Re: default score for SPF_HELO_FAIL too low?

2006-03-29 Thread David B Funk
On Wed, 29 Mar 2006, Matt Kettler wrote: > Andy Spiegl wrote: > > Hi, I'm wondering why the default score for SPF_HELO_FAIL is only 0.001? > > On the other hand SPF_HELO_SOFTFAIL adds 3.14 > > > > After reading "man Mail::SPF::Query" I thought fail is a lot worse than > > softfail, right? > > At l

Re: spamd REPORT

2006-03-29 Thread David B Funk
On Thu, 30 Mar 2006, mouss wrote: > > Use the 'REPORT' or 'REPORT_IFSPAM' spamd command instead of 'SYMBOLS' > > or 'PROCESS' to get the full score report but not the full message. > > > > This requires parsing the message. > > > I would like getting something like: > > ALL_TRUSTED=-1.44,MISSING_S

RE: socket SA is not fast enough, help

2006-03-29 Thread Matthew.van.Eerde
John D. Hardin wrote: > On Wed, 29 Mar 2006 [EMAIL PROTECTED] wrote: >> >> Windows does not have anything like UNIX domain sockets. The >> closest thing to it would be a TCP server listening on 127.0.0.1 >> and only accepting connections from 127.0.0.1 - but that has the >> same overhead as any o

RE: socket SA is not fast enough, help

2006-03-29 Thread John D. Hardin
On Wed, 29 Mar 2006 [EMAIL PROTECTED] wrote: > Rob McEwen (PowerView Systems) wrote: > > Justin Mason wrote: > >> for what it's worth, the overhead of UNIX domain sockets is a lot > >> less. > > > > ... any 3rd party tool to enhance and/or speed up window's built-in sockets? > > Windows does no

Re: socket SA is not fast enough, help

2006-03-29 Thread mouss
[EMAIL PROTECTED] wrote: You can probably set that up in local.cf with clear_report_template report _TESTSSCORES(,)_ That works. Thanks.

Re: socket SA is not fast enough, help

2006-03-29 Thread mouss
[EMAIL PROTECTED] wrote: mouss wrote: unix sockets can't be used if the client and the server are in disjoint jails Really? Not even with symlinks (can you symlink a socket) or mount --bind? symlinks are relative to the chroot. so # ln -s /etc/foo /var/chroot/app/etc/foo doesn't work (beca

RE: socket SA is not fast enough, help

2006-03-29 Thread Matthew.van.Eerde
mouss wrote: > I would like getting something like: > > ALL_TRUSTED=-1.44,MISSING_SUBJECT=1.345 > > instead of (REPORT): > > blahblah > ... > ... > Content analysis details: (-0.1 points, 5.0 required) > > pts rule name description > -- > --

Re: socket SA is not fast enough, help

2006-03-29 Thread mouss
David B Funk wrote: On Tue, 28 Mar 2006, mouss wrote: Another thing is that I can't find a way to get the SA headers (as they would be added by spamassassin) without having the full message sent back (SYMBOLS doesn't return the score of each test). or am I missing something? Use the 'REPORT'

RE: socket SA is not fast enough, help

2006-03-29 Thread Matthew.van.Eerde
Matthew.van.Eerde wrote: > mouss wrote: >> unix sockets can't be used if the client and the server are in >> disjoint jails > > Really? Not even with symlinks (can you symlink a socket) or mount > --bind? /me comes to his senses Of course you can't symlink out of a jail, duh -- Matthew.van.

RE: socket SA is not fast enough, help

2006-03-29 Thread Matthew.van.Eerde
mouss wrote: > unix sockets can't be used if the client and the server are in disjoint jails Really? Not even with symlinks (can you symlink a socket) or mount --bind? -- Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902 Hispanic Business Inc./HireDiversity.com Software Eng

Re: Trusted or internal networks not recognized

2006-03-29 Thread List Mail User
>... >mouss wrote: >> Matt Kettler wrote: >>> While daryl's comment here isn't entirely on the mark, it is close. >>> Daryl, read the docs closer. SA does accept this format. >>> >>> Stephan, If you want to do an implied mask to cover a whole, you MUST >>> end in a . ie: you must use "10." not "10

