Recently, one of the idiot tags by some ratware have been using the
X-Originating-IP: header in the style of [somdhost.comIP] or similar. Which
got me to writing the following:
header __HAS_XOIP exists:X-Originating-IP
describe __HAS_XOIP Header contains
Hi all,
I'm using SA 1.61 postfix 2.0.16 on a Debian woody box. I want to
test it on
a site with about 150 mails per minute. I tested it for a few
minutes, but
from 410 mails only 385 are scanned from spamd. None are skipped due
to the size.
I used the config from Security Sage.
spamd is
Thanks for the tips - but the problem persists ...
| System is configured to use the spamd interface to spamassassin. If I
you really shouldnt be passing mails back and forth since the whole
point of amavisd would be to do direct library calls, its far more
efficient..
I've killed spamd.
I upgraded from 2.60 to 2.61 and I am getting many false positives. It
seems that Bayes is pushing it with a score of 5.4. What are people to
do to get around this? Do you set Bayes for a lower score? Do you
disable? Thanks!
5.4 BAYES_99 BODY: Bayesian spam probability is 99 to
Hello,
I am having a weird problem with spamassassin missing messages
completely. Spamd logs that it accepted the mail to syslog but it does
not add any headers. This has been happening a lot lately (20x a day or
so) and I am unsure if it is an error in my setup or a problem with
spamassassin. SA
Good
morning and happy holidays everyone!
Im
running spamd + vpopmail + qmailscanner + mysql + clamuko. I have a problem
where every once in a while hundreds of spamd processes are spawning. It absolutely
crushes the server. I have determined it is not because of any large lists
being
Hello! Having used spamassassin as installed at my ISP, I now want to install
spamassassin at home. I log into my new ISP using a mail client at home, but
spamassassin doesn't work (the .forward file does not work). Does
spamassassin only work on mail servers? Or, can I use it with my mail
To Spamassassin:
My publication is double-opted in by 15,000 families with children with
autism. We are routinely victimized by incompetent software like
spamassassin because of false positives. This is just as intolerable as
spam. It is worse than spam because it victimizes the innocent in
I'm trying to devise a rule that would get tripped if an email had a
specific domain in the To or Cc fields and was not addressed *only* to
me. For example, let's say my email address was [EMAIL PROTECTED]
These emails would trip the rule:
To: [EMAIL PROTECTED]; [EMAIL PROTECTED]; [EMAIL
Start spamd with the argument -m 20, that maximizes the
concurrently spawned instances to 20.
/robert
From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
Michael P. VarreSent: Freitag, 26. Dezember 2003
16:23To: [EMAIL PROTECTED]Subject:
[SAtalk] hundreds of spamd processes
Yow, how am I supposed to stop spam like this? There isn't anything to filter
on except the word 'adult'. I guess 'rape' works as well.. But I'm not really
inclined to filter messages with the word rape in them, nor give them a 3+ score.
Ideas?
Alex
- Forwarded message from Nata Pofigen
At 03:37 PM 12/26/2003, you wrote:
Yow, how am I supposed to stop spam like this? There isn't anything to filter
on except the word 'adult'. I guess 'rape' works as well.. But I'm not really
inclined to filter messages with the word rape in them, nor give them a 3+
score.
When's the last legit
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Joey Netterville wrote:
i'm running spamassassin and it works wonderfully on new, incoming email.
i'm an administrator hoping to implement this on my machine and give users
the ability to start filtering their email. is it possible to run
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Hello out there...
I noticed that sa-learn sometimes is a bit too slow for my needs.
I call sa-learn via:
/usr/bin/sa-learn --no-rebuild --spam mailfile
To speed the call itself up, I think about writing a script that loads
the mailfile into RAM,
Hi,
I don't know how this message got copied multiple times to
the list, I certainly only sent it once... I'm sorry for the
inconvenience...
Anyway, is there an address I can send a tarbal with a
bunch of these messages? I keep getting spam which SA
(using 2.60) consistently scores
You
On Tue, 23 Dec 2003 17:00:20 -0500 Padmanabha Vegesna [EMAIL PROTECTED] wrote:
I am the system administrator for my company. We are in the process of
creating an autoresponder and are willing to download the SpamAssassin
for the spam filter for the email sent through the autoresponder.
My
The email below originated from a dynamic IP address, but was sent via a
normal relay. However, the origin IP address triggered some RBL checks
that I don't think it should have. Specifically, the RCVD_IN_DYNABLOCK
check. Note that 192.168.10.250 is a local (within the LAN) relay.
Also the email
I upgraded from 2.60 to 2.61 and I am getting many false positives. It
seems that Bayes is pushing it with a score of 5.4. What are people to
do to get around this? Do you set Bayes for a lower score? Do you
disable? Thanks!
5.4 BAYES_99 BODY: Bayesian spam probability is 99 to
On Fri, 2003-12-26 at 02:00, schafer wrote:
[...]
Exhibit:
Start SpamAssassin results
7.10 points, 5.5 required;
[...]
* 3.0 -- BODY: Bayesian classifier says spam probability is 99 to 100%
[score: 0.9988]
[...]
