Re: Redirect spam to mailbox

2008-01-21 Thread Evan Platt

At 07:37 PM 1/21/2008, Rubin Bennett wrote:

On Mon, 2008-01-21 at 19:22 -0800, Evan Platt wrote:
> Please reply to the list, not me.
>
True, but I've posted that post several times :)  Didn't want to
duplicate my answer.  I've sent *this* reply to the list however :)


Yep.. Maybe was worth sending to the OP, not me. I knew what SA can 
and can't do. :)




So the slightly longer answer to your question is that you need to tell
your Mail Delivery Agent to sort the message, be it Procmail, Postfix,
or whatever you use.  Some MDA's are smarter and more flexible than
others, but almost all have the ability to sort.  Worst case, you can
tell your mail client to sort for you (although this is cumbersome, and
a PIA to maintain if you have more that one client from which you access
your mail).


Umm.. Not my question. ;) 



Re: Redirect spam to mailbox

2008-01-21 Thread Rubin Bennett
On Mon, 2008-01-21 at 19:22 -0800, Evan Platt wrote:
> Please reply to the list, not me.
> 
True, but I've posted that post several times :)  Didn't want to
duplicate my answer.  I've sent *this* reply to the list however :)

> But...
> 
> "Spamassassin: TAGS Spam, but IT DOES NOT DO ANYTHING ELSE TO IT!!! 
> It Can't delete your spam, it can't reply to it. It can't forward it. 
> It looks at it, and either marks it as spam or not. That's it. Period. "
> 
> Yep.
> 
So the slightly longer answer to your question is that you need to tell
your Mail Delivery Agent to sort the message, be it Procmail, Postfix,
or whatever you use.  Some MDA's are smarter and more flexible than
others, but almost all have the ability to sort.  Worst case, you can
tell your mail client to sort for you (although this is cumbersome, and
a PIA to maintain if you have more that one client from which you access
your mail).

Rubin

> At 06:59 PM 1/21/2008, Rubin Bennett wrote:
> >Old, but still has value...
> >http://thatitguy.com/?target=sa-howto
> >
> >Rubin
> >
> >On Mon, 2008-01-21 at 18:49 -0800, Evan Platt wrote:
> > > At 06:22 PM 1/21/2008, Matsaki wrote:
> > >
> > > >I should be able to do this in spamassain as well as you can have 
> > > >training
> > > >etc. and sending SPAM: classified messages to a chosen mailbox, ie, spam.
> > >
> > > Spamassassin has no such capability to send messages to a chosen mailbox.
> > >
> > > >That's what I was reading in the spamassassin wiiki?
> > >
> > > Please quote what you saw that said spamassassin has that capability.
> > >
> >--
> >Rubin Bennett
> >rbTechnologies
> >[EMAIL PROTECTED]
> >http://thatitguy.com
> >(802)223-4448
> >
> >"Those who would give up essential liberty to purchase a little
> >temporary safety deserve neither liberty nor safety."
> > -Ben Franklin, Historical Review of Pennsylvania, 1759
> 
-- 
Rubin Bennett
rbTechnologies
[EMAIL PROTECTED]
http://thatitguy.com
(802)223-4448

"Those who would give up essential liberty to purchase a little
temporary safety deserve neither liberty nor safety."
-Ben Franklin, Historical Review of Pennsylvania, 1759



Re: Redirect spam to mailbox

2008-01-21 Thread Evan Platt

At 06:22 PM 1/21/2008, Matsaki wrote:


I should be able to do this in spamassain as well as you can have training
etc. and sending SPAM: classified messages to a chosen mailbox, ie, spam.


Spamassassin has no such capability to send messages to a chosen mailbox.


That's what I was reading in the spamassassin wiiki?


Please quote what you saw that said spamassassin has that capability. 



Re: Redirect spam to mailbox

2008-01-21 Thread Matsaki

I should be able to do this in spamassain as well as you can have training
etc. and sending SPAM: classified messages to a chosen mailbox, ie, spam.

