Re: [SAtalk] archives for seeding bayes?

2003-08-15 Thread Matt Kettler
At 07:57 AM 8/15/03 -0700, you wrote: I've trained my bayes database with about 12,000 spam and 7,000 ham messages, but I was wondering if there are much larger archives available for seeding bayes? That's a pretty large seed, you shouldn't need more. As for larger archives, really you want the

Re: [SAtalk] Update (2.60)

2003-08-15 Thread Matt Kettler
At 04:46 PM 8/15/03 +0200, you wrote: how can I update (upgrade) under Debian (3.0 Woody) of SA 2.55 on SA 2.60? Well, SA 2.60 isn't released yet.. it's a development version right now. However, if you want to play with it, there are snapshot tarballs available on the spamassassin.org website.

Re: [SAtalk] spamassassin user wise configuration

2003-08-15 Thread Matt Kettler
At 11:44 AM 8/15/2003 -0700, swapna ghosh wrote: or example, if user A wants that the mail from mailto:[EMAIL PROTECTED][EMAIL PROTECTED] should not reach at his mailbox it should not, but mailto:[EMAIL PROTECTED][EMAIL PROTECTED] should reach to user B, as user B has *no objection* for that

Re: [SAtalk] Update (2.60)

2003-08-15 Thread Matt Kettler
At 01:27 PM 8/15/03 -0700, Justin Mason wrote: hmm, must have missed this. Why would we need to extend the deadline? ;) All mass-check data should be in by now. I said I wasn't sure if they had or not.. I didn't see any posts on SaDev that would indicate that all the mass-check data was in, but

Re: [SAtalk] Scores

2003-08-15 Thread Matt Kettler
At 12:17 PM 8/15/03 -0700, Stephen Boals wrote: Just upgraded to 2.55, and in testing found that I am getting different scores between versions. Has the scoring changed for rules? Can I get some background on why, and thought process? Thanks. New scores were generated in 2.50, and they were

Re: [SAtalk] spamd is not responding

2003-08-14 Thread Matt Kettler
At 05:35 PM 8/13/2003 +0200, Céline REDON wrote: spamd appears to be running (with ps -aux) but telnet on port 783 does not work. Define telnet on port 783 does not work? What exact telnet command line did you use? I find that by default, spamd only listens on the loopback interface, so

Re: [SAtalk] What account should be used when running sa-learn

2003-08-14 Thread Matt Kettler
At 09:32 PM 8/13/03 -0400, Rob Cartier wrote: The basic question is do I only need to run sa-learn from my personal account or from root or both for later system usage. You need to run it as the same user that spamassassin gets run as when mail comes in. In some setups, this winds up being your

RE: [SAtalk] Testing a newsletter against SA online

2003-08-14 Thread Matt Kettler
At 08:27 PM 8/12/03 -0500, Theodore Heise wrote: Active effort to circumvent filtering totally contradicts any spammer's contention that he only sends e-mail to people who are interested in it. And you expected anything but? Of course they don't want to only send email to people who are

Re: [SAtalk] new DNS-based RBLs

2003-08-14 Thread Matt Kettler
Yes, it did make it to the list before.. you might not have gotten it back yet (the list can be ungodly slow, or you might be unsubscribed somehow) but I did get this message yesterday. At 11:46 AM 8/6/2003 -0700, Erick Calder wrote: this didn't make it to the list before... -Original

Re: [SAtalk] Users EvalTest.pm

2003-08-14 Thread Matt Kettler
At 06:01 PM 8/8/2003 +0200, Cahya Wirawan wrote: I can write my rule in local.cf or in users rules, but if I want tp have my own eval function I have to write it directly on EvalTests.pm . Since this file will be rewitten if I upgrade the SA, is there any plan to have a local/users EvalTests.pm

Re: [SAtalk] spamassassin and spamd giving very different results

2003-08-14 Thread Matt Kettler
At 11:35 AM 8/6/2003 -0400, Justin F. Knotzke wrote: Hi, When running spamassassin -t spam spamassassin returns that the given message is spam (which is correct). Running spamc on spam using spamc -c spam, spamc returns 0/4.3. Spamd is running: root 24816 0.0 9.3 13380 11952

Re: [SAtalk] auto-whitelist and sa-learn

2003-08-14 Thread Matt Kettler
At 08:40 PM 8/12/2003 +0100, Peter Doherty wrote: i would presume the idea is that it would add any email addresses learned as spam to the auto whitelist? i dont know if it exists or not, it was just written about in michael bell's how to but doesnt seem to be a feature of the actual software

RE: [SAtalk] DCC stopping this list?

