pyzor-users — general discussion of Pyzor and Pyzor-related topics

Re: report globally, check locally?

[Thomas G. <gu...@th...>]

On Tue, Oct 19, 2004 at 10:30:12AM -0400, Paul Bissex wrote:
> Hi all,
> 
> On my mailserver I collect spam via ~300 spamtrap addresses, feeding
> these messages directly to "pyzor report" via procmail. Recently I
> have switched to running pyzord locally for performance and
> reliability reasons. The "reliability" part is actually twofold --
> one, I was seeing timeouts on 5 - 10% of connection attempts at times;
> two, I realized that I had a very good local stream of data and was
> not gaining that much from the remote checks.
> 
> However, I would also like to be useful to the pyzor community and so
> I'm considering setting things up so that inbound mail (excepting
> spamtrap mail) is checked against the local db, while spamtrap mail is
> reported to both.

Hi,

I thought about this, too. It would be nice to have this feature. 


Regards,
 Thomas

-- 
Thomas Guettler <gu...@th...>
http://www.thomas-guettler.de

Re: report globally, check locally?

[Frank T. <ft...@ne...>]

Paul Bissex, on 2004-10-19, wrote:

> However, I would also like to be useful to the pyzor community and so 
> I'm considering setting things up so that inbound mail (excepting 
> spamtrap mail) is checked against the local db, while spamtrap mail is 
> reported to both.

That sounds like a good ability to have.  Duly noted.

-- 
Frank

Re: No more pyzor blocks

[<lar...@fl...>]

My problem was something else.

I run pyzor from procmail and I have some 200+ useraccounts all with the=
ir
own Maildir.
The problem was that the users .pyzor/servers file was missing.
This problem is now solved after I created a softlink in each users
directory to a master file that now contain the valid pyzor servers IP.

/Lars

----- Original Message ----- 
From: <Fra...@co...>
To: <pyz...@li...>
Sent: Friday, October 22, 2004 10:19 AM
Subject: Re: No more pyzor blocks


I had the same problem. I found out that the problem was that spamasssas=
sin
(running as user "filter") was not able to start /usr/bin/pyzor because =
of:
-rx--x--x and it seemed that also r is needed. I dont know why this happ=
en
since July, but after a "chmod a+r /usr/bin/pyzor" it work again

Frank

>Yes,
>
>July 28    40 blocks
<July 29     8 blocks
>July 30    none
>
> After July 30 a total of 2 blocks (Aug 15 and Aug 30).
>
> /Lars
> ----- Original Message -----
> From: "Frank Tobin" <ftobin@ne...>
> To: <pyzor-users@li...>
> Sent: Sunday, September 05, 2004 9:55 PM
> Subject: Re: No more pyzor blocks
>
>
> Lars Holmstr=F6m, on 2004-09-05, wrote:
>
> > After July 27 the number of mail blocked each day went down from a
minimum
> > of 40 to almost 0. Actually only 2 messages has been blocked after J=
uly
> 27.
> ...
> > Any suggestions why this happend ?
>
> Was it a steep die-off?  E.g., did it happen all in one day?
>
> The pyzor server database appears to not had any significant change in=
 the
> growth rate (which would correlate with the number of reported spams).
>
> --
> Frank


-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give u=
s
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out m=
ore
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
pyzor-users mailing list
pyz...@li...
https://lists.sourceforge.net/lists/listinfo/pyzor-users

Re: No more pyzor blocks

[<Fra...@co...>]

I had the same problem. I found out that the problem was that =
spamasssassin
(running as user "filter") was not able to start /usr/bin/pyzor because =
of:
-rx--x--x and it seemed that also r is needed. I dont know why this =
happen
since July, but after a "chmod a+r /usr/bin/pyzor" it work again

Frank

>Yes,
>
>July 28    40 blocks
<July 29     8 blocks
>July 30    none
>=20
> After July 30 a total of 2 blocks (Aug 15 and Aug 30).
>=20
> /Lars
> ----- Original Message -----
> From: "Frank Tobin" <ftobin@ne...>
> To: <pyzor-users@li...>
> Sent: Sunday, September 05, 2004 9:55 PM
> Subject: Re: No more pyzor blocks
>=20
>=20
> Lars Holmstr=F6m, on 2004-09-05, wrote:
>=20
> > After July 27 the number of mail blocked each day went down from a
minimum
> > of 40 to almost 0. Actually only 2 messages has been blocked after =
July
> 27.
> ...
> > Any suggestions why this happend ?
>=20
> Was it a steep die-off?  E.g., did it happen all in one day?
>=20
> The pyzor server database appears to not had any significant change =
in the
> growth rate (which would correlate with the number of reported =
spams).
>=20
> --
> Frank

report globally, check locally?

