RE: [SAtalk] general question about usage of SA

2004-01-28 Thread Mike Schrauder
Mike Schrauder Specialty Blades, Inc. -Original Message- From: Ross Tsolakidis [mailto:[EMAIL PROTECTED] Sent: Monday, January 26, 2004 6:06 PM To: [EMAIL PROTECTED] Subject: [SAtalk] general question about usage of SA Hi all, Can I only filter selected domains even individual mailboxes

[SAtalk] Rules to flag these stupid virus warnings?

2004-01-27 Thread Mike Batchelor
I am about ready to just open the message body with MIMEDefang and whack anything that mentions "InterScan" with extreme prejudice (like, forward it to InterScan's Postmaster, until they forcibly distribute a patch to all their customers that disables this stupid, stupid mis-feature). But befor

Re: [SAtalk] new chicnpox --lint failed

2004-01-26 Thread Mike Zanker
On 24 January 2004 14:29 +0100 Arpi <[EMAIL PROTECTED]> wrote: Hi, After upgrading chichekpox to Version 1.11, spamassassin --lint fails on every server i tried (spamassassin 2.62, perl 5.8.2). Fixed in version 1.14 (which RulesduJour downloaded yesterday). -- Mike Zanker Northampton,

RE: [SAtalk] Typo outs spammer

2004-01-26 Thread Mike Kercher
I found the following on Dwight Halstead: http://www.autosndeals.com/ur/ur,,_t,,itemview,,itemid,,1310.ne.aspx http://www.thewellcommunity.org/Forums/topic.asp?TOPIC_ID=173 http://www.nexx.iact1.com/88191/index.cfm Some even have phone numbers :) > -Original Message- > From: [EMAIL P

[SAtalk] Re: SA 2.63, Backhair, Chickenpox and UUencoded .pdf file

2004-01-24 Thread Mike Bostock
In your message regarding SA 2.63, Backhair, Chickenpox and UUencoded pdf file dated Thu, 22 Jan 2004 21:07:17 +, Mike Bostock said that ... >MB- Received false negative due to its attachment. I meant false positive - sorry >MB- >MB- Header of attachment was >MB- >MB- &qu

Re: [SAtalk] SA 2.63, Backhair, Chickenpox and UUencoded .pdf file

2004-01-23 Thread Mike Bostock
In your message regarding Re: [SAtalk] SA 2.63, Backhair, Chickenpox and UUencoded .pdf file dated Fri, 23 Jan 2004 11:00:25 +, Mike Bostock said that ... >MB- In your message regarding [SAtalk] SA 2.63, Backhair, Chickenpox and >MB- UUencoded .pdf file dated Thu, 22 Jan 2004 21:07:17

Re: [SAtalk] SA 2.63, Backhair, Chickenpox and UUencoded .pdf file

2004-01-23 Thread Mike Bostock
In your message regarding [SAtalk] SA 2.63, Backhair, Chickenpox and UUencoded .pdf file dated Thu, 22 Jan 2004 21:07:17 +, Mike Bostock said that ... >MB- Received false negative due to its attachment. I posted a correction to this from home but it doesn't seem to have appeared on

[SAtalk] SA 2.63, Backhair, Chickenpox and UUencoded .pdf file

2004-01-22 Thread Mike Bostock
OP_NET RBL: Received via a relay in bl.spamcop.net [Blocked - see <http://www.spamcop.net/bl.shtml?193.252.22.130>] 0.0 CASHCASHCASH Contains at least 3 dollar signs in a row 0.0 UPPERCASE_50_75message body is 50-75% uppe

Re: [SAtalk] SA under MIMEDefang, how to I get autolearn flags added?

2004-01-22 Thread Mike Batchelor
--On Wednesday, January 21, 2004 5:17 PM -0800 Ian White <[EMAIL PROTECTED]> wrote: Try the following bit of code in your filter_end before you write the headers. if (!defined($SASpamTester->{auto_learn_status})) { $learn = "no"; } elsif ($SA

[SAtalk] Two line spam that refuses to be caught

2004-01-22 Thread Mike Loiterman
hat this is and hopefully find a way to kill it? - -- Mike Loiterman grantADLER Tel: 630-302-4944 Fax: 773-442-0992 Email: [EMAIL PROTECTED] PGP Key 0xD1B9D18E -BEGIN PGP SIGNATURE- Version: PGP 8.0.3 Comment: Digitally signed by Mike Loiter

Re: [SAtalk] Spamassassin on Suse 9.0?

2004-01-21 Thread Mike Grau
Any thoughts on the simplest way of installing spamassassin _and_ keeping it current? On Redhat I used CPAN, no problems with it, guess I'm not 100% sure on the benefits of doing it using CPAN vs RPM. Any other "gotchas" with Suse and Spamassassin that I should know of? Quick search of the archi

Re: [SAtalk] SA under MIMEDefang, how to I get autolearn flags added?

