RE: Why is this spam passing my SA (counterfeit goods)

2008-04-14 Thread Koopmann, Jan-Peter
http://igor.chudov.com/tmp/spam003.txt Could you paste the message itself (queue file)? Would like to see what my installation has to say about this one. :-)

Re: SPF and forwarding best practice

2008-04-14 Thread Benny Pedersen
On Mon, April 14, 2008 00:45, Moritz Borgmann wrote: Now, this setup entails the well-known problem that if X.com publishes an SPF record, SpamAssassin (3.2.4) spanks the message with SPF_FAIL since it checks the first *external* relay (mx.B.com), not the first untrusted relay against

no sa-update since jan 20

2008-04-14 Thread mailinglists
Hello, I'm sorry if my question is not in the right place here, but I have searched on the net, without finding any answer So, here is my question : is it normal that I see not update of the rules since 2008 January 20th ? It used to be updated every week and I get a lot of spam

RE: Upgrading

2008-04-14 Thread hiram
Hi Mike, That sounds on the limit to scarry. I will rethink it before upgrading then. Thanks for the advice and the information! Best regards, /Hiram Michael Hutchinson-3 wrote: -Original Message- Sir, You or someone else, has managed to break apt-get's info about S.A. Im

RE: Can SpamAssassin do an auto fail for these please ?

2008-04-14 Thread Chris
Has anyone found a way to have fail: no such user here, for senders, who send from one of a long list, like : [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] etc, etc Please ? Any help much appreciated. Chris.

Re: Can SpamAssassin do an auto fail for these please ?

2008-04-14 Thread Arvid Ephraim Picciani
On Saturday 12 April 2008 19:03:49 Chris wrote: Has anyone found a way to have fail: no such user here you mean 550 Unknown user? actually your mailserver is suposed to do that. [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] , for senders, who send from one of a

Re: Can SpamAssassin do an auto fail for these please ?

2008-04-14 Thread Michael Scheidell
From: Chris [EMAIL PROTECTED] Organization: Chris Reply-To: [EMAIL PROTECTED] Date: Sat, 12 Apr 2008 19:03:49 +0200 To: users@spamassassin.apache.org Subject: RE: Can SpamAssassin do an auto fail for these please ? Has anyone found a way to have fail: no such user here, for senders, who

Re: Can SpamAssassin do an auto fail for these please ?

2008-04-14 Thread Matus UHLAR - fantomas
On Saturday 12 April 2008 19:03:49 Chris wrote: Has anyone found a way to have fail: no such user here you mean 550 Unknown user? actually your mailserver is suposed to do that. [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] , for senders, who send

For users of RMAIL in EMACS not familier with programming, not familiar with dotfiles, how can spamassassin headers be used with EMACS or RMAIL existing commands?...

2008-04-14 Thread Don Saklad
For users of RMAIL in EMACS not familier with programming, not familiar with dotfiles, how can spamassassin headers be used with EMACS or RMAIL existing commands?... .

Re: FW: Why is this spam passing my SA (counterfeit goods)

2008-04-14 Thread Jonas Eckerman
Josie Walls wrote: Would this group agree that requiring 5 hits in order to classify an email as spam is too conservative a number? I wouldn't. We reject everything with a score of 18 or higher, quarantine everything with 9 or higher (I read the quarantine reports every work day), and let

thresholds and accuracy (Re: FW: Why is this spam passing my SA (counterfeit goods))

2008-04-14 Thread Justin Mason
Jonas Eckerman writes: Josie Walls wrote: Would this group agree that requiring 5 hits in order to classify an email as spam is too conservative a number? I wouldn't. We reject everything with a score of 18 or higher, quarantine everything with 9 or higher (I read the quarantine

use_bayes 0 Clarification

2008-04-14 Thread Jean-Paul Natola
If I set the use_bayes 0 Will that negate the training of spam? I've trained sa with approx 7000 spam messages , yet I still get the -2.6 BAYES_00

RE: Updateing

2008-04-14 Thread Bowie Bailey
Karsten Bräckelmann wrote: On Sat, 2008-04-12 at 12:44 -0400, Grant Peel wrote: Just wondering how often people reccomend runing sa-update ? As often as you like [1]. It's just a DNS query, really cheap if there is no update. However... (a) Generally, there is just one update a day, if

Re: no sa-update since jan 20

2008-04-14 Thread Matt Kettler
mailinglists wrote: Hello, I'm sorry if my question is not in the right place here, but I have searched on the net, without finding any answer So, here is my question : is it normal that I see not update of the rules since 2008 January 20th ? It used to be updated every week and I

Re: FW: Why is this spam passing my SA (counterfeit goods)

2008-04-14 Thread Jonas Eckerman
Jonas Eckerman wrote: We reject everything with a score of 18 or higher, quarantine everything with 9 or higher That should have been reject *and* quarantine everything with 9 or higher /J -- Jonas Eckerman, FSDB Fruktträdet http://whatever.frukt.org/ http://www.fsdb.org/

