from:"Ryan"

We use Amavisd-new (which works great) that calls SpamAssassin, and it 
then forwards it (via SMTP) to our real POP server. We also have a 
sendmail machine in front of Amavisd that calls DNSRBL's and Milter-Sender.

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
Jon Fraley wrote:
We use iPlanet for our email system and SA doesn't integrate well with
it.  I want to know if I can have a box in front of our mail server that
will use SA to scan the messages and then forward the messages to our
iplanet box. 

I just want to know if that is possible.  I have been told that SA must
be run on the email server.


---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] spam filtering friendly fire

Oh the Irony!

- Original Message - 
From: "Justin Mason" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, August 11, 2003 7:14 PM
Subject: [SAtalk] spam filtering friendly fire


Theo dropped us a line last night to note that sourceforge.net's spam
filters are blocking his mail for some unknown reason, so he may
be a bit quiet on the -talk and -devel lists as a result for a few
days. :(

(it looks like a bug in their filtering, but they're being slow to
respond.)

--j.


---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk




---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

[SAtalk] Blocking mail with the same From and To lines

I know Spamassassin has a test that checks to see if the from and to are 
similar, but it doesn't seem to be catching any of the spam that has a 
return-path/from header set to be the same as the To: line. Does anyone 
have some rule for spamassassin that could be put in local.cf to help 
prevent spam like this?



Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net


---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] exchange and IMAP Public Folder messages

Tony Hoyle wrote:

Try in OutlookSpy... if you view the Imessage and look for PR_INTERNET_CONTENT that
will contain the exact text of the original message.  If PR_INTERNET_CONTENT is 
missing the
original message is lost.
If that attribute is there it should be relatively trivial to write an app which can 
fetch
it and squirt it to the Linux server.
Tony

 

No luck with OutlookSpy.  The PR_INTERNET_CONTENT propery doesn't appear 
on any of the messages that have been dragged to the public folders.

Interesting tool though...

Ryan



---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] USER IN WHITELIST spammer scam

We get alot (well, used to) of spam that has forged from/return-path 
headers. Whitelisting like that isn't really the most effective really. 
One thing you could do is that if you have a DNSRBL system setup for 
internal use is that you could add the smtp servers that your users use 
to that DNSRBL and define another rbl test in your local.cf file that 
checks that zone and give any hits from that test a negative score, like 
the BONDED_SENDERS test.

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
Greg Webster wrote:
Thanks, it is. What I'm wondering now is how the local user's address is
in the Return-Path header. Unless the spammer is forging the Return-Path
header (making it the same as the recipient), in which case we can't
really trust the Return-Path header at all for whitelisting.
Greg

On Thu, 14 Aug 2003 15:10:13 -0400: Matt Kettler skribon:

At 10:58 AM 8/14/2003 -0700, Greg Webster wrote:

'[EMAIL PROTECTED]' is not in our whitelist, and neither is '[EMAIL PROTECTED]'
or any variant.
It appears that there is a problem with the USER_IN_WHITELIST regexp
to me, but I may be mistaken. I can't think of any other way that
this would have made it through. Help?
is [EMAIL PROTECTED] in your whitelist_from?

If so, then the rule properly matched the Return-Path header.



---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk



---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] exchange and IMAP Public Folder messages

Covington, Chris wrote:

Ryan, 
I've found that if mail is sent directly to a mail-enabled Public
Folder's email address, IE from amavisd-new or Postfix, its headers will
make it through with IMAP.  However, if an email is moved to or from a
Public Folder with Outlook (regardless of whether or not the public
folder is mail-enabled), then its headers get truncated.  So I can at
least train bayes by having any emails over my threshold of 6.0 get
redirected to [EMAIL PROTECTED] by amavisd-new and they show up in the SPAM
folder.  And I can sa-learn them.  Unfortunately that's about it
though...  Moving false positives to a Public HAM folder truncates
headers, as does false negatives getting moved to the SPAM folder.

I think bayes can still learn with incomplete headers, though it's not
ideal.  

I'm not sure how bayes can be used with Exchange without bypassing
Exchange completely in some way.  I'd like to see other people's
solutions to this problem (or maybe they just don't know about the
problem).  Maybe somebody can come up with IMAP client patch that can
retrieve the full headers, as they are actually retained by Outlook when
messages are moved to or from Public Folders, just not when IMAP is
used.
Chris
 

Thanks Chris.  It sounds like we are having the same problem.  Just to 
forestall the responses from people running Exchange 5.5: this does NOT 
seem to be a problem in 5.5 and most of the solutions I have seen posted 
to this list seem to work with Exchange 5.5.  This problem seems 
peculiar to Public Folders on Exchange 2000.

My main problem isn't so much with false positives (I forward all tagged 
spam to mboxes using MailScanner so I get the headers unmolested by 
Exchange), but with false negatives received by the end Outlook users.  
Once they drag them into the Public Folder, as you point out, the 
headers get truncated.  I've even resorted to trying to reconstruct the 
original message by copying what little header information Outlook gives 
and then exporting the message to Outlook Express to get the body 
source.  As you can imagine this is pretty time consuming and doesn't 
always reproduce the original message.

Why does Microsoft have to make everything so hard??  :-)

Ryan



---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] exchange and IMAP Public Folder messages

Tom Meunier wrote:

I don't know how you're doing this, but my Ham and Spam public folders work exactly as specified. Are you certain your users aren't forwarding them there, but rather dragging & dropping from Outlook? Are your users connecting to the server via IMAP or MAPI? (We don't use IMAP, so I can't duplicate that.

-tom

---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

On the Windows/Outlook side we use MAPI (full Outlook client) and we are
definitely dragging and dropping. Unfortunately, MAPI is not an option
on Linux which is where I need to get the messages to run sa-learn. Any
client I've used on Linux, POP or IMAP, GUI or command line, experiences
the same truncation problem with the headers connecting to Exchange 2000
Public Folders.

Even more frustrating, Windows IMAP and POP clients have the same header
problems with Public Folders, which makes it impossible to export the
full message source to a text file and tranfer it to a Linux box. And
the full Outlook MAPI client doesn't even give you the option to save
the full message source (you just get the View/Options peek at the headers).

Ryan

Re: [SAtalk] archives for seeding bayes?

2003-08-15 Thread Ryan Moore

In a way, yes. We have no users on our SA gateway as they are all in 
SQL. Now Spamassassin runs as a unix user (amavis in our case, since we 
are using amavisd), so when I initially filled the bayes DB I did it for 
the amavis user. You can also put a bayes_path directive in your 
local.cf so that all users on that box use the same bayes db (which 
would only really lets you run sa-learn as root/etc in this config, 
which I do since I'm lazy:).

Also with the auto learning of spam/ham in Spamassassin, the bayes db 
will be in a constant state of change, in that more recent spam (score 
greater than 15 by default) will have precedence and older entries will 
be expired from the database. This how I understand that it works at 
least, could be wrong though.

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
Ricardo Kleemann wrote:
Thanks.

I know SA can handle user prefs via SQL, but can it also
handle bayes learning from users in SQL?
What I mean is, my email users are in SQL, they are not
regular unix users, which means that there's no unix user
uniquely mapped for spamc to run as. So I'm stuck with using
a generic user, unless SA is capable of running with "sql
users" rather than "unix users".
I'm not looking to add user prefs, which I know already is
possible with sql. I'm looking for the ability to build
bayes databases for "sql users". Is that possible?
Ricardo

- Original Message Follows -

Trying to seed the Bayes databases with other people's
spam probably  isn't a good idea -- the whole idea is that
it learns what *your* ham  and spam look like.  Filling it
up with mail from other sources is  probably just going to
lead to innacurate results.
Ricardo Kleemann wrote:


I've trained my bayes database with about 12,000 spam and
7,000 ham messages, but I was wondering if there are much
larger archives available for seeding bayes?






---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

[SAtalk] rbl test hangs for osirusoft.com

2003-08-16 Thread Ryan Summers

Hello all:

I just built a new mail server using qmail + vpopmail and spamassassin to 
filter out spam.  The last mail server I built using this same configuration 
didn't have any trouble with spamassassin.  After I installed spamassassin 
and the necessary perl modules, I ran some tests and noticed that the spamc 
process took a very long time to return (25-35 seconds).  After running 
spamd in a separate shell with debugging turned on, I noticed that the 
process seems to hang everytime it runs the RCVD_IN_OSIRUSOFT_COM test.  
Knowing little about this particular blacklist, I would guess that their rbl 
server is down.

Is there any way to run off individual rbl tests in spamassassin?  I have 
never came across this topic before...

Thanks in advance!

