Re: SpamAssassins bayes mechanism and message headers

2009-03-18 Thread floss
Matt Kettler mkettler...@verizon.net wrote: fl...@pbartels.info wrote: Hello, instead of disabling a lot possibly set message headers using bayes_ignore_header and ending up in strange configs like: bayes_ignore_header Return-Path bayes_ignore_header Received bayes_ignore_header X-Spam-Flag

interesting flash attack in spam

2009-03-18 Thread Michael Scheidell
just saw this one in email. terra.com/ spamcop.com./br are hosting trojans. but this email uses flash to load this: param name=movie value=http://www.terra.com.br/cartoes/datas/amor.swf; (which redirects to http://cartoes.terra.com.br/datas/amor.swf ) than trys to load a binary:

I think SpamAssassin does not check every mails

2009-03-18 Thread Sheeen
Hi all, We have an amavisd/spamassassin/clamav gateway before our Exchange server. I've trained spamassassin with about 3500 hams / 3500 spams, it should work correctly, and I'm training it regularly. But we're receiving some spams yet. I've looked into the headers of spams received

Re: I think SpamAssassin does not check every mails

2009-03-18 Thread Mark Martinec
Sheeen, We have an amavisd/spamassassin/clamav gateway before our Exchange server. I've trained spamassassin with about 3500 hams / 3500 spams, it should work correctly, and I'm training it regularly. But we're receiving some spams yet. I've looked into the headers of spams received

Re: SpamAssassins bayes mechanism and message headers

2009-03-18 Thread John Hardin
On Tue, 17 Mar 2009, Matt Kettler wrote: SA extensively parses the headers. It parses *all* headers, even nonstandard ones that I could randomly configure a server to add like X-Matts-funky-header: Hi!. If at a later date you add a header to the ignore list, does Bayes forget that it's

Re: SpamAssassins bayes mechanism and message headers

2009-03-18 Thread Matt Kettler
John Hardin wrote: On Tue, 17 Mar 2009, Matt Kettler wrote: SA extensively parses the headers. It parses *all* headers, even nonstandard ones that I could randomly configure a server to add like X-Matts-funky-header: Hi!. If at a later date you add a header to the ignore list, does Bayes

Re: interesting flash attack in spam

2009-03-18 Thread Ned Slider
Michael Scheidell wrote: just saw this one in email. terra.com/ spamcop.com./br are hosting trojans. but this email uses flash to load this: param name=movie value=http://www.terra.com.br/cartoes/datas/amor.swf; (which redirects to http://cartoes.terra.com.br/datas/amor.swf ) than trys to

Re: I think SpamAssassin does not check every mails

2009-03-18 Thread Sheeen
Thanks for your reply, I'll check my local.cf amavisd.conf. Have a nice day =) -- View this message in context: http://www.nabble.com/I-think-SpamAssassin-does-not-check-every-mails-tp22576920p22579097.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: SpamAssassins bayes mechanism and message headers

2009-03-18 Thread Karsten Bräckelmann
On Wed, 2009-03-18 at 08:00 +0100, fl...@pbartels.info wrote: Matt Kettler mkettler...@verizon.net wrote: Is there any reason to think headers make bad tokens? For example the X-Spam-Flag: NO can cause Problems if you don't remove it before parsing and don't set it yourself. (You'll

Re: spamassassin freebsd amd64 bug? [Bug 5548] New: Spamassassin hangs with 100% CPU usage with 1 specific mail

2009-03-18 Thread Karsten Bräckelmann
On Tue, 2009-03-17 at 21:32 -0400, Matt Kettler wrote: Michael Scheidell wrote: ram across this bug posting about a rumored problem with freebsd, amd64 and spamassassin. trying to follow the bug url, got 'you are not allowed to view this bug' FWIW, this bug is not made public due to

Re: interesting flash attack in spam

2009-03-18 Thread John Hardin
On Wed, 18 Mar 2009, Michael Scheidell wrote: both files still exist on the hosts, and neither was identified by clamav, and neither triggered any ET (snort) rules, SA didn't trigger any rules except these: HTML_EMBEDS=0.056, HTML_EXTRA_CLOSE=2.809, HTML_MESSAGE=0.001,

Re: What is AWL?

