Re: [SAtalk] Is there a way to reject a message before it arrives?

Here are the stats from our servers: The numbers below are averages per day for our primary MX over the past 30 days, with an average of 861,344 emails per day. mime_header_checks rejects 11% of emails SecuritySage_rhsbl5 rejects 14% of emails header_checks rejects 23% of emails body_checks r

[SAtalk] New Postfix & SpamAssassin Step-By-Step Guide

Hi all, I've just posted a new guide in my series of Postfix Anti-Spam documents. This one is a step-by-step guide to getting Postfix working with SpamAssassin as per the configuration that I like using. Comments and constructive criticism are welcome. The guide can be found here: http://www.s

RE: [SAtalk] Popcorn, Backhair, and Weeds

Hi Keith, Thanks for the your time and knowledge! The explanation of your rule contraction is excellent and really helped me understand the process much better. This exercise has been a very good learning experience for me thanks to Jennifer Wheeler. She authored a set of rules (http://spamhamm

RE: [SAtalk] Popcorn, Backhair, and Weeds

Hi Keith, Au contraire. That is exactly it. That explanation was beautiful! ( I long for your brain. :) ) Thank you for taking the time to make that so clear! The rules actually work, but I suspected they were filled with garbage. Thanks for cleaning them up! I'll put your shorn version on

[SAtalk] Subject not being tagged

I am used Exim 2.55 with Exim and exiscan-acl but I have noticed that spam messages are not being tagged. My local.cf is: required_hits 10.0 rewrite_subject 1 spam_level_char * spam_level_stars 1 skip_rbl_checks 1 dns_available no check_mx_attempts 0 check_mx_delay 5 report_safe 0 use_terse_report

[SAtalk] Can I delete learned email?

Hello, I couldn't find this in the FAQ, lists, or Google... I have been collecting spam for a while in anticipation of training the bayes filters in spamassassin. I now have a corpus of over 5000 spams and 5000 hams. After I train the bayes system with sa-learn can I remove the spam fro

[SAtalk] HTML character entities

Recently one of my users has been receiving a large amount of spam that is tagged by the HTTP_USERNAME_USED and USERPASS tests. The same mail has the URL's heavily obfuscated with character entities, but this fact doesn't seem to be triggering any particular test. In searching through this

[SAtalk] Bayes not working.. On System Wide SA

Hi all.. Quick question.. I hope.. I'm running SA 2.60 on RH9 and am trying to get Bayes to autolearn.. I pass ALL my mail from this system to my exchange server and host no local mailboxes.. While not ideal, it is what I was asked to do for the company.. I understand that Bayes can still work, th

[SAtalk] Too many rules?

I've been playing with and implementing a lot of the rules I have found that many of you have contributed.. They have worked wonders for my system.. However When I implemented the gigantic evilrules.cf, they worked great for about an hour.. Then the whole server went into such a slow mode that

RE: [SAtalk] Popcorn, Backhair, and Weeds

Larry Gilson <[EMAIL PROTECTED]> wrote: > I had the following HTML tag OBFU rule (variant of yours): > /(\>|\s)\w{1,5}?\<\/?\s?[\w\s]{6,150}\/?\s?\>\w{1,7}?(\s|\W|\<)/ There's a lot of clutter in that that makes it harder to follow. Let's try paring it down. First, '<' and '>' are not speci

[SAtalk] sa-learn

I've now seen this error twice: unlock: 69574 unlink failed: /u/gostl/.spamassassin/bayes.lock Each time I see it, my Bayes files seemed trashed. I pretty much have to wipe out my Bayes files and retrain. Has anyone else seen this problem? Is there a less painful way out of it? -- Jac

RE: [SAtalk] Popcorn, Backhair, and Weeds

Hi Jennifer, Thanks for the reply. I think I am seeing the light now. With your help and others from the list, I am really getting it now. The FPs I was getting are gone after changing the limit from \w{0,7} to \w{1,7}?. This really makes a huge difference. Thanks again! Don't feel awkward a

[SAtalk] Problems with Spamd

Hi to all, I've just sign up on the list 'cause I'm having some trouble installing spamassassing When I try to start the spamd daemon I get the following error: # /etc/init.d/spamassassin start Starting spamd: Can't locate loadable object for module HTML::Parser in @INC (@INC contains: ../lib /usr

[SAtalk] SA memory utilization (Was: Evil rules HUGE update!

At 17:35 10/9/2003 -0400, Chris Santerre wrote: Well I got around to updating my evilrules.cf file. Ummm.are you sitting down? The first version had 274 rules for spam hosts. This version has 1758 rules!! Yup! I went thru it by hand 3 times before running the reg2ule.pl script. I also posted a

Re: [SAtalk] Another example of obfuscating text

On Fri, Oct 10, 2003 at 10:52:37AM -0500, Bill Polhemus wrote: > Here's one that I got today, that slipped through (the first > in over a week). Not sure why SA 2.55 didn't get it: .. > Subject: )US D-octors w_rite you=r prescript-ions -nndt > > was lit, struck Toll by its cold severity. > chap.

Re: [SAtalk] Using only one RBL

On Friday, October 10, 2003, at 07:30 PM, Matt Kettler wrote: At 05:03 PM 10/10/03 -0700, Bill Shupp wrote: How do I setup SpamAssassin to query only bl.spamcop.net, and set a very high score for that? I'm using spamd with vpopmail support. Go to /usr/share/spamassassin. look through 20_dnsbl_t