Re: [SAtalk] no such user directories

2003-12-15 Thread Matt Kettler
At 04:57 PM 12/15/2003, [EMAIL PROTECTED] wrote: I'm using qmail, vpopmail, and SA, and I've got a catchall setup. When sending an email to [EMAIL PROTECTED], SA is creating directories in /, as /no such user [EMAIL PROTECTED]. sounds like the user_prefs directory is all screwed up... SA is

Re: [SAtalk] no such user directories

2003-12-15 Thread Matt Kettler
At 05:49 PM 12/15/2003, [EMAIL PROTECTED] wrote: When you don't specify a user for spamd to run as, does it run as nobody? I'm not specifying a user. Well, spamd will start as root, and if spamc doesn't have a user specified AND spamc is run as root, spamd will fall back to nobody. In general,

Re: [SAtalk] Another sneaky spam; anyone got a filter to snag this one?

2003-12-15 Thread Matt Kettler
At 06:48 PM 12/15/2003, Rubin Bennett wrote: When I saved this email to disk and ran it as my username on the mailserver, it scored 15.3 points. When I ran it through spamc as root, it got 9.6. Yet, the first time it came through, it scored a measley 3.7 points! What gives? Have I managed to

Re: [SAtalk] sa-learn not learning?

2003-12-15 Thread Matt Kettler
At 10:06 PM 12/15/2003, [EMAIL PROTECTED] wrote: I'm confused here. I have just installed Spamassassin on the server. I had a folder with a few spams I'd recieved and wanted to feed them to sa-learn so it would recognise these types of email as spam. But when I run sa-learn --spam --mbox spamdump

Re: [SAtalk] Clever spam (first of many, I'm afraid...)

2003-12-14 Thread Matt Kettler
At 12:47 PM 12/14/2003, Rubin Bennett wrote: The spammers are getting smarter about Bayes... this one sneaked through SA 2.6, a well trained Bayes database, and the BigEvil rules with a score of 1.0 out of 5. What to do? That's funny.. it hit BAYES_99 on mine... Admittedly I had to do a kinda

Re: [SAtalk] This is an ebay phish right?

2003-12-14 Thread Matt Kettler
At 02:40 PM 12/14/2003, Robert Nicholson wrote: Look at the body of the message and you should see a bunch of %'s in the url. You don't see them? Does your MUA allow you to look at the raw text of the message? Well, your post itself is declared to be text/plain.. When my MUA saw a html

Re: [SAtalk] Preserving Mail Format

2003-12-13 Thread Matt Kettler
At 08:56 AM 12/13/03 -0500, Frank M. Cook wrote: Sorry if this has been discussed over and over again, but I've just started to run SA and I'm not happy with the way it's mangling the tagged mail. I want it to change the subject but leave the body of the message alone. I've changed

Re: [SAtalk] SA report on an email ?

2003-12-13 Thread Matt Kettler
At 01:35 PM 12/12/2003, [EMAIL PROTECTED] wrote: How can I see a spamassassin report of an email ? I'd like to do something like pipe the email through a command. pipe it through spamassassin -t Note: -t mode FORCES sa to generate a report, and it WILL contain text declaring it to be spam, even

Re: [SAtalk] Re: Bayes database stats

2003-12-13 Thread Matt Kettler
At 02:45 PM 12/13/2003, Bryan Hoover wrote: 742753 - total number of words in it 515654 - total number of words which have been seen only once 80485 - ... twice 35325 - ... 3 times This statistics shows that most of the db us not used, just eating my hard drive (44 MB total size). Is

Re: [SAtalk] Mail::SpamAssassin::learn

2003-12-13 Thread Matt Kettler
At 06:53 PM 12/13/2003, Robert Nicholson wrote: $status = $f-learn ($mail, $id, $isspam, $forget) suggests that both $isspam and $forget are significant however it will only ever do one or the other not both. Well, forget inherently means you want to remove an entry instead of learn.. at that

Re: [SAtalk] AWL casuing false positives

2003-12-12 Thread Matt Kettler
At 01:46 PM 12/12/03 +, Peter McGarvey wrote: pts rule name description -- -- -4.9 BAYES_00 BODY: Bayesian spam probability is 0 to 1% [score: 0.] 56 AWL

Re: [SAtalk] Hit Digits

2003-12-12 Thread Matt Kettler
At 01:58 PM 12/12/03 +0100, Kai Poppe/Redaktion SDCE wrote: is there any possibility to change the digits of hit points from 1 (5.0) to 3 (5.000) that are shown in the report ? Since in the .cf files there are 3-digits hit points i would preffer to see them in the report, too... any config-line i

Re: [SAtalk] Mysterious SA tags in SPAM message?

