Re: [SAtalk] Spam with negative score

2003-07-15 Thread Matt Kettler
At 10:01 AM 7/15/2003 -0400, Gaurav Hariani wrote: I've been (almost) spam free for almost a month since I installed spamassassin. But today I received spam that had a -ve score. I don't know much about spamassassin, so could someone explain how this happened and what can I do to catch this sort of

Re: [SAtalk] Getting SA to score certain words higher

2003-07-15 Thread Matt Kettler
At 05:08 PM 7/15/2003 +0100, Huw Jenkins wrote: Hi there list, I'm fairly new to SA so forgive my ignorance. I've installed SpamAssasssin and it works very nicely. I've got my threshold set pretty high as we're an ISP and I don't want and False Negatives. I've noticed that certain pension spam

Re: [SAtalk] spam and dice.com

2003-07-14 Thread Matt Kettler
At 12:37 PM 7/14/2003 -0700, Matt Thoene wrote: Huh? One has absolutely nothing to do with the other. What kind of spam is getting through? I think what happened is a few of the more "clever" spammers got his address as a result of them mining addresses out of dice.com. Of course, the original em

Re: [SAtalk] Oddball SA custom-rule bug(s)?

2003-07-14 Thread Matt Kettler
At 03:42 PM 7/14/2003 -0400, Kris Deugau wrote: I've attached the message I'm playing with right now (as a zip because SourceForge rejected it the first time); here's the rule that's failing to trigger: uri SPAM_SITE_11/(domainsforpeople|pandabearperks)\.com/i describe SPAM_SITE_11 Body

Re: [SAtalk] Genetic Algorithm assigns some DNSBLs a score of 0? (Myunrejectv3)

2003-07-14 Thread Matt Kettler
At 01:19 PM 7/12/2003 -0700, I Am Jesus @sent wrote: I suggest something like the original comments followed by: #score RCVD_IN_BL_SPAMCOP_NET 1.8 #score RCVD_IN_DUL 0.8 #score RCVD_IN_DUL_FH 0.8 #score RCVD_IN_RBL 1.8 #score RCVD_IN_RSS 1.8 Flipping back to your original post... I *think* what yo

Re: [SAtalk] required hits setup

2003-07-14 Thread Matt Kettler
At 11:37 AM 7/14/2003 -0600, Eric wrote: I setup the local.cf in my /etc/mail/spamassassin/local.cf with the line required_hits 1.00 for testing purposes... however after killing spamd and restarting the spam hits say 5.0 is the required_hits cutoff my score changes in local cf are worki

Re: [SAtalk] Re: Movie FILTER THIS VIRUS ALREADY!!!

2003-07-14 Thread Matt Kettler
At 07:38 PM 7/13/2003 -0400, Mike Leone wrote: > And who will pay for the software? No one - you use one of the free anti-virus scanners. agreed, clamav is free and work fine for this... However a better question would be "who will pay for the hardware upgrades".. Seeing as the server that runs

Re: [SAtalk] [ot] Dilbert

2003-07-12 Thread Matt Kettler
At 03:14 PM 7/12/03 -0300, Raul Dias wrote: Just some fun related. http://www.comics.com/comics/dilbert/archive/images/dilbert2003071742312.gif Heh, Dilbert isn't the only cartoon with a spam theme for the day: http://ars.userfriendly.org/cartoons/?id=20030712 I found it quite amusing that 2 of

Re: [SAtalk] How to remove the Spam report in the mail body

2003-07-11 Thread Matt Kettler
At 12:22 PM 7/12/03 +1000, Leo Huang wrote: Spamassassin adds the report in the body. How can I remove it? I tried to use "report_header 1", but it doesn't work. In 2.5x the "report_header" option no longer exist.. use "report_safe 2" instead. Check the man page for Mail::SpamAssassin::

Re: [SAtalk] BAYES_XX scores

2003-07-11 Thread Matt Kettler
At 12:56 PM 7/11/2003 -0500, Genchev, Sergei wrote: I use bayes tests and do not use network tests with SA 2.55. Thing that puzzles me is the default scores for my situation. Is there any reason that BAYES_80 score (5.3) is bigger then BAYES_90 score (4.027) and even BAYES_99 score (5.2)? BAYES_1

Re: [SAtalk] asian fonts induce false negatives?

2003-07-11 Thread Matt Kettler
Summary: Known bug in your version, fixed in 2.54 and newer. No, the Asian fonts have nothing to do with it. The reason for your false negative is that you're using 2.53, which is very well known to be easily abused by spammers. The REFERENCES and IN_REP_TO rules both have very large negative s

Re: [SAtalk] question about returning mail

2003-07-11 Thread Matt Kettler
At 04:44 PM 7/11/2003 +0400, dawnshade wrote: In this case: [EMAIL PROTECTED] - not real address. How i can tell to Spamassassin don't doing this It's not spamassassin that's doing it, spamassassin itself can't even try to do this. Exim however can do things like this, and it's Exim that needs

Re: [SAtalk] Syntax for dns_available test?