2003-08-14 Thread Matt Kettler
At 09:59 AM 8/4/03 -0600, Chris Blaise wrote: You could say the same about SpamAssassin itself. Without a whitelist, it could catch messages based on its rules just as easily as someone maliciously checksumming every message in the list for DCC. True, although it is the policy of

Re: [SAtalk] Odd scoring message

2003-08-14 Thread Matt Kettler
At 04:03 PM 8/7/03 -0400, Scott Blomquist wrote: Hi folks, I just received the attached maessage, it tripped SA at 5.6 but the only thing that got hit was the BL rules. How did this get such a low score? snip version=2.53 First, a side-note.. are you aware of the dreaded bug 1589, that

Re: [SAtalk] Testing a newsletter against SA online

2003-08-14 Thread Matt Kettler
At 04:32 PM 8/12/2003 +0200, Rickard Andersson wrote: Hi folks! I'm wondering if there is a website where I can test a newsletter that I'm sending out against SA? I'm interested in know what SA thinks of my newsletter when it comes to things like headers and content. If there is such a thing, I

Re: [SAtalk] Where are the wordlists?

2003-08-14 Thread Matt Kettler
At 02:32 PM 8/11/03 -0700, Joshua Graham wrote: Mail from one of my domains (suckycentral.com) keeps getting marked as spam due to the fact that SA insists it contains words of an adult nature. Even if it's a blank message. Is there anyway I can remove the word suck from adult list so my mail

Re: [SAtalk] auto-whitelist and sa-learn

2003-08-14 Thread Matt Kettler
At 07:35 PM 8/12/2003 +0100, Peter Doherty wrote: i noticed a post to this list in the achives, on this subject, but didnt see a response. does the AWL switch work in sa-learn? Umm.. what would it do if it did work? --- This SF.Net email

Re: [SAtalk] weird rewriting of headers - SpamAssassin?

2003-08-14 Thread Matt Kettler
At 10:48 AM 8/7/03 -0700, Vicki Brown wrote: Except I wasn't installing I was upgrading, under time pressure, because people were insisting they would ignore bug reports and questions if I didn't upgrade. Well, personally I don't ignore questions from any version.. Unless it's something I really

Re: [SAtalk] newbie sa-learn question.

2003-08-14 Thread Matt Kettler
At 10:45 AM 8/11/2003 -0400, Russell Premont wrote: setup an address that users could forward spam to, so I could then run sa-learn on the mail folder. My question is can I use sa-learn in this manner or will it also pick up the addresses that forwarded the mail to the spam account also? It won't

Re: [SAtalk] How did this get 0 points?

2003-08-14 Thread Matt Kettler
At 08:56 AM 8/7/2003 -0700, Nichols, William wrote: The text below came through - failed two test (Hot_Nasty and No_Real_Name) it received 0.00 points: Rather than quoting only the bod of the spam message (which is almost completely useless without the headers), can you instead quote us the

RE: [SAtalk] Suddenly, spamd runs me out of memory (physical and swap)

2003-08-14 Thread Matt Kettler
At 09:33 AM 8/8/03 -0500, Mike Burger wrote: Great...now, I just need to figure out how to redirect the output. strace -p pid strace.txt didn't work. strace outputs to stderr if I recall correctly. strace -p pid 2 strace.txt --- This

Re: [SAtalk] USER IN WHITELIST spammer scam

2003-08-14 Thread Matt Kettler
At 10:58 AM 8/14/2003 -0700, Greg Webster wrote: '[EMAIL PROTECTED]' is not in our whitelist, and neither is '[EMAIL PROTECTED]' or any variant. It appears that there is a problem with the USER_IN_WHITELIST regexp to me, but I may be mistaken. I can't think of any other way that this would have

Re: [SAtalk] Question

2003-08-14 Thread Matt Kettler
At 08:04 PM 8/14/2003 +0200, Hub Dohnmen wrote: I am running RedHat 7.2 with Spamassassin installed thru RPMs. I have also integrated the exiscan-patch into Exim. Can I change the path of the user_prefs files in a cfg-file? The default of the file is the home-drectory of the user. I want to use

Re: [SAtalk] [Q] more_spam_to (was: Sorry - I'm blind.)

2003-08-14 Thread Matt Kettler
At 03:47 PM 8/10/03 -0400, Daniel Carrera wrote: What are those? What do more_spam_to and all_spam_to do? All three do the same basic thing look at the To: address of an email and subtract points from it if there's a match. The part that differs is how big of an impact they have on the score.

Re: *****THIS MESSAGE IS SPAM***** [SAtalk] Problem with penis e nlargement :)

2003-08-14 Thread Matt Kettler
At 05:38 PM 8/4/2003 -0700, Justin Mason wrote: Simon Byrnand writes: By default will it try to use one common AWL database, or will each user have their own AWL database ? If both options are possible which is recommended ? By default, it will created the AWL in the name of the user that SA is

Re: [SAtalk] newbie question

2003-08-14 Thread Matt Kettler
At 01:01 PM 8/8/03 +, william f guyton jr wrote: Is their a configuration that allows SA to use unique local.cf for each domain passing thru a SA gateway? This is really a function of the tool that calls SA, and not SA itself. So you'd have to specify which tool you're using for that. As an

Re: [SAtalk] Sorry - I'm blind.