2003-12-12 Thread Matt Kettler
At 10:53 AM 12/12/2003, Kang , Joseph S. wrote: === Anyone know how this could have happened? I'm just curious. I've NEVER seen Yahoo! tagged bulk email with SA tags. Odds are the open relay that the spammers sent the mail through was running

RE: [SAtalk] AWL casuing false positives

2003-12-12 Thread Matt Kettler
At 10:10 AM 12/12/2003, Colin A. Bartlett wrote: I have found that AWL works quite well and I keep it enabled. The only time that it is a pain is if I send myself or someone else a test using GTUBE. That f's up the AWL until I send a few hams. There's a way to remove the sender from the AWL but I

Re: [SAtalk] Mass-check corpus cleanup using included scripts. How??

2003-12-12 Thread Matt Kettler
At 09:34 AM 12/12/2003, Smart,Dan wrote: I'm assuming that the scripts: mass-check-results-to-mbox, mboxget, and extract-message-from-mbox are used to help in this process to check and purge improperly sorted mails out of the mbox. How are these used? Don't see any docs anywhere, and nothing in

Re: [SAtalk] Nested Meta Rules

2003-12-12 Thread Matt Kettler
At 11:12 AM 12/12/2003, Nayana Hettiarachchi wrote: i have made few customs rules and i was playing around with them little more and i was kinda curious if a rule like this will actually work, as per my experiment i noticed that it is not working. meta TTOFFICE_BLOCK (__TOOFFICE

Re: [SAtalk] Hit Digits

2003-12-12 Thread Matt Kettler
At 10:50 AM 12/12/2003, Kai Poppe/Redaktion SDCE wrote: Nope, mine does not. SpamAssassin 2.61 is the version. Hmm, you're right.. It looks like that rounding behavior is hard-coded.. you'd have to modify the source code to change it. ---

Re: [SAtalk] Rule Help...

2003-12-12 Thread Matt Kettler
At 02:50 PM 12/12/2003, Dan Tappin wrote: Here is a custom rule for a PayPal spoof virus that is going around. I can't get this to trigger a hit in SA. I have linted my rules and my config files are being loaded properly. Which configfile did you add your rule to? local.cf or user_prefs? Do

Re: [SAtalk] spamassassin -r: Clean Mail Before Reporting?

2003-12-12 Thread Matt Kettler
At 03:33 PM 12/12/2003, sabat wrote: The spamassassin manpage talks about setting up an alias to report spam, piping the mail to spamassassin -r. Since this reports to DCC and Razor, shouldn't one clean up the headers first? Isn't there risk of getting your own domain name into the spam report?

Re: [SAtalk] BigEvilList_170 and vnunet.com

2003-12-12 Thread Matt Kettler
At 04:06 PM 12/12/2003, Ken Gordon wrote: BigEvilList_170 catches vnunet.com. Is that appropriate? Depends on what you consider appropriate.. bigevil is autogenerated from some piles of spam. As such, it's going to be prone to FP cases. Bounce a message to Chris S and ask him to double-check

Re: [SAtalk] how it works

2003-12-12 Thread Matt Kettler
At 06:33 PM 12/12/2003, pacho baratta wrote: I have a fresh installation of SA, a default local.cf (attached) and nothing more. Now SA acts great on GTUBE test, but when I forward to my new SA protected account a spam message nothing happens. What's the trick? forwarded spam is not the same as

Re: [SAtalk] Trouble with bayesian classification and autolearn

2003-12-12 Thread Matt Kettler
At 06:37 PM 12/12/2003, J. S. Greenfield wrote: bayes_path /etc/mail/spamassassin/bayes bayes_file_mode 0666 where both the bayes_path directory, and the spamd home directory (it's parent), are owned by spamd, and world writeable, at this point, for good measure. There's

RE: [SAtalk] Rule Help...

2003-12-12 Thread Matt Kettler
At 05:10 PM 12/12/2003, Dan Tappin wrote: Hi Matt, I created in a custom .cf file in /etc/mail/spamassassin Dan Hmm, then that should work correctly... --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or

Re: [SAtalk] Trouble with bayesian classification and autolearn

2003-12-12 Thread Matt Kettler
At 08:50 PM 12/12/2003, J. S. Greenfield wrote: Thanks. I installed BerkeleyDB, DB_File, and corrected bayes_path as you indicated. No apparent change in behavior. Any other thoughts? try manual learning using sa-learn with debug mode on, see if it complains.. sa-learn -D --ham

Re: [SAtalk] Trouble with bayesian classification and autolearn

2003-12-12 Thread Matt Kettler
At 08:56 PM 12/12/2003, J. S. Greenfield wrote: Correction...it seems to be working now. Not sure why nothing happened on my first test message. Perhaps a minimum amount of content is required in the message for it to trigger autolearning? AFAIK there's no minimum content, but you need to keep

Re: [SAtalk] SA 2.61 and this annoying spammer?