* -4.3 -- AWL: Auto-whitelist adjustment
End of SpamAssassin
To Spamassassin:
Who is this 'SpamAsassin' you're writing to ?
My publication is double-opted in by 15,000 families with children with
autism. We are routinely victimized by incompetent software like
spamassassin because of false positives.
Whoa, steady on there... not a good start to your
At 11:00 PM 12/25/2003, you wrote:
My publication is double-opted in by 15,000 families with children with
autism. We are routinely victimized by incompetent software like
spamassassin because of false positives. This is just as intolerable as
spam. It is worse than spam because it victimizes
Hello Ricardo,
Saturday, December 27, 2003, 11:16:44 AM, you wrote:
RK I sent a message last week but I guess for some reason it didn't get
RK properly distributed, maybe because I attached a tarball with some
RK copies of the spam messages.
Could be. The sourceforge list system has a relative
At Sun Dec 28 17:55:46 2003, Ricardo Kleemann wrote:
I don't know how this message got copied multiple times to
the list, I certainly only sent it once... I'm sorry for the
inconvenience...
Sometime sourceforge's mail servers do misbehave like this.
Anyway, is there an address I can send
On Thu, 25 Dec 2003 23:00:14 -0800 schafer [EMAIL PROTECTED] wrote:
To Spamassassin:
My publication is double-opted in by 15,000 families with children with
autism. We are routinely victimized by incompetent software like
spamassassin because of false positives. This is just as
On Thu, Dec 25, 2003 at 11:00:14PM -0800, schafer
carved this out of pure phosphors:
To Spamassassin:
My publication is double-opted in by 15,000 families with children with
autism. We are routinely victimized by incompetent software like
spamassassin because of false positives. This is
-Original Message-
From: Joey Netterville
Sent: Friday, December 26, 2003 12:44 PM
i'm running spamassassin and it works wonderfully on new, incoming email.
i'm an administrator hoping to implement this on my machine and give users
the ability to start filtering their email. is it
For BigEvil_191, add 53x.com. Looks like the RND_UC_CHAR ratware is now
using this variant for its images.
---
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
At 15:11 28/12/2003 -0500, David A. Roth wrote:
On Sunday, December 28, 2003, at 01:40 PM, Simon Byrnand wrote:
I upgraded from 2.60 to 2.61 and I am getting many false positives. It
seems that Bayes is pushing it with a score of 5.4. What are people to
do to get around this? Do you set Bayes
Hi,
Can anyone tell me how to use the --remove-markup command in SA? I have
a whole folder of spam and I'd like to remove the SA markups so that I
can use this with sa-learn (next time my bayes DB goes awol..)
Also, I've got passed the 200 spams breakpoint for bayes but now it
seems that I
At 01:25 PM 12/28/2003, you wrote:
Hi,
Can anyone tell me how to use the --remove-markup command in SA? I have
a whole folder of spam and I'd like to remove the SA markups so that I
can use this with sa-learn (next time my bayes DB goes awol..)
Can't help you there, but...
Also, I've got
I do not know if this is the right place to complain as I could not find an
email address that offers feedback to the company. This arrogance stinks,
too. As if software developers don't need public feedback about their junky
products.
Someone needs to put a shotgun to this morons head
and pull
On Fri, Dec 26, 2003 at 06:37:34PM -0500, Alex J. Avriette wrote:
Yow, how am I supposed to stop spam like this? There isn't anything to filter
on except the word 'adult'. I guess 'rape' works as well.. But I'm not really
inclined to filter messages with the word rape in them, nor give them a
On Sun, 28 Dec 2003 23:38:15 +0200 cami [EMAIL PROTECTED] wrote:
I do not know if this is the right place to complain as I could not find an
email address that offers feedback to the company. This arrogance stinks,
too. As if software developers don't need public feedback about their
Hello,
I am having a weird problem with spamassassin missing messages
completely. Spamd logs that it accepted the mail to syslog but it does
not add any headers. This has been happening a lot lately (20x a day or
so) and I am unsure if it is an error in my setup or a problem with
On Sun, Dec 28, 2003 at 05:56:01PM -0500, Chris Tracy wrote:
Hello,
I am having a weird problem with spamassassin missing messages
completely. Spamd logs that it accepted the mail to syslog but it does
not add any headers. This has been happening a lot lately (20x a day or
so) and I am
Hi,
I just don't get this. Again this morning I look at my Bayes database and
it has gone from 1600+ spam emails known down to 6 and so it is no longer
active in SA.
It did this about 2 weeks ago as well. No error messages reported
anywhere that I can find, it just forgets all the spam emails!
-- Forwarded message --
Date: Sun, 28 Dec 2003 19:07:34 -0500 (EST)
From: Christopher X. Candreva [EMAIL PROTECTED]
To: schafer [EMAIL PROTECTED]
Subject: Re: [SAtalk] False positives
On Thu, 25 Dec 2003, schafer wrote:
To Spamassassin:
My publication is double-opted in by
Peter Kiem wrote:
header LOCAL_GOOD_SENDER_11 From =~ /[EMAIL PROTECTED]/
score LOCAL_GOOD_SENDER_11 -2.0
Return-Path: [EMAIL PROTECTED]
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Why isn't the local rule being activated?
