Re: [SAtalk] sa-learn ... R/W: tie failed!

2003-12-10 Thread AthlonRob
On Wed, 2003-12-10 at 21:41, David B Funk wrote: > Hate to say it, but it looks like your database is hosed. Well that's no fun. :-) > Permissions are OK, it's looking at the correct files, locks are good, > etc. Ok... > those 'File Exists' errors indicate that the DB_File library found >

[SAtalk] Re: One persistent spammer defeating SA.

2003-12-10 Thread Bryan Hoover
[EMAIL PROTECTED] wrote: > /^Reply-to:\s*(<[-a-z0-9_.]+\@([-a-z0-9_]+\.)+[a-z]+>)\s+\1/i > > Underscore is not technically valid in a domain name but you do see > them in practice anyway. > > I'm not sure this is any better than what I originally posted, as I > haven't tested this properly. My

Re: [SAtalk] META: Does spamassassin-talk have a working mail archive?

2003-12-10 Thread Pedro Sam
On December 11, 2003 01:09 am, Bob Apthorpe wrote: > After spending tireless minutes directing people to the SA-Talk > archives[1], I can't seem to get at them. Does > http://sourceforge.net/mailarchive/forum.php?forum=spamassassin-talk > work, and if not, is there a better place to peruse the arch

Re: [SAtalk] META: Does spamassassin-talk have a working mail archive?

2003-12-10 Thread Peter Kiem
Hi, > work, and if not, is there a better place to peruse the archives? Try http://marc.theaimsgroup.com/?l=spamassassin-talk&r=1&w=2 -- Regards, +-+-+ | Peter Kiem.^. | E-Mail: <[EMAIL PROTECTED]> | | Zordah IT

Re[2]: [SAtalk] Obfuscation by Punctuation

2003-12-10 Thread Robert Menschel
Hello Justin, Wednesday, December 10, 2003, 12:51:28 PM, you wrote: J> On Wed, 10 Dec 2003, Christopher Kunz wrote: >> What is the typical half-life of a spam domain? As far as I can recall >> from my brief glimpses at the stuff in my spam folders, I have never >> seen that a domain was spamver

[SAtalk] Re: [RD] raw/rare/folded/plain/alphed body/subject rende ring streams

2003-12-10 Thread era
On Wed, 10 Dec 2003 15:28:27 -0600, SpamTalk <[EMAIL PROTECTED]> posted to spamassassin-talk: >> Note that numbers are sometimes substituted for letters. >> [SNIP] This argues for phoneming and/or spell-checking before ALPHA-ing. > I figured just stripping them would be best, or with maybe an ad

[SAtalk] META: Does spamassassin-talk have a working mail archive?

2003-12-10 Thread Bob Apthorpe
Hi, After spending tireless minutes directing people to the SA-Talk archives[1], I can't seem to get at them. Does http://sourceforge.net/mailarchive/forum.php?forum=spamassassin-talk work, and if not, is there a better place to peruse the archives? Just covering all my bases here... -- Bob [1]

[SAtalk] Re: spamassassin procmail

2003-12-10 Thread era
On Wed, 10 Dec 2003 11:58:12 -0700, Daniel Kaliel <[EMAIL PROTECTED]> posted to spamassassin-talk: > ya it exsists. After no luck in the searches, I did try to join a procmail > user group, however after there server is rejecting all my attempts to join. > So I thought to try here, in the hopes

Re: [SAtalk] sa-learn ... R/W: tie failed!

2003-12-10 Thread David B Funk
On Wed, 10 Dec 2003, AthlonRob wrote: > On Wed, 2003-12-10 at 19:50, Adam Denenberg wrote: > > in the same directory as the bayes DB files. > > Unfortunately, there are no .lock files in that directory. > > [EMAIL PROTECTED]:~/.spamassassin$ sa-learn --rebuild -DD > debug: Final PATH set to: /usr

[SAtalk] Re: rule match counting

2003-12-10 Thread era
On Wed, 10 Dec 2003 11:38:59 -0500, Stephen M. Przepiora <[EMAIL PROTECTED]> posted to spamassassin-talk: > Almost all spam comes through with a url to click on, or a url to load > an image from. Most spammers have multiple domains they use, and > rotate through them. We match these domains and

Re: [SAtalk] Writing a DNSBL rule for both SPEWS levels

2003-12-10 Thread David B Funk
On Wed, 10 Dec 2003, Matt Kettler wrote: > At 02:08 PM 12/10/2003, Justin wrote: > >So that's how check_rbl and check_rbl_sub work? I always wondered about > >that. So what happens if an IP exists in two subzones at the same time? > > With SORBS, it's done by returning multiple results for a sin

Re: [SAtalk] sa-learn ... R/W: tie failed!

2003-12-10 Thread Matt Kettler
At 07:17 PM 12/10/03 -0800, AthlonRob wrote: Cannot open bayes databases /var/amavis/.spamassassin/bayes_* R/O: tie failed: ... Where might the lock files be? Try /var/amavis/.spamassassin/bayes*.lock --- This SF.net email is sponsored by: IB

Re: [SAtalk] sa-learn ... R/W: tie failed!

