[SAtalk] More on mailing lists that test as spammers

2002-05-03 Thread Syth
On Thursday, May 2, 2002, at 05:51 PM, I wrote: > I get messages from a mailing list that test out as spam > I know I can whitelist the mailing list. > whitelist_to [EMAIL PROTECTED] # Messages are addresed TO the list, right? > > Is this the best solution for a list that consistantly hits 5.0?

Re: [SAtalk] Brute force spam prevention for NSP's

2002-05-03 Thread LuKreme
On Friday, May 3, 2002, at 06:57 PM, Olivier Nicole wrote: > install SA and silently drop spam traffic. Oooo! that is clever. I like it I like it. -- You are responsible for your rose. ___ Have big pipes? SourceForge.net is looking

Re: [SAtalk] rule for IMG

2002-05-03 Thread LuKreme
On Friday, May 3, 2002, at 05:23 PM, Kaitlin Duck Sherwood wrote: > I don't even bother trying to parse to make sure it's an HTML tag: the > only English-language word with I-M-G in it is the city Pri.m.ghar, Iowa > -- population 950. There are a few acronyms -- Inside Macintosh Games, > for e

Re: [SAtalk] RFC: ok_languages patch

2002-05-03 Thread Craig R Hughes
Daniel Quinlan wrote: DQ> There were a bunch of test files distributed with TextCat. We can probably paste some of them into an email body then I guess. DQ> Having the GA score this would be nice. My last rule was almost a DQ> "fiver" after the GA got done with it. :-) It will be interesting

Re: [SAtalk] Brute force spam prevention for NSP's

2002-05-03 Thread Jeremy Mates
* Olivier Nicole <[EMAIL PROTECTED]> [2002-05-03T18:01-0700]: > What we have been thinking about would be a transparent redirect of > SMTP traffic to a mail gateway. The redirect being installed only for > the known/repported spammers. STARTTLS tunneled mail does not take kindly to being transpar

[SAtalk] Horde -HEAD now supports spam reporting ...

2002-05-03 Thread Marc G. Fournier
Today, the Horde team committed code that allows someone setting up a Horde mail system to enable a 'Report as Spam' option that can use a program to do the submission ... The example I got them to put into the conf file is spamassassin -r, but any program that can be pipe'd into should work jus

Re: [SAtalk] RFC: ok_languages patch

2002-05-03 Thread Daniel Quinlan
Craig R Hughes writes: > thanks, great work. It's getting late now, and I have a big > breakfast meeting early tomorrow, so I'll take a look at this > sometime after noon. Is it kosher to roll this with the > language-detection stuff and all into the SA distribution then? > Sounds like you've g

Re: [SAtalk] Can't get spamass-milter to load

2002-05-03 Thread Daniel Rogers
On Fri, May 03, 2002 at 05:47:51PM -0400, Ross Vandegrift wrote: > Have you had better luck with this patch applied? If so, kludge or not, > I'll certainly apply it. Yeah, it solved the deadlock problem completely. I think a big part of it was being caused by the milter writing to spamc in 4096

Re: [SAtalk] Fwd'ed spam

2002-05-03 Thread Charlie Watts
On 3 May 2002, Matt Sergeant wrote: > Actually, on second thoughts, maybe we should start to do a DB based URI > eval rule? Having a new rule for every single URI would kill > performance. Someone post a bug if you think that's a good idea. Why not use the existing DNS blacklist mechanisms? Feed

Re: [SAtalk] Brute force spam prevention for NSP's

2002-05-03 Thread Olivier Nicole
> I would suggest notifying an admin person rather than silently dropping. > Silently dropping is really bad should you ever have a false positive. I was talking about 100% identified spammers, only filter them. The war against these few customer has been runnig for ages, blocking their port 25,

[SAtalk] NetBSD package for SA 2.20

2002-05-03 Thread Klaus Heinz
Hi, in case anyone is interested: I noticed that the NetBSD package system ('pkgsrc') has updated the package mail/p5-Mail-SpamAssassin for SA 2.20. ciao Klaus ___ Have big pipes? SourceForge.net is looking for download mirrors

Re: [SAtalk] Brute force spam prevention for NSP's

2002-05-03 Thread Craig R Hughes
Olivier Nicole wrote: ON> Then install SA and silently drop spam traffic. I would suggest notifying an admin person rather than silently dropping. Silently dropping is really bad should you ever have a false positive. ON> I think thi solution is even better than adding some penalty to all ON> t

Re: [SAtalk] Brute force spam prevention for NSP's

2002-05-03 Thread Olivier Nicole
> Some questions I have is if anyone in a similar situation that I'm in? And if > so, would you think such a system like the above would be useful? I'd > appreciate any suggestions. Well I am not ISP, but I once talked to my friend who is working at one and has having the same problem. What we h

