Cronjob with sa-learn

2006-11-29 Thread Markus Braun 

Hello,

i tried to create a cron job to add spam messages as spamemails.

The following command :

0 1 * * *  vmail sa-learn  --spam 
/var/opt/vmail/.info/oliver/Maildir/.spam/cur *.*


But i get this retourn:

archive-iterator: readdir found no mail in 'domain1.de' directory
archive-iterator: readdir found no mail in 'domain2.de' directory
Learned tokens from 7 message(s) (460 message(s) examined)

I think the last message is ok. But what about the first and second one? The 
command is correct?


Thanks for help

marcus

_
Die neue MSN Suche Toolbar mit Windows-Desktopsuche. Suchen Sie gleichzeitig 
im Web, Ihren E-Mails und auf Ihrem PC! Jetzt neu! http://desktop.msn.de/ 
Jetzt gratis downloaden!

Ham Learning

2006-11-03 Thread Markus Braun 

Hello,

when i learn with sa-learn some emails as ham i get this error message:

Parsing of undecoded UTF-8 will give garbage when decoding entities at 
/usr/share/perl5/Mail/SpamAssassin/HTML.pm line 182.



Can somebody explain me what this mean?

bye marcus

_
Die neue MSN Suche Toolbar mit Windows-Desktopsuche. Suchen Sie gleichzeitig 
im Web, Ihren E-Mails und auf Ihrem PC! Jetzt neu! http://desktop.msn.de/ 
Jetzt gratis downloaden!

Re: Spam

2006-11-03 Thread Markus Braun 



>>you will get a format that's more suitable to put in the headers.
>What do you mean, whaat this two options do, i found nothing on the
>spamassassin site.


At the moment i use bayes and the emails are marked like this in the header:

But some emails come through the spamassasin filter like this from the 
header:


Return-path: <[EMAIL PROTECTED]>
Envelope-to: [EMAIL PROTECTED]
Received: from xdsl-10369.wroclaw.dialog.net.pl ([84.40.242.129])
by 89-149-XXX-125.internetserviceteam.com with esmtp (Exim 4.50)
id 1GfnGR-0002Fg-Nw
for [EMAIL PROTECTED]; Fri, 03 Nov 2006 01:50:36 +0100
Message-ID: <[EMAIL PROTECTED]>
From:   "cases" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: me configure instead editing
Date:   Fri, 3 Nov 2006 01:51:19 +0100
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="=_NextPart_000_0006_01C6FEEA.8EE1C180"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

It contains a picture in the body email and this text:



Function active am way! Destroy is without am closing in underlying handles 
odd even? Mutual exclusion see it exec?

Its is Looking am direction? It exec why of earth a we say ill.
Hash sha Melissa Schrumpf gtgtgti in gtgtgtthe. Without closing underlying 
handles odd even in actively redirected anyways.

Active way Sciences Division in Technology. Output actually appears in.
Gtgt yes similar issue program somehow or got confused a state. Gravereaux 
may tue is Tues Begin pgp Signed Hash sha.
Appear am first remove. Way Sciences Division! More Wish console or 
unresponse when script of started from.

Posted in will email visible? Parents a call them freaky true Thats.

So what can i do here?

thx
marcus

_
Sie suchen E-Mails, Dokumente oder Fotos? Die neue MSN Suche Toolbar mit 
Windows-Desktopsuche liefert in sekundenschnelle Ergebnisse. Jetzt neu! 
http://desktop.msn.de/ Jetzt gratis downloaden!

Re: Spam

2006-11-03 Thread Markus Braun 



http://spamassassin.apache.org/full/3.1.x/doc/Mail_SpamAssassin_Conf.html#item_clear_report_template


Thanks about the link.

i will take a look at this the next days.

But can i something more do, agains the spam problem?

Marcus

_
Sie suchen E-Mails, Dokumente oder Fotos? Die neue MSN Suche Toolbar mit 
Windows-Desktopsuche liefert in sekundenschnelle Ergebnisse. Jetzt neu! 
http://desktop.msn.de/ Jetzt gratis downloaden!

Re: Spam

2006-11-02 Thread Markus Braun 
I would like also to report the spams, but i dont wont get so much spams as 
i can see there.