2003-08-14 Thread Matt Kettler
At 02:36 PM 8/10/03 -0400, Daniel Carrera wrote: Okay, I'm blind. I didn't realize that the email DID have USER_IN_WHITELIST_TO in the header. I'll just change some values in user_prefs: score USER_IN_WHITELIST_TO -7.0 You can also use more_spam_to or all_spam_to instead of whitelist_to.. They

Re: [SAtalk] Does sa-learn process encoded messages?

2003-08-14 Thread Matt Kettler
At 09:53 PM 8/12/03 -0700, Ricardo Kleemann wrote: If a message body is encoded base64 or whatever, does sa-learn properly process the message? I mean, will it properly decode the body into real text and then process the tokens appropriately? I'm not entirely sure about the bayes code, but I'd

Re: [SAtalk] Blacklist Question (really an AWL question).

2003-08-14 Thread Matt Kettler
At 10:52 AM 8/13/03 +0100, Jason Crummack wrote: I posted a question a week or so ago but probably didn't phrase it very well here's my problem I have auto white listing enabled which seems to be behaving as expected e.g (/check_whitelist | grep coffer) 6.7 (6.7/1) -- [EMAIL

Re: [SAtalk] user_prefs configuration

2003-08-14 Thread Matt Kettler
At 10:49 AM 8/12/2003 -0700, Scott Fraser wrote: Good Morning Folks, Well, after fighting with it longer than I care to admit, I do believe I now have a working Postfix/SpamAssassin/Amavisd system. What I am trying to do now, is configure the system wide (and eventually on a per user

Re: [SAtalk] user_prefs file - local rules not being used?

2003-08-14 Thread Matt Kettler
By default user rules will be ignored in user_prefs if you use spamd/spamc. This is done to prevent security exploits. See the allow_user_rules option in man Mail::SpamAssassin::Conf. Either turn that on, or put custom rules only in local.cf.

RE: [SAtalk] Testing a newsletter against SA online

2003-08-14 Thread Matt Kettler
At 12:47 PM 8/12/2003 -0400, you wrote: You and every spammer out there would love to know from a simple web page what SA would think of their messages... Why don't you just save a copy of the full message you've received on an outside account and then spamassassin -tD testmessage? Really I

Re: [SAtalk] user_prefs file - local rules not being used

2003-08-14 Thread Matt Kettler
At 11:45 PM 8/9/2003 -0700, Vicki Brown wrote: Anyone now using 2.4* with options report_header or defang_mime should be wary if you upgrade. Apparently these were both rolled into the new report_safe feature, except the README fails to mention this. Actually the very first lines of the README do

Re: [SAtalk] SA-2.60 CVS not taking in account whitelist

2003-08-14 Thread Matt Kettler
At 01:24 PM 8/11/2003 -0300, Luis Hernán Otegui wrote: Hi, (I think) I've found a bug in SA-2.60-CVS (1.196-2003-07-29-exp): First of all, I use SA through spamassmilter, and I reject messages which score over 15, and quarantine anyone which scores between 5 and 15. I've whitelisted a few

Re: [SAtalk] autolearning: how?

2003-08-14 Thread Matt Kettler
At 10:01 AM 8/13/2003 -0400, Allin Cottrell wrote: If I don't use sa-learn manually, how is sa supposed to be made aware of its degree of non-success (the false negatives)? It can't. Autolearning isn't a perfect solution, it just provides a reasonable mechanism where some learning can occur

Re: [SAtalk] How to use trusted_networks setting?

2003-08-14 Thread Matt Kettler
At 02:26 PM 8/9/03 -0700, Bill Landry wrote: spamassassin -V SpamAssassin version 2.55 spamassassin --lint Failed to parse line in SpamAssassin configuration, skipping: trusted_networks 192.168/16 127/8 debug: Failed to parse line in SpamAssassin configuration, skipping: trusted_networks

Re: [SAtalk] implementation

2003-08-14 Thread Matt Kettler
At 01:52 PM 8/14/2003 -0400, Jon Fraley wrote: We use iPlanet for our email system and SA doesn't integrate well with it. I want to know if I can have a box in front of our mail server that will use SA to scan the messages and then forward the messages to our iplanet box. I just want to know if

RE: [SAtalk] stuff in white list getting tagged

2003-08-14 Thread Matt Kettler
At 06:10 PM 8/6/03 -0500, Robin Witkop-Staub wrote: I guess maybe the problem is I don't understand how AWL works. Could someone explain this process? Sure, the AWL is actually a very simple system. In short, the AWL is a score averaging system. It keeps track of the historical average of a

Re: [SAtalk] No rule for the word V1AGRA?

