Re: Would like to rewrite arbitrary headers

2005-10-31 Thread Alan Premselaar
[EMAIL PROTECTED] wrote: Greetings, battlers. I would like to rewrite headers on incoming spam without having SA prepend "X-Spam-" to them. Two reasons: First, I want to get rid of "Disposition-Notification-To" because many of my users configure their Outlook to automatically honour delivery n

How to include rule files?

2005-10-31 Thread Daniel Watts
Really simple question - Where's the documentation to find out how to link other rule files into my local.cf file? Dan

Re: How to include rule files?

2005-10-31 Thread Daniel Watts
Daniel Watts wrote: Really simple question - Where's the documentation to find out how to link other rule files into my local.cf file? Dan Answered this myself: http://spamassassin.apache.org/full/3.0.x/dist/doc/Mail_SpamAssassin_Conf.html just use "include FILENAME"

Re: How to include rule files?

2005-10-31 Thread Matt Kettler
At 05:54 AM 10/31/2005, Daniel Watts wrote: Really simple question - Where's the documentation to find out how to link other rule files into my local.cf file? You can't.. but you don't need to. Spamassassin will parse /etc/mail/spamassassin/*.cf, not just local.cf So, all you need to do is

Re: How to include rule files?

2005-10-31 Thread Daniel Watts
Daniel Watts wrote: Really simple question - Where's the documentation to find out how to link other rule files into my local.cf file? Dan Hmm spoke too soon: [EMAIL PROTECTED] spamassassin]# spamassassin --lint Failed to parse line in SpamAssassin configuration, skipping: include "/et

Re: How to include rule files?

2005-10-31 Thread Daniel Watts
Matt Kettler wrote: At 05:54 AM 10/31/2005, Daniel Watts wrote: Really simple question - Where's the documentation to find out how to link other rule files into my local.cf file? You can't.. Really? It's in the documentation (but admittedly doesn't work...) but you don't need to. Spa

Re: How to include rule files?

2005-10-31 Thread Matt Kettler
At 06:17 AM 10/31/2005, Daniel Watts wrote: Daniel Watts wrote: Really simple question - Where's the documentation to find out how to link other rule files into my local.cf file? Dan Hmm spoke too soon: [EMAIL PROTECTED] spamassassin]# spamassassin --lint Failed to parse line in SpamAssa

Re: How to include rule files?

2005-10-31 Thread Daniel Watts
*MANY* things in the 3.x documentation aren't supported in 2.55. The include directive is new as of 3.0.0. Since I run 2.64, I was unaware it had been added. However, the option is only really useful for user_prefs files. Adding it to local.cf is pointless unless you have your .cf files in a

Re: How to include rule files?

2005-10-31 Thread Matt Kettler
Daniel Watts wrote: > > Matt, > > Many thanks for this heads up! Any reason you are avoiding going to the > 3.x branch? Well, generally I hold off on new major releases for at least a month unless there's a security reason to upgrade ASAP. However, in this case I've just been too busy to upgra

AW: Report in english after reboot

2005-10-31 Thread Christoph Petersen
Hi, nobody any idea. It's very silly that the report is on english even when I have the german 30_text_de.cf in my /usr/share/spamassassin directory. Regards Christoph

Re: AW: Report in english after reboot

2005-10-31 Thread Matt Kettler
Christoph Petersen wrote: > Hi, > > even when I change the LANG setting to de_DE.ISO-8859-1 I get an english > report. What else could I do? > How did you do this? Are you sure this change applies to the spamassassin instance that generated the English report? (ie: merely setting this from a us

AW: AW: Report in english after reboot

2005-10-31 Thread Christoph Petersen
Hi Matt, Christoph Petersen wrote: > Hi, > > even when I change the LANG setting to de_DE.ISO-8859-1 I get an english > report. What else could I do? > > How did you do this? Are you sure this change applies to the spamassassin > instance that generated the English report? I've changed my sett

Wiki 3.1.0 upgrade page, strange commentary...

2005-10-31 Thread Matt Kettler
In the 3.1.0 upgrade page on the wiki: http://wiki.apache.org/spamassassin/UpgradeTo310 One will find this text: - The SA headers X-Spam-Flag, X-Spam-Checker-Version, X-Spam-Level, and X-Spam-Status are only added to messages that have been flagged as spam. I have

AW: AW: Report in english after reboot

2005-10-31 Thread Christoph Petersen
Hi folks, so after I've setup the config files from the source archive and setting LC_MESSAGES to de_DE.ISO8859-1 it works. Thanks for help. Regards Christoph > > I've changed my settings with dpkg-reconfigure locales. Which > changes on > debian the locales systemwide. After that I've restart

