[SAtalk] spamproxyd / amavisd

2002-12-06 Thread Tom Allison
I was looking around for something that would work as an advanced filter under postfix. I've had recommendations for amavisd and found some "stuff" on spamproxyd. How is this related to SpamAssassin? spamproxyd and a lot of people here have mentioned amavis so I'll guess this is a wealth of i

Re: [SAtalk] spamproxyd / amavisd

2002-12-06 Thread Mark Martinec
Tom, | I was looking around for something that would work as an advanced | filter under postfix. I've had recommendations for amavisd and | found some "stuff" on spamproxyd. | | How is this related to SpamAssassin? spamproxyd and a lot of | people here have mentioned amavis so I'll guess this

Re: [SAtalk] RBL slowness

2002-12-06 Thread Ralf Hildebrandt
* Stephen Bader <[EMAIL PROTECTED]>: > Thanks! Setting 'rbl_timeout 5' cut the time down to 10 seconds per > mesage, instead of 30. Although I don't think 30 is a bad number at all, > it can start to be a problem on servers that have a high volume of e-mail, > and a lot of spamd processes get start

Re: [SAtalk] Blacklist_to and Whitelist_to

2002-12-06 Thread Vince Hoang
On Fri, Dec 06, 2002 at 01:36:19PM +1000, Andrew wrote: > My Sendmail/Mimedefang/Spamassassin installation does not seem > to be recognising the blacklist_to and whitelist_to lists. > The filter picks up the blacklist_from and whitelist_from > perfectly. Anybody know what might cause this? You mig

Re: [SAtalk] base64 code

2002-12-06 Thread Jose M.Herrera
On Thu, 5 Dec 2002, Suzanne Skinner wrote: > On Thu, Dec 05, 2002 at 04:01:14PM -0300, Jose M.Herrera wrote: > > >> Try adding this line to your config file: > >> > >> defang_mime 0 > > > Thanks... but excuse by my ignorance, but what function makes this option. > > By default, SpamAssassi

Re: [SAtalk] Whitelist Problem

2002-12-06 Thread Justin Mason
Slava Madrit said: > We are using Spamassassin on win32 along with Guinevere 2 for our > GroupWise 6 system. I have a user who does not want his spam marked by > spamassassin. So I added an entry into the whitelist that says ALL_SPAM_TO= > [EMAIL PROTECTED] so that it will not get marked. It s

Re: [SAtalk] 2.50CVS false positives

2002-12-06 Thread Justin Mason
This looks like the bunch mgm was talking about. I have *no* spam from these guys, unfortunately. I would suggest some rules like this: - catching the wierd "letters-numbers-letters-numbers.com" format they use for their domains - the use of , a non-std HTML tag. - this message-id f

Re: [SAtalk] user_prefs to clear report template

2002-12-06 Thread Mike Burger
report_header 1 will put the report in the message header. defang_mime 0 will leave the HTML alone. On Thu, 5 Dec 2002, Victor O'Rear wrote: > How can I stop, preferably at the user_prefs file, spamassassin from > modifying the messages? My users don't mind modifying the subject line, but > HTML

RE: [SAtalk] 2.50CVS false positives

2002-12-06 Thread Michael Moncur
> This looks like the bunch mgm was talking about. I have *no* spam from > these guys, unfortunately. I keep being surprised by the difference between different people's spam. They account for nearly 10% of my spam... > - catching the wierd "letters-numbers-letters-numbers.com" format they >

Re: [SAtalk] RBL slowness

2002-12-06 Thread Rich Puhek
Sure do, but eventually I'll try to lookup a non-cached record. If the server is not responding, then we have to wait for DNS to time out. --Rich Ralf Hildebrandt wrote: * Stephen Bader <[EMAIL PROTECTED]>: Thanks! Setting 'rbl_timeout 5' cut the time down to 10 seconds per mesage, instead of

[SAtalk] defang_mime

2002-12-06 Thread Ronan Lucio
Hello, I create the file /etc/mail/spamassassin/user_prefs with the follow content: #== whitelist_from [EMAIL PROTECTED] whitelist_from [EMAIL PROTECTED] whitelist_to[EMAIL PROTECTED] defang_mime 0 use_terse_report

Re: [SAtalk] 2.50CVS false positives

2002-12-06 Thread Brian May
With Bayesian enabled.. wouldn't it have a higher hit count? I didn't see that in your list of test matches... - Original Message - From: "Michael Moncur" <[EMAIL PROTECTED]> To: "Justin Mason" <[EMAIL PROTECTED]> Cc: <[EMAIL PROTECTED]> Sent: Friday, December 06, 2002 7:48 AM Subject: RE

[SAtalk] sample userprefs rules?