RE: [SAtalk] Multi-user SpamAssassin setup on vpopmail

2002-05-03 Thread CertaintyTech - Ed Henderson
Take a look at the new vpopmail integration in SA 2.20 first before resorting to SQL. See the README.spamd-vpopmail in the spamd dir of the 2.20 distribution for details. It gives support for virtual vpopmail users. I wrote the patch and use it daily and works great. -- Ed. > > Chris, > > ta

Re: [SAtalk] Re: RATWARE rule and manual vs. GA scores

2002-05-03 Thread Craig R Hughes
Yes; and then do a diff -ur and either mail it to the list, or better, attach it to a bugzilla ticket. C Chuck Wolber wrote: CW> CW> CW> > Yes. Patches and/or bugzilla requests happily accepted. CW> CW> Excellent :-) Should I write it against the tip of the CVS tree? CW> CW> CW>

[SAtalk] rule for IMG

2002-05-03 Thread Kaitlin Duck Sherwood
Greetings, spamologists! I spent the past four years thinking about email, including spam, while working on a pair of books on how to overcome email overload. Recently, I've been working on a Visual Basic plug-in for MS Outlook (send flames off-list, please, and first note that I'm a Eudora fa

Re: [SAtalk] Re: RATWARE rule and manual vs. GA scores

2002-05-03 Thread Chuck Wolber
> Yes. Patches and/or bugzilla requests happily accepted. Excellent :-) Should I write it against the tip of the CVS tree? -- Chuck Wolber System Administrator AltaServ Corporation (425)576-1202 ten.vresatla@wkcuhc"Condense facts from the vapor of nuance."

Re: [SAtalk] Detecting local spammers

2002-05-03 Thread dman
On Fri, May 03, 2002 at 03:23:47PM -0700, Craig R Hughes wrote: | Theo Van Dinter wrote: | | TVD> > Note that MAIL FROM: is wholly different from From: and most end users | TVD> > never see the contents of the MAIL FROM:. | TVD> | TVD> Note: Most MUAs will use the From: header to be the envelope

Re: [SAtalk] persisten AWL scores

2002-05-03 Thread Klaus Heinz
Craig R Hughes wrote: > correctly but I guess I didn't. Could you file a bugzilla ticket Bug #276 ciao Klaus ___ Have big pipes? SourceForge.net is looking for download mirrors. We supply the hardware. You get the recognition. E

Re: [SAtalk] Detecting local spammers

2002-05-03 Thread Theo Van Dinter
On Fri, May 03, 2002 at 03:23:47PM -0700, Craig R Hughes wrote: > ...and hope the place that gets your email address doesn't reset all their > users' mail preferences to "opted in" -- cf Yahoo and eBay in recent months. I > also used to always turn off the "opt in" checkbox on everything, but *st

Re: [SAtalk] Re: RATWARE rule and manual vs. GA scores

2002-05-03 Thread Craig R Hughes
Yes. Patches and/or bugzilla requests happily accepted. C Chuck Wolber wrote: CW> > Running spamd? Did you restart it after changing local.cf? CW> CW> Would it not be beneficial fpr spamd to do a timestamp check on the conf CW> files so the admin does not have to worry about remembering to re

Re: [SAtalk] Detecting local spammers

2002-05-03 Thread Craig R Hughes
Theo Van Dinter wrote: TVD> > Note that MAIL FROM: is wholly different from From: and most end users TVD> > never see the contents of the MAIL FROM:. TVD> TVD> Note: Most MUAs will use the From: header to be the envelope FROM as well. Not sure I've ever seen a MUA other than 'telnet' which allow

Re: [SAtalk] Can't get spamass-milter to load

2002-05-03 Thread Dave Strickler
OK, that's embarassing... I though we tried that earlier. Evidently not!   As for the reliability, let me pass a few million messages through the system and I'll let you know. As of today, we are still testing. I should be able to answer this by next week.>>> Ross Vandegrift <[EMAIL PROTECTE

Re: [SAtalk] Can't get spamass-milter to load

2002-05-03 Thread Ross Vandegrift
> I had a problem with it where it would deadlock with the spamc process if > the message was over 250k (or whatever the max size for spamc/spamd). I > ended up solving it by adding a read() loop to spamc to flush the read > buffer so that the milter would be ready for the response. It's probabl

Re: [SAtalk] Can't get spamass-milter to load

2002-05-03 Thread Dave Strickler
That may just be what's causing it - thanks!   Dave Strickler CEODWS - "The GroupWise Integration Experts" Boston * Austin * Belgium * Denmark http://www.emailsolutions.com  (800) 999-5412 x10>>> Daniel Rogers <[EMAIL PROTECTED]> 5/3/2002 4:38:37 PM >>>On Fri, May 03, 2002 at 04:17:43PM -040