2009-03-18 Thread Ralf Hildebrandt
* Georgy Goshin go...@inbox.ee: 7.7 AWLAWL: From: address is in the auto white-list What is AWL rule? Why it gives so different amount of points? How to resolve this? AutoWhiteList -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité -

Re: What is AWL?

2009-03-18 Thread Georgy Goshin
I understood the spelling of AWL, but why the scores is different? How to tune them? G. - Original Message - From: Ralf Hildebrandt ralf.hildebra...@charite.de To: users@spamassassin.apache.org Sent: Wednesday, March 18, 2009 7:47 PM Subject: Re: What is AWL? * Georgy Goshin

Re: What is AWL?

2009-03-18 Thread John Hardin
On Wed, 18 Mar 2009, Georgy Goshin wrote: 6.6 AWLAWL: From: address is in the auto white-list another: 9.0 AWLAWL: From: address is in the auto white-list and another: 7.7 AWLAWL: From: address is in the auto white-list What is AWL

Re: What is AWL?

2009-03-18 Thread LuKreme
On 18-Mar-2009, at 12:07, John Hardin wrote: It's intended to allow an occasional spammy-looking message from a historically hammy correspondent to get through, hence auto whitelist. Well, it works just as well to prevent the occasional hammy message from getting through from a spammy

turn off bayes?

2009-03-18 Thread McDonald, Dan
I normally disable bayes, because without proper training it tends to make spamassassin less reliable. But I've got one installation that is stubbornly running bayes even though I have disabled it. I set use_bayes 0 in /etc/mail/spamassassin/local.cf I set use_bayes 0 in

Re: SpamAssassins bayes mechanism and message headers

2009-03-18 Thread Jeff Mincy
From: Matt Kettler mkettler...@verizon.net Date: Tue, 17 Mar 2009 21:30:02 -0400 fl...@pbartels.info wrote: Hello, instead of disabling a lot possibly set message headers using bayes_ignore_header and ending up in strange configs like: bayes_ignore_header

Re: SpamAssassins bayes mechanism and message headers

2009-03-18 Thread Greg Troxel
Jeff Mincy j...@delphioutpost.com writes: From: Matt Kettler mkettler...@verizon.net Date: Tue, 17 Mar 2009 21:30:02 -0400 shouldn't SpamAssassins bayes mechanism just ignore the complete message header and just look at the body? This seems useful in my opinion. It

Re: interesting flash attack in spam

2009-03-18 Thread Michael Scheidell
John Hardin wrote: plug type=shameless My email sanitizer successfuly defends against this attack. /plug :) mine did too... but it quarantined it in my 'this was only stopped due to custom rules, maybe SA group would like to see it' pile. and, didn't see any SA rules (or SARES rules)

Re: SpamAssassins bayes mechanism and message headers

2009-03-18 Thread Jeff Mincy
From: Greg Troxel g...@ir.bbn.com Date: Wed, 18 Mar 2009 15:33:31 -0400 Jeff Mincy j...@delphioutpost.com writes: From: Matt Kettler mkettler...@verizon.net Date: Tue, 17 Mar 2009 21:30:02 -0400 shouldn't SpamAssassins bayes mechanism just ignore the

Re: turn off bayes?

2009-03-18 Thread Mark Martinec
Dan, I normally disable bayes, because without proper training it tends to make spamassassin less reliable. But I've got one installation that is stubbornly running bayes even though I have disabled it. I set use_bayes 0 in /etc/mail/spamassassin/local.cf I set use_bayes 0 in

Re: interesting flash attack in spam

2009-03-18 Thread hamann . w
Michael Scheidell wrote: just saw this one in email. terra.com/ spamcop.com./br are hosting trojans. but this email uses flash to load this: param name=movie value=http://www.terra.com.br/cartoes/datas/amor.swf; (which redirects to http://cartoes.terra.com.br/datas/amor.swf )

RE: JoeJobbed - Vbounce plugin - SPF?.

