Re: [SAtalk] Cyrus IMAP Server and SA
I use SA with Cyrus-IMAP, but i don't use sendmail. Instead, i use postfix and amavisd-new instead. No problems here. On Tue, 27 Jan 2004, Peter P. Benac wrote: Greetings, Has anyone implemented SpamAssassin on a mail server running sendmail and Cyrus's IMAP Server? If so, did you run into any problems? Regards, Pete Peter P. Benac, CCNA Emacolet Networking Services, Inc Providing Systems and Network Consulting, Training, Web Hosting Services Phone: 919-847-1740 or 866-701-2345 Web: http://www.emacolet.com Need quick reliable Systems or Network Management advice visit http://www.nmsusers.org To have principles... First have courage.. With principles comes integrity!!! --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Silly spam
On Wed, 7 Jan 2004, Kurt Buff wrote: Several instances of the attached message got through, and I'm wondering what might catch this - we're running v2.60, with popcorn, backhair, weeds, smallpox, nov2rules and bigevil, plus a couple of minor custom rules. Hi, i'm a newbie to the list, is there are URL which has the rules for the above custom rules you mentioned above? --- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering advanced branching capabilities and atomic changes on 50+ platforms. Free Eval! http://www.perforce.com/perforce/loadprog.html ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] Re: [AMaViS-user] Amavis-New - SpamAssassin - Evil Rules....
If one had the capability to do so, would it not be more efficient to
use the domain list in an RHSBL? Granted that it uses a net lookup, but
if you secondary the zone on a localhost DNS server, I would think that
it would make it a lot easier for people to keep the file updated..
Don't get me wrong.. I think the list is great, and we're using it on a
few of our SA boxen, but when dealing with over 100 servers (using
postfix/amavis/spamassassin), flat files become a pain to manage.
We have an RHSBL that we've been running for about six months (for
those people who were using the easynet.nl spamdomains list, we also
imported their zone before they went offline), and use it with SA via
the following:
header BLACKHOLE_SSAGE eval:check_rbl_from_host('ssage',
'blackhole.securitysage.com')
describe BLACKHOLE_SSAGEBlacklisted as per
blackhole.securitysage.com
tflags BLACKHOLE_SSAGE net
score BLACKHOLE_SSAGE 4.5
On servers that see over a million emails per day, running a local
secondary was a necessity (as they couldn't handle the remote net
lookups), and it keeps us from having to make sure flat (text) files
are pushed out regularly..
Thoughts or info from people who have experience doing this sort of
thing would be appreciated..
Regards,
Jeff
On 11-Dec-03, at 6:21 PM, Teun Vink wrote:
- Original Message -
From: John B. [EMAIL PROTECTED]
Spamassassin just came out with a very large list of rules. These
rules are quite good and can be accessed here...
http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf
(Done by Chris Santerre)
I also read on the SA list that people should but the .cf file in
their /var/amavis/.spamassassin folder and NOT the
/etc/mail/spamassassin folder.
Is this true? I know that this has been hashed out before but I
really thought that it should go in the /etc/mail/spamassassin
folder.
I use this list as well, with great results. My site wide rules are
placed in /etc/spamassassin, which is the default directory on debian.
This works fine.
---
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
Free Linux Tutorials. Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278alloc_id=3371op=click
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] RHSBL Usage
Hi all, Is there a way to use an RHSBL list with SpamAssassin? In searching, I've found a lot of info for custom RBL details, but nothing on RHSBLs (domain based DNS blocklists). Thanks! Jeff --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278alloc_id=3371op=click ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] New Postfix SpamAssassin Step-By-Step Guide
Hi all, I've just posted a new guide in my series of Postfix Anti-Spam documents. This one is a step-by-step guide to getting Postfix working with SpamAssassin as per the configuration that I like using. Comments and constructive criticism are welcome. The guide can be found here: http://www.securitysage.com/guides/postfix_uce_steps.html Regards, ___ Jeffrey Posluns, CISA, CISSP, SSCP, CCNP, CCDA, GSEC Information Security Management Consultant SecuritySage Inc. Tel: (514) 995-4987 http://www.securitysage.com --- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. See the people who have HELPED US provide better services: Click here: http://sourceforge.net/supporters.php ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Is there a way to reject a message before it arrives?
