[SAtalk] random localpart in TO address

2003-11-11 Thread Thomas Kinghorn
Hi List. Does anyone know of a way to block mail sent to an invalid, random localpart. E,G. [EMAIL PROTECTED] [EMAIL PROTECTED] We are getting a lot of mails with TO addresses like the ones above. I know how to stop the ones ending in digits but not these ones. Any help appreciated. Many

[SAtalk] need rule for forged FROM's using domain on server

2003-11-11 Thread Debbie D
Spamassassin 2.54 Cobalt Raq4 w/sendmail, mailscanner, Clam antivirus I need very badly a rule that will check for forged FROM as being a domain on my server.. I get tons like this daily.. I saw one on someone's web site or here on the group last week, copied it then the computer locked up before

[SAtalk] order of preferences in white / black listing

2003-11-11 Thread Tristan Nixon
Hello all, I have a question regarding the way in which SA deals with whitelisting blacklisting. If I want to whitelist all but a few select entries from a domain, how would I do it. Should the following work? whitelist_from [EMAIL PROTECTED] unwhitelist_from [EMAIL PROTECTED] unwhitelist_from

Re: [SAtalk] logging issues... found answer to my prob..but why?

2003-11-11 Thread Mitchell D. Baker
Found the problem.. user error.. I thought I had taken the -t option off of the syslog startup.. So sometime after the first time, when I manually started syslogd to test this.. I restarted syslogd from the init script and started running again with the -t option disallowing connections Why

[SAtalk] Re: Trouble restarting spamd

2003-11-11 Thread Debbie D
Thanks.. ut yes Ishold have stated that.. stop start.. [root admin]# /etc/rc.d/init.d/spamd stop Shutting down spamd: ok [root admin]# /etc/rc.d/init.d/spamd start Starting spamd: spamdCould not create INET socket: Address already in use IO::Socket::INET: Address already in use Any other

RE: [SAtalk] Delete spam mails

2003-11-11 Thread Colin A. Bartlett
Frank Pineau Sent: Monday, November 10, 2003 11:16 AM x sips for every [EMAIL PROTECTED]@ spam you stop. I don't get spam with that any more. Mine all comes advertising sildenafil citrate. :/ Which is why I added a while ago: body SILDENAFIL_CITRATE /sildenafil citrate/i describe

[SAtalk] spamassassin

2003-11-11 Thread Maximo Lopez
hello ther I already install the spamassassing , I use the automatic way cpan, then I modify the procmail as the example http://spamassassin.org/dist/procmailrc.example, but I still receive Spam , what should I check ??? regards --- This

RE: [SAtalk] Automatic Unsubscribe

2003-11-11 Thread Colin A. Bartlett
Bart Schaefer Sent: Saturday, November 08, 2003 2:39 PM It would have been more interesting if you had used different tagged addresses for each of the unsubscribes, so you could track which one was the culprit, and look for similarities in the headers of the pre- and post- unsubscribe spams

[SAtalk] Spamassassin Shutting Down spamd ERROR!

2003-11-11 Thread Rajdeep Larha
I installed SpamAssassin as per the documentations available at thespamassassin.org. I installed all the dependent modules and it installedfine w/o any error,I checked and verified using the command listed in the USAGE file i.e.#Mail-SpamAssassin-2.60# spamassassin -t sample-nonspam.txt

[SAtalk] FROM_AND_TO_SAME Rule does not seem to work

2003-11-11 Thread Derek Jennings
I have upgraded to 2.60 because this was driving me crazy in 2.55, but the problem seems to be still there. Most of the few spams that make it to my inbox are from some_name my_emailaddy These trigger the AWL test and come in with a low score, and are not detected by the FROM_AND_TO_SAME test

[SAtalk] [MailServer Notification]To recipient: Message matched eManager setting and action was taken.

2003-11-11 Thread Administrator
eManager Notification * The following mail was blocked since it contains sensitive content. Source mailbox: Frank Pineau Destination mailbox(es): [EMAIL PROTECTED] Rule/Policy: Profanity Action: Quarantine to F:\Program

[SAtalk] whitelist_to stopped working

2003-11-11 Thread Guy Cohen
Hi, We have spamassassin enable for all the domains at our site, but only few domains require it's usage. Therefor most of the domains have a whitelist_to [EMAIL PROTECTED] entry in the .cf file that is being updated nightly from our database. After the last upgrade the whitelist_to stopped

[SAtalk] Problem while configuring Spamassassin Shutting Down spamd ERROR!