2003-08-14 Thread Matt Kettler
At 08:28 AM 8/13/03 +0200, Øystein Gisnås wrote: My Bayes is working properly, that's why it triggered on BAYES_90. The problem is that no BAYES rule is weighed so that it cross the 5.0 limit with the default settings. Of course, I can change this myself. But I thought the intention is that SA

Re: [SAtalk] How an I tell SA what isn't spam?

2003-08-14 Thread Matt Kettler
If you are using bayes, you can train that part of SA with the sa-learn tool. If you need more effect than that, the only thing you can do is tweak the scores of existing rules, or write some custom ones. SA doesn't really keep a database of messages, it's just got a series of text search

Re: [SAtalk] Help understanding spamc and bayes

2003-08-14 Thread Matt Kettler
At 01:23 PM 8/14/2003 -0700, Ricardo Kleemann wrote: This is a message that has been run through sa-learn with --spam, and yet I get nothing reported back from spamc. I did restart spamd after altering local.cf. I'm running spamc as the same user that ran sa-learn. I'd try running spamd with

Re: [SAtalk] USER IN WHITELIST spammer scam

2003-08-14 Thread Matt Kettler
At 01:17 PM 8/14/2003 -0700, Greg Webster wrote: How so? The spammer is 'From: [EMAIL PROTECTED]' and 'To: [EMAIL PROTECTED]' is a user inside our domain. Yes, we have [EMAIL PROTECTED] whitelisted, but not [EMAIL PROTECTED] I'm boggled here...how is the Return-Path getting our local user ('[EMAIL

Re: [SAtalk] Bayesian learning and mbox mailbox type

2003-08-14 Thread Matt Kettler
At 10:34 AM 8/12/2003 -0400, Matt Jones wrote: I have tried to use the sa-learn --spam/--ham feature with my mbox. I was told you need to do it when you have hundreds of examples of --ham and --spam. I have like 1000 spams in my assassinated folder and about 2000 good mails in my inbox. I used

Re: [SAtalk] please help me

2003-08-14 Thread Matt Kettler
At 04:14 PM 8/11/2003 +0200, Timothée HESPEL wrote: hello i want to add new rules but whenever i test the demonstration rule, it is forgotten by SA... My rule is define in my user_prefs file and i tested is with spamassassin --lint... Please help me... If you are using spamd, by default ALL

Re: [SAtalk] White List

2003-08-14 Thread Matt Kettler
At 06:30 PM 8/14/2003 -0300, Roberto Wagner wrote: I installed a SA and configured a procmail to each user. Into a /home/user/.spamassassin dir I put the user whitelist, but the SA still considering a sendar that is into a whitelist like SPAM. If someone have a idea to fix it please send to me.

Re: [SAtalk] HELP

2003-08-14 Thread Matt Kettler
At 07:06 PM 8/8/2003 +0100, Adam D. Barratt wrote: On Thu, 2003-08-07 at 21:54, Matt Kettler wrote: Do you have a specific kind of help you need, or should we assume it's an accidental PEBAC? PEBKAC (or PEBCAK), surely? :-) The problem needs to exist between the chair and something else

Re: [SAtalk] Moved into the ex-ip of a spammer

2003-08-14 Thread Matt Kettler
At 01:44 PM 8/14/2003 -0700, Doug Roberts wrote: Hi all - We just set up shop at a co-lo, started firing off mails to customers that requested to download our product (a spamassassin-based filter, ironically) and discovered that we are the proud owners of part of a class C that has been

Re: [SAtalk] Header rule for *@domain.com

2003-08-14 Thread Matt Kettler
At 04:34 PM 8/4/2003 -0400, Fred I-IS.COM wrote: Hello, I noticed a few messages using [EMAIL PROTECTED] in the headers. (To, From, CC). The domain part is random, sometimes I see juno.com or hotmail.com or china.com but I have many others. Can someone help me create a custom rule to trap

Re: [SAtalk] Help understanding spamc and bayes

2003-08-14 Thread Matt Kettler
At 07:15 PM 8/14/2003 -0700, Ricardo Kleemann wrote: Hi, Is there a problem running spamc as nobody? I'm actually using nobody as the user running it, and I have run sa-learn as nobody as well. I figured it doesn't matter which user it is, as long as that particular user has the bayes database

Re: [SAtalk] Problems with upgrade 2.43 - 2.55

2003-08-14 Thread Matt Kettler
At 08:40 PM 8/14/2003 -0400, Lois Bennett wrote: We use SA on our relay to mark mail as spam for the whole site. I was hoping that the upgrade would do a better job at marking spam but so far it's worse. I was wondering if there are any suggestions from the list as to how to approach the

