Re: SpamAssassin w/POP3 SMTP outsourced e-mail server...

2005-07-07 Thread Jesse Shumaker
Let me try and summarize what I have recieved from all these e-mails as well as put together myself. Then you guys could give me some feedback if I'm on the right trail. What I need to do is install SpamAssassin w/pop3proxy on a linux box. Then setup the pop3proxy to point to my external pop3

Re: (14.6) How can I correctly detect these spams?

2005-07-07 Thread Chris Thielen
Hi Thomas, Your email scored nearly 25 on my system. Chickenpox contributed 4.2, uribls contributed tons. HTH :) Thomas Booms wrote: Spam detection software, running on the system ns1.sandgnat.com, has identified this incoming email as possible spam. The original message has been

Re: SpamAssassin w/POP3 SMTP outsourced e-mail server...

2005-07-07 Thread Paolo Cravero as2594
Jesse Shumaker wrote: Let me try and summarize what I have recieved from all these e-mails as [...] use and am trying to piece it all together. Correct, except that the remote POP3 server is specified on client configuration and not wired statically on the pop3 proxy box. At least with

Re: SpamAssassin w/POP3 SMTP outsourced e-mail server...

2005-07-07 Thread Jesse Shumaker
OK. This is what I thought I needed to do. Just to clarify, SAproxy is the same as pop3proxy.pl correct? I've looked around and can't find a download for these. It looks like they have been discontinued. I saw that a new one which is only windows based has sprung up called SpamFu. I need it to be

Re: RFKINDY false positives on faxes

2005-07-07 Thread Bjorn Jensen
Martin Lee wrote: We've had some false positives with the X_LIBRARY, MIME_BOUND_RKFINDY rules being tripped on e-faxes received through www.myvfm.com. Fairly obviously the service has been built using the Indy.Sockets library (www.indyproject.org). The Indyproject knowledge base admits that

Re: How can I correctly detect these spams?

2005-07-07 Thread Andy Jezierski
Chris Thielen [EMAIL PROTECTED] wrote on 07/07/2005 01:15:24 AM: Hi Thomas, Your email scored nearly 25 on my system. Chickenpox contributed 4.2, uribls contributed tons. HTH :) As has been pointed out, make sure your network tests are turned on. I am surprised that I only got two

Re: How can I correctly detect these spams?

2005-07-07 Thread Chris Thielen
Andy Jezierski wrote: Chris Thielen [EMAIL PROTECTED] wrote on 07/07/2005 01:15:24 AM: Hi Thomas, Your email scored nearly 25 on my system. Chickenpox contributed 4.2, uribls contributed tons. HTH :) As has been pointed out, make sure your network tests are turned on. I am

rules_du_jour SA_RESTART interpretation?

2005-07-07 Thread Dr Robert Young
In configuring the rules_du_jour script for rule updates, I am a bit concerned over my interpretation of the SA_RESTART parameter. It sounds like it is a call to the routine to stop and then re-start the spamd daemon. But the rules_du_jour example kills the spamd process with killall (ie no

spamassassin --lint ....how long does it take?

2005-07-07 Thread Dr Robert Young
I am just becoming familiar with SpamAssassin, so I am sure this may appear to be an obvious issue to those familiar with the tool. I am just learning the ins and outs however. I downloaded many of the SARE rulesets (not bigevil however), and I am running spamassassin -D --lint. It seems

Re: spamassassin --lint ....how long does it take?

2005-07-07 Thread Theo Van Dinter
On Thu, Jul 07, 2005 at 02:27:32PM -0400, Dr Robert Young wrote: I downloaded many of the SARE rulesets (not bigevil however), and I am running spamassassin -D --lint. It seems like it is taking a very long time to run. Is this typical or am I hosed? I am running it on a test system

Re: spamassassin --lint ....how long does it take?

