Re: Found on a stock spam:

2006-06-18 Thread Michael Monnerie
On Montag, 19. Juni 2006 05:42 Bob Proulx wrote: > Meanwhile, I do think that filtering outgoing mail from such places > as open internet nodes at hotels and other places like that is > probably a good thing.  But simply tagging by itself does not seem > useful to me. It's a legal thing: You are n

RE: SPF SOFTFAIL definition

2006-06-18 Thread Jim Hermann - UUN Hostmaster
Here is another example that I was able to isolate to a test file. The debug looks like this: [28763] dbg: plugin: registering glue method for check_hashcash_double_spend (Mail::SpamAssassin::Plugin::Hashcash=HASH(0x98a6e80)) [28763] dbg: plugin: registering glue method for check_for_spf_helo_pas

Re: Bayes available ?

2006-06-18 Thread Loren Wilton
> debug: bayes: Not available for scanning, only 0 spam(s) in Bayes DB < 200 This says that you don't have Bayes trained. Before Bayes will score a message it has to know what is ham and what is spam for you. To do that, you need to specifically feed at least 200 hams and 200 spams to bayes, tel

RE: SPF SOFTFAIL definition

2006-06-18 Thread Jim Hermann - UUN Hostmaster
Does it mean anything with there is no test after the SPF failed: part of the report? I checked the from domain and it did not have a TXT or SPF record. It is possible that it refused my DNS connection. I don't recall. I saved the message to a file and ran spamassassin on it and it passes now.

Bayes available ?

2006-06-18 Thread Noc Phibee
Hi i have this in my logs : debug: lock: 5079 created /var/spool/spamassassin/bayes.lock.mx1.scanerys.org.5079 debug: lock: 5079 trying to get lock on /var/spool/spamassassin/bayes with 0 retries debug: lock: 5079 link to /var/spool/spamassassin/bayes.lock: link ok debug: bayes: 5079 tie-ing

Re: Found on a stock spam:

2006-06-18 Thread Bob Proulx
Loren Wilton wrote: > I found this in the original headers of a stock spam (before it picked up 67 > points on my system): :-) However what I have been seeing is that a lot of sites are processing *outgoing* mail through spamassassin. More than likely a spam virus infected cable 'bot sent the me

Trancated longreport

2006-06-18 Thread Jim Hermann - UUN Hostmaster
Why does the longreport get truncated sometimes? It appears to have something to do with the percent sign in the rule description. In the example below, the percent sign at the end of the BAYES_50 description has been replaced with the word uppercase, which is the last part AFTER the percent si

ApacheCon US 2006 CFP

2006-06-18 Thread Michael Parker
- Call for Papers for ApacheCon US 2006 is currently open! ApacheCon US 2006 will be held at the Hilton Hotel in Austin, Texas, October 9-13, 2006. The ASF and the conference producer—Full Circle Productions— invite the Open Source community to send in session an

Found on a stock spam:

2006-06-18 Thread Loren Wilton
I found this in the original headers of a stock spam (before it picked up 67 points on my system): X-Spam-Tests: BAYES_00=-2.599,FORGED_MUA_OUTLOOK=3.92, RAZOR2_CF_RANGE_51_100=0.056,RAZOR2_CHECK=1.511,STOCK_ALERT=2.385 X-Spam-Score: 5.3 X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on

Its nice when spammers declare their intentions...

2006-06-18 Thread Loren Wilton
Subject: PayPal Fraud Intention !!! Verify Account & Billing Information !!! From: "PayPal.inc Security Center Department " <[EMAIL PROTECTED]> Its nice to know that they intend to defraud me. Maybe I won't bother playing their game. Loren

Re: SPF SOFTFAIL definition

2006-06-18 Thread JamesDR
Jim Hermann - UUN Hostmaster wrote: What happens if the DNS records are not available? We don't know if there is a TXT record or not. Jim Benny Pedersen wrote: If the SPF module can't obtain the DNS TXT record due to timeouts, does this get reported as a SOFTFAIL? Received-SPF: pa

Re: SPF SOFTFAIL definition

2006-06-18 Thread Magnus Holmgren
On Sunday 18 June 2006 19:31, Jim Hermann - UUN Hostmaster took the opportunity to write: > Is Mail::SpamAssassin::Plugin::SPF adding the Received-SPF: Header? > > I don't see it in email that received by my server, except for email from > [EMAIL PROTECTED] No, it only defines a number of eval te