Here are the stats from our servers: The numbers below are averages per day for our primary MX over the past 30 days, with an average of 861,344 emails per day. mime_header_checks rejects 11% of emails SecuritySage_rhsbl5 rejects 14% of emails header_checks rejects 23% of emails body_checks rejects 18% of emails other_rbls reject 17% of emails Of the remaining 17% of emails that get processed by the system, SpamAssassin catches 6% Of the remaining 11% of emails, there are very few spams that slip by. Also note that the checks files each have a SPAM-ID, so if there is something wrongfully rejected, and someone complains about it, we tend to update the filters quite quickly. If you have any questions about how we do things, feel free to contact me off-list. Regards, Jeff On Thursday, October 9, 2003, at 02:00 PM, Dan Wilder wrote: Anybody here have any experience with the MTA-level checks found at http://www.securitysage.com/files.html ?? This stuff is Postfix-specific, and includes a bunch of patterns for various checks which purport to catch a lot of spam. The files may be updated daily. While it's true you're using incoming network bandwidth accepting some part of the email, it's possible that you save some CPU bandwidth, as the scanning is apt to be relatively lightweight. Also, Postfix is pretty good at load-shedding, which should limit CPU bandwidth absorbed. If anybody's tried them, I'm interested in knowning whether they're effective, to what extent they're prone to false postives and how much, if at all, they lower the burden of spam which is subsequently detected by SA. --- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. See the people who have HELPED US provide better services: Click here: http://sourceforge.net/supporters.php ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] Re: New Postfix SpamAssassin Step-By-Step Guide
Thanks everyone for the comments and suggestions (too many to reply individually to everyone). I'm working on an update to the guide, which should be ready / posted in a day or two. BTW, if anyone is in Chicago October 14-16, I'll be speaking at the Security Decisions conference (http://securityconf.techtarget.com/), and do not yet have anyone to go for beer with! Reply off-list (of course) if anyone wants to meet up and rant about spam - or anything else for that matter. :-) --- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. See the people who have HELPED US provide better services: Click here: http://sourceforge.net/supporters.php ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] Not identifying spam
Hi I have some mail in my mailbox that I think is SPAM but spamassassin does not. All mail look almost the same, there is some text and two urls and some junk at the bottom and all mail ends with Thanks, bye Is there a way to stop this? some mail get SA points as low as below 3. This sample gets X-Spam-Status: No, hits=3.6 tagged_above=3.0 required=6.0 tests=HTML_40_50, HTML_MESSAGE, HTTP_USERNAME_USED, MIME_LONG_LINE_QP, USERPASS Here is the sample Term-life coverage at reduced rates is now available Why spend more than you have to? We survey the top life-insurance companies-nationwide and provide the best-rates available today! [ http://[EMAIL PROTECTED]/click.php?id=leneyeiID=8 ]http://[EMAIL PROTECTED]/click.php?id=leneyeiID=8 If you don't want to hear from us again please follow the link below [ http://[EMAIL PROTECTED]/click.php?id=leneyex ]http://[EMAIL PROTECTED]/click.php?id=leneyex qdg22k2vn5 1l43lf3z7ehr vckwoh3h9zm643 dmnwye3itysos 1comk73p4lin y6rvk62rekxsi1 wbhooe3dd0mpi2 jbgckx1x6eixq 45k5qf1l4j2 o054uz20ny1 udra431d6r 8ymtzy2fkzsyz 5uozzon9djrj4s rniy6f1vwwv f44b3y1hkp0lk1 00tv5udywnyg1 lhk9y6878pdy3 c1pq4mhpa9yjol wgsca53z33k 8mm4xbukwcj82 hwywvb2xvlr4m2 6kawt93n1to 54oif13yu3l1 efkdle38woik7 6d32641a4dal21 lyyvwj1jh8p6z 24h5ql9ucj7v ehe9ec35ksofb puzzmi34t6k a5ryzce03slf vuls85mt3tm531 qiawpe2upefg riubhk1gbt Thanks, bye. --- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. See the people who have HELPED US provide better services: Click here: http://sourceforge.net/supporters.php ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Error installing spamassassin from CPAN
