Re: Basic Setup Questions

2010-06-28 Thread Matus UHLAR - fantomas
On Sun, Jun 27, 2010 at 12:45 PM, Giampaolo Tomassoni giampa...@tomassoni.biz wrote: No. You also need to teach enough ham and spam tokens to Bayes. By default, you should train bayes with at least 200 ham messages and 200 spam messages. At that point, you should start seeing bayes scoring

blizzard (and others) faux messages

2010-06-28 Thread LuKreme
Been getting a lot of messages form hotmail and others claiming to be from Blizzard account management or Aeon account services, or a whole host of others. They are not pegging SA at all, scoring usually close to 0 (they will get Bayes_00 and sometimes a spamcop hit to balance out, but nothing

Re: blizzard (and others) faux messages

2010-06-28 Thread Benny Pedersen
whitelist_from_dkim *...@blizzard.com whitelist_from_dkim *...@battle.net first dont use wildcard but as you want can be done like this blacklist_from f...@example.net whitelist_from_dkim f...@example.net if wildcard is needed do def_blacklist_from and def_whitelist_from_dkim -- xpoint

Autoreplies from RT are hitting on ANY_BOUNCE_MESSAGE

2010-06-28 Thread Dan Mahoney, System Admin
Hey there, Perhaps this is by design, but rt replies are, strictly speaking, not bounce messages. Message attached, let me know if it looks normal. -Dan -- Dan Mahoney Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC ICQ: 13735144 AIM: LarpGM Site:

Re: Autoreplies from RT are hitting on ANY_BOUNCE_MESSAGE

2010-06-28 Thread Yet Another Ninja
On 2010-06-28 11:33, Dan Mahoney, System Admin wrote: Hey there, Perhaps this is by design, but rt replies are, strictly speaking, not bounce messages. Message attached, let me know if it looks normal. -Dan from what I see it looks normal if someone really makes an effort to tune SA

Re: blizzard (and others) faux messages

2010-06-28 Thread Ned Slider
Yes, I do exactly the same - whitelist by dkim (or spf) the domain that is being abused and then wack all mail from that domain that isn't signed. On 28/06/10 10:07, Benny Pedersen wrote: whitelist_from_dkim *...@blizzard.com whitelist_from_dkim *...@battle.net first dont use wildcard

Re: blizzard (and others) faux messages

2010-06-28 Thread Benny Pedersen
On Mon 28 Jun 2010 12:37:57 PM CEST, Ned Slider wrote Why not - that looks fine to me? its less strong on something that one dont know what is, its still valid yes, but never shot animals with atom bomps :) The only real difference I see between whitelist_from_dkim and

Re: blizzard (and others) faux messages

2010-06-28 Thread Mark Martinec
LuKreme, Been getting a lot of messages form hotmail and others claiming to be from Blizzard account management or Aeon account services, or a whole host of others. They are not pegging SA at all, scoring usually close to 0 (they will get Bayes_00 and sometimes a spamcop hit to balance

Re: regex for short messages

2010-06-28 Thread Daniel Lemke
Bowie Bailey wrote: Bowie Bailey wrote: Daniel Lemke wrote: Hi, I want to check some mails for their char count (will be part of a meta rule) but spamassassin does hit the rule, even if the mail has less chars than defined in regex. The regex was tested in Perl and was working

Re: Does spamd support ipv6 yet?

2010-06-28 Thread Greg Troxel
Dan Mahoney, System Admin d...@prime.gushi.org writes: I previously asked this question and was told the best answer might be to wait for 3.3. Was there ever support ratified for ipv6 including proper -A ipv6 access lists, and proper ability to listen on both the ipv6 default and the v4

RE: Basic Setup Questions

2010-06-28 Thread Giampaolo Tomassoni
The documentation simply says run sa-learn. Does the creation of the bayes db files effectively enable bayes? No. You also need to teach enough ham and spam tokens to Bayes. By default, you should train bayes with at least 200 ham messages and 200 spam messages. At that point, you

Re: Learning and reporting with spamc in a single step?

2010-06-28 Thread Karsten Bräckelmann
On Sun, 2010-06-27 at 16:52 -0400, Dan Mahoney, System Admin wrote: Can spamc do this, or must it be forked to tee or something. Ideally I'd like to both report and learn in a single step (such as in a pipe from alpine). I note that spamassassin -r also has the option to learn (by

Re: Searched but did not find any info re scores for squirrelmail inbound

2010-06-28 Thread Karsten Bräckelmann
On Sun, 2010-06-27 at 18:22 -0700, bongomania wrote: My email server, squirrelmail, has spamassassin already installed. To configure, it says to enter the score above which emails should be quarantined. Unfortunately nowhere on that page, nor in the SA FAQ, nor in the SA WIKI, nor in a