That's what I was reading in the spamassassin wiiki?


mouss-2 wrote:
> 
> Matsaki wrote:
>> New to spamassassin I now got it up and running on my server with ubuntu,
>> postfix, dovecot.
>>
>> The only problem I have now is that i have created a mailaccount called
>> "spamtrap" but I can't manage to get the SPAM: classified email
>> redirected
>> to the mailbox. So some help would be appreciated. 
>>   
> 
> that's a job for your MTA or MDA.
> - if you deliver mail using the dovecot lda, then you can ask on either 
> postfix or dovecot lists
> - if you deliver mail using postfix (no external LDA), then ask on the 
> postfix list
> 
> When doing so, please
> - show how you are delivering mail
> - how you are filtering mail.
> 
> consider using amavisd-new where you can redirect spam (for example to 
> [EMAIL PROTECTED], then depending on user prefs, you can alias the 
> latter to your spamtrap).
> 
> Note that this is not really a spamtrap... it's just a Junk mailbox.
> 
> 

-- 
View this message in context: 
http://www.nabble.com/Redirect-spam-to-mailbox-tp15005825p15011300.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.



Re: The googolbees are getting craftier

2008-01-21 Thread John D. Hardin

Whoops! Just noticed I didn't send this to the list after all...

On Fri, 18 Jan 2008, John D. Hardin wrote:

> On Fri, 18 Jan 2008, Loren Wilton wrote:
> 
> > I guess btnl is no longer working.  Now they are doing a redirect:
> > 
> > http://google.co.uk///pagead/iclk?sa=l&ai=livermore&num=970&adurl=http://christmas-low-rate.tw?beast
> 
> Combined rule:
> 
> uri GOOG_MALWARE_URI 
> m,https?://(?:[^\./]+\.)*goo+gle(?:pages)?\.(?:[a-z][a-z][a-z]?(?:\.[a-z][a-z])?)/+.*[?&](?:btni|adurl),i

--
 John Hardin KA7OHZhttp://www.impsec.org/~jhardin/
 [EMAIL PROTECTED]FALaholic #11174 pgpk -a [EMAIL PROTECTED]
 key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
---
  Vista "security improvements" consist of attempting to shift blame
  onto the user when things go wrong.
---
 Today: John Moses Browning's 153rd Birthday




Re: google spams

2008-01-21 Thread David Gibbs

mouss wrote:

uri GOOGLE_SEARCH_BTNIm{gooo?gle\..*/search.*btnI=}


Loose the last equals sign, I've seen similar samples come through 
without it.


david



Re: How install spamassassin with vhcs2

2008-01-21 Thread Robert Schetterer
Theo Van Dinter schrieb:
> On Sat, Jan 19, 2008 at 12:25:40PM +0100, Outlaw wrote:
>> How install spamassassin with vhcs2? I search in google but I found
>> anything.
> 
> What is vhcs2?  This sounds more like a question for them than us.
> 
its an admin gui for isp style webhosting
as far i remember , their website seems to be down right now

-- 
Best Regards

MfG Robert Schetterer

Germany/Munich/Bavaria


Re: How install spamassassin with vhcs2

2008-01-21 Thread Theo Van Dinter
On Sat, Jan 19, 2008 at 12:25:40PM +0100, Outlaw wrote:
> How install spamassassin with vhcs2? I search in google but I found
> anything.

What is vhcs2?  This sounds more like a question for them than us.

-- 
Randomly Selected Tagline:
"In any free society, the conflict between social conformity and
  individual liberty is permanent, unresolvable, and necessary."
 - Kathleen Norris


pgpVg4NUTkv8D.pgp
Description: PGP signature


Re: google spams

2008-01-21 Thread John D. Hardin
On Mon, 21 Jan 2008, JP Kelly wrote:

> > JP Kelly wrote:
> 
> >> I am not able to write my own rules or regex.

Does that mean "I don't know how to write regular expressions", or "my
SA install doesn't permit me to add rules"?

If the former, then the rules I and others have posted over the past
week will work. Use my rule, or the rulesets others have posted.

If the latter, then ask whoever *can* add rules to your SA to add some 
google rules - point them at the list archives.

If you do have the adminstrative rights to add rules but you don't
know how to do that, that's another topic - "how do I add custom
rules?" - that has nothing do do with Google spams per se.
 
> http://google.com//search?hl=en&q=inurl:rhtawy.com%2BVPXL%2BMade%2BEasy&btnI=79547

Yeah, that's what we've posted rules for.

