Re: [SAtalk] stats
On Fri, 2004-01-23 at 15:19, Justin Mason wrote: > > svn co http://svn.apache.org/repos/asf/incubator/spamassassin/trunk > > or http://svn.apache.org/viewcvs.cgi/incubator/spamassassin/trunk/?root=Apache-SVN > > - --j. I tried those and got a connection timeout. Anyone else have this problem? -- AltGrendel <[EMAIL PROTECTED]> --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Spamassassin on Qmail Relay
On Thu, 2004-01-22 at 11:48, Atif Faruqui wrote: > Hi, > > I am running Qmail-1.03 running qmail-scanner-1.16 which calls SpamAssassin-2.61. > This is running on a Solaris 9 box. This is a relay configuration in which relay > server > accepts mail, do spam filtering (spamassassin) and virus check (Mcaffee) and then > sends mail to exchange server. Lately i am noticing that alot of spam is going to > users inbox. Users have a rule in their outlook client where all messages which have > header "X-Spam-Status:Yes" goes to their spam box But now 50 % of spam goes > in their inbox. I lowered the threshold to 3 but still same result. I turned the > verbose > logging on in qmail and i notice that some of the email message dont have any > spamassassin headers and some do. I imagine that all the incoming messages > should have something like this "X-Spam-Status:" But i dont see this header on all > messages and i believe this is the reason why half of the spam is going in users > inbox. Please let me know how i can troubleshoot/resolve this problem > > Thanks > Atif Faruqui > Unix Sys Admin > triVIN, Inc > > Check the maillog file and see if you're getting a connection refused messages or some such message that indicates that it's waiting for processes to die so it can spawn a spamd child for scanning. I'm not familiar with the Mcaffee scanner, so it might be that the virus scanner is taking too long and timing out. If that doesn't help you might try http://www.exit0.us/index.php/GettingAdvice Good luck. -- AltGrendel <[EMAIL PROTECTED]> --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] [SAtalk]Change points of preset rules
On Fri, 2004-01-23 at 06:10, Thorsten Schacht wrote: > Hey guys. > > How can I change the points of the rules included in spamassassin? > I'm trying to increase the points from the HTML_IMAGE_ONLY_02 BODY rule. > Edit the local.cf in /etc/mail/spamassassin directory and add something like: score HTML_IMAGE_ONLY_02 5 The 5 at the end of the line is the new score. Then restart spamd, if that's how you're using spamassassin. The 5 is an arbitrary number, you should adjust to your needs. -- AltGrendel <[EMAIL PROTECTED]> --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] expand_regex: a tool for debugging regex rules
On Tue, 2004-01-27 at 14:56, Gary Funck wrote:
> Attached is a perl script, expand_regex.pl, which will accept an SA rules
> file
> on standard input and will by default output the expansions of those rules,
> taking
> into account regex factoring due to parentheses. When invoked with
> the -verbose option, the program will preface the expansion by the rule. It
> has several
> options which will cause it to expand various commonly used idioms inside
> regex
> patterns such as \d, [set of chars], {repetition count}, and ?. Note that
> these
> expansion options are off by default, and when enabled can create some very
> large
> expansion sequences.
>
I've taken the liberty of adding this to the Exit0 wiki. It's at
http://www.exit0.us/index.php/ExpandRegex
--
AltGrendel <[EMAIL PROTECTED]>
---
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] too much spam...
On Mon, 2004-01-26 at 10:43, Paul Diaguila wrote: > Greetings > > Using SA Ver. 2.63 with Mimedefang, and still quite a bit of spam is > getting through. Have all the current BigEvil, ect... As an > example, a rule is in place in local.cf > > header SUBJECT_ENCODED_MY_TEST Subject:raw =~ /=\?.*\?=/i > describe SUBJECT_ENCODED_MY_TEST Subject begins with =? > scoreSUBJECT_ENCODED_MY_TEST 5.0 > > When a message comes in: > > Subject: > =?ISO-8859-1?b?V2UgaGF2ZSB3aGF0IHlvdSBuZWVkIC0gQ2hlYXBlc3QgcHJlc2NyaXB0aW8vbnMgb24gdGhlIGludGVybmV0?= > Content-Type: multipart/alternative; > boundary="=_NextPart_000_0CAC_A6ABA171.138272BD" > X-Spam-Score: 3.422 > BAYES_00,FORGED_OUTLOOK_TAGS,HTML_50_60,HTML_IMAGE_ONLY_02,HTML_MESSAGE,HTML_TAG_BALANCE_BODY,RM_rb_ANCHOR,RM_rb_BODY,RM_rb_HTML,SUBJECT_ENCODED_MY_TEST > X-Scanned-By: MIMEDefang 2.30 (www . roaringpenguin . com / > mimedefang) > > ??? Not sure what you're getting at here, try: http://www.exit0.us/index.php/GettingAdvice -- AltGrendel <[EMAIL PROTECTED]> --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] RE: Spamassassin doesn't appear to be running...?
On Mon, 2004-01-26 at 10:21, Webmaster wrote: > > Message: 26 > > Subject: RE: [SAtalk] Spamassassin doesn't appear to be running...? > > From: AltGrendel <[EMAIL PROTECTED]> > > To: SA-Talk <[EMAIL PROTECTED]> > > Date: Fri, 23 Jan 2004 10:31:52 -0500 > > > > > > You may also need something like this: > > http://qmail-scanner.sourceforge.net/ > > > > -- > > AltGrendel <[EMAIL PROTECTED]> > > > I tried downloading the qmail-queue RPM and got a "This is not a valid RPM > file" error. I tried to install the qmail-scanner referenced and nothing > happened. (Webmin showed an "Installed packages" page which was blank, as if > nothing actually installed after I ran the install.) I'm getting frustrated > that one program tells me I need another program installed first, and that > other program tells me I need the first one installed. Nearly 2 weeks into > this process I still have nothing but spamd running, and nothing getting > tagged as spam! :-( > > Wm > Hmm. It may be a source RPM. I usually work with the tar ball with no problems. You may want to check out the qmail-queue mail list/archives for help at this point. -- AltGrendel <[EMAIL PROTECTED]> --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] stats
On Fri, 2004-01-23 at 00:14, Bob Apthorpe wrote: > Hi, > > On Thu, 22 Jan 2004 15:12:06 -0600 Wagner One <[EMAIL PROTECTED]> wrote: > > > On 1/22/2004 1:15 PM, Bob Apthorpe wrote: > > > > > Note: I think this my hacked-up version of sa-stats.pl at > > > http://www.cynistar.net/~apthorpe/code/sa-contrib/sa-stats.pl > > > > > > I'm not sure where the canonical version of sa-stats.pl lives since the > > > migration from Sourceforge/CVS to Apache/SVN. I worked from the source at > > > http://cvs.sourceforge.net/viewcvs.py/spamassassin/spamassassin/tools/sa-stats > > > .pl and I think Duncan fixed some date problems in my patch involving the new > > > year before committing it. The current version is probably in Apache's SVN > > > repository but I have no clue where that is, how to browse it, etc. :/ So what is the current "official" site for this? -- AltGrendel <[EMAIL PROTECTED]> --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] Spamassassin doesn't appear to be running...?
On Thu, 2004-01-22 at 13:56, Webmaster wrote: > > Hmmm, when I look at the Qmail configuration in Webmin I see no > reference (nor a place for it) to spamc. I don't even see a reference to > spamassassin. When I look at the qmail action in the bootup process, this > is the entire script: > You may also need something like this: http://qmail-scanner.sourceforge.net/ -- AltGrendel <[EMAIL PROTECTED]> --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Hello, new to list ! :-)
On Wed, 2004-01-21 at 09:38, Brad Hazledine wrote: > On Wed, 21 Jan 2004, Spyros Tsiolis wrote: > > > Hello list ! > > Hello. > > > > I am kinda new here chaps, so please bare with me. > > > > A simple question (which I didn't pose on the xmail forum in case I > > get flamed/cursed) :-) > > > > >From what it seems, one must let spamassassin know of what to filter > > as spam mail; So far so good. > > > > It also looks like one has to invoke a special format of expressions > > (regex's?) > > to the .cf file living under /etc/mail/spamassassin/local.cf > > Spamassassin is already configured to filter spam, the local.cf is for > customization. > > You will find thousands of examples of regular expressions in your > /usr/share/spamassassin directory. You will also find loads of rules > covering recent trends here > > http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm > http://kepler.acns.bethel.edu/~bjn/spamassassin/ > http://www.emtinc.net/spamhammers.htm > There is also http://wiki.spamassassin.org and http://www.exit0.us -- AltGrendel <[EMAIL PROTECTED]> --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Another one for BigEvil
On Wed, 2004-01-21 at 09:33, Rubin Bennett wrote: > Sneaky bastard... got through with a 4.7 Chris: Would you prefer that we email you this stuff offlist? I have a few too, but I don't want to contribute to the line noise on this list. -- AltGrendel <[EMAIL PROTECTED]> --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] [OT] - The current state spam.
On Tue, 2004-01-20 at 18:28, Fred wrote: > > I can not imagine what it would be like to work for an abuse dept. at > an internet company and receive hundreds or thousands of complaints > about customers computers being hijacked or turned into spam zombies. > Non-original joke: I think that job is usually assigned to /Dave/Null. -- AltGrendel <[EMAIL PROTECTED]> --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Automated ruleset download
On Tue, 2004-01-20 at 13:52, JRiley wrote: > Just curious, if there is a script (be it perl or otherwise), that > anyone has written, that will perform an automated 'download' of the > different SARE (or other) SA rulesets? > I wouldn't think this would too difficult to do, and have a scheduled > restart of the MTA calling SA to implement it. > > thanks > -JR Try this: http://www.exit0.us/index.php/RulesDuJour I think it's what you're looking for. -- AltGrendel <[EMAIL PROTECTED]> --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] V-drug spam gets *0* hits on SA 2.55
On Tue, 2004-01-20 at 07:53, Christopher X. Candreva wrote: > On Tue, 20 Jan 2004, Scott A Crosby wrote: > > > Read it and weep. :( > > This looks very similar to the one I posted about yesterday. See this mbox: > http://www.westnet.com/~chris/Spam0118 > I would try the antidrug.cf at "http://mywebpages.comcast.net/mkettler/sa/antidrug.cf Install it in /etc/mail/spamassassin and restart spamd if necessary. It's been working great for me (Thanks Matt). -- AltGrendel <[EMAIL PROTECTED]> --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Where to put new rules...
