sa-update directory

[Shelley Waltz]

I am running spamassassin with amavisd on RHEL5.  I have the perl script
sa-update run daily.  There are updates .cf files written into
/var/lib/spamassassin/3.002004/updates_spamassassin_org/

and there is a
/var/lib/spamassassin/3.002004/updates_spamassassin_org.cf

I have spamassassin-3.2.4-1.el5 installed.  Does spamassassin know to use
these updates .cf files in the /var/lib/spamassassin directory, or do I
need to do something for the updated .cf files to be used?

S.Waltz

Transition to new server - internal_networks?

[Shelley Waltz]

I am moving from old smtp(MX)/amavisd/spamassassin server to a
 new smtp(MX)/amavisd/spamassassin server

I will be forwarding particular users email from the old server to the
new server as they are moved by using an alias in /etc/postfix/aliases.
I wish the new server to receive the forwarded mail from the old server
and treat it as though it was external, ie., filter it and deliver to
mailbox on new server.  It was suggested by the postfix users to use the
internal_networks configuration to accomplish this.

So, ... is this configuration correct? ...

I have old server which is a trusted host(relays spam, but does not
originate spam) which has IP aaa.bbb.ccc.11.  This host is also a MX for
my domain.

I have a new server which is a trusted host and a MX for my domain which
has IP aaa.bbb.ccc.12.

so, in the /etc/mail/spamassassin/local.cf on new server I would put

trusted_networks 127.0.0.1
trusted_networks aaa.bbb.ccc.0/24  !my class C

internal_networks 127.0.0.1
internal_networks aaa.bbb.ccc.11! old server/MX

Swaltz

Convert 2.63 DB to MySql

[Shelley Waltz]

I am migrating my Spamassassin 2.63 DB database to Spamassassin 3.1.9.
I wish to convert the Bayes Berkley DB to Mysql database.  My sa-learn
does not have the --backup option to dump to text file.  What is the
proper way to do this?

thanks
S.Waltz

LOCAL_RCVD

[Shelley Waltz]

Spamassassin 2.63-1/amavisd-new-20030616-p8

I am trying to configure spamassassin such that any email originating
from my domain is not spam tagged.  I have tried in local.cf

both these syntaxes.

header LOCAL_RCVD Received =~ /.*\(\S+\.myhost\.mydom\.edu\s+\[.*\]\)/
header LOCAL_RCVD Received =~ /\S+\.myhost\.mydom\.edu\s+\(.*\[.*\]\)/


In each case only one rule will work for one particular received from
header.  I have these two styles(one from mozilla, and one from webmail)

Received: from [192.168.1.10] (myhost.mydom.edu [192.168.1.10])

Received: from webmail.mydom.edu (localhost.localdomain [127.0.0.1])

Is there a rule which will work for both, or is there a simpler way to
achieve this result, ie, to not filter locallly originating mail?




Shelley Waltz

Spamassassin 2.63/dcc-1.3.15 issue

[Shelley Waltz]

I have installed dcc-1.3.15 and added public servers to the map, opened
the firewall udp port and tested dccproc and it works fine,
reporting back the server id, and body amd fuz scores.

I added the following to /etc/mail/spamassassin/local.cf

add_header all DCC _DCCB_: _DCCR_
use_dcc 1
dcc_add_header 1
dcc_timeout 20
dcc_home /var/dcc
dcc_path /usr/local/bin/dccproc

I have tested using
spamassassin -D  /tmp/spam/spam_message
but spamassassin does not call or have any references to DCC anything
in the output.
debug: Final PATH set to:
/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin:/root/bin
debug: using /usr/share/spamassassin for default rules dir
debug: using /etc/mail/spamassassin for site rules dir
debug: using /root/.spamassassin for user state dir
debug: using /root/.spamassassin/user_prefs for user prefs file

dccproc is in /usr/local/bin



Did I miss something?  How can I test or debug the use of DCC with
spamassassin?

{ Shelley Waltz;
  Center for Advanced Biotechnology and Medicine;
  Rutgers University/UMDNJ;
  679 Hoes Lane;
  Piscataway, NJ 08854;
  732 235 3346 }

70_sc_top200.cf not updated

[Shelley Waltz]

The 70_sc_top200.cf on rulesemporium has not been updated
since May 27.  This is supposed to be automatically generated.
I could not find a contact on the rulesemporium page - anyone
know why this rule is no longer updated?

{ Shelley Waltz;
  Center for Advanced Biotechnology and Medicine;
  Rutgers University/UMDNJ;
  679 Hoes Lane;
  Piscataway, NJ 08854;
  732 235 3346 }

Re: How to block this email??

[Shelley Waltz]

I had good luck eliminating this by using sa-learn.  It took about 15
messages
before the score went high enough to register as spam.

Shelley Waltz

Bryan Haase said:
 Does anyone have a rule that will score foreign characters or characters
 with the dashes on top?
 Below is example email that is not scoring at all for me.