Re: [SAtalk] disable version info

2003-08-11 Thread Matt Kettler
At 01:33 PM 8/8/03 +0200, Alexander Pubanz wrote: I want to disable the Version Info of Spamassassin in the mail headers. I am talking about this line: X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp) Can someone telle me what to write in the config to disable it ? As you see

Re: [SAtalk] Bayes probs

2003-08-10 Thread Matt Kettler
At 11:20 PM 8/9/03 -0400, Justin F. Knotzke wrote: I am having some issues with getting bayes to work using spamc/spamd. I'll admit I don't know the answer to your question, but you left out some important details: 1) what version of SA do you have? 2) have you upgraded between versions? if

Re: [SAtalk] Required the *required_hits* parameter

2003-08-10 Thread Matt Kettler
At 04:48 PM 8/7/03 -0700, swapna ghosh wrote: Hi This is regarding *required_hits* parameter...I have installed SA 2.55. Now for few users i have not configured the user_prefs file individually. I set required_hits parameter to 7 in the /etc/mail/spamassassin/local.cf file. But i am

Re: [SAtalk] user_prefs file - local rules not being used

2003-08-10 Thread Matt Kettler
At 08:21 PM 8/9/03 -0700, Vicki Brown wrote: My local tests (defined in ~/spamassassin/user_prefs) are not being run. These tests were run when we used SpamAssassin 2.43. Now we have upgraded to 2.55 and the tests are not being run. Read the manpage.. this is disabled by default in 2.55 for

[SAtalk] Rules guide updated, new text and ToC added.

2003-08-09 Thread Matt Kettler
I think this is going to be the final version for a while. Sorry I put off this last edit, but real life got busy for a while. In any event, the guide now covers meta, uri, and rawbody rules, and has a table of contents. These are really things I wanted to add a long time ago, and I feel they

Re: [SAtalk] Re: Newbie - Why no score for equal From: and To: address?

2003-08-09 Thread Matt Kettler
At 11:14 AM 8/8/2003 -0500, Chris Barnes wrote: Imho, this gets a low score because it is not uncommon for people to use it for non-spam distributions. For example, my wife sends a family update to around 20 or so people in her addressbook. Actually in 2.55 there's only one FROM_AND_TO_SAME and

Re: [SAtalk] Hmm, I wonder

2003-08-08 Thread Matt Kettler
At 04:58 PM 8/7/03 -0500, Chris Barnes wrote: X-PerlMx-Spam: Gauge=XI, Probability=95%, snip header LOCAL_PERLMX_TAG X-PerlMX=~ /\bGauge=X\b/i score LOCAL_PERLMX_TAG 3 In this case, the second \b will hurt you. It won't match because there's a bunch of I's after the

Re: [SAtalk] Test for FORGED_JUNO_RCVD

2003-08-08 Thread Matt Kettler
At 04:58 PM 8/4/2003 -0700, Justin Mason wrote: Theoretically Theo Van Dinter fixed this a long time ago in this bug: http://bugzilla.spamassassin.org/show_bug.cgi?id=1475 But looking at the code, the fix isn't in 2.43, 2.44, 2.50, 2.52, 2.54 or 2.55. it is in 2.60 though ;) Ouch.. it's been a

Re: [SAtalk] I just realized something..

2003-08-07 Thread Matt Kettler
At 08:32 PM 8/6/03 -0700, Jonathan Nichols wrote: uh... I whitelist this mailing list. I run everything through a SA mailgate box, with autolearn on... Have I been doing something really stupid? =/ I fear that I have..it's just been one of those days. Yes, but for the opposite reason of what you

Re: [SAtalk] weird rewriting of headers - SpamAssassin?

2003-08-07 Thread Matt Kettler
At 12:51 AM 8/7/03 -0700, Vicki Brown wrote: I upgraded to SpamAssassin 2.55. I just realized that some mail seems to be getting SpamAssassin information inserted BEFORE the regular headers, causing theo riginal headers to appear as part of the body of the message. I've not seen this behaviour

Re: [SAtalk] HELP

2003-08-07 Thread Matt Kettler
Do you have a specific kind of help you need, or should we assume it's an accidental PEBAC? --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download

RE: [SAtalk] What is /kernel: mail.info message ?

2003-08-06 Thread Matt Kettler
At 02:18 PM 8/5/2003 -0400, Sorin Chiorean wrote: Thanks Matt for your replay, I did this before (I have the same messages in the maillog file) but because is a message from Kernel is coming to the console too. It's there anything that I can change on spamd configuration to turn this messages off

Re: [SAtalk] [RD] Rule Philosophy

2003-08-05 Thread Matt Kettler
At 09:45 PM 8/4/03 -0700, Robert Menschel wrote: uri L_u_time4more /time4more\.net/i describe L_u_time4more Body text references known spammer score L_u_time4more 9.00 # graphics-only spam Aug 4 03 Personaly, I tend to not go over 4.0, even on a sure-fire spam rule. This is mostly

Re: [SAtalk] feature suggestions for typical users

2003-08-05 Thread Matt Kettler
At 02:17 PM 8/4/2003 -0700, Mark H wrote: One idea (probably the most work) is to create a web interface to SA for end users. I could change both black and white lists. To handle the training, perhaps I could set Eudora to leave mail on the server for a day or two, and SA could show these to

Re: [SAtalk] What is /kernel: mail.info message ?