2003-12-10 Thread AthlonRob
On Wed, 2003-12-10 at 19:50, Adam Denenberg wrote: > in the same directory as the bayes DB files. Unfortunately, there are no .lock files in that directory. [EMAIL PROTECTED]:~/.spamassassin$ sa-learn --rebuild -DD debug: Score set 0 chosen. debug: running in taint mode? yes debug: Running in tai

Re: [SAtalk] sa-learn ... R/W: tie failed!

2003-12-10 Thread Adam Denenberg
in the same directory as the bayes DB files. adam - Original Message - From: "AthlonRob" <[EMAIL PROTECTED]> To: "Justin Mason" <[EMAIL PROTECTED]> Cc: <[EMAIL PROTECTED]> Sent: Wednesday, December 10, 2003 10:17 PM Subject: Re: [SAtalk] sa-learn ... R/W: tie failed! > On Wed, 2003-12-

Re: [SAtalk] sa-learn ... R/W: tie failed!

2003-12-10 Thread AthlonRob
On Wed, 2003-12-10 at 19:11, Justin Mason wrote: > > [EMAIL PROTECTED]:~/.spamassassin$ sa-learn --rebuild > > Cannot open bayes databases /var/amavis/.spamassassin/bayes_* R/O: tie failed: > > Cannot open bayes databases /var/amavis/.spamassassin/bayes_* R/W: tie failed: > > File exists > > Cann

Re: [SAtalk] sa-learn ... R/W: tie failed!

2003-12-10 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 AthlonRob writes: > Hello list- > > I've been using SA for a while, including the bayes stuff, training it > with sa-learn every few weeks on the latest spam samples and ham I > happen to have received. > > I just did... a root oops. > > I was runn

[SAtalk] sa-learn ... R/W: tie failed!

2003-12-10 Thread AthlonRob
Hello list- I've been using SA for a while, including the bayes stuff, training it with sa-learn every few weeks on the latest spam samples and ham I happen to have received. I just did... a root oops. I was running known spam mails through a script which does a sa-learn --single --spam on the t

Re: [SAtalk] DB_File problem prevents Bayes working

2003-12-10 Thread Theo Van Dinter
On Wed, Dec 10, 2003 at 05:40:49PM -0800, Fred Bennett wrote: > version.c:30:16: db.h: No such file or directory > > Now I'm at a loss. It's probably staring me right in the face, but being > a Linux/Spamassassin/CPAN noob and a tired, fried one at that, I don't > see what should be tried next. So

Re: [SAtalk] Using dccifd instead of dccproc

2003-12-10 Thread Bill Landry
It's pretty straight forward, just make sure that the config options point to the correct directory and file locations for your setup. If you have specific questions after you have done this, let me know. Bill - Original Message - From: "Smart,Dan" <[EMAIL PROTECTED]> To: <[EMAIL PROTEC

[SAtalk] DB_File problem prevents Bayes working

2003-12-10 Thread Fred Bennett
Hello. My first post here, so be gentle ;-) I got Spamassassin 2.61 installed and it's working. Bayes is enabled, but when I try to train it or do anything with sa-learn I get something like this: Use of uninitialized value in numeric lt (<) at /usr/lib/perl5/site_perl/5.8.1/Mail/SpamAssassin/Baye

RE: [SAtalk] [RD] raw/rare/folded/plain/alphed body/subject rendering streams

2003-12-10 Thread Bob Apthorpe
On Wed, 10 Dec 2003, Gary Funck wrote: > Soundex might be a practical solution. Perhaps a manageable approach > is to first apply a spelling check using both a regular dictionary > and augmenting it with a set of spammer mis-spellings. Then, send the > output of that step into Soundex. The Soundex

Re: [SAtalk] Re: Bug#223399: spamassassin: not_ok_languages, no way to split Chinese

2003-12-10 Thread JRiley
> There are a number of providers that are utterly unresponsive until > someone (metaphorically) smacks them upside the head with a paving brick. That works for me. Where do we sign up? -JR --- This SF.net email is sponsored by: IBM Linux Tutor

RE: [SAtalk] [RD] raw/rare/folded/plain/alphed body/subject rendering streams

2003-12-10 Thread Gary Funck
Soundex might be a practical solution. Perhaps a manageable approach is to first apply a spelling check using both a regular dictionary and augmenting it with a set of spammer mis-spellings. Then, send the output of that step into Soundex. The Soundex is a heuristic for catching the creative alter

Re: [SAtalk] A question abouting teaching Spamassain

2003-12-10 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Matt Kettler writes: >At 06:48 PM 12/10/2003, stan wrote: >>Did I do wrong by teaching it with lots of _good_ messages? Should I reset >>it to the base rules, and start over? BTW how can I do that? > >Idealisticaly you want to train it with something