This is probably because you have an unconditional

 warn message = X-Spam-Report: $spam_report

in your Exim configuration - check your ACL.
I dont know what you exactly meen, what wrong is? But i will go on the exim4 
lists.




If you also add this
to /etc/spamassassin/local.cf:

clear_report_template
report _REPORT_

you will get a format that's more suitable to put in the headers.
What do you mean, whaat this two options do, i found nothing on the 
spamassassin site.


thanks
marcus

_
Sie suchen E-Mails, Dokumente oder Fotos? Die neue MSN Suche Toolbar mit 
Windows-Desktopsuche liefert in sekundenschnelle Ergebnisse. Jetzt neu! 
http://desktop.msn.de/ Jetzt gratis downloaden!

Spam

2006-11-02 Thread Markus Braun 

Hello,

i have at the moment spamassassin with exim4 running.

But in my logfiles I have so many spam information like this:

2006-11-01 03:55:27 H=adsl-152-80-187.asm.bellsouth.net (COMPUTER) 
[72.152.80.187] F=<[EMAIL PROTECTED]> rejected RCPT <[EMAIL PROTECTED]>: 
DNSBL listed at sbl-xbl.spamhaus.org
2006-11-01 03:55:31 H=adsl-152-80-187.asm.bellsouth.net 
(08iriua7.eakio21e.optonline.net) [72.152.80.187] 
F=<[EMAIL PROTECTED]> rejected RCPT <[EMAIL PROTECTED]>: DNSBL listed 
at sbl-xbl.spamhaus.org
2006-11-01 03:55:33 H=adsl-152-80-187.asm.bellsouth.net (COMPUTER) 
[72.152.80.187] F=<[EMAIL PROTECTED]> rejected RCPT 
<[EMAIL PROTECTED]>: DNSBL listed at sbl-xbl.spamhaus.org
2006-11-01 03:55:36 H=pool-71-127-50-181.washdc.east.verizon.net 
(RAY-AAGIJEFDZ5A) [71.127.50.181] F=<[EMAIL PROTECTED]> rejected RCPT 
<[EMAIL PROTECTED]>: DNSBL listed at sbl-xbl.spamhaus.org
2006-11-01 03:55:37 H=pool-71-127-50-181.washdc.east.verizon.net 
(RAY-AAGIJEFDZ5A.ue9rjf.org) [71.127.50.181] F=<[EMAIL PROTECTED]> 
rejected RCPT <[EMAIL PROTECTED]>: DNSBL listed at sbl-xbl.spamhaus.org
2006-11-01 03:55:38 H=pool-71-127-50-181.washdc.east.verizon.net 
(RAY-AAGIJEFDZ5A.brz0.com) [71.127.50.181] F=<[EMAIL PROTECTED]> rejected 
RCPT <[EMAIL PROTECTED]>: DNSBL listed at sbl-xbl.spamhaus.org
2006-11-01 03:55:42 H=static-72-67-209-4.lsanca.dsl-w.verizon.net (SOPRA3) 
[72.67.209.4] F=<[EMAIL PROTECTED]> rejected RCPT <[EMAIL PROTECTED]>: 
DNSBL listed at sbl-xbl.spamhaus.org
2006-11-01 03:55:43 H=static-72-67-209-4.lsanca.dsl-w.verizon.net (SOPRA3) 
[72.67.209.4] F=<[EMAIL PROTECTED]> rejected RCPT <[EMAIL PROTECTED]>: 
DNSBL listed at sbl-xbl.spamhaus.org


Can i something else to do here? or must i accept this?

