Re: Stock Spams; aka Pump and Dump

2006-06-01 Thread Loren Wilton
Sure is a stock spam rule set. http://www.rulesemporium.com/rules/70_sare_stocks.cf Had it running 10 minutes after it was announced. My problem is worse than that. Possibly I could create a meta rule in my local.cf that says a sare_stock hit plus any other rule, add 5 points. If it

Re: Stock Spams; aka Pump and Dump

2006-06-01 Thread Loren Wilton
time to try them again. SpamCop, I won't go there, we have issues with the people at SpamCop. I neither use them nor trust them. You REALLY need to try URIBL, and probably uriblack, and a few more of the URI based lists. These get feeds from SpamCop and the like. But they work. Loren

Re: Clarifying internal_networks

2006-06-01 Thread Mark Martinec
On Thursday June 1 2006 04:05, Matt Kettler wrote: Simple rule: trusted_networks - set to cover all machines that might generate a Received: header that you control. internal_networks - Will default to match trusted_networks if not declared. 99% of the time, you just set trusted_networks.

Re: Bayes problem in 3.1.2?

2006-06-01 Thread Kai Schaetzl
Nels Lindquist wrote on Wed, 31 May 2006 10:04:54 -0600: I removed the /var/lib/spamassassin/3.001002 directory which was blank It shouldn't exist after an install and if you ran sa-update it should have content. Maybe an sa-update that got interrupted? Kai -- Kai Schätzl, Berlin, Germany

Re: 3.1.2 issue with UnixNFSSafe.pm ?

2006-06-01 Thread Kai Schaetzl
wrote on Wed, 31 May 2006 19:37:54 -0400 (EDT): some under the 5.6.1 site_perl, some under 5.005. Did you notice that you didn't say anything about this earlier? ;-) It seems this is the cause of your problem. Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet

Integrating Spam assasin with exchange server.

2006-06-01 Thread Crespillo, Matias
I apologize in advance for making a lazy question, but is there a quick guide somewhere as to how to integrate Spam Assassin with an exchange server? Or maybe some way to set it in a way it will get the mails before, filter and then forward them to exchange unchanged?. Thanks a lot in advance.

RE: Integrating Spam assasin with exchange server.

2006-06-01 Thread Sietse van Zanen
I use a dedicated SMTP gateway running RH EL3 sendmail + SpamAssassin + ClamAV to virus and spam check my e-mail before it goes into Exchange. This should be fairly easy to set up as spamassassin is run without user preferences and only uses local configuration. You might need to change MX

Re: Integrating Spam assasin with exchange server.

2006-06-01 Thread Steven Stern
Crespillo, Matias wrote: I apologize in advance for making a lazy question, but is there a quick guide somewhere as to how to integrate Spam Assassin with an exchange server? Or maybe some way to set it in a way it will get the mails before, filter and then forward them to exchange unchanged?.

RE: Clarifying internal_networks

2006-06-01 Thread Bowie Bailey
Mark Martinec wrote: On Thursday June 1 2006 04:05, Matt Kettler wrote: Simple rule: trusted_networks - set to cover all machines that might generate a Received: header that you control. internal_networks - Will default to match trusted_networks if not declared. 99% of the time,

RE: Bayes problem in 3.1.2?

2006-06-01 Thread Bowie Bailey
Kai Schaetzl wrote: Nels Lindquist wrote on Wed, 31 May 2006 10:04:54 -0600: I removed the /var/lib/spamassassin/3.001002 directory which was blank It shouldn't exist after an install and if you ran sa-update it should have content. Maybe an sa-update that got interrupted? I have two

Re: new mailman spam???