2003-11-11 Thread Rajdeep Larha
I installed SpamAssassin as per the documentations available at thespamassassin.org. I instaleld all the dependent modules and it installedfine w/o any error,I checked and verified using the command listed in the USAGE file i.e. #Mail-SpamAssassin-2.60# spamassassin -t sample-nonspam.txt

[SAtalk] Umlaut on subjects

2003-11-11 Thread Leonardo H. Machado
Hi, is there a way to block subjects with Umlauted Letters like: ö ü ä (sorry if it's messesd after mailing) The spammers are Umlauting words like Viägra. Those Umlauts are quite difficult to detected. They are converted to ISO Code, or whatever. In my language there is no Umlauts. So, it's

Re: [SAtalk] order of preferences in white / black listing

2003-11-11 Thread David B Funk
On Sun, 9 Nov 2003, Tristan Nixon wrote: Hello all, I have a question regarding the way in which SA deals with whitelisting blacklisting. If I want to whitelist all but a few select entries from a domain, how would I do it. Should the following work? whitelist_from [EMAIL PROTECTED]

Re: [SAtalk] Re: Trouble restarting spamd

2003-11-11 Thread David B Funk
On Sat, 8 Nov 2003, Debbie D wrote: Thanks.. ut yes Ishold have stated that.. stop start.. [root admin]# /etc/rc.d/init.d/spamd stop Shutting down spamd: ok [root admin]# /etc/rc.d/init.d/spamd start Starting spamd: spamdCould not create INET socket: Address already in use

Re: [SAtalk] [MailServer Notification]To recipient: Message matched eManager setting and action was taken.

2003-11-11 Thread David B Funk
On Mon, 10 Nov 2003 [EMAIL PROTECTED] wrote: eManager Notification * The following mail was blocked since it contains sensitive content. Love the stupid -PC- double-talk here. Gee, what was the content sensitive to? (is it sensitve to light, heat, shock...)

[SAtalk] Training system-wide Bayesian filters?

2003-11-11 Thread Martyn Drake
Hi, I was wondering how I can use sa-learn to train a system-wide Bayesian database? The way I've set-up SA at the moment is that each user has a .forward file which runs |/usr/bin/procmail -f- and that in turn reads the .procmailrc file containing the recipie to forward the mail to spamc.

[SAtalk] html mails getting through

2003-11-11 Thread Thomas Kinghorn
Hi list. I have attached a spam i keep getting, from different senders. This keeps getting through and I cannot find a way to deny it. I am running SA-2.60, exim 4.24 and the exiscan patch with sa-exim-3.1. The SA server is the gatewauy to our exchange mailboxes. Any help on this appreciated.

RE: [SAtalk] Is punctuation really needed? (fwd)

2003-11-11 Thread Colin A. Bartlett
Chris Santerre [EMAIL PROTECTED] wrote: -Original Message- From: Bill Larson [mailto:[EMAIL PROTECTED] 1.Spamassassins reads in the message 2. It then stores the original message in two variables 3. In the second variable remove all punctuation, spaces, special encoded

Re: [SAtalk] Training system-wide Bayesian filters?

2003-11-11 Thread Johann Spies
On Tue, Nov 11, 2003 at 09:39:42AM +, Martyn Drake wrote: I was wondering how I can use sa-learn to train a system-wide Bayesian database? The way I've set-up SA at the moment is that each user has a .forward file which runs |/usr/bin/procmail -f- and that in turn reads the

RE: [SAtalk] sa-learn --rebuild --force-expire stuck using huge memory?

2003-11-11 Thread Bill Polhemus
This sounds like my earlier problem trying to sa-learn large mailboxes. Others here commented that it must be a hardware problem, but my box is fairly new with very decent components (built from scratch by me but with good MB and memory, etc.) and nothing else I do, including using X, gives it

Re: [SAtalk] FROM_AND_TO_SAME Rule does not seem to work

2003-11-11 Thread Kenneth Porter
--On Sunday, November 09, 2003 12:01 AM + Derek Jennings [EMAIL PROTECTED] wrote: These trigger the AWL test and come in with a low score, and are not detected by the FROM_AND_TO_SAME test which ought to find them. That test looks like it compares the entire From and To line, not just the

Re: [SAtalk] Is punctuation really needed? (fwd)

2003-11-11 Thread Marcio Merlone
On Tue, 11 Nov 2003 05:25:57 -0500 Colin A. Bartlett [EMAIL PROTECTED] wrote: (...) I have a client who can NEVER seem to get spacing down. I don't know if he can't type well or what but he always misses spaces after sentences, never uses the right punctuation, etc. Much like this example

DynaBlock strategy (was: Re: [SAtalk] Looking for Rules)

2003-11-11 Thread Mark
- Original Message - From: Matt Kettler [EMAIL PROTECTED] To: Bob Rosenberg [EMAIL PROTECTED]; Spamassassin mailing list [EMAIL PROTECTED] Sent: Monday, November 10, 2003 11:55 PM Subject: Re: [SAtalk] Looking for Rules So as not to hijack the original thread, I will start a new one.