Ryan Summers

_
The new MSN 8: advanced junk mail protection and 2 months FREE*  
http://join.msn.com/?page=features/junkmail



---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] rbl test hangs for osirusoft.com

2003-08-16 Thread Ryan Moore

Appears to be working here doing a manual test. I think setting the 
score to 0 disables the test, which you can do in your local.cf.

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net


~$ dig 2.0.0.127.relays.osirusoft.com

; <<>> DiG 9.2.1 <<>> 2.0.0.127.relays.osirusoft.com
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22989
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 2, ADDITIONAL: 0
;; QUESTION SECTION:
;2.0.0.127.relays.osirusoft.com.IN  A
;; ANSWER SECTION:
2.0.0.127.relays.osirusoft.com. 43200 IN A  127.0.0.4
2.0.0.127.relays.osirusoft.com. 43200 IN A  127.0.0.9
2.0.0.127.relays.osirusoft.com. 43200 IN A  127.0.0.3
;; AUTHORITY SECTION:
relays.osirusoft.com.   43200   IN  NS  ns2-relays.osirusoft.com.
relays.osirusoft.com.   43200   IN  NS  ns1-relays.osirusoft.com.
Ryan Summers wrote:
Hello all:

I just built a new mail server using qmail + vpopmail and spamassassin 
to filter out spam.  The last mail server I built using this same 
configuration didn't have any trouble with spamassassin.  After I 
installed spamassassin and the necessary perl modules, I ran some tests 
and noticed that the spamc process took a very long time to return 
(25-35 seconds).  After running spamd in a separate shell with debugging 
turned on, I noticed that the process seems to hang everytime it runs 
the RCVD_IN_OSIRUSOFT_COM test.  Knowing little about this particular 
blacklist, I would guess that their rbl server is down.

Is there any way to run off individual rbl tests in spamassassin?  I 
have never came across this topic before...

Thanks in advance!

Ryan Summers



---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] How can i connect to remote mysql db?

2003-08-22 Thread Ryan Moore

You would need to enter the following info in your local.cf:

user_scores_dsn   DBI:mysql:$databasename:$databasehost
user_scores_sql_username  $sadb_user
user_scores_sql_password  $sabd_pwd
user_scores_sql_table $tablename
You would need to enter your info for the the variables starting with $.

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
swapna ghosh wrote:
Hi
 
  i have sent one email asking for - that i am unable to connect mysql 
database
from my server. The database is under a different host but is 
*spamassassin* is
trying to connect only the database at the local server?
 
Here is again i am giving the snapshot of the log file for first few 
lines...
___
Aug 22 10:42:07 domain spamd[7250]: logmsg: server started on port 783 
(running
version 2.55)
Aug 22 10:42:07 domain spamd[7250]: server started on port 783 (running 
version
2.55)
Aug 22 10:42:07 domain spamd[7250]: logmsg: connection from localhost 
[127.0.0.1
] at port 2446
Aug 22 10:42:07 domain spamd[7250]: connection from localhost 
[127.0.0.1] at por
t 2446
Aug 22 10:42:07 domain spamd[7250]: logmsg: connection from localhost 
[127.0.0.1
] at port 2447
Aug 22 10:42:07 domain spamd[7250]: connection from localhost 
[127.0.0.1] at por
t 2447
Aug 22 10:42:07 domain spamd[7287]: debug: No DSN defined; skipping sql
Aug 22 10:42:07 domain spamd[7292]: debug: No DSN defined; skipping sql
Aug 22 10:42:07 domain spamd[7250]: logmsg: connection from localhost 
[127.0.0.1
] at port 2449
Aug 22 10:42:07 domain spamd[7250]: connection from localhost 
[127.0.0.1] at por
t 2449
_
Pl. help me out - if if tries to connect to local db server then how can
i connect a remote server?
 
Thanks in advance
-Swapna





---
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple operating systems on a single machine.
WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines
at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

[SAtalk] Spam using invalid Mime headers to bypass SpamAssassin?

2003-08-25 Thread Ryan Moore

I got an email that made it by spamassassin with virtually no hits, 
which looks like it used some wierd mime technique to get through 
spamassassin. I put the source of the email at 
http://h0b0.net/brokenmime.txt. I also edited the message and put some 
simple mime headers in it and passed it through spamassassin and it got 
7.7 hits, I put the source of that at http://h0b0.net/fixedmime.txt.

Is it valid to specify a different boundary in the mime header (when not 
attaching a rfc822 source message)? This message did that it appears, 
though I'm no mime expert so I'm not sure if that is a valid thing to do 
or not. In any case, is this a bug of some sort with SpamAssassin?

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net


---
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple operating systems on a single machine.
WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines
at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] Spam using invalid Mime headers to bypass SpamAssassin?

Using version 2.55 , thought it was in the headers, oops. It is in the 
header of the second message since I manually inserted those headers 
after editing the message and piping it through the spamassassin binary 
(as opposed to resending the message through Amavisd-new using 
Mail::SpamAssassin perl module).

Hopefully the mime parser in 2.60 is able to dig into the nested parts.

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
Bart Schaefer wrote:
On Mon, 25 Aug 2003, Ryan Moore wrote:
 
I got an email that made it by spamassassin with virtually no hits, 
which looks like it used some wierd mime technique to get through 
spamassassin.  [...]

Is it valid to specify a different boundary in the mime header (when not 
attaching a rfc822 source message)?


The sample is a well-formed nested multipart.  I know SA had problems
descending into nested parts in the past, but I've lost track of the
status.  What version are you using?  Can someone say whether this is
still a problem in 2.60?
It's stretching the semantics of multipart/related a bit to make the first
part be multipart/alternative, because the intent is that announcing the
type of the first part of the m/r allows the user agent to decide how to
render the content -- which the UA can't do without lookahead if the first
part is another multipart.  However, it isn't actually invalid AFAICT.




---
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple operating systems on a single machine.
WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines
at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] Re: Spam using invalid Mime headers to bypass SpamAssassin?

There is alot there for SA to trigger on, as noticed in the headers for 
the fixedmime.txt which yields expected results, however the original 
one only had one hit, which tells me that SA was unable to parse the 
HTML part of the message. Problem is that over the past two days, we've 
gotten half a dozen of these on one account. Guess I'll give 2.60 a try 
and see how it handles these.

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
Fuzzy Fox wrote:
Ryan Moore <[EMAIL PROTECTED]> wrote:

I got an email that made it by spamassassin with virtually no hits,
which looks like it used some wierd mime technique to get through
spamassassin.  I put the source of the email at
http://h0b0.net/brokenmime.txt.


I don't see anything broken about the MIME structure.  My mailer (Mutt)
had no trouble discerning the structure and showing me the message.  A
glance through the raw message shows that the structure is a bit more
than you'll find in a typical message, but there is nothing underhanded
about it.
I'm not sure why you thought this message should score highly, as there
is very little to trigger of SA's rules.  The text plain part simply
say:
don't wait
01743594368
Jim
while the text/html part simply says:

[IMG]
[IMG]
Hey Jim sounds good zdmhK
Go FcP Wish you were here kqIPn
There is very little for any of SA's rules to trigger on, very little
for any Bayes tokenization to use.  The message is short, and I'd
consider it basically an "image-only" type of spam, which SA is not
likely to ever detect as spam, unless there is some corroborating evidence
in the headers.
--

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net


---
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple operating systems on a single machine.
WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines
at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] RFC-ignorant usage?

You can implement any DNSBL via the following in your local.cf:

header $SOMETESTNAME   rbleval:check_rbl('$SOMETESTCLASS', '$SOMETESTZONE.')
describe $SOMETESTNAME Received via a relay in $SOMETESTNAME
tflags $SOMETESTNAME   net
score $SOMETESTNAME $SOMESCORE
That should be four lines in total (MUA wrapped it I think). The 
variables starting with $ should be edited for whatever zone you want to 
use.



Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
Fred I-IS.COM wrote:
Is it possible to use the dsn listing from RFC-ignorant.org?
This RTBL is meant to check the From line of the e-mail, to check if the 
sender is RFC ignorant.
 
Are these types of DNSBL tests possible with SpamAssassin?
 
zone = dsn.rfc-ignorant.org
 
 From their website:

  How to Use Domain-Based Blacklist Zones

General Concepts

If someone presents you with:

MAIL FROM: <[EMAIL PROTECTED]>

then you should do a lookup on example.tld.dsn.rfc-ignorant.org, and 
bounce or reject as you see fit.

 
Is this possible in 2.55 or 2.60?
 