2004-01-21 Thread Mike Batchelor
--On Wednesday, January 21, 2004 5:06 PM -0700 Nels Lindquist <[EMAIL PROTECTED]> wrote: What exactly are you trying to accomplish? Maybe there's another way. I want to generate some kind of record in the logs, or record in the mail headers, indicating what the autolearn disposition of the mess

[SAtalk] SA under MIMEDefang, how to I get autolearn flags added?

2004-01-21 Thread Mike Batchelor
SA 2.6x run by itself out of .procmailrc or spamc/spamd seems to add an autolearn=X flag to tell you what happened to the message as it interacted with the autolearn system. But I run SA+MD on a relay, and I don't get these flags when calling spam_assassin_check() from mimedefang-filter's filt

RE: [SAtalk] Spam Assassin as a Filter then Forward Mail to MS Exchange

2004-01-21 Thread Mike Kercher
I agree...certainly use MailScanner. Ultimately, this is a job for the MTA though. I can give you exact details on how to do it with sendmail. If you use Postfix, someone else will have to help you. Mike > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROT

RE: [SAtalk] Automated ruleset download

2004-01-20 Thread Mike Smith
should pick up the new rules. Any info would be great...I've been following all the BIGEVIL and TRIPWIRE threads lately...Great work! - Mike smime.p7s Description: S/MIME cryptographic signature

RE: [SAtalk] 2.62 Problems

2004-01-18 Thread Mike Loiterman
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Theo Van Dinter <mailto:[EMAIL PROTECTED]> wrote: > On Sun, Jan 18, 2004 at 02:10:12PM -0600, Mike Loiterman wrote: >> Hrmm...I guess I would just build SA with that perl? Like perl5.6 >> Makefile.PL? I might mess with that

RE: [SAtalk] 2.62 Problems

2004-01-18 Thread Mike Loiterman
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Theo Van Dinter <mailto:[EMAIL PROTECTED]> wrote: > On Sun, Jan 18, 2004 at 01:16:26PM -0600, Mike Loiterman wrote: >> Anyone else seeing problems like this when they start 2.62 >> >> [12:39:50 [EMAIL PROTECTED]: /home/mi

[SAtalk] 2.62 Problem

2004-01-18 Thread Mike Loiterman
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Anyone else seeing this in 2.62 when the start up: [12:39:50 [EMAIL PROTECTED]: /home/mike]# /usr/local/etc/rc.d/spamass.sh start Can't use subscript on split at /usr/local/lib/perl5/site_perl/5.005/Mail/SpamAssassin.pm line 100, ne

[SAtalk] 2.62 Problems

2004-01-18 Thread Mike Loiterman
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Anyone else seeing problems like this when they start 2.62 [12:39:50 [EMAIL PROTECTED]: /home/mike]# /usr/local/etc/rc.d/spamass.sh start Can't use subscript on split at /usr/local/lib/perl5/site_perl/5.005/Mail/SpamAssassin.pm line 100,

[SAtalk] Bayes NFS safe?

2004-01-15 Thread Mike Jackson
do this because the SQL-based Bayesian filtering doesn't quite look ready for prime time. Mike Jackson Technical Manager, efn.org www.efn.org --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Developmen

Re: [SAtalk] X-MAILER header

2004-01-14 Thread Mike Batchelor
--On Wednesday, January 14, 2004 3:37 PM -0500 Ben Hanson <[EMAIL PROTECTED]> wrote: It always stamps a header that reads: X-Mailer: Chilkat ActiveX Mail Control (www.chilkatsoft.com). It's all legitimate internal business traffic. Ben Hanson I.S. MGR Transprint USA Inc. "X-Mailer: Mulberry/3.1

Re: [SAtalk] a goof-proof (?) test for evil mailers

2004-01-14 Thread Mike Batchelor
Good one! I noticed this, too, but I call SA from MIMEDefang, so my MTA hasn't yet added a Received: header when MIMEDefang calls filter_recipient(). But it was easier for me to reject these without even bothering to run it through SpamAssassin (which I call later from filter_end()). sub filt

Re: [SAtalk] Spamwriter

2004-01-14 Thread Mike Batchelor
--On Wednesday, January 14, 2004 8:28 AM -0600 Bob Apthorpe <[EMAIL PROTECTED]> wrote: IDP broadband providers that give their customers direct access to port 25 on remote systems by default. Spam from AOL dropped to almost nothing once they did that. Oh, one other thing - when did they do that?

Re: [SAtalk] Scoring the Habeas header ...

