[SAtalk] How SpamAssassin works & load testing
Hi, I have mailscanner and spamassassin installed on a RH7.2 box. Let me get his straight...when new mail comes into the mailserver spamassassin tries to check whether or not it is spam by looking it's name/characteristics up on an online database somewhere or does it have a local database that it updates every now and then? -2nd Q: how can I load test a test server? It's pretty hard to spam myself. Ive tried forwarding all my hotmail spam to my test account but that's not enough. I'd like to try 200 messages or so. Can you guys spam me? thanx ___ Don't miss the 2002 Sprint PCS Application Developer's Conference August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] How SpamAssassin works & load testing
Thanx for the FAQ David, that makes things far more clear ''Hi, Support! My, what an interesting name you have. Were your parents athletic?'' Ha, Ha, Actually, Im just using the support@iquest email so if(when) I leave here, my heir can use the same list. I tried to grab that spam tarball but it gave me permissions denied. I'd like to try using it if you can set the permissions. thanx -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of David T-G Sent: Friday, June 07, 2002 10:13 AM To: SpamAssassin Users' list Cc: Support Subject: Re: [SAtalk] How SpamAssassin works & load testing Hi, Support! My, what an interesting name you have. Were your parents athletic? ...and then Support said... % % Hi, % % I have mailscanner and spamassassin installed on a RH7.2 box. A good start. % % Let me get his straight...when new mail comes into the mailserver % spamassassin tries to check whether or not it is spam by looking it's % name/characteristics up on an online database somewhere or does it have a % local database that it updates every now and then? It can do both. It has a list of tests, like looking for all caps, looking for common get-off-a-list phrases, and so on, and it applies these tests and then accrues a score for the message. It also can do off-site tests, like checking with Vipul's Razor to see if that very same message body has been submitted by someone else, and it adds those points to the score as well. Of course, it also has score-lowering tests like checking in your whitelist and such. Once the score is tallied up, it checks your threshold and, if the score is greater, flags the mail as spam, sprays paint all over it, and generally makes it pretty hard to miss that it's junk mail. If it's less, you still have a header or two tucked in but the message is otherwise untouched. >From there, it's handed on down the delivery chain (hmmm... I don't *think* that SA will drop mail directly, leaving that up to your mailfilter or procmail or such, but it might, though that's not the most prudent of courses) and SA is done. % % -2nd Q: % % how can I load test a test server? It's pretty hard to spam myself. Ive % tried forwarding all my hotmail spam to my test account but that's not % enough. I'd like to try 200 messages or so. % Can you guys spam me? I don't want to throw you a bunch of messages (why load my server? :-) + possibility of error, even if small), but if you want my old spam folder I can put a gzipped copy up on my site for you to pull down and shoot yourself. Oh, heck, it can be a symlink so it's no sweat (tick... tick... done), so surf over and grab http://justpickone.org/davidtg/private/OF.spam.gz if you want it. Lots of messages. Have fun. % % thanx HTH & HAND :-D -- David T-G * It's easier to fight for one's principles (play) [EMAIL PROTECTED] * than to live up to them. -- fortune cookie (work) [EMAIL PROTECTED] http://www.justpickone.org/davidtg/Shpx gur Pbzzhavpngvbaf Qrprapl Npg! ___ Don't miss the 2002 Sprint PCS Application Developer's Conference August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] Stop using Bayes(site-wide)