2003-07-10 Thread Matt Kettler
At 12:07 PM 7/10/2003 -0400, John P Verel wrote: dns_available test: server1.ltd, etc. Can someone clarify how to set this up? It's actualy .tld, not ltd.. In general what you do is instead of "server1.tld" specify some domain that you want SA to perform a MX record lookup for via dns. So in y

Re: [SAtalk] spam with no body...

2003-07-10 Thread Matt Kettler
At 12:57 PM 7/10/2003 -0400, VonEssen, John wrote: I have been seeing this sort of spam come up on several different mail servers I work on. The email is definitely spam and it tests positive for a few RBL, but not enough to raise its score significantly. The one I got the other day only scored 2.9

Re: [SAtalk] sa-learn question

2003-07-10 Thread Matt Kettler
At 02:47 PM 7/10/2003 -0400, Wendell Smith wrote: Can I feed sa-learn ONE file that contains a large number of emails? It should work if it's in mbox format and you tell sa-learn to use that format. The alternative is to use a tool to split it out into many files in a single directory and use the

Re: [SAtalk] tricky spam

2003-07-10 Thread Matt Kettler
At 11:53 AM 7/10/2003 -0300, German Staltari wrote: Hi, i've attahced a very tricky SPAM mail that has been scored with 0.8 points, what can be done with this kind of SPAM?. Thanks German This kind of spam is admittedly very well suited to bayes, as someone else already noted, but there are rules

Re: [SAtalk] A simple question

2003-07-10 Thread Matt Kettler
At 09:25 AM 7/10/2003 +0200, Timothée HESPEL wrote: Hello, I would like to know if we can use sa-learn --spam on tagged spam, or just on non-detected spam. Thanks Timothée HESPEL In general, sa-learn should be fed a nice balanced diet of all kinds of spam, tagged and otherwise. However feeding i

Re: [SAtalk] Exit when threshold/score reached

2003-07-09 Thread Matt Kettler
At 04:42 PM 7/9/2003 -0800, Chris Ochap wrote: I know I saw the option for spamassassin/spamd to stop scanning once the appropriate users score has been reached, but I cannot find it again. I have spamd/spamc running on qmail/vpopmail/maildrop with per user configs. I don't see it in perldoc Mail

RE: [SAtalk] Wow, spam with scores as low as 2.1??

2003-07-09 Thread Matt Kettler
At 10:46 AM 7/10/2003 +1200, Simon Byrnand wrote: >0.5 (Severe), Egads, > 1.5 (High), Ouch, > 4.0 (Medium), Oww. These three settings are going to give you false positives galore. 4.0 isn't all that bad.. according to STATISTICS.txt 4.0 should give you 0.44% FP rate in v 2.54, which is a

Re: [SAtalk] Very bad spamd performance!

2003-07-09 Thread Matt Kettler
At 10:06 PM 7/9/2003 +0200, Xavier wrote: Since a server crash (not spamd related), I've very bad performance! Only local mail is processed: more than 30" to check a mail! (was < 1" before) Any idea? Is there maybe some corrupted DB? 30 seconds is a very magic number.. that's how long SA waits fo

Re: [SAtalk] DOS Attack?

2003-07-09 Thread Matt Kettler
At 08:58 AM 7/9/2003 -0500, Mike Vanecek wrote: I think I am under a DOS attack on port 25. I have received 2172 smtp packets from the same location yesterday. Due to this activity I have set my firewall to reject all incoming packets from Japan. I notified [EMAIL PROTECTED], [EMAIL PROTECTED], and

Re: [SAtalk] Is this taking too long?

2003-07-09 Thread Matt Kettler
At 06:58 AM 7/9/2003 -0700, Robin Lynn Frank wrote: Jul 9 06:46:55 alpha13 spamd[3206]: identified spam (14.0/5.0) for rlfrank:501 in 32.3 seconds, 1836 bytes. This is on a pretty standard installation with razor2, pyzor and dcc active. Sounds/looks like one or more of your RBL checks are timing

Re: [SAtalk] subject_tag doesn't work

2003-07-09 Thread Matt Kettler
At 12:16 PM 7/9/2003 +0200, Aldo Mari wrote: but even if the score of spam is high (I see it in propertis of mail that is arrived X-Spam-Status: Yes, hits=101.4 required=7.5)...the subject of mail is NOT modified by *SPAM* WHY?? How are you calling SA? are you using a direct call in

Re: [SAtalk] This one got thru.

