After installing 2.60-cvs I've noticed a number of FPs resulting
from SA misinterpreting dial-up RBL data.
In particular, it does not seem to recognise the source IP address
as the originator of the message and so considers all the dial-up RBL
scores that it hits as a spam indication.
For example
At 04:31 PM 7/16/03 -0700, George Yobst wrote:
As I understand it, the sa-learn starts the Bayes filtering
process, but is per-user, so everybody would have to do their own?
How do I get it to run on the server level (or would that
be too CPU intensive)? Can I just copy the files to .?
Did a G
The LOTS_OF_STUFF rule will match URLs of the
following type:
http://1.2.123.3/images/something.gif
I'm not sure what, if anything, would be a better
solution
Jay Levitt
It seems like upgrading from 2.53 to 2.60-cvs has thrown
off my Bayes scoring. Now most messages (even blatant 'ham')
get a bayes rating of 90% or higher.
I've rebuilt it with a "sa-learn --rebuild"
I'm using "DB_File -- 1.77" for the database, so it shouldn't
be the problem.
I have a reasonable
Thanks.
Will do!
> -Original Message-
> From: Justin Mason [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, July 16, 2003 6:44 PM
> To: Lance Ware
> Cc: [EMAIL PROTECTED]
> Subject: Re: [SAtalk] Problems with FORGED_YAHOO_RCVD
>
>
> "Lance Ware" writes:
> >Hi Folks,
> >
> >We're seeing some
At 17:38 16/07/03 -0700, Lance Ware wrote:
Hi
Folks,
We're seeing some false positives
with SA/MailScanner.
It looks like SA thinks the headers
below are forged, even though these are legitimate emails generated by
Yahoo's store system.
Any thoughts?
TIA,
Lance
[removed exchange headers
et
"Lance Ware" writes:
>Hi Folks,
>
>We're seeing some false positives with SA/MailScanner.
>
>It looks like SA thinks the headers below are forged, even though these
>are legitimate emails generated by Yahoo's store system.
damn, FPs :(
Could you open a bug on http://bugzilla.SpamAssassin.org/ ,
Hi People,
Not having done a lot of manual training of Bayes until recently I havn't
come across this before, but it seems that with some kinds of messages its
very difficult to train them as ham and get a sufficiently low BAYES score
to make a difference.
These are mainly genuine messages tha
Title: Problems with FORGED_YAHOO_RCVD
Hi Folks,
We're seeing some false positives with SA/MailScanner.
It looks like SA thinks the headers below are forged, even though these are legitimate emails generated by Yahoo's store system.
Any thoughts?
TIA,
Lance
[removed exchange heade
I have Debian packages for Spamassassin 2.55 and Razor 2.22 available
here:
http://www.datafx.com.au/spam/
Tested and working on two of my servers - Not responsible if they break
anything!
Regards,
MB
---
This SF.net email is sponsored by: VM
Since it is sporadic, I suspect that it is related to connectivity
and/or congestion issues at (a/the) razor2 server(s). This suspicion
is strengthened in my mind by the comment in the code about providing
a better diagnostic than "Bad file descriptor" when the server is
unavailable.
Well,
On Wed, 16 Jul 2003, Yackley, Matt wrote:
> Adam,
>
> Try something like this in SA's local.cf
>
> razor_config /var/amavis/.razor/razor-agent.conf
>
> >
> > -Original Message-
> > From: Adam Denenberg [mailto:[EMAIL PROTECTED]
> > Sent: Wednesday, July 16, 2003 9:19 AM
> > To: Spamassassi
Hi all,
As I understand it, the sa-learn starts the Bayes filtering
process, but is per-user, so everybody would have to do their own?
How do I get it to run on the server level (or would that
be too CPU intensive)? Can I just copy the files to .?
Did a Google search and nothing came up.
