unsubscribe

[Andrew Xiang]

unsubscribe

[Andrew Xiang]

unsubscribe

user_in_whitelist , how do I find out which one?

[Andrew Xiang]

I have many users in the whitelist_from in the local.cf.
When I get forwarded spam email like this, how do I find which one it matched? 
Which FROM entry is it actually looking at?

-Andrew


X-Spam-Checker-Version: SpamAssassin 3.2.1 (2007-05-02) on xphotonics.com
X-Spam-Level: 
X-Spam-Status: No, score=-72.0 required=5.0 tests=BAYES_50,DCC_CHECK,
 DIGEST_MULTIPLE,DRUGS_ERECTILE,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,
 MIME_HTML_ONLY,PYZOR_CHECK,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,
 RAZOR2_CHECK,SARE_FROM_DRUGS,UNPARSEABLE_RELAY,USER_IN_WHITELIST autolearn=no
 version=3.2.1
X-Spam-Pyzor: Reported 4263 times.
X-Spam-Report: 
 * -100 USER_IN_WHITELIST From: address is in the user's white-list
 *  1.7 SARE_FROM_DRUGS From a drug
 *  5.5 UNPARSEABLE_RELAY Informational: message has unparseable relay lines
 *  0.0 HTML_MESSAGE BODY: HTML included in message
 *  0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
 *  [score: 0.5000]
 *  3.5 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
 *  5.0 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
 *  1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level
 *  above 50%
 *  [cf: 100]
 *  0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
 *  [cf: 100]
 *  5.0 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/)
 *  5.0 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
 *  0.0 DIGEST_MULTIPLE Message hits more than one network digest check
 *  0.3 DRUGS_ERECTILE Refers to an erectile drug
 *  0.1 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
Received: from xphotonics.com (localhost [127.0.0.1])
 by xphotonics.com (8.14.1/8.14.1) with ESMTP id l9MFJIOp032936
 (version=TLSv1/SSLv3 cipher=DHE-DSS-AES256-SHA bits=256 verify=NO)
 for <[EMAIL PROTECTED]>; Mon, 22 Oct 2007 11:19:18 -0400 (EDT)
 (envelope-from [EMAIL PROTECTED])
Received: (from [EMAIL PROTECTED])
 by xphotonics.com (8.14.1/8.14.1/Submit) id l9MFJIKX032935
 for xiang; Mon, 22 Oct 2007 11:19:18 -0400 (EDT)
 (envelope-from lian)
Received: from 029ae8f252bf4ac (84pavel.dialup.corbina.ru [85.21.237.209])
 by xphotonics.com (8.14.1/8.14.1) with SMTP id l9MFHg8N032899
 for <[EMAIL PROTECTED]>; Mon, 22 Oct 2007 11:17:44 -0400 (EDT)
 (envelope-from [EMAIL PROTECTED])
Date: Mon, 22 Oct 2007 11:17:42 -0400 (EDT)
Received: from Susana Ware (10.11.17.11) by 029ae8f252bf4ac (PowerMTA(TM) 
v3.2r4) id hfp31o62d55j87 for <[EMAIL PROTECTED]>; Mon, 22 Oct 2007 07:17:20 
+0300
Message-Id: <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject: October 79% OFF
From: VIAGRA ?Official Site <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
X-Virus-Scanned: ClamAV 0.91.1/4559/Mon Oct 22 00:02:57 2007 on xphotonics.com
X-Virus-Scanned: ClamAV 0.91.1/4559/Mon Oct 22 00:02:57 2007 on xphotonics.com
X-Virus-Status: Clean

Re: how to run SA3.0.1 on a existing mailbox

[Andrew Xiang]

Bill,

This does not move spam into a new file. In fact, it moves all into a new
file.
I want to be able to move ONLY SPAM or ONLY HAM into a new file.

thanks
Andrew

- Original Message - 
From: "William Stearns" <[EMAIL PROTECTED]>
To: "Andrew Xiang" <[EMAIL PROTECTED]>
Cc: "Jim Maul" <[EMAIL PROTECTED]>; "ML-spamassassin-talk"
; "William Stearns" <[EMAIL PROTECTED]>
Sent: Wednesday, December 08, 2004 12:40 PM
Subject: Re: how to run SA3.0.1 on a existing mailbox