2009-03-18 Thread Michael Hutchinson
-Original Message- From: Matus UHLAR - fantomas [mailto:uh...@fantomas.sk] Sent: Tuesday, 17 March 2009 10:17 p.m. To: users@spamassassin.apache.org Subject: Re: JoeJobbed - Vbounce plugin - SPF?. On 17.03.09 14:02, Michael Hutchinson wrote: I'm running Spamassassin 3.1.7, with netqmail

Sa-update problem

2009-03-18 Thread Bryan Lee
I'm a new administrator at a site and have been tasked with updating Spam Assassin, something I have never worked with before. I am running /usr/perl5/5.8.4/bin/sa-update daily as a cronjob, but I'm not sure if this is accomplishing anything. I have read through FAQs and documentation, but

RE: interesting flash attack in spam

2009-03-18 Thread RobertH
http://pastebin.com/m2fcbe7b5 Thanks for posting the sample. plug type=shameless My email sanitizer successfuly defends against this attack. /plug :) -- John Hardin no disrespect intended yet i would like to understand... u, if your email sanitizer

Spam Assassin White List

2009-03-18 Thread dsh979
I am having trouble with the standard White List BlackList configuration in the SpamAssassin user preferences file. The Manual White List user guide at http://wiki.apache.org/spamassassin/ManualWhitelist states Adding a user to your whitelist gives them a -100 score, which has the effect of

Re: interesting flash attack in spam

2009-03-18 Thread mouss
RobertH a écrit : http://pastebin.com/m2fcbe7b5 Thanks for posting the sample. plug type=shameless My email sanitizer successfuly defends against this attack. /plug :) -- John Hardin no disrespect intended yet i would like to understand... u, if your

Re: Sa-update problem

2009-03-18 Thread mouss
Bryan Lee a écrit : I'm a new administrator at a site and have been tasked with updating Spam Assassin, something I have never worked with before. I am running /usr/perl5/5.8.4/bin/sa-update daily as a cronjob, but I'm not sure if this is accomplishing anything. I have read through FAQs and

Re: SpamAssassins bayes mechanism and message headers

2009-03-18 Thread Matt Kettler
Jeff Mincy wrote: From: Matt Kettler mkettler...@verizon.net Date: Tue, 17 Mar 2009 21:30:02 -0400 fl...@pbartels.info wrote: Hello, instead of disabling a lot possibly set message headers using bayes_ignore_header and ending up in strange configs like:

Re: SpamAssassins bayes mechanism and message headers

2009-03-18 Thread Jeff Mincy
From: Matt Kettler mkettler...@verizon.net Date: Wed, 18 Mar 2009 19:49:53 -0400 Jeff Mincy wrote: From: Matt Kettler mkettler...@verizon.net Date: Tue, 17 Mar 2009 21:30:02 -0400 fl...@pbartels.info wrote: Hello, instead of

Re: Spam Assassin White List

2009-03-18 Thread John Hardin
On Wed, 18 Mar 2009, dsh979 wrote: I have found that when I add manually a user to the whitelist (in the SpamAssassin user preferences file) I get inconsistent results: ... I have also found that when I manually a user to the blacklist (in the SpamAssassin user preferences file) I get the

¿Qué tiene que ver Software Libre con educación?

2009-03-18 Thread Jorge Cardona
¿Qué tiene que ver Software Libre con educación? Más tarde o más temprano, la computadora va a pasar a formar parte del herramental educativo. Una vez que se haya asentado el polvo levantado por los profetas de la panacea electrónica, que pretenden resolver dificultades estructurales del sistema