Just a guess ... because the From address is not
[EMAIL PROTECTED]?
At Sun Dec 28 21:33:40 2003, Evan Platt wrote:
Also, I've got passed the 200 spams breakpoint for bayes but now it
seems that I need 200 hams also before bayes will kick in. here's a
fragment from my procmail file
Well, kind of. You generally need a equal number of hams to spams for it to
Just a guess ... because the From address is not
[EMAIL PROTECTED]?
I thought the from rule worked on the envelope sender of the email and not
the easily forged from header :(
You might try dropping the [EMAIL PROTECTED] part of the rule and you might
have better luck.
Yeah I might do that.
On Mon, Dec 29, 2003 at 10:44:24AM +1000, Peter Kiem wrote:
Just a guess ... because the From address is not
[EMAIL PROTECTED]?
I thought the from rule worked on the envelope sender of the email and not
the easily forged from header :(
You might try dropping the [EMAIL PROTECTED] part
Peter Kiem [EMAIL PROTECTED] wrote:
I thought the from rule worked on the envelope sender of the email and not
the easily forged from header :(
What makes you think the envelope sender isn't easily forged?
--
Keith C. Ivey [EMAIL PROTECTED]
Washington, DC
Preferably not as if someone does forge it, then the mail goes straight
through...
Isn't that what whitelist_from_rcvd is for? man Mail::SpamAssassin::Conf
The point is I *DON'T* want to whitelist. I wanted just to lower the SA
scores with a local rule.
--
Regards,
What makes you think the envelope sender isn't easily forged?
OK point taken, but from what I have seen the From headers are *usually*
what are forged and not the envelope address.
--
Regards,
+-+-+
| Peter Kiem.^. |
On Mon, 29 Dec 2003, Peter Kiem wrote:
Hi,
I'm trying to add local rules to allow certain senders that always get
caught by SA to lower their scores and give them a better chance of
getting through.
The rule I added was
header LOCAL_GOOD_SENDER_11 From =~ /[EMAIL PROTECTED]/
score
On Mon, 29 Dec 2003, Peter Kiem wrote:
Preferably not as if someone does forge it, then the mail goes straight
through...
Isn't that what whitelist_from_rcvd is for? man Mail::SpamAssassin::Conf
The point is I *DON'T* want to whitelist. I wanted just to lower the SA
scores with a
Hi David,
So you either need to change your rule to match the header from address or
code it to look for the envelope from address.
What is the rule for matching envelope from address?
--
Regards,
+-+-+
| Peter Kiem.^.
At Mon Dec 29 01:30:45 2003, Peter Kiem wrote:
What makes you think the envelope sender isn't easily forged?
OK point taken, but from what I have seen the From headers are *usually*
what are forged and not the envelope address.
Spammers don't want any trace back to them, and they don't
Hi David,
Actually, 'whitelist_from_rcvd' is the way to go, as it will only apply
if -both- the From address and the DNS host name of the sending system
match the rule. However looking back at your first post I see that the
DNS reverse map for the 'sneezy' system is FUBAR, so you cannot use
1. Chill ...
2. Your mail was flagged primarily because of it's HTML nature... There are
many online resources and guidelines that can help you write newsletters.
Google for them.
3. Your complains are ill-directed, becuase SA is not responsible for your
receivers CHOOSING to filter out
skumm wrote:
How and where do i modify the rules relating to html in the message body?
If it is there period i want marked as spam, so I want to change it's
weight to something like 10 if html exists in the message
In the beginning, techies designed spamassassin for themselves and
HTML
No. You *do* need a minimum of 200 hams. The reason behind this is
that for Bayes to work, it needs to know *both* what spam looks like
*and* what ham looks like so it can tell the difference.
But yes, it is best to have a vaguely equal number of both ham and
spam (but you can easily
Hello Simon,
Sunday, December 28, 2003, 7:51:15 PM, you wrote:
No. You *do* need a minimum of 200 hams. The reason behind this is
that for Bayes to work, it needs to know *both* what spam looks like
*and* what ham looks like so it can tell the difference.
But yes, it is best to have a
schafer wrote:
To Spamassassin:
My publication is double-opted in by 15,000 families with children with
autism. We are routinely victimized by incompetent software like
spamassassin because of false positives. This is just as intolerable as
spam. It is worse than spam because it victimizes
Hello Lenny
Lenny Schafer wrote:
To Spamassassin:
I am one of the users of Spamassassin. As with many things in the
free software world it is a team effort and anyone who takes the time
and effort to contribute are part of that team. Which means you often
won't find any particular person who
Hi
I cannot get spamd to use user_prefs when running spamd -d -a -c -L
--user-config as root (v 2.61, suse9). It insists on the global settings.
Here is the user_prefs file:
rewrite_subject 1
report_header 1
defang_mime 0
razor_timeout 0
use_bayes 1
required_hits 4.5
Is there something I'm
56 matches
Mail list logo