> Good day, Andrew,
>
> On Wed, 8 Dec 2004, Andrew Xiang wrote:
>
> > But I have a whole mbox with 10,000 messages. How can I pipe all the
> > messages and move them?
> >
> > - Original Message ----- 
> > From: "Jim Maul" <[EMAIL PROTECTED]>
> > To: "Andrew Xiang" <[EMAIL PROTECTED]>
> >
> > > Andrew Xiang wrote:
> > > > I want to run spamassassin on my existing /var/mail/mymailbox and
only
> > move
> > > > all the spam mail into /var/mail/spam .
> > > >
> > > > Is there   a way to do that?
> > >
> > > you could run spamassassin -e on the message and then make a quick
> > > script to check the return status and move the messages accordingly.
> > >
> > >   -e, --exit-code   Exit with a non-zero exit code
> > > if the tested message was spam
> > >
> > > SA doesnt move anything on its own so you'd have to script it.
>
> ...with something like the following:
>
> ~/bin/reprocess-mailbox
>  snip 
>
> #!/bin/bash
> #Copyright 2004 William Stearns <[EMAIL PROTECTED]>
> #Released under the GPL
>
> if [ -z "$1" ] || [ ! -r "$1" ]; then
> echo "Usage: $0 folder-to-reprocess"
> exit 1
> fi
>
> TmpFile=`mktemp -q "$1.XX"`
> if [ $? -ne 0 ]; then
> echo "$0: Can't create temp file, exiting..."
> exit 1
> fi
>
> if [ ! -w "$TmpFile" ]; then
> echo "$TmpFile unwriteable, exiting"
> exit 1
> fi
>
> echo "working with $1 and $TmpFile"
>
> nice formail -f -ds /usr/bin/spamc <"$1" >"$TmpFile"
>
> echo "Processing done.  Please check $TmpFile"
>  snip 
>
> This should be run on a mailbox that is _not_ actively recieving
> mail.  At the end, you'll need to rename the tmpfile back to the original
> file to keep the changes, and then start your mail flowing again.
> Cheers,
> - Bill
>
> --
-
> "5) what are people like spaf/chris rouland/lance then?
> a) THEY ARE THE ENEMY. WHITEHATS = ENEMY."
> -- http://www.blackhatbloc.org/phrack/texts/faq1.txt
> --
> William Stearns ([EMAIL PROTECTED]).  Mason, Buildkernel, freedups, p0f,
> rsync-backup, ssh-keyinstall, dns-check, more at:   http://www.stearns.org
> --
>

Re: how to run SA3.0.1 on a existing mailbox

[Andrew Xiang]

It seem to copy all the emails into the temp file. It does not remove spam
from the mbox.
The purpose is to remove all the spams inside mailbox.

-Andrew

- Original Message - 
From: "William Stearns" <[EMAIL PROTECTED]>
To: "Andrew Xiang" <[EMAIL PROTECTED]>
Cc: "Jim Maul" <[EMAIL PROTECTED]>; "ML-spamassassin-talk"
; "William Stearns" <[EMAIL PROTECTED]>
Sent: Wednesday, December 08, 2004 12:40 PM
Subject: Re: how to run SA3.0.1 on a existing mailbox


> Good day, Andrew,
>
> On Wed, 8 Dec 2004, Andrew Xiang wrote:
>
> > But I have a whole mbox with 10,000 messages. How can I pipe all the
> > messages and move them?
> >
> > - Original Message ----- 
> > From: "Jim Maul" <[EMAIL PROTECTED]>
> > To: "Andrew Xiang" <[EMAIL PROTECTED]>
> >
> > > Andrew Xiang wrote:
> > > > I want to run spamassassin on my existing /var/mail/mymailbox and
only
> > move
> > > > all the spam mail into /var/mail/spam .
> > > >
> > > > Is there   a way to do that?
> > >
> > > you could run spamassassin -e on the message and then make a quick
> > > script to check the return status and move the messages accordingly.
> > >
> > >   -e, --exit-code   Exit with a non-zero exit code
> > > if the tested message was spam
> > >
> > > SA doesnt move anything on its own so you'd have to script it.
>
> ...with something like the following:
>
> ~/bin/reprocess-mailbox
>  snip 
>
> #!/bin/bash
> #Copyright 2004 William Stearns <[EMAIL PROTECTED]>
> #Released under the GPL
>
> if [ -z "$1" ] || [ ! -r "$1" ]; then
> echo "Usage: $0 folder-to-reprocess"
> exit 1
> fi
>
> TmpFile=`mktemp -q "$1.XX"`
> if [ $? -ne 0 ]; then
> echo "$0: Can't create temp file, exiting..."
> exit 1
> fi
>
> if [ ! -w "$TmpFile" ]; then
> echo "$TmpFile unwriteable, exiting"
> exit 1
> fi
>
> echo "working with $1 and $TmpFile"
>
> nice formail -f -ds /usr/bin/spamc <"$1" >"$TmpFile"
>
> echo "Processing done.  Please check $TmpFile"
>  snip 
>
> This should be run on a mailbox that is _not_ actively recieving
> mail.  At the end, you'll need to rename the tmpfile back to the original
> file to keep the changes, and then start your mail flowing again.
> Cheers,
> - Bill
>
> --
-
> "5) what are people like spaf/chris rouland/lance then?
> a) THEY ARE THE ENEMY. WHITEHATS = ENEMY."
> -- http://www.blackhatbloc.org/phrack/texts/faq1.txt
> --
> William Stearns ([EMAIL PROTECTED]).  Mason, Buildkernel, freedups, p0f,
> rsync-backup, ssh-keyinstall, dns-check, more at:   http://www.stearns.org
> --
>