[SAtalk] ok_locales

2003-11-11 Thread Sergey V. Baldin
How to activate localization: ok_locales on|off? --- This SF.Net email sponsored by: ApacheCon 2003, 16-19 November in Las Vegas. Learn firsthand the latest developments in Apache, PHP, Perl, XML, Java, MySQL, WebDAV, and more!

Re: [SAtalk] Re: scoring system and values...

2003-11-11 Thread Terry Milnes
Lukreme wrote: On 10 Nov 2003, at 07:33, Terry Milnes wrote: The typical user is capable of making toast in his electric toaster, but when it comes to the overwhelming complexities involved in operating a computer he is totally lost. He will become extremely agitated when he looses the *REALLY

Re: [SAtalk] scoring system and values...

2003-11-11 Thread Terry Milnes
I have been considering using the bayes site wide, however I have seen a lot of opinions that oppose its use this way. Furthermore I did/do have doubts as to how well it would work. There is no way that I can allow users to add their own mail to the corpus, they'll screw it up. I guess I

[SAtalk] SA MimeDefang

2003-11-11 Thread webmaster
Does anyone know of a good (complete) Administration how-to that covers SpamAssassin called via MimeDefang working with Sendmail? I've got it all up and running, but I get the feeling I'm really missing the tuning and maintenance part of the equation. --- An insult from an idiot is equal to

[SAtalk] What Dynamic IPs rbl list?

2003-11-11 Thread Marcio Merlone
Hello! I was wondering what rbl lists you guys use to block dynamic IP ranges. I will use it on a gateway relay-only server, which makes anti-virus and anti-spam and then forwards messages to end server. It's a postfix box. The intention is to disallow any adsl, dial-up or dynamic/static address

Re: [SAtalk] Problem while configuring Spamassassin Shutting Down spamd ERROR!

2003-11-11 Thread Terry Milnes
and what happens when you run spamd -D from the command line? Rajdeep Larha wrote: I installed SpamAssassin as per the documentations available at the spamassassin.org. I instaleld all the dependent modules and it installed fine w/o any error, I checked and verified using the command listed in

Re: [SAtalk] What Dynamic IPs rbl list?

2003-11-11 Thread Christopher M. Iarocci
I use dialups.visi.com and dynablock.easynet.nl. - Original Message - From: Marcio Merlone [EMAIL PROTECTED] To: SA List [EMAIL PROTECTED] Sent: Tuesday, November 11, 2003 9:30 AM Subject: [SAtalk] What Dynamic IPs rbl list? Hello! I was wondering what rbl lists you guys use to

Re: [SAtalk] ok_locales

2003-11-11 Thread Matt Kettler
At 06:07 AM 11/11/2003, Sergey V. Baldin wrote: How to activate localization: ok_locales on|off? It's not an on/off thing, you need to pick a list of locales that are ok.. The current list of locales is: en - Western character sets in general ja - Japanese character sets

RE: [SAtalk] html mails getting through

2003-11-11 Thread Chris Santerre
Hi list. I have attached a spam i keep getting, from different senders. This keeps getting through and I cannot find a way to deny it. *snip* Regards, Tom Kinghorn It seems to be plain text, not HTML. It has the yahoo redirect that has been discussed recently. There is a rule for it

Re: [SAtalk] What Dynamic IPs rbl list?

2003-11-11 Thread Matt Kettler
At 09:30 AM 11/11/2003, Marcio Merlone wrote: I was wondering what rbl lists you guys use to block dynamic IP ranges. I will use it on a gateway relay-only server, which makes anti-virus and anti-spam and then forwards messages to end server. It's a postfix box. dynablock seems to work pretty well

Re: [SAtalk] html mails getting through

2003-11-11 Thread Matt Kettler
At 04:56 AM 11/11/2003, Thomas Kinghorn wrote: I have attached a spam i keep getting, no, you've quoted it in text-only form without all the headers... All I can tell from what you posted is it's using bayes poison.. There's no way from that little snippet to see what rules the email matched.

Re: [SAtalk] spamassassin

2003-11-11 Thread Ernie Zapata
Maximo Lopez wrote: hello ther I already install the spamassassing , I use the automatic way cpan, then I modify the procmail as the example http://spamassassin.org/dist/procmailrc.example, but I still receive Spam , what should I check ??? regards The procmailrc.example uses 'spamc', the

RE: [SAtalk] What Dynamic IPs rbl list?