The second Problem is that some emails are going throug the spam score, 
because it is by 5.0. So when i get such emails with the header:


MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="=_NextPart_000_000A_01C6FE62.A22A9E70"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962
X-Spam-Score: 4.2 ()
X-Spam-Report: Software zur Erkennung von "Spam" auf dem Rechner
89-149-194-125.internetserviceteam.com
hat die eingegangene E-mail als mögliche "Spam"-Nachricht identifiziert.
Die ursprüngliche Nachricht wurde an diesen Bericht angehängt, so dass
Sie sie anschauen können (falls es doch eine legitime E-Mail ist) oder
ähnliche unerwünschte Nachrichten in Zukunft markieren können.
Bei Fragen zu diesem Vorgang wenden Sie sich bitte an
the administrator of that system
Vorschau: End in Poem be Summary is Statistics for Poem Song or.
Demo Spidering formp eco Linuxbox. Be in Summary Statistics for Poem
Song if like it. Linuxbox apps system finder performs. City Titles
divx. Linuxbox apps system finder performs. Codes linkfiles database
hpv am texts is Gameguru favourite preview. Performs is Software map
one. Acdsee is powerdvd poweriso. Database hpv texts Gameguru in
favourite preview. Can in get of help large is download source fonts
links. The Serving since buttons by Alfaart. Help large download source
fonts links cellular of! The Serving since buttons. Site warning only
will banneradd a pageterms of useprivacy. Gamereview previews demo
Spidering formp eco Linuxbox am apps am system. Power dvd in alcohol
tomtom norton quicktime clone. It or Hong Kong. Clonedvd powerdvd
babylon. End in Poem be Summary is Statistics for Poem Song or.
Dvdstreams mp music gg in mania computer am eye. Photoshop cs babylon?
Diner dash crack or avg. Big gaming in gamereview previews am. Spyware
doctor nero kaspersky anydvd winrar in xp! Most Random Short Stories
Drop am juice. Order related games Coding engine! Income Discount in
enter one or words in use space. Words use space separator Example
windows or iis. Vtravel Ivtravel in Iiistory vyn Myastory sea Rozmaring
or Folklore. Demo Spidering formp eco Linuxbox. [...]
Inhaltsanalyse im Detail:   (4.2 Punkte, 5.0 benötigt)
Pkte Regelname  Beschreibung
	 -- 
--

0.4 HTML_IMAGE_ONLY_20 BODY: Außer Bildern nur 1600-2000 Zeichen 
Text
0.0 HTML_MESSAGE   BODY: Nachricht enthält HTML
0.2 HTML_20_30 BODY: Nachricht besteht zu 20-30% aus HTML
	3.5 BAYES_99   BODY: Spamwahrscheinlichkeit nach Bayes-Test: 
99-100%

[score: 0.9906]
X-Spam-Flag: YES

Should i reduce my spam score or what something else can i do here?

Thanks
marcus

_
Sie suchen E-Mails, Dokumente oder Fotos? Die neue MSN Suche Toolbar mit 
Window

Re: Spamassassin Spam Header

2006-03-02 Thread Markus Braun 

Sounds like you didn't kill spamd first.


this is my top:
7091 root   9   0 20092 1096 1096 S  0.0  0.1   0:01.17 spamd
7303 backuppc   8   0  5468 3364 1124 S  0.0  0.3   1:02.43 BackupPC
7315 backuppc   9   0  3032 1536 1100 S  0.0  0.1   0:07.87 BackupPC_trashC
7428 root   9   0 38596  23m  23m S  0.0  2.3   0:27.23 spamd
7429 root   9   0 47164  27m  27m S  0.0  2.7   0:19.87 spamd
7430 root   9   0 34328 4948 4948 S  0.0  0.5   0:22.41 spamd
7431 root   9   0  118m  29m  29m S  0.0  3.0   0:33.93 spamd
7432 root   9   0 40520  23m  23m S  0.0  2.3   0:24.63 spamd


Sounds like your installation is severely hosed. How did you install SA?


i installed it over

apt-get install spamassassin

i have a debian sarge system...

_
Haben Spinnen Ohren? Finden Sie es heraus – mit dem MSN Suche Superquiz via  
http://www.msn-superquiz.de  Jetzt mitmachen und gewinnen!

Re: Spamassassin Spam Header

2006-02-15 Thread Markus Braun 



Also be careful with bayes_file_mode.. you want 7's here not 6's like
you might think. This is really not a mode, but a mask, and it is
sometimes used in directory creation.
bayes_file_mode 0777


hello again,

so i make a cronjob the spamassassin is learning the spams from the spam 
folder with the user vmail.