Re: no sa-update since jan 20

2008-04-14 Thread mailinglists
Matt Kettler a écrit : mailinglists wrote: Hello, I'm sorry if my question is not in the right place here, but I have searched on the net, without finding any answer So, here is my question : is it normal that I see not update of the rules since 2008 January 20th ? It used to be

Re: use_bayes 0 Clarification

2008-04-14 Thread Matt Kettler
Jean-Paul Natola wrote: If I set the use_bayes 0 Will that negate the training of spam? this will disable the use of bayes completely. After setting that, no BAYES_* rules should match any email. I've trained sa with approx 7000 spam messages , yet I still get the -2.6 BAYES_00

Re: FW: Why is this spam passing my SA (counterfeit goods)

2008-04-14 Thread Matus UHLAR - fantomas
Jonas Eckerman wrote: We reject everything with a score of 18 or higher, quarantine everything with 9 or higher On 14.04.08 15:09, Jonas Eckerman wrote: That should have been reject *and* quarantine everything with 9 or higher I thought you can reject *or* quarantine, the combintaion

RE: use_bayes 0 Clarification

2008-04-14 Thread Jean-Paul Natola
Jean-Paul Natola wrote: If I set the use_bayes 0 Will that negate the training of spam? this will disable the use of bayes completely. After setting that, no BAYES_* rules should match any email. I've trained sa with approx 7000 spam messages , yet I still get the -2.6 BAYES_00

Ip getting listed on spamhaus

2008-04-14 Thread Johnny Stork
I have a client running a plesk/qmail hosting service who is having some trouble with getting their shared ip listed on spamhaus. I believe they are already running SA in some capacity. I am also looking into various solutions to suggest to them, possibly including mailscanner if it can be

Re: Ip getting listed on spamhaus

2008-04-14 Thread SM
At 08:47 14-04-2008, Johnny Stork wrote: I have a client running a plesk/qmail hosting service who is having some trouble with getting their shared ip listed on spamhaus. I believe they are already running SA in some capacity. I am also looking into various solutions to suggest to them,

Re: Ip getting listed on spamhaus

2008-04-14 Thread Joseph Brennan
Johnny Stork [EMAIL PROTECTED] wrote: For now I would like to try and determine why they keep getting listed on spamhaus. Go to www.spamhaus.org, click on the unfortunately named link Remove IP Address, which actually lets you _look up_ an IP address, and from there you can see why it is

Re: FW: Why is this spam passing my SA (counterfeit goods)

2008-04-14 Thread Jonas Eckerman
Matus UHLAR - fantomas wrote: I thought you can reject *or* quarantine, Wether that or is exclusive or not depends on the tools you use. With MIMEDefang (wich we use) it isn't. Since SpamAssassin has to be called after the complete message has been received, there is no technical reason

Re: Returned mail spam

2008-04-14 Thread Benny Pedersen
On Thu, April 10, 2008 18:29, Arvid Ephraim Picciani wrote: On Thursday 10 April 2008 17:16:40 mouss wrote: I personally have found that SPF causes more problems than it helps, and for that I do not recommend setting SPF record for general use domains. spf supports +ALL, please tell me why

is this backscatter or not

2008-04-14 Thread Arvid Ephraim Picciani
Hi, I'd like to discuss if returning a mail that went through a mailing list, back to the sender can be described as backscatter. I sent the postmaster a mail becouse they filter mails that contains specific words and send a bounce to the sender. Now i'm preparing to dicuss this with him/her

can not compile sought ruleset

2008-04-14 Thread Stefan Jakobs
Hello, I just tried the sought ruleset (see http://taint.org/2007/08/15/004348a.html). But I was not able to compile it. Is the ruleset not compilable or did I something wrong? I'm using SpamAssassin v3.2.3 and here's the output from sa-compile: # sudo /usr/bin/sa-compile [19022] info:

Re: is this backscatter or not

2008-04-14 Thread Martin Gregorie
On Mon, 2008-04-14 at 18:04, Arvid Ephraim Picciani wrote: Hi, I'd like to discuss if returning a mail that went through a mailing list, back to the sender can be described as backscatter. I would say not. Backscatter to me means 550 rejects that are sent to a bystander because the

Re: is this backscatter or not

2008-04-14 Thread DAve
Martin Gregorie wrote: On Mon, 2008-04-14 at 18:04, Arvid Ephraim Picciani wrote: Hi, I'd like to discuss if returning a mail that went through a mailing list, back to the sender can be described as backscatter. I would say not. Backscatter to me means 550 rejects that are sent to a

Bayesiam Learning Paths for Spamassassin

2008-04-14 Thread JasonHirsh
I have SA 3.17 running with amavisd-new, dovecot and Postfix 2.4.3 and Clama/v on freebsd 6.1 I am trying toteach sa using the following sa-learn /var/mail/vmail/example.com/user/.INBOX.spam/cur/ this is a maildir I have put around 175 spam messages in.. I got the following response Learned