RE: [SAtalk] [RD] raw/rare/folded/plain/alphed body/subject rendering streams

2003-12-10 Thread David B Funk
On Wed, 10 Dec 2003, Gary Funck wrote: > > It might be convenient to view each these transformations as > > operating on the output of the previous. I think you were. > > By doing so, it avoids replicating the description of the > > previous phase. > > I meant to add the following sugested additio

Re: [SAtalk] A question abouting teaching Spamassain

2003-12-10 Thread Matt Kettler
At 06:48 PM 12/10/2003, stan wrote: Did I do wrong by teaching it with lots of _good_ messages? Should I reset it to the base rules, and start over? BTW how can I do that? Idealisticaly you want to train it with something "realistic" in terms of spam/ham ratio.. ie: something close to what you get

[SAtalk] A question abouting teaching Spamassain

2003-12-10 Thread stan
I installed Spamassain a couple of days ago, on a Debina machine, and at frst it seemed to work great, catching all but a few spam messages. Then I used sa-learn to teach it using hundreds of stored mails I have in my mail folders (mostly from mailing lists). Now it seesm to be missing nearly every

Re: [SAtalk] Re: Bug#223399: spamassassin: not_ok_languages, no way to split Chinese

2003-12-10 Thread Bob Apthorpe
Hi, > While gargling concrete, "Dan Jacobson" <[EMAIL PROTECTED]> spewed: > > > However, anything in language [X] is always spam, so let me ban [X] > > without having to unban every other possible language. > > Pretty Draconian. Must be nice to be able to do that. Not 'nice' but 'convenient'; I d

[SAtalk] Punctuation in text rule I sent

2003-12-10 Thread Greg Webster
Please note that the following rules that I sent earlier today... rawbody GWW_PUNCT /([a-z][:punct:][a-z])|( [A-Z][:punct:]+|[a-z])/i score GWW_PUNCT 2.0 ...was effectively untested. And I discovered a flaw fairly quickly. It also matches words like "can't" and "it's". It also has a case-insen

Re: [SAtalk] Re: Bug#223399: spamassassin: not_ok_languages, no way to split Chinese

2003-12-10 Thread JRiley
While gargling concrete, "Dan Jacobson" <[EMAIL PROTECTED]> spewed: > However, anything in language [X] is always spam, so let me ban [X] > without having to unban every other possible language. > > Pretty Draconian. Must be nice to be able to do that. My clients/customers tend to whine a little

[SAtalk] Re: Bug#223399: spamassassin: not_ok_languages, no way to split Chinese

2003-12-10 Thread Dan Jacobson
>> And what if it doesn't match any of our ok_languages? then it will >> fail, against our wishes. Can you guarantee that you know all the >> possibilities? D> I still don't understand. You don't speak 1000 languages. Most speak 3 D> or 4 at most They can add these to ok_languanges. OK, you

Re: [SAtalk] non-numeric atime in Bayes db? (SA 2.61)

2003-12-10 Thread Theo Van Dinter
On Wed, Dec 10, 2003 at 02:08:33PM -0800, Gary Funck wrote: > Are you saying it should've looked like this? > > if ((!defined($oldmagic) || $oldmagic eq "") || $atime < $oldmagic) { > $self->{db_toks}->{$OLDEST_TOKEN_AGE_MAGIC_TOKEN} = $atime; > } yeah, although my patch will be a l

RE: [SAtalk] non-numeric atime in Bayes db? (SA 2.61)

2003-12-10 Thread Gary Funck
Hi Theo. > -Original Message- > From: Theo Van Dinter [mailto:[EMAIL PROTECTED] > Sent: Wednesday, December 10, 2003 2:02 PM > To: Gary Funck > Cc: Spamassassin List > Subject: Re: [SAtalk] non-numeric atime in Bayes db? (SA 2.61) > > > On Wed, Dec 10, 2003 at 01:44:17PM -0800, Gary Fun

Re: [SAtalk] Using sa-learn in a site-wide configuration

2003-12-10 Thread William Stearns
Good afternoon, Stephen, On Wed, 10 Dec 2003, Stephen Westrip wrote: > I am trying to set up sa-learn in a site-wide configuration. I have a Red > Hat 9 server, SpamAssassin 2.61 and MIMEDefanf 2.39. I have got SA to work > fine and our spam has dropped considerably, but I would also like to use

Re: [SAtalk] non-numeric atime in Bayes db? (SA 2.61)

2003-12-10 Thread Theo Van Dinter
On Wed, Dec 10, 2003 at 01:44:17PM -0800, Gary Funck wrote: > Follow-up, adding a check to see if $oldmagic is "" made the complaints > go away: > >1248 my $oldmagic = > $self->{db_toks}->{$OLDEST_TOKEN_AGE_MAGIC_TOKEN}; >1249 $oldmagic = 0 if (defined($oldmagic) && $oldmagic eq ""