RE: socket SA is not fast enough, help

2006-03-29 Thread Matthew.van.Eerde
Rob McEwen (PowerView Systems) wrote: > Justin Mason wrote: >> for what it's worth, the overhead of UNIX domain sockets is a lot >> less. > > ... any 3rd party tool to enhance and/or speed up window's built-in sockets? Windows does not have anything like UNIX domain sockets. The closest thing t

Re: socket SA is not fast enough, help

2006-03-29 Thread mouss
Justin Mason wrote: Adam Lanier writes: On Wed, 2006-03-29 at 08:50 -0800, Kenneth Kim wrote: My spamassassin is running on a remote server, no way to get around this at the moment. I am connecting to spamd on the remote server using sockets in php. Unfortunately I have to close the socket to g

Re: socket SA is not fast enough, help

2006-03-29 Thread David B Funk
On Tue, 28 Mar 2006, mouss wrote: > Another thing is that I can't find a way to get the SA headers (as they > would be added by spamassassin) without having the full message sent > back (SYMBOLS doesn't return the score of each test). or am I missing > something? Use the 'REPORT' or 'REPORT_IFSPA

Re: default score for SPF_HELO_FAIL too low?

2006-03-29 Thread Matt Kettler
Andy Spiegl wrote: > Hi, I'm wondering why the default score for SPF_HELO_FAIL is only 0.001? > On the other hand SPF_HELO_SOFTFAIL adds 3.14 > > After reading "man Mail::SPF::Query" I thought fail is a lot worse than > softfail, right? At least in SA's real world testing, SPF_HELO_FAIL had a wor

Re: socket SA is not fast enough, help

2006-03-29 Thread Rob McEwen (PowerView Systems)
Justin Mason wrote: > for what it's worth, the overhead of UNIX domain sockets is a lot less. I confess, I don't use SA... but I've frequented this list for a long time because I respect that expertise of SA users. Anyway... the mail server software I use runs on Windows 2003 and, recently, thi

Re: Trusted or internal networks not recognized

2006-03-29 Thread mouss
Matt Kettler wrote: In "old practice", 10.1=10.0.0.1 (a.b = 256^3 * a + b), and not 10.1.0.0. Really? That's a new one by me. This is a (deprecated?) BSD practice. it was coded in inet_addr.c and was thus imported by many systems. # ping 127.1 PING localhost (127.0.0.1): 56 data bytes 6

Re: 2nd mail server problem

2006-03-29 Thread Vincent Li
On 29-Mar-06, at 12:11 AM, Joshua, C.S. Chen wrote: Looks like I have to enable SA in the 2nd server. It might be a spam hole if the spam sent to 2nd first, then forcily relayed to the primary. If you are running postfix MTA on your 2nd server, you can map your email user list of main MTA serve

Re: socket SA is not fast enough, help

2006-03-29 Thread Justin Mason
Adam Lanier writes: > On Wed, 2006-03-29 at 08:50 -0800, Kenneth Kim wrote: > > My spamassassin is running on a remote server, no way to get around > > this at the moment. I am connecting to spamd on the remote server > > using sockets in php. Unfortunately I have to close the socket to get > > a

Re: socket SA is not fast enough, help

2006-03-29 Thread Adam Lanier
On Wed, 2006-03-29 at 08:50 -0800, Kenneth Kim wrote: > My spamassassin is running on a remote server, no way to get around > this at the moment. I am connecting to spamd on the remote server > using sockets in php. Unfortunately I have to close the socket to get > a response/spam score from the se

Re: socket SA is not fast enough, help

2006-03-29 Thread Kenneth Kim
My spamassassin is running on a remote server, no way to get around this at the moment. I am connecting to spamd on the remote server using sockets in php. Unfortunately I have to close the socket to get a response/spam score from the server. Is there any other way to promt a response from the serv

Re: Trusted or internal networks not recognized

2006-03-29 Thread Matt Kettler
mouss wrote: > Matt Kettler wrote: >> While daryl's comment here isn't entirely on the mark, it is close. >> Daryl, read the docs closer. SA does accept this format. >> >> Stephan, If you want to do an implied mask to cover a whole, you MUST >> end in a . ie: you must use "10." not "10". If you fa

MEDIA: MIT antispam conference video

2006-03-29 Thread Chris Santerre
Title: MEDIA: MIT antispam conference video I  missed the MIT conference. I thought it was April, and I was in Manhattan yesterday. If you are interested, you can watch the 6+ hours of video of it here: http://spamconference.org/ The good thing is you can fast forward the boring stuff. The

Re: How to: Nightly per-user batch training??

