pyzor-users — general discussion of Pyzor and Pyzor-related topics

RE: Pyzor server not responding

[Jan-Peter K. <Jan...@se...>]

On Monday, November 08, 2004 10:09 AM Andreas Schamanek wrote:=20

>> is it just me or is the Pyzor server having a problem? ... proxy:~ #
>> pyzor ping 217.160.253.84:24441    TimeoutError:
>=20
> sch...@ww...:~$ pyzor ping
> 217.160.253.84:24441    (200, 'OK')

Thanks so much for helping...=20

> :)

That explains it. Please read the rest of the postings and you will see
that unless you are not using a packet filter or open that one up
(unneccessarily) you will NOT receive answer packets anymore...

Regards,
  JP

Re: new server / firewall

[Frank T. <ft...@ne...>]

Tobias Stefan Richter, on 2004-11-10, wrote:

> Is there a good reason the new server (82.165.246.93) answering requests 
> to 217.160.253.84 isn't officially announced (via 'pyzor discover' or at 
> least mailing list)?

Currently the server is on a multihomed host; I'll see what I can do about 
having it bind to the advertised address.

-- 
Frank

Re: Status of project

[Mark N. <ma...@ti...>]

On 10 Nov 2004 at 18:47, Francisco wrote:

> What is the status of the project?
> Have only used it for a few days and have seen very little activity in the 
> list. In addition the docs could use some enhancements, which I would not 
> mind helping with if the project is still alive.

I'm not one of the developers, but I've been using pyzor for about a year as part of 
SpamAssassin (which in turn I am using as part of MailScanner).  I think the reason 
there is very little activity on the list is that the code is mature and works very well for 
most users.  A fair percentage of the spam we receive triggers the pyzor score.  I 
can't think of anything that would be needed to improve it.  
-- 
Mark W. Nienberg, SE
Tipping Mar + associates
1906 Shattuck Ave
Berkeley, CA 94704
510 549-1906 ext 236
http://www.tippingmar.com

Status of project

[Francisco <li...@na...>]

What is the status of the project?
Have only used it for a few days and have seen very little activity in the 
list. In addition the docs could use some enhancements, which I would not 
mind helping with if the project is still alive.

Is ANY development currently been done to the project?
Given that the last release was in September 8, 2002  kind of wonder what 
is next for this project.

Re: Running server

[Francisco <li...@na...>]

On Wed, 10 Nov 2004, Frank Tobin wrote:

> Yes, py-gdbm is needed.

Got it to work yesterday.
Is there a way to sync my own local server with the public one?

Re: Spamtrap account and local server

[Francisco <li...@na...>]

On Wed, 10 Nov 2004, Frank Tobin wrote:

>> For starters could I bounce the thousands of spam messages I already have 
>> received to the spamprobe account? Get a couple of hundreds per day.
>
> If you have a spamtrap account, having it report directly to the pyzor server 
> would be ideal.

I did that.
The question was if I should bounce emails that I got before setting up 
pyzor.

I am evaluating Pyzor and have 2 others methods of spam control from 
before pyzor. I am feeding, bouncing, spams from the other spam controls 
into my pyzor setup.

Re: Running server

[Frank T. <ft...@ne...>]

Francisco, on 2004-11-09, wrote:

> Are there additional requirements to install the server?
> Seems like it needs gdbm?
> Does it need py-gdbm too?

Yes, py-gdbm is needed.

-- 
Frank

Re: Spamtrap account and local server

[Frank T. <ft...@ne...>]

Francisco, on 2004-11-09, wrote:

> Will future spam email need to be identical to be flagged?
> If a spam is sent to the spamprobe account, will the same spam need to be 
> idential, except for the "To:" address to be picked up by Pyzor?

Pyzor only looks at the body of a message, and munges it a bit to try to 
filter out some noise.  It's not perfect, however.

> For starters could I bounce the thousands of spam messages I already have 
> received to the spamprobe account? Get a couple of hundreds per day.

If you have a spamtrap account, having it report directly to the pyzor 
server would be ideal.

-- 
Frank

Re: Confused on setup and concepts

[Frank T. <ft...@ne...>]

Francisco, on 2004-11-09, wrote:

> Is Pyzor a filter?