2003-07-09 Thread Matt Kettler
At 08:16 AM 7/9/2003 -0400, Bill wrote: Not sure how to filter this one. It only got a score of 0.1 Perhaps looking at the message headers might provide some better clues? Body rules aren't the strongest rules in the SA ruleset. --- This SF.Ne

Re: [SAtalk] server load increases with spamassassin

2003-07-09 Thread Matt Kettler
At 12:51 PM 7/9/03 +0800, Michael P. Carel wrote: thanks for the reply. What I also observed was, when a user used to send an email using pine mailer, which has a group addressbook, and used to send email to all that goup(which has a large list of email addresses) by including it all to CC: the se

Re: [SAtalk] server load increases with spamassassin

2003-07-08 Thread Matt Kettler
At 01:16 PM 7/9/03 +1200, Simon Byrnand wrote: > hi to all, > > I'm still having an unresolve problem with my Email server having > spamassassin. My server load increases when it scans less than a hundred > of > emails in transit. I'm running spamassassin daemon. > > Any idea why? Please help us

Re: [SAtalk] Definition of scores...

2003-07-08 Thread Matt Kettler
At 11:22 AM 7/8/2003 -0400, VonEssen, John wrote: In 50_scores.cf there are different formats of scores: score SCORE_NAME 0.0 3.017 0.0 2.635 or score SCORE_NAME 1.0 What is the difference and what do the extra fields mean? I would like to change the weighting of some dcc and rbl scores. It's i

Re: [SAtalk] Auto Whitelist strangeness

2003-07-08 Thread Matt Kettler
At 12:48 AM 7/8/2003 -0500, Thomas Cameron wrote: I just got a spam which scored 13.80 but had a -4.8 point AWL adjustment. I don't understand how it could have been whitelisted because it is obviously porn spam. It even rates a BAYES_70. How is it possible that it was whitelisted? This is a ver

Re: [SAtalk] Hoping that whom ever runs SA Site will get this

2003-07-07 Thread Matt Kettler
At 10:54 AM 7/7/03 -0700, Ben Johansen wrote: if I go into account options https://lists.sourceforge.net/lists/options/spamassassin-talk and give it my email address and click "Email My Password to Me" I never receive it. At first I thought it may be blocked by my mail server but checked the logs a

Re: [SAtalk] Local.cf

2003-07-07 Thread Matt Kettler
At 04:11 AM 7/3/2003 +0200, Andrea Riela wrote: Hi folks, I've problem with spamassassin 2.5x and local.cf on OpenBSD 3.3. I would see X-Spam-Report in the headers, but I can't. Report_header 1 doesn't work. Why? How could I see that? report_header is no longer a valid snort option. Read the curre

Re: [SAtalk] _REPORT_ format

2003-07-02 Thread Matt Kettler
At 11:42 AM 7/2/03 +0400, Andrew A. Vasilyev wrote: One can see which is more reader-friendly :-)) True, but I'd argue the old format is useless, regardless of readability. It doesn't list the names of the rules, just the descriptions, making the information it provides very limited in value. (

Re: [SAtalk] meaning of rule descriptions

2003-07-01 Thread Matt Kettler
At 02:45 AM 7/2/03 +0200, Klaus Heinz wrote: Hi, There's been several comments on these, but I wanted to give some concrete examples from real spam in my mailbox. Yes, all three of these are very common spam messages. # describe PREST_NON_ACCREDITED 'Prestigious Non-Accredited Universities' ba

Re: [SAtalk] Bug in whitelist_from?

2003-07-01 Thread Matt Kettler
At 02:41 PM 7/1/03 +0100, Adam T. Bowen wrote: in the man pages it says that whitelist_from only checks: Resent-From if available, otherwise Envelope-Sender Resent-Sender X-Envelope-From From Have things changed? From the 2.53 source code: if (defined

Re: [SAtalk] How to call SA in Sendmail?

2003-07-01 Thread Matt Kettler
At 02:34 AM 7/2/2003 +1000, Leo Huang wrote: Hello, I want to call spamc in the Sendmail, so the messages won't be re-scanned if it is delivered to multiple users. How to call SA in the sendmail? Use spamass-milter or a similar milter plugin to sendmail that calls SA.

Re: [SAtalk] Default Scores of 0.001

2003-07-01 Thread Matt Kettler
At 03:01 AM 7/1/2003 +0100, R.W. wrote: It's purely idle curiosity, but why are there so many default score entries of 0.001 ? During development they tend to assign 0.001 to new rules so that they are run and can be tested without any significant impact on normal mail. Eventualy when they GA the

Re: [SAtalk] Bug in whitelist_from?

2003-07-01 Thread Matt Kettler
At 12:04 PM 7/1/03 +0100, Adam T. Bowen wrote: We have received some email this morning with the From and To headers like: From: "" <> To: [EMAIL PROTECTED] and it is getting a USER_IN_WHITELIST -100 score. The whitelist rule causing this is: whitelist_from [EMAIL PROTECTED] whitelist_from

Re: [SAtalk] Getting a full report on uncaught spam

2003-06-30 Thread Matt Kettler
At 03:26 PM 6/30/2003 -0600, Mike Mills wrote: I'm having trouble running spamassassin to find out why a spam was not caught. I've tried invoking as follows: /usr/bin/spamassassin -D spam or ~/sausr/bin/spamassassin -D spam where spam is the message exported to a file. In both cases the proces

Re: [SAtalk] "Naughty" test names

2003-06-30 Thread Matt Kettler
At 07:41 PM 6/30/2003 +0200, Tony Earnshaw wrote: A dsjenwine problem. A what? Is this supposed to be the dutch spelling of genuine, not present anywhere within the visibility of even google? :) --- This SF.Net email sponsored by: Free pre-b

Re: [SAtalk] why is this not caught?