Hi, How can I completely stop SA 2.43 from using bayes? my /etc/mail/spamassassin/local.cf has this. - # Enable the Bayes system use_bayes 0 # Enable Bayes auto-learning auto_learn 0 # Enable or disable network checks skip_rbl_checks 0 use_razor2 1 use_dcc 1 use_pyzor 1 - however, in user profiles there are bayes files in my ~/.spamassassin/ dir auto-whitelist bayes_msgcount bayes_seen bayes_toks my user_prefs has no reference to bayes. Also I have use_razor2,use_dcc, use_pyzor should I only use 1? *BTW: Any word on webmin spamassassin module? thanx, Jose Guevarra Systems Administrator iQUEST Rm 5215 Broida Hall University of California, Santa Barbara Santa Barbara, CA 93106 Phone: 805.893.8108 Fax: 805.893.8170 Email: [EMAIL PROTECTED] Web: www.iquest.ucsb.edu --- This SF.net email is sponsored by: ObjectStore. If flattening out C++ or Java code to make your application fit in a relational database is painful, don't do it! Check out ObjectStore. Now part of Progress Software. http://www.objectstore.net/sourceforge ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
RE: [SAtalk] Stop using Bayes(site-wide)
Sorry I meant SA 2.53. doesn't setting "use_bayes 0" mean "don't enable bayes" and yes they do come back. thanx, -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Theo Van Dinter Sent: Wednesday, May 28, 2003 1:53 PM To: Support Cc: [EMAIL PROTECTED] Subject: Re: [SAtalk] Stop using Bayes(site-wide) On Wed, May 28, 2003 at 11:26:25AM -0700, Support wrote: > How can I completely stop SA 2.43 from using bayes? You can't, 2.43 doesn't have bayes. Or did you mean 2.53? > use_bayes 0 that's it right there. > however, in user profiles there are bayes files in my ~/.spamassassin/ > dir are those files recent? ie: if you remove them do they come back? -- Randomly Generated Tagline: Oh, the guys are work are going to have a field day with this. -- Homer Simpson The Call of the Simpsons --- This SF.net email is sponsored by: eBay Get office equipment for less on eBay! http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5 ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] asian fonts induce false negatives?
Hi,
I have a user who gets SPAM with scores of around -6.0 points. One thing
I've noticed is that they have asian characters(and some english). Could
this be inducing a false negative?
Also one side question. how exactly is a negative score accumulated? Are
there negative points added to the overall score?
thanx,
---Header-
X-Spam-Status: No, hits=-6.3 required=3.0
tests=IN_REP_TO,MAILTO_WITH_SUBJ,NO_REAL_NAME,REFERENCES,
SUBJ_HAS_SPACES,SUBJ_HAS_UNIQ_ID
version=2.53
X-Spam-Level:
X-Spam-Checker-Version: SpamAssassin 2.53 (1.174.2.15-2003-03-30-exp)
--
--part of email
Ìû ðàäû ïðåäëîæèòü âàì íîâûé áåñïëàòíûé ïî÷òîâûé ñåðâèñ
http://www.mail15.com. Åãî îòëè÷èòåëüíûå îñîáåííîñòè:
1) ðàçìåð ÿùèêà 15 ìá;
2) çàùèùåííîñòü è íàäåæíîñòü;
3) âîçìîæíîñòü èñïîëüçîâàíèÿ ëþáûõ ïî÷òîâûõ ïðîãðàìì(POP,IMAP,SMTP);
4) äîñòóï èç ëþáîãî ìåñòà â ëþáîå âðåìÿ;
5) ïðîñòîé è äîñòóïíûé âåáèíòåðôåéñ ñ ÏÎËÍÛÌ ÎÒÑÓÒÑÒÂÈÅÌ ÐÅÊËÀÌÛ;
6) àíòèâèðóñíûé è àíòèñïàìîâûé êîíòðîëü;
7) ìãíîâåííàÿ ïåðåñûëêà ïî÷òû.
Åñëè âû íå õîòèòå ïîëó÷àòü áîëåå äàííóþ ðàññûëêó, ïèøèòå
mailto:[EMAIL PROTECTED]
N¬HS^µé[)¢{(ç[Èö«jÊ ´J뢺k¢Öy¶©¦Æ®¶µë^²Ø§j+x:0ZuëÚg*)àjw`zÖç¢0Ã
Z«(~×(öîW¦º(}ªi³T©jf¬±«,{ZIX§X¬µ*Z«,jË"Ö¥X¬¶Ë(º· ~àzwÛi³ÿåËl²«qç讧zßåËlþX¬¶)ߣû)jf¬±«,{Z
[SAtalk] reasons for these false positives
Hi,
I'm getting a false positive on an automated mailing list. The reasons are
listed below. Is there a place where I can get a run-down on what these
tests test? For example, the Date doesn't seem to be 6-12 hours before the
Received: dates; it looks OK to me. And what does it mean by From: does not
include a real name? A list explaining these test would be nice.