2005-07-07 Thread Michele Neylon:: Blacknight
Dr Robert Young wrote: I am just becoming familiar with SpamAssassin, so I am sure this may appear to be an obvious issue to those familiar with the tool. I am just learning the ins and outs however. I downloaded many of the SARE rulesets (not bigevil however), and I am running

Re: spamassassin --lint ....how long does it take?

2005-07-07 Thread Kevin W. Gagel
I am just becoming familiar with SpamAssassin, so I am sure this may appear to be an obvious issue to those familiar with the tool. I am just learning the ins and outs however. I downloaded many of the SARE rulesets (not bigevil however), and I am running spamassassin -D --lint. It

Re: spamassassin --lint ....how long does it take?

2005-07-07 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Theo Van Dinter writes: On Thu, Jul 07, 2005 at 02:27:32PM -0400, Dr Robert Young wrote: I downloaded many of the SARE rulesets (not bigevil however), and I am running spamassassin -D --lint. It seems like it is taking a very long time to

Re: rules_du_jour SA_RESTART interpretation?

2005-07-07 Thread Chris Thielen
Allo, Dr Robert Young wrote: In configuring the rules_du_jour script for rule updates, I am a bit concerned over my interpretation of the SA_RESTART parameter. It sounds like it is a call to the routine to stop and then re-start the spamd daemon. But the rules_du_jour example kills the

Re: spamassassin --lint ....how long does it take?

2005-07-07 Thread Theo Van Dinter
On Thu, Jul 07, 2005 at 11:43:10AM -0700, Justin Mason wrote: eh, Theo, --lint doesn't require a message, it uses one of its own! Oh. Hahaha. I forgot about that. ;) Never mind me, brain is scattered right now due to work. My second suggestion is to do local-only in case there's a network

Re: spamassassin --lint ....how long does it take?

2005-07-07 Thread Jim Maul
Theo Van Dinter wrote: On Thu, Jul 07, 2005 at 11:43:10AM -0700, Justin Mason wrote: eh, Theo, --lint doesn't require a message, it uses one of its own! Oh. Hahaha. I forgot about that. ;) Never mind me, brain is scattered right now due to work. My second suggestion is to do local-only

SA training

2005-07-07 Thread Jean-Paul Natola
Hi everyone, I'm new to SA so I need a bit of help in configuring /training SA- The problem I have is that I do not keep any mail in the SA box- it forwards to my mail server- What method can I use to train it? Jean-Paul Natola Network Administrator Information Technology Family

Re: SA training

2005-07-07 Thread JamesDR
Jean-Paul Natola wrote: Hi everyone, I'm new to SA so I need a bit of help in configuring /training SA- The problem I have is that I do not keep any mail in the SA box- it forwards to my mail server- What method can I use to train it? Jean-Paul Natola Network Administrator

Re: spamassassin --lint ....how long does it take?

2005-07-07 Thread jdow
From: Dr Robert Young [EMAIL PROTECTED] I am just becoming familiar with SpamAssassin, so I am sure this may appear to be an obvious issue to those familiar with the tool. I am just learning the ins and outs however. I downloaded many of the SARE rulesets (not bigevil however), and I am

Re: spamassassin --lint ....how long does it take?

2005-07-07 Thread jdow
From: Theo Van Dinter [EMAIL PROTECTED] I think you're not passing it a message so it's waiting on STDIN. Try spamassassin -D --lint /dev/null. Er, Theo, --lint does not take any parameters. {o.o}

Re: spamassassin --lint ....how long does it take?

2005-07-07 Thread jdow
From: Jim Maul [EMAIL PROTECTED] Theo Van Dinter wrote: On Thu, Jul 07, 2005 at 11:43:10AM -0700, Justin Mason wrote: eh, Theo, --lint doesn't require a message, it uses one of its own! Oh. Hahaha. I forgot about that. ;) Never mind me, brain is scattered right now due to work.