Re: is this backscatter or not

2008-04-14 Thread Benny Pedersen
On Mon, April 14, 2008 21:05, Martin Gregorie wrote: On Mon, 2008-04-14 at 18:04, Arvid Ephraim Picciani wrote: Backscatter to me means 550 rejects that are sent to a bystander because the sending address was forged by some spamming low-life. http://www.t29.dk/header_check_notes.php old page

Re: SPF and forwarding best practice

2008-04-14 Thread mouss
Benny Pedersen wrote: On Mon, April 14, 2008 00:45, Moritz Borgmann wrote: Now, this setup entails the well-known problem that if X.com publishes an SPF record, SpamAssassin (3.2.4) spanks the message with SPF_FAIL since it checks the first *external* relay (mx.B.com), not the first

[no subject]

2008-04-14 Thread rickm
/m:46 spam: 3.2.4 X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on mail.limelyte.com X-Spam-Level: X-Spam-Status: No, score=-3.8 required=5.0 tests=ALL_TRUSTED,BAYES_00 autolearn=ham version=3.2.4 Received: from static-166-3.aei.ca (HELO ?192.168.1.119?) ([EMAIL

Re: is this backscatter or not

2008-04-14 Thread Bob Proulx
Martin Gregorie wrote: Arvid Ephraim Picciani wrote: I'd like to discuss if returning a mail that went through a mailing list, back to the sender can be described as backscatter. I sent the postmaster a mail becouse they filter mails that contains specific words and send a bounce to the

Re: is this backscatter or not

2008-04-14 Thread mouss
Arvid Ephraim Picciani wrote: Hi, I'd like to discuss if returning a mail that went through a mailing list, back to the sender can be described as backscatter. I sent the postmaster a mail becouse they filter mails that contains specific words and send a bounce to the sender. if they can't

Re: is this backscatter or not

2008-04-14 Thread Arvid Ephraim Picciani
On Monday 14 April 2008 22:28:58 Bob Proulx wrote: Martin Gregorie wrote: Arvid Ephraim Picciani wrote: I'd like to discuss if returning a mail that went through a mailing list, back to the sender can be described as backscatter. I sent the postmaster a mail becouse they filter mails

Re: Low Scores on Bounce Backs

2008-04-14 Thread Mark Martinec
On Friday 11 April 2008 15:05:59 Justin Mason wrote: Mark Martinec writes: It would also block some messages which you may or may not want to block, such as: - some automatic notifications such as calendar/meeting reminders, notifications from ticketing/PR systems (OTRS), status

Re: can not compile sought ruleset

2008-04-14 Thread Justin Mason
what version of re2c are you using? 0.12.3 seems to work fine... --j. Stefan Jakobs writes: Hello, I just tried the sought ruleset (see http://taint.org/2007/08/15/004348a.html). But I was not able to compile it. Is the ruleset not compilable or did I something wrong? I'm using

RE: Upgrading

2008-04-14 Thread Michael Hutchinson
Hello Hiram, It's not scary, you have to step up and own it - be prepared. The best way might be to replicate the situation/scenario in a Virtual environment, and attempt upgrading in there first, to see what might go wrong, and how you can avoid problems on your live server. VMWare is great for

Re: can not compile sought ruleset

2008-04-14 Thread Stefan Jakobs
On Monday 14 April 2008 23:42, Justin Mason wrote: what version of re2c are you using? 0.12.3 seems to work fine... I tried it first with 0.12.3 and then with 0.13.4. But I got the same failure with both of them. I tried it also only with the sought ruleset and re2c 0.13.4 and I got this:

SPF and Hotmail

2008-04-14 Thread Michael Hutchinson
Hi Everyone. I am trying to reduce Spam from Forged hotmail addresses. I understand that because I am on Spamassassin 3.1.7, that my hotmail rules are out-of-date. They do, however, manage to correctly fire on the forged hotmail Spam, but not with a score high enough to flag the mail as such.

Missing plugins?

2008-04-14 Thread Gerardo Juarez-Mondragon
Hi, I have SpamAssassin version 3.1.9 running on Perl version 5.8.8, Centos 5.1 OS. SpamAssassin has run perfectly so far. However, this monday I repeated the usual procedure to train the filters and received a lot of errors, similar to this pair: plugin: failed

Re: Missing plugins?

2008-04-14 Thread Matt Kettler
Gerardo Juarez-Mondragon wrote: Hi, I have SpamAssassin version 3.1.9 running on Perl version 5.8.8, Centos 5.1 OS. SpamAssassin has run perfectly so far. However, this monday I repeated the usual procedure to train the filters and received a lot of errors, similar to this pair:

Re: SPF and Hotmail

2008-04-14 Thread ram
On Tue, 2008-04-15 at 10:35 +1200, Michael Hutchinson wrote: Hi Everyone. I am trying to reduce Spam from Forged hotmail addresses. I understand that because I am on Spamassassin 3.1.7, that my hotmail rules are out-of-date. They do, however, manage to correctly fire on the forged