2004-01-14 Thread Mike Batchelor
--On Wednesday, January 14, 2004 2:48 PM -0500 John Ruttenberg <[EMAIL PROTECTED]> wrote: Mike Batchelor: And as soon as SA is upgraded to recognize when a lawsuit is pending, I might turn the HABEAS_SWE rule back on. Until then, a forged Habeas header is a free pass for spam to get throu

Re: [SAtalk] Spamwriter

2004-01-14 Thread Mike Batchelor
--On Wednesday, January 14, 2004 8:28 AM -0600 Bob Apthorpe <[EMAIL PROTECTED]> wrote: IDP broadband providers that give their customers direct access to port 25 on remote systems by default. Why should I have to pay extra for a business-class DSL line just so I can avoid using the ISP's heavily

Re: [SAtalk] Scoring the Habeas header ...

2004-01-14 Thread Mike Batchelor
--On Tuesday, January 13, 2004 3:07 PM -0600 Rich Puhek <[EMAIL PROTECTED]> wrote: Be patient. Use additional rules/tools to catch the latest spammers (clue: most come from spam zombie processes). Report the Habeas violators (more $$$ out of the spammers pockets!). Let's keep the Habeas marks as

Re: [SAtalk] Scoring the Habeas header ...

2004-01-14 Thread Mike Batchelor
--On Tuesday, January 13, 2004 11:39 AM -0800 Brian May <[EMAIL PROTECTED]> wrote: IF spammers use the Habeas headers, and the message is in fact spam, they will be sued. And as soon as SA is upgraded to recognize when a lawsuit is pending, I might turn the HABEAS_SWE rule back on. Until then, a

Re: [SAtalk] whitelist_from_rcvd - must domains resolve?

2004-01-13 Thread Mike Batchelor
--On Monday, January 12, 2004 10:07 PM -0500 Matt Kettler <[EMAIL PROTECTED]> wrote: Like this: whitelist_from_rcvd [EMAIL PROTECTED] NTDOMAIN.private.dns Should that work? No, not unless your MTA can resolve an IP to NTDOMAIN.private.dns and put it into a Received: header. NTDOMAIN.private.dns

RE: [WL] Re: [SAtalk] OT: forged habeus mark

2004-01-13 Thread Mike Batchelor
--On Tuesday, January 13, 2004 1:26 PM -0700 Nels Lindquist <[EMAIL PROTECTED]> wrote: If you encounter one shady business with a forged BBB certificate on the wall, does that mean you'll never trust the BBB again? The BBB-seal-forger doesn't lie and cheat his way onto my premises in order to ma

Re: [SAtalk] How to find values assigned to different tests?

2004-01-13 Thread Mike Leone
Rich Puhek ([EMAIL PROTECTED]) had this to say on 01/13/04 at 15:45: > > I put together a little script to generate a summary. An example recent > spam gives the following output: Looks nice. However, the mail has already been forwarded to my Exchange server, so it's not on my mail gateway any

Re: [SAtalk] How to find values assigned to different tests?

2004-01-13 Thread Mike Leone
Matt Kettler ([EMAIL PROTECTED]) had this to say on 01/13/04 at 15:21: > At 02:47 PM 1/13/2004, Mike Leone wrote: > >Matt Kettler ([EMAIL PROTECTED]) had this to say on 01/13/04 at 14:22: > >> At 02:12 PM 1/13/2004, Mike Leone wrote: > >> >I have a spam that scored

Re: [SAtalk] How to find values assigned to different tests?

2004-01-13 Thread Mike Leone
Matt Kettler ([EMAIL PROTECTED]) had this to say on 01/13/04 at 14:22: > At 02:12 PM 1/13/2004, Mike Leone wrote: > >I have a spam that scored like this: > > > >X-Spam-Status: No, hits=2.4 tagged_above=-999.0 required=5.0 > >tests=BAYES_56, > >

[SAtalk] How to find values assigned to different tests?

2004-01-13 Thread Mike Leone
I have a spam that scored like this: X-Spam-Status: No, hits=2.4 tagged_above=-999.0 required=5.0 tests=BAYES_56, FORGED_OUTLOOK_TAGS, HTML_60_70, HTML_IMAGE_ONLY_02, HTML_MESSAGE In my local.cf, I made the test HTML_IMAGE_ONLY_02 score 3 points. That would mean that the other tes

[SAtalk] .cf precedence and whitelist

2004-01-13 Thread Mike Carlson
in and always get through no matter the score and I didnt know if whitelist_from was enough.   --Mike