Re: [SAtalk] Can't get spamass-milter to load

2002-05-03 Thread Dave Strickler
Can't apply the patch until tomorrow, but will try it then and ley you (and the list) know how it works.   Dave Strickler CEODWS - "The GroupWise Integration Experts" Boston * Austin * Belgium * Denmark http://www.emailsolutions.com  (800) 999-5412 x10>>> Ross Vandegrift <[EMAIL PROTECTED]>

Re: [SAtalk] Re: RATWARE rule and manual vs. GA scores

2002-05-03 Thread Chuck Wolber
> Running spamd? Did you restart it after changing local.cf? Would it not be beneficial fpr spamd to do a timestamp check on the conf files so the admin does not have to worry about remembering to restart it? -Chuck -- Chuck Wolber System Administrator AltaServ Corporation (425)576-1202 ten

RE: [SAtalk] Turning on SA sitewide, overriding on a per-user basis?

2002-05-03 Thread Bart Schaefer
On 3 May 2002, Ken Causey wrote: > Thanks again Ed. I had to modify the script slightly to get it to work > with my procmail (procmail v3.22 2001/09/10): > > # Test for nospamcheck > :0 > * ? test -f $HOME/.nospamcheck > { > #if nospamcheck exists then deliver normally > :0: > $ORGMAIL >

[SAtalk] Question about SA and QMail-Scanner..

2002-05-03 Thread Robert Leonard
Title: Question about SA and QMail-Scanner.. I have Qmail running, I have SpamAssassin installed and the Daemon Started, I have Qmail-scanner installed and running, but I can't seem to get the scanner to use SpamAssassin! When I use the ./configure command from Qmail-Scanner I get an error st

Re: [SAtalk] Detecting local spammers

2002-05-03 Thread Theo Van Dinter
On Fri, May 03, 2002 at 03:48:03PM -0500, dman wrote: > Depends on how brain-damaged the software is in the first place. Some > software can easily be setup to switch settings dynamically. > > Alternatively an ssh tunnel can be used to get inside the corp. > network and pretend that the dialup l

Re: [SAtalk] Detecting local spammers

2002-05-03 Thread dman
On Fri, May 03, 2002 at 01:43:27PM -0600, LuKreme wrote: | | | > On Fri, May 03, 2002 at 11:09:53AM -0400, CertaintyTech - Ed Henderson | > wrote: | This question is not SA specific but just a general email | > sysadmin type | question: What is an effective way to monitor my own | > dialup cust

Re: [SAtalk] Can't get spamass-milter to load

2002-05-03 Thread Daniel Rogers
On Fri, May 03, 2002 at 04:17:43PM -0400, Ross Vandegrift wrote: > On a related note, is spamass-milter at all reliable for you? I have > huge amounts of problems with it spinning off a ridiculous number of > sub-processess (spamass-milter and spamc) that never return. I'm > considering figuring

Re: [SAtalk] Can't get spamass-milter to load

2002-05-03 Thread Craig R Hughes
It does list the port -- a unix socket in /var/local/spamass-sock Perhaps the user you're running as doesn't have the right permissions on that C Dave Strickler wrote: DS> A friend I just set up SA and it was working fine with the deamons. DS> After rebooting, the spamass-milter wouldn't load,

Re: [SAtalk] Re: RATWARE rule and manual vs. GA scores

2002-05-03 Thread LuKreme
> > Running spamd? Did you restart it after changing local.cf? Ahh, no I didn't. Thought it got read for each message. Guess that seems silly now. -- You are responsible for your rose. ___ Have big pipes? SourceForge.net is lo

Re: [SAtalk] Multi-user SpamAssassin setup on vpopmail

2002-05-03 Thread Craig R Hughes
Chris, take a look at storing the userprefs in a SQL database instead of as files. Search the mailing list archives for vpopmail or virtuser and you'll probably find lots of info. C Christopher Kunz wrote: CK> Hey there, CK> CK> since yesterday, I'm a happy SpamAssassin user (thanks to Sascha

Re: [SAtalk] Beginners question: gprintf

2002-05-03 Thread Craig R Hughes
gprintf is a Mandrake-ism I think. Redhat just uses echo instead. If you edit the /etc/rc.d/init.d/spamassassin script and replace the gprints with echos (or you can just comment them out if you don't care about the printing of startup info). C Gunnar Lieb wrote: GL> Hi, GL> GL> I'm new to sp

Re: [SAtalk] [Fwd: I have some exclusive information for you.]