Pyzor is not a filter, but rather just a 'categorizer'.  It's best called 
from within something akin to procmail.

-- 
Frank

new server / firewall

[<ts...@ac...>]

Is there a good reason the new server (82.165.246.93) answering 
requests to 217.160.253.84 isn't officially announced (via 'pyzor
discover' or at least mailing list)?

I think it's rather stupid to have to edit my firewall configuration
to let bogus UDP responses in, while I just can edit my pyzor server
file to point to the new location and everything would work all right.

$ pyzor ping
217.160.253.84:24441    TimeoutError:
$ vi .pyzor/servers
$ pyzor ping
82.165.246.93:24441     (200, 'OK')

Any ideas?

RE: Running server

[Jan-Peter K. <Jan...@se...>]

On Tuesday, November 09, 2004 9:21 PM Lars Holmstr=F6m wrote:=20

> I really do not support the numbers you are giving.

I think you missed my point. :-)

> I run two mailservers. One of them currently accept 400-600 mail per
> day and pyzor is a very usable tool that help the users to sort out
> about 80-120 mails per day. =20

I am not saying Pyzor is not a useful tool. Together with SpamAssassin =
it is extremely valuable even for low traffic mailservers. All I am =
saying is, if you run you own Pyzor server that is _not_ connected to =
the public server(s), it will be of no use to you if you are having low =
traffic.

In order for Pyzor/Razor/DCC to identify a message some other =
user/system must have already seen this particular message and reported =
it to Pyzor/Razor/DCC. Only then will your system benefit. So if you run =
your own server with just a few tousand messages, it will surely filter =
some spam but the first one will make it through Pyzor.

Suggestion: If you run a low-traffic mailserver, use the public =
Razor/DCC/Pyzor servers. If your system is really high-traffic, then run =
your own server if possible but sync your checkums with the public =
servers. I am not sure if/how this works with Pyzor, but there should be =
some way...


Regards,
  JP

Re: Running server

[Francisco <li...@na...>]

On Tue, 9 Nov 2004, [iso-8859-1] Lars Holmstr=F6m wrote:

> I really do not support the numbers you are giving.


I think he meant that the system needs hundreds of thousands of emails to=
=20
be effective.

Re: Running server

[<lar...@fl...>]

I really do not support the numbers you are giving.
I run two mailservers. One of them currently accept 400-600 mail per day and
pyzor is a very usable tool that help the users to sort out about 80-120
mails per day.

Spamassassin (that also is configured to use pyzor) sort out another 80-120
mails per day.

The other mailserver accept about 10-30 mail per day, and here pyzor is not
capable of detect most of the spam, but just a few (2-3 per day).

/Lars

----- Original Message ----- 
From: "Jan-Peter Koopmann" <Jan...@se...>
To: "Francisco" <li...@na...>
Cc: "Pyzor User List" <pyz...@li...>
Sent: Tuesday, November 09, 2004 7:07 PM
Subject: RE: Running server


On Tuesday, November 09, 2004 7:08 PM Francisco wrote:

> Which I do.
> Have several "catch all" addresses. Hundreds of emails per day.

Try a few houndred thousand... :-) The entire system depends on all of
us using pyzor (and razor and dcc to be exact), report our hashes etc.
It will not work out if you have your own little database...

>> or if you sync it with the public pyzor servers?
>
> How would that be done?

No idea. Never worked on this.

> I did.
> I opened my firewall to the two IP addresses listed on the archives.

Open incoming UDP packets from *:24441 for a start and try again.

Regards,
  JP


-------------------------------------------------------
This SF.Net email is sponsored by:
Sybase ASE Linux Express Edition - download now for FREE
LinuxWorld Reader's Choice Award Winner for best database on Linux.
http://ads.osdn.com/?ad_idU88&alloc_id065&op=ick
_______________________________________________
pyzor-users mailing list
pyz...@li...
https://lists.sourceforge.net/lists/listinfo/pyzor-users

Multiple IPs in serves file?

[Francisco <li...@na...>]

Do multiple IPs get processed if listed in the servers file?
If so in which order? Top down or bottom up?