Hi Ewald, the problem you have is that your system seems not to have a make pre-compiler: Writing Makefile for Mail::SpamAssassin Makefile:92: *** missing separator. Stop. /usr/bin/make -- NOT OK Running make test Can't test without successful make Running make install make had returned bad status, install seems impossible Previously to a compilation is needed to create a Makefile. In your case you have a 'Makefile' file but you haven't the 'make' binary, or it seems. Your compilation stopped at Makefile line 92 and the error is just this: /usr/bin/make -- NOT OK you have no make in your system. Install it (or create a link to your make if it's installed in a different path than the installer search for, that is /usr/bin/make) and all will work fine. best regards, jonathan Ewald Jenisch wrote: Hi, Sorry if these questions sound dumb, but being an absolute newbie to spamassassin I'm having a hard time setting it up: I tried to install spamassassin using the Perl-interface (CPAN) on a Redhat8 system; as per the INSTALL-file: # perl -MCPAN -e shell and then install Mail::SpamAssassin First of all it fetches SA v 2.55 instead of the new 2.60 Then it works on and finally complains with this error message: CPAN.pm: Going to build J/JM/JMASON/Mail-SpamAssassin-2.55.tar.gz Checking if your kit is complete... Looks good Warning: I could not locate your pod2man program. Please make sure, your pod2man program is in your PATH before you execute 'make' Writing Makefile for Mail::SpamAssassin Makefile:92: *** missing separator. Stop. /usr/bin/make -- NOT OK Running make test Can't test without successful make Running make install make had returned bad status, install seems impossible cpan However pod2man *IS* there: # which pod2man /usr/bin/pod2man # file /usr/bin/pod2man /usr/bin/pod2man: a /usr/bin/perl script text executable BTW, I also tried getting SA 2.60 up directly from the tar.gz-File using perl Makefile.PL - but again it complains about a missing pod2man. Any ideas what could be wrong here? TIA for your help -ewald --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk -- __ Jonathan Gonzalez - SureStorm.com Security Site - Madrid/MA/SPAIN http://www.surestorm.com - GnuPG Key ID = 0xAA3EAC08 /\ \ / ASCII RIBBON CAMPAIGN X Against HTML mail Microsoft attachments / \ --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] God, I HATE CPAN!
Hi James, i have installed SpamAssassin from my CPAN shell in my linux box without any problem but using this versions: perl-5.8.0-10tr Mail::SpamAssassin-2.55 My system is running Exim 4.22 + Exiscan-ACL v.11 with SpamAssassin v.255 and all works fine. Configuration files are available for Exim and SpamAssassing (among other config files) in my site data folder @ http://www.surestorm.com/data/ If yo have comments, just drop me an email. best regards, jonathan [EMAIL PROTECTED] wrote: FWIW, my little rant was all over nothing. I just installed 5.8 from FBSD ports and then everything worked fine, including SA. Interestingly, it looks like SA looks for 5.8 first when launching, because I kept 5.005 under /usr/bin, and put 5.8 under /usr/local/bin (I did not run the use.perl port script) and /usr/bin is in front of /usr/local/bin in the path. I may try switching with that script later to see if anything else breaks... On Tue, 23 Sep 2003, Bart Schaefer wrote: On Tue, 23 Sep 2003 [EMAIL PROTECTED] wrote: I thought I'd join the CPAN bandwagon and install SA with it. To my horror, it installed perl 5.8 (I use 5.005) and all the mods. This was a bug in the CPAN modules themselves, prior to CPAN v1.63 or so (I forget exactly). Following the recommended upgrade path by installing Bundle::CPAN would also trigger the bug and upgrade perl. The workaround is to make sure that you're running the perl 5.005 binary, fire up the CPAN shell, install *just* CPAN (not the bundle) to get the most recent version, quit and restart the CPAN shell, and *then* install Bundle::CPAN. If necessary -- and if you decide to stay with perl 5.005 -- delete all the 5.8.0 directories in /usr/lib/perl5 (or wherever the base path is) before upgrading CPAN. After that you should be OK to install SA. 2.60 sometimes gets an inconsequential test failure under perl 5.005, see bugzilla bug #2350. So you may have to force install it. --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk James Smallacombe PlantageNet, Inc. CEO and Janitor [EMAIL PROTECTED] http://3.am = --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk -- __ Jonathan Gonzalez - SureStorm.com Security Site - Madrid/MA/SPAIN http://www.surestorm.com - GnuPG Key ID = 0xAA3EAC08 /\ \ / ASCII RIBBON CAMPAIGN X Against HTML mail Microsoft attachments / \ --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] how do I get Spamassassin to ignore specific domains?