RE: SPF SOFTFAIL definition

2006-06-18 Thread Jim Hermann - UUN Hostmaster
Is Mail::SpamAssassin::Plugin::SPF adding the Received-SPF: Header? I don't see it in email that received by my server, except for email from [EMAIL PROTECTED] Jim -Original Message- From: Benny Pedersen [mailto:[EMAIL PROTECTED] Sent: Sunday, June 18, 2006 10:56 AM To: users@spamassass

RE: SPF SOFTFAIL definition

2006-06-18 Thread Jim Hermann - UUN Hostmaster
What happens if the DNS records are not available? We don't know if there is a TXT record or not. Jim -Original Message- From: JamesDR [mailto:[EMAIL PROTECTED] Sent: Sunday, June 18, 2006 11:03 AM To: users@spamassassin.apache.org Subject: Re: SPF SOFTFAIL definition Benny Pedersen wr

Re: SPF SOFTFAIL definition

2006-06-18 Thread JamesDR
Benny Pedersen wrote: If the SPF module can't obtain the DNS TXT record due to timeouts, does this get reported as a SOFTFAIL? Received-SPF: pass (amiga.junc.org: domain of [EMAIL PROTECTED] designates 209.237.227.199 as permitted sender) Received-SPF: unknown (asf.osuosl.org: error in pro

Re: SPF SOFTFAIL definition

2006-06-18 Thread Benny Pedersen
> If the SPF module can't obtain the DNS TXT record due to timeouts, does this > get reported as a SOFTFAIL? Received-SPF: pass (amiga.junc.org: domain of [EMAIL PROTECTED] designates 209.237.227.199 as permitted sender) Received-SPF: unknown (asf.osuosl.org: error in processing during lookup

Re: two required_scores deffinition

2006-06-18 Thread John D. Hardin
On Sun, 18 Jun 2006, Pezhman Lali wrote: > how Can I use two treshold in spamassassin, for > example: > 0-5 tagged messages, 5-15 delete message. In SA alone you can't. SA just scores, something else has to take action based on the score. > my system was made by p3scan+spamassassin for incoming

SPF SOFTFAIL definition

2006-06-18 Thread Jim Hermann - UUN Hostmaster
If the SPF module can't obtain the DNS TXT record due to timeouts, does this get reported as a SOFTFAIL? Jim

two required_scores deffinition

2006-06-18 Thread Pezhman Lali
hi how Can I use two treshold in spamassassin, for example: 0-5 tagged messages, 5-15 delete message. my system was made by p3scan+spamassassin for incoming and proxsmtpd + spamassassin for outgoing. help me best Pezhman __ Do You Yahoo!? Tired of s

How to detect current images-only messages?

2006-06-18 Thread Yves Goergen
Hello, I keep receiving messages that contain of nothing but composed images. They're HTML messages with only tags in them. There seems to be a rule that checks if the message has *any* image and compares it to its length. That gave my spam some scores recently but not so today. I received a messa

Re: Adding Phishing Link rule

2006-06-18 Thread Yves Goergen
On 18.06.2006 03:51 CE(S)T, Loren Wilton wrote: > The rule you suggest isn't particularly good. There are far too many legit > mails (mostly mailing list type of things) that do exactly what you want to > check for. So the FP rate is higher than most people would like. However, I haven't seen th

Re: Adding Phishing Link rule

2006-06-18 Thread Yves Goergen
On 18.06.2006 04:29 CE(S)T, Theo Van Dinter wrote: > Actually that is a rule already in 3.1 (HTTPS_IP_MISMATCH) (anchor text > has to be https w/ some http href which is an IP). Well, if it really is, it doesn't work. -- Yves Goergen "LonelyPixel" <[EMAIL PROTECTED]> http://beta.unclassified.de

Re: full rule required, or is there something better?

2006-06-18 Thread Michael Monnerie
On Sonntag, 18. Juni 2006 04:31 Theo Van Dinter wrote: > Sure. Use the MIMEHeader plugin. (you can even check out the other > attachment name-related rules that exist... ;) ) Thank you, good hint! > (full rules -- boo!) Yes I know, I read this, that's why I asked. Now I want to have the same