Re: 'hair' spam

2013-06-22 Thread John Hardin
On Sat, 22 Jun 2013, Jonathan Nichols wrote: What kind of worries me are the low hayes scores. I've been feeding fairly consistent message after message. If it never leaves BAYES_50 then the training isn't being properly done. Are you sure you're training the bayes database that SA is using?

'hair' spam

2013-06-22 Thread Jonathan Nichols
I've been getting flooded with pump n dump spams for a particular stock symbol, and my feeble admin skills these days are making it difficult to slow. Been using mailspike, spam cop at the mta, and barracuda too. Here's a sample: http://pastebin.com/Y5q4QTnf What kind of worries me are the lo

Re: False negatives/positives on debian

2013-06-22 Thread Karsten Bräckelmann
On Sun, 2013-06-23 at 08:06 +1000, Robert S wrote: > Just to recap - at the moment I'm running dnsmasq on my local server. > My resolv.conf now looks like this: > > domain mydomain.com.au > search mydomain.com.au > nameserver 127.0.0.1 > nameserver 208.67.220.220 # OpenDNS > nameserver

Re: False negatives/positives on debian

2013-06-22 Thread Benny Pedersen
Robert S skrev den 2013-06-23 00:06: Hi. Just to recap - at the moment I'm running dnsmasq on my local server. My resolv.conf now looks like this: domain mydomain.com.au search mydomain.com.au nameserver 127.0.0.1 nameserver 208.67.220.220 # OpenDNS nameserver 208.67.222.222 # OpenD

Re: False negatives/positives on debian

2013-06-22 Thread Robert S
Hi. Just to recap - at the moment I'm running dnsmasq on my local server. My resolv.conf now looks like this: domain mydomain.com.au search mydomain.com.au nameserver 127.0.0.1 nameserver 208.67.220.220 # OpenDNS nameserver 208.67.222.222 # OpenDNS Things have been working OK on this

Re: False negatives/positives on debian

2013-06-22 Thread Benny Pedersen
Karsten Bräckelmann skrev den 2013-06-22 23:18: I'd argue the evidence provided in this thread suggests to stick to the first nameserver currently listed in your resolv.conf -- your own. how are you comming to that conclusion ? :) one nameserver in resolv.conf, no more no less, if more then

Re: False negatives/positives on debian

2013-06-22 Thread Karsten Bräckelmann
On Sat, 2013-06-22 at 22:34 +0100, RW wrote: > On Sat, 22 Jun 2013 23:18:24 +0200 Karsten Bräckelmann wrote: > > > > If these things are true then the last question is - is it safe to > > > use OpenDNS IP addresses in my resolv.conf (and hence the remainder > > > of my small network) or should I s

Re: False negatives/positives on debian

2013-06-22 Thread RW
On Sat, 22 Jun 2013 23:18:24 +0200 Karsten Bräckelmann wrote: > > If these things are true then the last question is - is it safe to > > use OpenDNS IP addresses in my resolv.conf (and hence the remainder > > of my small network) or should I stick to the addresses provided by > > my ISP? > > I'd

Re: False negatives/positives on debian

2013-06-22 Thread Karsten Bräckelmann
On Sun, 2013-06-23 at 06:52 +1000, Robert S wrote: > The OpenDNS website states "OpenDNS is the largest and most reliable > _recursive_ DNS service available ...". Presumably this explains why > my queries are not blocked when I use OpenDNS. Again, nope. The OpenDNS server will do the query -- th

Re: False negatives/positives on debian

2013-06-22 Thread Robert S
The OpenDNS website states "OpenDNS is the largest and most reliable _recursive_ DNS service available ...". Presumably this explains why my queries are not blocked when I use OpenDNS. Various discussions on the net state that typo correction causes problems on OpenDNS with SURBL/URIBL. However

Re: False negatives/positives on debian

2013-06-22 Thread Karsten Bräckelmann
On Sat, 2013-06-22 at 21:16 +1000, Robert S wrote: > I've eliminated this problem by using openDNS servers: Nope. You've eliminated the problem by dropping your ISP's DNS servers. SA uses the first listed nameserver, IIRC, which previously was your ISP's. By removing them, the third listed became

Re: False negatives/positives on debian

2013-06-22 Thread Dave Funk
On Sat, 22 Jun 2013, Robert S wrote: I've eliminated this problem by using openDNS servers: # cat /etc/resolv.conf domain mydomain.net.au search mydomain.net.au nameserver 192.168.0.33 #<--- My server IP nameserver 208.67.220.220 nameserver 208.67.222.222 Is this likely to hav