Re: SA training

2005-07-07 Thread Stuart Johnston
JamesDR wrote: Jean-Paul Natola wrote: Hi everyone, I'm new to SA so I need a bit of help in configuring /training SA- The problem I have is that I do not keep any mail in the SA box- it forwards to my mail server- What method can I use to train it? Since you are forwarding onto an

RE: spamassassin --lint ....how long does it take?

2005-07-07 Thread Sander Holthaus - Orange XL
I downloaded many of the SARE rulesets (not bigevil however), and I am running spamassassin -D --lint. It seems like it is taking a very long time to run. Is this typical or am I hosed? I am running it on a test system (non-production) so it is not currently a serious problem, but I

Re: SORBS_DUL and NJABL_DUL

2005-07-07 Thread Daryl C. W. O'Shea
Rick Macdougall wrote: Daryl C. W. O'Shea wrote: [EMAIL PROTECTED] wrote: Received: from host-212-158-194-14.bulldogdsl.com (HELO phoenix.example.com) (212.158.194.14) by secure.example.name with (DHE-RSA-AES256-SHA encrypted) SMTP; 1 Jul 2005 10:00:52 +0100 What SMTP service

Re: spamassassin --lint ....how long does it take?

2005-07-07 Thread Matt Kettler
Dr Robert Young wrote: I am just becoming familiar with SpamAssassin, so I am sure this may appear to be an obvious issue to those familiar with the tool. I am just learning the ins and outs however. I downloaded many of the SARE rulesets (not bigevil however), and I am running

RE: SA training

2005-07-07 Thread Jean-Paul Natola
OK I found the documentation for using IMAP2mbox to train, Now its quite simple to tell a user if its spam , drag it here But how is the user to know if they have a false positive, unless they look at the header like this one for example which I don't know WHY it says possible spam as it

ALL_TRUSTED and Razor, DCC and Pyzor

2005-07-07 Thread Kenneth S.
Is there anyway to configure SA so that if the ALL_TRUSTED rule is hit it skips the Razor, DCC and Pyzor tests? Thanks, Kenneth

Re: SA training

2005-07-07 Thread JamesDR
Jean-Paul Natola wrote: OK I found the documentation for using IMAP2mbox to train, Now its quite simple to tell a user if its spam , drag it here But how is the user to know if they have a false positive, unless they look at the header like this one for example which I don't know WHY it says

RE: SA training

2005-07-07 Thread Jean-Paul Natola
-Original Message- From: JamesDR [mailto:[EMAIL PROTECTED] Sent: Thursday, July 07, 2005 5:42 PM To: users@spamassassin.apache.org Subject: Re: SA training Jean-Paul Natola wrote: OK I found the documentation for using IMAP2mbox to train, Now its quite simple to tell a user if its

Re: ALL_TRUSTED and Razor, DCC and Pyzor

2005-07-07 Thread Theo Van Dinter
On Thu, Jul 07, 2005 at 04:34:03PM -0500, Kenneth S. wrote: Is there anyway to configure SA so that if the ALL_TRUSTED rule is hit it skips the Razor, DCC and Pyzor tests? Not without modifying code. -- Randomly Generated Tagline: It is far more impressive when others discover your good

Re: SORBS_DUL and NJABL_DUL

2005-07-07 Thread rns . spamassassin . n . semba
Sorry for the slight delay, replies inline: At 01:39 07-07-05, Daryl C. W. O'Shea - [EMAIL PROTECTED] wrote: Received: from host-212-158-194-14.bulldogdsl.com (HELO phoenix.example.com) (212.158.194.14) by secure.example.name with (DHE-RSA-AES256-SHA encrypted) SMTP; 1 Jul 2005 10:00:52

Re: SA training

2005-07-07 Thread Stuart Johnston
Jean-Paul Natola wrote: -Original Message- From: JamesDR [mailto:[EMAIL PROTECTED] Sent: Thursday, July 07, 2005 5:42 PM To: users@spamassassin.apache.org Subject: Re: SA training Jean-Paul Natola wrote: OK I found the documentation for using IMAP2mbox to train, Now its quite