2002-05-03 Thread Michael C. Berch
It seems to me that it would be useful to have a single repository of false negatives (i.e., stuff that slipped past SA) with some sort of automated process to crunch the messages to produce fodder for rules updates. This would be most useful for body tests, since people would be using all so

Re: [SAtalk] Re: RATWARE rule and manual vs. GA scores

2002-05-03 Thread Craig R Hughes
I don't think this is the answer -- the binary difference between 2.9 and 3.0 is pretty large, and in any case, SA's rounding can tell the difference between these. This might be the problem if it were 2. versus 3.0 but not for a .1 difference. C dman wrote: d> On Fri, May 03, 2002 at 12:3

Re: [SAtalk] Re: RATWARE rule and manual vs. GA scores

2002-05-03 Thread Craig R Hughes
Running spamd? Did you restart it after changing local.cf? C LuKreme wrote: L> OK, so I decided to drop the value of X_OSIRU_SPAM_SRC to 2.9 (from 3.0) ___ Have big pipes? SourceForge.net is looking for download mirrors. We supply

Re: [SAtalk] Can't get spamass-milter to load

2002-05-03 Thread Ross Vandegrift
On Fri, May 03, 2002 at 04:08:09PM -0400, Dave Strickler wrote: > A friend I just set up SA and it was working fine with the deamons. > After rebooting, the spamass-milter wouldn't load, even by hand. The > error it give is (from the log): > > May 3 15:47:58 scrubber su(pam_unix)[1030]: session

Re: [SAtalk] multi action and spamassassin

2002-05-03 Thread Craig R Hughes
Looks like you're using cyrus for delivery. I do this: # process through spamassassin before here :0 | $DELIVER -e -q $USER and then I just create sieve scripts to handle which mailbox messages end up in, rather than trying to deliver the messages directly there using -m C [EMAIL PROTECTED]

Re: [SAtalk] [Fwd: I have some exclusive information for you.]

2002-05-03 Thread Craig R Hughes
Derek Broughton wrote: DB> From: "CertaintyTech - Ed Henderson" <[EMAIL PROTECTED]> DB> > they used to improve rules or just added the spam corpus? DB> DB> Aren't the two things synonymous? ;-) I'm sure that that is, at least, the DB> intention. The sightings stuff mostly does not currently end

[SAtalk] Can't get spamass-milter to load

2002-05-03 Thread Dave Strickler
A friend I just set up SA and it was working fine with the deamons. After rebooting, the spamass-milter wouldn't load, even by hand. The error it give is (from the log):   May  3 15:47:58 scrubber su(pam_unix)[1030]: session opened for user root by awaltman(uid=501)May  3 15:48:08 scrubber s

Re: [SAtalk] persisten AWL scores

2002-05-03 Thread Craig R Hughes
Hmm, looks like a bug. I'm surprised; I would have thought I'd implemented that correctly but I guess I didn't. Could you file a bugzilla ticket please Klaus at http://bugzilla.spamassassin.org/ Thanks, C Klaus Heinz wrote: KH> Hi, KH> KH> I was experimenting with spamc/spamd but noticed th

Re: [SAtalk] ${token1} Leave your debt problems behind you (fwd)

2002-05-03 Thread Craig R Hughes
Doug Crompton wrote: DC> This is really spam - should we not have something that matches credit DC> card debt? Submitted to razor. I guess I need to bump spam-phrase re-enablement up in the priority list. That would probably have flagged this message. C __

Re: [SAtalk] Detecting local spammers

2002-05-03 Thread Craig R Hughes
CertaintyTech - Ed Henderson wrote: CEH> This question is not SA specific but just a general email sysadmin type CEH> question: What is an effective way to monitor my own dialup customers to CEH> see if any are abusing their email privilege by sending out spam? I am CEH> using qmail. Somehow m

Re: [SAtalk] [Fwd: I have some exclusive information for you.]

2002-05-03 Thread Craig R Hughes
Richie Laager wrote: RL> On a related note, how can one send his spam collection to be RL> included in the spam corpus? Currently there are bandwidth/storage issues impinging on doing what I'd like to in this arena. I do have a couple feeds from other people's spamtraps which populate the corpu

RE: [SAtalk] [Fwd: I have some exclusive information for you.]

2002-05-03 Thread Craig R Hughes
Honestly, nothing much most of the time. But the messages are archived, and provide a resource which people can go to if necessary. Occasionally I browse through and see if there's anything there which jumps out at me. Don't tell anyone, but the list is mostly there so that people don't bombard

Re: [SAtalk] Multi-user SpamAssassin setup on vpopmail

2002-05-03 Thread Dave Weiner
Christopher Kunz <[EMAIL PROTECTED]> said: > Hey there, > > since yesterday, I'm a happy SpamAssassin user (thanks to Sascha Schumann, > who might even read this list, too) on my VPopMail setup. I'm now > investigating the possibility of setting SA as the default spam blocking > tool for all our

Re: [SAtalk] official site for SpamAssassin

2002-05-03 Thread Craig R Hughes
www.spamassassin.org is probably better, since that will stay with the project even if taint.org is no longer where the site is actually located. C Klaus Heinz wrote: KH> Hi, KH> KH> which is the official site name for SA that should be used? KH> Both www.spamassassin.org and spamassassin.taint