Is this rule now correct:
header L_S_ULT_PHARMSubject =The Ultimate Online Pharmaceutical
score L_S_ULT_PHARM 3.0
describe L_S_ULT_PHARM  spam from the ultimate online pharmacy

And how can i reload the spamd?

I try it with spamd reload then this comes up:
Could not create INET socket on 127.0.0.1:783: Die Adresse wird bereits 
verwendet (IO::Socket::INET: Die Adresse wird bereits verwendet)



or:

:/etc/spamassassin# spamassassin reload

Unable to open reload: Datei oder Verzeichnis nicht gefunden


Did i something wrong?

_
Die neue MSN Suche Toolbar mit Windows-Desktopsuche. Suchen Sie gleichzeitig 
im Web, Ihren E-Mails und auf Ihrem PC! Jetzt neu! http://desktop.msn.de/ 
Jetzt gratis downloaden!

Re: Spamassassin Spam Header

2006-02-06 Thread Markus Braun 




header L_S_SW_LOWPRSubject =~/\bS[o0]ftw[a4]r[e3] At L[o0]w 
Pr[i1]c[e3]s?\b/i

You have a spurious line wrap above. Join it to the end of the line
above so that it will have the "w" followed by the "Pr[". That will
help. ALWAYS run "SpamAssassin --lint" when you make a change like that
and before you tell spamd to reaload.


score L_S_SW_LOWPR 3.0
describe L_S_SW_LOWPR  offers software at low price



{^_^}



I think i have a good idea. Each Day i move t he spam files into the folder 
.spam. In the night i make a cronjob called this:



0 1 * * *  vmail sa-learn  --spam /var/opt/vmail/marcus/Maildir/.spam/cur 
*.*


But i don know that the command is correct.

But he execute it as vmail user and not root. or?

marcus

_
Sie suchen E-Mails, Dokumente oder Fotos? Die neue MSN Suche Toolbar mit 
Windows-Desktopsuche liefert in sekundenschnelle Ergebnisse. Jetzt neu! 
http://desktop.msn.de/ Jetzt gratis downloaden!

Re: Spamassassin Spam Header

2006-02-01 Thread Markus Braun 

It looks OK, except the file for some reason has HTML tags in it.. The
real file must not have HTML in it.

Which HTML Tags do you mean in the rule.cf?

header L_S_ULT_PHARMSubject =~/\bThe Ultimate Online Pharmaceutical\b/i
score L_S_ULT_PHARM 3.0
describe L_S_ULT_PHARM  spam from the ultimate online pharmacy

header L_S_SW_LOWPRSubject =~/\bS[o0]ftw[a4]r[e3] At 
L[o0]wPr[i1]c[e3]s?\b/i

score L_S_SW_LOWPR 3.0
describe L_S_SW_LOWPR  offers software at low price



> Is it a problem when i make the sa-learn with the user root?
If you  use spamd and don't have a bayes_path and bayes_file_mode
statement in your config files, yes.

Spamd never scans mail as the root user. If you try to make it, it will
setuid itself to the nobody user.

This is my local.cf:

#
rewrite_header Subject *SPAM*
# report_safe 1
# trusted_networks 212.17.35.
# lock_method flock

required_score 5.0
use_bayes 1
bayes_auto_learn 1


I Think spamd is running as vmail.

so must i login over ssh with vmail and learn the messages?

_
Sie suchen E-Mails, Dokumente oder Fotos? Die neue MSN Suche Toolbar mit 
Windows-Desktopsuche liefert in sekundenschnelle Ergebnisse. Jetzt neu! 
http://desktop.msn.de/ Jetzt gratis downloaden!

Re: Spamassassin Spam Header

2006-02-01 Thread Markus Braun 

You can drop these into a .cf file in your site-config directory
(/etc/mail/spamassassin/ for most people):

header L_S_ULT_PHARMSubject =~/\bThe Ultimate Online Pharmaceutical\b/i
score L_S_ULT_PHARM 3.0
describe L_S_ULT_PHARM  spam from the ultimate online pharmacy

header L_S_SW_LOWPRSubject =~/\bS[o0]ftw[a4]r[e3] At L[o0]w 
Pr[i1]c[e3]s?\b/i

score L_S_SW_LOWPR 3.0
describe L_S_SW_LOWPR  offers software at low price



Note: careful of the word-wrapping, each of those rules is 3 lines long, 
for a

total of 6 lines.