RE: [SAtalk] Using sa-learn in a site-wide configuration

2003-12-10 Thread Stephen Westrip
Yes, the DB_File Perl module has been installed. If I run a sa-learn --dump I get this output; 0.000 0 2 0 non-token data: bayes db version 0.000 0 0 0 non-token data: nspam 0.000 0 0 0 non-token data: nham 0.000

RE: [SAtalk] [RD] raw/rare/folded/plain/alphed body/subject rende ring streams

2003-12-10 Thread SpamTalk
>This paragraph suggests that the spelling transformation would >proceed the ALPHED transformation. Probably would have to be a fork rather than pipe, once it was phonemed, I would think it would be hard to get back into recognizable English. Then again that's what IBM ViaVoice and Dragon Dictate

RE: [SAtalk] non-numeric atime in Bayes db? (SA 2.61)

2003-12-10 Thread Gary Funck
> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Gary > Funck > Sent: Wednesday, December 10, 2003 8:49 AM > To: Spamassassin List > Subject: [SAtalk] non-numeric atime in Bayes db? (SA 2.61) > > > > Hello, > > after running a spam refiling script which

Re: [SAtalk] Obfuscation by Punctuation

2003-12-10 Thread Chris Thielen
Brad Wilkin said: > I seem to have a rash of spam lately that gets by SA because the subject > line > and/or body of the message contains spam phrases but words have been > obfuscated by > inserting semicolons, periods and other punctuation or special characters. > In > somes cases, the punctuatio

Re: [SAtalk] RE: [RD] Obfuscation by Punctuation

2003-12-10 Thread Chris Thielen
Gary Funck said: > Question to the group: what's the procedure for running the rules against > the > spam/ham samples to come up wiht hit frequencies? mass-check in the masses directory of the SpamAssassin source archive (methinks) -- Chris Thielen Easily generate SpamAssassin rules to catch ob

RE: [SAtalk] [RD] raw/rare/folded/plain/alphed body/subject rende ring streams

2003-12-10 Thread SpamTalk
>It might be convenient to view each these transformations as operating on the output of the previous. Indeed, I was. Elegance + Efficiency + Functionality = GoodCode(TM) >Note that numbers are sometimes substituted for letters. >[SNIP] This argues for phoneming and/or spell-checking before ALP

RE: [SAtalk] [RD] raw/rare/folded/plain/alphed body/subject rendering streams

2003-12-10 Thread Gary Funck
> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Gary > Funck > Sent: Wednesday, December 10, 2003 1:09 PM > To: [EMAIL PROTECTED] > Subject: RE: [SAtalk] [RD] raw/rare/folded/plain/alphed body/subject > rendering streams > > > > > > -Original M

RE: [SAtalk] [RD] raw/rare/folded/plain/alphed body/subject rende ring streams

2003-12-10 Thread SpamTalk
>>FOLDED set all lowercase >> Remove HTML >> punctuation to be underscore, >Why on earth do you want to "set all lowercase"? I guess folding the case might be overkill in the "simplification" process. As a matter of curiosity, does the objection extend to doing

RE: [SAtalk] [RD] raw/rare/folded/plain/alphed body/subject rendering streams

2003-12-10 Thread Gary Funck
> -Original Message- > From: SpamTalk > Sent: Wednesday, December 10, 2003 12:49 PM > > It would seem to me that, for purposes of rule simplification, that the > subject and body of messages to be scanned should be available in > pre-processed flavors, some of which is currently availabl

Re: [SAtalk] Obfuscation by Punctuation

2003-12-10 Thread Justin
On Wed, 10 Dec 2003, Christopher Kunz wrote: > What is the typical half-life of a spam domain? As far as I can recall > from my brief glimpses at the stuff in my spam folders, I have never > seen that a domain was spamvertised in two different spam runs. I have a 15,000 entry list of spamming d

Re: [SAtalk] [RD] raw/rare/folded/plain/alphed body/subject rendering streams

2003-12-10 Thread Matt Kettler
At 03:48 PM 12/10/2003, SpamTalk wrote: FOLDED set all lowercase Remove HTML punctuation to be underscore, Why on earth do you want to "set all lowercase"? Every regex in the ruleset can be set to case sensitve or insensitve on it's own, so this adjustment only m

Re: [SAtalk] Writing a DNSBL rule for both SPEWS levels

2003-12-10 Thread Justin
On Wed, 10 Dec 2003, Matt Kettler wrote: > At 02:08 PM 12/10/2003, Justin wrote: > >So that's how check_rbl and check_rbl_sub work? I always wondered about > >that. So what happens if an IP exists in two subzones at the same time? > > With SORBS, it's done by returning multiple results for a si

Re: [SAtalk] sa-learn mbox processing?