2003-12-12 Thread Matt Kettler
At 09:39 PM 12/12/2003, Robert Nicholson wrote: Anybody who's installed A 2.61 Can you tell me what the score for the following email was Rather than hoping one of us has a copy of the exact same email, if you want someone to test, why not just attach a copy of the email?

Re: [SAtalk] % HTML in message-test

2003-12-12 Thread Matt Kettler
At 08:52 PM 12/12/2003, Kai Poppe wrote: I just did a nice .cf that deactivates SA's old deka-step-html-percentage tests and does a hundred tests ranging from 0% to 100% (naturally *g*). Hope you find it useful, comments appreciated ! http://www.poppe-online.de/spamassassin/55_html_perc_tests.cf

Re: [SAtalk] % HTML in message-test

2003-12-12 Thread Matt Kettler
At 02:52 AM 12/13/03 +0100, Kai Poppe wrote: Ho list ! I just did a nice .cf that deactivates SA's old deka-step-html-percentage tests and does a hundred tests ranging from 0% to 100% (naturally *g*). Hope you find it useful, comments appreciated !

Re: [SAtalk] Bayes Corpus Project

2003-12-11 Thread Matt Kettler
At 09:10 AM 12/11/03 -0500, Adam Denenberg wrote: SA List, What i want to start is a Bayes Corpus Project. I would like to be able to allow people to submit confirmed ham and/or spam to a large bayes corpus repository (or maybe just spam) where people could then download (or somehow do an

Re: [SAtalk] new user of spamassassin

2003-12-11 Thread Matt Kettler
At 11:48 AM 12/11/03 -0300, Ceva wrote: I a new user of spamassassin, so I have some doubts. I installed spamassassin at a server running FreeBSD 4.9 and sendmail. I want to know how spamassassin works. Simple.. SA exists as a mail filter.. programs call it, feed it mail, it runs some rules

Re: [SAtalk] 2.61 and DYNABLOCK, issues still?

2003-12-11 Thread Matt Kettler
At 10:04 AM 12/11/2003, Rob Mangiafico wrote: After upgrading to 2.61, we re-enabled the DYNABLOCK RBL checks. They still seem to hit on emails that I do not believe should be matching DYNABLOCK IP's. Here are a few headers they hit on: snip Email thru our server from home PC: --- Received: from

Re: [SAtalk] Running mass-check with local rules

2003-12-11 Thread Matt Kettler
At 10:57 AM 12/11/2003, Smart,Dan wrote: How do you get mass-check to use your local custom rules in local.cf and other .cf files? I usually run mass check from within the masses sub-dir of an unzipped SA tarball directory. It will automatically use ../rules/*.cf instead of

Re: [SAtalk] Training based on previously detected spam

2003-12-11 Thread Matt Kettler
At 10:21 AM 12/11/2003, Graham Borland wrote: I'm about to start training sa with spam and ham. Is it a good or bad idea to use spam which has already been detected by sa's non-trained tests, or is that a waste of time? Should I only train it with spam which is currently managing to slip through?

Re: [SAtalk] 2.61 and DYNABLOCK, issues still?

2003-12-11 Thread Matt Kettler
At 11:52 AM 12/11/2003, Rob Mangiafico wrote: ok, this one makes sense. I guess dynablock will hit on anyone who emails from their mail program and has the smtp server set to their hosted server instead of the ISP's mailserver. Will probably hit on very high % of hams as well, since most people

Re: [SAtalk] Can't locate AAAA.pm

2003-12-11 Thread Matt Kettler
At 11:46 AM 12/11/2003, Per olof Ljungmark wrote: amavisd is running chroot'ed /usr/local/libdata/perl5/site_perl/i386-openbsd/Net/DNS/RR/.pm exists on the system. But does it exist relative to the root of the chroot? --- This SF.net

Re: [SAtalk] 2.61 and DYNABLOCK, issues still?

2003-12-11 Thread Matt Kettler
At 12:06 PM 12/11/2003, Rob Mangiafico wrote: ok. For example, we are a web host, and I often email from my home PC on a cable modem utilizing the mailserver of our own dedicated server in our datacenter. If I do that, my email trips the dynablock check in SA. The header you mentioned before was

Re: [SAtalk] False positive

2003-12-11 Thread Matt Kettler
At 12:42 PM 12/11/2003, Chris Barnes wrote: I got a false positive this morning, where it looks like the main culprit was bad information in SORBS and RJABL. The sender is a local Earthlink customer. Any idea on how to get the SORBS RJABL databases fixed? Those lists that fired off are dial-up

Re: [SAtalk] Spamassassin lint errors

2003-12-11 Thread Matt Kettler
At 01:12 PM 12/11/2003, Aaron Levitt wrote: Greets everyone- Um, your SA install appears to be badly corrupted, or based on some VERY ancient version (older than 2.43). Re-install from scratch. check_for_from_to_equivalence appears to be no part of SA 2.43, 2.44, 2.50, 2.52, 2.53, 2.54, 2.55,

