[SAtalk] server specs

2003-10-21 Thread Wiebren Braakman
I am buying a new server to scan e-mails with spamassassin. What is the optimal ratio of processor capacity, memory and cache. it will probably become a Intel xenon 3.05 GHz processor so what matters is how much cache and memory optimal is to go with this processor. How much e-mails per

[SAtalk] Spamd relay to external server

2003-10-21 Thread [EMAIL PROTECTED]
Is it possible to send the mail elaborated from spamd to another external server. I use smtproutes in order to select the relay with AntiVirusand/orAntiSpamming. domain1.com:localhost:2525 #antivirus domain2.com:localhost:783 #antispamming =

[SAtalk] Scoring of 5.0 means spam. ist possible to drop mails with a scoring of i.e. 15?

2003-10-21 Thread Vittorio Muth
Hello, I've read in the FAQ, that spamassassin does not drop mails. OK. Is there anyone who got it, to configure spamassassin like that:? Score 5.0 = mark as spam and forward Score 15 = move mail to /dev/null or send it to [EMAIL PROTECTED] thanks in advance, Vittorio --

Re: [SAtalk] strange behavior of Bayesian analyzer in SA 2.6

2003-10-21 Thread Ben Wing
well, i get false positives with an empty body ... Return-Path: [EMAIL PROTECTED] Delivered-To: [EMAIL PROTECTED] Received: (qmail 38912 invoked by uid 19047); 17 Oct 2003 07:23:43 - Received: from unknown (HELO mpls-qmqp-02.inet.qwest.net) ([63.231.195.113]) (envelope-sender [EMAIL

[SAtalk] psychopathic behaviour with SA and exim

2003-10-21 Thread Ari Heitner
Hi, [not subscribed to list, please cc: me on replies] I've been trying for a while now on and off to get SA correctly working with exim, using spamc as an exim filter and running the mail through exim a second time for delivery (so that I can still use my exim filtering .forward file). For

[SAtalk] CGI script for whitelisting?

2003-10-21 Thread mvangord
Have any of you tried the following? Basically I am looking for a script that will run from micro_httpd (or another tiny httpd) that will ask for an email address, add it to the whitelist file (no SQL) sort that file in alphabetical order and stop/start amavisd. I am sure that this is almost

RE: [SAtalk] [OT] What is next step?

2003-10-21 Thread Colin A. Bartlett
Chris Santerre Sent: Monday, October 20, 2003 3:38 PM Lets say I can track the spammer to the source. What avenue do we have to stop them? Should I work with local legislation next? Don't flame me on this question, but should ISPs be held more accountable? Like Comcast? (Should be called

[SAtalk] some sa-learn questions

2003-10-21 Thread Carlos Bachmaier
I wonder most of emails I receive include both in header and body my own email username. Does sa-learn add that as token in the spam and ham training phase? Does that fact influences my ham being considered as spam by SA? Is there a way to remove *just* a token form the db? (or to avoid

[SAtalk] SA header and scoring inconsistent

2003-10-21 Thread newsletters
Hey SA Gang, I've only been using SA for about 3-4 weeks and I keep turning additional spam checks to see see how things go. What i've got going on is messages that get marked in the subject as SPAM, the real email gets put into an attachment and the scoring summary as the main message.

Re: [SAtalk] strange behavior of Bayesian analyzer in SA 2.6

2003-10-21 Thread Ben Wing
hmm ... well, i can't reproduce. those results came right after i upgraded from 2.6 to 2.53, before i killed the database and redid it. debug: running header regexp tests; score so far=0 debug: running body-text per-line regexp tests; score so far=0 debug: bayes corpus size: nspam = 2611, nham

[SAtalk] sa-learn ? postfix SA protecting Exchange server

2003-10-21 Thread Mike Schrauder
I use postfix-SA2.6 in front of an exchange box. When someone gets a false negative, they place a copy of the spam in a public folder on exchange. I then use mutt - imap to get to my spam public folder on Exchange and then do sa-learn -D --mbox --spam spam10-17-03.mbox I get: debug: tokenize:

RE: [SAtalk] Scoring of 5.0 means spam. ist possible to drop mails with a scoring of i.e. 15?