DK_SIGNED from yahoo

2005-10-31 Thread Raul Dias
Hi, I upgraded to 3.1.0 (from 3.0.4) and enabled the Domainkeys plugin. I patched it with the patch in the bugzilla #4623 (http://issues.apache.org/SpamAssassin/attachment.cgi?id=3210) as I am using Mail::DomainKeys 0.80. Testing against mail from groups.yahoo.com, I get DK_SIGNED, but not DK_VER

MySQL server resolution

2005-10-31 Thread Marc Perkel
ok - here's what I'm thinking. I want to be able to switch MySWL servers should the main server go down. In my local.cf file I have this: user_awl_dsn DBI:mysql:spamassassin:bayes The server "bayes" is defined in my /etc/hosts file. What I'm thinking is if that server goes down that I gave a

Finally upgraded

2005-10-31 Thread [EMAIL PROTECTED]
Hello all: I finally upgraded from 2.64 to 3.01 using CPAN. I ready the UPGRADE file, of course. I made the tweaks of the necessary items using CPAN and my local conf file. I ran sa-learn --sync and after removing some old .cf files (like spamcop) I got it to run clean. However, I still have t

RE: Finally upgraded

2005-10-31 Thread Matthew.van.Eerde
[EMAIL PROTECTED] wrote: > I finally upgraded from 2.64 to 3.01 using CPAN. ... > I ran sa-learn --sync ... > However, I still have the " bayes db version 2 is not able to be used, > aborting" in my logs. Ive been I believe for an upgrade from 2.* to 3.* a simple sa-learn --sync is not enough.

Re: Finally upgraded

2005-10-31 Thread [EMAIL PROTECTED]
Did that, didn't help though. I only have the one version of sa-learn. on 10/31/05 1:14 PM, [EMAIL PROTECTED] at [EMAIL PROTECTED] wrote: > [EMAIL PROTECTED] wrote: >> I finally upgraded from 2.64 to 3.01 using CPAN. > ... >> I ran sa-learn --sync > ... >> However, I still have the " bayes db

RE: Finally upgraded

2005-10-31 Thread Matthew.van.Eerde
[EMAIL PROTECTED] wrote: > Did that, didn't help though. I only have the one version of > sa-learn. You can download the 2.64 version of sa-learn here: http://search.cpan.org/~jmason/Mail-SpamAssassin-2.64/ -- Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902 Hispanic Business I

Integrity checks in URLs for blocking phishers as anti-phishing prevention

2005-10-31 Thread Richard Leroy
Hi list, I want to know if there is some sort of integrity checks for a situation where a URL would be different from the "CAPTION" url, example: http://hacker.com";>http://legit-bank.com On top of my mind, I never saw a situation like this in real life, except in phish emails. I have also chec

Re: Wiki 3.1.0 upgrade page, strange commentary...

2005-10-31 Thread Raul Dias
On Mon, 2005-10-31 at 11:14 -0500, Matt Kettler wrote: > In the 3.1.0 upgrade page on the wiki: > http://wiki.apache.org/spamassassin/UpgradeTo310 [...] > Is it true that 3.1.0 is broken as the wiki indicates, or has someone been > posting mis-information to the wiki? misinformation. I checked th

RE: Integrity checks in URLs for blocking phishers as anti-phishing prevention

2005-10-31 Thread Matthew.van.Eerde
> http://hacker.com";>http://legit-bank.com > > On top of my mind, I never saw a situation like this in real life, > except in phish emails. I see this all the time in promotional emails (spam, not phish) to track clickthrough. -- Matthew.van.Eerde (at) hbinc.com 805.964.4554 x90

Re: Would like to rewrite arbitrary headers

2005-10-31 Thread mouss
[EMAIL PROTECTED] a écrit : Greetings, battlers. I would like to rewrite headers on incoming spam without having SA prepend "X-Spam-" to them. Two reasons: First, I want to get rid of "Disposition-Notification-To" because many of my users configure their Outlook to automatically honour delive

Re: Finally upgraded

2005-10-31 Thread [EMAIL PROTECTED]
I might add that im not totally opposed to dumping bayes info and starting fresh...would that be an easier solution? on 10/31/05 1:26 PM, [EMAIL PROTECTED] at [EMAIL PROTECTED] wrote: > [EMAIL PROTECTED] wrote: >> Did that, didn't help though. I only have the one version of >> sa-learn. > >

Re: Integrity checks in URLs for blocking phishers as anti-phishing prevention

2005-10-31 Thread Mathias Homann
Am Montag, 31. Oktober 2005 19:33 schrieb [EMAIL PROTECTED]: > > http://hacker.com";>http://legit-bank.com > > > > On top of my mind, I never saw a situation like this in real > > life, except in phish emails. > > I see this all the time in promotional emails (spam, not phish) to > track clickthrou

RE: MySQL server resolution

2005-10-31 Thread Gary W. Smith
You are thinking to hard on this problem. You create a MySQL cluster and point local.cf to that. Restart SA and it works. If you pull the plug on the first clustered node the other one will automatically take over. That's the purpose of the cluster... automating the failover. host files, cro

Re: Wiki 3.1.0 upgrade page, strange commentary...