2003-11-11 Thread Bill
The intention is to disallow any adsl, dial-up or dynamic/static address on such lines to send any mail to this server. I will have a separated smtp server for my customers... ;) Bad, bad, bad idea!!! There are many many people running home networks in dynamic space who send their mail thru

RE: [SAtalk] scoring system and values...

2003-11-11 Thread Smart,Dan
I use Bayes for site-wide and love it. I have a recipe in my Procmail to grab any message that scores between 6 and 10, and store it in a suspect MBOX. Once a week I look through this for false positives and move to a ConfirmedHam MBOX, and move the rest to ConfirmedSPAM MBOX. I look at the

Re: [SAtalk] [MailServer Notification]To recipient: Message matched eManager setting and action was taken.

2003-11-11 Thread Lukreme
On 11 Nov 2003, at 01:45, David B Funk wrote: On Mon, 10 Nov 2003 [EMAIL PROTECTED] wrote: The following mail was blocked since it contains sensitive content. Love the stupid -PC- double-talk here. Gee, what was the content sensitive to? (is it sensitve to light, heat, shock...) Stupidity, of

[SAtalk] Another question re: Spam Assassin and SQL

2003-11-11 Thread Gustafson, Tim
Hello I think I figured something out, and I just want to confirm: Am I correct in understanding now that the SQL user preferences system only works when you run Spam Assassin through Procmail? Can it be set up to run from the Spamass-Milter? Thanks. Tim

[SAtalk] new to spamassassin

2003-11-11 Thread Dan
Good morning guys! Im new to spamassassin. I have it set up on a redhat 8 box with sophos and amavisd-new. It seem to be working out of the box but I have a few questions. (Maybe someone can point me to some docs?) 1. I know spamassassin works on a point system, but does it learn as time goes

[SAtalk] Re: Abused redirector URLs ?

2003-11-11 Thread Lukreme
On 06 Nov 2003, at 20:26, Keith C. Ivey wrote: Chr. von Stuckrad [EMAIL PROTECTED] wrote: I created the following rule for them # Special abused yahoo-redirector uri YAHOO_REDIR /srd.yahoo.com\/drst\/illuminating\/\*http:/ score YAHOO_REDIR 2 describe YAHOO_REDIRcontains url of

Re: [SAtalk] What Dynamic IPs rbl list?

2003-11-11 Thread Marcio Merlone
On Tue, 11 Nov 2003 11:00:00 -0500 Bill [EMAIL PROTECTED] wrote: The intention is to disallow any adsl, dial-up or dynamic/static address on such lines to send any mail to this server. I will have a separated smtp server for my customers... ;) Bad, bad, bad idea!!! There are many

[SAtalk] Re: What Dynamic IPs rbl list?

2003-11-11 Thread Lukreme
On 11 Nov 2003, at 07:30, Marcio Merlone wrote: I was wondering what rbl lists you guys use to block dynamic IP ranges. I will use it on a gateway relay-only server, which makes anti-virus and anti-spam and then forwards messages to end server. It's a postfix box. reject_rbl_client

[SAtalk] Comments on CBL DNSBL (cbl.abuseat.org)

2003-11-11 Thread Robert James Kaes
Hi, Does anyone have any comments on the quality of the cbl.abuseat.org DNSBL? I noticed that it isn't used in SpamAssassin, but it is one of the black lists checked by spamcop. Is anyone else using this list? The purpose of the CBL is to list open proxies (of all types) which have been

Re: [SAtalk] Re: Trouble restarting spamd

2003-11-11 Thread up
You need to wait for all of spamd's children to die, including all of the spamc's. This can take a while on a busy and/or slow server. This works for me most of the time: #!/bin/bash PID=`awk '{print $1}' /var/run/spamd.pid` kill -TERM $PID wait || echo ERROR!

RE: [SAtalk] Comments on CBL DNSBL (cbl.abuseat.org)

2003-11-11 Thread Paul Hutchings
Seems well regarded. I'm currently logging any hits to see if it's worth adding to my per user DNSBLs that I use to reject mail to the people who get the most spam. The ones at http://abuse.easynet.nl are also well worth a look. regards, Paul -Original Message- From: Robert James

RE: [SAtalk] What Dynamic IPs rbl list?

2003-11-11 Thread Matt Kettler
At 11:00 AM 11/11/2003, Bill wrote: Bad, bad, bad idea!!! There are many many people running home networks in dynamic space who send their mail thru their isp server. These will all get caught and trashed by your plan. You better have a VERY good explanation why you just alienated hundreds of

[SAtalk] Re: Comments on CBL DNSBL (cbl.abuseat.org)

2003-11-11 Thread Lukreme
On 11 Nov 2003, at 10:09, Robert James Kaes wrote: Hi, Does anyone have any comments on the quality of the cbl.abuseat.org DNSBL? I noticed that it isn't used in SpamAssassin, but it is one of the black lists checked by spamcop. Is anyone else using this list? I use it a the postfix level to

RE: [SAtalk] What Dynamic IPs rbl list?