Hi Russell, if you are using blacklists in the local.cf file you have to put the whitelist_* over this line because if not won't work fine. If you want you can take a look at my local.cf file in my site @ http://www.surestorm.com/data/SpamAssassin_local.cf.html if you have comments just drop me an email message best regards, jonathan Russell Premont wrote: Can I set Spamassassin to not scan mail from specific domains? If I can how do I set it to do so. I tried adding the domains to the whitelist in local.cf in the form of whitelist_from [EMAIL PROTECTED] [EMAIL PROTECTED] etc. This does not seem to work. I am running Spamassassin on Solaris 9 Sparc in conjunction with Courier and Maildrop. Here is the issue I am having. I have a client that has a closed email system. They receive tickets (work orders) via email from 4 other domain, process these orders and in turn dispatch these tickets to the facilities to do the work. This system is all automated. Spamassassin is adding information to the ticket and causes the processing server to not be able to read the tickets. Thanks for any help you can provide. --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk -- __ Jonathan Gonzalez - SureStorm.com Security Site - Madrid/MA/SPAIN http://www.surestorm.com - GnuPG Key ID = 0xAA3EAC08 /\ \ / ASCII RIBBON CAMPAIGN X Against HTML mail Microsoft attachments / \ --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] Disable relays.osirusoft.com checks
Hi folks, i would like to know how can i disable the relays.osirusoft.com rbl checks form my spamassassin (v2.55 from CPAN) my config file (i provide it because i'm a newbie in SA) is in http://www.surestorm.com/data/SpamAssassin_local.cf.html This is an example of report of my SA v2.55 system, that i don't want to be checked anymore: X-Spam-Score: 3.0 (+++) X-Spam-Report: 3.0/5.0 Start SpamAssassin results 3.00 points, 5 required; * -0.5 -- Has a In-Reply-To header * 0.6 -- RBL: Received via a relay in relays.osirusoft.com [RBL check: found 106.67.195.213.relays.osirusoft.com.] * 2.9 -- RBL: DNSBL: sender is Confirmed Open Relay End of SpamAssassin results TIA jonathan -- __ Jonathan Gonzalez - SureStorm.com Security Site - Madrid/MA/SPAIN http://www.surestorm.com - GnuPG Key ID = 0xAA3EAC08 /\ \ / ASCII RIBBON CAMPAIGN X Against HTML mail Microsoft attachments / \ --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Tagged Mail Format Problem
I have different setup, including without trouble spam reports in email but as i said without problem. My config es the following: http://www.surestorm.com/data/SpamAssassin_local.cf.html best regards, jonathan Philip Bubel wrote: Hello All, Having a problem with mail that is tagged as spam. SA is placing a large block of text (see below) at the start of all messages tagged as spam. This block plays havoc with HTML messages and messages with attachments. This is a problem for us when a message gets tagged as spam incorrectly, often times I'm not able to recover it because the tag has messed with the message format. I've tired a bunch of different settings in local.cf, but I've been unable to remove this block. Anybody else have this problem? Any thoughts on a solution would be great appreciated. Thanks. SPAM: Start SpamAssassin results SPAM: 5.6 hits, 5 required; SPAM: * 2.0 -- From: contains numbers mixed in with letters SPAM: * 1.0 -- Subject is an eBay question SPAM: * 0.6 -- From: does not include a real name SPAM: * 2.0 -- Subject contains a unique ID number SPAM: SPAM: End of SpamAssassin results Philip Bubel [EMAIL PROTECTED] --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk -- ___ Jonathan Gonzalez - SureStorm.com Security Site - Madrid/MA/SPAIN http://www.surestorm.com - GnuPG Key ID = 0xAA3EAC08 /\ \ / ASCII RIBBON CAMPAIGN X Against HTML mail Microsoft attachments / \ --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Question on installing SA and using spamd