[Paul B. <pau...@gm...>]

Hi all,

On my mailserver I collect spam via ~300 spamtrap addresses, feeding
these messages directly to "pyzor report" via procmail. Recently I
have switched to running pyzord locally for performance and
reliability reasons. The "reliability" part is actually twofold --
one, I was seeing timeouts on 5 - 10% of connection attempts at times;
two, I realized that I had a very good local stream of data and was
not gaining that much from the remote checks.

However, I would also like to be useful to the pyzor community and so
I'm considering setting things up so that inbound mail (excepting
spamtrap mail) is checked against the local db, while spamtrap mail is
reported to both.

Anybody doing anything like this?  Caveats or suggestions?

pb


--=20
paul bissex, e-scribe.com -- database-driven web development
413.585.8095
69.55.225.29
01061-0847
72=B039'71"W 42=B019'42"N

Re: Pyzor project status?

[Paul B. <pau...@gm...>]

On Tue, 05 Oct 2004 10:35:27 -0700, Mark Nienberg <ma...@ti...> wro=
te:
> On 5 Oct 2004 at 9:42, Paul Bissex wrote:
> > But activity seems very low, and as somebody noted in September (I
> > looked at the archives), this includes reporting activity, which in
> > turn makes it a lot less useful.
>=20
> I think activity on the mailing list is low because pyzor is a fairly mat=
ure product that
> works well.  It is easy to set up, and it doesn't seem to need much devel=
opment.

Cool, thanks. That makes sense. (Thanks to Tim for his offlist reply too).=
=20

If anybody out there is running Pyzor with Postfix (not as part of SA,
but standalone), I'd be interested in seeing configuration details.=20
I'll hit the Postfix list if I don't hear anything here.

thanks

pb

--=20
paul bissex, e-scribe.com -- database-driven web development
413.585.8095
69.55.225.29
01061-0847
72=B039'71"W 42=B019'42"N

Re: Pyzor project status?

[Mark N. <ma...@ti...>]

On 5 Oct 2004 at 9:42, Paul Bissex wrote:
> But activity seems very low, and as somebody noted in September (I
> looked at the archives), this includes reporting activity, which in
> turn makes it a lot less useful.

I think activity on the mailing list is low because pyzor is a fairly mature product that 
works well.  It is easy to set up, and it doesn't seem to need much development.

I use MailScanner for virus and spam control on our company mail server.  
MailScanner can use of SpamAssassin for improved spam checking.  
SpamAssassin can use Pyzor and other programs as plug-ins to improve its 
accuracy.  I use DCC as well as Pyzor with our SpamAssassin.  The logs of my mail 
server verify that Pyzor is triggered on many spam messages, so I think the reporting 
is sufficient. 
-- 
Mark W. Nienberg, SE
Tipping Mar + associates
1906 Shattuck Ave
Berkeley, CA 94704
510 549-1906 ext 236
http://www.tippingmar.com

Pyzor project status?

[Paul B. <pau...@gm...>]

Hi all,

I feel like I'm a little late to the party, but regardless I just
started checking out Pyzor. For various reasons I am leaning toward it
over Razor and DCC.  If it ends up seeming worthwhile I'd like to add
it to my Postfix anti-spam setup, loosely documented here:
http://e-scribe.com/antispam/

But activity seems very low, and as somebody noted in September (I
looked at the archives), this includes reporting activity, which in
turn makes it a lot less useful.