I put one *.cf files into the /etc/spamassasin/ Directory.

See also attached.

Can you take a short look?

Also i restarted spamassassin.

Is it a problem when i make the sa-learn with the user root?

Thank you very much
marcus

_
Sie suchen E-Mails, Dokumente oder Fotos? Die neue MSN Suche Toolbar mit 
Windows-Desktopsuche liefert in sekundenschnelle Ergebnisse. Jetzt neu! 
http://desktop.msn.de/ Jetzt gratis downloaden!

header L_S_ULT_PHARMSubject =~/\bThe Ultimate Online Pharmaceutical\b/i
score L_S_ULT_PHARM 3.0
describe L_S_ULT_PHARM  spam from the ultimate online pharmacy

header L_S_SW_LOWPRSubject =~/\bS[o0]ftw[a4]r[e3] At 
L[o0]wPr[i1]c[e3]s?\b/i

score L_S_SW_LOWPR 3.0
describe L_S_SW_LOWPR  offers software at low price

Re: Spamassassin Spam Header

2006-01-29 Thread Markus Braun 

Are you sure your sa-learning was done as the correct user?
What user did you use? (root? nobody? The message recipient?)

I logged in as root.
I type sa-learn -spam and then the name of the email file.


Do you use spamd?

yes spamd is loaded.


Do you normally pass a -u parameter to either spamd or spamc?

I dont know  :-(, i installed it from apt-get install spamassassin

What BAYES rules do the messages hit when they are scanned at delivery 
time?

Where can i look ?



You can drop these into a .cf file in your site-config directory
(/etc/mail/spamassassin/ for most people):


Yes i made a file called rule.cf in this directory.

I think i must restart the daemon?

bye
marcus

_
Die neue MSN Suche Toolbar mit Windows-Desktopsuche. Suchen Sie gleichzeitig 
im Web, Ihren E-Mails und auf Ihrem PC! Jetzt neu! http://desktop.msn.de/ 
Jetzt gratis downloaden!

Spamassassin Spam Header

2006-01-28 Thread Markus Braun 

Hello again,

sorry but iI have still the problem , that i dont understand the spam bayes 
function.
I have SA-learn about 50 emails they are spam. But always the same header as 
spam comes as ham into my mailbox.


e.g.:

The Ultimate Online Pharmaceutical
Software
Software At Low Pr1ce

How can i make that such emails with these headers are marked as spam?

Thanks
marcus

_
Sie suchen E-Mails, Dokumente oder Fotos? Die neue MSN Suche Toolbar mit 
Windows-Desktopsuche liefert in sekundenschnelle Ergebnisse. Jetzt neu! 
http://desktop.msn.de/ Jetzt gratis downloaden!

Re: Spamassassin & Bayes

2006-01-23 Thread Markus Braun 

Suppose you address it as "foo.bar.baz". Then you can simply do a
"host foo.bar.baz" and get the address for that machine. That
becomes the only entry to "trusted_networks". Your "internal_network"
is a different proposition. In your case I might set it to 127.0.0.1
if you have exactly one machine of your own and it talks exclusively
to the outside world, including the email server, with no other
machines on an internal network at your location.


okay i will try it.

But i dont understand why i get always this email with the same header:

Doctor  The Ultimate Online Pharmaceutical

I made sa-learn to spam this email.

also i gave him a lots of emails to learn it.

How can i make it that i dont receive this email?

Thanks
marcus

_
Sie suchen E-Mails, Dokumente oder Fotos? Die neue MSN Suche Toolbar mit 
Windows-Desktopsuche liefert in sekundenschnelle Ergebnisse. Jetzt neu! 
http://desktop.msn.de/ Jetzt gratis downloaden!

RE: Spamassassin & Bayes

2006-01-17 Thread Markus Braun 

For an example setup:

If my network is 192.168.1.0/24 and I have two mailservers at
192.168.1.2 and 192.168.1.3, I could set it up two different ways.

Individually:
trusted_networks 192.168.1.2
trusted_networks 192.168.1.3

Or the entire network:
trusted_networks 192.168.1.

