You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Michael W Cocke <co...@catherders.com> on 2007/08/02 10:15:21 UTC
A rule for empty body and pdf attachment??
These blasted PDF spams are driving me mad! Any ideas for a rule that
would trip if there's no text in the body, just a PDF attachment ?
(I'm using the PDFinfo plugin now, but I don't really understand it)
Thanks!
Mike-
--
If you're not confused, you're not trying hard enough.
--
Please note - Due to the intense volume of spam, we have installed
site-wide spam filters at catherders.com. If email from you bounces,
try non-HTML, non-encoded, non-attachments,
Re: A rule for empty body and pdf attachment??
Posted by Zbigniew Szalbot <zb...@szalbot.homedns.org>.
Hello,
Please ignore, have just found out the location. Sorry to have bothered!
Zbigniew Szalbot
On Thu, 2 Aug 2007 11:45:13 +0200, Zbigniew Szalbot
<zb...@szalbot.homedns.org> wrote:
>
> Hello,
>
> On Thu, 2 Aug 2007 10:37:27 +0200 (CEST), Jeroen Tebbens
> <je...@tebbens.net> wrote:
>> Hi,
>>
>> Get the plugin PDFinfo
>>
>> http://www.rulesemporium.com/plugins/
>>
>> And it will give you more control about PDF spam. It has a rule for
> empty
>> body emails with PDF attachment (GMD_PDF_EMPTY_BODY) and give it a score
>> to your liking.
>
> Excume my lack of knowlegde but where is the plugin directory for SA?
>
> I tried putting it in /usr/local/etc/mail/spamassassin/
> then in /etc/mail and then in /usr/local/share/spamassassin
>
> When I restart spamd, it does not like when I put the path to
> /usr/local/share/spamassassin in init.pre and neither can it by itself
> find
> the PDFInfo.pm in /etc/mail nor in /usr/local/share/spamassassin.
>
> Thank you in advance for your help!
>
> Warm regards,
>
> --
> Zbigniew Szalbot
--
Zbigniew Szalbot
Re: A rule for empty body and pdf attachment??
Posted by Sebastian Ries <Se...@dtnet.de>.
Hi
> Excume my lack of knowlegde but where is the plugin directory for SA?
>
> I tried putting it in /usr/local/etc/mail/spamassassin/
> then in /etc/mail and then in /usr/local/share/spamassassin
>
> When I restart spamd, it does not like when I put the path to
> /usr/local/share/spamassassin in init.pre and neither can it by itself find
> the PDFInfo.pm in /etc/mail nor in /usr/local/share/spamassassin.
In my Debian etch installation it's
/usr/share/perl5/Mail/SpamAssassin/Plugin/
Regards
Sebastian Ries
--
------------------------------------------------------------
DT Netsolution GmbH - Talaeckerstr. 30 - D-70437 Stuttgart
Tel: +49-711-849910-36 Fax: +49-711-849910-936
WEB: http://www.dtnet.de/ email: Sebastian.Ries@dtnet.de
Re: A rule for empty body and pdf attachment??
Posted by Zbigniew Szalbot <zb...@szalbot.homedns.org>.
Hello,
On Thu, 2 Aug 2007 10:37:27 +0200 (CEST), Jeroen Tebbens
<je...@tebbens.net> wrote:
> Hi,
>
> Get the plugin PDFinfo
>
> http://www.rulesemporium.com/plugins/
>
> And it will give you more control about PDF spam. It has a rule for empty
> body emails with PDF attachment (GMD_PDF_EMPTY_BODY) and give it a score
> to your liking.
Excume my lack of knowlegde but where is the plugin directory for SA?
I tried putting it in /usr/local/etc/mail/spamassassin/
then in /etc/mail and then in /usr/local/share/spamassassin
When I restart spamd, it does not like when I put the path to
/usr/local/share/spamassassin in init.pre and neither can it by itself find
the PDFInfo.pm in /etc/mail nor in /usr/local/share/spamassassin.
Thank you in advance for your help!
Warm regards,
--
Zbigniew Szalbot
Re: A rule for empty body and pdf attachment??
Posted by Raquel <ra...@thericehouse.net>.
On Thu, 2 Aug 2007 12:24:37 -0700 (PDT)
User for SpamAssassin Mail List <sp...@pcez.com> wrote:
>
> Hello,
>
> We are running a Debian Sarge system here with spamassassin
> version Version: 3.0.3-2sarge1.