At the moment I've got a spamtrap account with procmail running "pyzor
report" on each incoming message (hence all the one-counts below):

  formail -s pyzor check < ~spamtrap/mbox

217.160.253.84:24441    (200, 'OK')     81      0
217.160.253.84:24441    (200, 'OK')     1       0
217.160.253.84:24441    (200, 'OK')     1       0
217.160.253.84:24441    (200, 'OK')     1       0
217.160.253.84:24441    (200, 'OK')     1       0
217.160.253.84:24441    (200, 'OK')     1       0
217.160.253.84:24441    (200, 'OK')     1       0
217.160.253.84:24441    (200, 'OK')     1       0
217.160.253.84:24441    (200, 'OK')     1       0
217.160.253.84:24441    (200, 'OK')     17409   0
217.160.253.84:24441    (200, 'OK')     17409   0
217.160.253.84:24441    (200, 'OK')     589     0
217.160.253.84:24441    (200, 'OK')     1       0
217.160.253.84:24441    (200, 'OK')     1       0
217.160.253.84:24441    (200, 'OK')     1       0
217.160.253.84:24441    (200, 'OK')     556     0
217.160.253.84:24441    (200, 'OK')     626     0
217.160.253.84:24441    (200, 'OK')     1       0
217.160.253.84:24441    (200, 'OK')     1       0
217.160.253.84:24441    (200, 'OK')     1       0
217.160.253.84:24441    (200, 'OK')     1       0

So anyway, before I launch into my specific questions I thought I'd
ping the list and make sure this is worth pursuing. Anybody out there?

Regards

pb

--=20
paul bissex, e-scribe.com -- database-driven web development
413.585.8095
69.55.225.29
01061-0847
72=B039'71"W 42=B019'42"N

Re: No more pyzor blocks

[<lar...@fl...>]

Yes,

July 28    40 blocks
July 29     8 blocks
July 30    none

After July 30 a total of 2 blocks (Aug 15 and Aug 30).

/Lars
----- Original Message ----- 
From: "Frank Tobin" <ft...@ne...>
To: <pyz...@li...>
Sent: Sunday, September 05, 2004 9:55 PM
Subject: Re: No more pyzor blocks


Lars Holmstr=F6m, on 2004-09-05, wrote:

> After July 27 the number of mail blocked each day went down from a min=
imum
> of 40 to almost 0. Actually only 2 messages has been blocked after Jul=
y
27.
...
> Any suggestions why this happend ?

Was it a steep die-off?  E.g., did it happen all in one day?

The pyzor server database appears to not had any significant change in t=
he
growth rate (which would correlate with the number of reported spams).

-- 
Frank

Re: No more pyzor blocks

[Frank T. <ft...@ne...>]

Lars Holmstr=F6m, on 2004-09-05, wrote:

> After July 27 the number of mail blocked each day went down from a minimu=
m
> of 40 to almost 0. Actually only 2 messages has been blocked after July 2=
7.
=2E..
> Any suggestions why this happend ?

Was it a steep die-off?  E.g., did it happen all in one day?

The pyzor server database appears to not had any significant change in the=
=20
growth rate (which would correlate with the number of reported spams).

--=20
Frank

No more pyzor blocks

[<lar...@fl...>]

After July 27 the number of mail blocked each day went down from a minimum
of 40 to almost 0. Actually only 2 messages has been blocked after July 27.

And, Yes, I am running pyzor discover every night.

Any suggestions why this happend ?
Any way to see what is wrong ?

/Lars

Re: alternative server

[Frank T. <ft...@ne...>]

Eugene Filatov, on 2004-08-20, wrote:

> I got new file, but I still have no answer from server (ACL is fixed for a
> new server)
>
> [21:16] eugenef->pts/3-># snoop host 217.160.253.84
> Using device /dev/hme (promiscuous mode)
> x.paco.net -> colo.buberel.org UDP D=24441 S=60276 LEN=173
> x.paco.net -> colo.buberel.org UDP D=24441 S=60628 LEN=173
> x.paco.net -> colo.buberel.org UDP D=24441 S=60671 LEN=173

*Now* I'm at a loss as to what the problem could be.  You are definitely 
talking with the right server...


-- 
Frank

Re: alternative server

[Eugene F. <eu...@pa...>]

On Fri, 20 Aug 2004, Frank Tobin wrote:

> > Hm. I got the same server (66.250.40.33) from
> > http://pyzor.sourceforge.net/cgi-bin/inform-servers-0-3-x
> My mistake; I never modified the appropriate file...it should be fixed
> now.