2003-10-21 Thread Giles Coochey
I use spam assassin milter for Sendmail. It has a -r option to reject emails with a score higher than a certain threshold. I set mine to 25. I believe the high scoring spam gets rejected with a 550 error or similar. -Original Message- From: Vittorio Muth [mailto:[EMAIL PROTECTED] Sent:

Re: [SAtalk] Scoring of 5.0 means spam. ist possible to drop mails with a scoring of i.e. 15?

2003-10-21 Thread Dominik Ruf
* Vittorio Muth [EMAIL PROTECTED] [2003-10-21 15:07]: I've read in the FAQ, that spamassassin does not drop mails. OK. Is there anyone who got it, to configure spamassassin like that:? Score 5.0 = mark as spam and forward Score 15 = move mail to /dev/null or send it to [EMAIL PROTECTED]

Re: [SAtalk] Scoring of 5.0 means spam. ist possible to drop mails with a scoring of i.e. 15?

2003-10-21 Thread Patrick Morris
Vittorio Muth wrote: I've read in the FAQ, that spamassassin does not drop mails. OK. Is there anyone who got it, to configure spamassassin like that:? As you read in the FAQ, SpamAssassin doesn't drop e-mails. Warnings that deleting mail SpamAssassin marks as spam aside, it's impossible to

Re: [SAtalk] Spamd relay to external server

2003-10-21 Thread Patrick Morris
[EMAIL PROTECTED] wrote: Is it possible to send the mail elaborated from spamd to another external server. I use smtproutes in order to select the relay with AntiVirus and/or AntiSpamming. domain1.com:localhost:2525#antivirus domain2.com:localhost:783 #antispamming

[SAtalk] Are you infested? Tell me about it...

2003-10-21 Thread John Biggs
Hi, I’m working on a book on computer security and would like to get a firsthand account of someone who is completely infested by spam and how they’re trying to fight it. Please reply to this address if you have a moment to talk about your spam woes. Best, John Biggs --- --- ---

[SAtalk] custom rules local.cf

2003-10-21 Thread Thomas Kinghorn
Hi List. Just a quick question. Do all custom rules have to be added to the /etc/mail/spamassassin/local.cf file OR can a seperate .cf file be placed in the spamassassin directory? This is for a system wide installation. Thanks in advance. Regards, Tom Kinghorn

RE: [SAtalk] child spamds sitting around forever

2003-10-21 Thread Dallas L. Engelken
i disabled both and now dont have any problems. spamd badly needs a child timeout setting. and awl and bayes need RDMBS support so each request doesnt have to lock the db's... except on inserts of which row-level locking might be an option. When you say you disabled bayes locking,

[SAtalk] have try these header check but don't know why it is not trigered.

2003-10-21 Thread Philippe Van Hecke
Hi i have installed these custome header check into my config. header FROM_MY_OWN_DOMAIN From =~/foo\.bar/i score FROM_MY_OWN_DOMAIN 0.01 header TO_MY_OWN_DOMAIN TO =~/foo\.bar/i score TO_MY_OWN_DOMAIN 0.01 header RECEIVED_FROM_OTHER_THAN_MY_DOMAIN Received !~/ \.foo\.bar|\.fw\.foo\.bar/i

RE: [SAtalk] [OT] What is next step?