>
> I tried to put these plugins (ImageInfo and loadplugin) into my
> system and got the following errors when I restarted:
<snip>
>
> What am I missing here to make this work?
>
> Thanks,
>
> Ken
>
Ken,
My understanding is that the plugin system doesn't work with that
version of spamassassin. Also, RDJ, as we are often reminded, is no
longer supported. If we haven't upgraded from Sarge to Etch yet,
despite having very valid reasons for not having upgraded ... we're
SOL.
--
Raquel
============================================================
To be nobody - but - yourself ... in a world which is doing its best
night and day, to make you everybody else ... means to fight the
hardest battle which any human being can fight; and never stop
fighting.
--e. e. cummings
Re: A rule for empty body and pdf attachment??
Posted by Adam Wilbraham <ad...@technophobia.com>.
On Thu, 2 Aug 2007 12:24:37 -0700 (PDT)
User for SpamAssassin Mail List <sp...@pcez.com> wrote:
>
> Hello,
>
> We are running a Debian Sarge system here with spamassassin version
> Version: 3.0.3-2sarge1.
My word, get yourself 3.1.7 from Sarge backports and run sa-update
before you do anything!
Re: A rule for empty body and pdf attachment??
Posted by User for SpamAssassin Mail List <sp...@pcez.com>.
As a follow up. I found a Logger.pm on the system but it was not in the
"/usr/share/perl5/Mail/SpamAssassin/" directory. I did find one in the
"/usr/share/perl5/Razor2" directory. I made copy of this Logger.pm file
and placed it in the "Mail/SpamAssassin/" directory like it was looking
for in the error log below. When I restarted up the spamassassin program I
got different errors this time:
-----------------------------------------------------------------------
Aug 2 13:00:23 mail spamd[4820]: spamd starting
Aug 2 13:00:23 mail spamd[4822]: Subroutine new redefined at
/usr/share/perl5/Mail/SpamAssassin/Logger.pm line 17.
Aug 2 13:00:23 mail spamd[4822]: Subroutine log redefined at
/usr/share/perl5/Mail/SpamAssassin/Logger.pm line 73.
Aug 2 13:00:23 mail spamd[4822]: Subroutine log2file redefined at
/usr/share/perl5/Mail/SpamAssassin/Logger.pm line 114.
Aug 2 13:00:24 mail spamd[4822]: Failed to run GMD_PDF_FUZZY2_T1
SpamAssassin test, skipping:__(Undefined subroutine
&Mail::SpamAssassin::Plugin::PDFInfo::dbg called at
/usr/share/perl5/Mail/SpamAssassin/Plugin/PDFInfo.pm line 393._)
------------------------------------------------------------------------
My guess is that this is not the right "Logger.pm" file. Where do I find
the correct file so I can make this work? And is that my only problem???
Thanks,
Ken
On Thu, 2 Aug 2007, User for SpamAssassin Mail List wrote:
>
> Hello,
>
> We are running a Debian Sarge system here with spamassassin version
> Version: 3.0.3-2sarge1.
>
> I tried to put these plugins (ImageInfo and loadplugin) into my system and
> got the following errors when I restarted:
> --------------------------------------------------------------------
> Aug 2 12:08:56 mail spamd[8789]: failed to parse plugin (from @INC): Can't locate
> Mail/SpamAssassin/Logger.pm in @INC (@INC contains: lib ../lib /usr/share/perl5 /etc/perl
> /usr/local/lib/perl/5.8.4 /usr/local/share/perl/5.8.4 /usr/lib/perl5 /usr/lib/perl/5.8
> /usr/share/perl/5.8 /usr/local/lib/site_perl) at
> /usr/share/perl5/Mail/SpamAssassin/Plugin/ImageInfo.pm line 100._BEGIN
> failed--compilation aborted at /usr/share/perl5/Mail/SpamAssassin/Plugin/ImageInfo.pm line
> 100._Compilation failed in require at (eval 26) line 1.
>
> Aug 2 12:08:56 mail spamd[8789]: failed to create instance of plugin
> Mail::SpamAssassin::Plugin::ImageInfo: Can't locate object method "new"
> via package "Mail::SpamAssassin::Plugin::ImageInfo" at (eval 27) line 1.