RE: [SAtalk] Rules Score

2004-01-13 Thread Mike Carlson
Yes I did mean spamd.   Thanks, --Mike   From: Matt KettlerSent: Tue 1/13/2004 7:39 AMTo: Mike Carlson; [EMAIL PROTECTED]Subject: Re: [SAtalk] Rules Score At 07:19 AM 1/13/04 -0600, Mike Carlson wrote: >Do you have restart spamassassin if you change a score on a rule? I assume you m

[SAtalk] Rules Score

2004-01-13 Thread Mike Carlson
Do you have restart spamassassin if you change a score on a rule?   --Mike

Re: [SAtalk] filter suggestions

2004-01-12 Thread Mike Leone
Brian McGroarty ([EMAIL PROTECTED]) had this to say on 01/12/04 at 23:37: > What's the proper way to suggest a new filter to the SA developers? > > I'm getting a TON of mail with a bunch of random uncommon-but-real > words to thwart Bayesian filtering, combined with a single picture > link. Spama

[SAtalk] whitelist_from_rcvd - must domains resolve?

2004-01-12 Thread Mike Batchelor
I need to make some entries in whilist_from_rcvd. But the only hostnames in the Received: header that I can trust, are not resolveable. Does that matter? Is it a simple pattern/string match, or does SA also try to resolve the hostname? Like this: whitelist_from_rcvd [EMAIL PROTECTED] NTDOMAIN

RE: [SAtalk] SA Performance .......

2004-01-12 Thread Mike Carlson
I am running SA on a PIII 450 with 384 MB of RAM and it processes about 5k to 6k of messages (92% spam) a day without ever hitting swap.   --Mike From: Andy DonovanSent: Mon 1/12/2004 10:38 AMTo: [EMAIL PROTECTED]Subject: [SAtalk] SA Performance ... Could I ask a quick poll on the # of

[SAtalk] Sendmail/Milter/ProcMail/Spamassassin

2004-01-12 Thread Mike Carlson
then setup a recipe to delete the emails based on score or does procmail replace the milter? This is a sitewide setup with this box being a gateway for out Notes server so I don't have any user based preferences. --Mike --- This SF.net

RE: [SAtalk] Your threshold score

2004-01-12 Thread Mike Carlson
I have ours set to 5.5. With 5.0 I had too many false positives. Our company came to the conclusion that a few missed spams were better than a few missed sales requests so we just deal with the handful of emails that get past the filter.   --Mike     From: Carl ChipmanSent: Mon 1/12/2004 9

RE: [SAtalk] Bigevil.cf 2.06f problems

2004-01-09 Thread Mike Loiterman
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Russell Mann <mailto:[EMAIL PROTECTED]> wrote: >> I did a lynx -dump > >> /etc/mail/spamassassin/bigevil.cf. Hrmm...are there any special >> requirements above and beyond what SA requires? >> >> - -

RE: [SAtalk] Bigevil.cf 2.06f problems

2004-01-09 Thread Mike Loiterman
x -dump > /etc/mail/spamassassin/bigevil.cf. Hrmm...are there any special requirements above and beyond what SA requires? - -- Mike Loiterman grantADLER Tel: 630-302-4944 Fax: 773-442-0992 Email: [EMAIL PROTECTED] PGP Key 0xD1B9D18E -BEGIN PGP SIGNATURE-

RE: [SAtalk] Country codes

2004-01-09 Thread Mike Kuentz (2)
;t write down who posted it, so I'm sorry I can't give appropriate credit to them. I removed .uk & .in from the list since we get mail from those two. Mike > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Eric > Sent: F

RE: [SAtalk] Oh Joy, another abusable URI redirector

2004-01-09 Thread Mike Kuentz (2)
l the rule above or below fail since the q is represented by it's hex code in the URL? Or is the hex code translated to q for the uri test? Mike > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of David B Funk > Sent: Friday, J

[SAtalk] Bigevil.cf 2.06f problems

2004-01-09 Thread Mike Loiterman
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Using 2.06f of bigevil and getting *lots* of these types of errors: SpamAssassin tests, skipping: (Can't find string terminator '"' anywhere before EOF, chunk 43. ) - ------ Mike Loiterman grantADL

RE: [SAtalk] RedHat init

2004-01-08 Thread Mike Kuentz (2)
amp;& touch /var/lock/subsys/spamd ;; Just put it between the start) and *) statements in the init script. Then you could just enter at the command line #service spamassassin stop #service spamassassin debug Mike > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAI

RE: [SAtalk] Email Not Caught

2004-01-07 Thread Mike Carlson
I did notice the misspellings in the email but shouldn't it have scored it with *something*? It gave it a score of 0.0. That just seems very odd. Isn't there a rule for Base64 encoded emails? --Mike -Original Message- From: Jennifer Wheeler [mailto:[EMAIL PROTECTED] Sent:

RE: [SAtalk] Any rule to catch this spam?