2003-12-10 Thread William Stearns
Good afternoon, Kris, On Wed, 10 Dec 2003, Kris Deugau wrote: > William Stearns wrote: > > You should use _bounce_ or _redirect_, instead. > > Which, unfortunately, adds some new headers with most MUAs. :( Along > with the extra set of Received: headers that go along with sending a > message

[SAtalk] [RD] raw/rare/folded/plain/alphed body/subject rendering streams

2003-12-10 Thread SpamTalk
It would seem to me that, for purposes of rule simplification, that the subject and body of messages to be scanned should be available in pre-processed flavors, some of which is currently available. Assume the spam key is some thing like that Vuhee drug, V=P i=o e=a n=g s=r u=a (i.e. Poensu) RAW

Re: [SAtalk] sa-learn mbox processing?

2003-12-10 Thread Kris Deugau
William Stearns wrote: > You should use _bounce_ or _redirect_, instead. Which, unfortunately, adds some new headers with most MUAs. :( Along with the extra set of Received: headers that go along with sending a message (which you could probably work around). The only way I've seen to get a mes

RE: [SAtalk] Help with Mark Motley's perl script - part2

2003-12-10 Thread Lentz, Wayne
>-Original Message- >From: Lentz, Wayne > >So I tried that and it helped as the script now runs, but it does't pull any >messages off Exchange. It reports that it pulled 1 message, and does create >an empty file named "1" in /var/amavisd/spam. It produces these results >regardless of how

[SAtalk] RE: [RD] Obfuscation by Punctuation

2003-12-10 Thread Gary Funck
> -Original Message- > From: Greg Webster > Sent: Wednesday, December 10, 2003 11:45 AM > > > Here's what I've recently done: > rawbody GWW_PUNCT /([a-z][:punct:]+[a-z])|( [A-Z][:punct:]+[a-z])/i > score GWW_PUNCT 2.0 > > It's not perfect, but it does the job. I think that pattern is g

Re: [SAtalk] Writing a DNSBL rule for both SPEWS levels

2003-12-10 Thread Matt Kettler
At 02:08 PM 12/10/2003, Justin wrote: So that's how check_rbl and check_rbl_sub work? I always wondered about that. So what happens if an IP exists in two subzones at the same time? With SORBS, it's done by returning multiple results for a single query. host 138.81.106.218.dnsbl.sorbs.net 138.81

Re: [SAtalk] Obfuscation by Punctuation

2003-12-10 Thread Christopher Kunz
Greg Webster wrote: Here's what I've recently done: rawbody GWW_PUNCT /([a-z][:punct:]+[a-z])|( [A-Z][:punct:]+[a-z])/i score GWW_PUNCT 2.0 It's not perfect, but it does the job. As well, I've noticed a lot of these include the domain 'doctor45.com', so I've been giving a good high score for th

RE: [SAtalk] Obfuscation by Punctuation

2003-12-10 Thread Greg Webster
Here's what I've recently done: rawbody GWW_PUNCT /([a-z][:punct:]+[a-z])|( [A-Z][:punct:]+[a-z])/i score GWW_PUNCT 2.0 It's not perfect, but it does the job. As well, I've noticed a lot of these include the domain 'doctor45.com', so I've been giving a good high score for that one. Greg --

Re: [SAtalk] Obfuscation by Punctuation

2003-12-10 Thread Christopher Kunz
Fred wrote: That's a fake header name with your e-mail address encoded with base64. I guessed it is some spam devilry. Actually, I don't care if harvesters pick up this address, it's also under SA monitoring :-) Add the following rule to your local.cf and you will never see those again ;) Isn't h

Re: [SAtalk] Obfuscation by Punctuation

2003-12-10 Thread Fred
Christopher Kunz wrote: > BTW: What kind of header is this? > > X-Ki: > > --ck That's a fake header name with your e-mail address encoded with base64. Un-base64 that and you get: [EMAIL PROTECTED] I munged most of it for your protection, but having that encoding here is enough to give your addr

Re: [SAtalk] Writing a DNSBL rule for both SPEWS levels

2003-12-10 Thread Justin
On Wed, 10 Dec 2003, Matt Kettler wrote: > At 01:39 PM 12/10/2003, Justin wrote: > > Still, is there a way to > >conditionally check/skip a DNSBL rule? > > No. > > However, if there's an agregate database, you can query multiple lists at > the same time.. Currently the SORBS and OPM rules work

Re: [SAtalk] Writing a DNSBL rule for both SPEWS levels

2003-12-10 Thread Matt Kettler
At 01:39 PM 12/10/2003, Justin wrote: Still, is there a way to conditionally check/skip a DNSBL rule? No. However, if there's an agregate database, you can query multiple lists at the same time.. Currently the SORBS and OPM rules work this way.. only one DNS query is made for all the lists in t

RE: [SAtalk] Help with Mark Motley's perl script - part2

2003-12-10 Thread Lentz, Wayne
All, It was suggested off list that I remove the '<>' brackets from this section: my $server = Mail::IMAPClient->new( Server => "", User => "", Password => "", Uid => 1, Debug => 0 ); So I tried that and it helped as the script now runs, but it does't pull