Re: [SAtalk] Spamassassin lint errors

2003-12-11 Thread Matt Kettler
At 01:12 PM 12/11/2003, Aaron Levitt wrote: Greets everyone- Digging a bit more, I unpacked some ancient tarballs for my collection. You're using parts of code from SA version 2.31, or older, not SA 2.55. The code you're getting errors on exists in versions 1.5, 2.0, 2.01, 2.10,2.11, 2.20,

Re: [SAtalk] False positive

2003-12-11 Thread Matt Kettler
At 02:16 PM 12/11/2003, Satya wrote: Okay, it seems to me that blocking because someone is in a dynablock is the same class as blocking because the email comes from .ru or East Asia or is in the wrong langauge. I guess I'll just start blocking all email from Earthlink (I don't know anyone there),

RE: [SAtalk] Need a rule for IE Exploit

2003-12-11 Thread Matt Kettler
At 06:03 PM 12/11/2003, [EMAIL PROTECTED] wrote: For example - I don't have an ASCII chart handy, but suppose %03 is also non-printable - a href= http://[EMAIL PROTECTED]/exploit /format/c Read this or risk legal action!!!/a Um.. the exploit doesn't work if the character is escaped with a %.. it

Re: [SAtalk] new user of spamassassin

2003-12-11 Thread Matt Kettler
At 02:46 PM 12/11/03 -0300, Ceva wrote: Thanks for your help. One last doubt. As I understod, sendmail ( procmail )calls spamassassin, but this is done automatic whem a start spamassassin? Or I must make some configuration on sendmail? You must configure your mail tools (ie: sendmail) to call SA.

Re: [SAtalk] Training SA

2003-12-10 Thread Matt Kettler
At 02:01 AM 12/10/03 -0500, kittonian wrote: Since the clients all download the mail and it becomes stored on the exchange server for the user's inbox, how exactly do I train SA to stop marking certain items? Our users are all over the place so if there's something I can setup where I can

Re: [SAtalk] Preparing a spam corpus?

2003-12-10 Thread Matt Kettler
At 08:13 AM 12/10/03 -0500, Bill wrote: Do I need to extract each of those spams from the report or can I submit the encapsulated report message? Will SA strip the added headers/encapsulation? Read the FAQ: http://wiki.spamassassin.org/w/LearningMarkedUpMessages In short, SA will auto-remove it's

Re: [SAtalk] Log Help!

2003-12-10 Thread Matt Kettler
At 09:58 AM 12/10/03 +0200, Ryan Lumsden wrote: how do I get spamd to log to a diffrent file besides messages and mail.log. edit your /etc/syslog.conf and use spamd's -s parameter to change what syslog facility to use. Spamd isn't writing to any files at all, it's just doing standard

Re: [SAtalk] Training SA

2003-12-10 Thread Matt Kettler
At 11:45 PM 12/9/03 -0800, Justin Mason wrote: Oh yeah, forgot to mention I finally got around to migrating all the FAQ stuff onto the Wiki ;) Heh, yeah, I caused me to go Where the heck is that FAQ link???!!! for about 5 seconds before I saw the wiki one.. Ok, my real impressions were a little

Re: [SAtalk] SA tests performed

2003-12-10 Thread Matt Kettler
At 09:34 AM 12/10/03 -0500, Barb Bautista wrote: What do I do with the tests performed available here: http://www.spamassassin.org/tests.html Could someone please explain if I should just copy this file into a .cf file in my local.cf? I am currently running SA site-wide. Um, don't do *anything*

Re: [SAtalk] sven and spam rule

2003-12-10 Thread Matt Kettler
At 09:48 AM 12/10/03 +0100, stephane ancelot wrote: Hi, are there any rules to avoid sven messages ? bye steph It's not really the point of SA, however Andreas Kotowicz posted a list of rules that appear to work well. My only criticism of this ruleset is that he forgot to name all the sub-rules

Re: [SAtalk] rule match counting

2003-12-10 Thread Matt Kettler
At 10:09 AM 12/10/03 -0500, Stephen M. Przepiora wrote: Hello, I have constructed a huge list of rules and wish to detect how good they are. Is there a way to log the count of rule matches somewhere? if you've got a spam/ham corpus, you can test your rules using the tools in the masses/

Re: [SAtalk] sa-learn mbox processing? (forwarded learning)

2003-12-10 Thread Matt Kettler
At 11:32 AM 12/10/2003, Larry Starr wrote: My question regards scripts to ease processing of these mailboxes. Since the messages are forwarded, from several different Email clients (netscape, kmail, pine, AppleMail, etc), extracting the original message, for sa-learn is proving to be non-trivial.