2003-11-11 Thread Bill
I want to block those selling [EMAIL PROTECTED]@, asian porn, and such un-wanted material, which represents about 50% of the traffic (pure guess). There will be some spam that will then be easaly downloaded by our customers and then filtered. Again, I feel deleting ANY mail addressed to

[SAtalk] Filtering.

2003-11-11 Thread Rajdeep Larha
I have successfully installed the SA. but I am not able to filer the content. Any stuff which I want to filter in there in the rules directory but not getting filter. What I have to do with this? For e.g I have to filter the vulgar stuff. But it does not filterit. My local.cf is as follows:- #

Re: [SAtalk] new to spamassassin

2003-11-11 Thread Evan Platt
--On Tuesday, November 11, 2003 9:58 AM -0800 Dan [EMAIL PROTECTED] wrote: 1. I know spamassassin works on a point system, but does it learn as time goes by? See the topics on SpamAssassin's Learn Feature. You'll need to feed it ham and spam for it to learn. 2. My compnay wants to block all

Re: [SAtalk] What Dynamic IPs rbl list?

2003-11-11 Thread Marcio Merlone
On Tue, 11 Nov 2003 12:29:27 -0500 Matt Kettler [EMAIL PROTECTED] wrote: At 11:00 AM 11/11/2003, Bill wrote: Bad, bad, bad idea!!! Bad, bad, bad assumption! :) LOL Matt is right. I will block just direct-delivery. :) -- Marcio Merlone

[SAtalk] SpamAssassin dont block the default sample spam examples and others

2003-11-11 Thread Joao Pedro
Hi there, I'm installing a Spam Gateway Email Server in a FreeBSD server with Postfix+Amavisd+SpamAssassin and a followed this howto http://lawmonkey.org/anti-spam.html. All it's appear ok, but when I send a email with the sample_spam.txt or other spam example file to a external email or send

Re: [SAtalk] What Dynamic IPs rbl list?

2003-11-11 Thread Marcio Merlone
On Tue, 11 Nov 2003 13:04:46 -0500 Bill [EMAIL PROTECTED] wrote: I want to block those selling [EMAIL PROTECTED]@, asian porn, and such un-wanted material, which represents about 50% of the traffic (pure guess). There will be some spam that will then be easaly downloaded by our

Re: [SAtalk] new to spamassassin

2003-11-11 Thread Matt Kettler
At 12:58 PM 11/11/2003, Dan wrote: 1. I know spamassassin works on a point system, but does it learn as time goes by? IF you use the bayes subsystem, which is on by default but untrained as well, SA will engage in some automatic learning for the bayes rules. The remaining rules are static ones,

[SAtalk] A black listing question

2003-11-11 Thread Peter P. Benac
Greetings, Is there a legitimate reason not to blacklist email.com? I just seem to get way too much SPAM from email.com. Regards, Pete Peter P. Benac, CCNA Emacolet Networking Services, Inc Providing Systems and Network Consulting, Training, Web Hosting Services Phone: 919-847-1740 or

RE: [SAtalk] A black listing question

2003-11-11 Thread Paul Hutchings
just the obious answer, if someone who has a legitimate account there tries to send you email it will get flagged as spam.. -Original Message- From: Peter P. Benac [mailto:[EMAIL PROTECTED] Sent: 11 November 2003 18:17 To: 'SpamAssassin' Subject: [SAtalk] A black listing question

Re: [SAtalk] (semi)automatic Razor reporting options? anyone don e it like thi s before?

2003-11-11 Thread Chip Paswater
If you use Windows and Outlook, try Cloudmark's Spamnet product. It's the commercial version of razor, and feeds the same backend database. I think it's still free to use. http://www.cloudmark.com As far as looking up status, there's no official way to do it. You could create a unique

RE: [SAtalk] (semi)automatic Razor reporting options? anyone don e it like thi s before?

2003-11-11 Thread Mathew Hendry
Chip Paswater wrote: If you use Windows and Outlook, try Cloudmark's Spamnet product. It's the commercial version of razor, and feeds the same backend database. I think it's still free to use. http://www.cloudmark.com No it's not free (subscription is $1.99 a month or something) but there

Re: [SAtalk] [MailServer Notification]To recipient: Message matched eManager setting and action was taken.

2003-11-11 Thread Matt Kettler
At 03:45 AM 11/11/2003, David B Funk wrote: On Mon, 10 Nov 2003 [EMAIL PROTECTED] wrote: eManager Notification * The following mail was blocked since it contains sensitive content. Love the stupid -PC- double-talk here. Gee, what was the content sensitive to?