2002-12-06 Thread Rob Tow
Could some kind soul point me to a sample userprefs file with a goodly set of user defined rules? Thanks! -- R o b T o w [EMAIL PROTECTED] www.tauzero.com/Rob_Tow (408)-829-7407 * *ronin in the glade *swift katas slice the still air *...his own opponent * -

Re: [SAtalk] defang_mime

2002-12-06 Thread Matthew Davis
* Ronan Lucio ([EMAIL PROTECTED]) wrote: > > #== > whitelist_from [EMAIL PROTECTED] > whitelist_from [EMAIL PROTECTED] > > whitelist_to[EMAIL PROTECTED] > > defang_mime 0 > use_terse_report1 > report_header

RE: [SAtalk] 2.43 - too many false negatives

2002-12-06 Thread Vivek Khera
> "MM" == Michael Moncur <[EMAIL PROTECTED]> writes: MM> These folks are serious spammers. They even register each of the domain MM> names to look legit. Look up findhsm-list-cluster-182-643.com or any of the MM> others, they're all registered to Daily Promotions. (It's a shame a WHOIS MM> loo

Re: [SAtalk] Updated DailyPromotions / HSM rules

2002-12-06 Thread Patrick Bores
Hello, I have noticed that most of the NS records for these spammers are the same or similar. Would it be too expensive to do a quick lookup of NS records to block these guys? Here are my results: [whiteout:~] patrick% host -t ns thelst40090hspeedm.com thelst40090hspeedm.com name server NS1.HS

[SAtalk] Re: defang_mime

2002-12-06 Thread Alan Ordway
try putting the defang_mime 0 in the local.cf file in /etc/mail/spamassassin instead. I got that from /usr/share/spamassassin/10_misc.cf " # SpamAssassin basic config file # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/loca

[SAtalk] zaconta.com

2002-12-06 Thread Rich Puhek
Does anyone else tend to get resumes from zaconta.com? They do not appear to honor removal requests, and frequently change the source of their mailings. Last message I got from them scored an 8.5. I'm set to tag at 10 (ISP with false-positive sensitive users). There seem to be fairly consistent

[SAtalk] Spamassassin Problem with DCC

2002-12-06 Thread Ben M. VanWagner
I am having a little problem with dcc.. I have razor working fine and now im trying to get dcc and pyzor working these are the messages I get in maillog Dec 6 17:36:07 domain dccproc[12581]: send(dcc.dcc-servers.net (153.19.44.233,6277)): Operation not permitted Dec 6 17:36:08 domain spamd[12

[SAtalk] Spammer gets taste of his own medicine

2002-12-06 Thread Matthew Cline
"West Bloomfield bulk e-mailer Alan Ralsky..." has "been inundated with ads, catalogs and brochures delivered by the U.S. Postal Service to his brand-new $740,000 home." "It's all the result of a well-organized campaign by the anti-spam community, and Ralsky doesn't find it funny." Really? I

Re: [SAtalk] Spamassassin Problem with DCC

2002-12-06 Thread Theo Van Dinter
On Fri, Dec 06, 2002 at 05:40:20PM -0600, Ben M. VanWagner wrote: > Dec 6 17:36:07 domain dccproc[12581]: send(dcc.dcc-servers.net >(153.19.44.233,6277)): Operation not permitted Can you run DCC from the commandline without error? It looks like a DCC issue, not something with SA. -- Randomly

Re: [SAtalk] zaconta.com

2002-12-06 Thread Mike Burger
I added zaconta.com to my MTA's spam reject list long ago...anything from zaconta.com gets rejected with a code 550. On Fri, 6 Dec 2002, Rich Puhek wrote: > Does anyone else tend to get resumes from zaconta.com? They do not > appear to honor removal requests, and frequently change the source of

[SAtalk] RBL Usage - Use of Spamcop and ORDB

2002-12-06 Thread Mike McCandless
After identification by the group that Net::DNS needed to be installed for RBL usage to work, I've re-run the command: spamassassin -tD < sample-spam.txt and a snippet of the output is: debug: Ran run_rbl_eval_test rule RCVD_IN_OSIRUSOFT_COM ==> got hit debug: Ran run_rbl_eval_test rule X_OSIR

Re: [SAtalk] RBL Usage - Use of Spamcop and ORDB

2002-12-06 Thread Daniel Quinlan
Mike McCandless <[EMAIL PROTECTED]> writes: > In other words, where are the checks being executed against spamcop and > ordb and why are checks run against osirusoft? I thought by having the > 'score RCVD...' in my user prefs file, that instructed SA to check those > blacklist databases. > > Wha