Re: [SAtalk] Using sa-learn in a site-wide configuration

2003-12-10 Thread Matt Kettler
At 12:04 PM 12/10/2003, Stephen Westrip wrote: What exactly do I need to do to make this work? I have read lots about adding 'bayes_auto_learn 1' and other bits and pieces to put in the cf file but whatever I try the Bayes DB never gets added to. did you install DB_File? if not, bayes won't go.

Re: [SAtalk] Writing a DNSBL rule for both SPEWS levels

2003-12-10 Thread Matt Kettler
At 01:39 PM 12/10/2003, Justin wrote: Still, is there a way to conditionally check/skip a DNSBL rule? No. However, if there's an agregate database, you can query multiple lists at the same time.. Currently the SORBS and OPM rules work this way.. only one DNS query is made for all the lists in

Re: [SAtalk] Writing a DNSBL rule for both SPEWS levels

2003-12-10 Thread Matt Kettler
At 02:08 PM 12/10/2003, Justin wrote: So that's how check_rbl and check_rbl_sub work? I always wondered about that. So what happens if an IP exists in two subzones at the same time? With SORBS, it's done by returning multiple results for a single query. host 138.81.106.218.dnsbl.sorbs.net

Re: [SAtalk] [RD] raw/rare/folded/plain/alphed body/subject rendering streams

2003-12-10 Thread Matt Kettler
At 03:48 PM 12/10/2003, SpamTalk wrote: FOLDED set all lowercase Remove HTML punctuation to be underscore, Why on earth do you want to set all lowercase? Every regex in the ruleset can be set to case sensitve or insensitve on it's own, so this adjustment only

Re: [SAtalk] A question abouting teaching Spamassain

2003-12-10 Thread Matt Kettler
At 06:48 PM 12/10/2003, stan wrote: Did I do wrong by teaching it with lots of _good_ messages? Should I reset it to the base rules, and start over? BTW how can I do that? Idealisticaly you want to train it with something realistic in terms of spam/ham ratio.. ie: something close to what you get

Re: [SAtalk] sa-learn ... R/W: tie failed!

2003-12-10 Thread Matt Kettler
At 07:17 PM 12/10/03 -0800, AthlonRob wrote: Cannot open bayes databases /var/amavis/.spamassassin/bayes_* R/O: tie failed: snip ... Where might the lock files be? Try /var/amavis/.spamassassin/bayes*.lock --- This SF.net email is sponsored

Re: [SAtalk] Habeas test

2003-12-09 Thread Matt Kettler
At 01:27 AM 12/9/03 -0500, Jeremy Kister wrote: It seems that spamassassin 2.60 requires all 9 Habeas fields to be included, in order, in the header of an email, for it to recognize the Habeas mark. While contacting Habeas support about a semi-related issue, I was informed that spamassassin should

Re: [SAtalk] [RD] Help with Subject rule

2003-12-09 Thread Matt Kettler
At 07:13 AM 12/9/03 -0500, Scott Sprunger wrote: I wanted to test a theory so I've been trying to come up with a rule that will catch encoded strings in the subject of a message. So far I've tried the rules below, but none of them are hitting. Any suggestions? rawbody type rules have already had

Re: [SAtalk] A Out of memory case

2003-12-09 Thread Matt Kettler
At 01:26 PM 12/9/03 +0100, Claude Frantz wrote: Please allow me to report about an Out of memory case which occured on a system here. RedHat Linux 9.0, all available patches applied amavisd-new-20030616-p6 SpamAssassin version 2.60 Please read the release notes for 2.61, which just came out.

RE: [SAtalk] another SpamAssassin ???

2003-12-09 Thread Matt Kettler
At 08:38 AM 12/9/03 -0500, Bill wrote: Now that the name SpamAssassin is getting to be known as the premier product on the market you can be sure they are going to start using the name on a commercial product. I also expect to see them sue the open-source developers in the near future over the

Re: [SAtalk] reject messages

2003-12-09 Thread Matt Kettler
At 10:01 AM 12/9/03 -0500, gentian wrote: Is such a thing possible with SpamAssassin and some other combinations in Redhat ?? Yes, this is largely a function of whatever tool you integrate SA with.. I'd suggest trying a mitler-level tool which can do this kind of thing by 550ing the message at

Re: [SAtalk] Header problems

2003-12-09 Thread Matt Kettler
At 03:18 PM 12/9/03 +0100, Luca Palazzo wrote: i'm experiencing a strabge problem using Spamassassassin (2.60).. It recognizes a mail as spam, rewrite message (using the rule from safe_report 1) but adds its header with wrong X-Spam-Status.. This is typicaly what happens when you run mail through

RE: [SAtalk] another SpamAssassin ???

2003-12-09 Thread Matt Kettler
At 10:42 AM 12/9/03 -0500, Matt Kettler wrote: Would you people please get some facts prior to posting senseless blather. Replying to myself, sorry for the sharp-edged tone there. It is however frustrating when you offhandedly mention a simple fact, and people begin jumping to conclusions

Re: [SAtalk] I have encountered a strange problem.