On Mon, 2004-01-19 at 14:14, Ron Gilbert wrote: > I have two questions: > > 1) Where do i put new rules, or changes to scores. I have heard several > different things, and I'm sure there are reason for each, but i can't figure > it out. As far as i ca tell, there is (RH9): > > ~/.spamassassin/user_prefs > /usr/share/spamassassin > /etc/mail/spamassassin > > Are there others? > > I am the only user on the machine. > > And the second questions is when i add a new .cf file, or change an existing > one (including user_prefs), do i need to restart spamd? Is there some kind of > log file generated that will tell me when/if my new rules have been read? > You want to use /etc/mail/spamassassin and yes, you want to restart spamd. Also check out http://www.exit0.us/index.php/GettingAdvice since this question has been asked before. ...many times. -- AltGrendel <[EMAIL PROTECTED]> --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] FP on MY_HTTP_ODD_PORT
On Thu, 2004-01-15 at 16:17, Alan Munday wrote: > Matt/Theo > > Yes it did come from the "other" wiki. > > This raises the question of how can we learners tell what is no longer valid > from the custom rule sets? > > Also are there any established processes for managing them? > It's a wiki. You can make changes or comments on the wiki as you like. I don't mind, since I'm not "competing" with the official SA wiki. Cross linking between the two would actually be great as far as I'm concerned. My only request is to be responsible and mature about posting on the wiki. -- AltGrendel <[EMAIL PROTECTED]> --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] Forged mail pretending to be from MS Outlook
On Mon, 2004-01-12 at 15:50, Mitch (WebCob) wrote: > I keep saying this and no one does... (not sure if it's you, or if > there are a lot of people sending the same question) - MORE > INFORMATION is needed. > > 0) READ THE ACHIVES > 1) SEND THE HEADERS > 2) FILE A BUG REPORT > You can also refer folks to this link, http://www.exit0.us/index.php/GettingAdvice -- AltGrendel <[EMAIL PROTECTED]> --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] SA 2.55, (?/?)
On Thu, 2004-01-08 at 12:39, Russell Mann wrote: > Received: from [EMAIL PROTECTED] by dude.myhost.com by uid 504 with > qmail-scanner-1.20rc3 > (clamscan: 0.60. spamassassin: 2.55. Clear:RC:0:SA:0(?/?):. > Processed in 16.851793 secs); 08 Jan 2004 10:20:46 - > > > Hello, > > The spam that get through my current filter setup always have this (?/?) > scoreing in their headers. Can anyone tell me what this means? How can I > do something about it? > It's been a long time since I saw that on my server. I would check your current /var/log/maillog or /var/spool/qmailscanner/qmail-queue.log and make sure that there are no error msgs. Like maybe spamd is not running. I would also consider upgrading to the latest and greatest SA. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering advanced branching capabilities and atomic changes on 50+ platforms. Free Eval! http://www.perforce.com/perforce/loadprog.html ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] Bigevil 2.06f posted.
On Thu, 2004-01-08 at 20:33, Chris Santerre wrote: > Sorry it took me so long to reply. I'm working from home today. (don't ask!, > but no it isn't a hockey injury :p) > > Yup, the regex is getting slowy rewritten rule by rule. Faster processing. I > still add more domains every update. I've actually pulled out a few that > expired or were bogus as well. > > Next update should be Monday or Tuesday. Lots of preasure to get each > update right. :) > > --Chris > Maybe you should setup CSV and start a dev team? (I'd help if I could but I suck at regex) -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering advanced branching capabilities and atomic changes on 50+ platforms. Free Eval! http://www.perforce.com/perforce/loadprog.html ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] Re: The Wiki at www.exit0.us is down!
On Thu, 2004-01-08 at 01:21, Wolfram Schroeder wrote: > Hi, > > I'm mailing you because you're the administrator/owner of the domain > www.exit0.us. > > We, the german rule developers, noticed that the wiki at www.exit0.us > has been down for quite some time. We would like to know if the wiki > will be restarted and if it is at least possible to get the content e.g. > as backup files out of it and if you could possibly send it to me - I'm > especially interested in the pages WolfRam, German*, de_* ! > > Best regards, > Wolfram Hi Wolfram, sorry for the trouble. While I was away on vacation, my server decided to crash hard. This took out both the /var and / partitions. Fortunatly I have tape backups and I finished restoring the site this morning. The last backup was as of Jan 1, 2004. I would appreciate it if you and any other contributors please check the content of any pages that you regularly edit and make sure that everything is ok. If anyone has any questions, please email me off list. Thank you for your patience. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering advanced branching capabilities and atomic changes on 50+ platforms. Free Eval! http://www.perforce.com/perforce/loadprog.html ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] checking outgoing mail
On Sat, 2003-12-20 at 11:11, Jeff Koch wrote: > Hi, > > We've been burned a few times by spammers getting into our servers to send > out spam. Does anyone know (or can provide a reference) for how SA could be > integrated into qmail to examine outgoing emails? > > Thanks. > Modify your tcp.smtp file. You would eliminate the RELAYCLIENT='' from the non-localhost lines. You'll need to experiment a little. I did this by accident when I also accidently left my server open as a relay. I came back from the weekend with a queue full of pre-marked spam. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] check vs learn (Design issues with SA)
On Fri, 2003-12-19 at 05:35, Robert Nicholson wrote: > I'm guessing a little here but it looks to me as though if I have > create a brand new Mail::Audit > and I wish to call learn. The way things are setup at the moment is > that it assumes I've previously called check or something because > otherwise the mail object won't be a NoMailAudit which I think Bayes > wants to be when learning the message. > > > What's happening is that since I'm using a Mail::Audit somewhere it's > not being wrapped by the NoAudit because it's calling get_pristine_body > and Mail::Audit::Internet doesn't respond > to that method. > > Can somebody explain just exactly why I'm able to learn from a > Mail::Audit sometimes and not others? ie. Sometimes the Mail::Audit > gets ecapsulated correctly but sometimes it doesn't. > You might want to talk to SADev mail list about this. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] importing spam from exchange users for sa-learn?
On Thu, 2003-12-18 at 12:40, Hamilton, Kent wrote: > I've done it via IMAP on both 5.5 and 2k and had no problems with the > headers getting munged. I just went and checked 'em again by pulling them > via IMAP dumping to a file and looking at 'em and the headers appear to be > fine with no added MS junk. You guys are making me nervous though because > we are getting ready to upgrade our servers to 2003. > > I think it's an issue of public vs private folders. I have an IMAP script that pulls the files from an SA account just fine. It was when I tried to use public folders that the problem arose. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] importing spam from exchange users for sa-learn?
On Thu, 2003-12-18 at 10:03, Yackley, Matt wrote: > SNIP! > > Here is what we saw while moving from Exchange 5.5 to Exchange 2000: > 1. Mail is sent through SA and marked up. > 2. Message is sent from SA relay to Exchange 5.5 IMC (Internet Mail > Connector) > 3. Message that stayed with the 5.5 system, even if sent to another > site/server, retained all header info > 4. Messages that were routed from the 5.5 boxen to Exchange 2000 boxen, > had all SMTP headers destroyed and new headers started by 2000 > > What fixed the issue for us: > Once we were able to have the SA relay box send the messages to Exchange > 2000 instead of 5.5 IMC, everything was fine, all original headers were > retained. Even when Exchange 2000 routed the messages to a 5.5 server, > it still retained the headers. > > Theory: > Exchange 5.5 -> Exchange 2000 = rebuilt headers > Exchange 2000 -> Exchange 5.5 = no problems > This may be an issue with public folders as well, possibly if the mail > is moved from a 5.5 box or 5.5 based mail client and dropped or emailed > to Exchange 2000 public folder it probably munges the headers. > > Thoughts, flames, comments? > We're running Exchange 2k that was upgraded from 5.5, which was upgraded from ...(you get the idea). Anyway, I'm still seeing the old header style and I'm wondering if it's not an issue with upgrade vs clean install. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] importing spam from exchange users for sa-learn?
On Thu, 2003-12-18 at 00:38, Tony W. Bunce wrote: > The way we have it setup is we have a public folder on the exchange server for spam > (and/or ham) > and there is a script on our spam server that reads the public folder, creates a > file for each message, > and deletes the message from the public folder. Then all you have to do is run > sa-learn > on the folder you saved the messages to. > > If you'r interested let me know and I'll attach the script we use. > Wasn't there a big issue with public folders stripping off the original email headers and replacing them with something else? -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] One persistent spammer defeating SA.
On Sun, 2003-12-07 at 01:28, Robert Nicholson wrote: > I've got a mailbox full of messages that got past SA > > They are all from the same spammer. > SNIP!! > All of these scored less the 0.6 hits > > I've posted abbreviated headers for brevity. > > Do we have a way of dealing with the spammer who's Reply-To's always > look the same? > > Is Bayes the only way of handling these? > I would actually research the domains. I bet that if you use dig and www.arin.net, you'll find that they all go to the same net block. I would then either write a rule for that net block, or talk to your firewall guys about blocking that range. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] Detecting strings of Gibberish
On Thu, 2003-12-11 at 11:17, Tom Meunier wrote: > http://www.wot.no-ip.com/cgi-bin/detoken.pl > > Most of the gibberish I see is encoded tracking information. I plugged > in my domain name to the little script thingy, saved the .cf file, and > it catches 'em like crazy. > I've added a link for this to the front page of the wiki at http://www.exit0.us Hope you don't mind. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] autoreply to spam.
On Tue, 2003-12-16 at 20:45, Dan Wilder wrote: > > The reasons I would never in a million years set up such an > autoresponder are: > > * It only increases the burden on the Internet and on one's own >mail servers, attempting to send mail which will in most cases >simply time out due to unreachable recipients. > > * It spams innocent victims whose addresses have been forged >by the spammers. > > * Most people I know simply discard such mail. I sure do. > There is also the theory (or fact) that it confirms an active email address/domain for the spammer. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] SA 6.0 installed, spamd using 2.5.5 ???
On Tue, 2003-11-04 at 13:34, MIKE YRABEDRA wrote: > I have SA 6.0 installed and running, but my emails say that they were > processed using 2.5.5 (the version I had installed before 6) > > Any ideas? > Not enough information here to be much help. Try http://www.exit0.us/index.php/GettingAdvice -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Sole scanner?