Frederic Tarasevicius
Internet Information Services, Inc.
http://www.i-is.com/
810-794-4400
mailto:[EMAIL PROTECTED]
 
 




---
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple operating systems on a single machine.
WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines
at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] Re: Spam using invalid Mime headers to bypass SpamAssassin?

As an addendum, it appears as if SA 2.60-rc2 is able to parse the 
message. Hooray!

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
Ryan Moore wrote:
There is alot there for SA to trigger on, as noticed in the headers for 
the fixedmime.txt which yields expected results, however the original 
one only had one hit, which tells me that SA was unable to parse the 
HTML part of the message. Problem is that over the past two days, we've 
gotten half a dozen of these on one account. Guess I'll give 2.60 a try 
and see how it handles these.

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
Fuzzy Fox wrote:

Ryan Moore <[EMAIL PROTECTED]> wrote:

I got an email that made it by spamassassin with virtually no hits,
which looks like it used some wierd mime technique to get through
spamassassin.  I put the source of the email at
http://h0b0.net/brokenmime.txt.


I don't see anything broken about the MIME structure.  My mailer (Mutt)
had no trouble discerning the structure and showing me the message.  A
glance through the raw message shows that the structure is a bit more
than you'll find in a typical message, but there is nothing underhanded
about it.
I'm not sure why you thought this message should score highly, as there
is very little to trigger of SA's rules.  The text plain part simply
say:
don't wait
01743594368
Jim
while the text/html part simply says:

[IMG]
[IMG]
Hey Jim sounds good zdmhK
Go FcP Wish you were here kqIPn
There is very little for any of SA's rules to trigger on, very little
for any Bayes tokenization to use.  The message is short, and I'd
consider it basically an "image-only" type of spam, which SA is not
likely to ever detect as spam, unless there is some corroborating 
evidence
in the headers.



---
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] exchange and IMAP Public Folder messages

2003-08-31 Thread Ryan Bingham

Did anyone ever figure out a fix for this on Exchange 2000? It will be a 
while before I can migrate to 2003.

To recap: the problem involves retrieving intact headers from messages 
moved to Public Folders on Exchange 2000.

Thanks,

Ryan

-Original Message-
From: Covington, Chris [mailto:[EMAIL PROTECTED] 
Sent: Wednesday, August 13, 2003 12:39 PM
To: Bingham, Ryan; Tom Meunier; Martin Bene
Cc: [EMAIL PROTECTED]
Subject: RE: [SAtalk] exchange and IMAP Public Folder messages

Guys,

FYI I have upgrade to Exchange 2003 and there is no longer a problem
with full headers being retrieved by IMAP, even if some messages are
"posts" in the public folders and others are "notes."  And also,
PR_INTERNET_CONTENT still disappears on messages moved to the public
folders, but it doesn't affect the IMAP headers.
Chris
 





---
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

RE: [SAtalk] exchange and IMAP Public Folder messages

2003-08-31 Thread Bingham, Ryan

Did anyone ever figure out a fix for this on Exchange 2000?  It will be
a while before I can migrate to 2003.

Thanks,

Ryan

-Original Message-
From: Covington, Chris [mailto:[EMAIL PROTECTED] 
Sent: Wednesday, August 13, 2003 12:39 PM
To: Bingham, Ryan; Tom Meunier; Martin Bene
Cc: [EMAIL PROTECTED]
Subject: RE: [SAtalk] exchange and IMAP Public Folder messages

Guys,

FYI I have upgrade to Exchange 2003 and there is no longer a problem
with full headers being retrieved by IMAP, even if some messages are
"posts" in the public folders and others are "notes."  And also,
PR_INTERNET_CONTENT still disappears on messages moved to the public
folders, but it doesn't affect the IMAP headers.

Chris


---
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] How to identify attachments with PIF extensions?

2003-09-01 Thread Ryan Bingham

MailScanner has built-in filetype and file extension filters.  It also 
supports multiple anti-virus engines and uses SpamAssassin for spam 
protection

Best of all, it's easy to set up!

www.mailscanner.info

Ryan

Bob Apthorpe wrote:

Hi,

On Mon, 01 Sep 2003 14:19:32 +0530 "BG Mahesh" <[EMAIL PROTECTED]>
wrote:
 

I want to add a rule to assign higher points if the email has an
attachment with PIF extension. How do I do that? [I am using
SA-2.55+procmail]
   

To solve the general problem of email-borne malware, you might filter
mail through Anomy Sanitizer; see http://mailtools.anomy.net/ You can
run this from procmail or within your MTA, which is one advantage it has
over MIMEDefang (a good tool but it's Sendmail-specific.)
Anomy Sanitizer breaks malicious attachments (.pif, .scr, certain HTML,
etc), neutralizing whatever junk was sent to you. It also tags
content it has sanitized, making it easier to write SA custom rules to
flag malware. I'd probably just move sanitized content to a virus folder
and not process it by SA, but you could pass it to SA if you wanted.
-- Bob

---
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
 





---
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

RE: [SAtalk] What the F****??

2003-09-12 Thread Bingham, Ryan

Going forward, would it be possible to have a configuration option that
allows you to take Bayes scores into account when autolearning?

-Original Message-
From: Matt Kettler [mailto:[EMAIL PROTECTED] 
Sent: Friday, September 12, 2003 12:49 AM
To: Larry Rosenman; [EMAIL PROTECTED]
Subject: Re: [SAtalk] What the F??

At 10:36 PM 9/11/03 -0500, Larry Rosenman wrote:
>a SPAM message being learned as HAM?
>
>
>X-Spam-Flag: YES
>X-Spam-Checker-Version: SpamAssassin 2.60-rc4 (1.203-2003-08-29-exp) on
> lerami.lerctr.org
>X-Spam-Level: *
>X-Spam-Status: Yes, hits=5.5 required=5.0 tests=BAYES_99,HTML_MESSAGE
> autolearn=ham version=2.60-rc4
>MIME-Version: 1.0

What's your autolearn threshold set to? Is it greater than 0.2?

Remember that autolearning is done based on the score as if there was NO

BAYES involved.

Thus the bayes_99 goes away. This will VERY significantly reduce the
score 
of this particular message. The only rule left has a very small score:

score HTML_MESSAGE 0.160 0.001 0.100 0.100

So, poof, autlearned as ham, even though bayes_99 made it tag by adding 
another 5.4 points to it.




---
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk


---
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] RD - Here is a rule to check for Verisign redirect domain

2003-09-17 Thread Ryan Moore

It depends on how the round-robin is setup. In the case of 
www.yahoo.com, the client gets multiple IPs back and picks one (at 
random I assume). The DNS server can only respond with one IP and just 
rotate through the list as the queries come in. I'm pretty sure you can 
setup BIND to do it either way, don't remember exactly how to offhand 
though.

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
Jon Gabrielson wrote:
Nope, it returns them all on my box.
i.e. when i type "nslookup www.yahoo.com" i get about 20 ip addresses.
So presumably, looking up a garbage address should also work
even with round-robin.
Jon.

On Wednesday 17 September 2003 01:18 pm, Daniel Quinlan wrote:

Jon Gabrielson <[EMAIL PROTECTED]> writes:

The correct way to do this is not "nslookup sitefinder.verisign.com",
but rather "nslookup www.safsdafdsfadsfsdafadsfdsaf.com" or some other
garbage address.  If you program spamassassin to do this, you can
easily keep up with any ip changes that might happen.
That only works until Verisign sets up DNS round robin.

Daniel




---
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] Amavis-New, PostFix, SA, MAILTO_TO_SPAM_ADDR

2003-09-17 Thread Ryan Moore

You would insert:

"score $TESTNAME 0"

into your local.cf to disable the test. Though that one test is fairly 
low scoring, it would barely be enough to bring it under your threshold. 
You might want to check why messages are getting caught by the RBL's, it 
seems almost as if it is checking for localhost, but I wouldn't think 
that SA wouldn't query for 127.0.0.1 since that will hit a few rbl zones 
that include it for some reason (when they should be including 127.0.0.2 
or something).

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
John wrote:
I am running Amavis-New, Postfix, SpamAssassin 2.60 4

I have a webmail system running from the same box. 
Scanning the messages sent from the webmail system is
alright but I just found a false positive..