2003-10-21 Thread Chris Santerre
Good points. Trust me, I know how to follow the spam :) Most that come from Korea are actually sent from the U.S. (creating twice the traffic.) I completely agree with you on law enforcement! I've called them all! FBI, CIA, Local PD, ect... and the only thing they will ever attempt to go after

RE: [SAtalk] server specs

2003-10-21 Thread Todd Schuldt
SA is also file IO intensive. It depends on your hard drive system for the file IO as well using IDE or SCSI or SAN? Hard or soft RAID? If hardware RAID what cache size and what mode 0, 1, 5, 10, 50? What drive speed? Also depends on OS choice and MTA. I use RH 7.3 with CommuniGate Pro

Re: [SAtalk] custom rules local.cf

2003-10-21 Thread Fred I-IS.COM
Yes, any *.cf file in that directory will be parsed for rules / config options. Frederic Tarasevicius Internet Information Services, Inc. http://www.i-is.com/ Thomas Kinghorn wrote: Hi List. Just a quick question. Do all custom rules have to be added to the

Re: [SAtalk] Scoring of 5.0 means spam. ist possible to drop mails with a scoring of i.e. 15?

2003-10-21 Thread Robert Nicholson
Any of this possible .. you just have to post process the headers of the email You would just look at the X-Spam-Status eg. X-Spam-Status: No, hits=0.0 required=0.6 tests=none autolearn=no version=2.60 How you determine the score will depend on you are invoking SA. On Tuesday, October 21,

[SAtalk] Message being marked as spam with less score

2003-10-21 Thread Listas - OPEN Internet
Hi all, I´m wondering here why SA-2.60, which I begin to use today, mark as spam messages with score less than 10 (my default score). Any idea how to avoid this? Thank´s any help. Gustavo --- This SF.net email is sponsored by OSDN

RE: [SAtalk] custom rules local.cf

2003-10-21 Thread Bill Polhemus
Yes. William L. Polhemus, Jr. P.E. Polhemus Engineering Company Katy, Texas USA -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Thomas Kinghorn Sent: Tuesday, October 21, 2003 6:50 AM To: Spamassassin-Talk (E-mail) Subject: [SAtalk] custom rules

Re: [SAtalk] custom rules local.cf

2003-10-21 Thread Patrick Morris
Thomas Kinghorn wrote: Hi List. Just a quick question. Do all custom rules have to be added to the /etc/mail/spamassassin/local.cf file OR can a seperate .cf file be placed in the spamassassin directory? Either will probably work, but it depends a bit on how you call SpamAssassin.

[SAtalk] How BIG are 'auto-whitlist' files supposed to get?

2003-10-21 Thread Charles Gregory
Hello! We've only just started using SA. For a while we were running 2.4, and just last week we upgraded to 2.6. When we first started using SA, I kept a casual eye on the personal files in .spamassassin, and did not see anything particularly problematic, but NOW I see auto-whitelist and 'bayes'

RE: [SAtalk] custom rules local.cf

2003-10-21 Thread Dallas L. Engelken
-Original Message- From: Thomas Kinghorn [mailto:[EMAIL PROTECTED] Sent: Tuesday, October 21, 2003 6:50 AM To: Spamassassin-Talk (E-mail) Subject: [SAtalk] custom rules local.cf Hi List. Just a quick question. Do all custom rules have to be added to the

RE: [SAtalk] list of test gone

2003-10-21 Thread Tom Meunier
Sorry, I should've left a note. I had brought it to the printers to get a banner made, and thought I'd take it out for a nice ice cream sundae too. It's back now, though. I put it at http://www.spamassassin.org/tests.html -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL

Re: [SAtalk] have try these header check but don't know why it is not trigered.

2003-10-21 Thread Matt Kettler
At 11:29 AM 10/21/2003, Philippe Van Hecke wrote: #header RECEIVED_FROM_OTHER_THAN_MY_DOMAIN Received !~/(server1||server2|server3|server4|server5)(\.fw)?\.foo\.bar/i snip the commented header RECEIVED_FROM_OTHER_THAN_MY_DOMAIN never match and so the FORGED_MY_DOMAIN is never trigered but the

RE: [SAtalk] custom rules local.cf

2003-10-21 Thread Colin A. Bartlett
Thomas Kinghorn Sent: Tuesday, October 21, 2003 7:50 AM Do all custom rules have to be added to the /etc/mail/spamassassin/local.cf file OR can a seperate .cf file be placed in the spamassassin directory? They can be in any .cf file within the /etc/mail/spamassassin folder. cheers, Colin

Re: [SAtalk] list of test gone

2003-10-21 Thread Adam D. Barratt
Cliff Browning wrote, Tuesday, October 21, 2003 3:39 PM I went to the spamassassin.org site today and the list of tests is not there. Could you please put it back. It's still at http://www.spamassassin.org/tests.html - easily reachable via the `Tests' link about half-way through the set of

RE: [SAtalk] Scoring of 5.0 means spam. ist possible to drop mails with a scoring of i.e. 15?