2003-12-09 Thread Matt Kettler
At 10:59 AM 12/9/03 -0500, Paul Hirschorn wrote: I found out the way it does this is just by initially tagging that users email message as -100 points as soon as it is scanned and also getting auto-learned as a result because it is below the minimum ham score. Is there a bug fix for this Um, what

Re: [SAtalk] Content Analysis

2003-12-09 Thread Matt Kettler
At 12:01 PM 12/9/2003, Thomas Shoaf \(PromoStep\) wrote: 1) I have used the Content Checker over at Lyris - Is there such a Content Checker available that I may use on my respective server that allows me to checked my content before sending it out via email, etc. I like the tool at Lyris BUT I

Re: [SAtalk] Re: Habeas test

2003-12-09 Thread Matt Kettler
At 02:11 PM 12/9/2003, Scott A Crosby wrote: The plan was abuse copyright and trademark law in order to engage in anticompetetive lock-in. IE, to require payment from people wishing to produce games, people who didn't pay would be forced to commit 'trademark and copyright infringement'. The

Re: [SAtalk] a couple questions.

2003-12-09 Thread Matt Kettler
At 03:27 PM 12/9/2003, John Harrold wrote: i asked some friends and they seem to think that by putting this file in my ~/.spamassassin/ directory it will be used automatically. is this true? or is there a source or include command i can put in my user_prefs file? That is not true... in

Re: [SAtalk] New to SA

2003-12-09 Thread Matt Kettler
At 04:39 PM 12/9/2003, Rachel E. Hewitt wrote: 1. if using the spamassassin --lint at the command prompt and it just goes back to the dos prompt after a moment does that mean that SA is running without any errors? Yes, spamassassin --lint should have no output unless there are errors. If you

[SAtalk] Re: Order of precedence with respect to user_prefs

2003-12-09 Thread Matt Kettler
At 10:51 PM 12/9/2003, mairhtin wrote: It appears that I *WAS* correct. There is still a matter of order of precedence with respect to the scoring of tests. Hmm.. maybe. You have proved it is using your particular user_prefs file. Your original problem was concern over settings bleeding between

Re: [SAtalk] Negative score redux

2003-12-08 Thread Matt Kettler
At 10:02 AM 12/8/03 -0500, Owen Becker wrote: I have several users who are in all_spam_to in local.cf. It looks like spamassassin is giving negative scores to spam for other users when someone in all_spam_to is included in the headers. Anyone know of any quick fixes? Quick fixes, maybe, maybe

Re: [SAtalk] another spamAssassin ???

2003-12-08 Thread Matt Kettler
At 11:08 AM 12/8/2003, gentian wrote: Is this SpamAssassin™ the same as this spamassassin here ? http://www.no-spam-today.com/?banner=GoogleNSTX2http://www.no-spam-today.com/?banner=GoogleNSTX2 The title of the page makes it pretty clear they are a windows installer for the open-source SA.

Re: [SAtalk] What user to run SA-LEARN as ?

2003-12-08 Thread Matt Kettler
At 11:07 AM 12/8/2003, Vee Persaud wrote: I read the FAQ and saw something about using a different user to run sa-learn and that it might cause issues WRT to Bayes. Is this correct ? Yes, this is correct, unless you over-ride the bayes_path and file mode. I'm running sa-learn as root and spamd

RE: [SAtalk] Weird Word patch

2003-12-08 Thread Matt Kettler
At 11:22 AM 12/8/2003, Mike Kuentz (2) wrote: Eval's return true/false if I'm not mistaken. Yes, they do.. But I suspect perl is like C, where any nonzero return value is true. So it's less useful than it appears to return a count, but not harmful. It's probably better style to do what most of

Re: [SAtalk] Order of precedence in rule sets?

2003-12-08 Thread Matt Kettler
At 12:21 PM 12/8/2003, mairhtin wrote: I have an oddity occuring. In my site-wide (local.cf) rules, I have some custom rules, but none concerning dell.com . I want one user to always get any mail from dell.com, but if other users get mail from that domain (or one spoofed to look like it) I want

Re: [SAtalk] Generic V-whatever drug with no GV rule hits (fwd)

2003-12-08 Thread Matt Kettler
At 10:54 AM 12/8/2003, Christopher X. Candreva wrote: I just opened a Bugzilla report for this: http://bugzilla.spamassassin.org/show_bug.cgi?id=2817 (SA 2.60, Solaris, perl 5.6.1) For the moment, I'd suggest a rule like this one that I just cooked up: body LOCAL_GAPPY_VIAG

Re: [SAtalk] Generic V-whatever drug with no GV rule hits (fwd)

2003-12-08 Thread Matt Kettler
At 02:59 PM 12/8/2003, Christopher X. Candreva wrote: body LOCAL_GAPPY_VIAG /\bV\Wi\Wa\Wg\Wr\Wa\b/i score LOCAL_OBFU_VIAG 1.0 Shouldn't the two descriptions match ? :-) ACK!.. that's what I get for re-naming a rule.. :)

Re: [SAtalk] Is sa-learn learning?