Re: [SAtalk] What Dynamic IPs rbl list?

2003-11-11 Thread Mark
- Original Message - From: Bill [EMAIL PROTECTED] To: 'Marcio Merlone' [EMAIL PROTECTED]; 'SA List' [EMAIL PROTECTED] Sent: Tuesday, November 11, 2003 5:19 PM Subject: RE: [SAtalk] What Dynamic IPs rbl list? The intention is to disallow any adsl, dial-up or dynamic/static address on

RE: [SAtalk] A black listing question

2003-11-11 Thread Yackley, Matt
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Peter P. Benac Sent: Tuesday, November 11, 2003 12:17 PM To: 'SpamAssassin' Subject: [SAtalk] A black listing question Greetings, Is there a legitimate reason not to blacklist email.com?

Re: [SAtalk] Filtering.

2003-11-11 Thread Matt Kettler
At 12:31 PM 11/11/2003, Rajdeep Larha wrote: I have successfully installed the SA. but I am not able to filer the content. Any stuff which I want to filter in there in the rules directory but not getting filter. Um what do you mean by Any stuff which I want to filter in there in the rules

RE: [SAtalk] new to spamassassin

2003-11-11 Thread Scott Harris
2. My compnay wants to block all swears (dont ask me why!) How can this be done? Write some custom rules with high scores: bodyLOCAL_SWEARWORD1/\bf***\b/i score LOCAL_SWEARWORD1 10.0 Substitute f*** for your favorite swear word.. Be sure to frame your swear words

[SAtalk] Re: new to spamassassin

2003-11-11 Thread Chris Barnes
Dan [EMAIL PROTECTED] wrote: 1. I know spamassassin works on a point system, but does it learn as time goes by? sa-learn (Bayes) 2. My compnay wants to block all swears (dont ask me why!) How can this be done? A really, REALLY bad idea. Part of a good system admin's job is convincing

Re: [SAtalk] Re: Abused redirector URLs ?

2003-11-11 Thread Carl R. Friend
On Tue, 11 Nov 2003, Lukreme wrote: uri YAHOO_REDIR /srd.yahoo.com\/drst\/.*\*http:/ Quick (stupid) question. What is the best place to add rules where they will not get blown away via an upgrade? Give a go at putting it in /etc/mail/spamassassin/local.cf -- that's where I put

RE: [SAtalk] spamassasin without the mess

2003-11-11 Thread Tom Meunier
You've just described how spamassassin works. So I'm pretty certain the you don't want to sit at a command line, saving your mails to text files, and checking them one-by-one. What is it that you would LIKE to do, really? Chances are someone's already doing it. Do you have a non-*n?x

[SAtalk] spamassasin without the mess

2003-11-11 Thread Tyler Montbriand
Not having ever run a UNIX mail server, I find the existing documentation and configuration info for spamassasin quite mystifying. I'd prefer not to go with the UNIX method of handling mail and mailboxes, and I certainly don't want it screwing with my ISP's smtp server. I'd like to just cut

RE: [SAtalk] scoring system and values...

2003-11-11 Thread Larry Gilson
I don't know if this really fits in this subject or not. However, I keep thinking while reading this thread if anyone considers real opt-in advertisements/messages that get tagged by SA (like from OshKosh, Travelocity, Lands' End, etc.) to be a FP or not. Do site-wide Bayes installs have a hard

RE: [SAtalk] [RD] new to spamassassin

2003-11-11 Thread Yackley, Matt
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Harris I have a regex type question, I think, about local examples like the on above. Can you put multiple words on a single check such as: Body LOCAL_SWEARWORD1

Re: [SAtalk] SpamAssassin dont block the default sample spam examples and others

2003-11-11 Thread Matt Kettler
At 01:19 PM 11/11/2003, Joao Pedro wrote: I'm installing a Spam Gateway Email Server in a FreeBSD server with Postfix+Amavisd+SpamAssassin and a followed this howto http://lawmonkey.org/anti-spam.html. All it's appear ok, but when I send a email with the sample_spam.txt or other spam example file

RE: [SAtalk] [RD] simple rule for consumption

2003-11-11 Thread Scott Sprunger
Regis, I had several false positives today based on the BAD_X_HEADERS rule. I'm using the rules from Chris' site (Nov02). The legitimate emails had an X-URL header. All of the FPs where from a single mailing list. For what ever reason, they are providing a valid link to some content within

[SAtalk] RD: Random Text Rules

2003-11-11 Thread Larry Gilson
Just tossing this out as an idea . . . I have been working on the random text strings. I have talked about this a little before but only really had one rule. I have started looking at consonant-vowel-consonant combinations rather than just the long consonant strings. I checked these

Re: [SAtalk] A black listing question

2003-11-11 Thread Matt Kettler
At 01:17 PM 11/11/2003, Peter P. Benac wrote: Is there a legitimate reason not to blacklist email.com? I just seem to get way too much SPAM from email.com. It's a real webmail type service.. So the same arguments that apply for why you should/should not block hotmail, yahoo, eudoramail, and

RE: [SAtalk] Filtering.