2004-01-07 Thread Mike Kuentz (2)
> > Mike, If you look at Rich's X-spam status header, he's already using > bigevil and netchecks, but at the time the message ran, the I'll make sure I look a little more closely next time. I just copied the message and ran it through to see what I came up with out o

RE: [SAtalk] 1/2 OT - SA up2date debian package

2004-01-07 Thread Mike Schrauder
to 2.61-1 but it is working so well on 2.60 and I only have a production env so I don't have the guts to make the upgrade. Anyone on debian upgrade from 2.60 to 2.61? Any gotchas? Please understand, I am a linux luser and can barely do a thing in linux. (Although I catch myself typin

RE: [SAtalk] Any rule to catch this spam?

2004-01-07 Thread Mike Kuentz (2)
l.org] Get BigEvil at http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm Mike > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of [EMAIL PROTECTED] > Sent: Wednesday, January 07, 2004 12:38 PM > To: Spamassassin-List &

RE: [SAtalk] Email Not Caught

2004-01-07 Thread Mike Carlson
I am running 2.61. Are these rules not enabled or something? I cannot figure out why they are not getting caught.   --Mike   From: SethSent: Wed 1/7/2004 11:32 AMTo: Mike CarlsonCc: [EMAIL PROTECTED]Subject: Re: [SAtalk] Email Not Caught These are the rules that it flagged on my 2.60

[SAtalk] Email Not Caught

2004-01-07 Thread Mike Carlson
there a way to test against that?   --Mike   email.zip Description: email.zip

RE: [SAtalk] Bad Email Address

2004-01-06 Thread Mike Kuentz (2)
\.ca also, but I left in since that was what you had. Also, look at Chris' rules site for some great examples http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm also see http://www.exit0.us/ and the wiki for other good stuff. http://wiki.spamassassin.org/w/ Mike > -Ori

RE: [SAtalk] New unsecure redirector.

2004-01-05 Thread Mike Kuentz (2)
> Bill Larson wrote: > Abused url > http://g.msn.com/1SUenus/CT?http://www.Nicole.name-williams.com/E/4156.h tml It works without the CT, also Mike --- This SF.net email is sponsored by: IBM Linux

[SAtalk] SA TIMED OUT

2004-01-05 Thread Mike Vanecek
emember seeing something on this before ?? Advice please. Thank you. Mike. --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorial

RE: [SAtalk] suggestion: mail_grep - a tool for scanning e-mail

2003-12-30 Thread Mike Kuentz (2)
http://grepmail.sourceforge.net/ Mike > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Gary Funck > Sent: Tuesday, December 30, 2003 12:30 PM > To: Spamassassin List > Subject: [SAtalk] suggestion: mail_grep - a too

[SAtalk] Big Evil FP?

2003-12-30 Thread Mike Kuentz (2)
One of my users got a link to this: http://www.ticz.com/homes/users/bob/On-A-Rock/On-A-Rock.htm Looks ticz.com is an ISP, but probably had some one set up shop to host images off of their site. Mike --- This SF.net email is sponsored by: IBM

RE: [SAtalk] Postfix and Spamassasin

2003-12-30 Thread Mike Schrauder
sorry, forgot the url http://advosys.ca/papers/postfix-filtering.html > -Original Message- > From: Atkins, Brian [mailto:[EMAIL PROTECTED] > Sent: Tuesday, December 30, 2003 10:08 AM > To: '[EMAIL PROTECTED]' > Subject: [SAtalk] Postfix and Spamassasin > > > Good Morning, All, > > I'm j

RE: [SAtalk] Postfix and Spamassasin

2003-12-30 Thread Mike Schrauder
Brian, I used this site for about 95% of my setup. I used postfix in front of an Exchange server. HTH Mike Schrauder www.specialtyblades.com www.olfablades.com > -Original Message- > From: Atkins, Brian [mailto:[EMAIL PROTECTED] > Sent: Tuesday, December 30, 2003 10:0

[SAtalk] whitelist_from_rcvd question with unresolveable domains

2003-12-29 Thread Mike Batchelor
I need to make some entries in whilist_from_rcvd. But the only hostnames in the Received: header that I can trust, are not resolveable. Does that matter? Is it a simple pattern/string match, or does SA also try to resolve the hostname? Like this: whitelist_from_rcvd [EMAIL PROTECTED] NTDOMAIN

[SAtalk] Documentation question

2003-12-29 Thread Mike Kuentz (2)
: Failed to parse line in SpamAssassin configuration, skipping: use_auto_whitelist 0 Mike --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tuto

