Re: Spam with tons of lines with garbage characters, preceded by

2017-07-21 Thread Andrzej A. Filip
David B Funk wrote: > On Thu, 20 Jul 2017, Andrzej A. Filip wrote: > >> By default messages bigger than 500KB are not sent to spamd for >> processing/scanning => the tactics you describe frequently "turns off" >> spam filtering. >> >> IMHO SA s

Re: Spam with tons of lines with garbage characters, preceded by

2017-07-19 Thread Andrzej A. Filip
Mark London wrote: > Hi - Sorry if this has been discussed before. I'm seeing a lot of > html spam with a few links, followed by a line that just contains >

Re: reason why sendmail w/ SA3.4.1 scantime=15.0, delay=00:01:06 w/ SquirrelMail?

2017-07-13 Thread Andrzej A. Filip
Robert Kudyba wrote: > n*5s delay *may* indicate unresponsive DNS host(s)/resolver(s) in /etc/hots > [ at least it should be ruled out ] > > Nah both are university DNS servers that are current. > > How long does it take to get SMTP greeting message when you start > "/usr/sbin/sendmail -bs" a

Re: reason why sendmail w/ SA3.4.1 scantime=15.0, delay=00:01:06 w/ SquirrelMail?

2017-07-13 Thread Andrzej A. Filip
Robert Kudyba wrote: > Over the past few days sending mail via SquirrelMail has become glacial. The > load on the server is under 1. I've restarted the SA, sendmail and dovecot > processes several times. Here are > some logs I can provide any settings if desired. > > Jul 13 23:03:24 storm sendma

Re: WashPost: US says global spam scheme targeted after mastermind nabbed

2017-04-13 Thread Andrzej A. Filip
"Kevin A. McGrail" wrote: > https://www.washingtonpost.com/business/technology/alleged-russian-hacker-arrested-in-spain-at-us-request/2017/04/10/3e4830e6-1dd9-11e7-bb59-a74ccaf1d02f_story.html?utm_term=.cc6e6c5d10c7 > > > Regards, > KAM Americans are unable to spam without Russian help, aren't th

Re: Different bayes results from command line and through MTA

2016-12-23 Thread Andrzej A. Filip
Sebastian Arcus wrote: > On 23/12/16 10:12, Sebastian Arcus wrote: >> I know this hot potato has been discussed before - but I'm afraid it's >> back to haunt me and I can't fathom it out. I'm getting again different >> bayes results if I test a message on the command line, compared to it >> going

Re: procmail

2014-10-28 Thread Andrzej A. Filip
"David F. Skoll" wrote: > On Mon, 27 Oct 2014 23:50:20 -0700 > Ian Zimmerman wrote: > >> Or you could run dovecot and its sieve plugin. Sieve is a real standard >> (RFC 5228) which procmail never was. > > It may be a standard, but it's nowhere near as flexible as Perl. I have very > unusual fil

Re: Reporting to SpamCop [wish: option to use port 25 instead of default 587]

2013-11-16 Thread Andrzej A. Filip
On 11/16/2013 01:34 PM, RW wrote: > On Sat, 16 Nov 2013 14:14:21 +0200 > Jari Fredriksson wrote: > >> >> My current ISP seems to block my attempts to send reports to SpamCop >> from SpamAssassin ---report. >> >> Which port does it send to? If 25, can we use submission as an >> alternate? > > It a

Re: Rule 'TVD_FROM_1' causing all our emails' spam scores go up

2013-05-19 Thread Andrzej A. Filip
On 05/17/2013 06:08 PM, David F. Skoll wrote: > On Fri, 17 May 2013 17:58:48 +0200 > Axb wrote: > > [Re domain name ends with digits] > >> my LOUD +1 to remove/disable this rule for good. >> anybody else? > > Yes, +1. Rules like this and the 12-char-domain rule > are much too dangerous. IMHO

Re: Dev-nulling is a bad idea [Was: Verifying .procmailrc settings to delete high scoring spam messages]

2013-04-22 Thread Andrzej A. Filip
On 04/22/2013 03:27 PM, Thomas Cameron wrote: > On 04/08/2013 03:52 AM, Andrzej A. Filip wrote: >> On 04/08/2013 05:12 AM, Thomas Cameron wrote: >>> [...] >>> I want to delete any spam that scores over 10, though. I believe that I >>> should insert a new rule

Dev-nulling is a bad idea [Was: Verifying .procmailrc settings to delete high scoring spam messages]

2013-04-08 Thread Andrzej A. Filip
On 04/08/2013 05:12 AM, Thomas Cameron wrote: > [...] > I want to delete any spam that scores over 10, though. I believe that I > should insert a new rule between the first and second, and I want to use > the X-Spam-Level header. But since it uses asterisks, which are > interpreted as regex wildcar