Hi Jason, comment in line, Jason Williams wrote: Good morning everyone. I wanted to ask a couple of quick questions about installing SA and running spamd. From what i've read, I have two options to install SA: use perl -MCPAN or download the source and install it. My first question is about perl -MCPAN. I have only used this a few times and im still learning it. If I decide to install SA using perl -MCPAN, after I have installed the package through perl -MCPAN, do I need to navigate to the directory (/root/.cpan/mail-spamassassin...) and run the setup from within that directory? Reason I ask is when I was testing SA awhile ago, I downloaded it via MCPAN and ended up having to navigate to the directory where it was downloaded and run perl Makefile.pl, make and make install... If you run perl -MCPAN -e shell you will get a CPAN shell (installing 20 mb of perl modules in your hard disk) where you can type in expample install Mail::SpamAssassin and all the job will be done by CPAN. At the end you will have installed the package, with the binarie in a path executable directory and the configuration under /etc/mail/spamassassin/local.cf You won't need anything else. Can someone clear that up for me? Lastly, in regards to using spamd/spamc. For the most part, all I need to do is move the executables to where I want them, and then run spamd in the background (using the -d flag?). Finally, configure postfix to call for spamc instead of spamassassin, correct? I have used before postfix but now i use Exim so i cannot help you with the configuration file. What i can tell you is that you have to run spamd from rc.local at the boot time to have running the spamassassin daemon. You should run spamd like spam -d -a. The -d flag means daemonize and the -a flag means Use auto-whitelists. For your own interes you can take a look a my configuration for email at http://www.surestorm.com/data/ In this folder you'll find config files for Exim, Postfix, SpamAssassin and more, but the SpamAssassin configuration will only involve Exim and SpamAssassing. I have never configured Postfix with SpamAssassin Just want to make sure I have all my bases covered. Thanks for all the help. Thanks to you ;-) Jason jonathan --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk -- ___ Jonathan Gonzalez - SureStorm.com Security Site - Madrid/MA/SPAIN http://www.surestorm.com - GnuPG Key ID = 0xAA3EAC08 /\ \ / ASCII RIBBON CAMPAIGN X Against HTML mail Microsoft attachments / \ --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] RE: Subject rule question
Message-ID: [EMAIL PROTECTED] From: Mike Kuentz (2) [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: [SAtalk] [RD] Subject rule question X-Original-Date: Tue, 9 Sep 2003 15:04:25 -0400 Date: Tue, 9 Sep 2003 15:04:25 -0400 Status: R Hi Mike, RE: [SAtalk] [RD] Subject rule question I chased this for a while too, and after failing miserably with SpamAssassin ( no doubt my fault, not SAs, I was in a hurry ) here's what I did. My end delivery is somewhat draconian, change your end target to suit. The redundancy is for some debugging in progress, check $HOME/procmail.log to see which one actually traps what you're getting. Corrections, improvements welcome and solicited. -- cut here - DROPPRIVS=yes VERBOSE=YES LOGFILE=$HOME/procmail.log # feed it to spamc first :0fw * 256000 | spamc # regardless of outcome, dump it. :0H * ^Subject:.*ISO-8859-1.* !bit-bucket :0H * ^Subject:.*[Ii][Ss][Oo]-8859-1.* !bit-bucket -- cut here - SA is a phenomenal product, and Procmail is one of the Doomsday Buttons Of Last Resort for UCE as well. :) Good Luck G.F. Boyd VTA.COM / VTA Technologies [EMAIL PROTECTED] I see a lot of spams coming through hiding the subject masked using ISO-8859, like this Subject: =?ISO-8859-1?b?SGFsZiBQcmljZWQgU2lsZGVuYWZpbCBDaXRyYXRl?= which translates back to a subject of: Half Priced Sildenafil Citrate obviously I can look for Half Priced Sildenafil Citrate in the subject, but I want to write a rule for ISO-8859 in the subject. I have this rule, but it doesn't appear to hit. header MK_CHARSET_IN_SUBJECT Subject =~ /ISO\-8859/i Does SA translate that before hand and that's why it's not hitting? It's obviously a big thing for spammers, since a search on groups.google.com for ISO-8859 turns up tons of results from news.admin.net-abuse.sightings. Mike --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] SA and razor not playing nice