2005-10-31 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Raul Dias writes: > On Mon, 2005-10-31 at 11:14 -0500, Matt Kettler wrote: > > In the 3.1.0 upgrade page on the wiki: > > http://wiki.apache.org/spamassassin/UpgradeTo310 > [...] > > Is it true that 3.1.0 is broken as the wiki indicates, or has someon

3.1.0 upgrade

2005-10-31 Thread Mark Merchant
upgraded 3.0.4 to 3.1.0, spamassassin --lint produces: [EMAIL PROTECTED] spamassassin]# spamassassin --lint [1257] warn: config: SpamAssassin failed to parse line, "/home/bayes/" is not valid for "bayes_path", skipping: bayes_path _/home/bayes/ [1257] warn: config: failed to parse line, skipping:

Re: 3.1.0 upgrade

2005-10-31 Thread JamesDR
Mark Merchant wrote: upgraded 3.0.4 to 3.1.0, spamassassin --lint produces: [EMAIL PROTECTED] spamassassin]# spamassassin --lint [1257] warn: config: SpamAssassin failed to parse line, "/home/bayes/" is not valid for "bayes_path", skipping: bayes_path _/home/bayes/ [1257] warn: config: failed to

Re: 3.1.0 upgrade

2005-10-31 Thread Matt Kettler
Mark Merchant wrote: > upgraded 3.0.4 to 3.1.0, spamassassin --lint produces: > > [EMAIL PROTECTED] spamassassin]# spamassassin --lint > [1257] warn: config: SpamAssassin failed to parse line, "/home/bayes/" > is not valid for "bayes_path", skipping: bayes_path _/home/bayes/ SA is correct, your b

Re: Integrity checks in URLs for blocking phishers as anti-phishing prevention

2005-10-31 Thread Kelson
[EMAIL PROTECTED] wrote: http://hacker.com";>http://legit-bank.com On top of my mind, I never saw a situation like this in real life, except in phish emails. I see this all the time in promotional emails (spam, not phish) to track > clickthrough. I see it on legit mail too, including a coupl

Re: Integrity checks in URLs for blocking phishers as anti-phishing prevention

2005-10-31 Thread mouss
Mathias Homann a écrit : and increasing the score on spams hurts WHY? to be precise, the rule should only trigger if the text between the href=> and parts of the url has a hostname at all, so that an url like http://www.spamassassin.org";>click here to ged rid of it doesnt trigger it. do

Spam being delivered

2005-10-31 Thread Robert Bartlett
Running SA 3.01 on Fedora Core 2 with Qmail. The problem is recently Im showing emails getting delivered to mailbox with the ***SPAM*** in the title, yet the rules state if the email is spam it shouldn't be delivered to the persons mailbox. The headers even show the score is over the spam count: 6.

Re: Integrity checks in URLs for blocking phishers as anti-phishing prevention

2005-10-31 Thread Loren Wilton
> > > http://hacker.com";>http://legit-bank.com > > > > > > On top of my mind, I never saw a situation like this in real > > > life, except in phish emails. > > > to be precise, the rule should only trigger if the text between the href=> and parts of the url has a hostname at all, so that an > ur

Re: Spam being delivered

2005-10-31 Thread Andy Jezierski
"Robert Bartlett" <[EMAIL PROTECTED]> wrote on 10/31/2005 02:20:43 PM: > Running SA 3.01 on Fedora Core 2 with Qmail. The problem is recently Im > showing emails getting delivered to mailbox with the ***SPAM*** in the > title, yet the rules state if the email is spam it shouldn't be delivered to

Re: Spam being delivered

2005-10-31 Thread Loren Wilton
> Running SA 3.01 on Fedora Core 2 with Qmail. The problem is recently Im > showing emails getting delivered to mailbox with the ***SPAM*** in the > title, yet the rules state if the email is spam it shouldn't be delivered to "delivery" isn't SA's business, "scoring" is. So it is Qmail that isn't

Re: Integrity checks in URLs for blocking phishers as anti-phishing prevention

2005-10-31 Thread mouss
Loren Wilton a écrit : I've written a number of rules to check for this, so have others. Yes, it will catch some of the phish. Unfortunately it also catches just an amazing amount of legit mail. I think the last statistics were something like 50/50, or maybe even heavier on the ham side. It

RE: Spam being delivered

2005-10-31 Thread Robert Bartlett
Im using maildrop for that I believe. On a side note would you recommend I use Amavis instead of maildrop? Robert -Original Message- From: Loren Wilton [mailto:[EMAIL PROTECTED] Sent: Monday, October 31, 2005 1:35 PM To: users@spamassassin.apache.org Subject: Re: Spam being delivered >

OK guys - why did this one get through.