2003-08-05 Thread Matt Kettler
At 11:56 AM 8/5/2003 -0400, Sorin Chiorean wrote: I am getting a lot of messages on console like this: /kernel: mail.infospamd [xxx] connection from localhost [127.0.0.1] at port . I have a FreeBSD 4.3-RELEASE-p20 server running like mail server (sendmail, Qpopper, procmail etc..) with

Re: *****THIS MESSAGE IS SPAM***** [SAtalk] Problem with penis e nlargement :)

2003-08-05 Thread Matt Kettler
At 01:09 PM 8/5/2003 +1200, Simon Byrnand wrote: Hmm, thats a shame that all_spam_to fools the AWL like that, because as postmaster, I have abuse@ and postmaster@ listed in all_spam_to. Well, it doesn't really fool it.. the AWL is a fundamentally very simple minded beast. It's a historical score

Re: [SAtalk] Distributed Server Blacklists??

2003-08-05 Thread Matt Kettler
At 04:22 PM 8/5/2003 -0400, Dragoncrest wrote: Just started hearing about something called a Distributed Mail Server blacklist today. Never heard of it before. Apparently if your mail server is part of a distributed mail server cluster, it's blacklisted until you're no longer part of

Re: [SAtalk] Test for FORGED_JUNO_RCVD

2003-08-04 Thread Matt Kettler
At 03:49 PM 8/4/2003 -0400, Fred I-IS.COM wrote: Hello, I noticed an issue with 2.55 and the test for FORGED_JUNO_RCVD, The reverse dns for juno customers is: untd.com This causes a false positive for juno customers. Thanks, Theoretically Theo Van Dinter fixed this a long time ago in this bug:

Re: [SAtalk] 1)Change Bayes scores; 2)Whitelists

2003-08-03 Thread Matt Kettler
At 08:48 AM 8/3/03 -0400, Daniel Carrera wrote: 1) I find that Bayes seems to be right most of the time. How can I make SA rely on Bayes more? Can I just change the scores the same way I change every other score? If so, where can I find a list of all BAYES_* scores and their default values? I

Re: [SAtalk] The correct use of Bayes

2003-08-03 Thread Matt Kettler
At 05:02 PM 8/3/03 +0300, Harri Pesonen wrote: I think that the autolearn is bad, because it only learns from those spam messages that it knows to be spam for certain in any case, and the same for ham as well. OK, it does not necessarily mean that Bayes agrees what SpamAssassin thinks. Anyway,

Re: [SAtalk] how to stop mails with from=

2003-08-01 Thread Matt Kettler
At 01:14 PM 8/1/2003 -0700, Jonathan Nichols wrote: hi, I just wanna ask what rule should I aply to stop mails that have in header from= . thanks for any (hope there will be some hehe) replys IIRC, that's a valid field.. some RFC somewhere talked about it. I forgot which one, but I've seen it

Re: [SAtalk] Question about what users get their mail processed through SA

2003-08-01 Thread Matt Kettler
At 05:37 PM 8/1/03 -0400, Steven W. Orr wrote: But there is no specific user associated with a mailing list. 1. Is this why mail is not going through SA if it's bound for a list? 2. Is there a way to make all mail go through SA? Procmail is an MDA, thus, it only gets involved if a message is

Re: [SAtalk] (no subject) - Installation

2003-07-31 Thread Matt Kettler
At 12:05 PM 7/31/03 +0530, jagan wrote: sir, i ahve downloaded ur spamassasin . i need to insatll to my server which runs on linux. I like to have the method of 1.INSTALLATION AND 2.INTEGRATING THIS WITH MY MTA QMAIL USING spamd . That is via C AND NOT PERL. so how could i go about installing.

Re: [SAtalk] dcc

2003-07-31 Thread Matt Kettler
At 07:28 AM 7/31/03 -0400, Sanjay K. Patel wrote: How can I verify that spamassassin is using dcc? When I do cdcc info I do get a response but this is no guarantee that spamassassin is using dcc. I call spamassassin through MailScanner I usually test my Mailscanner's setup using the spamassassin

Re: [SAtalk] Spam scored above threshhold but is not tagged.