Re: Searched but did not find any info re scores for squirrelmail inbound

2010-06-28 Thread Karsten Bräckelmann
On Sun, 2010-06-27 at 21:34 -0400, Alex wrote: [...] spamassassin itself only does the scoring -- it's up to another program, such as amavisd-new (separate application) or spamd (included with spamassassin) to do something with the email once it has been determined to be spam. Nope, spamd

Re: Basic Setup Questions

2010-06-28 Thread Adam Moffett
My default config does not appear to be using bayes. How do I enable it? use_bayes and bayes_auto_learn are on by default. I think using the packages on a Ubuntu system they'll default to off. There could be others that do that. The documentation simply says run sa-learn. Does

Re: regex for short messages

2010-06-28 Thread Bowie Bailey
Daniel Lemke wrote: Hmm, I've just noticed that my rule is working fine for simple text messages, but is also been triggered when checking mails containing html (http://pastebin.com/xB7SKnFV). rawbody T__SHORT_MAIL /\A.{0,150}\z/s -D reports: Jun 28 13:32:40.961 [4200] dbg: rules:

Re: [sa-list] Re: Learning and reporting with spamc in a single step?

2010-06-28 Thread Dan Mahoney, System Admin
On Mon, 28 Jun 2010, Karsten Bräckelmann wrote: On Sun, 2010-06-27 at 16:52 -0400, Dan Mahoney, System Admin wrote: Can spamc do this, or must it be forked to tee or something. Ideally I'd like to both report and learn in a single step (such as in a pipe from alpine). I note that

Re: Learning and reporting with spamc in a single step?

2010-06-28 Thread Karsten Bräckelmann
On Mon, 2010-06-28 at 13:53 -0400, Dan Mahoney, System Admin wrote: On Mon, 28 Jun 2010, Karsten Bräckelmann wrote: If you actually can use both options at the same time, I don't know. Maybe you wanna try it, and let us know. :) Ah, having spamc talk to netcat just showed it nicely. Both -L

Re: Searched but did not find any info re scores for squirrelmail inbound

2010-06-28 Thread Alex
Hi, [...] spamassassin itself only does the scoring -- it's up to another program, such as amavisd-new (separate application) or spamd (included with spamassassin) to do something with the email once it has been determined to be spam. Nope, spamd does not do anything with the email either.

Re: Searched but did not find any info re scores for squirrelmail inbound

2010-06-28 Thread Karsten Bräckelmann
On Mon, 2010-06-28 at 14:57 -0400, Alex wrote: Nope, spamd does not do anything with the email either. Thanks for correcting me. I use amavisd. For those who use spamd, how do they determine the email destiny based on the score? With just procmail? Yes, or any other MDA, probably using

sane values for size of bayes_token database in MySQL

2010-06-28 Thread Aaron Bennett
I'm sort of pulling at straws here, but I'm reading the manpage for sa-learn and it says that sa-learn will try to expire bayes tokens according to this: - the number of tokens in the DB is 100,000 - the number of tokens in the DB is bayes_expiry_max_db_size - there is

me.com as freemail?

2010-06-28 Thread Daniel J McDonald
I notice that me.com (Apple's mobile me) is now offering a free 60 day trial for their mail solution. About half the mail from me.com has been spam here lately, so I've added it to my local list of freemail domains. Anyone seen anything similar? -- Daniel J McDonald, CCIE # 2495, CISSP #

Re: me.com as freemail?

2010-06-28 Thread LuKreme
On 28-Jun-2010, at 14:41, Daniel J McDonald wrote: I notice that me.com (Apple's mobile me) is now offering a free 60 day trial What do you mean, now? They have always offered a 60 day trial. for their mail solution. About half the mail from me.com has been spam here lately, so I've added

Re: blizzard (and others) faux messages

2010-06-28 Thread LuKreme
On 28-Jun-2010, at 04:51, Mark Martinec wrote: The syntax hasn't changed - the DKIM plugin docs is up-to-date, see there. perldoc Mail::DKIM was not in anyway helpful. I assume I am looking in the wrong place? $ perldoc Mail::SpamAssasin::Plugin::DKIM No documentation found for

Re: blizzard (and others) faux messages

2010-06-28 Thread Karsten Bräckelmann
On Mon, 2010-06-28 at 15:02 -0600, LuKreme wrote: On 28-Jun-2010, at 04:51, Mark Martinec wrote: The syntax hasn't changed - the DKIM plugin docs is up-to-date, see there. I assume I am looking in the wrong place? $ perldoc Mail::SpamAssasin::Plugin::DKIM No documentation found for

Re: blizzard (and others) faux messages

2010-06-28 Thread LuKreme
On 28-Jun-2010, at 15:11, Karsten Bräckelmann wrote: On Mon, 2010-06-28 at 15:02 -0600, LuKreme wrote: On 28-Jun-2010, at 04:51, Mark Martinec wrote: The syntax hasn't changed - the DKIM plugin docs is up-to-date, see there. I assume I am looking in the wrong place? $ perldoc