Re: [SAtalk] Detecting local spammers

2002-05-03 Thread LuKreme
> On Fri, May 03, 2002 at 11:09:53AM -0400, CertaintyTech - Ed Henderson > wrote: | This question is not SA specific but just a general email > sysadmin type | question: What is an effective way to monitor my own > dialup customers to | see if any are abusing their email privilege by > sending

Re: [SAtalk] AWL verses early-terminate

2002-05-03 Thread Craig R Hughes
Matt Sergeant wrote: MS> Personally I think the implementation of whitelisting is broken - if MS> it's whitelisted or blacklisted we should be scanning period. But our MS> white/blacklisting is implemented separately here, so you're unlikely to MS> see a fix coming direct from me, I'm afraid (unl

Re: [SAtalk] Rules for digitally signed messages

2002-05-03 Thread Craig R Hughes
dman wrote: d> On Fri, May 03, 2002 at 11:24:43AM +0100, Darren Coleman wrote: d> | Yes, it does check for PGP signed messages, which is good. d> | d> | But digitally signed messages (like yours and mine), i.e those that d> | require the person to buy a digital id, go through a verification d> |

Re: [SAtalk] X-Spam-Status: No, hits=5.0 required=5.0

2002-05-03 Thread Craig R Hughes
Derek Broughton wrote: DB> make sense to be rounding a result of 4.55 or even 4.95 up to 5 (though to DB> be pedantic, you can't round 4.9 _down_ to 4.9 - that's truncation Round (v): to make round, to convert into something round Round (n): A low-precision number So why exactly can't you r

RE: [SAtalk] Turning on SA sitewide, overriding on a per-user basis?

2002-05-03 Thread LuKreme
> You could add an entry to the main procmailrc that checks for the > existence of a certain file called "nospamcheck" (or something like > that). IF the file exists in the users dir then don't run spamc > otherwise run spamc. Then put "nospamcheck" in each of the user's dir > that do not want

Re: [SAtalk] AWL verses early-terminate

2002-05-03 Thread Craig R Hughes
Nathan Neulinger wrote: NN> Was this changed recently? Cause it most definately did not work for me I definitely think there's something weird going on in the short-circuit code. I'll take a look at it and it'll probably be pretty clear what's up. C ___

RE: [SAtalk] Rules for digitally signed messages

2002-05-03 Thread Craig R Hughes
Darren, can you send me such a signed message? There are probably several hundred digital-message-signing technologies out there, and they probably all have slightly different ways of doing the signing, etc. I don't know if you're using S/MIME or something. If you send a message, I'll find a p

[SAtalk] Multi-user SpamAssassin setup on vpopmail

2002-05-03 Thread Christopher Kunz
Hey there, since yesterday, I'm a happy SpamAssassin user (thanks to Sascha Schumann, who might even read this list, too) on my VPopMail setup. I'm now investigating the possibility of setting SA as the default spam blocking tool for all our domain customers. Unfortunately, vpopmail uses virtual

RE: [SAtalk] AWL verses early-terminate

2002-05-03 Thread Craig R Hughes
Well, AWL can't really run first. It more or less *has* to run last. But there's no reason it can't run last, after the early-terminate has terminated: while(early-terminate condition not met) { step through some rules } check awl here as opposed to treating AWL as just another rule. C Mat

Re: [SAtalk] ${token1} Leave your debt problems behind you (fwd)

2002-05-03 Thread LuKreme
> This is really spam - should we not have something that matches credit > card debt? Submitted to razor. Not to mention the key phrase "cut [your] interest rate" -- You are responsible for your rose. ___ Have big pipes? SourceFo

[SAtalk] Beginners question: gprintf

2002-05-03 Thread Gunnar Lieb
Hi, I'm new to spamassassin and also new to linux. We just installed CommunigatePro on Redhat 7.2 I have downloaded the RPM's for Spamassassin. If I go in the package manager everything seems right, but if I try to start it the sript is complaining that gprintf is an undefined function? So what

Re: [SAtalk] Detecting local spammers

2002-05-03 Thread LuKreme
> This question is not SA specific but just a general email sysadmin type > question: What is an effective way to monitor my own dialup customers > to see if any are abusing their email privilege by sending out spam? I > am using qmail. Somehow monitor the volume that each local IP is > sendin

RE: [SAtalk] Turning on SA sitewide, overriding on a per-user basis?

2002-05-03 Thread Ken Causey
Thanks again Ed. I had to modify the script slightly to get it to work with my procmail (procmail v3.22 2001/09/10): # Test for nospamcheck :0 * ? test -f $HOME/.nospamcheck { #if nospamcheck exists then deliver normally :0: $ORGMAIL } #Filter message thru SA :0fw | /usr/bin/spamc -u $LO

Re: [SAtalk] Re: RATWARE rule and manual vs. GA scores

2002-05-03 Thread dman
On Fri, May 03, 2002 at 12:32:03PM -0600, LuKreme wrote: | OK, so I decided to drop the value of X_OSIRU_SPAM_SRC to 2.9 (from 3.0) | X-Spam-Status: Yes, hits=5.0 required=5.0 | SPAM: Hit! (3.0 points) DNSBL: sender is Confirmed Spam Source | puzzled. Welcome to binary floating point :-). The

[SAtalk] Re: Appending original message as MIME attachment?