--
 John Hardin KA7OHZhttp://www.impsec.org/~jhardin/
 [EMAIL PROTECTED]FALaholic #11174 pgpk -a [EMAIL PROTECTED]
 key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
---
  USMC Rules of Gunfighting #20: The faster you finish the fight,
  the less shot you will get.
---
 Today: John Moses Browning's 153rd Birthday



Re: Guidance needed...

2008-01-21 Thread Kevin W. Gagel
- Original Message -
>Shortcircuiting[1] makes a big difference here. My average scan time is
>2.7 seconds (200k messages, full network tests and 2x1Ghz Sun server,
>includes some amavisd-new overhead). Almost 40% of my traffic is simply
>shortcircuited with (BAYES_00 && RELAY_XX) rule. My bayes works very well
>and messages originating from my country is another sure sign of ham.
>Another 10% by WHITELIST_* rules. I probably could get away with just
>using BAYES_00 alone for shortcircuiting, but I don't need the extra
>performance. So profile your traffic and find common patterns.
>
>[1] http://wiki.apache.org/spamassassin/ShortcircuitingRuleset

I'll look into the link, thanks. What exactly do you mean by profiling?

I've been racking my brains on how to gather a quantity of email from my
users and then figure out a way to read through them to decide if they are
ham or spam. No matter how I look at it, it seems a monumental job to me.
So I went with the idea of checking which rules trigger and which don't.


=
Kevin W. Gagel
Network Administrator
Information Technology Services
(250) 562-2131 local 5448
My Blog:
http://mail.cnc.bc.ca/blogs/gagel
My File share:
http://mail.cnc.bc.ca/users/gagel

---
The College of New Caledonia, Visit us at http://www.cnc.bc.ca
Virus scanning is done on all incoming and outgoing email.
Anti-spam information for CNC can be found at http://gateway.cnc.bc.ca
---


Re: Redirect spam to mailbox

2008-01-21 Thread mouss

Matsaki wrote:

New to spamassassin I now got it up and running on my server with ubuntu,
postfix, dovecot.

The only problem I have now is that i have created a mailaccount called
"spamtrap" but I can't manage to get the SPAM: classified email redirected
to the mailbox. So some help would be appreciated. 
  


that's a job for your MTA or MDA.
- if you deliver mail using the dovecot lda, then you can ask on either 
postfix or dovecot lists
- if you deliver mail using postfix (no external LDA), then ask on the 
postfix list


When doing so, please
- show how you are delivering mail
- how you are filtering mail.

consider using amavisd-new where you can redirect spam (for example to 
[EMAIL PROTECTED], then depending on user prefs, you can alias the 
latter to your spamtrap).


Note that this is not really a spamtrap... it's just a Junk mailbox.


Re: Redirect spam to mailbox

2008-01-21 Thread Evan Platt

At 12:32 PM 1/21/2008, Matsaki wrote:


New to spamassassin I now got it up and running on my server with ubuntu,
postfix, dovecot.

The only problem I have now is that i have created a mailaccount called
"spamtrap" but I can't manage to get the SPAM: classified email redirected
to the mailbox. So some help would be appreciated.


SpamAssassin can't do this. You'd need to use procmail or another such method.



Redirect spam to mailbox

2008-01-21 Thread Matsaki

New to spamassassin I now got it up and running on my server with ubuntu,
postfix, dovecot.

The only problem I have now is that i have created a mailaccount called
"spamtrap" but I can't manage to get the SPAM: classified email redirected
to the mailbox. So some help would be appreciated. 
-- 
View this message in context: 
http://www.nabble.com/Redirect-spam-to-mailbox-tp15005825p15005825.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.