I got new file, but I still have no answer from server (ACL is fixed for a
new server)

[21:16] eugenef->pts/3-># snoop host 217.160.253.84
Using device /dev/hme (promiscuous mode)
x.paco.net -> colo.buberel.org UDP D=24441 S=60276 LEN=173
x.paco.net -> colo.buberel.org UDP D=24441 S=60628 LEN=173
x.paco.net -> colo.buberel.org UDP D=24441 S=60671 LEN=173

> Thanks for the heads up!
Thanks for your help :-)

Best Regards, 					mailto:eu...@pa...
	Eugene.

Re: alternative server

[Frank T. <ft...@ne...>]

Eugene Filatov, on 2004-08-20, wrote:

> Hm. I got the same server (66.250.40.33) from
> http://pyzor.sourceforge.net/cgi-bin/inform-servers-0-3-x

My mistake; I never modified the appropriate file...it should be fixed 
now.

Thanks for the heads up!

-- 
Frank

Re: alternative server

[Eugene F. <eu...@pa...>]

On Fri, 20 Aug 2004, Frank Tobin wrote:

> > All works well with my firewall till the end of June. Since end of June
> > I do not get any responses from  66.250.40.33  :(
> Ah, you need to run 'pyzor discover', as there is a new server being used.

Hm. I got the same server (66.250.40.33) from
http://pyzor.sourceforge.net/cgi-bin/inform-servers-0-3-x

Best Regards, 					mailto:eu...@pa...
	Eugene.

Re: alternative server

[Frank T. <ft...@ne...>]

Eugene Filatov, on 2004-08-20, wrote:

>>> With tcpdump I see outbound packets but no inbount packets :(
>>> -> 66.250.40.33 UDP D=24441 S=41979 LEN=173
>> Are you firewalling out UDP packets?  I doubt that using a different
> Yes. I have in my ACL the following string:
>
> permit udp  host 66.250.40.33 eq 24441 host 195.114.x.x
>
> All works well with my firewall till the end of June. Since end of June
> I do not get any responses from  66.250.40.33  :(

Ah, you need to run 'pyzor discover', as there is a new server being used.

-- 
Frank

Re: alternative server

[Eugene F. <eu...@pa...>]

On Thu, 19 Aug 2004, Frank Tobin wrote:

> > I found that my pyzoe client does not get any responses from server.
> > With tcpdump I see outbound packets but no inbount packets :(
> > -> 66.250.40.33 UDP D=24441 S=41979 LEN=173
> Are you firewalling out UDP packets?  I doubt that using a different
Yes. I have in my ACL the following string:

permit udp  host 66.250.40.33 eq 24441 host 195.114.x.x

All works well with my firewall till the end of June. Since end of June
I do not get any responses from  66.250.40.33  :(

> server would help, unless the server is simply not responding to you at
> all (but it seems to be fully functional).



>
> --
> Frank
>
>
> -------------------------------------------------------
> SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
> 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
> Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
> http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
> _______________________________________________
> pyzor-users mailing list
> pyz...@li...
> https://lists.sourceforge.net/lists/listinfo/pyzor-users
>


Best Regards, 					mailto:eu...@pa...
	Eugene.

Re: alternative server

[Frank T. <ft...@ne...>]

Eugene Filatov, on 2004-08-19, wrote:

> I found that my pyzoe client does not get any responses from server.
> With tcpdump I see outbound packets but no inbount packets :(
>
> -> 66.250.40.33 UDP D=24441 S=41979 LEN=173

Are you firewalling out UDP packets?  I doubt that using a different 
server would help, unless the server is simply not responding to you at 
all (but it seems to be fully functional).

-- 
Frank

alternative server

[Eugene F. <eu...@pa...>]

Hello.

I found that my pyzoe client does not get any responses from server.
With tcpdump I see outbound packets but no inbount packets :(

 -> 66.250.40.33 UDP D=24441 S=41979 LEN=173

Is it possible to use alternative server?

Best Regards, 					mailto:eu...@pa...
	Eugene.

pyzor discover using HTTP proxy?

[<ha...@de...>]

We're planning on running pyzor from behind a firewall and would like to
use an HTTP proxy for letting pyzor update its server configuration.