RE: Running server

[Jan-Peter K. <Jan...@se...>]

On Tuesday, November 09, 2004 7:08 PM Francisco wrote:

> Which I do.
> Have several "catch all" addresses. Hundreds of emails per day.

Try a few houndred thousand... :-) The entire system depends on all of
us using pyzor (and razor and dcc to be exact), report our hashes etc.
It will not work out if you have your own little database...

>> or if you sync it with the public pyzor servers?
>=20
> How would that be done?

No idea. Never worked on this.

> I did.
> I opened my firewall to the two IP addresses listed on the archives.

Open incoming UDP packets from *:24441 for a start and try again.

Regards,
  JP

RE: Running server

[Francisco <li...@na...>]

On Tue, 9 Nov 2004, Jan-Peter Koopmann wrote:

> Are you aware that running your own server will only benefit you if you
> have "a LOT" of mail

Which I do.
Have several "catch all" addresses. Hundreds of emails per day.

>or if you sync it with the public pyzor servers?

How would that be done?

> The communication issues are firewall related and can be fixed. Check
> the mailing list.

I did.
I opened my firewall to the two IP addresses listed on the archives.

RE: Running server

[Jan-Peter K. <Jan...@se...>]

On  pyz...@li... wrote:

> I am new to pyzor. Tried to use the public server and got
> timeouts. Looked at archives and found others having simmilar
> problems. I figure that I can not depend on an outside server
> so would like to run my own pyzor server.

Are you aware that running your own server will only benefit you if you
have "a LOT" of mail or if you sync it with the public pyzor servers?
Otherwise it will simply not work out for you.

The communication issues are firewall related and can be fixed. Check
the mailing list.

Regards,
  JP

Running server

[Francisco <li...@na...>]

I am new to pyzor. Tried to use the public server and got timeouts. Looked 
at archives and found others having simmilar problems. I figure that I can 
not depend on an outside server so would like to run my own pyzor server.

I use the sample server configuration from the web site.
When try to run the server I get:

Traceback (most recent call last):
   File "/usr/local/bin/pyzord", line 9, in ?
     import pyzor.server
   File "/usr/local/lib/python2.3/site-packages/pyzor/server.py", line 10, 
in ?
     import gdbm
ImportError: No module named gdbm

Are there additional requirements to install the server?
Seems like it needs gdbm?
Does it need py-gdbm too?

RE: Pyzor server not responding

[Jan-Peter K. <Jan...@se...>]

On Tuesday, November 09, 2004 2:34 AM Chris wrote:

> So, which would be the lesser of two evils, opening port
> 24441 on my firewall or making 82.165.246.93 a trusted host?

_If_ 82.165.246.93 is constant then allowing 24441 from that host only
would be the best solution. However I do not recall having seen an
announcement of this behaviour. So either it is bound to change again
without prior notice or this is something weird like a hacked system.=20

Is there no way to get an official statement from the Pyzor people? This
behaviour is extremely annoying. If I communicate with one IP I expect
the answer to come from that IP as well. Why did this change?

Kind regards,
 JP

Spamtrap account and local server

[Francisco <li...@na...>]

Reading more it seems that Pyzor depends on bad emails been fed into the 
system.

Will future spam email need to be identical to be flagged?
If a spam is sent to the spamprobe account, will the same spam need to be 
idential, except for the "To:" address to be picked up by Pyzor?

Is there any advantage at all to run a local server instead of the public 
one? It would seem the system depends on getting spam messages and to have 
such messages marked as spam for it to work.

What are good places to put the spamtrap account? Any popular newsgroup?

For starters could I bounce the thousands of spam messages I already have 
received to the spamprobe account? Get a couple of hundreds per day.

Confused on setup and concepts

[Francisco <li...@na...>]

Just discovered pyzor today.

For starters I am confused about the concept of the program.
I understand that it uses a hash to check against other spams at a central 
server, but I don't understand how one marks new messages as spam. Also 
noticed upon installation (FreeBSD port) that there is a client and a 
server. Do I need to run the server at my machine?

From the sample at http://www.archeus.plus.com/colin/pydoc/howto it seems 
pyzor is to be called by procmail. Is there a way to make it work with 
Fetchmail instead?

