's a good boy. simon@klunky / .co.uk / .org John Hardin jhar...@impsec.org wrote: On Mon, 23

Re: Where the spams are stored

2012-04-13 Thread Simon Loewenthal
Hi, SA does not store spam. It scans it. It is up to your to decide what to do with it. I send mine to Dovecot for delivery to the users' mailboxes. S -- Dogs are tough. I've been interrogating this one for hours and he still won't tell me who's a good boy. simon@klunky / .co.uk / .org

Mail::SpamAssassin::Plugin::SpamCop

2012-04-11 Thread Simon Loewenthal
Hi, Are these options still valid for Mail::SpamAssassin::Plugin::SpamCop settings in the local.cf http://spamassassin.apache.org/full/3.3.x/doc/Mail_SpamAssassin_Plugin_SpamCop.html (from spamcop.net http://spamcop.net/fom-serve/cache/331.html ). *It is recommended the default settings in

Re: Mail::SpamAssassin::Plugin::SpamCop

2012-04-11 Thread Simon Loewenthal
On 11/04/12 15:30, Simon Loewenthal wrote: Hi, Are these options still valid for Mail::SpamAssassin::Plugin::SpamCop settings in the local.cf http://spamassassin.apache.org/full/3.3.x/doc/Mail_SpamAssassin_Plugin_SpamCop.html (from spamcop.net http://spamcop.net/fom-serve/cache/331.html

Re: Mail::SpamAssassin::Plugin::SpamCop

2012-04-11 Thread Simon Loewenthal
On 04/12/2012 12:58 AM, Benny Pedersen wrote: Den 2012-04-11 15:37, Simon Loewenthal skrev: Partially answered. # spamassassin --lint Apr 11 15:35:06.700 [24545] warn: config: failed to parse line, skipping, in /etc/spamassassin/local.cf: auto_report_threshold 30 Was it replaced

Re: Quick question about enabling a private rules in the local.cf

2012-03-26 Thread Simon Loewenthal
:27, Simon Loewenthal wrote: # spamc -y -R 20120323.spam http://pastebin.com/kVFn71B3 Full email with headers via spamassassin -t . Slightly redacted: http://pastebin.com/HFmWfZa6 On 23/03/12 13:59, Banyan He wrote: 60.Mar 23 10:39:43.265 [28017] dbg: config: read file /etc/spamassassin

Quick question about enabling a private rules in the local.cf

2012-03-23 Thread Simon Loewenthal
|sucabikes\.com\.ar|mpe-export\.com|eceurop\.com|cdromland\.nl|buyshield\.com)/ scoreRBODY_PDOMAINS1 5.0 SA version is 3.3.1-1 running on Debian Squeeze. Something ought to have changed, because I swear these custom rules works last month. Regards, Simon -- PGP is optional

Re: Quick question about enabling a private rules in the local.cf

2012-03-23 Thread Simon Loewenthal
Indeed I certainly can. http://pastebin.com/c2an4irw On 23/03/12 13:44, Banyan He wrote: Maybe you can share with us the debug output for the second thought in this case, Simon. Best regards, Banyan He Blog: http://www.rootong.com Email: ban...@rootong.com On 2012-03-23

Re: Better phish detection

2012-03-12 Thread Simon Loewenthal
David F. Skoll d...@roaringpenguin.com wrote: Hi, I've been following this thread... not sure how many of you are aware of this project: http://code.google.com/p/anti-phishing-email-reply/ We use the phishing address list and it does catch a few things. We don't yet use the phishing URL list,

Re: Better phish detection

2012-03-12 Thread Simon Loewenthal
Paul Russell pruss...@nd.edu wrote: On 3/12/2012 12:58, Simon Loewenthal wrote: At first glance: This is private black list of email assesses maintened by many. Free to use, but it'll turn into a huge file for a server to parse. Eventually we moved from hosts files to DNS :) I