 Thanks
 Bryan


 berton laurence [EMAIL PROTECTED] 6/18/2005 7:52 PM 
ТРÐ?Ð?СБЛОК XXI


 Ð?аша компаниÑ? 
 оказывает 
 юридичеÑ?кие
 уÑ?луги в облаÑ?ти 
 налогооблажениÑ?:

 - Возмещение Ð?ДС

 поÑ?ле проведениÑ? 
 правовой Ñ?кÑ?пертизы
 финанÑ?ово-хозÑ?йÑ?твенной
  деÑ?тельноÑ?ти
 Вашей компании мы 
 обеÑ?печиваем
 поÑ?тупление денег на 
 ваш раÑ?четный
 Ñ?чет.

 - ПредÑ?тавительÑ?тво и 
 защита интереÑ?ов
 вашей компании в 
 арбитражных Ñ?удах и
 Ñ?удах общей 
 юриÑ?дикции, во вÑ?ех
 гоÑ?ударÑ?твенных 
 органах, включаÑ?
 налоговые и 
 таможенные органы.

 -РегиÑ?трациÑ? 
 предприÑ?тий 
 различных форм
 Ñ?обÑ?твенноÑ?ти.

 Телефон: 8(926)530-13-94


 -

 This email transmission and any documents, files or previous

 email messages attached to it may contain information that is

 confidential or legally privileged. If you are not the intended

 recipient, you are hereby notified that any disclosure, copying,

 printing, distributing or use of this transmission is strictly

 prohibited. If you have received this transmission in error,

 please immediately notify the sender by telephone or return

 email and delete the original transmission and its attachments

 without reading or saving in any manner.



 The Evangelical Lutheran Good Samaritan Society.

 -



{ Shelley Waltz;
  Center for Advanced Biotechnology and Medicine;
  Rutgers University/UMDNJ;
  679 Hoes Lane;
  Piscataway, NJ 08854;
  732 235 3346 }

Wordlist Rules

[Shelley Waltz]

I am trying to use the following from a posting on Mar 2 2004
RHES3/spamassassin-2.63-1 ...

# match Bayes-poison lists of lowercase words without articles or common
#prepositions

body  PT_WORDLIST_10
/(?:\b(?!(?:from|that|have|this|were|with)\b)[a-z]{4,12}\s+){10}/
describe PT_WORDLIST_10  string of 10+ random words
score  PT_WORDLIST_10  1.0

body  PT_WORDLIST_13
/(?:\b(?!(?:from|that|have|this|were|with)\b)[a-z]{4,12}\s+){13}/
describe PT_WORDLIST_13  string of 13+ random words
score  PT_WORDLIST_13  3.0

body  PT_WORDLIST_30
/(?:\b(?!(?:from|that|have|this|were|with)\b)[a-z]{4,12}\s+){30}/
describe PT_WORDLIST_30  string of 30+ random words
score  PT_WORDLIST_30  10.0

# match Bayes-poison lists of lowercase words without articles or common
#prepositions

body  XX_WORDLIST_10
/(?:\b(?!(?:from|that|have|this|were|with)\b)[a-z\.\,\-\;]{4,18}\s+){10}/
describe XX_WORDLIST_10  string of 10+ random words
score  XX_WORDLIST_10  1.0


When I spamassassin -D --lint I get the following ...


Failed to parse line in SpamAssassin configuration, skipping: body 
PT_WORDLIST_10
Failed to parse line in SpamAssassin configuration, skipping:
/(?:\b(?!(?:from|that|have|this|were|with)\b)[a_z]{4,12}\s+){10}/
Failed to parse line in SpamAssassin configuration, skipping: body 
PT_WORDLIST_13
Failed to parse line in SpamAssassin configuration, skipping:
/(?:\b(?!(?:from|that|have|this|were|with)\b)[a_z]{4,12}\s+){13}/
Failed to parse line in SpamAssassin configuration, skipping: body 
PT_WORDLIST_30
Failed to parse line in SpamAssassin configuration, skipping:
/(?:\b(?!(?:from|that|have|this|were|with)\b)[a_z]{4,12}\s+){30}/
Failed to parse line in SpamAssassin configuration, skipping: body 
XX_WORDLIST_10
Failed to parse line in SpamAssassin configuration, skipping:
/(?:\b(?!(?:from|that|have|this|were|with)\b)[a_z\.\,\_\;]{4,18}\s+){10}/
Failed to parse line in SpamAssassin configuration, skipping: body 
XX_WORDLIST_13
Failed to parse line in SpamAssassin configuration, skipping:
/(?:\b(?!(?:from|that|have|this|were|with)\b)[a_z\.\,\_\;]{4,18}\s+){13}/
Failed to parse line in SpamAssassin configuration, skipping: body 
XX_WORDLIST_30
Failed to parse line in SpamAssassin configuration, skipping:
/(?:\b(?!(?:from|that|have|this|were|with)\b)[a_z\.\,\_\;]{4,18}\s+){30}/

Do these rules work for SA-2.63?


{ Shelley Waltz;
  Center for Advanced Biotechnology and Medicine;
  Rutgers University/UMDNJ;
  679 Hoes Lane;
  Piscataway, NJ 08854;
  732 235 3346 }