My ISP may be trustworthy, but since I don't control their servers, I'm
not going to list them.



I have an ISP provider where my server is located with an own ip.
so i must found out the internal network.

I get the suggest for Ping?
but i dont understand it really.

I must login to my server over ssh and then?

marcus

_
Sie suchen E-Mails, Dokumente oder Fotos? Die neue MSN Suche Toolbar mit 
Windows-Desktopsuche liefert in sekundenschnelle Ergebnisse. Jetzt neu! 
http://desktop.msn.de/ Jetzt gratis downloaden!

Re: Spamassassin & Bayes

2006-01-16 Thread Markus Braun 


It's more like "I know all machines in 10.2.3.xxx belong to my network 
which is safe and which I trust, so I'll add 10.2.3.xxx/24 to 
trusted_networks"


I don't think it's safe to add a external network like gmx to your 
trusted_networks list.



But what is my internal network. I have one server in cologne.

_
Sie suchen E-Mails, Dokumente oder Fotos? Die neue MSN Suche Toolbar mit 
Windows-Desktopsuche liefert in sekundenschnelle Ergebnisse. Jetzt neu! 
http://desktop.msn.de/ Jetzt gratis downloaden!

RE: Spamassassin & Bayes

2006-01-16 Thread Markus Braun 



The trusted_networks setting specifies which mail servers you trust not
to forge header information.  Normally, this will just be the servers
that you directly control.  You can either list your mailservers
individually, or you can list your entire network so that you
automatically trust any mailserver in your network.


Can you give me an example..?

When i trust gmx, the i must enter the IP of GMX and so on for every each 
server?


_
Sie suchen E-Mails, Dokumente oder Fotos? Die neue MSN Suche Toolbar mit 
Windows-Desktopsuche liefert in sekundenschnelle Ergebnisse. Jetzt neu! 
http://desktop.msn.de/ Jetzt gratis downloaden!

Re: Spamassassin & Bayes

2006-01-16 Thread Markus Braun 

Are you running German-language rules on 3.0.x?  If so this is
(unfortunately) expected.



If you are only running English-language rules files, then this would
probably indicate that you had rules from 2.6x on a 3.x SA install.


I have spamassassin installed on a debian sarge version with
apt-get install spamassassin.

I think this would be the german version. How can i found this out?



> About the rulesets in rulesemporium.com what can you suggest for me?

I would suggest at least the "0" files for you, and probably the "1" files.
I suspect you get German-language email, and the SARE rules are really only
checked thoroughly aginst English.  So there is a possibility that you 
might

get some FPs in other languages.  You should watch your mail and see if you
are getting FPs, and if necessary remove an optional ruleset or rescore 
some

of the rules.

I write german emails but i get english spam emails.
also i was on this site, but i found nothing about 0 files. I see SARE 
Rules, Incomplete Rules and so on.

But SARE Rules list is very  long.



debug: is Net::DNS::Resolver available? no
debug: is DNS available? 0

You are not running network tests.  If at all feasible you should enable
these tests, they will catch a ton of your spam.

How can i make it on?


debug: bayes: Not available for scanning, only 1 spam(s) in Bayes DB < 200



You have Bayes enabled, but you have not yet fed it at least 200 each hams
and spams, so it is not operating yet.  When you feed Bayes what it needs 
it

will start helping too.
so i must wait until i have 100 spam and hams, and then i make autolearn? is 
that correct?




debug: tests=ALL_TRUSTED,MISSING_DATE,MISSING_SUBJECT,NO_REAL_NAME

Here is a BIG problem!  You got an ALL_TRUSTED on this spam.  Assuming you
fed in a spam that came from outside and the headers are still there 
showing

that, it shoudl NEVER get an ALL_TRUSTED indication.  This results in a
negative score, being added to the total, and in this case is probably
responsible for the major problems here.  You MUST set trusted_networks
correctly.

How can i found out to configure it correctly?

marcus

_
Sie suchen E-Mails, Dokumente oder Fotos? Die neue MSN Suche Toolbar mit 
Windows-Desktopsuche liefert in sekundenschnelle Ergebnisse. Jetzt neu! 
http://desktop.msn.de/ Jetzt gratis downloaden!

