Re: pattern problem

2010-11-10 Thread Matus UHLAR - fantomas
> On Tue, 9 Nov 2010 12:48:52 +0100 > Matus UHLAR - fantomas wrote: > > can IP addresses in PBL get onto XBL? On 10.11.10 08:46, RW wrote: > Yes, some servers reject on XBL, but not on PBL. I was more interested iun spamhaus practice. And not rejecting mail from PBL at SMTP level is imho strang

Re: pattern problem

2010-11-10 Thread RW
On Tue, 9 Nov 2010 12:48:52 +0100 Matus UHLAR - fantomas wrote: > > > On 05.11.10 12:28, RW wrote: > > > > It's not all that safe to deep-parse XBL because it's mostly > > > > dynamically assigned IP addresses. > > > On Fri, 5 Nov 2010 14:38:45 +0100 > > Matus UHLAR - fantomas wrote: > > > the

Re: pattern problem

2010-11-09 Thread Matus UHLAR - fantomas
> > On 05.11.10 12:28, RW wrote: > > > It's not all that safe to deep-parse XBL because it's mostly > > > dynamically assigned IP addresses. > On Fri, 5 Nov 2010 14:38:45 +0100 > Matus UHLAR - fantomas wrote: > > the PBL from ZEN is mostly dynamically assigned. > > the XBL means exploits block li

Re: pattern problem

2010-11-05 Thread RW
On Fri, 5 Nov 2010 14:38:45 +0100 Matus UHLAR - fantomas wrote: > > On Fri, 05 Nov 2010 11:54:08 + > > Ned Slider wrote: > > > are safe to do so. You should be safe to deep parse against > > > Spamhaus SBL and XBL but not PBL. This instance hits against XBL > > > and many others. > > On 05.

Re: pattern problem

2010-11-05 Thread Matus UHLAR - fantomas
> On Fri, 05 Nov 2010 11:54:08 + > Ned Slider wrote: > > are safe to do so. You should be safe to deep parse against Spamhaus > > SBL and XBL but not PBL. This instance hits against XBL and many > > others. On 05.11.10 12:28, RW wrote: > It's not all that safe to deep-parse XBL because it's m

Re: pattern problem

2010-11-05 Thread RW
On Fri, 05 Nov 2010 11:54:08 + Ned Slider wrote: > are safe to do so. You should be safe to deep parse against Spamhaus > SBL and XBL but not PBL. This instance hits against XBL and many > others. It's not all that safe to deep-parse XBL because it's mostly dynamically assigned IP addresse

Re: pattern problem

2010-11-05 Thread Ned Slider
On 05/11/10 07:02, Cédric Jeanneret wrote: Hello, I have a lot of mail like this one: http://tengu.pastebin.com/PCyGxApn The problem is, SA doesn't seem to see it as a spam (I've included all headers). I'm willing to create a filter for those nasty mails, but I have to confess I'm not really s

Re: pattern problem

2010-11-05 Thread Martin Gregorie
On Fri, 2010-11-05 at 09:02 +0200, Cédric Jeanneret wrote: > It seems that a patern like /[a-z]+~[a-z]+~[a-z]+/i is used in each > mail - I have to dig in my spambox to confirm that. > > Maybe I can use the return-path, from and X-Originating-Email in > addition ? > If they all contain: - a

pattern problem

2010-11-05 Thread Cédric Jeanneret
Hello, I have a lot of mail like this one: http://tengu.pastebin.com/PCyGxApn The problem is, SA doesn't seem to see it as a spam (I've included all headers). I'm willing to create a filter for those nasty mails, but I have to confess I'm not really sure on how to do it. It seems that a pa

RE: whitelist pattern problem in userpref-whitelisting

2009-03-17 Thread Bowie Bailey
LuKreme wrote: > On 17-Mar-2009, at 10:12, Bowie Bailey wrote: > > If you do not want to allow user rules, you > > can define the rule in local.cf and give it a 0 score. The > > individual users would then be able to activate the rule by > > changing the score in user_prefs. > > > Oh? Well, tha

Re: whitelist pattern problem in userpref-whitelisting

2009-03-17 Thread LuKreme
On 17-Mar-2009, at 10:12, Bowie Bailey wrote: If you do not want to allow user rules, you can define the rule in local.cf and give it a 0 score. The individual users would then be able to activate the rule by changing the score in user_prefs. Oh? Well, that's clever. I thought scoring 0 dis

RE: whitelist pattern problem in userpref-whitelisting

2009-03-17 Thread Bowie Bailey
I did not realize you were talking about whitelisting when I replied. The whitelist_from and related commands use filename globbing. You can use '?' to represent one character or '*' to represent any number of characters, but that is the extent of it. The rule that I listed below can be used as a

Re: userpref whitelist pattern problem

2009-03-15 Thread Linda Walsh
LuKreme wrote: On 13-Mar-2009, at 12:58, Linda Walsh wrote: I get many emails addressed to internal sendmail 's. 123...@mydomain or 1abd56.ef7...@mydomain (seem to fit a basic pattern but don't know how to specify the pattern (or I don't have it right): <(start of an email-address)>[0-9][

Re: whitelist pattern problem

2009-03-14 Thread LuKreme
On 13-Mar-2009, at 12:58, Linda Walsh wrote: I get many emails addressed to internal sendmail 's. 123...@mydomain 1abd56.ef7...@mydomain (seem to fit a basic pattern but don't know how to specify the pattern (or I don't have it right): <(start of an email-address)>[0-9][0-9a-fa-f\@mydomain

Re: whitelist pattern problem in userpref-whitelisting

2009-03-13 Thread Linda Walsh
Does the below apply to the ~/.spamassassin/userprefs whitelisting (command, keyword or feature)... Sorry...it was the whitelisting in the userpref file that I was talking about the "primitive pattern matching" At one point it was limited to DOS-like file-matching patterns, not the

RE: whitelist pattern problem

2009-03-13 Thread Bowie Bailey
Linda Walsh wrote: > I get many emails addressed to internal sendmail 's. > 123...@mydomain > 1abd56.ef7...@mydomain > > > (seem to fit a basic pattern but don't know how to specify the > pattern (or I don't have it right): > <(start of an email-address)>[0-9][0-9a-fa-f\@mydomain > > b

whitelist pattern problem

2009-03-13 Thread Linda Walsh
I get many emails addressed to internal sendmail 's. 123...@mydomain 1abd56.ef7...@mydomain (seem to fit a basic pattern but don't know how to specify the pattern (or I don't have it right): <(start of an email-address)>[0-9][0-9a-fa-f\@mydomain by start of an email, addr, I mean inside