Re: how to run SA3.0.1 on a existing mailbox

[Andrew Xiang]

But I have a whole mbox with 10,000 messages. How can I pipe all the
messages and move them?

- Original Message - 
From: "Jim Maul" <[EMAIL PROTECTED]>
To: "Andrew Xiang" <[EMAIL PROTECTED]>
Cc: 
Sent: Wednesday, December 08, 2004 12:21 PM
Subject: Re: how to run SA3.0.1 on a existing mailbox


> Andrew Xiang wrote:
> > I want to run spamassassin on my existing /var/mail/mymailbox and only
move
> > all the spam mail into /var/mail/spam .
> >
> > Is there   a way to do that?
> >
> > thanks
> > Andrew
> >
> >
> >
>
> you could run spamassassin -e on the message and then make a quick
> script to check the return status and move the messages accordingly.
>
>   -e, --exit-code   Exit with a non-zero exit code
> if the tested message was spam
>
> SA doesnt move anything on its own so you'd have to script it.
>
> -Jim
>

how to run SA3.0.1 on a existing mailbox

[Andrew Xiang]

I want to run spamassassin on my existing /var/mail/mymailbox and only move
all the spam mail into /var/mail/spam .

Is there   a way to do that?

thanks
Andrew

URIDNSBL on freebsd?

[Andrew Xiang]

How to configure URIDNSBL on Freebsd? It does not seem to work by default.

-Andrew

config surbl in freebsd?

[Andrew Xiang]

I don't know if surbl is working on my system? how can I check it? 
Spam checking is not as good as before. 

-Andrew

lint failed

[Andrew Xiang]

 spamassassin --lint
config: SpamAssassin failed to parse line, skipping: urirhssub
URIBL_JP_SURBL  multi.surbl.org.A   64
Failed to run URIBL_JP_SURBL SpamAssassin test, skipping:
(Can't locate object method "check_uridnsbl" via package
"Mail::SpamAssassin::PerMsgStatus" (perhaps you forgot to load
"Mail::SpamAssassin::PerMsgStatus"?) at
/usr/local/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin/PerMsgStatus.pm line
2296.
)
lint: 2 issues detected.  please rerun with debug enabled for more
information.


local.cf:


urirhssub URIBL_JP_SURBL  multi.surbl.org.A   64
body  URIBL_JP_SURBL  eval:check_uridnsbl('URIBL_JP_SURBL')
describe  URIBL_JP_SURBL  Has URI in JP at http://www.surbl.org/lists.html
tflagsURIBL_JP_SURBL  net

score URIBL_JP_SURBL4.0

Re: whitelist_from override all the spam check?

[Andrew Xiang]

guess that should be good enough. -100.



- Original Message - 
From: "Marco van den Bovenkamp" <[EMAIL PROTECTED]>
To: 
Sent: Thursday, December 02, 2004 5:11 PM
Subject: Re: whitelist_from override all the spam check?


> Andrew Xiang wrote:
>
> > If I use whitelist_from [EMAIL PROTECTED] , it should not classify the 
> > email as
> > spam no matter what the score is, right?
>
> No, 'whitelist_from' is a -100 score.
>
> -- 
>
> Regards,
>
> Marco.
>

whitelist_from override all the spam check?

[Andrew Xiang]

If I use whitelist_from [EMAIL PROTECTED] , it should not classify the email as
spam no matter what the score is, right?

-Andrew