Re: Apache SpamAssassin 3.4.0 release candidate 2 - invitation to testers

2013-06-22 Thread Mark Martinec
On Saturday 22 June 2013 15:15:20 The Doctor wrote: > > So how can we test on such platform? > > 2) NetBSD, FreeBSD and OpenBSD are akin so some testers > might be available. It is regularly in use on FreeBSD (7.2, 8.2, and 9.1), it has been tested on OpenBSD 5.2, and some time ago on NetBSD (

Re: False negatives/positives on debian

2013-06-22 Thread John Hardin
On Sat, 22 Jun 2013, Robert S wrote: I've eliminated this problem by using openDNS servers: Is this likely to have untoward consequences? Yes. OpenDNS is potentially aggregating *more* traffic than your ISP does... -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/

Re: sa-learn

2013-06-22 Thread Matus UHLAR - fantomas
Matus UHLAR - fantomas skrev den 2013-06-22 15:02: I only recommend to use --forget for localy broken (misformatted) mail. That means, only if you know that mail can't be checked by SA and no matter what you have learnt it, it will spoil scoring. otherwise, learn as ham. On 22.06.13 15:31, Benn

Re: sa-learn

2013-06-22 Thread Benny Pedersen
Matus UHLAR - fantomas skrev den 2013-06-22 15:02: I only recommend to use --forget for localy broken (misformatted) mail. That means, only if you know that mail can't be checked by SA and no matter what you have learnt it, it will spoil scoring. otherwise, learn as ham. if --spam is used on c

Re: Apache SpamAssassin 3.4.0 release candidate 2 - invitation to testers

2013-06-22 Thread The Doctor
On Sat, Jun 22, 2013 at 11:41:38AM +0200, Mark Martinec wrote: > On Saturday 22 June 2013 07:06:43 The Doctor wrote: > > > Tweaking needed > > > Test Summary Report > > t/bayesdbm_flock.t (Wstat: 0 Tests: 48 Failed: 1) > > Failed test: 39 > > t/sa_check_spamd.t (Wstat

Re: sa-learn

2013-06-22 Thread Matus UHLAR - fantomas
Jari Fredriksson skrev den 2013-06-22 09:57: If that was news for you, then maybe it is too, that sa-learn --ham is also something we must do. Learning is not all spam. On 22.06.13 12:21, Benny Pedersen wrote: i tend to use --forget on ham mails :) I only recommend to use --forget for local

Re: False negatives/positives on debian

2013-06-22 Thread Axb
FTR: iirc, OpenDNS is also blocked from doing URIBL queries. the web is full of forum post regarding this so it may be best not to forward to them as your fallback. unbound or powerdns-recursor on a separate local box/VM/would be the safeest choice. It also spares you from potential third pa

Re: False negatives/positives on debian

2013-06-22 Thread Benny Pedersen
John Hardin skrev den 2013-06-22 06:45: If you're running dnsmasq locally, you should list it first so that you take advantage of its local cache and only fall back to direct queries of your ISP's servers if dnsmasq fails for some reason. that only hold water if /etc/resolv.conf does not conta

Re: False negatives/positives on debian

2013-06-22 Thread Benny Pedersen
Robert S skrev den 2013-06-22 06:14:   I only run a small business and I doubt that we'd be exceeding the URIBL quota. you need to change /etc/resolv.conf to nameserver 127.0.0.1 and use bind9 as local dns server that just have NONE forwards in options, and it must only listen on 127.0.0.1, w

Re: sa-learn

2013-06-22 Thread Benny Pedersen
Jari Fredriksson skrev den 2013-06-22 09:57: If that was news for you, then maybe it is too, that sa-learn --ham is also something we must do. Learning is not all spam. i tend to use --forget on ham mails :) -- senders that put my email into body content will deliver it to my own trashcan,

Re: Apache SpamAssassin 3.4.0 release candidate 2 - invitation to testers

2013-06-22 Thread Mark Martinec
On Saturday 22 June 2013 07:06:43 The Doctor wrote: > Tweaking needed > Test Summary Report > t/bayesdbm_flock.t (Wstat: 0 Tests: 48 Failed: 1) > Failed test: 39 > t/sa_check_spamd.t (Wstat: 0 Tests: 7 Failed: 5) > Failed tests: 1, 3-6 > t/spamc_B.t

Re: sa-learn

2013-06-22 Thread Jari Fredriksson
21.06.2013 16:06, emailitis.com kirjoitti: > Benny, > Regarding: > sa-learn --spam > /var/qmail/mailnames/hosted-domain.com/user-1/Maildir/.Spam/cur > thank you for the correction and the education. > > If that was news for you, then maybe it is too, that sa-learn --ham is also something we must d