X-Spam-Status: Yes, hits=6.9 tag1=3.0 tag2=6.3 kill=6.3
tests=HTML_30_40,  HTML_MESSAGE, HTML_MIME_NO_HTML_TAG,
MAILTO_TO_SPAM_ADDR, MIME_HTML_ONLY,  RCVD_IN_DYNABLOCK,
RCVD_IN_NJABL, RCVD_IN_NJABL_DIALUP, RCVD_IN_SORBS
X-Spam-Level: **
I don't really care about people emailing to known spam
addresses (at least that is what I am assuming with the
test MAILTO_TO_SPAM_ADDR).
1) Does anyone know any negative drawback to disabling
that test?
2) To disable the test, just edit the
/etc/mail/spamassassin/local.cf file and insert
"MAILTO_TO_SPAM_ADDR 0"?
Thank you.




---
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] Monitoring which Rules are being used...

As far as I know, Amavisd-new doesn't support the inclusion of 
individual test's scores. I wish it did, since I use it (amavisd-new) as 
well, but it works *very* well otherwise.  However the syslog file (for 
the mail facility) will have all the tests that every email amavisd 
see's, so you could parse through that and do what you will, we do some 
parsing of the file and stick data into a database for our users. That 
is assuming you are logging to syslog, which I think is the default for 
amavis and I'm pretty sure that is configurable within amavisd.

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
Steve Brorens wrote:
SA is doing a superb job in my gateways config (with amavisd-new and
clamav), but I'd like to get a better feel for the relative effects of
the various rules - in particular BAYES_*, AWL, my 'custom local.cf
rules', RCVD_IN_BL_SPAMCOP, AWL...
 - My logs now show the TotalHits and the RulesInvolved - but not the
individual effects
 - The admin notification summary gives all the detail, but as
individual mail items.
I suspect there's a way to configure so as to create a log file that's
easy to analyse - I'm just not sure what that way is!
Any tips? Are others doing this?

 - steve



---
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] 2.60 and Dynamic IP Checks

By default SA will check the 9 previous hosts listed in the RECEIVED 
headers. You could lower that by using "num_check_received" directive in 
your usr_prefs/local.cf, I currently use a setting of four.

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
David L. Crow wrote:
First, thanks so much for Spamassassin.  It works so well!

I received an email with the following Received headers:

Received: from ms-smtp-02.texas.rr.com (ms-smtp-02.texas.rr.com
  [24.93.36.230]) by waterloo.OrangeBlood.org (8.12.8/8.12.8)
  with ESMTP id h8NDa2UW031261 for <[EMAIL PROTECTED]>;
  Tue, 23 Sep 2003 08:36:02 -0500
Received: from 448xc01 (cs2439-220.austin.rr.com [24.243.9.220])
  by ms-smtp-02.texas.rr.com (8.12.5/8.12.2) with SMTP id
  h8NDZk8V029596; Tue, 23 Sep 2003 08:35:47 -0500 (CDT)
And the scoring system provided:

3.5 RCVD_IN_NJABL_DIALUP   RBL: NJABL: dialup sender did non-local
   SMTP [24.243.9.220 listed in
   dnsbl.njabl.org]
2.6 RCVD_IN_DYNABLOCK  RBL: Sent directly from dynamic IP
   address [Dynamic/Residential IP range
   listed by] [easynet.nl DynaBlock -
 <http://dynablock.easynet.nl/errors.html>]
0.1 RCVD_IN_NJABL  RBL: Received via a relay in
   dnsbl.njabl.org [24.243.9.220 listed in
   dnsbl.njabl.org]
The mail was sent from a "dynamic host" directly to the appropriate ISP 
SMTP server using "Outlook Express 6.00.2800.1158" and then delivered to 
my host.  Should this message really have been marked as coming from a 
dynamic host?  Can/should the first Received: header be ignored?



---
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] 2.60 and Dynamic IP Checks

Doh, I remember looking in the perldoc and thinking "ok it isn't in the 
deprecated section", obviously I was wrong since it actually is. Is 
there another config option that would perform the same behavior or has 
that functionality been lost in 2.60?

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
Daniel Quinlan wrote:
Ryan Moore <[EMAIL PROTECTED]> writes:


By default SA will check the 9 previous hosts listed in the RECEIVED 
headers. You could lower that by using "num_check_received" directive in 
your usr_prefs/local.cf, I currently use a setting of four.


"num_check_received" is a deprecated setting in 2.60 and doesn't
actually apply here.
David, can you create a bug at bugzilla.spamassassin.org.  After
creating the bug, attach (not cut-and-paste) an example message (you can
edit out the body if you need to, but it must include the full headers)
to the bug.
Also include your local.cf and user_prefs files.

Daniel



---
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] why is sa not catching the microsoft emails ?

Is there a size limit that SA implements to avoid scanning huge messages 
whose content is primarily binary? I know amavisd has a limit such as 
that, but I'm not sure if spamassassin has one as well or not.

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
Stephen Reese wrote:
h, i still don't understand why SA is not even looking at them
though see's everything else?
-Original Message-
From: Daniel Kaliel [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, September 23, 2003 5:59 PM
To: Stephen Reese; [EMAIL PROTECTED]
Subject: RE: [SAtalk] why is sa not catching the microsoft emails ?

I am getting nailed with these as well, 72 for the day so far.  Other
admins I talked here have had over 100 so far on the day.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of
Stephen Reese
Sent: September 23, 2003 3:29 PM
To: [EMAIL PROTECTED]
Subject: [SAtalk] why is sa not catching the microsoft emails ?
I've been getting tons of this mail usually with virus's attached. I am
also getting messages that seem to orginate from our own server but they
don't.
I am running sa 2.6, redhat 7.3, courier 0.43.0

The following is a header from one of the messages:

Delivered-To: [EMAIL PROTECTED]
Return-Path: <[EMAIL PROTECTED]>
Received: from smtp04.nauticom.net (smtp04-pix.nauticom.net
[:::209.195.133.7])
  by prcdigital.com with esmtp; Tue, 23 Sep 2003 17:16:35 -0400
Received: from ulgmxx (104.np13.np.dialup.nauticom.net
[209.195.143.104])
by smtp04.nauticom.net (8.12.9/8.12.9) with SMTP id
h8NKfCdF061535;
Tue, 23 Sep 2003 16:41:14 -0400 (EDT)
Date: Tue, 23 Sep 2003 16:41:12 -0400 (EDT)
Message-Id: <[EMAIL PROTECTED]>
FROM: "MS Corporation Technical Services"
<[EMAIL PROTECTED]>
TO: "Customer" <[EMAIL PROTECTED]>
SUBJECT: New Network Critical Pack
Content-Type: multipart/mixed;
boundary="MIMEStream=_0+28469_34507359171605_72511450908"


As you may notice there is no sa attempt, but the following is what
occurs with the rest of my messages:


Delivered-To: [EMAIL PROTECTED]
Return-Path: <[EMAIL PROTECTED]>
Received: from sc8-sf-list2.sourceforge.net (lists.sourceforge.net
[:::66.35.250.206])
  (TLS: TLSv1/SSLv3,168bits,DES-CBC3-SHA)
  by prcdigital.com with esmtp; Tue, 23 Sep 2003 16:58:02 -0400
Received: from sc8-sf-list1-b.sourceforge.net ([10.3.1.13]
helo=sc8-sf-list1.sourceforge.net)
by sc8-sf-list2.sourceforge.net with esmtp (Exim 3.31-VA-mm2 #1
(Debian))
id 1A1uEU-0006fG-00
for <[EMAIL PROTECTED]>; Tue, 23 Sep 2003 13:58:02 -0700
Date: Tue, 23 Sep 2003 13:57:26 -0700
Subject: Spamassassin-talk -- confirmation of subscription -- request
786688
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Reply-To: [EMAIL PROTECTED]
X-Ack: no
Sender: [EMAIL PROTECTED]
Errors-To: [EMAIL PROTECTED]
X-BeenThere: [EMAIL PROTECTED]
X-Mailman-Version: 2.0.9-sf.net
Precedence: bulk
List-Help:
<mailto:[EMAIL PROTECTED]>
List-Post: <mailto:[EMAIL PROTECTED]>
List-Subscribe:
<https://lists.sourceforge.net/lists/listinfo/spamassassin-talk>,
<mailto:[EMAIL PROTECTED]
e>
List-Id: Talk about SpamAssassin

List-Unsubscribe:
<https://lists.sourceforge.net/lists/listinfo/spamassassin-talk>,
<mailto:[EMAIL PROTECTED]
ibe>
List-Archive:
<http://sourceforge.net/mailarchive/forum.php?forum=spamassassin-talk>
Message-Id: <[EMAIL PROTECTED]>
X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on
prcserver.prcdigital.com
X-Spam-Status: No, hits=0.3 required=5.0 tests=NO_REAL_NAME autolearn=no
version=2.60
X-Spam-Level:


Stephen Reese
Systems Administrator



---
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] RCVD_IN_DYNABLOCK problem

2003-09-24 Thread Ryan Moore

If there are recieved-from headers from the recipient's mail system, 
then they may get checked in the rbl's depending on how deep they are. 
The recipient can use the 'trusted_networks' option that was added in 
2.60 to get around that problem. I don't have the start of the thread on 
the machine I'm writing this from so hopefully I understood what was 
going on ;]

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
Terry Milnes wrote:
But you are missing the point, mail is being identified as 
RCVD_IN_DYNABLOCK when it is the recipient who is in the dial up block, 
not the sender.