>
> Aug 2 12:08:56 mail spamd[8789]: failed to parse plugin (from @INC):
> Can't locate Mail/SpamAssassin/Logger.pm in @INC (@INC contains: lib
> ../lib /usr/share/perl5 /etc/perl /usr/local/lib/perl/5.8.4
> /usr/local/share/perl/5.8.4 /usr/lib/perl5 /usr/lib/perl/5.8
> /usr/share/perl/5.8 /usr/local/lib/site_perl) at
> /usr/share/perl5/Mail/SpamAssassin/Plugin/PDFInfo.pm line 131._BEGIN
> failed--compilation aborted at
> /usr/share/perl5/Mail/SpamAssassin/Plugin/PDFInfo.pm line 131._Compilation
> failed in require at (eval 28) line 1. Aug 2 12:08:56 mail spamd[8789]:
> failed to create instance of plugin Mail::SpamAssassin::Plugin::PDFInfo:
> Can't locate object method "new" via package
> "Mail::SpamAssassin::Plugin::PDFInfo" at (eval 29) line 1.
> -----------------------------------------------------------------------
>
> What am I missing here to make this work?
>
> Thanks,
>
> Ken
>
>
>
>
> On Thu, 2 Aug 2007, Jeroen Tebbens wrote:
>
> > Hi,
> >
> > Get the plugin PDFinfo
> >
> > http://www.rulesemporium.com/plugins/
> >
> > And it will give you more control about PDF spam. It has a rule for empty
> > body emails with PDF attachment (GMD_PDF_EMPTY_BODY) and give it a score
> > to your liking.
> >
> > /Jeroen
> >
> > On Thu, 2 Aug 2007, Michael W Cocke wrote:
> >
> > > These blasted PDF spams are driving me mad! Any ideas for a rule that
> > > would trip if there's no text in the body, just a PDF attachment ?
> > >
> > > (I'm using the PDFinfo plugin now, but I don't really understand it)
> > >
> > > Thanks!
> > >
> > > Mike-
> > > --
> > > If you're not confused, you're not trying hard enough.
> > > --
> > > Please note - Due to the intense volume of spam, we have installed
> > > site-wide spam filters at catherders.com. If email from you bounces,
> > > try non-HTML, non-encoded, non-attachments,
> > >
> > >
> >
>
Re: A rule for empty body and pdf attachment??
Posted by User for SpamAssassin Mail List <sp...@pcez.com>.
Hello,
We are running a Debian Sarge system here with spamassassin version
Version: 3.0.3-2sarge1.
I tried to put these plugins (ImageInfo and loadplugin) into my system and
got the following errors when I restarted:
--------------------------------------------------------------------
Aug 2 12:08:56 mail spamd[8789]: failed to parse plugin (from @INC): Can't locate
Mail/SpamAssassin/Logger.pm in @INC (@INC contains: lib ../lib /usr/share/perl5 /etc/perl
/usr/local/lib/perl/5.8.4 /usr/local/share/perl/5.8.4 /usr/lib/perl5 /usr/lib/perl/5.8
/usr/share/perl/5.8 /usr/local/lib/site_perl) at
/usr/share/perl5/Mail/SpamAssassin/Plugin/ImageInfo.pm line 100._BEGIN
failed--compilation aborted at /usr/share/perl5/Mail/SpamAssassin/Plugin/ImageInfo.pm line
100._Compilation failed in require at (eval 26) line 1.
Aug 2 12:08:56 mail spamd[8789]: failed to create instance of plugin
Mail::SpamAssassin::Plugin::ImageInfo: Can't locate object method "new"
via package "Mail::SpamAssassin::Plugin::ImageInfo" at (eval 27) line 1.
Aug 2 12:08:56 mail spamd[8789]: failed to parse plugin (from @INC):
Can't locate Mail/SpamAssassin/Logger.pm in @INC (@INC contains: lib
../lib /usr/share/perl5 /etc/perl /usr/local/lib/perl/5.8.4
/usr/local/share/perl/5.8.4 /usr/lib/perl5 /usr/lib/perl/5.8
/usr/share/perl/5.8 /usr/local/lib/site_perl) at
/usr/share/perl5/Mail/SpamAssassin/Plugin/PDFInfo.pm line 131._BEGIN
failed--compilation aborted at
/usr/share/perl5/Mail/SpamAssassin/Plugin/PDFInfo.pm line 131._Compilation
failed in require at (eval 28) line 1. Aug 2 12:08:56 mail spamd[8789]:
failed to create instance of plugin Mail::SpamAssassin::Plugin::PDFInfo:
Can't locate object method "new" via package
"Mail::SpamAssassin::Plugin::PDFInfo" at (eval 29) line 1.