Re: [sa-list] Re: Supporting spamcop "quick" reporting

2013-02-19 Thread Andrzej A. Filip
On 02/19/2013 10:29 PM, Dan Mahoney, System Admin wrote: > On Tue, 19 Feb 2013, Andrzej A. Filip wrote: > >> On 02/19/2013 08:53 PM, Dan Mahoney, System Admin wrote: >>> On Tue, 19 Feb 2013, Andrzej A. Filip wrote: >>> >>>> On 02/19/2013 03:47 AM, Dan

Re: [sa-list] Re: Supporting spamcop "quick" reporting

2013-02-19 Thread Andrzej A. Filip
On 02/19/2013 08:53 PM, Dan Mahoney, System Admin wrote: > On Tue, 19 Feb 2013, Andrzej A. Filip wrote: > >> On 02/19/2013 03:47 AM, Dan Mahoney, System Admin wrote: >>> Spamcop has an undocumented feature that they allow you (if they trust >>> you) to "quic

Re: Supporting spamcop "quick" reporting

2013-02-19 Thread Andrzej A. Filip
On 02/19/2013 03:47 AM, Dan Mahoney, System Admin wrote: > Spamcop has an undocumented feature that they allow you (if they trust > you) to "quick report" spam, where you send to a different mail address, > and it's reported instantly, without having to hit the web interface. > When you do this, yo

Re: Message not scanned- Size?

2012-12-04 Thread Andrzej A. Filip
On 12/03/2012 09:43 PM, David F. Skoll wrote: > On Mon, 3 Dec 2012 22:03:25 +0200 > Henrik K wrote: > >> On Mon, Dec 03, 2012 at 01:54:44PM -0500, Kevin A. McGrail wrote: > [Test loadavg in filtering decisions] > >> Seems kind of pointless. Have you actually measured how larger >> messages affect

Re: Greylisting (was Re: "Fairly-Secure" Anti-SPAM Gateway Using OpenBSD, Postfix, Amavisd-new, SpamAssassin, Razor and DCC ? Can I get your opinion?)

2012-11-29 Thread Andrzej A. Filip
On 11/29/2012 09:53 PM, David F. Skoll wrote: > On Thu, 29 Nov 2012 21:27:19 +0100 > "Andrzej A. Filip" wrote: > >> Do you treat "yahoo like" spam sources in the same way? > With respect to greylisting, of course. If a machine passes greylisting once, > i

Re: Greylisting (was Re: "Fairly-Secure" Anti-SPAM Gateway Using OpenBSD, Postfix, Amavisd-new, SpamAssassin, Razor and DCC ? Can I get your opinion?)

2012-11-29 Thread Andrzej A. Filip
On 11/29/2012 09:31 PM, Dave Warren wrote: > On 11/29/2012 12:27, Andrzej A. Filip wrote: >> On 11/29/2012 08:46 PM, David F. Skoll wrote: >>> [...] >>> Also, once a given IP passes greylisting, we remember that and we don't >>> greylist that server for

Re: Greylisting (was Re: "Fairly-Secure" Anti-SPAM Gateway Using OpenBSD, Postfix, Amavisd-new, SpamAssassin, Razor and DCC ? Can I get your opinion?)

2012-11-29 Thread Andrzej A. Filip
On 11/29/2012 08:46 PM, David F. Skoll wrote: > [...] > Also, once a given IP passes greylisting, we remember that and we don't > greylist that server for 40 days. If you have a large-enough user population, > this can greatly mitigate the problems caused by initial greylisting delays. Do you trea

Re: Spamassassin and SPF records with "+all" [learning per domain worth of SPF record]

2012-07-12 Thread Andrzej A. Filip
On 07/12/2012 09:01 AM, David F. Skoll wrote: > On Thu, 12 Jul 2012 08:50:59 +0200 > Robert Schetterer wrote: > >> spf does not solve spam problems in general, its may only one from >> many parameters for spam tagging check > Indeed. I *never* subtract points for an SPF "pass" except for a very >

Re: [sendmail,milter,ident] Could not retrieve sendmail macro "_"!. Please add it to confMILTER_MACROS_CONNECT for better spamassassin results

2012-06-03 Thread Andrzej A. Filip
On 06/03/2012 11:44 PM, Thomas Cameron wrote: > I am getting $SUBJECT on my RHEL6 box running sendmail, spamassassin, > spamass-milter, clamav-milter, and milter-greylist. My sendmail.mc > looks like this: > > [root@spamcatcher ~]# grep -v "^dnl" /etc/mail/sendmail.mc > [] > define(`confTO_IDEN

Re: Canonicalizing text parts to UTF-8 before applying body rules

2012-05-31 Thread Andrzej A. Filip
On 05/29/2012 09:58 PM, David F. Skoll wrote: > This idea is growing out of a thread I started in which someone pointed me > to https://issues.apache.org/SpamAssassin/show_bug.cgi?id=3062 > > Ignoring the locale under which SA runs and also ignoring the character > encoding of the message can make