If you've got the connection with the intention of running your own
mailserver, check the IP address(es) you've got on an RBL lookup page
such as:
Fortunately, I'm not on any of the RBL lists. I don't have enough
customers to spam! ;)
The problem thing is that my IP block was still a "DSL IP
At 08:26 15/07/03 -0700, Jonathan Nichols wrote:
I'm using a DSL line on my email server. Which is part of my ISP's static
DSL pool. I don't send thru my ISP's mail server. I'm starting to see the
error in this now. In my mind I had somehow split the difference of HOME
DSL and BUSINESS DSL. I al
Nix <[EMAIL PROTECTED]> wrote:
You'd have to run the files through spamassassin -d before passing them
to razor, and sa-learn also has to do that, so spamassassin -r is faster
(you're only doing the equivalent of a -d once)
Only if you have SA alter the message. If all you do is add headers, you
At 01:42 PM 7/16/2003 -0700, I Am Jesus @sent wrote:
I re-suggest (v 1.1) something like the original comments followed by:
*
#These are suggested starting values for users too lazy or otherwise
unable to run the GA optimizer to find the optimal values.*
#score RCVD_IN_BL_SPAMCOP_NET 1.8
#score R
At 01:42 PM 7/16/2003 -0700, I Am Jesus @sent wrote:
I see evidence that the current scores are not being optimally set. A LOT
of the Rules scores are apparrently still at initial values: integers,
0.001, or 0.100 suggesting they weren't really optimized by the GA. It
obviously isn't being run
I have gotten spamassassin to work on windows with Vircom Vopmail, I will
see about giving some sort of writeup and source code to the teeny tiny
program I had to write.
The only problem I'm having is that certain emails when being reported to me
that they are spam messages, do not have the origin
On Wednesday, July 16, 2003, at 04:14 PM, Nix wrote:
You'd have to run the files through spamassassin -d before passing them
to razor, and sa-learn also has to do that, so spamassassin -r is
faster
(you're only doing the equivalent of a -d once) as well as being more
effective (you're reporting to
Matt Kettler wrote:
Flipping back to your original post...
Thankfully.
I *think* what you are asking is that all the RBL's be GAed and then
the "for pay" ones zeroed out later with their GA assigned scores in
comments.
Thanks for a clear and informative explanation that shows why a
sensib
On Wed, Jul 16, 2003 at 04:51:27PM -0400, Dragoncrest wrote:
>
> >Erm ... _no_, actually. What's in the vicinity of line 420 of
> >/usr/local/lib/perl5/site_perl/5.005/Mail/SpamAssassin/Dns.pm
> >on the machine with the problem?
>
> I've got the same thing you do on like 420 that you hav
Erm ... _no_, actually. What's in the vicinity of line 420 of
/usr/local/lib/perl5/site_perl/5.005/Mail/SpamAssassin/Dns.pm
on the machine with the problem?
I've got the same thing you do on like 420 that you have on Line
407. In fact what you have and what I have (I've got SA v2.55) are
On Tue, 15 Jul 2003, [EMAIL PROTECTED] uttered the
following:
> spamassassin -r reports to razor/pyzor and bayes
razor, pyzor, dcc, and bayes.
> sa-learn only does bayes?
>
> what would be best for reporting a maildir of spam?
>
> spamassassin -r each file?
>
> or sa-learn the directory and th
On Wed, 16 Jul 2003, Michael Weber wrote:
> I'm trying to get the RPM's to install and their are failed
> dependencies... But there shouldn't be!
>
> Here's what I get:
>
> # rpm -ivh perl-Mail-SpamAssassin-2.55-1.7.3.i386.rpm
> error: failed dependencies:
> perl(HTML::Parser) is needed
YD> That will work, but if everyone starts doing it then spammers will start
YD> forging X-Spam-Status lines into their spam. The idea is good but that
YD> implementation is trivially defeated.
YD> To make it a little more spammer-resistant I would add version_tag
YD> something to local.cf and adj
On Wed, Jul 16, 2003 at 11:43:31AM -0500, Chris Barnes is rumored to have said:
>
> I need a simple procmail script so that any messages marked as spam by
> SA get put into a folder named "Filtered" (I use IMAP, so using the MUA
> is not an option).