[SAtalk] Updated Textpad Syntax file for SA

2003-12-26 Thread Mike Kuentz (2)
Updated to handle new keywords in versions 2.60 & 2.61. See <http://www.textpad.com/add-ons/syna2g.html#instructions> for instructions on how to install if you use Textpad. Mike sasynfile.zip Description: sasynfile.zip

RE: [SAtalk] whitelist_from_rcvd question with multiple domains

2003-12-24 Thread Mike Kuentz (2)
the user is in the whitelist. I'm no Perl guru, so I could be completely wrong. When you add an identical key to a hash, the first one gets over written. >BTW What happened to Mike Kuentz (1) and will we be seeing a Mike Kuentz >(3) in the near future? Let's hope not, the f

RE: [SAtalk] sa-learn from Exchange 2000

2003-12-24 Thread Mike Kuentz (2)
> btw 42??? what did you mean by that. that was very > creepy to see, > because i've tried to convince my brother from an early age, that the > number 42 *haunts* me and turns up *everywhere*! that'll either be a > very good year for me, or that's the year i'll buy the farm per se! http://

RE: [SAtalk] whitelist_from_rcvd question with multiple domains

2003-12-24 Thread Mike Kuentz (2)
oes it make sense what I'm asking now? I apologize if I didn't explain it well enough originally. Mike --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for

RE: [SAtalk] Question re: Rule

2003-12-24 Thread Mike Kuentz (2)
T_01 describe MK_BAD_SUBJECT_02 Tries hiding a nono phrase with a different charset score MK_BAD_SUBJECT_02 1.5 Hope that helps, Mike > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Michael Satterwhite > Sent: Wednesday, December 2

[SAtalk] whitelist_from_rcvd question with multiple domains

2003-12-24 Thread Mike Kuentz (2)
_rcvd [EMAIL PROTECTED] sprintspectrum.com Correct me if I'm wrong, but if the domains are stored in a hash table for lookups, and [EMAIL PROTECTED] is used to look up the domain in the hash table, only one will match. Thanks, Mike --- This SF

[SAtalk] NJABL Dialup test

2003-12-23 Thread Mike Grau
ialup sender did non-local SMTP tflags RCVD_IN_NJABL_DIALUP net or? header RCVD_IN_NJABL_DIALUP eval:check_rbl('njabl-notfirsthop', 'dynablock.njabl.org.', '127.0.0.3') describe RCVD_IN_NJABL_DIALUP NJABL: dialup sender did non-local SMTP tflags RCVD_IN_NJABL_

[SAtalk] NJABL Dialup test

2003-12-23 Thread Mike G
ialup sender did non-local SMTP tflags RCVD_IN_NJABL_DIALUP net or? header RCVD_IN_NJABL_DIALUP eval:check_rbl('njabl-notfirsthop', 'dynablock.njabl.org.', '127.0.0.3') describe RCVD_IN_NJABL_DIALUP NJABL: dialup sender did non-local SMTP tflags RCVD_IN_NJABL_

Re: [SAtalk] Excessive amavisd memory use with spamassasin 2.6 on ppc platform

2003-12-22 Thread Mike Vanecek
On Fri, 19 Dec 2003 21:21:02 +, Iain Stevenson wrote > System: > > Linux ppc (basicallu Yellowdog), 2.4.21 kernel > Postfix > amavisd-new-20030314 > spamassassin 2.6 or 2.61 > clamav-0.65 > > System is configured to use the spamd interface to spamassassin. If > I install the 2.6 or 2.61 ver

[SAtalk] SpamAssassin Install Help

2003-12-22 Thread Mike Schultz
I am having a problem installing Spam Assassin 2.61 on perl 5.8.2. When I go to the Spam Assassin directory and type perl makefile.pl it works fine and asks for email or url to suspect spam report. then it said file good, Writing makefile for mail::spamassassin, makefile written by ExtUtils::

Re: [SAtalk] Excessive amavisd memory use with spamassasin 2.6 on ppc platform

2003-12-20 Thread Mike Vanecek
On Fri, 19 Dec 2003 21:21:02 +, Iain Stevenson wrote > System: > > Linux ppc (basicallu Yellowdog), 2.4.21 kernel > Postfix > amavisd-new-20030314 > spamassassin 2.6 or 2.61 > clamav-0.65 > > System is configured to use the spamd interface to spamassassin. If > I install the 2.6 or 2.61 ver

RE: [SAtalk] regex expansion tool

2003-12-17 Thread Mike Kuentz (2)
have you looked at the regex coach? <http://www.weitz.de/regex-coach/> Available for Linix & win32 Mike > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Kirk Moore > Sent: Wednesday, December 17, 2003 6:40 PM > To: G

Re: [SAtalk] Report scripts?