2003-06-30 Thread Matt Kettler
At 09:29 AM 6/30/2003 +0200, Martin Maechler wrote: Look at the message I've saved in ftp://stat.ethz.ch/U/maechler/spam-mail/please 1) why there's no check on the obvious spam subject Subject: PLEASE READ! Important Support Information and FAQs 2) I give small positive scores to the LINES

Re: [SAtalk] "full" test and attachments

2003-06-30 Thread Matt Kettler
At 03:18 PM 6/30/2003 +0200, [EMAIL PROTECTED] wrote: of which I thought it should match on mails which contain a file attachment like "test.zip": Content-Type: application/zip; name="test.zip"; But the test doesn't match. What could have went wrong? Is "full" the wrong test method? Based on th

RE: [SAtalk] New (to me) spam technique

2003-06-30 Thread Matt Kettler
At 03:22 PM 6/30/2003 +0100, Darren Coleman wrote: It would be nice, although ultimately unworkable I guess, if SA could be engineered to ignore anything which isn't humanly-visible in an email. i.e. when spammers insert fake PGP signatures in tags to lower their score - SA should ignore it. The p

Re: [SAtalk] BUGGY_CGI?

2003-06-29 Thread Matt Kettler
At 12:17 PM 6/29/03 -0700, Spam Sucks wrote: Anyone know what Spamassassin is testing to trip the BUGGY_CGI sensor? Is there a web site that lists the tests of each of the default settings? I could only find lists of the default scores and descriptions (even on the spamassasin.org site). The messag

Re: [SAtalk] Installing spamassasin...

2003-06-27 Thread Matt Kettler
At 11:28 AM 6/28/2003 +1000, Brad wrote: A quick search on Google found that there are several GUI front-ends and wizards for the Windows version of Spamassassin, which would streamline the installation considerably. Are there any such GUI environments for Linux? Or are we still confined to arcane

Re: [SAtalk] question: how to match '@' in body test

2003-06-27 Thread Matt Kettler
At 03:42 PM 6/27/2003 -0700, Marvin Raab wrote: I'm running SA 2.51 on Linux 7.3 with perl 5.6.1 I tried body [EMAIL PROTECTED] /[EMAIL PROTECTED]/ describe [EMAIL PROTECTED] searches for above phrase in body score [EMAIL PROTECTED] 15.0 The test is never executed. Also fails to execute: /[EMA

Re: [SAtalk] FORGED_MUA_AOL and AOL employees

2003-06-27 Thread Matt Kettler
At 04:57 PM 6/27/2003 -0600, Bryan Field-Elliot wrote: I've been exchanging mail with an actual employee of AOL, and his messages are always tagged as spam because they fail the FORGED_MUA_AOL filter. Obviously, he's a little upset about this! Is there something he could be doing differently, or

Re: [SAtalk] New trick

2003-06-27 Thread Matt Kettler
At 10:40 PM 6/27/2003 +0100, Martin Radford wrote: They could do this. On the other hand, there's some computational cost in generating the PGP signature, which is going to slow down the spam run. Alternatively, if they use the same message body for all messages (and hence the same signature) the

Re: [SAtalk] OT-spam virus? anyone heard of this?

2003-06-27 Thread Matt Kettler
At 03:23 PM 6/27/2003 -0400, Chris Santerre wrote: I checked sarc.com but nothing on it. I heard this on a car board I am on. Any truth? Yes, some spammers are in fact using trojan horses to create "spam zombies".. similar to how DDoS flooders will install trojans to use your machine to flood t

Re: [SAtalk] Is SUBJ_HAS_SPACES working?

2003-06-27 Thread Matt Kettler
At 09:00 AM 6/27/2003 -0600, Ken Gordon wrote: Using SA 2.55, a message with Subject: DealBook: New York Community Bancorp to Buy Roslyn Bancorp for $1.6 Billion was tagged as spam partly because it failed the SUBJ_HAS_SPACES test. (headers below). Is the test properly specified? 20_head_tests

Re: [SAtalk] user in whitelist

2003-06-27 Thread Matt Kettler
At 12:55 PM 6/27/03 +0200, Holger Glaess wrote: please help some users got mails with this score but i dident allow user_prefs or whitelists (only a central config where only root have access.) USER_IN_WHITELIST (-100.0 points)From: address is in the user's white-list i have no idea to change

Re: [SAtalk] Conflicting scores in SA/MailScanner

2003-06-27 Thread Matt Kettler
At 11:27 AM 6/27/03 +1200, Simon Byrnand wrote: Shouldn't it be possible to simply check for the presence of spamassassin markup before calling it a second time ?? No, because that's easily abused by spammers.. all they have to do is add a spamassassin markup to the header that says "not spam" an

