[SAtalk] Re: AWL with spamassassin -P

2002-05-20 Thread Shane Hird
"Shane Hird" <[EMAIL PROTECTED]> wrote in message acclod$5qn$[EMAIL PROTECTED]">news:acclod$5qn$[EMAIL PROTECTED]... > > --- > > > > [b.] Because of the above problem, I am using a .procmailrc of; > > > > :0fw > > |/home/user/bin/spamassassin/spamassassin -P -c > > /home/user/bin/spamasssa

[SAtalk] Re: AWL with spamassassin -P

2002-05-20 Thread Shane Hird
> --- > > [b.] Because of the above problem, I am using a .procmailrc of; > > :0fw > |/home/user/bin/spamassassin/spamassassin -P -c > /home/user/bin/spamasssassin/rules > > The paths will be changed once I install it globally. However at the moment > it doesn't seem to doing AWL properly.

[SAtalk] date difference testing

2002-05-20 Thread Daniel Quinlan
I'm in the process of revising the date difference testing. So far, here's what I've done: - fix timezone addition/subtraction (it was sign-reversed!) - don't compare unparseable dates (caused false positives) - don't require seconds (per RFC-2822) - added support for North American time

[SAtalk] AWL with spamassassin -P

2002-05-20 Thread Shane Hird
I am trying to deploy spamassassin site-wide on a Sun/Solaris machine but am having a few difficulties. [a.] I can't get spamd to run. I am using 'perl spamd' (because perl isn't in the /usr/perl5/5.00503/bin/perl path) and get the error: Can't locate syslog.ph in @INC (did you run h2ph?) (@INC

Re: [SAtalk] Razor

2002-05-20 Thread Skip Montanaro
>> I have SpamAssassin running with Communigate, I just installed razor >> (Downloaded, compiled, installed). How can I verify that it is >> working with SpamAssassin and/or is there any configuration necessary >> to get it to check the database for received emails? I think you s

Re: [SAtalk] Klez

2002-05-20 Thread Sidney Markowitz
On Mon, 2002-05-20 at 17:17, Ed Kasky wrote: > Could you post that procmail recipe to the list? I started to, then did not because I have been lazy and took a shortcut with it that really should be fixed before anyone else uses it. But I'll post it now with lots of comments added. Maybe someone w

Re: [SAtalk] Klez

2002-05-20 Thread Ed Kasky
Sidney - Could you post that procmail recipe to the list? Ed ~~ At 04:27 PM Monday, 5/20/2002, Sidney Markowitz wrote -=> >On Mon, 2002-05-20 at 14:18, Peter Scott wrote: > > Does anyone have a rule for matching the Klez virus? > >Following Craig's suggestion, made earlier on this list, I instal

[SAtalk] Re: Klez

2002-05-20 Thread Peter Scott
At 05:02 PM 5/20/02 -0500, Shane Williams wrote: >On Mon, 20 May 2002, Peter Scott wrote: > > > Does anyone have a rule for matching the Klez virus? Normally I wouldn't > > confound spam protection with virus protection, but this is one I want to > > head off before it even gets downloaded. > >I'

Re: [SAtalk] Klez

2002-05-20 Thread Sidney Markowitz
On Mon, 2002-05-20 at 14:18, Peter Scott wrote: > Does anyone have a rule for matching the Klez virus? Following Craig's suggestion, made earlier on this list, I installed f-prot for virus scanning and call it from procmail before any other filters, sending any catches to /dev/null. That replaced

Re: [SAtalk] Spam Tracking

2002-05-20 Thread Mark Martinec
Matt, | Unfortunately that's not strictly true. | | You could very easily poison the database using short english phrases. I | see an awful lot of emails that just contain single words, such as: | "Hello???" or "How did it go?" etc. Generating things like that using a | Markov Chain system wo

Re: [SAtalk] What's wrong with this rule?