2003-12-17 Thread Mike Jackson
> Is it possible to generate, say, daily and weekly reports of spamassains > statistices? If so, where are teh logfiles stored? > > And does anyone have sample scripts to start from? I use a FreeBSD system, and I dropped the following Perl script into my /etc/periodic/daily/ directory. It could be

RE: [SAtalk] SpamAssassin and SendMail

2003-12-17 Thread Mike Carlson
instructions in the activation.txt file in:   /usr/local/share/doc/spamass-milter/   It takes me about 30 minutes to get a new SA box up and running. I use them in front of Exchange and Domino servers I setup for people.   --Mike From: CevaSent: Wed 12/17/2003 8:21 AMTo: [EMAIL PROTECTED]; Matt

Re: [SAtalk] Pyzor

2003-12-16 Thread MIKE YRABEDRA
here ;-) Just make sure you *remove* the -L and it should work. +----+ Mike Yrabedra (President) 323 Incorporated Home of MacDock.com, MacAgent.com and MacShirt.com ++ W: http://www.323inc.com/ P: 770.382.1

Re: [SAtalk] Pyzor

2003-12-16 Thread MIKE YRABEDRA
believe you need to have the -t flag in there for it to work. +----+ Mike Yrabedra (President) 323 Incorporated Home of MacDock.com, MacAgent.com and MacShirt.com ++ W: http://www.323inc.com/ P: 770.382.119

Re: [SAtalk] Re: SpamAssassin 2.61 released!

2003-12-15 Thread Mike Vanecek
On 15 Dec 2003 12:19:38 +0200, era wrote > On Fri, 12 Dec 2003 17:01:10 -0600, Mike Vanecek >> I ran into this installing 2.61. I just did a --force to get around >> it, but wondered if that was a safe approach? What is the purpose >> of perllocal.pod and why does perl-Mai

Re: [SAtalk] SpamAssassin 2.61 released!

2003-12-12 Thread Mike Vanecek
On Fri, 12 Dec 2003 14:30:09 -0800, Justin Mason wrote [snip] > >http://bugzilla.spamassassin.org/show_bug.cgi?id=2569 > > Missed that one; I've just set it to be fixed for 2.62. It seems pretty > complex; either there's several failure cases, or nobody has yet done > enough diagnosis to get to

RE: [SAtalk] Question on SUBJ_HAS_UNIQ_ID-test

2003-12-12 Thread Mike Kuentz (2)
from looking at the eval test that runs for that rule, it checks against an English dictionary. Maybe you should disable the test score SUBJ_HAS_UNIQ_ID 0 Mike > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Mika A > Sent: F

[SAtalk] SPAMD and SA-Learn

2003-12-12 Thread Mike Dabbs
I've been using SA for a little while now but am still not up to speed on all it can do. We are mostly a Windows shop here so we have very few techs who know Linux that well. We're using SPAMD to filter email and use a Windows-based email proxy to send/receive info to/from the SPAMD host. It d

Re: [SAtalk] SA for IM?

2003-12-11 Thread MIKE YRABEDRA
on 12/11/03 1:08 PM, Jonathan Vanasco at [EMAIL PROTECTED] wrote: > Maybe its an ichat only thing -- because everyone i know running iChat > gets 10+ AOL IM spams a day. I'm averaging 15. I have not gotten a single one. Guess I am lucky :-) ---

[SAtalk] perllocal.pod conflict with 2.61

2003-12-11 Thread Mike Vanecek
What is the safest way to resolve this 2.61 install error? Can I safely use --force? What is the purpose of perllocal.pod? [EMAIL PROTECTED] i386]# rpm -Uvh --test spama*.rpm perl-Mail* Preparing...### [100%] file /usr/lib/perl5/site_

Re: [SAtalk] another SpamAssassin ???

2003-12-09 Thread MIKE YRABEDRA
Afee does not get the idea to start licensing SA. That would suck! +----+ Mike Yrabedra (President) 323 Incorporated Home of MacDock.com, MacAgent.com and MacShirt.com ++ W: http://www.323inc.com/ P: 770.382.1

[SAtalk] Delete mail with a score above n

2003-12-08 Thread Mike D
Does anyone know how to config spamassassin to delete messages with a score above a certain threshold?Thanks! - MDMike DunlopAWN, Inc.// www.awn.com[ e ] [EMAIL PROTECTED][ p ] 323.606.4237Mike

RE: [SAtalk] Weird Word patch

2003-12-08 Thread Mike Kuentz (2)
how would you use this? Eval's return true/false if I'm not mistaken. So any line with a comma or period would hit. Mike > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Brendan Burns > Sent: Wednesday, December 03,

[SAtalk] Delete mail with a score above n

2003-12-06 Thread Mike D
Does anyone know how to config spamassassin to delete messages with a score above a certain threshold? Thanks! - MD Mike Dunlop AWN, Inc. // www.awn.com [ e ] [EMAIL PROTECTED] [ p ] 323.606.4237

[SAtalk] Delete mail with a score above n

2003-12-06 Thread Mike D
Does anyone know how to config spamassassin to delete messages with a score above a certain threshold? Thanks! - MD Mike Dunlop AWN, Inc. // www.awn.com [ e ] [EMAIL PROTECTED] [ p ] 323.606.4237

Re: [SAtalk] sa-learn: what happened to --dir ?