2006-03-29 Thread mouss
Jason Morrill wrote: Mike, I believe the difference is that you're using MySQL for the database. I'm using flat files in /home/user/.spamassassin. In my case when I run as 'root' sa-learn looks for the database in /root/.spamassassin since that is the current user's SA database location. In your

Re: SA scores

2006-03-29 Thread mouss
Belette wrote: hello there ! IS there a way to get SA scores using a shell command : e.g. : # spam -score < mail.txt # .045 depends on which headers you SA adds. *) X-Spam-Score (usually added with: add_header all Score _SCORE_ ). If it looks like: X-Spam-Score: -0.1 then

Re: How to: Nightly per-user batch training??

2006-03-29 Thread Jason Morrill
Mike, I believe the difference is that you're using MySQL for the database. I'm using flat files in /home/user/.spamassassin. In my case when I run as 'root' sa-learn looks for the database in /root/.spamassassin since that is the current user's SA database location. In your case the database loca

BLOCK: Antifraud Fraud

2006-03-29 Thread Chris Santerre
Title: BLOCK: Antifraud Fraud This is getting scary. Chase manhattan fisher is continuing to morph. Check out this Phish: http://204.17.79.197/wwwroot/gorilla/Chase.htm Which links to: http://genoma.cecalc.ula.ve/.chase/index.htm These antifraud frauds need to get shutdown ASAP. I think

RE: SA scores

2006-03-29 Thread Bowie Bailey
Belette wrote: > On 3/29/06, Johann Spies < [EMAIL PROTECTED]> wrote: > > On Wed, Mar 29, 2006 at 01:32:48PM +0200, Belette wrote: > > > > > >IS there a way to get SA scores using a shell command : > > > > > >e.g. : > > ># spam -score < mail.txt > > ># .045 > > > > > >i need

Re: SA scores

2006-03-29 Thread Belette
yeah thx, but the result is a very long text.in fact, i need to use the score as a number.( for an intern use )maybe a shell script will be usefullis there any way to get this score in a shell script and use it in it... ( as a variable ) i do not want to use spamc -R file.txt | grep etcmay

Re: 3.1.1 Upgrade Problems [solved]

2006-03-29 Thread Dale Blount
> > Replying to myself... I upgraded Archive::Tar and the error is gone now. > > To what version? > >From 1.00 to 1.29. Dale

Re: SA scores

2006-03-29 Thread Johann Spies
On Wed, Mar 29, 2006 at 01:32:48PM +0200, Belette wrote: >hello there ! > >IS there a way to get SA scores using a shell command : > >e.g. : ># spam -score < mail.txt ># .045 > >i need this coz i do not want to filter all mails, i just need a score, >without writing S

SA scores

2006-03-29 Thread Belette
hello there !IS there a way to get SA scores using a shell command :e.g. :   # spam -score < mail.txt# .045i need this coz i do not want to filter all mails, i just need a score, without writing SA header inside it Thx

Re: Training SA with Thunderbird Junk folder

2006-03-29 Thread martin
Edward Diener tropicsoft.com> writes: deleted... > > > > sth like this? > > > > sa-learn --mbox --spam --showdots Thunderbird_Junk_folder? > > That was what I was looking for. Thanks ! and also pls take care of running user (-u) and database path (--dbpath), as without running user param

default score for SPF_HELO_FAIL too low?

2006-03-29 Thread Andy Spiegl
Hi, I'm wondering why the default score for SPF_HELO_FAIL is only 0.001? On the other hand SPF_HELO_SOFTFAIL adds 3.14 After reading "man Mail::SPF::Query" I thought fail is a lot worse than softfail, right? "fail" means the client IP is not a designated mailer, and the sender wants you to re

Re: 2nd mail server problem

2006-03-29 Thread Joshua, C.S. Chen
Looks like I have to enable SA in the 2nd server. It might be a spam hole if the spam sent to 2nd first, then forcily relayed to the primary. Thanks for all your opinions Cheers Joshua martin wrote: Joshua, C.S. Chen asiaa.sinica.edu.tw> writes: Hi folks, I am using spamassa