On Mon, 2003-11-03 at 11:21, Angel Gabriel wrote: > I want to setup a machine, with a sole purpose, of scanning email. All > email to be delivered to my domain, will be accepted by this machine, > and then, after scanning delivered to my mail server. > > How can I achieve such a setup? http://www.exit0.us/index.php/SA%20on%20a%20email%20gateway%20vs.%20standalone%20server -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] deteting e-mails tagged as spam
On Mon, 2003-11-03 at 06:50, Maxwell Ochieng wrote: > I would like help on how i can delete or quarantine mails tagged as spam > by SA am running qmail+qmail-scanner+spamassassin. > http://www.exit0.us/index.php/So%20you%20want%20to%20%27delete%27%20all%20your%20spam%21 -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] stats script, by (fairly) popular demand
'mikea' wrote: There are probably some adjustments to be made. Use at your own risk. Enjoy. If you improve on it, please make the improvements available to the list. I've posted this on the Wiki at http://www.exit0.us/index.php/MikesStatScript --- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Broken Rule
On Wed, 2003-10-29 at 11:36, Tobin wrote: > Hello, > > I was wondering if anyone could help me fix a broken rule. Im getting a > error > > "Failed to compile body spamassassin tests, skipping: > (syntax error at /ect/mail/spamassassin/local.cf, rule Porn, line 1, > near "/) > > and > > "Failed to compile body spamassassin tests, skipping: > (syntax error at /ect/mail/spamassassin/20_compensate.cf, > rule_ORIG_MESSAGE_LINE, line 106, near "; > > I have tried replacing the rules, reading old post but I can come to a > conclusion. Any help would be greatly appreciated. > > Josh Check out http://www.exit0.us/index.php/GettingAdvice -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] IP Blocks to kill at the firewall?
On Thu, 2003-10-23 at 17:17, Chris Trudeau wrote: > Found this linked from the Emporium :) > > http://www.stearns.org/sa-blacklist/sa-blacklist.current > > > You can probably use this... > > CT > > > - Original Message - > From: "John L" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Thursday, October 23, 2003 4:10 PM > Subject: [SAtalk] IP Blocks to kill at the firewall? > > > > Does anybody have a good list of SPAMMER IP's they'd like to share for > > blocking at the firewall? > > > > We have one mail server we're hosting that is just getting crushed > > running SA. > > > > We'd have a pretty good list in the sendmail access list, but we're > > looking for a good one to block at the firewall too. > > > > Thanks! > > > > John > > Actually, this is what I've been working on all week. The problem is that the list that I have is in our Checkpoint firewall. I need to talk to one of the firewall guys on how to export the rule in a human readable manner. If I can do that, I'll post it on the wiki or something. INHO, the only downside to sharing the Spammer ip lists in a public manner is that then the spammers know too. **Sigh** -- AltGrendel <[EMAIL PROTECTED]> http://www.exit0.us --- This SF.net email is sponsored by: The SF.net Donation Program. Do you like what SourceForge.net is doing for the Open Source Community? Make a contribution, and help us add new features and functionality. Click here: http://sourceforge.net/donate/ ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] need help sizing a dedicated server
On Fri, 2003-10-24 at 15:27, Joshua A. Fiske wrote: > Hello all, > > I have seen requests for help sizing servers on this list before, but > never anything that comes close to the size of the server that I (think) > that I need. Here is my situation. > > I need to scan the mail that comes from two large qmail installations > (whole site scanning). The volume of this mail is approx. 150,000 > messages per day. > > I have tested these two setups with limited success: > > SETUP #1: > - 1x POWER4 @ 1.1GHz > - 1 GB RAM > - 150K messages per day absolutely swamped this machine > > SETUP #2: > - 2x POWER4 @ 1.1GHz > - 1 GB RAM > - 150K messages per day elevated load average to ~32 > > I have a third setup (in a production environment) that I may be able to > use if I can be assured that spamassassin will not eat 100% of the CPU as > it has done on the previous two setups. This setup is as follows: > > SETUP #3: > - 6x POWER4 @ 1.1GHz > - 8GB RAM > - Current load average of 1 > > However, management has been leaning towards the purchase of a dedicated > box to do spamassassin scanning. I need to have some idea of what type of > box will suffice to cover our needs and be somewhat expandible for the > future. The new box will probably not have POWER4 processors (as my test > environment has had), rather they will have Intel Xeon processors. > > Of course, I use spamd/spamc rather than invoking MANY instances of perl. > I also have disabled bayesian filtering (because I have not had great > luck with it). > > Does anyone have any suggestions as to what an appropriately sized system > would be for this type of setup? > Pack as much RAM into those puppies as you can afford. For a gateway, RAM is #1 with drive space being a close #2. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: The SF.net Donation Program. Do you like what SourceForge.net is doing for the Open Source Community? Make a contribution, and help us add new features and functionality. Click here: http://sourceforge.net/donate/ ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Re: [OT] What is next step?
On Thu, 2003-10-23 at 12:11, Alan Hodgson wrote: > On Thu, Oct 23, 2003 at 11:13:52AM -0400, VonEssen, John wrote: > > We also assume that they clean their list when address appears to be bad. > > I've seen no evidence of this. The only thing I've seen for certain is > that the older an E-mail address is (once it has gotten on at least one > spammer's list), the more spam it gets. Regardless of whether it's bounced > or not. Spammers are still selling each other E-mail addresses I haven't > used in 4 years. I agree with that. I see addresses at my client that haven't existed in 5+ years. No one should kid themselves that spam lists are cleaned or that they learn from being blocked at the firewall. Spammers are pests, a blight, and scum of the earth. -- AltGrendel <[EMAIL PROTECTED]> Visit the Spamassassin wiki at http://www.exit0.us --- This SF.net email is sponsored by: The SF.net Donation Program. Do you like what SourceForge.net is doing for the Open Source Community? Make a contribution, and help us add new features and functionality. Click here: http://sourceforge.net/donate/ ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] discarding mail
On Fri, 2003-10-17 at 12:54, Jeffrey Schilperoord wrote: > How do i setup spamasassin to delete all mail tagged as spam? Or move > it to a dir? > I would check out http://www.exit0.us/index.php/So%20you%20want%20to%20%27delete%27%20all%20your%20spam%21 -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by OSDN developer relations Here's your chance to show off your extensive product knowledge We want to know what you know. Tell us and you have a chance to win $100 http://www.zoomerang.com/survey.zgi?HRPT1X3RYQNC5V4MLNSV3E54 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] evilrules.cf including in local.cf?
On Wed, 2003-10-15 at 16:00, Chris Santerre wrote: > No problem. The idea that I'm trying to start is to take "like" rules > (popcorn and evilrules) and put them in seperate cf files. This way you > simply drop them into your /etc/mail/spamassassin dir and restart spamd. > Nothing else is needed, well.except for this ridiculalsy silly problem > of text files. You may have to open the file in vi and resave. > > You can have tons of cf files in that dir. Making seperate ones for sake of > testing is great. > > But the idea is supposed to go something like this: > > Every month grab the latest evilrules.cf and whatever else I got for goodies > from people. > remove the old one (go ahead, it's okay!) > drop the new one into /etc/mail/spamassasin > run "spamassassin -d --lint" to see if you get no errors. If errors, fix the > silly text file :) > (This could be line breaks or silly hidden end of line characters, which I > will solve!) > if that reports nothing at all you are good to go. > run 'ps -ef | grep spamd' and see the pid#. > then kill -TERM pid# > then 'spamd -d -c -a' or whatever option you are running for whatever > version. > Sit back and watch the fun. Email the rule writers/devs much praise. > > Should be quick and painless enough for you to still find time for a beer > and a hockey game! > FYI: wget http://www.merchantsoverseas.com/wwwroot/gorilla/evilrules.cf works nicely. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email sponsored by: Enterprise Linux Forum Conference & Expo The Event For Linux Datacenter Solutions & Strategies in The Enterprise Linux in the Boardroom; in the Front Office; & in the Server Room http://www.enterpriselinuxforum.com ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: R: [SAtalk] Website spammer with number
On Tue, 2003-09-16 at 09:01, mikea wrote:
> On Tue, Sep 16, 2003 at 01:14:07PM +0200, Andrea Riela wrote:
> > Hi
> >
> > > # Domain name starts with number(s)
> > <...>
> > > # Domain name ends with number(s)
> > <...>
> >
> > And domain name with number(s) like:
> > Getit4less
> > Hotxxxmail4u
> > ...??
>
> Be aware that scoring mail-IDs this way may cause false positives, and
> *will* score some valid addresses higher.
>
> As an example, you might score mail from my work address higher,
> because our twenty-year-old naming scheme uses mail-IDs like
> UDSD007, where U indicates the agency, DSD the division, and 007
> is sequentially assigned to that division of that agency. When we
> formulated the scheme, electronic mail was decidedly uncommon, and
> hardly anyone outside academia used TCP/IP.
>
> I've already been caught by SA rules at more than one site because
> my mail-ID matches /\w[0-9]{1,}/.
Would it catch my (legit) domain? Probably.
--
AltGrendel <[EMAIL PROTECTED]>
---
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[Fwd: Re: [SAtalk] Fitz, an add-on to Spamassassin]
Forward from me too just to keep in on-list. I haven't seen any mention of licensing and haven't looked at the tarball as yet. Is it GPL? -- AltGrendel <[EMAIL PROTECTED]> --- Begin Message --- Hi Update: The stats are online now at http://spam-fitz.de More before/after info when all the users of the AStA (Student's organization) are protected. At the moment only root is using fitz to evaluate it. The last thing I heard is "It works very well. Now I can read the AStA-mailinglist again (which was totally SPAMmed)". Looks good to me. Have Fun Thorsten > Do you have any stats to back that up? I'm curious and would like to see > any before/after info you may have. > -- > AltGrendel <[EMAIL PROTECTED]> > > > > --- > This sf.net email is sponsored by:ThinkGeek > Welcome to geek heaven. > http://thinkgeek.com/sf > ___ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk -- Thorsten Sick [EMAIL PROTECTED] www.hort-des-wissens.de Winter is coming -BEGIN GEEK CODE BLOCK- Version: 3.12 GCS d-- s++:- a-- C++ UL+++ P+++ L+++ E W++ N o K w--- O-- M- V- PS+ PE- Y+ PGP++ t 5+++ X+ R+ !tv b DI- D G e+ h-- r++ y? --END GEEK CODE BLOCK-- --- End Message ---
Re: [SAtalk] Not sure if my Bayesian filter is adding to the score ...