Re: SORBS_DUL and NJABL_DUL

2005-07-07 Thread Daryl C. W. O'Shea
[EMAIL PROTECTED] wrote: Sorry for the slight delay, replies inline: At 01:39 07-07-05, Daryl C. W. O'Shea - [EMAIL PROTECTED] wrote: Received: from host-212-158-194-14.bulldogdsl.com (HELO phoenix.example.com) (212.158.194.14) by secure.example.name with (DHE-RSA-AES256-SHA encrypted)

Re: ALL_TRUSTED and Razor, DCC and Pyzor

2005-07-07 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Theo Van Dinter writes: On Thu, Jul 07, 2005 at 04:34:03PM -0500, Kenneth S. wrote: Is there anyway to configure SA so that if the ALL_TRUSTED rule is hit it skips the Razor, DCC and Pyzor tests? Not without modifying code. However, it is

Re: ALL_TRUSTED and Razor, DCC and Pyzor

2005-07-07 Thread Kelson
Theo Van Dinter wrote: On Thu, Jul 07, 2005 at 04:34:03PM -0500, Kenneth S. wrote: Is there anyway to configure SA so that if the ALL_TRUSTED rule is hit it skips the Razor, DCC and Pyzor tests? Not without modifying code. You could probably create a set of meta-rules to counteract the

RE: ALL_TRUSTED and Razor, DCC and Pyzor

2005-07-07 Thread Sander Holthaus - Orange XL
I think that is an excellent idea! I call spamc from maildrop, so I can filter out some message's that do not need to be processed by SpamAssassin. But it would be much easier for most installations if such behaviour can be done from within SpamAssassin. You might want to add even an extra

Re: ALL_TRUSTED and Razor, DCC and Pyzor

2005-07-07 Thread Kenneth S.
Well this works out. I started putting something together after Theo's response. I already have it working and skipping the checks based on ALL_TRUSTED but did not add any debug code. Since it looks like this is something that you want in SA I'll add debug code and put a patch together. I

Re: SpamAssassin w/POP3 SMTP outsourced e-mail server...

2005-07-07 Thread Loren Wilton
I don't immediately see that anyone more knowledgable replied, so I'll toss out some possibilities/confirmations: Yes, you need something like a Linux box. It will run SA, and will retrieve mail using pop3 from your current provider. Pop3proxy is one possibility. Another possibility is

Re: SA training

2005-07-07 Thread Loren Wilton
at the header like this one for example which I don't know WHY it says possible spam as it scored a ZERO X-Spam-Score: 0.0 (/) Is that directly out of SA? Or do you have sometrhing else like qmail or some such in the path? If that is straight out of SA, something looks broken as all heck.

RE: ALL_TRUSTED and Razor, DCC and Pyzor

2005-07-07 Thread lists
Hello, Man, I can't wait till these kinds of features get implemented. Another similar idea would be to stop SA scanning if the score gets to a certain number. On heavily hit mail servers, these kinds of features would help with CPU usage. As it stands now, SA goes through all of the

Re: Tsunami warning hits the spam barrier

2005-07-07 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 yeah, I saw that -- the message scores 3.7 according to the report, well under 5. It's pretty reckless to lower the threshold enough to cause that to hit as spam. however, it'd be nice to get a copy with full headers so we could think about

Re: ALL_TRUSTED and Razor, DCC and Pyzor

2005-07-07 Thread Theo Van Dinter
On Thu, Jul 07, 2005 at 07:24:02PM -0500, Kenneth S. wrote: Skip DNS tests (Default option = 0) -Skip Razor, Pyzor and DCC checks and the above tests (option = 1) -Skip all checks (option = 2) How does that look? Also what would the option be called? This really belongs on dev, but...