Re: [SAtalk] spamassassin procmail

2003-12-10 Thread Daniel Kaliel
ya it exsists. After no luck in the searches, I did try to join a procmail user group, however after there server is rejecting all my attempts to join. So I thought to try here, in the hopes of finding a procmail guru! :) - Original Message - From: "Evan Platt" <[EMAIL PROTECTED]> To: "S

Re: [SAtalk] Obfuscation by Punctuation

2003-12-10 Thread Christopher Kunz
Gary Funck wrote: A pattern like the following: /([a-z][;][a-z]+.*){5}/i might get some traction. This has to be run after the HTML is stripped. That exact message got through here, too. Actually, it was using the whitelist_from trick to get a whopping -93.6 points, but OTOH, bayes_60 and l

RE: [SAtalk] making my own Evil rule list

2003-12-10 Thread Bret Miller
> I am pulling my example off the following url. > > http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf > > I have setup the following rule in my user_prefs file. > > uri EVILLIST_2 /\b(?:dubnh\.us)\b/i > describe EVILLIST_2 Generated EvilList_2 > score EVILLIST_2 3.0 Uri is a priveleged

Re: [SAtalk] sa-learn mbox processing? (forwarded learning)

2003-12-10 Thread Larry Starr
On Wednesday 10 December 2003 12:10 pm, Matt Kettler wrote: > At 11:32 AM 12/10/2003, Larry Starr wrote: > >My question regards scripts to ease processing of these mailboxes. Since > > the messages are forwarded, from several different Email clients > > (netscape, kmail, pine, AppleMail, etc), ext

Re: [SAtalk] sa-learn mbox processing?

2003-12-10 Thread William Stearns
Good afternoon, Larry, On Wed, 10 Dec 2003, Larry Starr wrote: > I currently have mimedefang (2.37) and spamassassin (2.60) running on a RH9 > mail gateway. > > Spamassassin is configured to block messages with a very high SA score and to > tag and pass along everything else. > > I have two a

Re: [SAtalk] spamassassin procmail

2003-12-10 Thread Evan Platt
--On Wednesday, December 10, 2003 11:44 AM -0700 Daniel Kaliel <[EMAIL PROTECTED]> wrote: > > I read through the readme and made a config change to the way procmail > and spamassassin work together, however I now get the error: > > couldn't create or rename temp file. "/var/spool/mail/il -

[SAtalk] Writing a DNSBL rule for both SPEWS levels

2003-12-10 Thread Justin
Does anyone have a DNSBL rule for SPEWS that conditionally checks both level 1 and level 2? Remember that l2 also contains l1. What I'm looking for is a way to haev SA first query l1.spews.sorbs.net. If a record exists in l1 then a score should be assigned (2 for example) and the l2 check should

[SAtalk] spamassassin procmail

2003-12-10 Thread Daniel Kaliel
I  read through the readme and made a config change to the way procmail and spamassassin work together, however I now get the error:   couldn't create or rename temp file. "/var/spool/mail/il -oi [EMAIL PROTECTED]   I have a default /etc/procmailrc with the lines   :0fw: spamassassin.lock *

[SAtalk] Re: bayes permission errors

2003-12-10 Thread Lukreme
On 07 Dec 2003, at 01:02, David B Funk wrote: You've got spamd running as the user "postfix" (that "-u postfix" command line argument). Thus the user postfix needs to have write permissions to the bayes_* files. but in that directory listing you show: 4160 -rw--- 1 user staff 5111808 Dec 4

Re: [SAtalk] rule match counting

2003-12-10 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Matt Kettler writes: >At 10:09 AM 12/10/03 -0500, Stephen M. Przepiora wrote: > >>Hello, I have constructed a huge list of rules and wish to detect how good >>they are. Is there a way to log the count of rule matches somewhere? > >if you've got a spa

Re: [SAtalk] rule match counting

2003-12-10 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Stephen M. Przepiora writes: > Hello, I have constructed a huge list of rules and wish to detect how > good they are. Is there a way to log the count of rule matches somewhere? Hi -- about time I documented this properly; should be helpful for the

RE: [SAtalk] filtering spam tagged email before hitting exchange 2000

2003-12-10 Thread Gary Smith
To comment on Bob's approach that's exactly what got me going in the Linux world... Exchagne2K. Here is my experience with Exchange 2K. This is a little off topic I just wanted to include some feedback. Here was the problem that we had (and the solution) when I started running Exchange 2K.

RE: [SAtalk] Using dccifd instead of dccproc

2003-12-10 Thread Smart,Dan
Do you have an example of how to configure the dcc_conf? The INSTALL.txt and dccifd.html offers very little on this. <> | -Original Message- | From: Bill Landry [mailto:[EMAIL PROTECTED] | Sent: Wednesday, December 10, 2003 10:50 AM | To: [EMAIL PROTECTED] | Subject: Re: [SAtalk] Us

Re: [SAtalk] Using sa-learn in a site-wide configuration

2003-12-10 Thread Matt Kettler
At 12:04 PM 12/10/2003, Stephen Westrip wrote: What exactly do I need to do to make this work? I have read lots about adding 'bayes_auto_learn 1' and other bits and pieces to put in the cf file but whatever I try the Bayes DB never gets added to. did you install DB_File? if not, bayes won't go.