On Tue, 2003-09-09 at 12:26, Weyland wrote: > On Tuesday 09 September 2003 10:57 am, James Herschel spake: > > > Hello, I've been training the Bayesian filter for some time now and I watch > > it get called upon in /var/log/maillog. Problem is that it doesn't look > > like it is adding to my spam scores. I have "use_bayes 1" turned on in my > > config file and run sa-learn nightly on spam and ham mailboxes I've set up. > > Using spamassassin 2.55 with qmail 1.03 and qmail-scanner 1.16 ... Here's > > how it goes down in /var/log/maillog: > > Which is intresting because it spurred me to check mine. > I'm using RH8 with Sendmail, supposedly using Bayes (I've been training it for > a long time now, at least...), and didn't get *anything* when I cat and grep > for "bayes". Nothing at all. > > So how *do* you know it's working? ./check_bayes_db |more Feed the db. do it again. see if the nspam and nham lines have incremented. There are better ways, but that's how I do it. -- AltGrendel <[EMAIL PROTECTED]> --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] allowing certain types of spam
On Tue, 2003-09-09 at 01:30, Daniel Quinlan wrote: > "Jennifer Fountain" <[EMAIL PROTECTED]> writes: > > > Some of my users sign up for newsletters that SA views as spam (which is > > correct due to the nature of the email). How can I allow these types of > > emails through - are whitelists the only way? Any other options? I use > > SA with qmailscanner that delivers to an exchange box. > > > > Any thoughts would be great. > > Whitelists are the best way, specifically the "whitelist_from" option, > see the Mail::SpamAssassin::Conf documentation. > Well, he MAY have to use whitelist_to, at least that's what you need to do with the SA mail list. Just keep an eye on the addressing in the headers. -- AltGrendel <[EMAIL PROTECTED]> --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: Re[2]: [SAtalk] [RD] MSGID_GOOD_EXCHANGE
On Mon, 2003-09-08 at 09:39, Mike Kuentz (2) wrote: > We do site wide here, so I've had to make adjustments, too. Not ready to do > bayes, yet. Not sure how well it would work for a site wide environment. > We do consulting, so most of our FPs used to come from "Dear Sir, look at my > resume", flagged with high importance, a subject of only hello, and from a > yahoo mail account. You do bring up some good points I'm going to check > out, thanks for the help. > > We do site wide here too but with Bayes enabled. I think it's been a big help, I haven't seen it fire on any FP (yet). My client does placement and I haven't really seen or heard any complaints on resumes getting incorrectly tagged. If it becomes an issue, I could always add an ALL_SPAM_TO flag. -- AltGrendel <[EMAIL PROTECTED]> --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Fitz, an add-on to Spamassassin
On Sun, 2003-09-07 at 13:46, Thorsten Sick wrote: > Hello, everybody > > As a part of my diploma thesis I developed an AI to sort Mails into > Ham/Spam. > > The AI alone was able to get about the same results as Spamassassin. > Which means it is very good. > > I released it as Open Source and it is downloadable at > http://spam-fitz.de > You just overwrite a few files of spamassassin and you will get a > combination of the two programs > > > I hope someone can use it. > > Why install it ? > - The results of the AI alone are as good as Spamassassin's results. > Combined it is therefor better. > - It learns very fast. After learning 20 Hams and 20 Spams the results > become very good > - Even with lesser mails to learn it is useable, but it won't stop much > spams (but it leaves hams unharmed). Do you have any stats to back that up? I'm curious and would like to see any before/after info you may have. -- AltGrendel <[EMAIL PROTECTED]> --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] writing rules
[EMAIL PROTECTED] wrote: 1 How do I write my own rules? is there a tutorial someplace? 2 Spam changes with time, which means the tests should be updated. How to I get the current tests performed? ie can I simply copy the new .cf files from a newer version of spamassassin? or do I have to reinstall completely? or is there some place where new tests are stored for public use? 3 I don't see any evidence that RBL checks are being made in my spam headers. How can I make sure the RBL checks are being done? thanks A good place to start is http://www.exit0.us --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] spamassassin not working with qmail-scanner..
On Wed, 2003-09-03 at 03:57, Cornelius Bolten wrote: > this is my current tcp.smtp-content: > > # > 127.:allow,RBLSMTPD="",RELAYCLIENT="",QMAILQUEUE="/var/qmail/bin/qmail-queue > " > #:allow,QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl" > > there is no content-scanning at all :-( > > after editing tcp.smtp file i executed the following statement to recreate > the cdb-file: > #tcprules tcp.smtp.cdb assign.tmp < tcp.smtp > and restarted qmail. > This is what I'm using: 127.:allow,RELAYCLIENT='',QMAILQUEUE='/var/qmail/bin/qmail-scanner-queue.pl' xxx.yyy.zzz.:allow,RELAYCLIENT='',QMAILQUEUE='/var/qmail/bin/qmail-scanner-queue.pl',QS_SPAMASSASSIN='on' :allow,QMAILQUEUE='/var/qmail/bin/qmail-scanner-queue.pl',QS_SPAMASSASSIN='on' -- AltGrendel <[EMAIL PROTECTED]> --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] spamassassin and windows
On Wed, 2003-09-03 at 07:03, [EMAIL PROTECTED] wrote: > Will the program run on MS windows NT and/or 2000 servers? If so how? > > There's a windows section on the SpamAssassin Wiki at www.exit0.us -- AltGrendel <[EMAIL PROTECTED]> --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] exchange and IMAP Public Folder messages
On Sun, 2003-08-31 at 15:51, Ryan Bingham wrote: > Did anyone ever figure out a fix for this on Exchange 2000? It will be a > while before I can migrate to 2003. > > To recap: the problem involves retrieving intact headers from messages > moved to Public Folders on Exchange 2000. > > Thanks, > Not with public folders. I wound up creating a spam email account with a folder called Unmarked_spam and move the unmarked mails from the Public folder over to that one, then doing a script pull. Still debating over giving users access to that folder. -- AltGrendel <[EMAIL PROTECTED]> --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] spamassassin not working with qmail-scanner..
On Sun, 2003-08-31 at 14:39, cornelius bolten wrote: > heya folks, > > thanx to Jason S. first, for bringing qmail-scanner in my life ;-) > the test-installation-script works fine. i setup fprot too, both > (spam. + fprot) working fine. > > but now i have a new problem! > all mail comming from unknow hosts (like spam..) isn't scanned > anymore. mail from known hosts (like localhost or other that are in > whitelist) are scanned. > > is this a know problem ? are there any solves for this one ? > i started spamd with -d option only. test_installation.sh works fine. > Have you tried this (ripped off from the qmail-scanner faq)? How do I add QMAILQUEUE support to supervise-style startup scripts?. Don't. There are now too many different ways of doing things under daemontools/supervise. I cannot be bothered documenting them all. Instead set it under the tcpserver smtp rules file (you're using Qmail - so you already know what that is - right? :-). That way you can even setup Qmail-Scanner to only scan mail from particular SMTP client IP address ranges/etc. This is now the only officially supported mechanism. Set it something like this: #/etc/tcpserver/smtp.rules # # No Qmail-Scanner at all for mail from 127.0.0.1 127.:allow,RELAYCLIENT="",RBLSMTPD="",QMAILQUEUE="/var/qmail/bin/qmail-queue" # Use Qmail-Scanner without SpamAssassin on any mail from the local network # [it triggers SpamAssassin via the presence of the RELAYCLIENT var] 10.:allow,RELAYCLIENT="",RBLSMTPD="",QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl" # # Use Qmail-Scanner with SpamAssassin on any mail from the rest of the world :allow,QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl" Then run "maketcprules" or something like "tcprules /etc/tcp.smtp.cdb /etc/tcp.smtp.tmp < /etc/tcp.smtp" to rebuild the database. -- AltGrendel <[EMAIL PROTECTED]> --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] moving spam mails to a seperate folder
On Fri, 2003-08-29 at 23:59, Dragoncrest wrote: > Have you considered using Procmail to filter the mail once its > tagged or not tagged? That's what I use and it's awesome. Does everything > I need. If you need a good working example procmailrc file, let me know > and I'll pass along mine. > > Now if you had something else in mind like doing it right through > Qmail or SA, I couldn't really tell ya on that one. I've always defaulted > to procmail for all my mail filtering needs. > It's not that difficult to do with qmail(note the lower case q :) ) as long as it's all local delivery. You can setup a default .qmail file to call procmail or such. Setting up a qmail gateway is a horse of a different color since it's a remote delivery and will never be seen by the default .qmail file. -- AltGrendel <[EMAIL PROTECTED]> --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] Going after more than OsiruSoft?
Latest news: http://slashdot.org/article.pl?sid=03/08/28/1832215&mode=thread&tid=111&tid=126 -- AltGrendel <[EMAIL PROTECTED]> --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] configuration
On Thu, 2003-08-28 at 13:51, Jon Fraley wrote: > I am trying to get Spamassassin 2.55, spamass-milter-0.2.0 and > sendmail-8.11.6-26.72 running with Red Hat AS 2.1. I have installed > everything and have started all process, however no emails are being > sent through SA. Spamd is running and there are three instances of > spam-milter running. > > 29164 27625 0 13:28 pts/300:00:00 /usr/bin/perl /usr/bin/spamd -D > 29179 1 0 13:28 pts/300:00:00 spamass-milter -p /var/run/spama > 29180 29179 0 13:28 pts/300:00:00 spamass-milter -p /var/run/spama > 29181 29180 0 13:28 pts/300:00:00 spamass-milter -p /var/run/spama > > I have set this up on Red Hat 9.0 with no problems. That box is running > sendmail-8.12.8-4. > > Any suggestions? Is this a gateway setup? -- AltGrendel <[EMAIL PROTECTED]> --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] FW: Best Child Pornography Site
On Wed, 2003-08-27 at 14:01, jherschel wrote: > Thanks for your input, though I never really gave this a second thought as > someone trying to promote a legitimate business. > > I think the point to my original message has gotten lost. Basically, this > is still spam and I'm pleading ignorance on how to tweak my rules to get > something as absurd as this tagged as spam. For example, how what would be > the best way to drop an email with "Child Pornography" in it dropped. > > James Herschel I'm not sure that you want to do that. You may wind up blocking legit email. Like some of the "old" style filters that would block breast cancer newsletters because of the word breast. If you know for fact that it won't impact the user community, go for it. Write a rule that will tweak it up a bit, like a score of 0.1 or something to start. Details on rules writing can be found at (one site of many) www.exit0.us -- AltGrendel <[EMAIL PROTECTED]> --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Install qmailscanner, spamassassin and clamav... butnow does it work?
