Re: Spamassassin and no whitelisting

2010-08-16 Thread jdow
Off hand I don't see a problem. What does spamassassin --lint say as a user (not as root?) It's almost as if your whitelist rules are not being parsed because of an error in the file above the whitelist rules. If lint passes I'd use spamassassin -t -D testemail. Note, I'd NOT use spamc to make

Optional argument in regex

2010-08-16 Thread Mynabbler
I think everybody and their dog made a ruleset regarding 'your email address has won'. Something like: MN_YEAHRIGHT /\bYour (?:email|e-mail) (?:address|account) (?:has won|just won you)\b/ How do you make the second argument optional? So it also hits 'your email has won'? -- View this message

Re: Spamassassin and no whitelisting

2010-08-16 Thread Josef Karliak
radio-hk:/etc/mail/spamassassin # sudo -u chose spamassassin --lint -c /etc/mail/spamassassin/local.cf Aug 16 13:00:05.859 [4857] warn: netset: cannot include 200.200.200.0/24 as it has already been included Aug 16 13:00:05.868 [4857] warn: netset: cannot include 200.200.200.0/24 as it has

Re: Optional argument in regex

2010-08-16 Thread Daniel McDonald
On 8/16/10 6:00 AM, Mynabbler mynab...@live.com wrote: I think everybody and their dog made a ruleset regarding 'your email address has won'. Something like: MN_YEAHRIGHT /\bYour (?:email|e-mail) (?:address|account) (?:has won|just won you)\b/ How do you make the second argument

Re: Optional argument in regex

2010-08-16 Thread Martin Gregorie
On Mon, 2010-08-16 at 04:00 -0700, Mynabbler wrote: I think everybody and their dog made a ruleset regarding 'your email address has won'. Something like: How do you make the second argument optional? So it also hits 'your email has won'? One way is to use a meta: body _MN_YR1

Re: Spamassassin and no whitelisting

2010-08-16 Thread Martin Gregorie
On Sun, 2010-08-15 at 18:35 -0700, John Hardin wrote: Short of a custom plugin you'd probably be looking at a tool to extract external email addresses from your outbound log and create a whitelist .cf file that SA reads, and you'd periodically run this tool and then restart SA. I have a

Re: Optional argument in regex

2010-08-16 Thread John Hardin
On Mon, 16 Aug 2010, Mynabbler wrote: I think everybody and their dog made a ruleset regarding 'your email address has won'. Something like: MN_YEAHRIGHT /\bYour (?:email|e-mail) (?:address|account) (?:has won|just won you)\b/ I've done lots. Take a look in my sandbox. How do you make the

Re: Spamassassion for each site

2010-08-16 Thread Bowie Bailey
On 8/13/2010 8:47 PM, nonlin wrote: Dear all, Thank you all for your assistance. After all the fuss I have been making, I forgot the one rule that I have learned from dealing with electrics, always check your equipment before you use it!. since I was the admin I use outlook express to

Re: controlling channel order (Was: JM_SOUGHT_FRAUD)

2010-08-16 Thread Bowie Bailey
On 8/14/2010 5:51 PM, mouss wrote: Le 12/08/2010 00:37, Karsten Bräckelmann a écrit : On Wed, 2010-08-11 at 17:30 -0400, Bowie Bailey wrote: In case anyone else is following this... The sa-update process made things a bit more complex than simply renaming the file after updates. If that's

Re: Optional argument in regex

2010-08-16 Thread Bowie Bailey
On 8/16/2010 7:00 AM, Mynabbler wrote: I think everybody and their dog made a ruleset regarding 'your email address has won'. Something like: MN_YEAHRIGHT /\bYour (?:email|e-mail) (?:address|account) (?:has won|just won you)\b/ How do you make the second argument optional? So it also hits

autowhitelist

2010-08-16 Thread Mark Chaney
Ok, so I setup the mysql autowhitelisting db connection info in SA and then ran the lint test and it appears everything is connecting fine. I am though seeing any data logged. According to the local.conf, autowhitelisting is enabled by default. I am using version 3.3.1 and it is setup with

short pharma spam shoots straight through

2010-08-16 Thread Jason Haar
Hi there For the past few weeks we've experienced a large increase in missed spam. It's Pharma-related, one sentence plus a link. The interesting features are: * every Subject line is different. They're aren't Bayes-busters either - all Pharma related - but shall we say innovative in their use

Re: short pharma spam shoots straight through

2010-08-16 Thread Bowie Bailey
On 8/16/2010 4:05 PM, Jason Haar wrote: Hi there For the past few weeks we've experienced a large increase in missed spam. It's Pharma-related, one sentence plus a link. The interesting features are: * every Subject line is different. They're aren't Bayes-busters either - all Pharma

Re: short pharma spam shoots straight through

2010-08-16 Thread Jason Haar
On 08/17/2010 08:11 AM, Bowie Bailey wrote: Since you only give one example, it's hard to find a good pattern to match on. If all of them are going to .ru urls, you could write a rule for that. The best thing to do is to take a look at several examples and try to figure out what they have