Re: Spamassassin & Bayes

2006-01-15 Thread Markus Braun 

debug: tests=ALL_TRUSTED,MISSING_DATE,MISSING_SUBJECT,NO_REAL_NAME



Here is a BIG problem!  You got an ALL_TRUSTED on this spam.  Assuming you
fed in a spam that came from outside and the headers are still there 
showing

that, it shoudl NEVER get an ALL_TRUSTED indication.  This results in a
negative score, being added to the total, and in this case is probably
responsible for the major problems here.  You MUST set trusted_networks
correctly.



so i have read something about spamassassin and the configuration of trusted 
networks.


I found an example:

trusted_networks 123.12.34.56 123.12.35/24
That line will specify that the host at 123.12.34.56, and all hosts in the 
123.12.35.0 - 123.12.35.255 address range, are to be trusted.


But i dont understand it really. I have a webserver with an Ip Adress. How 
must i configure it?


Thank you very much for your help
marcus

_
Haben Spinnen Ohren? Finden Sie es heraus – mit dem MSN Suche Superquiz via  
http://www.msn-superquiz.de  Jetzt mitmachen und gewinnen!

Re: Spamassassin & Bayes

2006-01-13 Thread Markus Braun 
sa-learn will help here. Another way to help is by grabbing some of the 
rulesets off of rulesemporium.com that cover the spam which is giving you 
the most trouble.




I have made

spamassassin -D --lint

but i got the warnings in the attached file.

i have debian and installed it with:

apt-get install spamassassin.

About the rulesets in rulesemporium.com what can you suggest for me?

I get a email with the sendername: Doctor and the header The ultimate Online 
Pharmaceutical.


The Email content this:

Vluagra - $3.3
Lejvitra - $3.3
Ciralis - $3.7
Imivtrex - $16.4
Floymax - $2.2
Ulteram - $0.78
Viaoxx - $4.75
Amlbien - $2.2
Valihum - $0.97
Xaxnax - $1.09
Somza - $3
Merfidia - $2.2

But this is the same in the last email, which i have made with sa--learn to 
spam.


So can you give me here an exactly help?

Thank you very much.
marcus

_
Sie suchen E-Mails, Dokumente oder Fotos? Die neue MSN Suche Toolbar mit 
Windows-Desktopsuche liefert in sekundenschnelle Ergebnisse. Jetzt neu! 
http://desktop.msn.de/ Jetzt gratis downloaden!