2002-05-03 Thread Craig R Hughes
Matt Sergeant wrote: MS> I'd be pretty unpopular if I gave them away (I already have to be pretty MS> careful about my contributions - I have some killer new spam stuff here, MS> but unfortunately I'm not really allowed to talk about it - if I did it MS> would be trivial for you to implement, but

Re: [SAtalk] Re: RATWARE rule and manual vs. GA scores

2002-05-03 Thread LuKreme
OK, so I decided to drop the value of X_OSIRU_SPAM_SRC to 2.9 (from 3.0) so I made changes to the existing local.cf file: % cat /etc/mail/spamassassin/local.cf # Add your own customisations to this file. See 'man Mail::SpamAssassin::Conf'# for details of what can be tweaked. # score X_OSIRU_SPA

Re: [SAtalk] Brute force spam prevention for NSP's

2002-05-03 Thread Derek Broughton
From: "Viraj Alankar" <[EMAIL PROTECTED]> > > Now by being able to see this traffic, we can do some interesting things. If > anyone has played with dsniff, there are 2 tools in that package that come to > mind: mailsnarf and tcpkill :). For those that do not know, mailsnarf > basically dumps out S

[SAtalk] Brute force spam prevention for NSP's

2002-05-03 Thread Viraj Alankar
Hello, We are a network service provider and over time I have seen the customers that we provide network connectivity to many times generate alot of spam from their network. Many times the business rationale of this is basically it is more profitable to the company to keep these customers. Many

RE: [SAtalk] [OT] Help - someone is using our company domain name as the from address in spam

2002-05-03 Thread Andrew Hoying
These spam messages are coming from someone hosted by chinanet, chinanet.cn.net using the ip address of 61.129.81.52, which searching google is a commonly used IP address for spam mailings. In fact this same message is being sent with a variety of forged from/return-path addresses. However as far

[SAtalk] multi action and spamassassin

2002-05-03 Thread spamreg
I have a account where the only thing I recieve is SPAM. So I'd like to set it up to report it with spamassassin. I've tried: :0 H * ^Delivered-To: [EMAIL PROTECTED] { :0 fw | spamassassin -r :0 | formail -I "From " -s $DELIVER -m user.spam.spam } but the mail doesn't get delived with

RE: [SAtalk] Turning on SA sitewide, overriding on a per-user basis?

2002-05-03 Thread Ken Causey
Thank you, this looks like a possible solution! Ken On Fri, 2002-05-03 at 11:12, CertaintyTech - Ed Henderson wrote: > > > > > > You could add an entry to the main procmailrc that checks for the > > existence > > of a certain file called "nospamcheck" (or something like that). IF the > > file e

Re: [SAtalk] Detecting local spammers

2002-05-03 Thread dman
On Fri, May 03, 2002 at 11:09:53AM -0400, CertaintyTech - Ed Henderson wrote: | This question is not SA specific but just a general email sysadmin type | question: What is an effective way to monitor my own dialup customers to | see if any are abusing their email privilege by sending out spam? I

Re: [SAtalk] [OT] Help - someone is using our company domain name as the from address in spam

2002-05-03 Thread dman
On Fri, May 03, 2002 at 09:52:39AM -0600, Andrew Hoying wrote: | I'm getting flooded with messages from postmaster accounts about spam coming | from us. When you look at the header it is obviously coming from Asia, but | they are using our company domain name in the from and return-path | addresse

Re: [SAtalk] [Fwd: I have some exclusive information for you.]

2002-05-03 Thread Derek Broughton
From: "CertaintyTech - Ed Henderson" <[EMAIL PROTECTED]> > > > > These should goto spamassassin-sightings, not spamassassin-talk (unless > > you think there's a discussion in store for this spam.) > > What exactly happens to the emails that are sent to spamassassin-sightings? > I have sent alot of

RE: [SAtalk] Turning on SA sitewide, overriding on a per-user basis?

2002-05-03 Thread CertaintyTech - Ed Henderson
> > > You could add an entry to the main procmailrc that checks for the > existence > of a certain file called "nospamcheck" (or something like that). IF the > file exists in the users dir then don't run spamc otherwise run > spamc. Then > put "nospamcheck" in each of the user's dir that do not

RE: [SAtalk] Turning on SA sitewide, overriding on a per-user basis?