Is there a way of having 'pyzor discover' go over an (authenticating)
http proxy instead of making a direct request?
If not, is there a recommended work-around by using wget oder LWP (or
similar cmd line tools) for updating the server config?

Cheers - Harry

RE: please help with firewall setup

[Chris W. P. <cp...@sw...>]

Frank Tobin <mailto:ft...@ne...>
    on Monday, July 05, 2004 7:51 PM said:

> When pyzor is talking with pyzor.sourceforge.net, it is going to talk
> with TCP port 80.  If you can view http://pyzor.sourceforge.net/ via
> your box, then the pyzor client should be able to 'discover' properly.

well that's not good news. i did both 'wget pyzor.sourceforge.net' and
'wget http://pyzor.sourceforge.net/cgi-bin/inform-servers-0-3-x' and was
able to download files with no problems.

what else could it be?


thanks,
chris.

Re: please help with firewall setup

[Frank T. <ft...@ne...>]

Chris W. Parker, on 2004-06-30, wrote:

> i've tried allowing all traffic on UDP 24441 in and out of the network
> but that didn't work. then i tried allowing all traffic between
> 66.35.250.209 (pyzor.sourceforge.net/projects.sourceforge.net) and my
> linux server (10.0.0.9). but that didn't work either.
> 
> when i run 'pyzor discover' it just sits there for a long time and then
> finally says "No servers available! Maybe try the 'discover' command".

When pyzor is talking with pyzor.sourceforge.net, it is going to talk with
TCP port 80.  If you can view http://pyzor.sourceforge.net/ via your box, 
then the pyzor client should be able to 'discover' properly.

-- 
Frank Tobin			http://www.neverending.org/~ftobin/

please help with firewall setup

[Chris W. P. <cp...@sw...>]

hello,

ok i'm not very good with firewall configuration so i think i've got
something setup incorrectly. the linux box that pyzor is running on
currently has iptables turned off. so as i understand it there should be
no blocking of IP traffic occuring at all at this point. this box
however does sit behind a Sonicwall SOHO3 and i think this is where my
problem is.

i've tried allowing all traffic on UDP 24441 in and out of the network
but that didn't work. then i tried allowing all traffic between
66.35.250.209 (pyzor.sourceforge.net/projects.sourceforge.net) and my
linux server (10.0.0.9). but that didn't work either.

when i run 'pyzor discover' it just sits there for a long time and then
finally says "No servers available! Maybe try the 'discover' command".

i am currently using pyzor 0.4.0 with mailscanner, spamassassin, and
sendmail.


thanks for your help.
chris.

Newbee: Configuration questions

[Harald A. <li...@ar...>]

Hi I am new at this list.

Today I installed pyzor on a SuSE 9.0 to work together with
amavis_new amavisd-new-20030616-p5, spamassasion 2.63, razor 
2.40, dcc 1.2.50 and pyzor 0.40.

My only steps till now for configuration of pyzor was to
set free ports 24441 upd outgoing to servers and the same
port tcp for incoming on my firewall. Also after installation
I called pyzor discover to get a list of servers and make a
test pre "spamassassin -D < spam.txt".

My question:

I want to set configuration file to my amavis environment
in /var/spool/amavis in subdirectoy ".pyzor". 

1) I think that I have to set a path for this configuration 
file in /etc/mail/spamassassin/local.cf to find it when 
pyzor is called by SA. 
2) Also I want to be called as the same user as amavis_new:
vscan
3) Is there an IP-table of all possible pyzor-servers used 
to check mails ?
4) There is also an daemon version of pyzor. How can I use
this in my configuration
5) Once I started the daemon and I saw a log-file. How can
I configurate pyzor(d) to use this file fo logging AND
debugging.
6) How can I really check if pyzor is used out of SA and
out of amavis_new

Thanks Harald

Pyzor with Postfix

[Zane K. <zan...@al...>]

I'd like to use Pyzor as a Postfix 2.1.3 filter. The catch is, I'd like
to do it without using SpamAssassin.

Postfix command-based filters must accept the contents of the message as
standard input and return the mail to Postfix using the sendmail
command. Pyzor doesn't seem to work this way.

Does anyone have experience using Pyzor "naked"?

Any tips will be greatly appreciated.

Zane