-----------------------------------------------------------------------
What am I missing here to make this work?
Thanks,
Ken
On Thu, 2 Aug 2007, Jeroen Tebbens wrote:
> Hi,
>
> Get the plugin PDFinfo
>
> http://www.rulesemporium.com/plugins/
>
> And it will give you more control about PDF spam. It has a rule for empty
> body emails with PDF attachment (GMD_PDF_EMPTY_BODY) and give it a score
> to your liking.
>
> /Jeroen
>
> On Thu, 2 Aug 2007, Michael W Cocke wrote:
>
> > These blasted PDF spams are driving me mad! Any ideas for a rule that
> > would trip if there's no text in the body, just a PDF attachment ?
> >
> > (I'm using the PDFinfo plugin now, but I don't really understand it)
> >
> > Thanks!
> >
> > Mike-
> > --
> > If you're not confused, you're not trying hard enough.
> > --
> > Please note - Due to the intense volume of spam, we have installed
> > site-wide spam filters at catherders.com. If email from you bounces,
> > try non-HTML, non-encoded, non-attachments,
> >
> >
>
Re: A rule for empty body and pdf attachment??
Posted by Jeroen Tebbens <je...@tebbens.net>.
Hi,
Get the plugin PDFinfo
http://www.rulesemporium.com/plugins/
And it will give you more control about PDF spam. It has a rule for empty
body emails with PDF attachment (GMD_PDF_EMPTY_BODY) and give it a score
to your liking.
/Jeroen
On Thu, 2 Aug 2007, Michael W Cocke wrote:
> These blasted PDF spams are driving me mad! Any ideas for a rule that
> would trip if there's no text in the body, just a PDF attachment ?
>
> (I'm using the PDFinfo plugin now, but I don't really understand it)
>
> Thanks!
>
> Mike-
> --
> If you're not confused, you're not trying hard enough.
> --
> Please note - Due to the intense volume of spam, we have installed
> site-wide spam filters at catherders.com. If email from you bounces,
> try non-HTML, non-encoded, non-attachments,
>
>
Re: A rule for empty body and pdf attachment??
Posted by MIKE YRABEDRA <li...@323inc.com>.
Probably a stupid question, but where do I put the PDFInfo.pm file?
I put it is /etc/mail/plugins/...
But that does not work.
I will continue googling in the meantime
on 8/2/07 5:09 AM, Michael W Cocke at cocke@catherders.com wrote:
> Thanks, both of you. Looks like an update to pdfinfo snuck out while
> I wasn't looking. I've made the adjustments.
>
> Mike-
>
>
> On Thu, 2 Aug 2007 10:39:20 +0200, you wrote:
>
>> "Michael W Cocke" <co...@catherders.com> wrote in message
>> news:pf43b3h1e1g5ghv7ud5k3es8mje4vj4m6t@4ax.com...
>>> These blasted PDF spams are driving me mad! Any ideas for a rule that
>>> would trip if there's no text in the body, just a PDF attachment ?
>>>
>>> (I'm using the PDFinfo plugin now, but I don't really understand it)
>>>
>>> Thanks!
>>>
>>> Mike-
>>> --
>>> If you're not confused, you're not trying hard enough.
>>> --
>>> Please note - Due to the intense volume of spam, we have installed
>>> site-wide spam filters at catherders.com. If email from you bounces,
>>> try non-HTML, non-encoded, non-attachments,
>>>
>>
>>
>> If you're using the PDFinfo plugin, you should see a rule called
>> GMD_PDF_EMPTY_BODY on those spams - it should fire on any message
>> containing a PDF and a blank body. Obviously you can modify that rule's score
>> if you want to make it higher, or meta it with other
>> rules. Also make sure you're using the latest version of the plugin and the
>> associated .cf file from
>> www.rulesemporium.com/plugins.htm.
>>
>> Cheers,
>> Jeremy
>>
>>
> --
> If you're not confused, you're not trying hard enough.
> --
> Please note - Due to the intense volume of spam, we have installed
> site-wide spam filters at catherders.com. If email from you bounces,
> try non-HTML, non-encoded, non-attachments,
--
Mike Yrabedra B^)>
Re: A rule for empty body and pdf attachment??
