Re: New slew of spams

2009-06-10 Thread Adam Katz
I said: >> I'd consider that a rather sane decision. Back when my distribution >> had user accounts with shell access, I had custom rules disabled too. LuKreme wrote: > Sue, but how long ago was that? Not sure I approve of that nickname... That was ~3y ago. > The way to properly host people no

Re: New slew of spams

2009-06-10 Thread John Hardin
On Wed, 10 Jun 2009, LuKreme wrote: On 9-Jun-2009, at 07:42, Adam Katz wrote: No, I'd consider that a rather sane decision. Back when my distribution had user accounts with shell access, I had custom rules disabled too. Sue, but how long ago was that? The way to properly host people now is

Re: New slew of spams

2009-06-10 Thread LuKreme
On 9-Jun-2009, at 07:42, Adam Katz wrote: ktn wrote: By default, the spamd daemon does not allow user defined rules. Hostmonster needs to set "allow_user_rules" to 1 in the system configuration file. I asked about this and that's something that they will not do. LuKreme wrote: It's a good thi

RE: sa-update and SA versions (was: Re: New slew of spams)

2009-06-09 Thread RobertH
> From: Karsten Bräckelmann > The differences between 3.2.x versions are code fixes. There > is no difference in rules, when using sa-update. > > While it is possible to publish per micro version updates, > this is not necessary and thus not used for 3.2.x. They all > share the very same rul

sa-update and SA versions (was: Re: New slew of spams)

2009-06-09 Thread Karsten Bräckelmann
On Mon, 2009-06-08 at 07:57 -0700, John Hardin wrote: > That is correct. I hope (when I get write access to the repo) to add them > to the 3.2.5 rules so they will go out via sa-update. Is there any way you > can upgrade to 3.2.5? The differences between 3.2.x versions are code fixes. There is n

Re: New slew of spams

2009-06-09 Thread Adam Katz
ktn wrote: >>> By default, the spamd daemon does not allow user defined rules. >>> Hostmonster needs to set "allow_user_rules" to 1 in the system >>> configuration file. I asked about this and that's something that >>> they will not do. LuKreme wrote: > It's a good thing there are other hosting

Re: [sa] New slew of spams

2009-06-09 Thread ktn
7;s running a private MTA to service a private LAN. > -- View this message in context: http://www.nabble.com/New-slew-of-spams-tp23892760p23942169.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: New slew of spams

2009-06-08 Thread LuKreme
On 8-Jun-2009, at 11:19, ktn wrote: By default, the spamd daemon does not allow user defined rules. Hostmonster needs to set "allow_user_rules" to 1 in the system configuration file. I asked about this and that's something that they will not do. It's a good thing there are other hosting comp

Re: New slew of spams

2009-06-08 Thread John Hardin
On Mon, 8 Jun 2009, ktn wrote: By default, the spamd daemon does not allow user defined rules. Hostmonster needs to set "allow_user_rules" to 1 in the system configuration file. I asked about this and that's something that they will not do. ...which is completely reasonable in a shared-hosti

Re: New slew of spams

2009-06-08 Thread ktn
that they won't allow 'local.cf' or that > they won't allow 'user_prefs'? I'd be a bit surprised if the latter > were not available > -- View this message in context: http://www.nabble.com/New-slew-of-spams-tp23892760p23928476.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: New slew of spams

2009-06-08 Thread Charles Gregory
On Mon, 8 Jun 2009, ktn wrote: I am also starting to get a lot of these ".rtf attachment only with no email body text" spams. Unfortunately, we use hostmonster.com for our email so my ability to customize SA is greatly limited (i.e. I cannot use custom rules). Do you mean that they won't all

Re: [sa] New slew of spams

2009-06-08 Thread Martin Gregorie
On Mon, 2009-06-08 at 07:17 -0700, ktn wrote: > I am also starting to get a lot of these ".rtf attachment only with no email > body text" spams. Unfortunately, we use hostmonster.com for our email so my > ability to customize SA is greatly limited (i.e. I cannot use custom rules). > You can, of c

Re: [sa] New slew of spams

2009-06-08 Thread John Hardin
On Mon, 8 Jun 2009, ktn wrote: We haven't been with hostmonster long, but considering that they're running 3.2.4 right now, I would assume at some point that they will update to 3.2.5. Until then, I can be patient. I'm just glad to hear that a standard rule for this kind of spam will be added

Re: [sa] New slew of spams

2009-06-08 Thread ktn
s to the repo) to add them > to the 3.2.5 rules so they will go out via sa-update. Is there any way you > can upgrade to 3.2.5? > -- View this message in context: http://www.nabble.com/New-slew-of-spams-tp23892760p23926488.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: [sa] New slew of spams