2003-12-08 Thread Matt Kettler
At 03:57 PM 12/8/2003, Steven P. Auerbach wrote: 1 - What does Learned from 0 message(s) mean? It means no learning happened. Your interpretation is ONE possibility, but it's the wrong one.. it didn't learn because you don't have DB_File, thus it's impossible for bayes to store data. Since bayes

Re: [SAtalk] Generic V-whatever drug with no GV rule hits (fwd)

2003-12-08 Thread Matt Kettler
At 04:33 PM 12/8/2003, David B Funk wrote: Small enhancement suggestion, modify each one of those '\W' with '?' thus making successive obfuscating characters optional. With your rule there -must- be an obfuscating between each regular character, with the '?', it will catch all permutations of

Re: [SAtalk] another SpamAssassin ???

2003-12-08 Thread Matt Kettler
At 09:17 PM 12/8/03 -0600, JRiley wrote: The very same. However, I didnt know the name SpamAssassin was trademarked.. -JR Yep, it was trademarked by Deersoft, and now owned by McAfee following their acquisition of Deersoft. IIRC. --- This

Re[2]: [SAtalk] Spam that got through question

2003-12-08 Thread Matt Kettler
At 07:45 PM 12/8/03 -0800, Robert Menschel wrote: MK That's definitely bayes poison. Well, it's definitely an attempt at bayes poison, and/or a checksum poison. I used to treat it as bayes poison, and keep those out of my bayes database. I no longer bother. To me it's become bayes fodder. Well,

Re: [SAtalk] Mailer daemon mail in whitelist

2003-12-07 Thread Matt Kettler
At 11:07 AM 12/6/03 -0800, mairhtin wrote: Great to hear! Is xanadu.evi-inc.com *YOUR* dns machine? my machine is named mail.techsolutionsgroupllc.com, so I suppose that the correspondant line would be : whitelist_from_rcvd [EMAIL PROTECTED] mail.techsolutionsgroupllc.com since

RE: [SAtalk] Adding another RBL

2003-12-07 Thread Matt Kettler
At 08:49 PM 12/7/03 -0500, Richard Bewley wrote: mm, it looks as though this would be the problem: debug: is Net::DNS::Resolver available? no debug: is DNS available? 0 Now, the next question, how do I go about installing Net::DNS, do I have to use CPAN? you can do it via tarball, and most

Re: [SAtalk] Spam that got through question

2003-12-07 Thread Matt Kettler
At 07:15 PM 12/7/03 -0800, Scott Harris wrote: The spam attached has the following random words at the bottom: automata childhood reflectance trevelyan tile captious hollingsworth cornstarch chinaman chicanery Is this to try to poison bayes or to just try and fool things to get it through or

Re: [SAtalk] Bayes scoring

2003-12-07 Thread Matt Kettler
At 02:46 PM 12/7/03 -0600, Michael Satterwhite wrote: 50_scores.cf:score BAYES_80 0 0 5.300 2.862 50_scores.cf:score BAYES_90 0 0 4.027 3.002 50_scores.cf:score BAYES_99 0 0 5.200 3.008 if I'm reading this correctly more points are given for classifying a message as 80% probable than for 90%

Re: [SAtalk] ATTN DEVELOPERS: Rule out-of-date??

2003-12-06 Thread Matt Kettler
There are a lot of outlook 2003 related bugs that have recently been fixed in CVS and are slated for 2.61.. http://bugzilla.spamassassin.org/show_bug.cgi?id=2344 http://bugzilla.spamassassin.org/show_bug.cgi?id=2538 Theoreticaly, these may fix your problem. You can also look at the other

Re: [SAtalk] Mailer daemon mail in whitelist

2003-12-06 Thread Matt Kettler
At 10:29 AM 12/6/03 -0800, mairhtin wrote: This results in a -87 score. How can I guard against this, or change my honest-to-goodness mail from MAILER-DAEMON to read something else, like mymailer-daemon ??? Is there a setting in sendmail that I can change to allow me to blacklist [EMAIL

Re: [SAtalk] Customise the default alert message

2003-12-05 Thread Matt Kettler
At 07:21 AM 12/5/2003, george o'dowd wrote: Anyone know how to customise the default alrert message ? Spamassassin has detected possible spam running on server xxx.xxx etc etc Anyone know how I can change the content of that message ? I've never seen that message, but there is a similar one.. set

Re: [SAtalk] Changing user spamd runs as

2003-12-05 Thread Matt Kettler
At 12:04 PM 12/5/2003, Nichols, William wrote: but on startup of RH9 I have it starting spamd, how do I change the user there? Edit the init script that starts spamd.. it's probably in /etc/rc.d/init.d or /etc/init.d, but I've never checked on a RH9 box.