Re: [SAtalk] Spamassasin License Question

2003-06-26 Thread Matt Kettler
At 04:57 PM 6/26/2003 -0700, Daniel Quinlan wrote: Under the terms of the GPL, that would constitute a modified version (even without changing any rules), so there are some additional terms that would need to be followed. The Artistic license is generally less restrictive, if more difficult to und

Re: [SAtalk] Conflicting scores in SA/MailScanner

2003-06-26 Thread Matt Kettler
At 04:30 PM 6/26/2003 -0500, Richard Humphrey wrote: I just set up MailScanner to run w SA/Sendmail and obviuously something isnt configured correctly. Notice the 2 conflicting scores. I want Mailscanner to do virus scanning and let SA take care of the spam. I thought I had this set in the conf fil

Re: [SAtalk] manicmail.net -- anonymous mailers

2003-06-26 Thread Matt Kettler
At 04:29 PM 6/26/2003 -0500, Charles Mount wrote: Does anyone have a good way of blocking mail from anonymous mailers like http://manicmail.net ? It may not be commercial email but it is certainly unwanted. FYI -- I use Sendmail-Switch with an access database and use the MimeDefang milter to pass

Re: [SAtalk] Spamassasin License Question

2003-06-26 Thread Matt Kettler
At 12:50 PM 6/26/2003 -0700, Ian Searle wrote: We are considering using a subset and derivative of the Spamassasin rules in a commercial product (WatchGuard's WFS-Spamscreen). My understanding of the license is that we need to attribute the rules we use to the Spamassasin development team in our p

Re: AW: [SAtalk] Another one

2003-06-26 Thread Matt Kettler
At 09:48 AM 6/26/03 -0400, Jack Gostl wrote: What really worries me is the growing number of messages between 4.5 and 5. Many of these already have a Bayes score of 90+. Agreed, this is why rule development for SA always has been, and always will be, an arms race. Spammers are aware of SpamAssas

Re: AW: [SAtalk] Another one

2003-06-26 Thread Matt Kettler
At 08:51 AM 6/26/03 -0400, Jack Gostl wrote: That PGP sig buried in HTML sticks out like a sore thumb. Even better, if you check my post from 6/14, most of these have a PGP signature block, but are without a "begin pgp signed message" block.. Try this meta rule pair for a starter. I can't guara

Re: [SAtalk] DCC Source

2003-06-25 Thread Matt Kettler
At 09:37 PM 6/25/03 -0400, Scott Rothgaber wrote: For some reason, I am unable to connect to `calcite.rhyolite.com' via HTTP. Is there a way to fetch the DCC tarball via FTP? Is there an alternate site? Thanks! Scott From the rhyolite.com dcc web-page: "The DCC source and documentation is avail

Re: [SAtalk] how to add more points according to message size?

2003-06-25 Thread Matt Kettler
At 04:43 AM 6/26/03 +0800, Dan Jacobson wrote: How does one add more points according to message size? Maybe I must check for a Lines: header, then what? Anyway, say I want to add 2 points per 100 KB. i.e. $message_size/5 I don't think you can do this with a simple rule, but if you dig out an o

Re: [SAtalk] wtf? global destruction?

2003-06-25 Thread Matt Kettler
At 08:51 AM 6/25/2003 -0700, Jonathan Nichols wrote: Now THIS is a scary thing to see in /var/log/mail: Jun 25 08:49:49 jezebel spamd[28618]: Attempt to free non-existent shared string during global destruction. I half expected a computer named Joshua to ask me if I'd like to play a game. What

Re[2]: [SAtalk] Newbe question: How to make SA learn spam with remote users using Outlook in POP3 mode?

2003-06-24 Thread Matt Kettler
At 09:44 PM 6/23/2003 -0700, Robert Menschel wrote: MK> This is an oft-requested item, but AFAIK it is simply impossible. It should be possible... Not with outlook :) It is theoreticaly possible with the right mailsystem, but Outlook just isn't such a tool. It _might_ be possible for them to d

Re: [SAtalk] Spamassassin hangs on spamassassin -t test....

2003-06-23 Thread Matt Kettler
At 05:05 PM 6/23/03 -0400, John McGivern wrote: Hi! I did the make/ make install for SA 2.53 and everything looks fine at that point. I then do the test "spamassassin -t [PATH TO]sample-nonspam.txt OR sample-spam.txt and nothing happens - forever. I have another live computer running SA 2.31

Re: [SAtalk] Newbe question: How to make SA learn spam with remote users using Outlook in POP3 mode?

2003-06-23 Thread Matt Kettler
At 12:39 PM 6/23/2003 -0400, Bill wrote: I was wondering how to set up a spam address that would accept forwarded messages from users and feed them into SA for learning as spam. Is there an easy way to do this? Is SA smart enough to know not to blacklist the sender of the forwarded message and to o

Re: [SAtalk] BASE64_ENC_TEXT skipping rules???