2003-07-31 Thread Matt Kettler
that's a negative number. Negative 17.6 is definitely less than 5.0 This due to a VERY well known scoring issue in versions 2.50-2.53.. In these versions several rules, including MSGID_GOOD_EXCHANGE and REFERENCES, had very large negative scores, resulting in the effective whitelisting of

Re: [SAtalk] DCC vs Razor2 vs Pyzor

2003-07-31 Thread Matt Kettler
At 01:45 PM 7/31/2003 -0500, Clay Atkins wrote: Any thoughts on which of these is better, none, or a combination of them? The STATISTICS*.txt files that come with spamassassin will speak much more definitively about the accuracy of these tools than any human on this list can. from SA 2.55's

RE: [SAtalk] DCC vs Razor2 vs Pyzor

2003-07-31 Thread Matt Kettler
At 07:33 PM 7/31/2003 -0400, Sanjay K. Patel wrote: How can someone generate this report on the their local copy of spamassassin? It's not generated by your local copy.. Those statistics are included as a part of the SA distribution. They are the rule hit-rate statistics from the corpus that was

RE: [SAtalk] DCC vs Razor2 vs Pyzor

2003-07-31 Thread Matt Kettler
At 11:16 PM 7/31/03 -0400, Larry Gilson wrote: Have these statistics been fairly true over time or do they fluctuate? It seems that the statistics are point-in-time numbers that tell more about the reported spam rather than the effectiveness of the specific check. While the corpus of messages

Re: [SAtalk] spam flag NO despite high score

2003-07-30 Thread Matt Kettler
At 11:01 AM 7/30/2003 -0400, Luiz L Souza wrote: My mail provider uses spamassassin. I have set the spam threshold to a low value, 1.5, and added some entries to my 'allow' and 'deny' lists in order to reduce the number of spam that gets through spamassassin. Most of the spam is correctly

Re: [SAtalk] [RD] tiny comment 'gaps'

2003-07-30 Thread Matt Kettler
At 10:17 AM 7/30/2003 -0700, Ian Douglas wrote: Also, what exactly is spamassassin --lint supposed to do for me when I point it at my rules file? It always just returns to the shell prompt, never outputs anything. the --lint option will show you any syntactic complaints SA has while trying to

Re: [SAtalk] WHITELIST QUESTION

2003-07-30 Thread Matt Kettler
At 01:12 PM 7/30/2003 -0600, Alan Fullmer wrote: I have a question for someone. What does Whitelist_from actually look at? all headers? or a single one? Is there a way to whitelist this line: From: Alan Fullmer mailto:[EMAIL PROTECTED][EMAIL PROTECTED] any ideas? thanks in advance.

Re: [SAtalk] spam flag NO despite high score

2003-07-30 Thread Matt Kettler
Hmm.. I'm not really familiar with mimedefang, and the output it's put there isn't very informative. My first question would be how did you set your spam threshold to 1.5? What exact configuration file and command did you use? My next question would be can you generate a X-Spam-Status header,

Re: [SAtalk] Spam Folder

2003-07-30 Thread Matt Kettler
At 09:58 PM 7/30/03 -0500, Ken Marcum wrote: I have not done something correctly in my installation. I get messages marked as Spam but they still come to my Inbox and do not go to my Spam folder. What do I need to do? Thanks for the help, Ken Marcum Based on your headers, it sounds like you're

Re: [SAtalk] USER_IN_WHITELIST

2003-07-29 Thread Matt Kettler
At 10:39 PM 7/28/03 -0600, Alan Fullmer wrote: check for another instance of user_prefs somewhere on your system. looks like your own email is the from. some spammers like to put your email as the from so it will fool spam assassin's default setup. Also be sure to check to see if it matches one

Re: [SAtalk] some messages not filtering

2003-07-29 Thread Matt Kettler
At 11:04 AM 7/29/2003 -0500, spam wrote: Hello. We're running SA version 2.43 on a Free BSD box (OSX). Everything seems to work good except that some obvious SPAM is not being filtered. That is to say: some messages that are flagged by SA with more hits than required to be spam, are still ending

Re: [SAtalk] whitelist not working?!?

2003-07-29 Thread Matt Kettler
At 07:41 PM 7/29/2003 +0200, Bonny wrote: Hello all! In my ./spamassassin/user_prefs I put: whitelist_from @tuttinudi.com BUT e-mails coming in from that domain (I mainly get it from ONE address, which is a mailing list) are still caught as SPAM! What can I do? I already did sa-learn on the

Re: [SAtalk] How to remove an rbl from SA?

2003-07-28 Thread Matt Kettler
At 12:04 AM 7/28/2003 -0400, Steven W. Orr wrote: This is an rbl that IMNSHO should *not* be used by anyone unless they deliberately want to block all clients of uunet. I know of which I speak. as a side note, the score of the RFCI RBL in 2.55 is less than 1.5. It would be very hard to construe

Re: [SAtalk] SA seems to alternate messages

2003-07-28 Thread Matt Kettler
At 11:53 PM 7/28/03 +0200, Erik van der Meulen wrote: I seem to have this odd issue with SA. It seems that whenever a message is identified as spam, it gets passed through SA again in some mangled way. snip - Begin Quoted Spam - Sorry man, but your message got mangled because your own

Re: [SAtalk] SA not filtering spam.