The sender is on the rogers network using aloak smtp/pop3 servers, 
sending a message to a domain that is in the dial up block.

The message should NOT be tagged as RCVD_IN_DYNABLOCK because the 
"received from" is from aloak.

I thought I might have a problem explaining this, take a look at the 
headers I supplied, a real close look and you should be able to see what 
I mean.

As for the Rogers Network, there is a problem there as well, they sell 
commercial accounts that did not have these restrictions you mention, 
yet over the last few weeks these commercial accounts are being treated 
the same as the residential.  I am calling them tomorrow about this 
issue, it costs three times as much for the commercial services, 
hopefully their policies haven't changed.

Thanks for the response btw.

Terry



---
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] RCVD_IN_DYNABLOCK problem

2003-09-25 Thread Ryan Moore

I guess I'm either confused or a little too tired, but I'm not seeing a 
problem with what is happening. The IP 65.48.80.27 is listed in the 
dynablock list, so when the receiving system parses through the
headers it checks that IP in the various RBLs and gets a match on that one.

In any case, as Gerry mentioned your daughter will want to use her isp's 
smtp server instead of sending directly into your system, as it sounds 
like that is what is happening. Or you can use the trusted_networks option

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
Terry Milnes wrote:
Ryan,

Ok here are the two headers again, both messages originated from the 
same computer, smtp server in outlook express is set up to use aloak.ca 
(which is not in a dialup block).

The only difference besides content is the recipient address, the only 
difference in content was they also contained recipient addresses...  I 
ran this a dozen times to make sure it wasn't an isolated case, and was 
incluing the recipient address in the content for fater reference.

Terry...

HEADER FROM RCVD_IN_DYNABLOCK MESSAGE-

 From - Wed Sep 24 14:06:52 2003
X-UIDL: 1064426808.23355_0.london.interface.on.ca
X-Mozilla-Status: 0001
X-Mozilla-Status2: 
Return-Path: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
Received: (qmail 23349 invoked from network); 24 Sep 2003 18:06:46 -
Received: from igloo.aloak.ca (216.220.38.195)
  by london.interface.on.ca with SMTP; 24 Sep 2003 18:06:46 -
Received: (qmail 26040 invoked by uid 1); 24 Sep 2003 18:06:37 -
Received: from unknown (HELO neetas) (65.48.80.27)
  by igloo.aloak.ca with SMTP; 24 Sep 2003 18:06:37 -
Message-ID: <[EMAIL PROTECTED]>
From: "Anita Milnes" <[EMAIL PROTECTED]>
To: "Dad" <[EMAIL PROTECTED]>
Subject: test 13
Date: Wed, 24 Sep 2003 14:08:04 -0400
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="=_NextPart_000_0062_01C382A5.45E02CC0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
X-Spam-Checker-Version: SpamAssassin 2.60-rc6-interface_1.3
(1.208-2003-09-19-exp) on london.interface.on.ca
X-Spam-Status: No, hits=2.7 required=4.0 tests=HTML_70_80,HTML_MESSAGE,
RCVD_IN_DYNABLOCK autolearn=no version=2.60-rc6-interface_1.3
X-Spam-Level: **
--

 HEADER FROM MESSAGE THAT APPEARS CORRECT -

 From - Wed Sep 24 14:24:40 2003
X-UIDL: 1064427870.23568_0.london.interface.on.ca
X-Mozilla-Status: 0001
X-Mozilla-Status2: 
Return-Path: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
Received: (qmail 23562 invoked from network); 24 Sep 2003 18:24:28 -
Received: from qanuk.aloak.ca (216.220.38.194)
  by london.interface.on.ca with SMTP; 24 Sep 2003 18:24:28 -
Received: from igloo.aloak.ca (igloo [216.220.38.195])
by qanuk.aloak.ca (8.12.9/8.12.2) with SMTP id h8OIOJRj009321
for <[EMAIL PROTECTED]>; Wed, 24 Sep 2003 14:24:19 -0400
Received: (qmail 32404 invoked by uid 1); 24 Sep 2003 18:24:18 -
Received: from unknown (HELO neetas) (65.48.80.27)
  by igloo.aloak.ca with SMTP; 24 Sep 2003 18:24:18 -
Message-ID: <[EMAIL PROTECTED]>
From: "Anita Milnes" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject: test 14
Date: Wed, 24 Sep 2003 14:25:44 -0400
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="=_NextPart_000_006B_01C382A7.BD61FA10"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
X-Spam-Checker-Version: SpamAssassin 2.60-rc6-interface_1.3
(1.208-2003-09-19-exp) on london.interface.on.ca
X-Spam-Status: No, hits=0.1 required=4.0 tests=HTML_70_80,HTML_MESSAGE
autolearn=no version=2.60-rc6-interface_1.3
X-Spam-Level:


Ryan Moore wrote:

If there are recieved-from headers from the recipient's mail system, 
then they may get checked in the rbl's depending on how deep they are. 
The recipient can use the 'trusted_networks' option that was added in 
2.60 to get around that problem. I don't have the start of the thread 
on the machine I'm writing this from so hopefully I understood what 
was going on ;]

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
Terry Milnes wrote:

But you are missing the point, mail is being identified as 
RCVD_IN_DYNABLOCK when it is the recipient who is in the dial up 
block, not the sender.

The sender is on the rogers network using aloak smtp/pop3 servers, 
sending a message to a domain that is in the dial up block.

The message should NOT be tagged as RCVD_IN_DYNABLOCK because the 
"received from&quo

Re: [SAtalk] Sendmail error help...

2003-09-25 Thread Ryan Moore

If your server is taking an abnormal amount of time to display the SMTP 
banner (the first 220 line), then the remote end might close the 
connection before issuing any commands.

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
Matt Chapman wrote:
sendmail[2427]: h8PG5C9C002427: smtpout.mac.com [17.250.248.97] did not
issue MAIL/EXPN/VRFY/ETRN during connection to MTA
This is showing up all the time.  This is me at my .mac account trying
to send to my domain which is relayed via my
sendmail/mimedefang/spamassassin config.  Mail works well except for a
few domains like mac.com, att.com bellsouth.com etc...
Any ideas.  I have read that this is because the sending server did not
issue the full command needed???  Is it a sendmail.mc config issue?
Any help would be great...

Matt Chapman




---
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] Bayes

2003-10-01 Thread Ryan Bingham

Bart Schaefer wrote:

On Mon, 29 Sep 2003, Jack Gostl wrote:

 

That new Bayes algorithm is mighty touchy. So far its tagged four real
messages with a BAYES_99, three of them today alone. In just five days
it has had twice the false positives that 2.55 had in four months.
   

I noticed similar behavior when I upgraded from 2.55 and kept the old 
Bayes database.  Since that time, I've deleted the old db and started 
from scratch on 2.60.

The Bayes scores have been dead accurate since then (no fp's due to 
Bayes).  If you have the luxury of getting rid of the old Bayes db I 
would recommend it.

Ryan



---
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] Highest Score

2003-10-03 Thread Ryan Moore

Highest I've got is a 75.8, but that was with SA 2.55 and with a few RBL 
scores set to 2.5 or 3.0 in local.cf (still would have been right around 
 70 with defaults though)

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
Scott Rothgaber wrote:
Mike Carlson wrote:

what is the highest scoring anyone has seen SA give a
message? I had one come through at 37.54 the other day.


Sorry to bust your bubble, but I see those several times per day.  ;-) I 
have even seen a few with scores in the low 40s.