2003-06-23 Thread Matt Kettler
At 11:07 AM 6/23/2003 -0400, Chris Santerre wrote: OK, I've had some problems tagging this repetitive spam. I'm using SA 2.43 (quiet you!) :) I'm getting excellent results! But this one has got me goofy. It simply skips some of my rules!! I'm not sure why. In the header you can see it hits MY_D

Re: [SAtalk] BASE64_ENC_TEXT skipping rules???

2003-06-23 Thread Matt Kettler
At 11:07 AM 6/23/2003 -0400, Chris Santerre wrote: I'm getting excellent results! But this one has got me goofy. It simply skips some of my rules!! I'm not sure why. In the header you can see it hits MY_DSL which is a header rule. But I have a specific rawbody rule for "Stop Mailings here" and a

Re[2]: [SAtalk] robots and scores

2003-06-23 Thread Matt Kettler
At 06:23 PM 6/23/03 +0400, Maxim Berlin wrote: Thanks for answer, but i am still confused. Two passes: sendmail input(1)->majordomo->sendmail output(2), am i correct? (1) should not tag message, because sender is in whitelist_from. Is it? Are you SURE that the sender that appeared in the headers pr

Re: [SAtalk] spamassassin supported??

2003-06-23 Thread Matt Kettler
At 09:52 AM 6/23/03 -0400, Bob Young wrote: Hello, Could you tell me if spamm assassin is supported with eudora 5.2 under redhat 6.2. Um, is eudora supported under redhat 6.2? Or do you have a RedHat 6.2 mailserver that eudora pops from? In general what MUA you use is more-or-less irrelevant if

Re: [SAtalk] robots and scores

2003-06-23 Thread Matt Kettler
At 01:41 PM 6/23/03 +0400, Maxim Berlin wrote: so, i've -98.1 hits, and no X-Spam-Flag: YES, but subject was rewritten. Is that a bug, or i do not understand something? This kind of general behavior usually happens when a message gets run through SA twice. The first run tags it, but the second one

Re: [SAtalk] How to know RBL check is enabled?

2003-06-23 Thread Matt Kettler
At 05:54 PM 6/23/03 +1000, Clement wrote: Do you know if I have missed anything? Do you have Net::DNS installed? Try spamassassin -tD --- This SF.Net email is sponsored by: INetU Attention Web Developers & Consultants: Become An INetU Hostin

Re: [SAtalk] Spam got score -80.6 - Spamassassin 2.55

2003-06-22 Thread Matt Kettler
At 03:14 PM 6/23/03 +1200, Simon Byrnand wrote: I've suggested before on the list that predefined whitelists for places like amazon.com should be much less than -100, just -10, or perhaps even -5. Enough to offset any "spamminess" that might otherwise bump them over over the threshold, but not s

Re: [SAtalk] Spam got score -80.6 - Spamassassin 2.55

2003-06-22 Thread Matt Kettler
At 12:15 PM 6/23/03 +1200, Simon Byrnand wrote: At 00:41 23/06/03 +0200, Bernd Kuhls wrote: Hi, got this nice baby: Greetings, Bernd [snip] Just wondering, how exactly does posting a copy of that message to this list help anyone ? a) There is no indication of what version of SpamAssassin proce

Re: [SAtalk] autolearn/autowhitelist misguided

2003-06-22 Thread Matt Kettler
At 08:30 PM 6/21/03 -0400, Gordon Cormack wrote: Auto-learn and auto-whitelist use different scoring criteria from those used in spamassassin's spam filtering. The bayes auto-learning does not use "it's own" scoring mechanism, it uses scoreset 0. This is the score the email would get by the main S

Re: [SAtalk] Net::DNS tests skipped.

2003-06-22 Thread Matt Kettler
At 03:30 PM 6/21/03 +0100, Jim Ford wrote: Hi, A bit OT here - I've posted to the net-dns list, but I feel I'm more likely to get a response here! I'm trying to use Net::DNS with spamassassin without success so far. I've grabbed Net-DNS-0.38 and installed it, but when I run the test suite I get t

Re: [SAtalk] Razor checks...

2003-06-21 Thread Matt Kettler
At 03:21 PM 6/21/03 -0700, Cassandra Lynette Brockett wrote: I'm just wondering if anyone knows how the razor checks work. The reason I ask is that I have spamassassin running twice on all messages - once in a milter and once from the glocal procmail file. I have started to notice messages that h

Re: [SAtalk] SA and subject rewrites

2003-06-20 Thread Matt Kettler
At 04:30 PM 6/20/2003 -0500, Roger wrote: In invoking SA via amavisd-new I don't believe there's anything on amavis' end thats needs to be changed. Below is a copy of my local.cf - from looking over the man page this would appear to be enough to rewrite the subject header - but messages w/ hits

Re: [SAtalk] Failed to parse line in SA config.

2003-06-20 Thread Matt Kettler
At 08:44 PM 6/20/2003 +0100, you wrote: On Fri, Jun 20, 2003 at 03:04:26PM -0400, Matt Kettler wrote: > What version of SA are you using? Works fine on my copy of 2.54.. 2.55 Here's the start of my ~.spamassassin/user_prefs - looks alright to me! # SpamAssassin user preferences fi

Re: [SAtalk] Failed to parse line in SA config.