2009-06-08 Thread John Hardin
On Mon, 8 Jun 2009, ktn wrote: I am also starting to get a lot of these ".rtf attachment only with no email body text" spams. Unfortunately, we use hostmonster.com for our email so my ability to customize SA is greatly limited (i.e. I cannot use custom rules). Bummer. Does hostmonster run

Re: [sa] New slew of spams

2009-06-08 Thread ktn
ndard rule in SA (we use 3.2.4) for filtering out mail with attachments but no text. Charles Gregory wrote: > > On Fri, 5 Jun 2009, Jeremy Morton wrote: >> I've suddenly started getting a new slew of spams that are making their >> way >> through my SpamAssassin fil

Re: New slew of spams

2009-06-06 Thread RW
On Fri, 05 Jun 2009 14:05:40 -0400 Rob McEwen wrote: > An occassional legit e-mail will have RDNS_NONE, and an occassional > legit e-mail will have RCVD_IN_PBL. But even extreme fewer legit > emails will have hits on BOTH of these. So I'd suggest scoring the > combination of the two either just a

Re: New slew of spams

2009-06-05 Thread Benny Pedersen
On Fri, June 5, 2009 20:05, Rob McEwen wrote: > I highly recommend scoring RDNS_NONE at much higher than "0.1", and > scoring RCVD_IN_PBL at much higher than 0.9 meta SPAM_LOCAL (RDNS_NONE && RCVD_IN_PBL) describe SPAM_LOCAL Meta: it hits both RDNS_NONE and RCVD_IN_PBL score SPAM_LOCAL 5.0 --

Re: New slew of spams

2009-06-05 Thread Benny Pedersen
On Fri, June 5, 2009 19:58, Jeremy Morton wrote: > http://pastebin.com/m586e296c http://cbl.abuseat.org/lookup.cgi?ip=93.5.36.134 do you use zen.spamhaus.org in exim ? http://www.wpbl.info/cgi-bin/detail.cgi?ip=93.5.36.134 if the ip is not sending ham to you block the ip localy -- http://loca

Re: New slew of spams

2009-06-05 Thread rich...@buzzhost.co.uk
On Fri, 2009-06-05 at 20:33 +0200, Raymond Dijkxhoorn wrote: > Hi! > > >> http://pastebin.com/m586e296c > >> > >> As you can see they tend to hit a couple of blacklists, but don't get a > >> high enough score to be marked as spam. What do your SpamAssassin > >> analyses give of this e-mail, and a

Re: New slew of spams

2009-06-05 Thread Raymond Dijkxhoorn
Hi! http://pastebin.com/m586e296c As you can see they tend to hit a couple of blacklists, but don't get a high enough score to be marked as spam. What do your SpamAssassin analyses give of this e-mail, and any tips as to how I can get these marked as spam? But; 93.5.36.134 listed in b

Re: New slew of spams

2009-06-05 Thread Adam Katz
Jeremy Morton wrote: > I've suddenly started getting a new slew of spams that are making their > way through my SpamAssassin filter. Here's an example of one: > > http://pastebin.com/m586e296c > > As you can see they tend to hit a couple of blacklists, but don'

Re: New slew of spams

2009-06-05 Thread John Hardin
On Fri, 5 Jun 2009, Jeremy Morton wrote: I've suddenly started getting a new slew of spams that are making their way through my SpamAssassin filter. Here's an example of one: http://pastebin.com/m586e296c Look for the MIME_NO_TEXT ruleset I posted a few days ago. -- John Har

Re: [sa] New slew of spams

2009-06-05 Thread Charles Gregory
On Fri, 5 Jun 2009, Jeremy Morton wrote: I've suddenly started getting a new slew of spams that are making their way through my SpamAssassin filter. Here's an example of one: http://pastebin.com/m586e296c These are examples of the new variant on 'image only' spams, hav

Re: New slew of spams

2009-06-05 Thread rich...@buzzhost.co.uk
On Fri, 2009-06-05 at 18:58 +0100, Jeremy Morton wrote: > Hi, > > I've suddenly started getting a new slew of spams that are making their > way through my SpamAssassin filter. Here's an example of one: > > http://pastebin.com/m586e296c > > As you ca

Re: New slew of spams

2009-06-05 Thread Rob McEwen
Jeremy Morton wrote: > I've suddenly started getting a new slew of spams that are making > their way through my SpamAssassin filter. Here's an example of one: > > http://pastebin.com/m586e296c > > As you can see they tend to hit a couple of blacklists, but don'

New slew of spams

2009-06-05 Thread Jeremy Morton
Hi, I've suddenly started getting a new slew of spams that are making their way through my SpamAssassin filter. Here's an example of one: http://pastebin.com/m586e296c As you can see they tend to hit a couple of blacklists, but don't get a high enough score to be marked as