2003-11-11 Thread Jennifer Wheeler
Hi Rajdeep, I have successfully installed the SA. but I am not able to filer the content. Any stuff which I want to filter in there in the rules directory but not getting filter. What I have to do with this? For e.g I have to filter the vulgar stuff. But it does not filterit. My local.cf is

Re: [SAtalk] [RD] Updated Corn

2003-11-11 Thread guenther
Hey Jennifer, Fresh popcorn if you would like some. I had one come through today (which I actually had anticipated, just had to figure out how to write the rule.) If you use this set, I'd update. It catches quite a lot more in the tag. Thanks for the update. :)

[SAtalk] new to spamassassin

2003-11-11 Thread Charles Gregory
On Tue, 11 Nov 2003, Yackley, Matt wrote: Scott, This would probably be a little better cleaner looking: body LOCAL_SWEARWORD /\b(?:word1|word2|word3|word4)\b/i And in case anyone else unfamiliar with regex is wondering about that question mark followed by a colon - it is a special code

RE: [SAtalk] A black listing question

2003-11-11 Thread Peter P. Benac
Well now that you mention it!!! OK OK I guess I'll tweak the rules some more. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Kettler Sent: Tuesday, November 11, 2003 14:46 To: [EMAIL PROTECTED]; 'SpamAssassin' Subject: Re: [SAtalk] A

[SAtalk] Bayes versioning?

2003-11-11 Thread Ted Cabeen
I've got a site-wide bayes database that I'm not sure is correctly configured. It's quite a large database, and I think it may not have been converted to the new DB format when I upgraded. When I try to run a sa-learn --dump magic, I get the following output: Use of uninitialized value in

Re: [SAtalk] Bayes versioning?

2003-11-11 Thread Theo Van Dinter
On Tue, Nov 11, 2003 at 12:36:54PM -0800, Ted Cabeen wrote: Here are the directory entries: -rw--- 1 amavisd amavisd 3148 Nov 11 12:29 bayes_journal -rw--- 1 amavisd amavisd 2652 Oct 1 10:36 bayes_msgcount -rw--- 1 amavisd amavisd 41607168 Nov 11 12:29 bayes_seen

[SAtalk] New Spam Source? Rules for this yet??

2003-11-11 Thread Robert Leonard III
I have been getting several new spams that seem to get past my SA setup.. So far they have come from: @name-james.com @name-clark.com @smegheads.com They all have wording like.. but with minor variations.. anybody else seeing these/written any rules to stop these?? I pasted the headers at the

RE: [SAtalk] scoring system and values...

2003-11-11 Thread Smart,Dan
Since we are a company, I don't get too hung up over these. I more worry about newsletters people get for their work. I usually just delete the non-business stuff, and don't run them as either spam or ham. Dan | -Original Message- | From: Larry Gilson [mailto:[EMAIL PROTECTED] | Sent:

Re: [SAtalk] new to spamassassin

2003-11-11 Thread Dan
Sorry all, I jumped the gun. This does flag it as spam. Thanks Dan - Original Message - From: Charles Gregory [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, November 11, 2003 11:59 AM Subject: [SAtalk] new to spamassassin On Tue, 11 Nov 2003, Yackley, Matt wrote: Scott,

RE: [SAtalk] [RD] Updated Corn

2003-11-11 Thread guenther
http://spamhammers.nxtek.net How are those files organized on that site? I couldn't find a link to the .cf files, so I just tried. Found popcorn.cf and weeds.cf but backhair.cf doesn't exist... I only linked the popcorn.cf on the site (as a temp download until Chris S. is able to

Re: [SAtalk] Bayes versioning?

2003-11-11 Thread Ted Cabeen
Theo Van Dinter [EMAIL PROTECTED] writes: On Tue, Nov 11, 2003 at 12:36:54PM -0800, Ted Cabeen wrote: Here are the directory entries: -rw--- 1 amavisd amavisd 3148 Nov 11 12:29 bayes_journal -rw--- 1 amavisd amavisd 2652 Oct 1 10:36 bayes_msgcount -rw--- 1 amavisd

RE: [SAtalk] [RD] Updated Corn

2003-11-11 Thread Jennifer Wheeler
Hi Guenther, Fresh popcorn if you would like some. I had one come through today (which I actually had anticipated, just had to figure out how to write the rule.) If you use this set, I'd update. It catches quite a lot more in the tag. Thanks for the update. :) My Pleasure!