Posted by Michael W Cocke <co...@catherders.com>.
Thanks, both of you. Looks like an update to pdfinfo snuck out while
I wasn't looking. I've made the adjustments.
Mike-
On Thu, 2 Aug 2007 10:39:20 +0200, you wrote:
>"Michael W Cocke" <co...@catherders.com> wrote in message news:pf43b3h1e1g5ghv7ud5k3es8mje4vj4m6t@4ax.com...
>> These blasted PDF spams are driving me mad! Any ideas for a rule that
>> would trip if there's no text in the body, just a PDF attachment ?
>>
>> (I'm using the PDFinfo plugin now, but I don't really understand it)
>>
>> Thanks!
>>
>> Mike-
>> --
>> If you're not confused, you're not trying hard enough.
>> --
>> Please note - Due to the intense volume of spam, we have installed
>> site-wide spam filters at catherders.com. If email from you bounces,
>> try non-HTML, non-encoded, non-attachments,
>>
>
>
>If you're using the PDFinfo plugin, you should see a rule called GMD_PDF_EMPTY_BODY on those spams - it should fire on any message
>containing a PDF and a blank body. Obviously you can modify that rule's score if you want to make it higher, or meta it with other
>rules. Also make sure you're using the latest version of the plugin and the associated .cf file from
>www.rulesemporium.com/plugins.htm.
>
>Cheers,
>Jeremy
>
>
--
If you're not confused, you're not trying hard enough.
--
Please note - Due to the intense volume of spam, we have installed
site-wide spam filters at catherders.com. If email from you bounces,
try non-HTML, non-encoded, non-attachments,
Re: A rule for empty body and pdf attachment??
Posted by Diego Pomatta <in...@abelsonsa.com.ar>.
Jeremy Fairbrass escribió:
> If you're using the PDFinfo plugin, you should see a rule called GMD_PDF_EMPTY_BODY on those spams - it should fire on any message
> containing a PDF and a blank body. Obviously you can modify that rule's score if you want to make it higher, or meta it with other
> rules. Also make sure you're using the latest version of the plugin and the associated .cf file from
> www.rulesemporium.com/plugins.htm.
>
> Cheers,
> Jeremy
>
>
What about GMD_PDF_NO_TXT that comes disabled by default and was already
present in at least PDFInfo 0.4 ?
body GMD_PDF_NO_TXT
eval:pdf_image_to_text_ratio(0.000, 0.005)
describe GMD_PDF_NO_TXT Low rawbody to pixel area ratio
score GMD_PDF_NO_TXT 0.75
counts GMD_PDF_NO_TXT 64s/3h of 10615 corpus
(5652s/4963h AxB) 06/25/07
Re: A rule for empty body and pdf attachment??
Posted by Jeremy Fairbrass <jf...@hotmail.com>.
"Michael W Cocke" <co...@catherders.com> wrote in message news:pf43b3h1e1g5ghv7ud5k3es8mje4vj4m6t@4ax.com...
> These blasted PDF spams are driving me mad! Any ideas for a rule that
> would trip if there's no text in the body, just a PDF attachment ?
>
> (I'm using the PDFinfo plugin now, but I don't really understand it)
>
> Thanks!
>
> Mike-
> --
> If you're not confused, you're not trying hard enough.
> --
> Please note - Due to the intense volume of spam, we have installed
> site-wide spam filters at catherders.com. If email from you bounces,
> try non-HTML, non-encoded, non-attachments,
>
If you're using the PDFinfo plugin, you should see a rule called GMD_PDF_EMPTY_BODY on those spams - it should fire on any message
containing a PDF and a blank body. Obviously you can modify that rule's score if you want to make it higher, or meta it with other
rules. Also make sure you're using the latest version of the plugin and the associated .cf file from
www.rulesemporium.com/plugins.htm.
Cheers,
Jeremy
Re: A rule for empty body and pdf attachment??
Posted by Theo Van Dinter <fe...@apache.org>.
On Thu, Aug 02, 2007 at 04:15:21AM -0400, Michael W Cocke wrote:
> These blasted PDF spams are driving me mad! Any ideas for a rule that
> would trip if there's no text in the body, just a PDF attachment ?
run sa-update. There's been a rule in the channel for a while now.
--
Randomly Selected Tagline:
"It's a good cause... Cause it's good...?" - Hardcore TV