Re: Tsunami warning hits the spam barrier

2005-07-07 Thread Daryl C. W. O'Shea
Justin Mason wrote: however, it'd be nice to get a copy with full headers so we could think about whitelisting it ;) - --j. The problem arises if the open source filter is installed straight out of the box; the messages (usually written in upper case) are not considered spam. According to

RE: SA training

2005-07-07 Thread Jean-Paul Natola
I wish I can Answer That with 100% certainty, Here's what I did, Installed Freebsd, then installed exim, then clamav and finally SA, All were done via passive ftp -Original Message- From: Loren Wilton [mailto:[EMAIL PROTECTED] Sent: Thursday, July 07, 2005 8:33 PM To:

Re: Tsunami warning hits the spam barrier

2005-07-07 Thread Gene Heskett
On Thursday 07 July 2005 21:15, Daryl C. W. O'Shea wrote: Justin Mason wrote: however, it'd be nice to get a copy with full headers so we could think about whitelisting it ;) - --j. The problem arises if the open source filter is installed straight out of the box; the messages (usually

Re: Tsunami warning hits the spam barrier

2005-07-07 Thread Daryl C. W. O'Shea
Gene Heskett wrote: On Thursday 07 July 2005 21:15, Daryl C. W. O'Shea wrote: Justin Mason wrote: however, it'd be nice to get a copy with full headers so we could think about whitelisting it ;) - --j. The problem arises if the open source filter is installed straight out of the box; the

Re: SpamAssassin w/POP3 SMTP outsourced e-mail server...

2005-07-07 Thread jdow
No, it doesn't. We go fetchmail to procmail to mailbox and local POP3 server. AV filtering is done on the local machines via a standard AV tool that is maintained up to date automatically. I don't trust tools like ClamAV to be as up to the minute as the email scanners. (Besides, SA filters here as

Re: Tsunami warning hits the spam barrier

2005-07-07 Thread jdow
From: Gene Heskett [EMAIL PROTECTED] On Thursday 07 July 2005 21:15, Daryl C. W. O'Shea wrote: Justin Mason wrote: however, it'd be nice to get a copy with full headers so we could think about whitelisting it ;) - --j. The problem arises if the open source filter is installed

Re: SpamAssassin w/POP3 SMTP outsourced e-mail server...

2005-07-07 Thread Loren Wilton
Procmail will act as the pop3 server Not quite. My belief (and Joanne set this up, so she has the actual details) is that Fetchmail is feeding procmail, possibly going through Sendmail to do this. Procmail has a 2-line recipe that calls SA as part of the delivery process for local deliery

Re: Tsunami warning hits the spam barrier

2005-07-07 Thread Loren Wilton
All we hope for is that a system is in place by the time half of LaPalma slides into the ocean. If the predictions are correct, our gulf coast/florida real estate will need all new maps. The Indonesian tsunami was a ripple in the bathtub in comparison according to some doomsayers.

Re: SpamAssassin w/POP3 SMTP outsourced e-mail server...

2005-07-07 Thread Jesse Shumaker
We have 9 site and around 20 users who need e-mail on average per site. What I really want in the end is a SpamAssassin, ClamAV, setup. I want to make it so that the users can either grab their filtered mail from a linux box inside each site that has already pulled their mail from the ISP's mail

Re: SA training

2005-07-07 Thread Steven Dickenson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Jul 7, 2005, at 9:30 PM, Jean-Paul Natola wrote: Here's what I did, Installed Freebsd, then installed exim, then clamav and finally SA, All were done via passive ftp The default Exim configuration files do not do any SA scanning, so you

Re: SpamAssassin w/POP3 SMTP outsourced e-mail server...

2005-07-07 Thread Steven Dickenson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Jul 7, 2005, at 10:59 PM, Loren Wilton wrote: Procmail will act as the pop3 server Not quite. My belief (and Joanne set this up, so she has the actual details) is that Fetchmail is feeding procmail, possibly going through Sendmail to do