thanx,
-jose
==
Return-Path: <[EMAIL PROTECTED]>
Received: from metromaster.physics.campus.edu
(metromaster.physics.campus.edu [1.1.16.30])
by scud.iquest.campus.edu (8.11.6/8.11.6) with ESMTP id h77G95408054
for <[EMAIL PROTECTED]>; Thu, 7 Aug 2003 09:09:05 -0700
Received: from library.campus.edu (library.campus.edu [1.1.87.25])
by metromaster.physics.campus.edu (8.11.6/8.11.6) with ESMTP id
h77G8TB28346
for <[EMAIL PROTECTED]>; Thu, 7 Aug 2003 09:08:29 -0700
Received: from circulation-029 (circulation-029.library.campus.edu
[1.1.95.214])
by library.campus.edu (8.12.9+Sun/8.12.8) with SMTP id
h77G8ma0029010
for <[EMAIL PROTECTED]>; Thu, 7 Aug 2003 09:08:48 -0700 (PDT)
Message-Id: <[EMAIL PROTECTED]>
From: [EMAIL PROTECTED]
To: <[EMAIL PROTECTED]>
Cc:
Date: Thu, 07 Aug 03 09:09:06 Pacific Daylight Time
X-Mailer: WC Mail
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary=WC_MAIL_PaRt_BoUnDaRy_05151998
X-Spam-Status: Yes, hits=3.2 required=3.0
tests=AWL,DATE_IN_PAST_06_12,INVALID_DATE,NO_REAL_NAME
version=2.55
X-Spam-Level: ***
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
X-Spam-Report: This mail is probably spam. The original message has been
attached
along with this report, so you can recognize or block similar unwanted
mail in future.
Content preview: H O L D A V A I L A B L E N O T I C E August 07 2003
Your ID: 21205001775246 [...]
Content analysis details: (3.20 points, 3 required)
NO_REAL_NAME (0.8 points) From: does not include a real name
INVALID_DATE (0.6 points) Invalid Date: header (not RFC 2822)
DATE_IN_PAST_06_12 (0.8 points) Date: is 6 to 12 hours before Received:
date
AWL(1.0 points) AWL: Auto-whitelist adjustment
X-Spam-Flag: YES
Subject: {SPAM?} hold request - 01
==
---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa0013ave/direct;at.aspnet_072303_01/01
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] [Fwd: Seminar: Secrets of SPAM]
H... Here's something interesting. I forward this so that perhaps a few hundred people in the US and Canada will call the 800 number a couple dozen times and make this a little more expesive for the worthless losers holding this. I like costing spammers money ;^). Don Original Message Subject: Seminar: Secrets of SPAM Date: Wed, 10 Apr 2002 20:08:22 -0400 From: "Education Dept." <[EMAIL PROTECTED]> Reply-To: "Education Dept." <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Hello, Ever wonder how the bulk mail artists of today get away with sending out millions of unsolicited e-mails without losing their ISP or breaking any laws? They spend almost no money, and rake in millions. Well it is very simple, they all learned from the same person how to stay legal, and completely anonymous (without spending big money). Global129 has been hacking for almost 15 years. He has a intimate knowledge of the inner workings of the internet. We are now sponsoring a series of seminars where you too can gain this invaluable knowledge. You will take part in a day-long seminar hosted by Global129 himself learning how to beat the ISP's and "SPAM Complainers" at there own game! The Secrets of Bulk e-Mail seminar will be in NYC and on Long Island In late April and May. Admission will be $850 ($400 each additional person in your party)and pre-registration will start shortly. Limited seating is available. For more information, and registration forms please e-ma il [EMAIL PROTECTED] with your city and state. (your address will NOT be sold or SPAMMEd) Thank you. Complaints/Removal Requests can be directed to: 877-693-2200 ext. 893 Disclaimer: We always abide by every law. We never tell you to do something that will break any laws, and recommend that you always check federal/State/ and Local laws before engaging in bulk e-mailing activity. ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
[SAtalk] Disable a User who does not want SA
Hi All RH8.0 with SA2.60 installed as sitewide. Procmailrc is handling spam for all users and creates ~/.spamassassin/user_prefs ok. Now 1 customer has decided he does not like spam filtered emails (cannot please all). tried |/usr/bin/spamassasin -x in procmailrc since i read no user_prefs no spam handling. tried ~/.no-spamfilter Done a google search but not found an answer to disable on a per user basis. Mark --- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Disable a User who does not want SA