Is Pyzor a filter?
Let me see if I understand it..

Incoming email
  |
  |
MTA
  |
  |
procmail
  |
  |
pyzor
  |
  |
mail box

Is that it?

Re: Pyzor server not responding

[Chris <cpo...@ea...>]

On Monday 08 November 2004 09:36 am, Jan-Peter Koopmann wrote:
> On Monday, November 08, 2004 4:07 PM Seanster wrote:
> >> pyzor ping
> >
> > 217.160.253.84:24441    (200, 'OK')
>
> Ok. I figured it out. I am sending requests to
>
> 217.160.253.84:24441 but the replys come from
>
> 82.165.246.93
>
> which is why our firewall could not match this to its session table.
>
> Is this new behaviour? It definately worked without me opening up the
> firewall for all inbound traffic to 24441...
>

Ah, this solves one of the mysteries on my box.  My syslog is full of the=
se=20
from the past few days:

Nov  8 18:06:50 cpollock kernel: IN=3Deth0 OUT=3D=20
MAC=3D00:50:fc:2c:93:ee:00:a0:c5:4a:7b:43:08:00 SRC=3D82.165.246.93=20
DST=3D192.168.1.2 LEN=3D92 TOS=3D0x00 PREC=3D0x00 TTL=3D52 ID=3D0 DF PROT=
O=3DUDP=20
SPT=3D24441 DPT=3D47889 LEN=3D72=20
Nov  8 18:15:48 cpollock kernel: IN=3Deth0 OUT=3D=20
MAC=3D00:50:fc:2c:93:ee:00:a0:c5:4a:7b:43:08:00 SRC=3D82.165.246.93=20
DST=3D192.168.1.2 LEN=3D93 TOS=3D0x00 PREC=3D0x00 TTL=3D52 ID=3D0 DF PROT=
O=3DUDP=20
SPT=3D24441 DPT=3D47909 LEN=3D73=20
Nov  8 18:19:16 cpollock kernel: IN=3Deth0 OUT=3D=20
MAC=3D00:50:fc:2c:93:ee:00:a0:c5:4a:7b:43:08:00 SRC=3D82.165.246.93=20
DST=3D192.168.1.2 LEN=3D91 TOS=3D0x00 PREC=3D0x00 TTL=3D52 ID=3D0 DF PROT=
O=3DUDP=20
SPT=3D24441 DPT=3D47930 LEN=3D71=20

So, which would be the lesser of two evils, opening port 24441 on my=20
firewall or making 82.165.246.93 a trusted host?


--=20
Chris
Registered Linux User 283774 http://counter.li.org
7:30pm up 4 days, 23:56, 2 users, load average: 1.02, 0.92, 0.73
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Practice yourself what you preach.
=09=09-- Titus Maccius Plautus
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Live - From Virgin Radio UK Satus Quo - Whatever you want

RE: Pyzor server not responding

[Jan-Peter K. <Jan...@se...>]

On Monday, November 08, 2004 4:07 PM Seanster wrote:

>> pyzor ping
> 217.160.253.84:24441    (200, 'OK')

Ok. I figured it out. I am sending requests to

217.160.253.84:24441 but the replys come from

82.165.246.93

which is why our firewall could not match this to its session table.

Is this new behaviour? It definately worked without me opening up the
firewall for all inbound traffic to 24441...

Regards,
  JP

Re: Pyzor server not responding

[Andreas S. <sch...@fa...>]

On Mon, 8 Nov 2004, Jan-Peter Koopmann wrote:

> is it just me or is the Pyzor server having a problem? ...
> proxy:~ # pyzor ping
> 217.160.253.84:24441    TimeoutError:

sch...@ww...:~$ pyzor ping
217.160.253.84:24441    (200, 'OK')

:)

-- 
-- Andreas

Pyzor server not responding

[Jan-Peter K. <Jan...@se...>]

Hi,

is it just me or is the Pyzor server having a problem?

proxy:~ # pyzor discover
downloading servers from
http://pyzor.sourceforge.net/cgi-bin/inform-servers-0-3-x
proxy:~ # pyzor ping
217.160.253.84:24441    TimeoutError:=20

Regards,
  JP