Re: [SAtalk] Being BigEvil inspired...

2003-12-05 Thread Matt Kettler
At 01:58 PM 12/5/2003, Brian Ipsen wrote: But incoming messages encoded in Base64 containg links with the above domains are not recognized ?? Why ?? Any chance the particular B-64 messages are multipart with one part being QP and the other part being base64? get_decoded_body_text_array has this

RE: [SAtalk] Being BigEvil inspired...

2003-12-05 Thread Matt Kettler
At 02:15 PM 12/5/2003, Larry Rosenman wrote: But incoming messages encoded in Base64 containg links with the above domains are not recognized ?? Why ?? one word: rawbody LER OUCH! That makes a lot of sense. Hmmm.Should I change bigevil to URI??? Dunno, I'd ask for some

Re: [SAtalk] Basic flow of SpamAssassin

2003-12-05 Thread Matt Kettler
At 03:10 PM 12/5/2003, kelli coggins wrote: Does the message ever leave the user's in folder on the mail server while SpamAssassin is running? If not, what happens to the original message (before it is re-wrapped as spam)? If so, how is it sent back to the correct mail box? I've never run SA on a

Re: [SAtalk] SA-Talk poisoning Bayes

2003-12-04 Thread Matt Kettler
At 11:06 AM 12/4/2003, Smart,Dan wrote: In reading the sa-learn man file, it says running discussions of spam through sa-learn is bad. Does SA take this into account already, or should I create a procmail rule to bypass SA for messages from SATalk and (possibly) Postfix-List ? SA's bayesian

Re: [SAtalk] Spam received with a return path of mailfilter-dev-admin@lists.sourceforge.net

2003-12-04 Thread Matt Kettler
At 07:25 AM 12/4/2003, Clive Dove wrote: No big deal at the moment as it is only one message, but what happens when other spammers discover that this is a way to distribute their junk? It's been a problem for a LONG time and is nothing new at all.. This very issue forced sa-talk to become list

Re: [SAtalk] How to fix ?

2003-12-04 Thread Matt Kettler
At 12:44 PM 12/4/2003, Gary Lopez wrote: bayes_file_mode 0770 bayes_path /etc/mail/spamassassin/bayes bayes_expiry_max_db_size15 bayes_journal_max_size 102400 Does the above file exist? yes drwxr-xr-x 2 root other512 Dec 3

Re: [SAtalk] a new Sendmail Filter

2003-12-04 Thread Matt Kettler
At 03:13 PM 12/4/2003, kula Yu wrote: Hi There, There is a new Sendmail Filter developed by Mailshell that is utilizing a very powerful engine to catch spam, Mailshell SpamCatcher. Filter has many configuration options which you can customize according to your needs. It can be freely downloaded

Re: [SAtalk] How to do better than 85% detect?

2003-12-04 Thread Matt Kettler
At 03:33 PM 12/4/2003, Kurt Buff wrote: I've also got Bayes autolearning turned on, and it's definitely active. snip Is there anything I can do to help improve the detection rate? I'd advise not using bayes with autolearning alone.. Bayes more or less requires at least some hand-feeding in order

Re: [SAtalk] How to do better than 85% detect?

2003-12-04 Thread Matt Kettler
At 04:35 PM 12/4/2003, Matt Kettler wrote: Most autolearn-only bayes databases wind up being mostly poisoned and wind up doing more harm than good. If you're seeing any spam with BAYES_ scores under 20, or ham with bayes scores over 80 you've got big bayes database problems. Spam under 50

Re: [SAtalk] reverse scoring question

2003-12-03 Thread Matt Kettler
At 11:29 AM 12/3/2003, Gary Smith wrote: The question: What I was wondering if I can create a new rule that filteres on a specific piece of text (like the normal rules) but apply a negative score value. Yes, that's easy to do. Here's a howto guide:

Re: [SAtalk] spamd, rewrite_subject being ignored everywhere

2003-12-03 Thread Matt Kettler
At 12:40 PM 12/3/2003, Martin, Jeremy wrote: I'm having an odd problem with SpamAssassin 2.60, Qmail-Scanner 1.20 and netqmail 1.04 compiled from source (RedHat 9). qmail-scanner does not use spamd/spamc's modification of subject lines, it does the subject taggigng itself. Please read the

Re: [SAtalk] SA Learn question

2003-12-03 Thread Matt Kettler
At 02:24 PM 12/3/2003, Vee Persaud wrote: It got a score of 3.3. I ran sa-learn --spam on this message and now I get a score of 3.0 if I resend the message. I'm a bit confused. Did I do something wrong ??? How did you resend the message? If you resend the message, merely by making a new

<    1   2   3   4   5   6   7   8   9   10   >