2002-05-03 Thread CertaintyTech - Ed Henderson
You could add an entry to the main procmailrc that checks for the existence of a certain file called "nospamcheck" (or something like that). IF the file exists in the users dir then don't run spamc otherwise run spamc. Then put "nospamcheck" in each of the user's dir that do not want SA. I do th

[SAtalk] [OT] Help - someone is using our company domain name as the from address in spam

2002-05-03 Thread Andrew Hoying
I'm getting flooded with messages from postmaster accounts about spam coming from us. When you look at the header it is obviously coming from Asia, but they are using our company domain name in the from and return-path addresses. The spam is even about equities, we deal in commodities and equity t

[SAtalk] persisten AWL scores

2002-05-03 Thread Klaus Heinz
Hi, I was experimenting with spamc/spamd but noticed the following also with spamassassin -P: $ perl ./check_whitelist | grep bangura [EMAIL PROTECTED] -> 107.4 (107.4/1) $ spamassassin -R < /tmp/bangura SpamAssassin auto-whitelist: removing address: [EMAIL PROTEC

[SAtalk] Turning on SA sitewide, overriding on a per-user basis?

2002-05-03 Thread Ken Causey
I need some SA specific procmail help and I'm hoping someone on the list has already run into this. I've recently setup SA for a small ISP (about 1000+ mailboxes). 99% percent of their customers are happy, there are a couple that are offended that their email is being "modified". Can I continue

[SAtalk] ${token1} Leave your debt problems behind you (fwd)

2002-05-03 Thread Doug Crompton
This is really spam - should we not have something that matches credit card debt? Submitted to razor. Doug -- Forwarded message -- Received: from outmta027.topica.com (outmta027.topica.com [64.125.140.180]) by marconi.crompton.com (8.10.0/8.10.0) with SMTP id g43EeoG0797

Re: [SAtalk] newbie question - getting an error trying to use this with

2002-05-03 Thread Jason Hough
Hi Henry - I have it working now. I'm using a Cobalt Qube 3 (which runs some Linux variant, RH I believe). Just needed to setup procmail correctly, and fix up some stuff in smrsh. It's working great now! At 02:55 AM 5/3/2002 -0700, Henry Kwan wrote: > > My .foward is setup exactly as the READM

[SAtalk] Detecting local spammers

2002-05-03 Thread CertaintyTech - Ed Henderson
This question is not SA specific but just a general email sysadmin type question: What is an effective way to monitor my own dialup customers to see if any are abusing their email privilege by sending out spam? I am using qmail. Somehow monitor the volume that each local IP is sending? Just cur

Re: [SAtalk] [Fwd: I have some exclusive information for you.]

2002-05-03 Thread Richie Laager
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Friday 03 May 2002 10:00 am, CertaintyTech - Ed Henderson wrote: > What exactly happens to the emails that are sent to > spamassassin-sightings? I have sent alot of them but just > wonder if anything is done with them. Are they used to > improve

[SAtalk] Re: Appending original message as MIME attachment?

2002-05-03 Thread Craig R Hughes
Matt Sergeant wrote: MS> Well we don't care if there's multiply nested stuff - because anything MS> deeper than the first level is just an attachment (though it does store MS> attachments, with their mime type, so you can parse them if you want MS> to). Yes, we do care. I've seen examples of mu

[SAtalk] Re: Appending original message as MIME attachment?

2002-05-03 Thread Matt Sergeant
Craig R Hughes wrote: > Matt Sergeant wrote: > > MS> Well we don't care if there's multiply nested stuff - because anything > MS> deeper than the first level is just an attachment (though it does store > MS> attachments, with their mime type, so you can parse them if you want > MS> to). > > Yes,

RE: [SAtalk] [Fwd: I have some exclusive information for you.]

2002-05-03 Thread CertaintyTech - Ed Henderson
> > These should goto spamassassin-sightings, not spamassassin-talk (unless > you think there's a discussion in store for this spam.) > What exactly happens to the emails that are sent to spamassassin-sightings? I have sent alot of them but just wonder if anything is done with them. Are they use

Re: [SAtalk] Appending original message as MIME attachment?

2002-05-03 Thread Craig R Hughes
Matt Sergeant wrote: MS> I think the reason my stuff would work quite well is it's specifically MS> designed to make it easy to get the known body text from the document, MS> in the same way that an email client would. The MIME::* stuff seems more MS> generic to me, so you'd have to code that stu

Re: [SAtalk] Re: Appending original message as MIME attachment?

2002-05-03 Thread Bart Schaefer
On Fri, 3 May 2002, Daniel Pittman wrote: > SpamAssassin, at least, should be scanning inline parts no matter > their depth in the hierarchy. Attachment parts probably only want > scanning when they are the only, or first, part in a message. Given a multipart/related part, any part that is refer

Re: [SAtalk] [Fwd: I have some exclusive information for you.]