>
Here's the procmail stuff I use for SA:
###
I need a simple procmail script so that any messages marked as spam by
SA get put into a folder named "Filtered" (I use IMAP, so using the MUA
is not an option).
My initial thought was to simply look for the **SPAM** that SA adds to
the subject line. Seemed easy enough, right up until I found out
Hi,
On 16 Jul 2003 11:08:57 -0400 Adam Denenberg <[EMAIL PROTECTED]> wrote:
> is defang_mime still an option in 2.55 ? Can it be placed in sql table
> for user prefs?
>
> I am getting the following error in 2.55
>
> : debug: retrieving prefs for [EMAIL PROTECTED] from SQL server
>
> Jul 16
would i be correct in saying report_safe 2 does what i remember
defang_mime to do? (strips out html and converts email to text).
I dont want any extra reports added to the email .
thanks
adam
On Wed, 2003-07-16 at 11:59, Theo Van Dinter wrote:
> On Wed, Jul 16, 2003 at 11:08:57AM -0400, Adam
On Wed, 16 Jul 2003 08:11:38 -0600 "Benjamin Tomhave" <[EMAIL PROTECTED]> wrote:
> Michael Weber wrote:
> > I'm trying to get the RPM's to install and their are failed
> > dependencies... But there shouldn't be!
> >
> > Here's what I get:
> >
> > # rpm -ivh perl-Mail-SpamAssassin-2.55-1.7.3.i386.r
On Wed, Jul 16, 2003 at 11:08:57AM -0400, Adam Denenberg wrote:
> is defang_mime still an option in 2.55 ? Can it be placed in sql table
> for user prefs?
nope. look at "report_safe".
--
Randomly Generated Tagline:
"I love drag queens, you can take 'em to dinner and then dancing, and if you
g
is defang_mime still an option in 2.55 ? Can it be placed in sql table
for user prefs?
I am getting the following error in 2.55
: debug: retrieving prefs for [EMAIL PROTECTED] from SQL server
Jul 16 10:41:06 somehost spamd[18395]: debug: Failed to parse line in
SpamAssassin configuration, ski
On Wed, 2003-07-16 at 11:02, Alexander Litvinov wrote:
> > That will work, but if everyone starts doing it then spammers will start
> > forging X-Spam-Status lines into their spam. The idea is good but that
> > implementation is trivially defeated.
>
> It seems to much better solution will be
> |
Adam,
Try something like this in SA's local.cf
razor_config /var/amavis/.razor/razor-agent.conf
>
> -Original Message-
> From: Adam Denenberg [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, July 16, 2003 9:19 AM
> To: Spamassassin-Talk (E-mail)
>
> Is it possible to specify the path to
Is it possible to specify the path to look for Razor2's home in Spam
Assassin? I dont want to use /root/.razor or anything else it defaults
to.
thanks
adam
---
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple oper
On Wed, Jul 16, 2003 at 06:01:12PM +0700, Alain Fauconnet wrote:
> Hello,
> One user reported an undected spam to me (quoted below, headers
> included). Your usual Nigerian scam-style spam. It got 3.8 points, but
Hey - that was a good one! I wonder why I've never received a copy - I feel
l
At 01:46 AM 7/16/03 -0400, Gorm Jensen wrote:
I run spamassassin 2.55 on a Redhat 7.2 system
The attached email is spam, but it was not filtered because of the
"USER_IN_WHITELIST" assessment. I studied my whitelist, and neither
the originator nor strings containing the originator are listed, so I
At 08:36 AM 7/16/03 -0500, Michael Weber wrote:
I'm trying to get the RPM's to install and their are failed
dependencies... But there shouldn't be!
Here's what I get:
# rpm -ivh perl-Mail-SpamAssassin-2.55-1.7.3.i386.rpm
error: failed dependencies:
perl(HTML::Parser) is needed by perl-Mail
Michael,
This is an RPM-ism. Because you installed HTML::Parser via CPAN, the rpm db
doesn't know it's installed. You should either install SA through CPAN,
too, using "install Mail::SpamAssassin" or you should add the --nodeps flag
to rpm and force the RPM install. This latter approach, howeve
> -Original Message-
> From: Pat Masterson [mailto:[EMAIL PROTECTED]
> Subject: RE: [SAtalk] (OT) DSL/DIALUP manual BL Catch 22
>
>
> Here it is Chris..