2003-07-27 Thread Matt Kettler
At 11:40 PM 7/24/03 -0400, Daniel Carrera wrote: In any event, SA doesn't seem to be filtering spam at all. I only get about 1 or 2 spams a day, so it's hard to say anything certain, but not a single one of those (in the last 3 days) has been picked up by SA. What mechanism did you use to

Re: [SAtalk] Actual Documentation for 2.55 or 2.60 ?

2003-07-25 Thread Matt Kettler
At 11:01 AM 7/25/03 +0200, Muenz, Michael wrote: Hi, the docs at SA site have changed. Is that only a doc update or is it now for 2.60 ? I'm interested in the trusted networks feature. If it's for 2.60, is there a release date planned ? Thx I've never exactly understood why, but the

Re[2]: [SAtalk] Big problem - SA crashing

2003-07-25 Thread Matt Kettler
At 11:48 PM 7/24/2003 -0700, Abigail Marshall wrote: Matt, thanks for the great tip, but it didn't solve my problem. I disabled Bayes and then modified procmail as you suggested, and a large, legit email from a previously unknown user (not whitelisted) with a 30k attachment went through without a

Re: [SAtalk] reporting idea

2003-07-25 Thread Matt Kettler
At 12:24 PM 7/25/2003 -0500, mikea wrote: Bad idea, I think. Certainly you should not mail the whois contacts using an automated tool, and I think it is not entirely wise to mail other mailboxes using such a tool if there is no human in the loop. Well, this part of your argument against it is

Re: [SAtalk] Newbie... some questions

2003-07-25 Thread Matt Kettler
At 01:43 AM 7/26/2003 +0200, Bonny wrote: Hello! I'm using spamassassin 2.44 and would like to know a) the difference with the latest release (2.55 afair)... There's a very significant difference. First, 2.44's spamd has a buffer overflow vulnerability. This wasn't completly fixed till 2.50 so

Re: [SAtalk] bayes question

2003-07-25 Thread Matt Kettler
At 02:22 PM 7/25/2003 -0700, Ian Douglas wrote: I've been putting sa-learn through the gears with many thousands of spam messages (gotta love web hosting 100+ domains most of which do nothing but collect spam /sigh). I'm curious how Bayes is *supposed* to be learning... I find that despite

Re: [SAtalk] Block an entire Network?

2003-07-25 Thread Matt Kettler
At 03:09 PM 7/25/03 +0300, Turgut Kalfaoglu wrote: How does one go about blacklisting an entire network, say for example [EMAIL PROTECTED] does not seem to work? If you have the option; block it from the firewall OR router. It saves SO much overhead! Actualy, it is the lowest overhead to 5xx it

Re: [SAtalk] rule ideas..

2003-07-24 Thread Matt Kettler
At 03:31 PM 7/24/03 +0300, Turgut Kalfaoglu wrote: Perhaps if the sender has a .BIZ domain that could be a rule? also, perhaps if the sender's domain ends with a NUMBER, that could be a rule? You could easily make rules like that.. I don't think that they'd be effective enough to meet the S/O

Re: [SAtalk] Block an entire Network?

2003-07-24 Thread Matt Kettler
At 07:00 PM 7/23/03 -0700, Jim Blevins wrote: How does one go about blacklisting an entire network, say for example [EMAIL PROTECTED] does not seem to work? The blacklist_from feature in SA works based on the contents of the email address.. thus for the above blacklist to work, the person's

Re: [SAtalk] Spammers getting smarter?? or using S.A.?

2003-07-24 Thread Matt Kettler
At 06:58 PM 7/23/03 -0700, Mark H wrote: I know this may have been mentioned before, but maybe the spammers are using SA to design their spams?? That is unquestionably true, and it's also very well known. The abuse of the multiple mailers and fake quoting and fake pgp signatures seen earlier

Re: [SAtalk] FROM_AND_TO_SAME doesn't work?

2003-07-24 Thread Matt Kettler
At 01:51 PM 7/24/2003 +0200, Cahya Wirawan wrote: I think it is because white space in jenny hewit [EMAIL PROTECTED]. if it is: jennyhewit[EMAIL PROTECTED] , it will match. Look on the last code: if ($hdr_from =~ /^\s*\S+\s*$/ $hdr_to =~ /^\s*\S+\s*$/){return 1;} it doesn't allow space in the

Re: [SAtalk] Block an entire Network?

2003-07-24 Thread Matt Kettler
At 11:36 AM 7/24/2003 -0400, Theo Van Dinter wrote: FYI: SA 2.60 will have support for accessdb. :) You guys are awesome... --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and

<    3   4   5   6   7   8   9   10   11   12   >