2006-06-01 Thread Thomas Bolioli
I definitely did not see an approval request. And I can now confirm that there are some people who are trying to opt out of the list saying they did not subscribe. I already have sent postmaster but I am not optimistic. Tom Benny Pedersen wrote: I have included the mailing in

Re: Stock Spams; aka Pump and Dump

2006-06-01 Thread Doc Schneider
DAve wrote: Howdy, My users are just about tired of the stock spams, we are getting many now that are barely hitting any stock rules at all. The funny thing is they are pretty much a legit email. No obfuscation, no funky headers, no URL. I am nearly ready to just stomp any and all stock

Re: syncing bayesian dbs between servers

2006-06-01 Thread Nigel Frankcom
On Thu, 1 Jun 2006 12:23:23 -0400, Theo Van Dinter [EMAIL PROTECTED] wrote: On Thu, Jun 01, 2006 at 05:07:26PM +0100, Nigel Frankcom wrote: If you find way of load balancing the MySQL db's I'd be very interested in hearing how. I'm not a DBA, but doesn't MySQL support clustering which would

Re: Stock Spams; aka Pump and Dump

2006-06-01 Thread DAve
Nigel Frankcom wrote: This may be a daft question, if so, apologies in advance; but, do you train these spam into sa? Nope, been down the Bayes road a few times and the load on the server never justified the spam it caught. When using bayes we always end up babysitting it too much. This

Re: Stock Spams; aka Pump and Dump

2006-06-01 Thread Dhawal Doshy
DAve wrote: Nigel Frankcom wrote: This may be a daft question, if so, apologies in advance; but, do you train these spam into sa? Nope, been down the Bayes road a few times and the load on the server never justified the spam it caught. When using bayes we always end up babysitting it too

Re: Stock Spams; aka Pump and Dump

2006-06-01 Thread Nigel Frankcom
Bayes is a stalwart here, that and the more recent versions of SA. Best I can suggest is upgrade to 3.1.1 and run in some rules, I'm happy to let you know which ones we use. That being said, bayes is the only realistic way of training in spam - adding it makes life a lot easier. HTH Kind

Re: Clarifying internal_networks

2006-06-01 Thread Mark Martinec
Bowie, it is imperative than MSA hosts are excluded from internal_networks. What do you do if SA is running on your MSA host? I believe this is the only exception to the rule, because the following probably takes precedence: The machine you're scanning on should be internal trusted

Re: Stock Spams; aka Pump and Dump

2006-06-01 Thread Theo Van Dinter
On Thu, Jun 01, 2006 at 02:53:56PM -0400, DAve wrote: Theo, I appreciate the results, that means more to me than upgrade. Results speak louder than anything else. Could you tell me the scores for each test? If you are as busy as I am, I understand if you can not Not off hand, but they're

Re: OT justin on slashdot

2006-06-01 Thread jdow
From: Dallas L. Engelken [EMAIL PROTECTED] From: John D. Hardin [mailto:[EMAIL PROTECTED] On Thu, 1 Jun 2006, Justin Mason wrote: Dallas L. Engelken writes: for those that didn't see it, http://slashdot.org/ read Google, Submission AdSense and NoFollow Letdown. figured I'd toot his

Re: OT justin on slashdot

2006-06-01 Thread jdow
From: Chris Santerre [EMAIL PROTECTED] From: Dallas L. Engelken [mailto:[EMAIL PROTECTED] From: John D. Hardin [mailto:[EMAIL PROTECTED] On Thu, 1 Jun 2006, Justin Mason wrote: Dallas L. Engelken writes: for those that didn't see it, http://slashdot.org/ read Google, Submission

Re: Stock Spams; aka Pump and Dump

2006-06-01 Thread Mark Martinec
On Thursday June 1 2006 20:53, DAve wrote: Bayes, arrgg!! More than once I've been given examples of bayes being the solution I need. I really really really want bayes to work. But each time I set it up, the db gets huge, scan times go through the roof, and I end up disappointed. I currently

Anyone using MyDNS to create private dsn rbl lists?

2006-06-01 Thread Marc Perkel
I'm thinking about using MyDNS to create my own DNS blacklist. I'm thinking I'll make it available to everyone to list IPs that are not on other lists. Mostly virus infected zombies and such. So - has anyone else done this? Looking for some pointers. I'm running Exim and wanting to have Exim

[SARE] 70_sare_html0.cf updated.

2006-06-01 Thread Robert Menschel
Just a quick note that 70_sare_html0.cf has been updated. A few obsolete rules (no longer hit any ham) have been removed, and one rule added. It'll take a little while longer for me to update the rest of the 70_sare_html*.cf files, and therefore 70_sare_html.cf ... if you don't want to wait for