---
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] yahoo redirect

2003-10-24 Thread Ryan Moore

Looks like YAHOO_REDIR looks for "http://rd.yahoo.com";, adding the "s" 
into the hostname threw it off ;\

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
Colin A. Bartlett wrote:
Can anyone hazard a guess as to why a message with an image and several
links in this fashion did not match the test YAHOO_REDIR...
http://srd.yahoo.com/drst/accomplished/*http://www.grestccd.com/k.jpg";>
An image-only spam like this slipped through my SA with only these tests
matched:
  BAYES_44
  HTML_FONT_INVISIBLE
  HTML_IMAGE_ONLY_02
  HTML_MESSAGE
  MIME_HTML_ONLY
  MSGID_FROM_MTA_HEADER
  RCVD_IN_RFCI
cheers,
Colin
Colin A. Bartlett
Kinetic Web Solutions
www.kineticweb.biz




---
This SF.net email is sponsored by: The SF.net Donation Program.
Do you like what SourceForge.net is doing for the Open
Source Community?  Make a contribution, and help us add new
features and functionality. Click here: http://sourceforge.net/donate/
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

RE: [SAtalk] sa-learn on messages from outlook/exchange

2003-05-29 Thread Bingham, Ryan


I think there maybe be problems with the public folder solution in Exchange 2000.  
While it appears to work under Exchange 5.5, in Exchange 2000 it seems that all mail 
stored in public folders and accessed through IMAP or POP loses a lot of its header 
information, at least in my experience.  I seem to recall other people reporting the 
same problem on this list.  Has anyone else seen this?

Thanks,

Ryan

> -Original Message-
> From: Louis Bohm [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, May 28, 2003 3:48 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [SAtalk] sa-learn on messages from outlook/exchange
> 
> Can one of the SA developers please respond to this and give a definit
> "Yes it can/No it cannot be done" answer.
> 
> I currently have a mailbox containing 2 SPAM mails that were not
> marked as such and about 1000 HAMS marked as spam.  Can I really just
> pump them into SA with out causing any problems??
> 
> Thanks,
> Louis
> 
> On Wed, 2003-05-28 at 15:15, Stewart, John wrote:
> > > Please correct me if I am wrong.  But I thought I saw a
> > > posting a while
> > > back (when 2.50 came out) that doing what you are doing would
> > > shift the
> > > balance of the Bayes DB toward one side or another.  I
> > > remember someone
> > > clearly stating that you need an equal amount of SPAM and HAM to do
> > > this.
> >
> > Well, in practice I found it worked quite well. We did the public folder
> > thing on our Exchange server.
> >
> > However, I had to disable Bayes because SA 2.55 won't stop trying to
> expire,
> > causing amavisd-new to time out, ad infinitum. Apparently there is no
> way to
> > stop SA from opportunistically expiring, nor is there any way to force
> an
> > expire with sa-learn!
> > And SA *sucks* without bayes. =(
> >
> > johnS
> --
> -
> --
> ---
> ¤¤º°`°º¤ø,¸¸,ø¤º°`°º¤øø¤º°`°º¤ø,¸¸,ø¤º°`°º¤øø¤º°`°º¤
> ¤°`°Lightbridge, Inc
> ¤°`°67 South Bedford St.
> ¤°`°Burlington MA 01802
> ¤°`°781.359.4795 mailto:[EMAIL PROTECTED]
> ¤°`°http://www.lightbridge.com
> ¤¤º°`°º¤ø,¸¸,ø¤º°`°º¤øø¤º°`°º¤ø,¸¸,ø¤º°`°º¤øø¤º°`°º¤
> 
> NHY޵隊X'u᡼z~'zࠫg+Ვ,wk(miuڮiv&\otw$ou^୽u
> jf,{ZIXX*Z,j"ᥞ֥X(Ჺ~zw孆i࠳lᬲq

zleX)ߣ)jf,ᡊ{Z
N¬HY޵隊X¬²'²Þu¼¬zÚ~'z«¢¦g§µú+ë,¢wk(m¶ÿi×ڮiv&©ì\¢oÚw÷$ÿ½u×^½ï¯u딩jf¬±«,{ZIX§X¬µ*Z«,jË"֥X¬¶Ë(º·~àzwÛi³ÿåËl²«qçè®§zßåËlþX¬¶)ߣû)jf¬±«,{Z

Re: [SAtalk] (no subject)

2003-06-04 Thread Ryan Bingham

Didn't this (and all the subsequent flames) just happen?  Like several times
already in the recent past??

Anyone ever see Groundhog Day?  I'm startin to get wigged out...

Ryan


- Original Message -
From: Marge Golomb
To: [EMAIL PROTECTED]
Sent: Tuesday, June 03, 2003 9:17 PM
Subject: [SAtalk] (no subject)


I do not want spamassassin - I called my ISP and they do not subscribe to
you.  I emailed them and they know nothing about you.  I found you on my
computer, deleted you, and 3 days later you are back again.  I want you off
my computer - if I want my email checked, I will check it myself!  Let me
know how to get rid of you ASAP!

Thank you



---
This SF.net email is sponsored by:  Etnus, makers of TotalView, The best
thread debugger on the planet. Designed with thread debugging features
you've never dreamed of, try TotalView 6 free at www.etnus.com.
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

RE: [SAtalk] OT: SCO may have violated GNU

2003-06-11 Thread Bingham, Ryan

Open-source strikes back:

http://www.eweek.com/article2/0,3959,1123172,00.asp

Let's hope there's some merit to this.

Ryan 

-Original Message-
From: Kristian Koehntopp [mailto:[EMAIL PROTECTED] 
Sent: Wednesday, June 11, 2003 12:10 PM
To: [EMAIL PROTECTED]
Subject: [SAtalk] LDAP Storage instead of SQL Storage


Has anybody written a ConfSourceLDAP.pm analogue to ConfSourceSQL.pm? I
am
looking for a solution that stores SpamAssassin Preferences within an
LDAP
store.

Kristian


---
This SF.NET email is sponsored by: eBay
Great deals on office technology -- on eBay now! Click here:
http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk


---
This SF.NET email is sponsored by: eBay
Great deals on office technology -- on eBay now! Click here:
http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: SA in Mailshield by Lyris / (was) Re: [SAtalk] OT: SCO may have violated GNU

2003-06-12 Thread Ryan Bingham

Haha.  I love how these threads evolve.  SCO dropped out of this
conversation like after the first post.

Now, QED, SCO violated GNU!

Excellent.

Ryan

- Original Message -
From: "Stuart Gall" <[EMAIL PROTECTED]>
To: "Greg A" <[EMAIL PROTECTED]>;
<[EMAIL PROTECTED]>
Sent: Thursday, June 12, 2003 4:36 PM
Subject: Re: SA in Mailshield by Lyris / (was) Re: [SAtalk] OT: SCO may have
violated GNU


- Original Message -
From: "Greg A" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, June 12, 2003 6:59 PM
Subject: SA in Mailshield by Lyris / (was) Re: [SAtalk] OT: SCO may have
violated GNU


> The way I read the license was that you can not sell SA software. You can
only charge for duplication fees, installation or maintenance but not for
the software or customized versions derived from it. I could be wrong, I am
not a lawyer...
>

There are a number of open source licenses
GNU definitely would not allow the above scineario, but GPL (the now lesser
GNU) does.
SA is licensed under the perl artistic license. or GNU

It is a bit of a paradox because the GNU is quite strict on what can be done
commercially, but perl artistic is very lax.

I conclude that SCO definitely violated GNU but not perl artistic and hence
not the licence of SA.



Stuart Gall
Systems Administrator

-
Critical Error: REALITY.SYS Corrupted! Reboot universe? (y/n) [y]:




---
This SF.NET email is sponsored by: eBay
Great deals on office technology -- on eBay now! Click here:
http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk




---
This SF.NET email is sponsored by: eBay
Great deals on office technology -- on eBay now! Click here:
http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] Is there a way to filter mail that's forwarded?