On Tue, 2003-08-26 at 15:47, Jennifer Fountain wrote: > in the articles I am reading, you should see this in your > /var/log/maillog: > > Jun 8 05:08:00 myhost spamd[11636]: info: setuid to qmailq succeeded > Jun 8 05:08:00 myhost spamd[11636]: checking message > <[EMAIL PROTECTED]> for qmailq:545. > Jun 8 05:08:01 myhost spamd[11636]: clean message (4.7/5.0) for > qmailq:545 in 0.3 seconds, 6264 bytes. > > I am not seeing this in my logs and spamd is running. I am currently > running qmail, qmail-scanner and spamassassin on a redhat 8.0 box. > > > Here is my config: > > # How many hits before a message is considered spam. > required_hits 7.5 > > # Whether to change the subject of suspected spam > rewrite_subject 1 > > # Text to prepend to subject if rewrite_subject is used > subject_tag *SPAM* > > # Encapsulate spam in an attachment > report_safe 1 > > # Use terse version of the spam report > use_terse_report0 > > # Enable the Bayes system > use_bayes 1 > > # Enable Bayes auto-learning > auto_learn 1 > > # Enable or disable network checks > skip_rbl_checks 1 > use_razor2 1 > use_dcc 1 > use_pyzor 0 > > # Mail using languages used in these country codes will not be marked > # as being possibly spam in a foreign language. > ok_languagesall > > # Mail using locales used in these country codes will not be marked > # as being possibly spam in a foreign language. > ok_locales all > > a snip of my header: > > server by uid 504 with qmail-scanner-1.20rc1 > (clamscan: 0.60. Clear:RC:0:. > Processed in 0.117654 secs) > > here is my log: > > Aug 26 14:40:14 server spamd[580]: server started on port 783 (running > version 2.55) > > how can I tell SA is actually working correctly? > > Thanks > Jenn Since you're using 1.20-rc1 (bleeding edge) I'd actually check with the qmail-scanner mail list. They're up to RC2 because of some issues with SA (I think). -- AltGrendel <[EMAIL PROTECTED]> --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] spamc/spamd question on a qmail gateway
On Sat, 2003-08-23 at 04:44, Joe Cave wrote: > Dear list, > I'm having some problems getting spamc/spamd working on a qmail gateway. I'm > wondering what is the most lightweight way to get mail scanned and then re-injected > back into the qmail-queue? I have qmail patched to work with the QMAILQUEUE > variable. If I point my QMAILQUEUE to spamc nothing seems to happen. Qmail's smtp > log shows the mail coming in, but then the main qmail log shows nothing. I thinking > I need to re-inject the scanned message yes? Most of the examples I see are using > Postfix or QmailScanner or such but these seem like more than I need. I don't need > per-user config or other scans for virus etc... I just want mail to bounce through > spamd and then follow a smtproute to an internal server. I know there must be some > other people doing the same thing. > > If someone could steer me in the right direction I'd appreciate it. > That's right, the message needs to be injected into the queue. And yes, this is usually done by qmail-scanner or some other such software. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] OT - This list and delays, etc.
On Fri, 2003-08-22 at 10:35, Fred wrote: > Has anyone inquired about the troubles of this list? Is it normal to see > your messages the day after you post them? Is it normal to see messages > appear out of order? Why does it take so long to see your own post? > I've only been on this list for 3 weeks, but the past 3 days have shown a > real slowdown, mixup, whatever you call it. > > Just curious! > Lately, yes. With SoBig.F et al. floating around I'm not too suprised though. Hard to explain to users though. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] OT - Sorry for the line noise on the list.
Sorry folk, this is a continuing saga. I can't email Yorkshire Dave directly. YD: This is the latest trace that I have when attpempting to get to your site. < internal subnets deleted> 3 64.83.78.1 (64.83.78.1) 4.255 ms 3.697 ms 3.650 ms 4 64.83.72.1.PHI-7507.cavtel.net (64.83.72.1) 9.297 ms 5.346 ms 5.443 ms 5 delmar-209-137-166-73-dsl.cavtel.net (209.137.166.73) 7.004 ms 5.345 ms 7.115 ms 6 jfk-edge-04.inet.qwest.net (208.46.126.49) 9.105 ms 8.918 ms 8.893 ms 7 jfk-core-02.inet.qwest.net (205.171.30.109) 9.985 ms 10.829 ms 10.421 ms 8 jfk-brdr-01.inet.qwest.net (205.171.30.18) 10.469 ms 11.189 ms 6.400 ms 9 acr1-so-3-1-0.NewYork.cw.net (206.24.195.149) 10.659 ms 9.819 ms 7.616 ms 10 agr4-loopback.NewYork.cw.net (206.24.194.104) 8.753 ms agr3-loopback.NewYork.cw.net (206.24.194.103) 9.755 ms 8.203 ms 11 dcr2-so-6-3-0.NewYork.cw.net (206.24.207.189) 8.719 ms dcr1-so-7-3-0.NewYork.cw.net (206.24.207.77) 7.304 ms dcr1-so-7-2-0.NewYork.cw.net (206.24.207.73) 7.760 ms 12 zcr2-loopback.Londonlnt.cw.net (166.63.210.19) 88.445 ms 80.157 ms 81.061 ms 13 zcr1-so-7-0-0.Londonlnt.cw.net (166.63.222.41) 92.094 ms 129.764 ms 101.433 ms 14 * telewest.Londonlnt.cw.net (166.63.222.38) 100.890 ms 99.898 ms 15 wit-tele2-pos.telewest.net (194.117.136.17) 111.326 ms 110.048 ms 109.845 ms 16 brad-wit-pos.telewest.net (194.117.136.22) 109.890 ms 108.427 ms 109.916 ms 17 * * * 18 * * * 19 ubr01-wk.blueyonder.co.uk (62.30.241.30) 111.497 ms 110.928 ms 108.909 ms 20 * * * 21 * * * 22 * * * 23 * * * 24 * * * 25 * * * 26 * * * 27 * * * 28 * * * 29 * * * 30 * * * -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Configure to delete messages
On Thu, 2003-08-21 at 20:42, Carl R. Friend wrote: >Hello, > > > >I added a section to the main page of the wiki www.exito.us :) > > >One can't repeat this enough, it is NOT a good idea to automatically delete > > >emails marked spam. Then again, it isn't a good idea to date your cousin, > > >but some people never learn! > Just to clarify, it's www.exit0.us (The number zero, not the letter "oh"). -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] Rules
On Tue, 2003-08-19 at 09:19, Chris Santerre wrote: > > -Original Message- > > From: Alan Fullmer [mailto:[EMAIL PROTECTED] > > Sent: Monday, August 18, 2003 10:46 PM > > To: [EMAIL PROTECTED] > > Cc: [EMAIL PROTECTED] > > Subject: [SAtalk] Rules > > > > > > Is there a good website / url someone could post that > > describes how to write > > rules for spam assassin? > > > > See link in my sig for examples. > > Chris Santerre > System Admin and SA Custom Rules Emporium keeper > http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm > "A little nonsense now and then, is relished by the wisest men." - Willy > Wonka > ...and the wiki at http://www.exit0.us -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] FreeBSD + Sendmail
On Wed, 2003-08-20 at 19:43, Mike Carlson wrote: > Well I got spamass-milter installed and when I send the test mail outlined in > the activation.txt file, my root user gets the messages and they are properly > marked, but when I set up my forwarding to my exchange box, none of the mail > that gets forwarded to my exchange box gets caught as spam. I even resent the > test email to an address on my exchange box. > > Is there some other step I need to do for spamass-milter to process the email > forwarded to my exchange box? > > -Mike I think you'll find that this is an MTA issue. I would look into the differences between local and remote delivery. For example in qmail you have two different programs called for local queues and remote queues. The local one can process .qmail and promail scripts. The remote one goes straight to the next MTA and won't process anything unless you do some real gymnastics. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] virus bounce rules
On Wed, 2003-08-20 at 15:28, Justin Mason wrote: > So I'm being driven nuts by AV software which mails "your message contains > a virus" notifications even when the virus is known to forge From addrs. > > Since they're not really anti-spam rules -- SpamAssassin's raison d'etre > -- I don't think they're appropriate for the distribution. But a > page on the Wiki makes sense! > > http://www.exit0.us/index.php/VirusBounceRules > > (exit0, hope that's OK ;) > > --j. > > I have no problems with this. That's what it's for. :) -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Configure to delete messages
On Wed, 2003-08-20 at 11:24, Daniel Kaliel wrote: > I have been trying to find documentation on how to do this, but have > not found any. I spoke with the partnership of my company on this and > how it is safer not to, instead filtering email on there email client, > however, they have decided to have all SPAM immediately deleted. So > if anyone knows where I can find more info on how to do this, I would > appreciate it. I would read this first: http://www.exit0.us/index.php/GettingAdvice -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by Dice.com. Did you know that Dice has over 25,000 tech jobs available today? From careers in IT to Engineering to Tech Sales, Dice has tech jobs from the best hiring companies. http://www.dice.com/index.epl?rel_code=104 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAdev] Re: [SAtalk] [RD] new rules for listwashing tokens,ROT-13 etc.