2003-06-20 Thread Matt Kettler
At 05:00 PM 6/20/2003 +0100, Jim Ford wrote: I've got in my SA user_prefs file 'dcc_path /usr/local/bin', which is where dccproc lives, but I'm getting: 'Failed to parse line in spamassassin configuration: skipping dcc_path /usr/local/bin' What version of SA are you using? Works fine on my copy

Re: [SAtalk] How can I tell DNS is working?

2003-06-20 Thread Matt Kettler
At 05:54 PM 6/20/2003 +0100, Jim Ford wrote: I've now installed Net:DNS, and put 'dns_available test' in my user_prefs. I've not seen any sign of it working in my maillog yet (I've got the -D option for spamd), how can I tell if it's working, please? The fastest way is to fire up the plain command-

Re: [SAtalk] What helper ap should I add on next?

2003-06-19 Thread Matt Kettler
At 07:11 PM 6/19/2003 +0100, Jim Ford wrote: Hi, Looks like I've got DCC working with SA OK - with Razor, another piece of the jigsaw! Any recommendations as to what remote anti-spam service I should add next? Well, if you've got DCC and razor going, there's only 2 other possible optional pieces

Re: [SAtalk] Question on usage before MTA...

2003-06-19 Thread Matt Kettler
At 09:36 PM 6/19/2003 +0200, TeamHost Limited wrote: getting closer on this one ;-) > What database? the bayes database? Why bother? In order to have one one database which needs work on but several servers / ISPs to use it. Why should there be xxx databases to work on?? I think it is easier to ha

Re: [SAtalk] Question on usage before MTA...

2003-06-19 Thread Matt Kettler
At 08:51 PM 6/19/2003 +0200, TeamHost Limited wrote: Hi Matt, thanks for the information. Is it possible to have mailservers share SA database? What database? the bayes database? Why bother? Is it possible with SA to - set an address to send all possible spam to? No, SA never sees the delivery e

Re: [SAtalk] Question on usage before MTA...

2003-06-19 Thread Matt Kettler
At 12:55 PM 6/19/2003 +0200, TeamHost Limited wrote: Hello list. Is it possible to use spamassassin before it reaches the server?? We would like to implement it on a firewall system which is set in front of our servers. Would this be possible? Has anyone done that yet? What is needed? No, this is

Re: [SAtalk] whitelist_from_rcvd question

2003-06-18 Thread Matt Kettler
At 02:59 PM 6/18/2003 -0700, Mike Batchelor wrote: Received: from unys-2.namewithheld.com (webmail2.usainteractive.com [209.11.17.108]) by lax1msa1.tmcs.net (8.12.9/8.12.9/200306171005) with ESMTP id h5IJZO0q028359 for <[EMAIL PROTECTED]>; Wed 18 Jun 2003 12:35:24 -0700 "unys-2.n

Re: [SAtalk] SA hit threshold and whitelist_from problem.

2003-06-18 Thread Matt Kettler
At 06:44 PM 6/18/2003 -0400, Steve Fulton wrote: Hi all, I recently installed SA on a mail server, only applying globally right now -- no individual user configurations. I've discovered that when I add "whitelist_from ..." entries to the local.cf file, SA let's spam in that is marked above the

Re: [SAtalk] Setting local values for rbl checks

2003-06-18 Thread Matt Kettler
At 01:47 PM 6/18/2003 -0400, Theo Van Dinter wrote: On Wed, Jun 18, 2003 at 11:19:53AM -0600, Lucas Albers wrote: It sees your entries correctly. > spamassassin -D, against a test message and I get the following errors: > > debug: Failed to parse line in SpamAssassin configuration, skipping: > RCVD

Re: [SAtalk] Bayesian and SpamAssassin

2003-06-18 Thread Matt Kettler
At 09:51 AM 6/18/2003 -0500, Oleg Aronov wrote: Hello, I have question and hope that somebody will help me. Please... So, few days ago I installed and configured SpamAssassin on Linux. The SA is works fine, but he is catching only about 20% of spam emails. I believe that I should

Re: [SAtalk] SA-LEARN

2003-06-18 Thread Matt Kettler
At 10:06 AM 6/18/2003 -0400, Mike Wagner wrote: I have a RedHat 9 box with sendmail and spamassassin running. I installed both from the redhat cd and have done no additional configuration, other than setting up procmail to feed to spamc. Spamassassin works great, it detects spam and marks it as s

Re: [SAtalk] Razor Default Score

2003-06-17 Thread Matt Kettler
At 05:56 PM 6/17/03 -0500, Link, Pete wrote: If I understand the process correctly, Spamassassin fires up the Razor checks and assigns a score. My question: How does one increase the default score? edit your local.cf or user_prefs and add: score RAZOR2_CHECK 4.0 or whatever other

Re: [SAtalk] How to create rule in SpamAssassin?