Re: Spamassassin and no whitelisting

2010-08-16 Thread jdow
That -c shows what you are doing wrong. -c /etc/mail/spamassassin is the path to the directory. That is what you should use. I am not sure what SpamAssassin is using for its configuration. {^_^} - Original Message - From: Josef Karliak karl...@ajetaci.cz To: jdow j...@earthlink.net

Re: short pharma spam shoots straight through

2010-08-16 Thread Benny Pedersen
On man 16 aug 2010 22:05:25 CEST, Jason Haar wrote http://pastebin.com/W6wXq4RX match on ru tld with a score of 10 and then whitelist specifik ru domains that does not spam with a score of -10 that will neotralize scores for ham from ru domains there was a spam that included the words my new

Re: short pharma spam shoots straight through

2010-08-16 Thread Benny Pedersen
On man 16 aug 2010 23:28:00 CEST, Jason Haar wrote I was really just expecting to hear yeah, me too responses. :-( me too why care of new ru domains ?, blacklist the tld and whitelist ones that do not spam, maybe meta it with sender domain or something that match on that domain, i newer

Updating spam signatures file

2010-08-16 Thread Jerry M
I see that there's an update bat file available to refresh the spam signature file. Is that only a manual process (to update)? Or is there an auto-update capability built into spamassassin? If it is manual, what is the recommend procedure? Just log on to the server when spam starts

Re: Updating spam signatures file

2010-08-16 Thread John Hardin
On Mon, 16 Aug 2010, Jerry M wrote: I see that there's an update bat file available to refresh the spam signature file. Is that only a manual process (to update)? Or is there an auto-update capability built into spamassassin? Yes, it's called sa-update, and you should be running it daily

Re: short pharma spam shoots straight through

2010-08-16 Thread John Hardin
On Tue, 17 Aug 2010, Jason Haar wrote: I didn't give more examples because there is no pattern. I've been writing our own rules (based on the Subject or body) for weeks and they never trigger as the sentences don't show up again. The .ru thing isn't an option - those URLs are different too -

RE: Updating spam signatures file

2010-08-16 Thread Suhag P Desai
I gone through http://wiki.apache.org/spamassassin/RuleUpdates Below is my version.. SpamAssassin Server version 3.2.5 running on Perl 5.8.8 with SSL support (IO::Socket::SSL 1.31) with zlib support (Compress::Zlib 2.024) I have two directories.. under /var/lib/spamassassin 3.002005

mkdir error in lint

2010-08-16 Thread Mark Chaney
When run lint, im getting the following error: Aug 16 21:47:16.112 [4457] dbg: config: mkdir /var/www/.spamassassin failed: mkdir /var/www/.spamassassin: Permission denied at /usr/share/perl5/Mail/SpamAssassin.pm line 1853 Though i have no idea what its for and why it would be trying to

Re: Updating spam signatures file

2010-08-16 Thread Matt Kettler
On 8/16/2010 10:19 PM, Suhag P Desai wrote: I gone throughhttp://wiki.apache.org/spamassassin/RuleUpdates Below is my version.. SpamAssassin Server version 3.2.5 running on Perl 5.8.8 with SSL support (IO::Socket::SSL 1.31) with zlib support (Compress::Zlib 2.024) I have two

RE: Updating spam signatures file

2010-08-16 Thread John Hardin
On Tue, 17 Aug 2010, Suhag P Desai wrote: I gone through http://wiki.apache.org/spamassassin/RuleUpdates Below is my version.. SpamAssassin Server version 3.2.5 running on Perl 5.8.8 with SSL support (IO::Socket::SSL 1.31) with zlib support (Compress::Zlib 2.024) I have two directories..

Re: short pharma spam shoots straight through

2010-08-16 Thread Jason Haar
On 08/17/2010 01:04 PM, John Hardin wrote: You might consider implementing spamhaus zen as an MTA-level hard reject DNSBL (I do that, maybe that's why I don't see any pharma spam?) - many admins trust it enough to do that, and the sample you posted hit on the abuseat CBL, which is a zen

Re: short pharma spam shoots straight through

2010-08-16 Thread Rob McEwen
Jason Haar wrote: On 08/17/2010 01:04 PM, John Hardin wrote: You might consider implementing spamhaus zen as an MTA-level hard reject DNSBL (I do that, maybe that's why I don't see any pharma spam?) - many admins trust it enough to do that, and the sample you posted hit on the abuseat

Installing spamd as a Windows service?

2010-08-16 Thread Jerry M
I can't seem to find any documentation on how to install spamd as a Windows service. I found something about getting something called NTRunner. But that appears to be obsolete. The link is dead. I've just got spamd running in a command line window. But I need it to be a service. I

Re: Installing spamd as a Windows service?

2010-08-16 Thread Ted Mittelstaedt
Microsoft has instructions for this: http://support.microsoft.com/kb/137890 They are for win nt4 and win 2000 but they work on server 2003 (and vista) if you get the tools off the server 2003 resource kit You can also use the programs off the server 2003 reskit under server 2008, well at least