Re: [SAtalk] sa-learn mbox processing? (forwarded learning)

2003-12-10 Thread Matt Kettler
At 11:32 AM 12/10/2003, Larry Starr wrote: My question regards scripts to ease processing of these mailboxes. Since the messages are forwarded, from several different Email clients (netscape, kmail, pine, AppleMail, etc), extracting the original message, for sa-learn is proving to be non-trivial.

RE: [SAtalk] Obfuscation by Punctuation

2003-12-10 Thread Gary Funck
> -Original Message- > From: Brad Wilkin > Sent: Wednesday, December 10, 2003 9:23 AM [...] > Has anyone had success writing tests that can catch this sort of > trickery? It > seems if you could come up with a level of punctuation WITHIN > words or simply > remove common punctuation from

[SAtalk] Batching files with spamc

2003-12-10 Thread Dimitar Haralanov
Hi, I was trying to find any information on batching messages with spamc and could not find anything so I am asking the list: Is it possible to batch multiple files with spamc? In other words instead of redirecting messages one at a time to spamc (spamc [options] < message) give spa

[SAtalk] making my own Evil rule list

2003-12-10 Thread Douglas Kirkland
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I am pulling my example off the following url. http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf I have setup the following rule in my user_prefs file. uri EVILLIST_2 /\b(?:dubnh\.us)\b/i describe EVILLIST_2 Generated EvilList_2 score EVI

[SAtalk] Obfuscation by Punctuation

2003-12-10 Thread Brad Wilkin
I seem to have a rash of spam lately that gets by SA because the subject line and/or body of the message contains spam phrases but words have been obfuscated by inserting semicolons, periods and other punctuation or special characters. In somes cases, the punctuation displaces a character (s*xual)

Re: [SAtalk] filtering spam tagged email before hitting exchange 2000

2003-12-10 Thread Bob Apthorpe
Hi, [N.B. Reformatted into a sensible whole. Please trim your posts, line wrap and (I know this sounds petty) please don't top post if you expect follow-ups. Thanks.] On Wed, 10 Dec 2003 09:22:06 -0600 "JRiley" <[EMAIL PROTECTED]> wrote: > From: Efren Pedroza > > On Behalf Of gentian > > > I a

[SAtalk] Using sa-learn in a site-wide configuration

2003-12-10 Thread Stephen Westrip
Dear All, I am trying to set up sa-learn in a site-wide configuration. I have a Red Hat 9 server, SpamAssassin 2.61 and MIMEDefanf 2.39. I have got SA to work fine and our spam has dropped considerably, but I would also like to use sa-learn. What exactly do I need to do to make this work? I have

RE: [SAtalk] Help with Mark Motley's perl script

2003-12-10 Thread Scott Harris
> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Lentz, Wayne > Sent: Wednesday, December 10, 2003 7:38 AM > To: '[EMAIL PROTECTED]' > Subject: [SAtalk] Help with Mark Motley's perl script > > Guys, > > I'm trying to use the perl script that M

RE: [SAtalk] non-numeric atime in Bayes db? (SA 2.61)

2003-12-10 Thread Gary Funck
> > should I try an 'sa-learn --rebuild' at this point? > > follow-up. 'sa-learn --rebuild' just printed out more of these messages: > /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/Conf.pm line 362. > Argument "" isn't numeric in numeric lt (<) at > /usr/lib/perl5/site_perl/5.8.0/Mail/Spam

Re: [SAtalk] Razor and Spamassassin vs spamc

2003-12-10 Thread Adam D. Lopresto
Are you running spamd as yourself, or as another user (nobody, or root, or whatever)? It sounds quite likely that the user your running spamd as doesn't have a ~/.razor/ set up, but your own user does. On Mon, 8 Dec 2003, Mark Norton wrote: > Any reason why I would get razor results against spam

Re: [SAtalk] Wacky postmaster whitelist questions

2003-12-10 Thread Evan Platt
--On Wednesday, December 10, 2003 10:54 AM -0500 Josh Endries <[EMAIL PROTECTED]> wrote: > I get a lot of postmaster emails, and I'm trying to whitelist them so > they aren't marked as spam. Even though many are bounces due to spam, I > would like to whitelist them so I don't miss any legit emails

Re: [SAtalk] Using dccifd instead of dccproc

2003-12-10 Thread Bill Landry
It should already be installed at /var/dcc/libexec/dccifd (depending on your ./configure parameters). All you have to do is setup the config files at /var/dcc/dcc_conf and /var/dcc/libexec/start-dccifd, then execute start-dccifd and you should be good to go. Oh, and appears to run faster in our e

[SAtalk] non-numeric atime in Bayes db? (SA 2.61)

2003-12-10 Thread Gary Funck
Hello, after running a spam refiling script which invokes 'spamassassin -r', I received the following diagnostics: /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/Conf.pm line 362. Argument "" isn't numeric in numeric lt (<) at /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/BayesStore.pm line

Re: [SAtalk] rule match counting

2003-12-10 Thread Stephen M. Przepiora
First, thanks for the reply. This method wouldn't work for us as I can not keep a copy of all mail through the server for legal reasons. What I need is a way for spamd to log the hit count for each rule as it processes the mail. This way I can prune old rules from the system (we currently run c

[SAtalk] sa-learn mbox processing?