Re: [SAtalk] Bayes versioning?

2003-11-11 Thread Theo Van Dinter
On Tue, Nov 11, 2003 at 01:00:05PM -0800, Ted Cabeen wrote: I was running perl 5.005 back then, but I've upgraded to 5.8.1 now. Should I try running the import again? You might want to try that. The error you're reporting seems to occur when the DB is not accessible, likely for writing.

Re: [SAtalk] Bayes versioning?

2003-11-11 Thread Rod Begbie
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Ted Cabeen wrote: I've got a site-wide bayes database that I'm not sure is correctly configured. It's quite a large database, and I think it may not have been converted to the new DB format when I upgraded. When I try to run a sa-learn --dump magic,

Re: [SAtalk] new to spamassassin

2003-11-11 Thread Dan
Hey guys! This works great! However, it seems to not throw a SPAM tag inot the logs but says content reject. Can that be changed at all? I want to write some shell scripts for reporting. Thanks Dan - Original Message - From: Charles Gregory [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent:

RE: [SAtalk] [RD] Updated Corn

2003-11-11 Thread Jennifer Wheeler
Darn it!!! Wget again Guenther. I'm sorry. I STILL didn't have the right Weeds set up there. It is right now. Wow... time to call it a day I think. :) Sorry for the trouble. -Original Message- From: guenther [mailto:[EMAIL PROTECTED] Sent: Tuesday, November 11, 2003 4:14 PM To:

Re: [SAtalk] FROM_AND_TO_SAME Rule does not seem to work

2003-11-11 Thread Morris Jones
I think I solved this problem by removing my email address from the AWL. No need for it to be in there. spamassassin --remove-addr-from-whitelist [EMAIL PROTECTED] Mojo On Sun, 9 Nov 2003, Derek Jennings wrote: I have upgraded to 2.60 because this was driving me crazy in 2.55, but the

Re: [SAtalk] A black listing question

2003-11-11 Thread Vivek Khera
PPB == Peter P Benac [EMAIL PROTECTED] writes: PPB Is there a legitimate reason not to blacklist email.com? I just PPB seem to get way too much SPAM from email.com. email.com (along with many others, such as mail.com) is hosted by outblaze. they have stated publicly that if any mail from any

Re: [SAtalk] Bayes versioning?

2003-11-11 Thread Ted Cabeen
Theo Van Dinter [EMAIL PROTECTED] writes: On Tue, Nov 11, 2003 at 01:00:05PM -0800, Ted Cabeen wrote: I was running perl 5.005 back then, but I've upgraded to 5.8.1 now. Should I try running the import again? You might want to try that. The error you're reporting seems to occur when the

Re: [SAtalk] Bayes versioning?

2003-11-11 Thread Ted Cabeen
Rod Begbie [EMAIL PROTECTED] writes: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Ted Cabeen wrote: I've got a site-wide bayes database that I'm not sure is correctly configured. It's quite a large database, and I think it may not have been converted to the new DB format when I

Re: [SAtalk] spamassasin without the mess

2003-11-11 Thread Bob Apthorpe
Hi, On Tue, 11 Nov 2003, Tyler Montbriand wrote: Not having ever run a UNIX mail server, I find the existing documentation and configuration info for spamassasin quite mystifying. I'd prefer not to go with the UNIX method of handling mail and mailboxes, and I certainly don't want it screwing

RE: [SAtalk] Filtering.

2003-11-11 Thread Rajdeep Larha
Hi Jennifer, I read your mail. But this is something little above it. There are certain words in 20_porn.cf. When I use only those words even then the rating given is too low. I used 5 words from the list in same case.. even then the mail was given only 1.4 points...Any idea? I can write my won

Re: [SAtalk] New Spam Source? Rules for this yet??

2003-11-11 Thread Jonathan Nichols
Robert Leonard III wrote: I have been getting several new spams that seem to get past my SA setup.. So far they have come from: @name-james.com @name-clark.com @smegheads.com They all have wording like.. but with minor variations.. anybody else seeing these/written any rules to stop these??

Re: [SAtalk] FROM_AND_TO_SAME Rule does not seem to work

2003-11-11 Thread Nick Leverton
On Tue, Nov 11, 2003 at 01:13:27PM -0800, Morris Jones wrote: I think I solved this problem by removing my email address from the AWL. No need for it to be in there. spamassassin --remove-addr-from-whitelist [EMAIL PROTECTED] The developers are still pondering it, however for me, the patch

  1   2   >