2003-10-21 Thread Bill Polhemus
I do it using a procmail recipe, such as: =BEGIN PROCMAIL RECIPE== :0 * ^X-Spam-Status: Yes { # Mails with a score of 15 or higher are almost certainly spam (with 0.05% # false positives according to rules/STATISTICS.txt). Let's delete them # completely. :0: *

Re: [SAtalk] Scoring of 5.0 means spam. ist possible to drop mails with a scoring of i.e. 15?

2003-10-21 Thread Kelson Vibber
Vittorio Muth [EMAIL PROTECTED] wrote: I've read in the FAQ, that spamassassin does not drop mails. OK. Is there anyone who got it, to configure spamassassin like that:? As it says in the FAQ, SpamAssassin does not do that. HOWEVER, you can have another program - generally the program calling

Re: [SAtalk] How BIG are 'auto-whitlist' files supposed to get?

2003-10-21 Thread Kris Deugau
Charles Gregory wrote: When we first started using SA, I kept a casual eye on the personal files in .spamassassin, and did not see anything particularly problematic, but NOW I see auto-whitelist and 'bayes' files that are exceeding 1MB in size, each. Is this 'normal'? For users with lots of

Re: [SAtalk] [OT] What is next step?

2003-10-21 Thread Dan Wilder
On Tue, Oct 21, 2003 at 10:01:24AM -0400, Chris Santerre wrote: [ Describes plan for DDOS attack on spam-friendly ISPs, comprising synchronized complaints about as many copies as possible of each spam originating from said ISP ] We could clean them up one by one. What do you guys think? How

Re: [SAtalk] Re: Swap Space

2003-10-21 Thread Kris Deugau
Simon Byrnand wrote: I imagine it would, however single threaded delivery mode just isn't an option for any kind of real world use. Until such time as sendmail implements a *proper* local delivery concurency setting, my method works very well... IIRC, you posted this method seom time ago-

Re: [SAtalk] server specs

2003-10-21 Thread Ray Dzek
I have SA running as aFilter/Relayon a RH 7.3 box. It is a Celeron 1.4Ghz. It processes mail for about 250 users. Ithas a single7200RPM IDE drive and 768MB of PC100 RAM. I process around 4000 messages a day (Most of it spam) - Original Message - From: Wiebren Braakman

RE: [SAtalk] server specs

2003-10-21 Thread Robert A. Hayden
Just to echo Todd's suggestions. Disk I/O is your primary issue. I recommend using RAID mirroring instead of RAID 5 since RAID5 has such crappy write performance. Physical memory is important if your box is slow enough to queue up multiple spamd processes, but any modern machine will clear

[SAtalk] Errors in my log

2003-10-21 Thread Hans-Juergen Schwarz
Hello List, I habe installed spamassassin 2.6, Perl 5.8 on a Debian Machine from the debian packages. Everything seems to work fine, but there are always the following messages in my logs: Oct 21 14:30:23 localhost spamd[26484]: Use of uninitialized value in string ne at /usr/sbin/spamd line

Re: [SAtalk] custom rules local.cf

2003-10-21 Thread Matt Kettler
At 07:50 AM 10/21/2003, Thomas Kinghorn wrote: Do all custom rules have to be added to the /etc/mail/spamassassin/local.cf file OR can a seperate .cf file be placed in the spamassassin directory? SA will by default parse *.cf in /etc/mail/spamassassin. Thus, you can put them in a separate CF file