2005-10-31 Thread jdow
===8<--- Status: U Return-Path: <[EMAIL PROTECTED]> Received: from smtp.earthlink.net [209.86.93.209] by localhost with POP3 (fetchmail-6.2.5) for [EMAIL PROTECTED] (single-drop); Mon, 31 Oct 2005 03:55:59 -0800 (PST) Received: from mail19a.g19.rapidsite.net ([204.202.242.24]) by mx-nebolish.atl.

aim.com

2005-10-31 Thread jdow
What's with the unreadable messages that seem to come from this service. A fellow on the FC4 list is posting messages from his account at aim.com (AOL) that feature a signature and a walking man icon but nothing other than quoted content. (I've just given the entire aim.com host a score of 4.9

Re: aim.com

2005-10-31 Thread Doc Schneider
jdow wrote: What's with the unreadable messages that seem to come from this service. A fellow on the FC4 list is posting messages from his account at aim.com (AOL) that feature a signature and a walking man icon but nothing other than quoted content. (I've just given the entire aim.com host a sco

SURBL: New SC data live, new data engine also

2005-10-31 Thread Jeff Chan
We have made the experimental SC2 data into the production SC list. The new version has been tested to catch about 10% more spam than the old version with no significant increase in false positives. Along with this change is the use of a new data engine which has a shorter cycle time of 5 minutes

be.surbl.org to be decommissioned

2005-10-31 Thread Jeff Chan
The data in be.surbl.org, originally from Chris Santerre's BigEvil SpamAssassin ruleset, is stale and has been superceded by ws.surbl.org for a long time now, so we will be shutting down DNS service for it in one month, at the end of November. Please update your configurations to use multi.surbl.o

Problem with 70_sare_header.cf 01.03.16

2005-10-31 Thread Ed Kasky
When running rdj, I get the following: Ruleset for header abuse (sets 0-3) has changed on yoda2. Version line: # Version: 01.03.16 ***WARNING***: spamassassin --lint failed. Lint output: [25934] warn: config: warning: description exists for non-existent rule SARE_HEAD_DATE_LONG1 [25934] warn:

Re: DK_SIGNED from yahoo

2005-10-31 Thread Chris
On Monday 31 October 2005 12:04 pm, Raul Dias wrote: > Hi, > > I upgraded to 3.1.0 (from 3.0.4) and enabled the Domainkeys plugin. > I patched it with the patch in the bugzilla #4623 > (http://issues.apache.org/SpamAssassin/attachment.cgi?id=3210) as I am > using Mail::DomainKeys 0.80. > > Testing

Re: Problem with 70_sare_header.cf 01.03.16

2005-10-31 Thread Doc Schneider
Ed Kasky wrote: When running rdj, I get the following: Ruleset for header abuse (sets 0-3) has changed on yoda2. Version line: # Version: 01.03.16 ***WARNING***: spamassassin --lint failed. Lint output: [25934] warn: config: warning: description exists for non-existent rule SARE_HEAD_DATE_LO

Re: Problem with 70_sare_header.cf 01.03.16

2005-10-31 Thread Ed Kasky
At 06:14 PM Monday, 10/31/2005, Doc Schneider wrote -=> Ed Kasky wrote: When running rdj, I get the following: Ruleset for header abuse (sets 0-3) has changed on yoda2. Version line: # Version: 01.03.16 ***WARNING***: spamassassin --lint failed. Lint output: [25934] warn: config: warning: descr

Re: Finally upgraded

2005-10-31 Thread Chris
On Monday 31 October 2005 12:41 pm, [EMAIL PROTECTED] wrote: > I might add that im not totally opposed to dumping bayes info and > starting fresh...would that be an easier solution? > > > > on 10/31/05 1:26 PM, [EMAIL PROTECTED] at > The below is from the 3.1 upgrade text. I upgrade via CPAN also,

Re: OK guys - why did this one get through.

2005-10-31 Thread Chris
On Monday 31 October 2005 04:22 pm, jdow wrote: > ===8<--- > Status: U > Return-Path: <[EMAIL PROTECTED]> > Received: from smtp.earthlink.net [209.86.93.209] > by localhost with POP3 (fetchmail-6.2.5) > for [EMAIL PROTECTED] (single-drop); Mon, 31 Oct 2005 03:55:59 > -0800 (PST) Received: from m

Re: DK_SIGNED from yahoo

2005-10-31 Thread List
I upgraded to 3.1.0 (from 3.0.4) and enabled the Domainkeys plugin. I patched it with the patch in the bugzilla #4623 (http://issues.apache.org/SpamAssassin/attachment.cgi?id=3210) as I am using Mail::DomainKeys 0.80. How do I patch DK using that patch? What commands?