> GL. -pat
>
Thanks for your access file Pat!! Your list was great help. I wanted to let
you know how I'm handling this as it may be
I'm trying to get the RPM's to install and their are failed
dependencies... But there shouldn't be!
Here's what I get:
# rpm -ivh perl-Mail-SpamAssassin-2.55-1.7.3.i386.rpm
error: failed dependencies:
perl(HTML::Parser) is needed by perl-Mail-SpamAssassin-2.55-1
But, when I try to update
I'm trying to work out a rule to bounce messages that contain no text
- just a mime or base64 attachment. Using (and new to) SA 2.55. Any
hints?
Thanks!
Mike-
If you're not confused, you're not trying hard enough.
Please note - Due to the i
Hello,
Hope I won't get flamed for this, but I haven't found anything in the
FAQs.
One user reported an undected spam to me (quoted below, headers
included). Your usual Nigerian scam-style spam. It got 3.8 points, but
according to the rules matching, it should get 5.0 (it does if I run
> That will work, but if everyone starts doing it then spammers will start
> forging X-Spam-Status lines into their spam. The idea is good but that
> implementation is trivially defeated.
It seems to much better solution will be
| spamassassin --remove-markup | spamassassin
(remove any markup by
On Wed, 2003-07-16 at 08:29, Abigail Marshall wrote:
> SWO> I want a recipe for /etc/procmailrc which conditionally runs a message
> SWO> through spamc *only* if it hasn't already been processed by SA. I want to
> SWO> use the X-Spam-Status and/or the X-Spam-Flag headers.
>
> OK, try this:
>
>
Close. I whitelisted myself, and the spam's "Return-Path" points to
me.
Thanks, Bob.
> Even without seeing the missing attachment, I'm guessing the message
> matched something in the default whitelists in
> /usr/share/spamassassin/60_whitelist.cf
>
> Amazon?
>
> -- Bob
---
On Wednesday, July 16, 2003 3:52 AM, I wrote:
> .. but, to keep the regex semi-simple, it does allow for names as ' or .
or
> even whitespace.
I have improved the regex myself, As I couldnt stand
whitespace/comma/tick/dash/dot being valid.
> header JK_SENDER1 Sender =~
/^"?[a-z0-9\s\.\',-]+
This may be a Microsoft Outlook-only thing, but I am getting a lot of
NO_REAL_NAME hits on messages that are forwarded on behalf of someone.
in the headers:
From: <[EMAIL PROTECTED]>
Sender: "Jeremy Kister" <[EMAIL PROTECTED]>
and my MUA shows me:
From: Jeremy Kister [EMAIL PROTECTED] on behalf o
SWO> I want a recipe for /etc/procmailrc which conditionally runs a message
SWO> through spamc *only* if it hasn't already been processed by SA. I want to
SWO> use the X-Spam-Status and/or the X-Spam-Flag headers.
OK, try this:
:0fw
* < 256000
* ! ^X-Spam-Status:
| spamc
(The exclamation poi
Hi,
On Wed, 16 Jul 2003 01:46:17 -0400 "Gorm Jensen" <[EMAIL PROTECTED]> wrote:
> I run spamassassin 2.55 on a Redhat 7.2 system
>
> The attached email is spam, but it was not filtered because of the
> "USER_IN_WHITELIST" assessment. I studied my whitelist, and neither
> the originator nor stri
Hi Phil,
>I've setup 2 mailboxes to use for sa-learn. When I or anyone else
>forwards mail into either the spam or nonspam mailboxes, does it matter
>if a ton of the messages will be from me, and they will have
>the subject prefaced by "FW:"? I would think either of those things would
really
>thr
52 matches
Mail list logo