2003-06-17 Thread Matt Kettler
At 04:32 PM 6/17/03 -0500, Oleg Aronov wrote: Hello, I just installed and configured SpamAssassin (with amavisd-new and Postfix). And it's working, but I want to create few more rules by myself which I want to use, but unfortunately I have no idea how I can do it. Hope somebody will help m

Re: [SAtalk] Low scoring

2003-06-17 Thread Matt Kettler
At 12:32 PM 6/17/2003 -0500, Fogle, Don - OPS System Administrator wrote: I have a Redhat 7.3 system running Postfix, Spamassassin 2.55 and Amavisd-new that filters mail and relays it on to an Exchange server. I have noticed that obvious spam is not being caught and is being relayed on. One of t

Re: [SAtalk] New one for me

2003-06-13 Thread Matt Kettler
At 08:51 PM 6/13/03 -0700, you wrote: Anyone have a nice rule that will catch the attached? It got negative scores with fake In-Reply-To, Approved-By, and X-Authentication-Warning lines. Also, note the faked PGP signature with random words following it. Sure is a lot of trouble to go through just t

Re: [SAtalk] spamassassin......

2003-06-13 Thread Matt Kettler
At 08:31 PM 6/13/03 +0200, Kai Schaetzl wrote: You don't need to subscribe to send mail to this list? Isn't that nonsense? Read the archives.. this list is an open list, and it always has been.. This gets discussed at least once every 3 months, usually whenever a spam message gets posted and some

Re: [SAtalk] spamassassin......

2003-06-13 Thread Matt Kettler
If you are getting spam messages that have been tagged by spamassassin, and would rather get your spam messages un-tagged, contact your ISP and ask them to disable the product for your account. I strongly suspect this is what your are experiencing, but you weren't specific about what emails you

Re: [SAtalk] Spamassassin vs spamd vs spamc

2003-06-12 Thread Matt Kettler
At 10:24 PM 6/12/03 -0400, Jose M.Herrera wrote: What is the difference to put in procmailrc, "| spamassassin", "| spamd" or "|spamc" Well you never first off you absolutely never | spamd in procmailrc... That's just not a valid option. spamd and spamc are a pair and are used together not s

Re: SA in Mailshield by Lyris / (was) Re: [SAtalk] OT: SCO may have violated GNU

2003-06-12 Thread Matt Kettler
At 05:51 PM 6/12/2003 +0100, Peter Campion-Bye wrote: > http://www.mailshield.com/products/mailshield/server/whats_new.html At the bottom of the page in the above link is the line: Note: SpamAssassin is a trademark of Deersoft, Inc Putting www.deersoft.com into a browser takes you to the McAfee

Re: [SAtalk] black listing domain

2003-06-11 Thread Matt Kettler
At 04:35 PM 6/11/03 -0800, [EMAIL PROTECTED] wrote: I am trying to black list send4fun.com. I am using spamd and was reading the man page for spamassassin and am wondering if I have the syntax right to add this domain to the blacklist. spamassassin -r -W send4fun.com Would that be correct? And whe

Re: [SAtalk] OT: SCO may have violated GNU

2003-06-11 Thread Matt Kettler
At 05:08 PM 6/11/2003 -0500, Justin Shore wrote: I don't have any information about this either, only a thought. If I contributed code to an open source project like SA, I'm contributing it under the conditions of whatever licensing scheme(s) the project already utilizes. Yes, this is the case fo

Re: [SAtalk] spamd

2003-06-11 Thread Matt Kettler
At 04:02 PM 6/11/2003 -0400, David Yang wrote: Hi there, How can correctly start deamon spamd ? My first question is how are you starting it now, and what is sending it SIGTERMs? Really you should start one and only one spamd process, from a system startup script. It looks like you're winding

Re: [SAtalk] SA and time zones

2003-06-11 Thread Matt Kettler
SA should correctly interpret the times, using the specified RFC compliant timezone indication. (I *think* this is done by normalizing all the times to -000 before comparison) Could you post an example set of Received: headers and Date: header? At 03:06 PM 6/11/2003 -0400, Louis Bohm wrote: How

RE: [SAtalk] OT: SCO may have violated GNU

2003-06-11 Thread Matt Kettler
At 01:23 PM 6/11/2003 -0400, Shayne Lebrun wrote: Of course it's legal. If they've made any changes to SA, they're obligated to release them to anybody who buys the product (NOT necessarily to have them publically available on a web/FTP site; that's just usually the route people take.) If they'

Re: [SAtalk] adding a special "whitelist" via a local rule

2003-06-11 Thread Matt Kettler
At 01:24 PM 6/11/03 +0200, [EMAIL PROTECTED] wrote: Hi However looking at the syntax in the answer to Q1.13, I dont know how to add such a rule? At the risk of being self promoting, I've got a rule writing guide. It might be a bit of overkill, but should cover what you need. http://mywebpages.co

<    5   6   7   8   9   10   11   12   13   >