Re: google spams

2008-01-21 Thread mouss

JP Kelly wrote:




From: [EMAIL PROTECTED]
Subject: She'll Beg for More..
Date: January 21, 2008 10:34:15 AM PST
To: [EMAIL PROTECTED]
Return-Path: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 3.2.3 (2007-08-08) on 
jpkvideo.net

X-Spam-Level: 
X-Spam-Status: No, score=4.5 required=5.0 
tests=BAYES_99,MISSING_MID, RCVD_IN_PBL,RDNS_DYNAMIC autolearn=no 
version=3.2.3

Received: (qmail 8030 invoked by uid 110); 21 Jan 2008 08:35:21 -0800
Received: (qmail 7999 invoked from network); 21 Jan 2008 08:35:20 
-0800
Received: from 190.75-207-15.dyn.dsl.cantv.net (HELO 
equipo05.cantv.net) (190.75.207.15) by smallgod.com with SMTP; 21 Jan 
2008 08:35:19 -0800
Received-Spf: none (smallgod.com: domain at bloggingstocks.com 
does not designate permitted sender hosts)

Content-Transfer-Encoding: 7bit

body:
--

Mon, 21 Jan 2008 17:34:15 -0100

http://google.com//search?hl=en&q=inurl:rhtawy.com%2BVPXL%2BMade%2BEasy&btnI=79547 



so that's similar to the one discussed in the thread
   "Re: Googlepages & Livefilestore spams"
see that thread and look for a message by Ben Lentz (10-10-2008 04:56).

maybe something like this (Warning: untested):

uri GOOGLE_SEARCH_BTNIm{gooo?gle\..*/search.*btnI=}
score GOOGLE_SEARCH_BTNI  2.0
describe GOOGLE_SEARCH_BTNI  contains


PS. who is smallgod.com? I would block the blasphematory MTA ;-p
If it's your MTA, then see if the PBL is safe for you to use at the MTA 
level.





Re: google spams

2008-01-21 Thread JP Kelly


On Jan 21, 2008, at 9:26 AM, mouss wrote:


JP Kelly wrote:

Enough is enough!
SA has been working so well for me all these years I guess I am  
spoiled.
I woke up this morning and had 5 Google spams and one legit email  
and I've had it.


I noticed a somewhat lengthy discussion on the subject here.
I am not able to write my own rules or regex.
Is there a quick and dirty way to give these spams a higher score?
I am using SA 3.2.3 and these message typically score around 4.5.



show samples. Otherwise, it's hard to know that everybody is talking  
about the same spam.



here is a typical example:
--

headers:
--

From:   [EMAIL PROTECTED]
Subject:She'll Beg for More..
Date:   January 21, 2008 10:34:15 AM PST
To: [EMAIL PROTECTED]
Return-Path:<[EMAIL PROTECTED]>
Delivered-To:   [EMAIL PROTECTED]
Delivered-To:   [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 3.2.3 (2007-08-08) on jpkvideo.net
X-Spam-Level:   
X-Spam-Status: 	No, score=4.5 required=5.0 tests=BAYES_99,MISSING_MID,  
RCVD_IN_PBL,RDNS_DYNAMIC autolearn=no version=3.2.3

Received:   (qmail 8030 invoked by uid 110); 21 Jan 2008 08:35:21 -0800
Received:   (qmail 7999 invoked from network); 21 Jan 2008 08:35:20 -0800
Received: 	from 190.75-207-15.dyn.dsl.cantv.net (HELO  
equipo05.cantv.net) (190.75.207.15) by smallgod.com with SMTP; 21 Jan  
2008 08:35:19 -0800
Received-Spf: 	none (smallgod.com: domain at bloggingstocks.com does  
not designate permitted sender hosts)

Content-Transfer-Encoding:  7bit

body:
--

Mon, 21 Jan 2008 17:34:15 -0100

http://google.com//search?hl=en&q=inurl:rhtawy.com%2BVPXL%2BMade%2BEasy&btnI=79547


Re: google spams

2008-01-21 Thread mouss

JP Kelly wrote:

Enough is enough!
SA has been working so well for me all these years I guess I am spoiled.
I woke up this morning and had 5 Google spams and one legit email and 
I've had it.


I noticed a somewhat lengthy discussion on the subject here.
I am not able to write my own rules or regex.
Is there a quick and dirty way to give these spams a higher score?
I am using SA 3.2.3 and these message typically score around 4.5.



show samples. Otherwise, it's hard to know that everybody is talking 
about the same spam.





RE: Guidance needed...