- Original Message - From: "Mark Muller" <[EMAIL PROTECTED]> To: "'Obantec Support'" <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]> Sent: Monday, December 01, 2003 9:27 PM Subject: RE: [SAtalk] Disable a User who does not want SA > all_spam_to [EMAIL PROTECTED] should do it. > > > -Original Message- > From: Obantec Support [mailto:[EMAIL PROTECTED] > Sent: Monday, December 01, 2003 2:25 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Disable a User who does not want SA > > > Hi All > > RH8.0 with SA2.60 installed as sitewide. > > Procmailrc is handling spam for all users and creates > ~/.spamassassin/user_prefs ok. > > Now 1 customer has decided he does not like spam filtered emails (cannot > please all). > > tried |/usr/bin/spamassasin -x in procmailrc since i read no user_prefs no > spam handling. > tried ~/.no-spamfilter > > Done a google search but not found an answer to disable on a per user basis. > > Mark > > > > > --- > This SF.net email is sponsored by: SF.net Giveback Program. > Does SourceForge.net help you be more productive? Does it > help you create better code? SHARE THE LOVE, and help us help > YOU! Click Here: http://sourceforge.net/donate/ > ___ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > Hi Mark (sorry sent my reply to your email no list) Does the all_spam_to work if the To: is faked as most spams seem to be? (i skipped past the all_spam_to thinking it was a way to send "All the spam to xyz!") Mark --- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] Disable a User who does not want SA
- Original Message - From: "Kenneth Porter" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, December 05, 2003 5:52 AM Subject: Re: [SAtalk] Disable a User who does not want SA > --On Monday, December 01, 2003 3:55 PM -0600 Rich Puhek > <[EMAIL PROTECTED]> wrote: > > > Here's the nospam.pl script: > > Why not use grep? > > > * ! ? /usr/local/bin/nospam.pl $LOGNAME > > (Untested code) > > * ! ? grep -q ^$LOGNAME$ /etc/spamassassin/exempt > > Or you could use the magic file approach: > > test -f /home/$LOGNAME/.nospamassassin > > > --- > This SF.net email is sponsored by: IBM Linux Tutorials. > Become an expert in LINUX or just sharpen your skills. Sign up for IBM's > Free Linux Tutorials. Learn everything from the bash shell to sys admin. > Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click > ___ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > Thanks to all who replied. I have gone with all_spam_to [EMAIL PROTECTED] the wild card does seem ok and since the user has a few email aliases to the domain it works a treat. I did spend a lot of time explaining how the user could use the usermin SA module to edit spam settings but he seemed reluctant. Maybe he likes spam! Mark --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
Re: [SAtalk] evilrules.cf including in local.cf?
even the local.cf.sample? Or just the files that end in .cf? Probably a rhetorical question... I didn't know all the cf's would get processed. Good tip. Rudy Matt Kettler wrote: At 02:37 PM 10/15/2003, Mike Schrauder wrote: I have sa/spamd setup on postfix - debian using Duncan Findlay's deb to protect an exchange server. All is working well, but I am getting a LOT of false negatives now. I would like to include the evilrules.cf to see if that might help. What syntax would I use in my local.cf to (include?) the evilrules.cf? Sry for my ignorance of all things 'nix. I checked the POD Docs on the SA website to no avail. TIA There's no need to do an include. SA will parse _every_ file in /etc/mail/spamassassin, not just local.cf --- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. See the people who have HELPED US provide better services: Click here: http://sourceforge.net/supporters.php ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk --- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. See the people who have HELPED US provide better services: Click here: http://sourceforge.net/supporters.php ___ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