On Mon, 2003-08-18 at 20:02, Justin Mason wrote: > Yorkshire Dave writes: > > As long as it's worth blocking on it, I'll keep working at ciphers. If > > all the spammers start using real encryption I'll look for another way. > > I'm just taking advantage of a stupid subset of spammers while I can. > > Yep. Bear in mind, there's a pretty large subset there ;) > > For example, the "my wife, Jody" testimonial text is still flying about > and it'd be super-trivial for a moderately clever spammer to read the > SpamAssassin tests list and change that name. But they don't! > They don't have too. They are working the economy of scale. The majority of them won't worry about changing stuff like that until they are blocked effectively at ALL mail servers. Ain't gonna happen in MY lifetime. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by Dice.com. Did you know that Dice has over 25,000 tech jobs available today? From careers in IT to Engineering to Tech Sales, Dice has tech jobs from the best hiring companies. http://www.dice.com/index.epl?rel_code=104 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: AW: [SAtalk] exchange and IMAP Public Folder messages
On Tue, 2003-08-12 at 03:41, Martin Bene wrote: > Hi Chris, > > >make it through with IMAP. However, if an email is moved to or from a > >Public Folder with Outlook (regardless of whether or not the public > >folder is mail-enabled), then its headers get truncated. > > I can not confirm that. I'm using outlook 2000-SR1 (9.0.0.5414) + exchange > server 2000 (6.0 Build 6249.4: SP 3)+ public folders on the exchange server; > moving/coying a message from inbox to a public folder on the exchange server > does NOT disturb the headers in any way; all information is still present and > accessible by fetching the mails from the exchange server using imap > protocol. > > >I'm not sure how bayes can be used with Exchange without bypassing > >Exchange completely in some way. I'd like to see other people's > >solutions to this problem (or maybe they just don't know about the > >problem). Maybe somebody can come up with IMAP client patch that can > >retrieve the full headers, as they are actually retained by > >Outlook when messages are moved to or from Public Folders, just not > >when IMAP is used. > > I've defined the public folders on the exchange server and I'm using imap on > a SA linux box to download the messages using a perl script found in the list > archives; this works as expected and gets the messages including all headers > to to the SA box. > I can vouch for all of this. I'm running basically the same setup here and all my testing confirms this. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] A hack to log and delete spam
On Tue, 2003-08-12 at 22:40, Christopher X. Candreva wrote: > I whipped out a little hack tonight, as a possible solution for my users who > just want spam to disappear, to act as a safety net. > > It's a small client C program, intended to receive marked spam on STDIN. It > parse out a Date, From, and Subjet line, and sends them as a UDP packet to a > perl server process, which logs this to an SQL database. > > The idea is for a user who doesn't receive a message they are expecting to > be able to check the log (via a web page, not yet made). If they see the > from/subject they were expecting, they can request the message to be resent, > see about whitelisting, or take whatever action is needed. > > Already I'm thinking of changes -- this was designed to run the server > process on a logging machine, separate from the mail server. However, I'm > thinking of changing it to run the server on the same mail machine. If > connection was lost to the SQL server, it could log to a text file, that > could be reloaded later. (I think it is more likely to loose packets to > another machine, then to the local machine on a Unix socket). > > This is a 'first draft', comments welcome, especially any problems in my C, > which is quite rusty. I wouldn't suggest non-programmers trying to use it -- > this is the result of about 3 hours codeing while watching the Yankee game > :-) > > Grab it from http://www.westnet.com/~chris/lognul-0.0.tar.gz > > (I should say, this was written and compiles on Solaris 8) > > -Chris > I like the idea but not being a C coder, I'm going to have to wait. Let me know when it reaches a stable beta. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Bayes Spam Filtering
On Wed, 2003-08-06 at 11:24, David Meier wrote: > Hello, > > please excuse me to ask the same question again however, since I did not receive any > reply on my last mail which was quite long I ask you any shorter: > > I am running a test server on RH9 with a > postfix+mysql+amavis+spamassassin+cyrus+squirrelmail setup. SpamAssassin is called > from amavisd when the MTA passes off mail to amavisd. Since I do not have any local > users I wonder how bayes spam filtering works. Does it work without local users? How > can it be 'trained'? > > (See also my last post: [SAtalk] Another > postfix+mysql+cyrus+amavisd-new+spamassassin setup) > > Thanks, Dave If you are running spamc/spamd with spamd running with the -u flag, it will use that uid $HOMEDIR for the Bayes db. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] bqtW Powerful DVD copy software. nhmW Now you cansave your favorite movies. (fwd)
On Wed, 2003-08-06 at 10:59, Harri Pesonen wrote: > Use Bayes. > Agreed. My Bayes caught that one. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Where are the wordlists?
On Tue, 2003-08-12 at 00:12, Matt Kettler wrote: > At 02:32 PM 8/11/03 -0700, Joshua Graham wrote: > >Mail from one of my domains (suckycentral.com) keeps getting marked as > >spam due to the fact that SA insists it contains words of an adult nature. > >Even if it's a blank message. > > > >Is there anyway I can remove the word suck from "adult list" so my mail > >won't keep getting bounced internally? > > SA doesn't use anything as simple as a "word list". It also won't care > about "suck" in a domain name, and it doesn't have anything containing the > word "adult list" so if your mail is being blocked with some explicit > message stating that it's adult, then I suggest you look elsewhere. > > I strongly suspect you've got some other scanning tool involved. > > If your message is being in fact being marked by SA, please include an > X-Spam-Status header or a full spam report so we can see which rules fired. > I know Sybari does stuff like that. We had to revamp how we filter inbound mail because of that kind of thing with it. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Update to Rules Wiki.
Chris Santerre wrote: I love the new look. Hated the yellow, reminded me of default exchange web access screen ;) I've got a few more things I want to add today. This wiki will rock! I changed the front page around a little. I wanted to put more of the tips or howto pages together at the top, and the cusom rules together towards the bottom. Maybe seperate the sections? --chris Chris: I liked your idea so much I went ahead and made the changes. I've also modified the site so that it no longer asks for a password on sign-in ( I think). --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Newbie
On Thu, 2003-08-07 at 16:30, Jean-Paul Natola wrote: > well we are tiny non-profit 40 internal 20 external email acts (60 > -total) > > I also NEED to know what OS to run it under , red hat? i have used > HP-UX for a few years at my old org, also where I can get the OS, > > I understand red-hat is 4 cds for the OS is that what I should use or > do I have other options? > - Original Message - If your HP system runs Perl 5.6 or 5.8 and sendmail, you're off to a pretty good start. You might want to search the SA archives for HP-UX and see if anything turns up. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Bayes probs
Jonathan Nichols wrote: Aug 9 23:03:45 shampoo spamd[19926]: logmsg: info: setuid to jknotzke succeeded I'm afraid to ask what the other machines are named. ;) -Jonathan Er If it's an SA box, he could call it "rinse". ;-) --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] Update to Rules Wiki.
I have upgraded the SpamAssassin rules wiki at http://www.exit0.us. It has a new look & feel. I would appreciate it if you check any contributions you have made and make sure they were migrated correctly. Hope you enjoy the update. --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] exchange and IMAP Public Folder messages
On Mon, 2003-08-04 at 18:44, Covington, Chris wrote: > Hi all, > > RH 9, amavisd-new 06162003, Postfix 2.0.13, SA 2.55. > > I've been using the wonderful script from: > > http://marc.theaimsgroup.com/?l=spamassassin-talk&m=105622875610715&w=2 > > I instruct users to move undetected SPAM to Public Folders. > > But I've noticed that Exchange 2000 Public Folders in IMAP mode seems to > truncate mail headers, leaving (sometimes) only the last few received > headers and not all. > > I first assumed this was a problem with Mail::IMAPClient and its > message_to_file call when working with Exchange. > I then used Pine to access the same message and the headers are also > missing. > > So basically it's an Exchange problem when messages are pulled from > Public Folders. This doesn't happen when IMAP accesses a user's > mailbox. > > My questions: First, has anyone found a workaround? Second, is it OK to > sa-learn on messages that don't have complete headers (but do have > complete bodies)? > > I've attached an example of the behavior in my case. ham1 is an email > pulled with Pine/Mail::IMAPClient and ham1.exchange is an email pulled > from Outlook. > > I guess everyone should ditch the Public Folder method... unless > Exchange 5.5 or 2003 don't have this problem. > > Chris > > ps - yeah, yeah I know ditch Exchange altogether ;) That's not an > option, unfortunately Is the public folder mail enabled? I'm not sure if it will make a difference, but you could try that. -- AltGrendel <[EMAIL PROTECTED]> Visit the SpamAssassin rules wiki at www.exit0.us --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] SA integration with Outlook and Exchange server
On Fri, 2003-08-01 at 07:13, Larry Gilson wrote: > Hi Klaus, > > I would love to have a copy of the program too if that is ok with you. > > Thanks, > Larry > > > > > -Original Message- > > From: Klaus Mueller > > > Something is hard coded currently and I'm still moving the > > configuration option to a separate config file. I'll notify if this > > is done. > There's a dandy little perl script in the archives. You'd need to search on Exchange to find it. -- AltGrendel <[EMAIL PROTECTED]> SA Rules wiki at www.exit0.us --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] DCC vs Razor2 vs Pyzor
On Thu, 2003-07-31 at 14:45, Clay Atkins wrote: > Any thoughts on which of these is better, none, or a combination of > them? > Ya know, that would be a good topic for a poll at the SA news site. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] spamc/spamd not checking all messages
On Wed, 2003-07-30 at 09:02, Dave Sill wrote: > I'm using 2.55 under Red Hat 8 and qmail with qmail-scanner-1.16. I > *think* this problem started when I upgraded to 2.55 from 2.50, but > I'm not sure. I'm using nearly the same configuration at home and not > seeing this problem. > > What's happening is that some spam (~5-10/day out of 60-70) is not > being checked correctly by spamd. For example, an obvious spam > contains the header field: > > X-Spam-Status: No, hits=0 required=0 > > Syslog shows, for this message: > > Jul 29 23:33:18 sws5 spamd[5574]: checking message <[EMAIL PROTECTED]> for > qmailq:49503. > > I.e., it shows spamd is seeing the message, but there's no line > indicating whether it was determined to be clean or spam. > > Has anyone else seen this? Is there any way to tell what's causing > spamd not to correctly check the message? > > Here is the header for this message: > When you upgrade SA, you often need to rebuild qmail-scanner so it knows that it has a new version of SA. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] [RD] Random characters in SPAM
On Wed, 2003-07-30 at 07:06, Daniel Bird wrote: > Hi all, > Someone posted a rule a while back to catch those little buggers, but > for the life of me I can't find it. Can someone point me in the right > direction or re post please. > > TIA > > Dan Try Chris's site, he's got a lot of stuff there: http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm Shameless plug: There's also a rules wiki at www.exit0.us -- AltGrendel <[EMAIL PROTECTED]> --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Newbie... some questions
On Tue, 2003-07-29 at 17:32, Bonny wrote: > In data 29 Jul 2003 15:31:04 -0400 > AltGrendel <[EMAIL PROTECTED]> scriveva: > > > Yes, but you will probably have to use the nodeps option. > > Why this? I mean, when UNinstalling, what is nodeps good for? Ok, maybe I spoke out of turn here. But as I recall, when you uninstall the SA RPM, rpm will complain about other programs needing things you are trying to uninstall. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Newbie... some questions
On Tue, 2003-07-29 at 13:45, Bonny wrote: > In data Mon, 28 Jul 2003 15:01:53 -0700 > Jason Williams <[EMAIL PROTECTED]> scriveva: > > > install Mail::SpamAssassin > > > > Spell it correctly, it is caps sensitive. > > OK, just wanting to know the last thing: > > can I remove all the RPMs related to SA or not, when installing from > CPAN? > > Thanks Yes, but you will probably have to use the nodeps option. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] HELP - SA stopped marking Spam
On Tue, 2003-07-29 at 05:12, Walter Ray wrote: > HI Everybody, > > For some reason, SA stopped marking messages. We had it set up to mark all > possible Spam with the *SPAM* marker and for no apparent reason, it > just stopped. I didn't make any changes to anything on it. I tried > stopping the daemon and restarting but nothing. I also tried stopping and > restarting sendmail but nothing. Any suggestions as to what to look at > would be appreciated. > > Thanks > > Walter > A few questions to answer first: What OS are you running. What version of SA are you running. What do the logs say (maillog and syslog) Do the SA headers show at all in the email? Examples help and show that you've made a good faith effort on your own behalf first. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Advice on how to create this rule
On Mon, 2003-07-28 at 19:40, Stevens, John wrote: > Hi All, > I am using SA 2.55 on a linux box (Cobalt Raq3) and have whitelisted our > domain and a couple of others we handle. We are having problems with > sender addresses of the form "joe blogs" <[EMAIL PROTECTED]> and > recipient <[EMAIL PROTECTED]> , in other words smtp address of the > sender and recipient are the same. > > I have tried using the check_for_from_to_same EvalTest, but it fails > this due to the "joe blogs" bit in the sender, and this check does not > look only at smtp type addresses in these headers. Can anyone suggest > or point me in a direction to develop a rule, or include my own eval > test in my local.cf that could test the smtp addresses of the sender and > recipient and flag where they are the same? > Thanks In advance and apologies for the foul disclaimer. > There are many good rules sites, as I have found out. Here are some listed at my site: http://mywebpages.comcast.net/mkettler/sa/SA-rules-howto.txt http://www.spamassassin.org/doc/Mail_SpamAssassin_Conf.html http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm There is also a rules wiki at http://www.exit0.us ____ -- AltGrendel <[EMAIL PROTECTED]> --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Block an entire Network?