2008-01-21 Thread Bowie Bailey
Kevin W. Gagel wrote:
> I've been researching what rules get hit on my system. To do that I've
> writen a small script to pull together a list of all the rules that
> SA is using on my system and another to parse my log files to see
> what rules were triggered, how often and how long it took to scan the
> messages. 
> 
> I used a full month worth of data. I have 2,827 (give or take a few
> for script logic errors) rules that SA checks on each message. For
> December I had 256,542 messages that made it through blacklists and
> then were evaluated by SA. A total of 1,087 rules were tripped in all
> of those messages.
> 
> Looking at the list of tripped rules (and how many times it was
> tripped) and how long it took to process all of those messages (a
> total of 569.732 hours) I wondered if I could improve performance by
> cutting out rules that were not tripped or only tripped a very small
> number of times. 
> 
> What I need guidance on, is this...
> 
> I see multiple rules with descriptions writen in other languages to
> catch the same thing as the english one. Are these treated by SA as
> seperate rules, testing the message against each language?
> 
> Before I go setting up scores of zero's for rules I think don't need
> to be run, am I correct in thinking that setting the score to zero
> will keep SA from running the rule? I seem to recall seeing emails on
> the list that indicate that but others that say the rule is still
> run... 
> 
> Any advice on this would be welcome.

Yes, if you set the score to 0, the rule will not be run.  I think there
have been one or two bugs that caused this not to work in some
circumstances, but this is the correct way to disable a rule.

The multiple language descriptions are probably just from the different
language files.  The main thing is the rule name.  If the rule name is
the same, it's just a translated description.  If the rule name is
different, it's a different rule.

-- 
Bowie


google spams

2008-01-21 Thread JP Kelly

Enough is enough!
SA has been working so well for me all these years I guess I am spoiled.
I woke up this morning and had 5 Google spams and one legit email and  
I've had it.


I noticed a somewhat lengthy discussion on the subject here.
I am not able to write my own rules or regex.
Is there a quick and dirty way to give these spams a higher score?
I am using SA 3.2.3 and these message typically score around 4.5.

Thanks.
 


Guidance needed...

2008-01-21 Thread Kevin W. Gagel
I've been researching what rules get hit on my system. To do that I've
writen a small script to pull together a list of all the rules that SA is
using on my system and another to parse my log files to see what rules were
triggered, how often and how long it took to scan the messages.

I used a full month worth of data. I have 2,827 (give or take a few for
script logic errors) rules that SA checks on each message. For December I
had 256,542 messages that made it through blacklists and then were
evaluated by SA. A total of 1,087 rules were tripped in all of those
messages.

Looking at the list of tripped rules (and how many times it was tripped)
and how long it took to process all of those messages (a total of 569.732
hours) I wondered if I could improve performance by cutting out rules that
were not tripped or only tripped a very small number of times.

What I need guidance on, is this...

I see multiple rules with descriptions writen in other languages to catch
the same thing as the english one. Are these treated by SA as seperate
rules, testing the message against each language?

Before I go setting up scores of zero's for rules I think don't need to be
run, am I correct in thinking that setting the score to zero will keep SA
from running the rule? I seem to recall seeing emails on the list that
indicate that but others that say the rule is still run...

Any advice on this would be welcome.

Thanks.


=
Kevin W. Gagel
Network Administrator
Information Technology Services
(250) 562-2131 local 5448
My Blog:
http://mail.cnc.bc.ca/blogs/gagel
My File share:
http://mail.cnc.bc.ca/users/gagel

---
The College of New Caledonia, Visit us at http://www.cnc.bc.ca
Virus scanning is done on all incoming and outgoing email.
Anti-spam information for CNC can be found at http://gateway.cnc.bc.ca
---


OT: Not able to access spamassassin.apache.org

2008-01-21 Thread ram
Hi,

  I think my web proxy server is in some kind of blacklist
(59.163.11.70)I am not able to go to the spamassassin.apache.org. 
Can someone tell me what blacklist does this server use



Sorry for being OT here. I cant find my ip listed anywhere but
spamassassin site is blocked 