Re: [SAtalk] list of test gone

2003-10-21 Thread Matt Kettler
At 10:39 AM 10/21/2003, Cliff Browning wrote: I went to the spamassassin.org site today and the list of tests is not there. Could you please put it back. Thanks Seems to be there and just fine for me... It's possible you caught the site in the middle of an update.. the tests list is built

Re: [SAtalk] My first question here[SA DCC]

2003-10-21 Thread Marco Calistri
On 21-Oct-2003 Matt Kettler wrote: At 10:19 PM 10/20/03 +0200, Marco Calistri wrote: Hello, first of all I want to make my compliments to the developers that are spending their time to fight the SPAM and of course, among these thanks to SA Team. My first question (the first of a long series...)

Re: [SAtalk] SA header and scoring inconsistent

2003-10-21 Thread Theo Van Dinter
On Mon, Oct 20, 2003 at 01:16:12PM -0400, newsletters wrote: summary as the main message. However, in the header it doesn't have the same score as the scoring summary. This means the message is being scanned twice. -- Randomly Generated Tagline: I didn't know Allman was a stand-up comedian

Re: [SAtalk] server specs

2003-10-21 Thread Dan Wilder
On Tue, Oct 21, 2003 at 10:32:41AM -0500, Todd Schuldt wrote: SA is also file IO intensive. It depends on your hard drive system for the file IO as well - using IDE or SCSI or SAN? Hard or soft RAID? If hardware RAID what cache size and what mode 0, 1, 5, 10, 50? What drive speed? Also

Re: [SAtalk] Re: Swap Space

2003-10-21 Thread Patrick Morris
Kris Deugau wrote: I found that even this wasn't lightweight enough on the filter server I'm adminning, so I wrote a microprogram to use the load average instead. Ideally, this should be hacked into sendmail itself in some way; I'm not going there myself. I *might* poke it into procmail if I

RE: [SAtalk] sa-learn ? postfix SA protecting Exchange server

2003-10-21 Thread Dan Kohn
This is a common enough header from all the Exchange servers out there that it should not be acting as a spam or ham indicator. So, I wouldn't worry about it. From: [EMAIL PROTECTED] on behalf of Mike Schrauder Sent: Tue 2003-10-21 5:13 To: [EMAIL PROTECTED]

RE: [SAtalk] CGI script for whitelisting?

2003-10-21 Thread Larry Gilson
About a year and a half ago I was on a quest to find a management panel for an Email gateway. I never found one but what I did find was Webmin (http://www.webmin.com/). Webmin is a web-based interface for system administration for Unix. It is entirely written in Perl/CGI. The base uses a

[SAtalk] dcc returns letters not numbers. docs say to limit #'s

2003-10-21 Thread Arlo Gilbert
I'm hopeful that somebody can explain the dcc results to me. i understand the concept of dcc, however spamassassin docs say that you should set limits that are numeric. eg. so that dcc doesnt give false positives. upon looking at the headers however, i see the following: X-Spam-DCC:

[SAtalk] Score less than needed anda marked as spam

2003-10-21 Thread Listas - OPEN Internet
Hi there, Wi some messages under score are marked as spam sometimes? Thank´s any help. Gustavo --- This SF.net email is sponsored by OSDN developer relations Here's your chance to show off your extensive product knowledge We

RE: [SAtalk] How BIG are 'auto-whitlist' files supposed to get?

2003-10-21 Thread Ian Douglas
Charles Gregory wrote: When we first started using SA, I kept a casual eye on the personal files in .spamassassin, and did not see anything particularly problematic, but NOW I see auto-whitelist and 'bayes' files that are exceeding 1MB in size, each. Is this 'normal'? Any permission

Re: [SAtalk] list of test gone

2003-10-21 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Matt Kettler writes: At 10:39 AM 10/21/2003, Cliff Browning wrote: I went to the spamassassin.org site today and the list of tests is not there. Could you please put it back. Thanks Seems to be there and just fine for me... It's possible