On Mon, 2003-07-28 at 12:34, Tony Earnshaw wrote: > > I just put you on my blacklist. I'm considering blacklisting all .us > addresses. Darn, there goes my main reason for reading this list. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] SA Custom Rule Emporium is alive :)
On Fri, 2003-07-25 at 14:36, Yorkshire Dave wrote: > On Fri, 2003-07-25 at 16:51, AltGrendel wrote: > > On Thu, 2003-07-24 at 21:16, Yorkshire Dave wrote: > > > > > It's been unreachable from here since you announced it. > > > > > > I know its up because I can get at it from elsewhere, but from here it > > > stops 3 hops short. your upstream got me blocked or something? > > > > No, I'm not blocking anything. > > Traceroute from here gets as far as 208.46.126.50, I believe the next > hop should be 209.137.166.74 (delmar-209-137-166-74-dsl.cavtel.net) but > that doesn't seem to want traffic from me. I don't think it's a > temporary condition, it hasnt changed since you announced the wiki. > > Shame, I've been hoping for a wiki, I've been arguing for a sharing of > rules every chance i got for months, you beat me to setting up a wiki by > a matter of hours, and now I can't even get to it! > > sucks to be me i guess :) > > -- > Yorkshire Dave I've opened a trouble ticket with the provider about this. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Newbie... some questions
On Sat, 2003-07-26 at 07:14, Bonny wrote: > In data Fri, 25 Jul 2003 20:27:44 -0400 > Matt Kettler <[EMAIL PROTECTED]> scriveva: > > > > If you want to know in-depth, check out the changelog: > > > > http://www.spamassassin.org/dist/Changes > > > > 2.44 was released 2003-01-31 and 2.55 was released 2003-05-19. > > OK, I'll check it. Now, as I got SpamAssassin installed from Redhat 9 > RPMs, what's the best way to get it upgraded to 2.55? You might want to check the mail list archives on this topic. From what I've read and experenced, the easiest thing to do is actually install/upgrade via CPAN. Less muss and fuss and no RPM depencancies to worry about. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] SA Custom Rule Emporium is alive :)
On Thu, 2003-07-24 at 15:11, Chris Santerre wrote: > I added a URI rule to try. Quick and fast! But what is to keep spammers from > going in there and deleteing stuff? > > Chris > > > > -Original Message----- > > From: AltGrendel [mailto:[EMAIL PROTECTED] > > Sent: Thursday, July 24, 2003 2:41 PM > > To: Spamassassin-Talk "(E-mail) > > Subject: RE: [SAtalk] SA Custom Rule Emporium is alive :) > > > > > > On Thu, 2003-07-24 at 12:38, Chris Santerre wrote: > > > Site is updated. Thanks to Mike Y, Mike A, Sandy S, and Dave Y! > > > > > > Also added 2 goodies for Sendmail users. Just for fun :) > > > > > > Link in sig. Send more rules!!! > > > > > > > ...and don't forget the new rules wiki at www.exit0.us. > > -- > > AltGrendel <[EMAIL PROTECTED]> > > Well, yes anyone can change it. But then it's supposed to be an "Open Source" web site. The more people that use it and add corrections, the more accurate it can become. I will be trying to keeping an eye on things per se though. I'm looking at this as a collabrative/community effort. Both of our sites can be important. Yours for the archival aspect and mine for the dynamic learning aspect. You site can act as both a final repository for rules issues that could be hashed out on mine. Anyone with a rules site is certany welcome to add a link to the front page. > > -- AltGrendel <[EMAIL PROTECTED]> --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] SA Custom Rule Emporium is alive :)
On Thu, 2003-07-24 at 21:16, Yorkshire Dave wrote: > It's been unreachable from here since you announced it. > > I know its up because I can get at it from elsewhere, but from here it > stops 3 hops short. your upstream got me blocked or something? No, I'm not blocking anything. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] SA Custom Rule Emporium is alive :)
On Thu, 2003-07-24 at 12:38, Chris Santerre wrote: > Site is updated. Thanks to Mike Y, Mike A, Sandy S, and Dave Y! > > Also added 2 goodies for Sendmail users. Just for fun :) > > Link in sig. Send more rules!!! > ...and don't forget the new rules wiki at www.exit0.us. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] Spam assassin rules wiki.
Ok, I've seen lots of requests and no responce for a SpamAssassin rules wiki. Maybe I'm wrong, but I don't recall any responses saying "I have one here". In an attempt to give back to the community, I've setup a wiki at www.exit0.us that can be use for this purpose. Please consider this a formal announcement of a community resource. Thanks. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] [Fwd: Undelivered Mail Returned to Sender]
On Mon, 2003-07-21 at 07:47, Tony Earnshaw wrote: > Another xenophobic ameddican :-/ > > Tony > > -- "Just 'cause your paranoid doesn't mean they're not out to get you." - Anon. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here: http://www.vmware.com/wl/offer/345/0 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] SA Learn from emails collected in Exchange (Outlook) ?
On Tue, 2003-07-15 at 14:39, Matthew Moldvan wrote: > An easier way to do it would be to setup a Samba share (google for > Samba if you're unfamiliar), have your users save the false > negatives/positives in a directory in that share, then have your SA > box run a crontab every night to learn those saved messages as ham or > spam ... > > Regards, > Matthew Moldvan > > System Administrator > Trilogy International, Inc. > IMHO, you would want to try and keep this at the MTA level, that way you know that the headers are intact. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.Net email sponsored by: Parasoft Error proof Web apps, automate testing & more. Download & eval WebKing and get a free book. www.parasoft.com/bulletproofapps1 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] SA Learn from emails collected in Exchange (Outlook)?
On Tue, 2003-07-15 at 12:46, Nichols, William wrote: > My SA box is a message router, does not collect any mail into local > folders. > > All mail is delivered to users exchange folder, and is read in > outlook. When someone receives a false positive or negative they > forward it to me and I stick it in the appropriate folder. > > I want to then FTP these messages to a folder on sa box and run > sa-learn --ham --dir /folderpath/here/ > > these are in .eml format. How could I save these so that they could > be used to learn the SA box? Any ideas here? > > Thanks, > > Bill Nichols There was a huge discussion on list some months ago on how to handle transfering mail between the SA box and Exchange. The best advise that I saw was to setup a public folder for spam/ham and write a script for SA server to log into the Exchange server as a mail client and pull the emails that way. I did test it and it worked very well. Details are in the mail archives. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.Net email sponsored by: Parasoft Error proof Web apps, automate testing & more. Download & eval WebKing and get a free book. www.parasoft.com/bulletproofapps1 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] How to uninstall?
Chris Ochap wrote: Click your heels together three times. -Chris -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Thursday, July 10, 2003 2:19 PM To: [EMAIL PROTECTED] Subject: [SAtalk] How to uninstall? I totally can't get spamassassin working--how do you uninstall it? Thanks Personally, I think he should try an solve the problem like a good admin, instead of running away from it. You know, answer the basics: What OS am I running? What MTA am I using? Do I really understand how SA works with what software I'm running. What's my problem? Should I consider a job that uses the phrase "Do you want fries with that" instead of staying in the challenging field of IT? --- This SF.Net email sponsored by: Parasoft Error proof Web apps, automate testing & more. Download & eval WebKing and get a free book. www.parasoft.com/bulletproofapps1 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Custom Rules Forum? Listing?