Thanks
Ram




RE: whois plugin .. where to get it

2008-01-21 Thread ram
On Sat, 2008-01-19 at 13:38 +0100, Giampaolo Tomassoni wrote:
> > -Original Message-
> > From: ram [mailto:[EMAIL PROTECTED]
> > Sent: Saturday, January 19, 2008 11:47 AM
> > 
> > I had read about the whois plugin into SA. But I cant seem to find it
> > now Can someone tell me how do I install this
> 
> You can get a copy of the uriwhois plugin at:
> 
>   http://www.tomassoni.biz/download/URIWhois-0.03.tar.bz2
> 
> But please read next.
> 
> 
> > I beleive that could be a very effective idea to score on domain names
> > who have bad registrars
> 
> The uriwhois plugin doesn't do that. The thing closest to this, that it
> allows to, is to put scores on nameserver addresses used to propagate the
> domain entries of spammed uris. In example, if you find that a set of
> well-known spams are advertizing uris whose domains are announced always
> through 1.1.1.1 and 1.1.1.2 nameservers, then you can put a SA rule to let
> all the uris whose domain is announced trough these NSes earn scores.
> 
> uriwhois also tests other things as well. In example, a uri gets a score
> depending on its domain's registration age. Also, it get scored if the NSes
> defined in the whois record differ partially (PARTNSMIS) or fully
> (FULLNSMIS) from the ones defined in the DNS zone.
> 
> A further test is the RFC1035IGN one, which basically would check compliance
> to RFC1035 of the DNS SOA record of the domain. It checks, in example, if
> the primary NS defined in the SOA record is among the NSes defined through
> NS records. If it isn't, the rule triggers. I found that most sites hosted
> by the Akamai's infrastructure do fire this rule, since Akamai puts a master
> DNS server in the SOA, which is only used as a replication master for the
> other NSes. It is not used as a public DNS server. I believe this behavior
> is not RFC-1035 compliant but nevertheless, for the purposes of the uriwhois
> plugin, it simply leads to FPs...
> 
> Now I would change the RFC1035IGN test to match those domains whose NSes
> don't reply to DNS SOA requests, which I see is the "reply" from spammers to
> the previous behavior of this test. But this is not currently implemented.
> 
> 
> > Every hour hundreds of domains get registered purely for the purpose of
> > spamming. That is what I assume because I see so many new  one liner
> > spams with just a link  to a site, and soon the  site gets listed in
> > URIBL* If I could just block these spammers based on their registrars
> > then SA could turn very effective. I could even use this information at
> > my MTA and reject mails from spamming domains
> 
> Again, no registrar check, sorry. You could eventually use the: "uri_whois
> nsname" or the "uri_whois nsaddr" tests to attempt catch these.
> 
> 

I think I am missing something here. The NS address is different from
the registrar. 
How can we score based on NS address? Can a spammer not put innocent
servers as his Nameserver , as long as they allow DNS queries to his
host

The format of the registrar in whois information is not standardized. I
wonder why.  If I could do something like 
dig domain.tld REG ( just like dig domain.tld MX ) 
then life would have been so simple. 


Thanks
Ram









Re: user_prefs rules not being used

2008-01-21 Thread Matt Kettler

[EMAIL PROTECTED] wrote:
I'm running SpamAssassin version 3.1.8 on SuSE 9.3. Spamassassin is 
invoked through amavisd.


I have a series of whitelist_from commands in my 
/etc/mail/spamassassin/local.cf, which spamassassin recognizes. I also have


allow_user_rules 1

in my local.cf.

However, when I edit .spamassassin/user_prefs in my home directory to add 
further whitelist_from commands, spamassassin doesn't see them. Is there 
any obvious reason why?
  


Um, doesn't amavis always use one user (amavis) when scanning mail?




Re: disable all network test except ...

2008-01-21 Thread Matus UHLAR - fantomas
> On Monday 21 January 2008 12:29, Matus UHLAR - fantomas wrote:
> > On 18.01.08 13:24, Stefan Jakobs wrote:
> > > I'm using amavisd-new with spamassassin and for some tests I have to
> > > disable all network tests in spamassassin except for sorbs, njabl, uribl
> > > and maybe some other blackhole lists.
> >
> > why?

On 21.01.08 13:57, Stefan Jakobs wrote:
> I like to know which DNS server is faster, bind or rbldnsd. Therefore I will 
> provide each server with local zone files. To prevent side effects 
> spamassassin should only query the zones I am able to provide. The other 
> queries I will disable.

you can just ask :-)

rbldnsd is much faster and uses much less memory than bind. However it's not
fully functional DNS server and is only capable of serving simple data -
just like RBL data. If you want to have local mirrors of some RBLs, just use
rbldns for them and create forward zones in BIND.