Has anyone come up with a solution to this yet? Regards, /Jeff On Friday, July 4, 2003, at 08:02 PM, Dale LaFountain wrote: On 05.06.2003 16:48 Uhr, Chris Balay [EMAIL PROTECTED] wrote: AARGHH! I am in spam hell! Well when I run spamassassin from the terminal I get the following error: razor2 check skipped: Can't locate object method new via package Razor2::Client::Agent at /Library/Perl/Mail/SpamAssassin/Dns.pm line 382. Could that be why SpamAssasin is failing when called by CGP? If so how do I fix it? Any help is greatly appriciated! Free PEZ to the solution provider/providers! ;-) Looks familiar... I have SpamAssassin 2.55 working fine for a couple months now on a Communigate 4.06 server with OSX 10.2.5. When it's enabled Razor complains exactly as Chris mentioned above. Note that both SA and Razor2 seem to be functional on their own. If use_razor2 is set to 1, I receive the complaint below about the new method (which IS in the Agent.pm file, I looked). In either case, SA finishes scanning the message fine, but SA throws errors on every scan into the log when razor2 is turned on. spamassassin -tD sample-spam.txt debug: Razor2 is available debug: Razor2 is available debug: entering helper-app run mode razor2 check skipped: Can't locate object method new via package Razor2::Client::Agent at /Library/Perl/Mail/SpamAssassin/Dns.pm line 382. debug: leaving helper-app run mode debug: Razor2 results: spam? 0 highest cf score: 0 debug: all '*To' addrs: [EMAIL PROTECTED] [EMAIL PROTECTED] .. razor-check -d sample-spam.txt Razor-Log: Computed razorhome from env: /var/root/.razor Razor-Log: Found razorhome: /var/root/.razor Razor-Log: read_file: 16 items read from /var/root/.razor/razor-agent.conf Jul 04 16:54:13.057053 check[1685]: [ 1] [bootup] Logging initiated LogDebugLevel=9 to stdout Jul 04 16:54:13.058023 check[1685]: [ 5] computed razorhome=/var/root/.razor, conf=/var/root/.razor/razor-agent.conf, ident=/var/root/.razor/identity-ruXYT9jzYE Jul 04 16:54:13.058218 check[1685]: [ 2] Razor-Agents v2.34 starting razor-check -d .. Jul 04 16:54:13.493800 check[1685]: [ 8] razor-check finished successfully. I have already re-installed both razor and SA a couple different times, with no luck. Anyone have a solution? Thanks, Dale --- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
FW: [SAtalk] Appliances vs SA
-Original Message- From: Chad Leigh I've been using SA for at least a year or two now and love it! We combine it with MailScanner with ClamAV and out of 20,000 emails per week receive no viruses and block out around 4,000 pieces of spam.and really only about 100 pieces of spam slip through the cracks. I think that is awesome! My problem is the IT Director loves SA too, but is wanting to purchase one of the Spam Appliances that handles all the updating, etc. for a fee. I can't see that it would be a wise investment as the appliances are at least $1500 and yearly subscriptions are around $150 for spam and virus updates. He's thinking that in addition to not having to add rules for spam slipped through the cracks to SA that the appliance will be more accurate. I think it'll be about the same. I bet you are correct. The funny thing is that some people think that just because some aspects of the spam thwarting process is automated, it means the solution is hands-off. This is rarely the case. It is difficult to just give arguments though. It really depends on your environment. For example, a company I consult for uses Postini. Postini is a great service. It is very expensive but the anti-spam solution is outsourced for my client so it is hands-off. They have more money to toss at the problem which means that they buy their IT staff's time back. The staff is not technically adept with Email anyway so they benefit from outsourcing. What they loose is any ability to customize their mail processing. Now this solution at another company would be totally wrong as another organization may have a qualified staff and may really need the flexibility. So in the end, it is really up to you to develop the arguments as only you know all the trade-offs and the specific appliances you are considering. Arguments are a dime-a-dozen until aimed at a specific situation. I must admit, after writing the above, that I can not understand the choice to go with an appliance over an already installed SA solution. You really loose the flexibility that SA offers for a closed solution. I have heard the argument from people that they would be willing to accept a higher FN rate if they did not have to deal with the solution on a daily basis. I have yet to have anyone really quantify acceptable parameters though. The immediate drawbacks for you are: 1) learning a whole new system (that you may need to supplement with additional checks anyway 2) potentially loose some flexibility as you will be dealing with more of a closed system 3) if a fix is needed, good luck getting anyone to tend to it within your timeframe --Larry --- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] new to spamassassin and do not know what the heck I am doing!