Re: Spamassassin detect my mails as spam

2012-03-09 Thread Simon Loewenthal
On 09/03/12 11:29, FC Mario Patty wrote: I'm sorry for not giving full information before. We set our mail server to use SMTP with TLS (port 587) and the outgoing server (of the mail client on android smart phone) as our server itself (in other words, not relaying through the provider

Re: Some rules I created for suspicious Javascript practices

2012-03-06 Thread Simon Loewenthal
Hi, Were these rules, or an improved variant, added to the rules? Regards, Simon. On 16/02/12 01:43, neon_overload wrote: Hello, I have created some rules which I have found to be very effective so far at identifying a certain type of spam that spamassassin otherwises cannot detect

Re: uribl lastminute.com listed in uribl whte and is now used for nordea phisting mails

2012-03-02 Thread Simon Loewenthal
It was a last minute decision. Jeremy McSpadden jer...@fluxlabs.net wrote: Ha. Nice -- Jeremy McSpadden On Mar 2, 2012, at 10:38 AM, Michael Scheidell michael.scheid...@secnap.com wrote: On 3/2/12 11:36 AM, Benny Pedersen wrote: just a note to whom it might concern :) phisting? OUCH.

Bayes now changed to autolearn=unavailable.

2012-02-27 Thread Simon Loewenthal
: 4BA78604 simon @ klunky . org simon @ klunky . co.uk I won't accept your confidentiality agreement, and your Emails are kept. ~Ö¿Ö~

Re: Bayes now changed to autolearn=unavailable.

2012-02-27 Thread Simon Loewenthal
On 27/02/12 13:55, RW wrote: On Mon, 27 Feb 2012 11:48:50 +0100 Simon Loewenthal wrote: Recently I enabled shortcircuit for ham on a server because Bayes seems reasonably well trained. It works well. I noticed that emails that did not hit BAYES_00 (so no shortcircuit) were

Re: Bayes now changed to autolearn=unavailable.

2012-02-27 Thread Simon Loewenthal
On 27/02/12 15:24, Simon Loewenthal wrote: On 27/02/12 13:55, RW wrote: On Mon, 27 Feb 2012 11:48:50 +0100 Simon Loewenthal wrote: Recently I enabled shortcircuit for ham on a server because Bayes seems reasonably well trained. It works well. I noticed that emails that did not hit

Re: Bayes now changed to autolearn=unavailable.

2012-02-27 Thread Simon Loewenthal
On 27/02/12 15:29, Simon Loewenthal wrote: On 27/02/12 15:24, Simon Loewenthal wrote: On 27/02/12 13:55, RW wrote: On Mon, 27 Feb 2012 11:48:50 +0100 Simon Loewenthal wrote: Recently I enabled shortcircuit for ham on a server because Bayes seems reasonably well trained. It works well

Re: warn: config: SpamAssassin failed to parse line, no value provided for body, skipping: body

2012-02-16 Thread Simon Loewenthal
been trying to push out. On 2/3/2012 2:35 PM, Simon Loewenthal wrote: Yep, fails on standard rules. ( Excuse the slightly messy copy and paste, but I am using ConnectBot on a smartphone whilst travelling on train. ) # spamassasin -C `pwd` --lint eb 3 20:27:53.349 [19929] warn: config

warn: config: SpamAssassin failed to parse line, no value provided for body, skipping: body

2012-02-03 Thread Simon Loewenthal
with debug enabled for more information Any starting pointers? Cheers, S -- PGP is optional: 4BA78604 simon @ klunky . org simon @ klunky . co.uk I won't accept your confidentiality agreement, and your Emails are kept

Re: warn: config: SpamAssassin failed to parse line, no value provided for body, skipping: body

2012-02-03 Thread Simon Loewenthal
Version 3.3.1 on Debian Squeeze -- Dogs are tough. I've been interrogating this one for hours and he still won't tell me who's a good boy. simon@klunky / .co.uk / .org Kevin A. McGrail kmcgr...@pccc.com wrote: On 2/3/2012 5:00 AM, Simon Loewenthal wrote: Hi, I have an error

  1   2   >