Chris Santerre wrote: Did my list give you the rule writing sickness Bill? ;) I'm in for a rule forum for sure! I just keep writing more rules every week. But to make it separate will not work. The SA developers should be part of the discussion, as they may have better insight as to what the next SA ruleset will have. I may write a rule that is already covered in a spam_phrases rule. I've done it before. Sometimes the default rules don't hit all the time do to OBFU. So a custom rule can do a better job. This list has been my BEST source for rule writing. (and a FAQ for perl regex.) I have everyone to thank every morning when my spamtrap is full. Thanks Chris (still learning to write better regex) -Original Message- *From:* Nichols, William [mailto:[EMAIL PROTECTED] *Sent:* Tuesday, July 08, 2003 3:02 PM *To:* Spamassassin-List *Subject:* [SAtalk] Custom Rules Forum? Listing? Is there a forum, list or anything for custom rules that people have tested, are coming up with? If not would anyone be interested in one? Bill I have an unused forum site at http://www.tark.us that may used if you want. --- This SF.Net email sponsored by: Parasoft Error proof Web apps, automate testing & more. Download & eval WebKing and get a free book. www.parasoft.com/bulletproofapps ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] "Naughty" test names
Satya wrote: On Jun 30, 2003 at 19:41, Tony Earnshaw wrote: My own doubt would be: where does political correctness end? E.g., when is some Jewish or Muslim user going to object to ham being called ham and spam (non-ham) being called spam (non-ham)? Would their objection be valid, because an incompetent CEO or one of his/her minions finds it so? Yaknow what I find offensive? The people who like to find offense where there is none. I am deeply offended over this whole penile arguement. Stop the freakin' spam first! (And oh yeah, I like to eat bacon. I find Tony Earnshaw's example offensive. The previous two sentences are supposed to be humor. If you the reader still find them offensive, I find *you* offensive, and this time I'm not joking. PS: I'm talking to you the reader, and not Tony Earnshaw. Unless you are Tony Earnshaw.) What I find offensive are people reply to threads on people who like to find offense where there is none, after the thread has been beaten to death. Can we please this "stuff" and get back to stopping spam? --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0016ave/direct;at.asp_061203_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] SpamAssassin 2.55 RedHat RPM
On Wed, 2003-06-11 at 13:11, Greg A wrote: > The Van Dinter SA 2.55 RPMs are only available for RedHat 7.3 > > For SA 2.53 there were Van Dinter RPMs for RedHat 7.3 and RedHat 8.0 > both. > > My question is this... > > Has anyone used the 7.3 RPM with RedHat Linux 8.0 and does it work? > > Thank you. Personally, I feel that you are better off using CPAN for the install. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.NET email is sponsored by: eBay Great deals on office technology -- on eBay now! Click here: http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Problems with SpamAssassin and qmail
Jason D. Montgomery wrote: I'm using qmail 1.03, SpamAssassin 2.55, Perl v5.8.0, and procmail v3.22 to run a STMP gateway server to filter spam. This system is a dedicated SMTP/SpamAssassin server and does nothing else. I'm not sure if SA is overloading the system because of the high volume of mail, or if it's mis-configured. Any comments or suggestions as to how to improve performance or if anyone notices any glaring mistake in my setup (.procmailrc) - I would be most grateful. I've poked around google and the SA FAQ and haven't turned up much other than possibly running SA on another server - but that's not really an option for me. The system is a 1GHz Dell w/ 256MB of RAM (and 494MB of swap, and normally top shows the swap at 2% in use) running FreeBSD. 'top' reveals around 20% total CPU load. I'm running spamd: /usr/local/bin/spamd -a -c -d -r /var/run/spamd.pid All users are setup to run their mail through spamc (see below). There are aprox 55 email addresses handled by this server. The problem is the server seems to get way behind on processing messages in the mail queue and the CPU also gets bogged down. The following messages show up in syslog: 15:51:02 /kernel: swap_pager_getswapspace: failed 15:51:56 last message repeated 3 times 16:02:17 /kernel: swap_pager_getswapspace: failed 16:02:19 last message repeated 11 times 16:05:07 last message repeated 6 times 16:05:14 /kernel: swap_pager_getswapspace: failed 16:05:32 su: mngr to root on /dev/ttyp0 16:05:33 /kernel: swap_pager_getswapspace: failed 16:06:03 last message repeated 10 times There's also a ton of these 'out of swap space" messages in syslog as well: 15:16:43 /kernel: swap_pager: out of swap space 15:17:03 /kernel: pid 60524 (perl), uid 1010, was killed: out of swap space 15:40:35 /kernel: pid 62180 (perl), uid 1001, was killed: out of swap space 16:05:33 /kernel: swap_pager_getswapspace: failed 16:06:03 last message repeated 10 times 16:14:43 /kernel: pid 69291 (procmail), uid 0: exited on signal 11 A 'ps auxww | grep spamd', reveals several (like 4 or 5) of spamd processes running in parallel (owned by the user who spamd is processing mail for). Some seem to get stuck and run indefinitely until they are killed because they ate up all the swap space on the system. A basic users configuration on my system is as follows: The .qmail file in the home directory launches procmail: | preline procmail The .procmailrc file checks for spam. If it scores a 5 or greater, I forward it to a mailbox that collects spam, otherwise forward it to my personal exchange server account: # SpamAssassin ~$HOME/.procmailrc EXCHANGE_SERV = [EMAIL PROTECTED] SPAMBOXDATA = "[EMAIL PROTECTED]" :0fw: /var/tmp/spamassassin.lock * < 256000 | spamc # Mails with a score of 15 or higher are almost certainly spam (with 0.05% # false positives according to rules/STATISTICS.txt). Let's put them in a # different mbox. (This one is optional.) :0: * ^X-Spam-Level: \*\*\*\*\* ! $SPAMBOXDATA :0 ! $ EXCHANGE_SERV Here are the overall stats on the qmail system over the past 16 hours or so. Completed messages: 4578 Recipients for completed messages: 5037 Total delivery attempts for completed messages: 5079 Average delivery attempts per completed message: 1.10944 Bytes in completed messages: 46039454 Bytes weighted by success: 43072620 Average message qtime (s): 492.89 Total delivery attempts: 7101 success: 3981 failure: 1061 deferral: 2059 Total ddelay (s): 2133766.488631 Average ddelay per success (s): 535.987563 Total xdelay (s): 325547.260610 Average xdelay per delivery attempt (s): 45.845270 Time span (days): 0.685022 Average concurrency: 5.50042 Two things that I can think of: 1) If you are doing any RBL checking, try turning it off. There was some discussion earlier about processes with long time outs when trying to do RBL checking and not getting through. Check the archive for details. There may also be some DNS issues that you aren't aware of. 2) check your softlimit settings in your qmail run files and make sure they are reasonable, not too big, not too small. Free advice: I have found that if you are going to run qmail, http://www.lifewithqmail.org is a valuable book to have around. It has a really good troubleshooting section. --- This SF.net email is sponsored by: Etnus, makers of TotalView, The best thread debugger on the planet. Designed with thread debugging features you've never dreamed of, try TotalView 6 free at www.etnus.com. ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] (no subject)
On Wed, 2003-06-04 at 09:52, Chris Santerre wrote: > I plan on never replying to these kinds of posts again. It is a scam to > waste our time. Hell, I may start writing a rule to put them in the spamtrap > ;) > Ah, Grasshopper. You have acheved true enlightenment. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: Etnus, makers of TotalView, The best thread debugger on the planet. Designed with thread debugging features you've never dreamed of, try TotalView 6 free at www.etnus.com. ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Which version of Red Hat?
On Mon, 2003-06-02 at 12:43, [EMAIL PROTECTED] wrote: > I'm setting up a new box with qmail, qmail-scanner and spamassassin on a Red > Hat box. Does anyone have recommendations about which OS version I should use? > It depends on if this is a production box that you need to get online fast or if you're just testing things out. Even though RH is going to stop support on it in the near future, I would suggest RH 7.3 as a starting point if you're in a production environment. I consider it "Plain Vanillia" for RH at this point. If you have the time to test and play, go with RH9. Check the SA list for gotchas with it, mostly it has to do with the language setting. Like I said, it's on the list archives. YMMV. -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: eBay Get office equipment for less on eBay! http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Getting spamd to start on boot.
On Mon, 2003-06-02 at 03:17, Cassandra Lynette Brockett wrote: > - Original Message - > From: "AltGrendel" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Sunday, June 01, 2003 8:26 PM > Subject: Re: [SAtalk] Getting spamd to start on boot. > > > > Very valid response, especally for the sys admin that has many boxes to > > maintain. Some people prefer to install some things "by hand'" via > > tarball. I don't really think that it's valid for every situation, but I > > like to do that so I can get a feel for what's going on with an > > installation and what the requirements, are and what goes where when > > installed. It just depends on how hands-on you want to be. > > That is quite true - though personally I have another machine which I use to > "test" new software on, so I don't run into the hassles of suddenly finding > "strange" "wandering" files around, so I build the "real" package from the > tarball on that machine - test it there to make sure it works like I expect, > and then install the new package on the server I intended to run it on. > That's what I was trying to alude to. I did that with SA 2.3x thru 2.4x. Once I was comfortable with it, I started using CPAN for the installs/upgrades on the production systems. No rpms or tarballs needed. Toe-may-toe / Toe-mah-toe. :) -- AltGrendel <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: eBay Get office equipment for less on eBay! http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Training SA based on Outlook mailboxes
Lucas Albers wrote: Their is another potential method you could use. Use the isbg.py imap python script to access the folders via imap and learn the spam. http://www.rogerbinns.com/isbg/ You could also use winbind to use the correcut NT usernames for the imap connection from the linux box. http://nic-ks.greatplains.net/samba/winbind.html This appears to be a possible method, that I have not investigated fully. --Luke There was a huge discussion on this topic about a month ago or so. The summary of the ideas was to use public folders on the Exchange box, one for ham and one for spam , and to have a script (the example was Perl) pull it over to the approprate maildir folder. I did test it and it works, you might want to search the SA archives. --- This SF.net email is sponsored by: eBay Get office equipment for less on eBay! http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Getting spamd to start on boot.
Cassandra Lynette Brockett wrote: I don't see what the problem is here. I compiled spamassassin via "rpm -tb " to give me rpm's to install, and spamassassin is controlled via "chkconfig spamassassin on" and service spamassassin start/stop/restart works fine. If you are running a rhat box, you really should install all possible packages as rpm's (in fact any distro that includes a package management system you should install all possible software via that system) that way you can handle such details as config file cleanups and other programming handled by the package all in the system - so upgrades don't generally leave random files that you really don't want sitting around the system. Very valid response, especally for the sys admin that has many boxes to maintain. Some people prefer to install some things "by hand'" via tarball. I don't really think that it's valid for every situation, but I like to do that so I can get a feel for what's going on with an installation and what the requirements, are and what goes where when installed. It just depends on how hands-on you want to be. --- This SF.net email is sponsored by: eBay Get office equipment for less on eBay! http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