2003-12-05 Thread Mike Batchelor
Awesome, yes it works that way for me, too. I read the man page and thought it had been deprecated --On Saturday, December 06, 2003 10:38 AM +1000 Peter Kiem <[EMAIL PROTECTED]> wrote: So it defaults to folders already. So you would just need to do sa-learn --spam /var/tmp/spam and it s

[SAtalk] sa-learn: what happened to --dir ?

2003-12-05 Thread Mike Batchelor
I have too many files to learn, so sa-learn craps out with "bad interpreter: Too many arguments". I am invoking 2.60 like this: sa-learn --spam -d /var/tmp/spam/* I used to invoke 2.54 like this: sa-learn --spam --dir /var/tmp/spam What happened to the flag --dir ? That worked great in 2.54.

RE: [SAtalk] Changing user spamd runs as

2003-12-05 Thread Mike Kuentz (2)
modify /etc/sysconfig/spamassassin to have the -u username option it. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nichols, William Sent: Friday, December 05, 2003 12:04 PM To: SA Mailing list Subject: [SAtalk] Changing user spamd runs as I am having

[SAtalk] Spamd/Milter Problem

2003-12-04 Thread Mike Carlson
lso have this in /razor_agent.log Dec 04 10:28:25.664589 check[118]: [ 3] Unable to connect to 66.151.150.11:2703; Reason: Bad file descriptor. Dec 04 10:28:26.001671 check[118]: [ 3] Unable to connect to 66.151.150.11:2703; Reason: Bad file descriptor. Any ideas on why the Milter is timing out l

RE: [SAtalk] disable RCVD_IN_SORBS_xxx feature

2003-12-04 Thread Mike Kuentz (2)
Mike > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of stephane ancelot > Sent: Thursday, December 04, 2003 5:40 AM > To: Spamassassin-Talk > Subject: [SAtalk] disable RCVD_IN_SORBS_xxx feature > > > Hi, &g

RE: [SAtalk] HTML rules...

2003-12-04 Thread Mike Kuentz (2)
e set that will catch them. Mike > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of SqM > Sent: Thursday, December 04, 2003 5:01 AM > To: [EMAIL PROTECTED] > Subject: [SAtalk] HTML rules... > > > Hi! > > A questio

[SAtalk] I have a FP that I need to retrain as ham but SA has re-written the body

2003-12-03 Thread Mike
I have a false positive that I want to retrain but SA has rewritten the body. I turned everything off that I could see that would tell SA to re-write the body but it still does. I read that SA will still re-learn spam that it has altered to headers but will it do it for the body? It does look like

RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!

2003-12-03 Thread Mike Kuentz (2)
Not to start a text editor war, but it can be done in Textpad with a regex search and replace. Hit F8, check the Regular Expression textbox -> Find: \t3.0$ -> Replace with: \t1.0 (or whatever you want the score to be). Mike > -Original Message- > From: [EMAIL PROTECTED

RE: [SAtalk] BIG HUGE EVIL RULE NEWS!!!!

2003-12-02 Thread Mike Kuentz (2)
spamassassin dir. > > I plan to just keep adding to this file!!! > http://www.merchantsoverseas.com/wwwroot/gorilla/bigevil.cf Mike Kuentz, you are no longer allowed to put ideas into my head :) My fingers now hurt! Thanks for lighting the spark! Payment for use of this has to be more then the old evilrules.

RE: [SAtalk] WhiteListing and newbie

2003-12-02 Thread Mike Kuentz (2)
rcvd [EMAIL PROTECTED] example.com whitelist_from_rcvd [EMAIL PROTECTED] sergeant.org Mike -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Billy A. Pumphrey Sent: Tuesday, December 02, 2003 1:57 PM To: [EMAIL PROTECTED] Subject: [SAtalk]

RE: [SAtalk] SA: Moving spam mails(sitewide) to a separate Dir/Account

2003-12-02 Thread Mike Kuentz (2)
SA doesn't move mail. We'd need to know more about your setup to help you out. Postfix/qmail/procmail, versions, how you get mail from your MTA to SA, etc. Mike > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Mail M

  1   2   3   4   5   6   7   >