2002-05-03 Thread Ken Causey
I want to apologize to everyone for my fumble here. I will be more careful in the future. Ken On Fri, 2002-05-03 at 09:25, Theo Van Dinter wrote: > On Fri, May 03, 2002 at 09:20:34AM -0500, Ken Causey wrote: > > Not much to filter here, I reported it to razor as well as AOL. > > These should g

Re: [SAtalk] [Fwd: I have some exclusive information for you.]

2002-05-03 Thread Theo Van Dinter
On Fri, May 03, 2002 at 09:20:34AM -0500, Ken Causey wrote: > Not much to filter here, I reported it to razor as well as AOL. These should goto spamassassin-sightings, not spamassassin-talk (unless you think there's a discussion in store for this spam.) -- Randomly Generated Tagline: "Working a

[SAtalk] official site for SpamAssassin

2002-05-03 Thread Klaus Heinz
Hi, which is the official site name for SA that should be used? Both www.spamassassin.org and spamassassin.taint.org work and point to the same address. ciao Klaus ___ Have big pipes? SourceForge.net is looking for download mirro

[SAtalk] [Fwd: I have some exclusive information for you.]

2002-05-03 Thread Ken Causey
Not much to filter here, I reported it to razor as well as AOL. --- Begin Message --- Check out the most exclusive sex guide site on the net, for men and women! http://pleasurelover.subverter.net";>Click here! --- End Message ---

Re: [SAtalk] AWL verses early-terminate

2002-05-03 Thread Matt Sergeant
Nathan Neulinger wrote: > Matt Sergeant wrote: > >>On Thu, 2002-05-02 at 19:31, Neulinger, Nathan wrote: >> >>>The biggest problem with -S is due to the ordering of the rule checks. >>>If all of the negative rules (or at least the _large_ negative rules) >>>were processed first, it would probably

[SAtalk] Re: [info@informics.com: Your address is on the Internet, next timehide it using these methods]

2002-05-03 Thread Daniel Pittman
On Fri, 3 May 2002, [EMAIL PROTECTED] wrote: > On Fri, May 03, 2002 at 02:54:25PM +1000, Daniel Pittman wrote: > | On Thu, 2 May 2002, Duncan Findlay wrote: > | > On Thu, May 02, 2002 at 09:35:58PM -0400, Theo Van Dinter wrote: > | > > | > I wonder if this particular spammer has ways around this.

Re: [SAtalk] Rules for digitally signed messages

2002-05-03 Thread dman
On Fri, May 03, 2002 at 11:24:43AM +0100, Darren Coleman wrote: | Yes, it does check for PGP signed messages, which is good. | | But digitally signed messages (like yours and mine), i.e those that | require the person to buy a digital id, go through a verification | procedure etc, are not given a

Re: [SAtalk] Re: [info@informics.com: Your address is on the Internet, next time hide it using these methods]

2002-05-03 Thread dman
On Fri, May 03, 2002 at 02:54:25PM +1000, Daniel Pittman wrote: | On Thu, 2 May 2002, Duncan Findlay wrote: | > On Thu, May 02, 2002 at 09:35:58PM -0400, Theo Van Dinter wrote: | > | > I wonder if this particular spammer has ways around this... | | Duh. :) He's probably hoping to get a one-up o

Re: [SAtalk] AWL verses early-terminate

2002-05-03 Thread Nathan Neulinger
Matt Sergeant wrote: > > On Thu, 2002-05-02 at 19:31, Neulinger, Nathan wrote: > > The biggest problem with -S is due to the ordering of the rule checks. > > If all of the negative rules (or at least the _large_ negative rules) > > were processed first, it would probably be ok > > All the large

Re: [SAtalk] X-Spam-Status: No, hits=5.0 required=5.0

2002-05-03 Thread Derek Broughton
Craig wrote: > Well, I think that better than comparing the rounded number, we should > instead compare the real numbers, and just round down instead. > So 4.9 would be > displayed as 4.9 not 5.0 -- it's less mathematically correct, but makes it > clearer why 5.0 < 5.0 sometimes. Which is fi

[SAtalk] Re: Appending original message as MIME attachment?

2002-05-03 Thread Daniel Pittman
On 03 May 2002, Matt Sergeant wrote: > On Fri, 2002-05-03 at 12:31, Daniel Pittman wrote: >> >> Cool. Does it correctly handle cases such as MIME digest messages >> >> containing nested multipart/related and multipart/alternative >> >> content? >> > >> > Well we don't care if there's multiply nes

[SAtalk] Re: Appending original message as MIME attachment?

2002-05-03 Thread Matt Sergeant
On Fri, 2002-05-03 at 12:31, Daniel Pittman wrote: > >> Cool. Does it correctly handle cases such as MIME digest messages > >> containing nested multipart/related and multipart/alternative > >> content? > > > > Well we don't care if there's multiply nested stuff - because anything > > deeper than

  1   2   >