warning: description for EXCUSE_6 is over 50 chars
warning: description for X_ORIG_IP_NOT_IPV4 is over 50 chars
warning: description for DRUGS_SLEEP_EREC is over 50 chars
warning: description for FORGED_JUNO_RCVD is over 50 chars
warning: description for PRIORITY_NO_NAME is over 50 chars
warning: description for FROM_HAS_MIXED_NUMS3 is over 50 chars
warning: description for MSGID_SPAM_LETTERS is over 50 chars
warning: description for RCVD_FAKE_HELO_DOTCOM is over 50 chars
warning: description for RCVD_AM_PM is over 50 chars
warning: description for TO_NO_USER is over 50 chars
warning: description for FAKE_OUTBLAZE_RCVD is over 50 chars
warning: description for T_DNS_FROM_SECURITYSAGE is over 50 chars
warning: description exists for non-existent rule T_DNS_FROM_SECURITYSAGE
warning: description for RCVD_IN_NJABL_MULTI is over 50 chars
warning: description for EXCUSE_19 is over 50 chars
warning: description for __RCVD_IN_SBL_XBL is over 50 chars
warning: description for DNS_FROM_RFC_POST is over 50 chars
warning: description for RCVD_IN_SORBS_ZOMBIE is over 50 chars
warning: description for FROM_NUM_AT_WEBMAIL is over 50 chars
warning: description for WEIRD_QUOTING is over 50 chars
warning: description for HTML_NONELEMENT_20_30 is over 50 chars
warning: description for X_AUTH_WARN_FAKED is over 50 chars
warning: description for FORGED_HOTMAIL_RCVD is over 50 chars
warning: description for MPART_ALT_DIFF is over 50 chars
warning: description for MISSING_MIMEOLE is over 50 chars
warning: description for HTML_NONELEMENT_60_70 is over 50 chars
warning: description for TRACKER_ID is over 50 chars
warning: description for DATE_IN_PAST_24_48 is over 50 chars
warning: description for CHARSET_FARAWAY_HEADER is over 50 chars
warning: description for EXCUSE_REMOVE is over 50 chars
warning: description for HTML_NONELEMENT_00_10 is over 50 chars
warning: description for RCVD_IN_DSBL is over 50 chars
warning: description for RATWARE_HASH_2 is over 50 chars
warning: description for RCVD_IN_BSP_TRUSTED is over 50 chars
warning: description for ADDR_NUMS_AT_BIGSITE is over 50 chars
warning: description for MSGID_SPAM_CAPS is over 50 chars
warning: description for FORGED_AOL_TAGS is over 50 chars
warning: description for RATWARE_MOZ_MALFORMED is over 50 chars
warning: description for RATWARE_STORM_URI is over 50 chars
warning: description for FORGED_TELESP_RCVD is over 50 chars
warning: description for SENT_IN_COMPLIANCE is over 50 chars
warning: description for NUMERIC_HTTP_ADDR is over 50 chars
warning: description for PORN_URL_SEX is over 50 chars
warning: description for HTML_MIME_NO_HTML_TAG is over 50 chars
warning: description for SPF_SOFTFAIL is over 50 chars
warning: description for NO_DNS_FOR_FROM is over 50 chars
warning: description for MIME_BOUND_DD_DIGITS is over 50 chars
warning: description for HELO_DYNAMIC_HEXIP is over 50 chars
warning: description for HTML_NONELEMENT_50_60 is over 50 chars
warning: description for DATE_IN_PAST_03_06 is over 50 chars
warning: description for HTML_NONELEMENT_10_20 is over 50 chars
warning: description for RCVD_IN_SORBS_WEB is over 50 chars
warning: description for FORGED_AOL_RCVD is over 50 chars
warning: description for FORGED_HOTMAIL_RCVD2 is over 50 chars
warning: description for USERPASS is over 50 chars
warning: description for TO_ADDRESS_EQ_REAL is over 50 chars
warning: description for MIME_BOUND_NEXTPART is over 50 chars
warning: description for SPF_FAIL is over 50 chars
warning: description for DRUGS_ANXIETY_EREC is over 50 chars
warning: description for RCVD_DOUBLE_IP_SPAM is over 50 chars
warning: description for HTML_FONT_FACE_CAPS is over 50 chars
warning: description for FROM_HAS_ULINE_NUMS is over 50 chars
warning: description for WE_HONOR_ALL is over 50 chars
warning: description for DATE_IN_PAST_48_96 is over 50 chars
warning: description for HTML_MISSING_CTYPE is ov

Spamassassin & Bayes

2006-01-13 Thread Markus Braun 

Hello together,

At the moment i use spamassassin for spam protection.
Also Autobayes is activated.

I know when autobayes make some mistakes with ham or spam, that i can 
correct it manually.


e.g.
sa -- learn (the file)

But what does sa--learn keep in mind?

On the next day, a spam emails als come from another email adress. But the 
adressname and the header information are the same.


So my question is, how can i make it that these emails are also marked als 
spam.


When somebody needs more details, i can give it.

Thank you very much
marcus

_
Haben Spinnen Ohren? Finden Sie es heraus – mit dem MSN Suche Superquiz via  
http://www.msn-superquiz.de  Jetzt mitmachen und gewinnen!

SpamScore Email

2005-11-25 Thread Markus Braun 

Hello,

i am new on this list.
I have a problem. I installed exim4, courier and spamassassin.

But every email i sent it out, is marked bei spam. e.g. Spam Score 1.6

Can i turn it of or is some configuration error?

Thanks a lot

marcus

_
Sie suchen E-Mails, Dokumente oder Fotos? Die neue MSN Suche Toolbar mit 
Windows-Desktopsuche liefert in sekundenschnelle Ergebnisse. Jetzt neu! 
http://desktop.msn.de/ Jetzt gratis downloaden!