2003-12-10 Thread Larry Starr
I currently have mimedefang (2.37) and spamassassin (2.60) running on a RH9 mail gateway. Spamassassin is configured to block messages with a very high SA score and to tag and pass along everything else. I have two accounts set up, on an internal server, for users to forward received spam, and

Re: [SAtalk] Re: Help with DCC setup for use with Spamassaian

2003-12-10 Thread stan
On Wed, Dec 10, 2003 at 01:22:23AM -0500, Bryan Hoover wrote: > stan wrote: > > Yes, I just erviewd the firewall config. It will pass all trafic > > originating on the innsied. I see that may not be a good general case, but > > it should be OK here (Small home network). > > > > BTW, I decided to t

Re: [SAtalk] rule match counting

2003-12-10 Thread Matt Kettler
At 10:09 AM 12/10/03 -0500, Stephen M. Przepiora wrote: Hello, I have constructed a huge list of rules and wish to detect how good they are. Is there a way to log the count of rule matches somewhere? if you've got a spam/ham corpus, you can test your rules using the tools in the masses/ subdirec

[SAtalk] Wacky postmaster whitelist questions

2003-12-10 Thread Josh Endries
Hey guys and gals, I get a lot of postmaster emails, and I'm trying to whitelist them so they aren't marked as spam. Even though many are bounces due to spam, I would like to whitelist them so I don't miss any legit emails. I turned bayes off because it learned these as spam. Anyway I haven't f

[SAtalk] Using dccifd instead of dccproc

2003-12-10 Thread Smart,Dan
The DCC documentation says that the dccifd interface is much more efficient than dccproc. I see from doing a spamassassin -D that it looks for it. Is there any install procedure for dccifd, and should this be the generally recommended interface for dcc? Why or why not? TIA <> --

Re: [SAtalk] SA tests performed

2003-12-10 Thread Terry Milnes
Barb Bautista wrote: Newbie question...sorry for my ignorance. What do I do with the "tests performed" available here: http://www.spamassassin.org/tests.html Could someone please explain if I should just copy this file into a .cf file in my local.cf? I am currently running SA site-wide. That's ju

Re: [SAtalk] sven and spam rule

2003-12-10 Thread Matt Kettler
At 09:48 AM 12/10/03 +0100, stephane ancelot wrote: Hi, are there any rules to avoid sven messages ? bye steph It's not really the point of SA, however Andreas Kotowicz posted a list of rules that appear to work well. My only criticism of this ruleset is that he forgot to name all the sub-rules

[SAtalk] Help with Mark Motley's perl script

2003-12-10 Thread Lentz, Wayne
Guys, I'm trying to use the perl script that Mark posted, for feeding bayes with mail in our Exchange5.5 public folders. But when I execute the script it, it gives me the error below. I know squat about perl and google isn't giving me much, so I'm hoping you guys can help me help me with this. T

Re: [SAtalk] SA tests performed

2003-12-10 Thread Matt Kettler
At 09:34 AM 12/10/03 -0500, Barb Bautista wrote: What do I do with the "tests performed" available here: http://www.spamassassin.org/tests.html Could someone please explain if I should just copy this file into a .cf file in my local.cf? I am currently running SA site-wide. Um, don't do *anything*

Re: [SAtalk] Training SA

2003-12-10 Thread Matt Kettler
At 11:45 PM 12/9/03 -0800, Justin Mason wrote: Oh yeah, forgot to mention I finally got around to migrating all the FAQ stuff onto the Wiki ;) Heh, yeah, I caused me to go "Where the heck is that FAQ link???!!!" for about 5 seconds before I saw the wiki one.. Ok, my real impressions were a little

Re: [SAtalk] Log Help!

2003-12-10 Thread Matt Kettler
At 09:58 AM 12/10/03 +0200, Ryan Lumsden wrote: how do I get spamd to log to a diffrent file besides messages and mail.log. edit your /etc/syslog.conf and use spamd's -s parameter to change what syslog facility to use. Spamd isn't writing to any files at all, it's just doing standard unix-style

Re: [SAtalk] filtering spam tagged email before hitting exchange 2000

2003-12-10 Thread JRiley
SA does have the ability to filter (block/discard) if so configured.. basically by just setting SA to delete any incoming scanned msg with a score of 5+ (default score level).   As far as setting up a whitelist, on a win32 implementation of SA,  read the SA docs, and/or visit some sites with

  1   2   >