2003-06-18 Thread Ryan Nelson

> From: Peter Campion-Bye <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Date: 6/18/2003 11:34:50 AM
> Subject: Re: [SAtalk] Is there a way to filter mail that's forwarded?
>
> > Hi all.  Trying to use my home mail server to filter my dad's mail for
> > spam.  What I'm doing is I'm pulling it in off of his netzero account
(oh
> > yeah, spam heaven) and it's supposed to be filtered as it goes through
my
> > server and off to the dumping account I have setup for delivering all
mail
> > after it's been filtered.  Only problem is, it's not being filtered. 
It's
> > being pulled in with fetchmail, handed off to sendmail, and immediately
> > forwarded off to the dumpng account with no filtering being applied at
> > all.
> >
> > Does anyone know a creative way around this?  I want it to filter the
> > mail
> > on my end before it's fowarded off to his dumping account so as to block
> > all viruses and spam coming into his account.  Any help is Much
> > appreciated.
>
> I achieve this using procmail, you would need to set up a .procmailrc file
> in his home directory with a recipe to filter his mail through
> spamassassin before delivering it.
> HTH


i do something similar to what you're trying, namely, fetchmail off of
several accounts, and then spamassassinate it before delivering it to my
final clean mailbox.

so, it's   fetchmail --> procmail --> mbox

I don't let fetchmail deliver via smtp to the localhost, i use procmail
directly as the mail delivery agent.

here's my recipe:
in my fetchmailrc after everything else, i have this line:
mda 'formail -s /usr/bin/procmail -m /home/me/.procmailrc'
...this splits the input into individual messages, and runs them through my
procmail ruleset.

then, in my .procmailrc i have:
   :0fw
   | /usr/local/bin/spamc -t45 -s 9  

(these options might differ for you... if you're not using spamd/spamc ,
you could just pipe directly to /usr/local/bin/spamassassin )
later on in my .procmailrc, i have:

   :0 ^X-Spam-Status: Yes
   /home/me/mail/spam

   :0
   * ^From:
  {
 :0 c
 ! [EMAIL PROTECTED]

 :0
 /home/me/mail/local-copy-of-cleanmailbox
   }

so, procmail runs it through spamassassin, then puts spam in the spambox,
forwards a copy of what's left to the pop-mailbox that i check for real,
and keeps a copy in my local mbox.

hope this helps...

ryan



---
This SF.Net email is sponsored by: INetU
Attention Web Developers & Consultants: Become An INetU Hosting Partner.
Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

[SAtalk] OT- "greylisting" - opinions from the SA community?

2003-06-21 Thread Ryan Bingham




I apologize to anyone if this has been brought up 
before, but I'd be curious to get some opinions on the concept of "greylisting" 
as a spamfighting tool.  To summarize, it involves initially rejecting an 
SMTP session from an unknown source in the expection that a valid SMTP host will 
try again a short time later while a spamming host will not.
 
Here's a link to a fuller treatment:
 
http://projects.puremagic.com/greylisting/
 
Ryan

RE: [SAtalk] Public folders, IMAP

2003-06-22 Thread Bingham, Ryan

Mark,

This sounds great; thanks for posting the script.  One question: does
this method preserve the message headers?  I've had a lot of problems
keeping the headers intact with Exchange 2000/Public Folders/IMAP.

Ryan

-Original Message-
From: Mark Motley [mailto:[EMAIL PROTECTED] 
Sent: Saturday, June 21, 2003 4:27 PM
To: Marek Dohojda
Cc: [EMAIL PROTECTED]
Subject: RE: [SAtalk] Public folders, IMAP

Yes.  I've written a simple Perl script to pull all the ham/spam off of
an Exchange 2000 server via IMAP and run sa-learn on them.  

Basically, users drag/drop spam and ham to a shared Public Folder and
this script connects via IMAP and pulls those down to sequential files
in a directory.  Finally, sa-learn is run against those in --dir mode.

I have two scripts, pullspam and pullham, that only differ in the
directory where they pull the ham/spam and the Public Folder path.  The
pullham script is included below.

It requires Mail::IMAPClient module from CPAN.

Although I've used it against an Exchange 2000 server, I don't see why
one couldn't modify it for another IMAP implementation.  I've used this
on my Exchange server for about 2 months now and it works great.

Note the locations where you will need to change things...

--- cut here 

#!/usr/bin/perl

use Mail::IMAPClient;
use Sys::Syslog;

# You may need to change the Public Folders path to suit your server 
my $FOLDER_NAME = 'Public Folders/Spam Filter Teaching/Ham'; 
my $SEQ = 1; openlog('pullham','cons,pid', 'user');

my $server = Mail::IMAPClient->new(
Server => "",
User => "",
Password => "",
Uid => 1,
Debug => 0 );

$server->select($FOLDER_NAME);
my @msgs = $server->search("ALL");
foreach my $msg (@msgs) {
$server->message_to_file("/var/spam/ham/" . $SEQ,$msg);
$server->delete_message($msg);
$SEQ++;
};
$server->expunge($FOLDER_NAME);
print "Pulled ". ($SEQ-1) . " messages from ham folder.\n"; 
syslog('mail|info', 'Pulled '.($SEQ-1) . ' messages from ham folder.');


 that's all 

-Original Message-
From: Marek Dohojda [mailto:[EMAIL PROTECTED] 
Sent: Friday, June 20, 2003 3:58 PM
To: [EMAIL PROTECTED]
Subject: [SAtalk] Public folders, IMAP

Hello everyone

I hope this questions hasn't been asked before.  If so, me sorry :)

As most of you know Outlook doesn't forward headers when you forward an
e-mail (and with newer Outlook 2002+, you can't even resend with headers
intact).  Therefore Outlook is a bad tool in traning SA.

Unfortuantely I don't have a choice, Outlook and exchange is a must for
me. 

Therefore I have an idea, of allowing users to put their spam in a
public folder.  Then a text IMAP client would grab this and put it in a
folder on the SA server.  Then just do the sa-learn and bingo.. Spam
learn.

My question is.. Has anybody tried this? If so what tools worked for
you.  I am looking for a text based IMAP client that can see into public
folders, and transfer files within it.

Thank you!!

This correspondence is considered confidential and any reproduction for
the purpose of public disclosure is forbidden without written permission
by the author signed above. If you are not the intended recipient,
please immediately notify the sender and delete any copies.


---
This SF.Net email is sponsored by: INetU
Attention Web Developers & Consultants: Become An INetU Hosting Partner.
Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php
___
Spamassassin-talk mailing list [EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk


---
This SF.Net email is sponsored by: INetU
Attention Web Developers & Consultants: Become An INetU Hosting Partner.
Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk


---
This SF.Net email is sponsored by: INetU
Attention Web Developers & Consultants: Become An INetU Hosting Partner.
Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

RE: [SAtalk] Spam got score -80.6 - Spamassassin 2.55

2003-06-22 Thread Bingham, Ryan

Check the first two lines of the header:

Return-path: <[EMAIL PROTECTED]>
Received: from router ([192.168.1.8])

It looks like it was able to spoof amazon.com, which would explain why
it got whitelisted.  If I'm reading this correctly, the first hop was to
an internal router (probably with its own fake DNS entry for amazon.com)
which allowed the original host to pretend to be amazon.com.

Does this look correct?

Ryan

-Original Message-
From: Simon Byrnand [mailto:[EMAIL PROTECTED] 
Sent: Sunday, June 22, 2003 8:16 PM
To: Bernd Kuhls; [EMAIL PROTECTED]
Subject: Re: [SAtalk] Spam got score -80.6 - Spamassassin 2.55

At 00:41 23/06/03 +0200, Bernd Kuhls wrote:
>Hi,
>
>got this nice baby:
>
>Greetings, Bernd

[snip]

Just wondering, how exactly does posting a copy of that message to this 
list help anyone ?

a) There is no indication of what version of SpamAssassin processed the 
message, its not even obvious that it is even SpamAssassin

b) There is no X-Spam-Status header, so we can't see what tests
triggered 
and what didn't

c) The score of -80.6 suggests that it triggered the USER_IN_WHITELIST
rule 
which has a score of -100, but because of a lack of further information
its 
impossible to know...

Regards,
Simon

---
This SF.Net email is sponsored by: INetU
Attention Web Developers & Consultants: Become An INetU Hosting Partner.
Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

---
This SF.Net email is sponsored by: INetU
Attention Web Developers & Consultants: Become An INetU Hosting Partner.
Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

RE: [SAtalk] Spammers sneaking lower Bayes scores

2003-06-26 Thread Bingham, Ryan

I can't believe we're even debating this!

As my old boss would say, anyone who has enough free time on their hands
to worry about this kind of stuff needs a project!

I for one don't care what it's called.  I'm more focused on keeping it
out of my users' mailboxes.

Ryan

-Original Message-
From: Tony Earnshaw [mailto:[EMAIL PROTECTED] 
Sent: Thursday, June 26, 2003 8:33 AM
To: Daniel Quinlan
Cc: Greg A; Mike Batchelor; [EMAIL PROTECTED]
Subject: Re: [SAtalk] Spammers sneaking lower Bayes scores

Daniel Quinlan wrote:

>>Ham=good wanted email
>>Spam=bad unwanted email
> 
> Those are not the generally accepted definitions and definitely not
the
> ones used by us.
> 
>   spam = unsolicited bulk/commercial email
>   ham  = everything else

You are the language expert amongst the developers. It is best to be 
politically correct nowadays. Complaints have been made by the Jewish, 
kosher (not yet by the Muslim, halal) community who would rather not see

such words in common use.

I use the terms "spam" and "non-spam," myself, as far as SA goes. Though

atheist, I would rather not use the term "ham," since I see no reason 
to. There is a perfectly viable alternative (non-spam.) When I buy ??? 
from my local butcher, I simply point at it and do the rest in sign 
language, in order not to offend any possible customers within earshot.