-- 
Matus UHLAR - fantomas, [EMAIL PROTECTED] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
   One OS to rule them all, One OS to find them, 
One OS to bring them all and into darkness bind them 


Re: disable all network test except ...

2008-01-21 Thread Stefan Jakobs
On Monday 21 January 2008 12:29, Matus UHLAR - fantomas wrote:
> On 18.01.08 13:24, Stefan Jakobs wrote:
> > I'm using amavisd-new with spamassassin and for some tests I have to
> > disable all network tests in spamassassin except for sorbs, njabl, uribl
> > and maybe some other blackhole lists.
>
> why?

I like to know which DNS server is faster, bind or rbldnsd. Therefore I will 
provide each server with local zone files. To prevent side effects 
spamassassin should only query the zones I am able to provide. The other 
queries I will disable.


Greetings
Stefan


pgpygvjhT7zxn.pgp
Description: PGP signature


Re: Feeding SA-learn

2008-01-21 Thread Anthony Peacock

Diego Pomatta wrote:

Jari Fredriksson escribió:

Hey list,

Can I feed a plain text file representing just the body
of a message to sa-learn?

/Diego



Yes you can, who to stop it?

I just  sent your message body as --ham, and it told it learned one 
message.


  

I meant without the headers, just the body.
ok thanks



Well the short answer is, yes you can.

The slightly longer answer is that you won't get as good results doing 
this, as the Bayes system uses tokens found in the complete message.  By 
only learning on the body you will not gain any advantage for tokens 
found in headers.



--
Anthony Peacock
CHIME, Royal Free & University College Medical School
WWW:http://www.chime.ucl.ac.uk/~rmhiajp/
"A CAT scan should take less time than a PET scan.  For a CAT scan,
 they're only looking for one thing, whereas a PET scan could result in
 a lot of things."- Carl Princi, 2002/07/19


Re: Feeding SA-learn

2008-01-21 Thread Diego Pomatta

Jari Fredriksson escribió:

Hey list,

Can I feed a plain text file representing just the body
of a message to sa-learn?

/Diego



Yes you can, who to stop it?

I just  sent your message body as --ham, and it told it learned one message.

  

I meant without the headers, just the body.
ok thanks


Re: disable all network test except ...

2008-01-21 Thread Matus UHLAR - fantomas
On 18.01.08 13:24, Stefan Jakobs wrote:
> I'm using amavisd-new with spamassassin and for some tests I have to
> disable all network tests in spamassassin except for sorbs, njabl, uribl
> and maybe some other blackhole lists.

why?

-- 
Matus UHLAR - fantomas, [EMAIL PROTECTED] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
BSE = Mad Cow Desease ... BSA = Mad Software Producents Desease


Re: Feeding SA-learn

2008-01-21 Thread Jari Fredriksson
> Hey list,
> 
> Can I feed a plain text file representing just the body
> of a message to sa-learn?
> 
> /Diego

Yes you can, who to stop it?

I just  sent your message body as --ham, and it told it learned one message.




Re: How install spamassassin with vhcs2

2008-01-21 Thread --[ UxBoD ]--
- "Outlaw" <[EMAIL PROTECTED]> wrote:

> How install spamassassin with vhcs2? I search in google but I found
> anything.
> 
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.

http://vhcs.puuhis.net/wiki/index.php/Spam_/_Antivirus_filter

-- 
Regards,

-- 
--[ UxBoD ]--
// PGP Key: "curl -s http://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: F57A 0CBD DD19 79E9 1FCC A612 CB36 D89D 2C5A 3A84
// Keyserver: www.keyserver.net Key-ID: 0x2C5A3A84
// Phone: +44 845 869 2749 SIP Phone: [EMAIL PROTECTED]

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.



How install spamassassin with vhcs2

2008-01-21 Thread Outlaw

How install spamassassin with vhcs2? I search in google but I found
anything.


How install spamassassin with vhcs2

2008-01-21 Thread Outlaw
How install spamassassin with vhcs2? I search in google but I found
anything.


Feeding SA-learn

2008-01-21 Thread Diego Pomatta

Hey list,

Can I feed a plain text file representing just the body of a message to 
sa-learn?


/Diego