Hi Jenn, I don't know what your usage is but the following is a great howto. http://lawmonkey.org/anti-spam.html --Larry -Original Message- From: Jennifer Fountain I am reading the online help and googling but I am not getting a clear picture as to what to do. :( Can anyone point me to a good - here's how to install spamassasin and configure it? I searched the archives but I might just be too stupid 'cause I can't find anything :( --- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] FYI - New SecuritySage RHSBL
Hello all, If anyone is interested, there's a new RHSBL available that is based on the SecuritySage access filters (http://www.securitysage.com/files/access). Information about the RHSBL can be found at: http://www.securitysage.com/guides/postfix_uce_rhsbl.html Regards, ___ Jeffrey Posluns, CISA, CISSP, SSCP, CCNP, CCDA, GSEC Information Security Management Consultant SecuritySage Inc. Tel: (514) 995-4987 http://www.securitysage.com --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] Assistance with SpamAssassin Configuration
I sent out a message a few days ago, and haven't gotten any response yet. This is becoming a hot issue with some of my users, and it'd be great if somebody has some insight or can direct me to somewhere other than the general RTFM response. I've checked the IRC channel, (it was uninhabited for a period of 36 hours straight...) and I've exhaustively searched every link that Google comes up with on this subject. I can't find any links to email addresses on the spamassassin.org website, so I am imploring somebody on this list to lend a helping hand. Here is a copy of my original email, again: Greetings fellow SpamAssassins: I have installed SpamAssassin 2.43 on my primary mailserver in a sitewide configuration, so it filters all inbound mail on my server. I am running Sendmail 8.12.6, and have spamass-milter creating the sock, and a line in my sendmail.cf pointing to that sock. I am having some difficulty with the SpamAssassin per-user preferences configuration. I have attempted, in assorted methods, to get spamd to read a user preferences file. I first set the SPAMD_ARGS to include a -c which, according to the manpage for spamd, forces spamd to create the user preferences files. I cannot find the location where the spamd daemon is creating these, if at all. They're certainly not going into the /home/username/.spamassassin directories. I've also added the --virtual-config=dir and -x arguments, and supplied a separate directory for files, titled username.prefs, where 'username' is replaced with the username desiring the custom preferences. Spamassassin is still not reading that preferences file, either. Some users want the required score of 5, while other people want a much looser score for SPAM filtering. This is why I need to utilize the per-user configurations. It is entirely possible that I am doing something wrong, and that I don't understand how this is supposed to be configured. Any assistance would be greatly appreciated. Unfortunately, the documentation is not thorough enough to answer this question - I have RTFM'd several times with no luck, and this is why I am asking you fine people for your assistance! Thank you in advance, Gregg --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] Re: Assistance with SpamAssassin Configuration
I'm sorry, I should have clarified that in my original post. I'm using sendmail as the MTA. I have the spamass-milter sock generated in a startup script, and an entry in my sendmail.cf file pointing to the spamass-milter sock. Thanks again, Gregg At 01:48 AM 12/21/2002 -0500, Theo Van Dinter wrote: The first question is: define sitewide configuration. Are you running via the MTA, or in a global procmailrc, or ...? --- This SF.NET email is sponsored by: The Best Geek Holiday Gifts! Time is running out! Thinkgeek.com has the coolest gifts for your favorite geek. Let your fingers do the typing. Visit Now. T H I N K G E E K . C O Mhttp://www.thinkgeek.com/sf/ ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