Could we have an alternative to "spam?"

Best,

Tony

-- 
Tony Earnshaw

Humor him, and he'll go away again

http://j-walk.com/blog/docs/conference.htm
http://www.billy.demon.nl
Mail: [EMAIL PROTECTED]

---
This SF.Net email is sponsored by: INetU
Attention Web Developers & Consultants: Become An INetU Hosting Partner.
Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

---
This SF.Net email is sponsored by: INetU
Attention Web Developers & Consultants: Become An INetU Hosting Partner.
Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] Spamassassin Report generation??

2003-07-03 Thread Ryan Bingham

My recommendation would be to use MailScanner (http://www.mailscanner.info)
to call SpamAssassin, and then use MailWatch for MailScanner
(http://www.smf.f2s.com/mailscanner/) to generate your reports (it
conveniently logs all MailScanner traffic to a MySQL database).

MailScanner is very easy to install and operate and has an excellent mailing
list for support (the developer -- Julian Field -- usually answers questions
within a few hours of posting).

Let me know if you have any questions; I'd be happy to help.

Ryan

- Original Message -
From: "Tony Earnshaw" <[EMAIL PROTECTED]>
To: "Eric Sandquist" <[EMAIL PROTECTED]>
Cc: <[EMAIL PROTECTED]>;
<[EMAIL PROTECTED]>
Sent: Thursday, July 03, 2003 3:34 PM
Subject: Re: [SAtalk] Spamassassin Report generation??


Eric Sandquist wrote:

> I am looking for something that will generate reports, with or without
> graphics.
>
> I need something that will collect the number of spam caught per day, per
> week, and per month. and generate a report.  This tool should be able to
> keep a history from past reports.  Something that uses a MySQL database
for
> data storage of the information would be great.

Not with MySQL, but read on ...

> Also, if possible, collecting the top 5-10 spam messages caught in a given
> time period would be nice, but just a perk.

No perks.

> Does anyone know of nay tools that do this for spamassassin?

> I am using spamassassin via procmail, and amavis-ng with clamav for virus
> filtering.  So far this configuration with postfix has worked well with
300
> users.

Well, the amavis is all over, by then. Anyway, if you don't get choked
with trying to install stuff your system can't cope with (the following
does most of what you want for me - but on RH7.2 + I had to keep on
inventing things:)

http://people.ee.ethz.ch/~dws/software/mailgraph/

Best,

Tony

--
Tony Earnshaw

Humor him and he'll go away

http://j-walk.com/blog/docs/conference.htm
http://www.billy.demon.nl
Mail: [EMAIL PROTECTED]



---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa0016ave/direct;at.asp_061203_01/01
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk




---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa0016ave/direct;at.asp_061203_01/01
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] Anti-virus suggestions requested

2003-07-10 Thread Ryan Bingham

I second the recommendation for MailScanner.  We use it
in conjunction with Sophos here (with great results), and MailScanner
can use any number of anti-virus engines -- including clamAV -- and can 
use multiple scan engines at the same time.  It also integrates with
SpamAssassin and has a host of other useful features.

Definitely the best out there.

Just my two cents.

Ryan

Rick Macdougall wrote:

Steve Thomas wrote:

Doh! I misread the original mail. I thought he was looking for a 
scanning mechanism, not the scanner itself.

Revised recommendation:

MailScanner and Sophos. :)


I replied to him off list cause I thought it was OT, but I'll repost 
my recommendation here just for fun.

Since he was already using a milter for scanning, I recommended he try 
clamAV and the sendmail milter for it.

Regards,

Rick



---
This SF.Net email sponsored by: Parasoft
Error proof Web apps, automate testing & more.
Download & eval WebKing and get a free book.
www.parasoft.com/bulletproofapps
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk






---
This SF.Net email sponsored by: Parasoft
Error proof Web apps, automate testing & more.
Download & eval WebKing and get a free book.
www.parasoft.com/bulletproofapps1
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

[SAtalk] SA and Razor

2003-07-18 Thread Ryan Lumsden

Hi

Simple quiestion, does Razor2 work with RA 2.20

R


---
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple operating systems on a single machine.
WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the
same time. Free trial click here: http://www.vmware.com/wl/offer/345/0
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] SA and Razor

2003-07-18 Thread Ryan Lumsden

On Friday 18 July 2003 15:46, you wrote:

Oh really, thats good to know, I am upgrading now then.

Thanks for the input 

R


> At 11:32 AM 7/18/03 +0200, Ryan Lumsden wrote:
> >Hi
> >
> >Simple quiestion, does Razor2 work with RA 2.20
>
> I doubt it, but a better point would be that nobody should be using SA 2.2x
> unless they are GAing their own scoreset on a regular basis...



---
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple operating systems on a single machine.
WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the
same time. Free trial click here: http://www.vmware.com/wl/offer/345/0
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] exchange and IMAP Public Folder messages

Tony Hoyle wrote:

If you can write some software to fetch it, the original text of the email is stored
in exchange 2000 (not 5.5, which always reconstructs the text from its MAPI 
information).
I had a play with it and you can retrieve the original email in a lot of cases, but
in (seemingly random) instances it'll ditch the text when copying between folders.
Tony
 

Tony (or anyone else in the know),

Could you post more details about how you were able to handle the 
headers problem in Exchange 2000?  I have had the same problems as Chris 
extracting meaningful header information from Exchange 2000 Public 
Folders.  E2K basically makes a mess of them (and I've tried all manner 
of methods and clients) and renders the messages meaningless for 
teaching Bayes.

Any help is greatly appreciated!

Ryan



---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] user_prefs configuration

We use amavisd-new with SQL preferences with user policies setup so that 
the user can specify if they want mail to be rejected/tagged. The hard 
part was writing the php interface to allow the user to change their 
preferences. All of our users are virtual though, they only exist in 
sql, so it was pretty easy to setup.

Ryan Moore
--
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
Scott Fraser wrote:
Good Morning Folks,
Well, after fighting with it longer than I care to admit, I do 
believe  I now have a working Postfix/SpamAssassin/Amavisd system. What 
I am  trying to do now, is configure the system wide (and eventually on 
a per  user basis) a way to bounce mail. Currently email that is spam is 
just  flagged. Our president wants to bounce it.

Here is the configuration I currently have:
/etc/mail/spamassassin/local.cf
 This is the right place to customize your installation of SpamAssassin.
# See 'perldoc Mail::SpamAssassin::Conf' for details of what can be
# tweaked.
#
 
###
#
#rewrite_subject 0
#report_safe 1

#whitelist_from [EMAIL PROTECTED]  # whitelist for mentoring.ws
whitelist_from  *securityfocus.com
rewrite_subject 1

report_safe 0
use_terse_report 1
use_bayes 1
bayes_path /var/amavisd/.spamassassin/bayes
auto_learn 1
skip_rbl_checks 1
use_razor2 1
use_dcc 1
use_pyzor 0
dcc_add_header 1
dns_available yes

header LOCAL_RCVD Received =~ /\S+\.domain\.com\s+\ (.*\[ .*\]\)/
describe LOCAL_RCVD Received from local machine
score LOCAL_RCVD -50
## Optional Score Increases
score DCC_CHECK 4.000
score RAZOR2_CHECK 2.500
score BAYES_99 4.300
score BAYES_90 3.500
score BAYES_80 3.000
and for users, this is the file I have created:
~username/.spamassassin/user_prefs
 SpamAssassin user preferences file.  See 'perldoc  
Mail::SpamAssassin::Conf'
# for details of what can be tweaked.
 
###

# How many hits before a mail is considered spam.
required_hits   1
# Whitelist and blacklist addresses are now file-glob-style patterns, so
# "[EMAIL PROTECTED]", "[EMAIL PROTECTED]", or "*.domain.net" will all work.
# whitelist_from[EMAIL PROTECTED]
# Blacklist
blacklist_from [EMAIL PROTECTED]
# Add your own customised scores for some tests below.  The default  
scores are
# read from the installed spamassassin rules files, but you can  
override them
# here.  To see the list of tests and their default scores, go to
# http://spamassassin.org/tests.html .
#
# score SYMBOLIC_TEST_NAME n.nn

# Added by Scott Fraser.
spam_level_stars1
spam_level_char R
ok_languagesen
ok_locales  en
report_safe 0

use_bayes   0

Am I missing something? I thought there was an on-line user_prefs  
configuration tool, but I can't locate it.

Thanks in advance,
Scott



---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Re: [SAtalk] exchange and IMAP Public Folder messages