2002-05-20 Thread Craig R Hughes
Drop the colon, so just header MUSI_CAL_GIG_GOPHERSubject =~ /Musi-Cal Tour Fetch:/ C Skip Montanaro wrote: SM> SM> Given these lines in my user_prefs file: SM> SM> header MUSI_CAL_GIG_GOPHER Subject: =~ /Musi-Cal Tour Fetch:/ SM> describe MUSI_CAL_GIG_GOPHERSubject: indic

Re: [SAtalk] How to check that rbl_checks are turned off

2002-05-20 Thread Kelsey Cummings
On Mon, May 20, 2002 at 11:48:26PM +0200, Nipper, Arnold wrote: > As I'm doing rbl checks already during receiving I wanted to turn off rbl > checks. Setting skip_rbl_checks to 1 should do the trick. But output from > below suggest that these checks are still performed. How can I check that? Yo

Re: [SAtalk] INPUT_MAIL_FILTER lines for spamass-milter?

2002-05-20 Thread Graham Dunn
On Sun, May 19, 2002 at 11:58:30AM -0700, Craig R Hughes wrote: > You should do size-checking on the messages (or use spamc which does the size > checking for you). Some of the tests get really really slow when run over large > messages. If you're concerned about the time taken to process messag

[SAtalk] Razor

2002-05-20 Thread AHYDLE
Title: Razor I have a dumb question. I have SpamAssassin running with Communigate, I just installed razor (Downloaded, compiled, installed). How can I verify that it is working with SpamAssassin and/or is there any configuration necessary to get it to check the database for received emails?

[SAtalk] Re: Klez

2002-05-20 Thread Shane Williams
On Mon, 20 May 2002, Peter Scott wrote: > Does anyone have a rule for matching the Klez virus? Normally I wouldn't > confound spam protection with virus protection, but this is one I want to > head off before it even gets downloaded. I'm not entirely sure what mechanisms are available to you

[SAtalk] How to check that rbl_checks are turned off

2002-05-20 Thread Nipper, Arnold
As I'm doing rbl checks already during receiving I wanted to turn off rbl checks. Setting skip_rbl_checks to 1 should do the trick. But output from below suggest that these checks are still performed. How can I check that? Arnold spamassassin -t -D < /dev/null > /dev/null debug: using "/usr/sh

[SAtalk] Klez

2002-05-20 Thread Peter Scott
Does anyone have a rule for matching the Klez virus? Normally I wouldn't confound spam protection with virus protection, but this is one I want to head off before it even gets downloaded. -- Peter Scott Pacific Systems Design Technologies __

Re: [SAtalk] Spam Grading Information as attachment

2002-05-20 Thread Daniel Quinlan
Matt Sergeant <[EMAIL PROTECTED]> writes: > Yeah, I've got that working here. It's a pretty trivial change to > SpamAssassin, but I haven't gotten around to integrating it yet. It's > just a matter of setting the content-type to multipart/mixed, and set > the first part to text/plain, and the

[SAtalk] How to log SA Stats

2002-05-20 Thread Dan . Smart
How do you log stats on SA? I know stats are logged inside the messages, but is there a way to log them on the server? I am using SpamAssassin on a site-wide basis, and would like stats on which rules are getting hit.? Here's what I'm running in Procmail --- snip --- # Run SpamAssassin Daemo

Re: [SAtalk] botched MIME tests?

2002-05-20 Thread Daniel Quinlan
Matt Sergeant writes: > Every single one of these is a virus, not spam. I think it's a worm, actually, but the headers are forged so I don't know who's sending them, so unlike a trojan being sent from a co-worker, it's basically unsolicited email that should be filtered. I think trying to not f

[SAtalk] SA not scanning messages?

2002-05-20 Thread Theo Van Dinter
I know there was a thread about this a little while ago, but this just happened to me so I thought I'd post. Got this spam message in, and it was completely not scanned by SA. The syslog entries show that spamd was contacted, but nothing came out of it: May 20 13:03:12 eclectic sendmail[2779]:

Re: [SAtalk] Spam Grading Information as attachment

2002-05-20 Thread Matt Sergeant
Ed Ames wrote: >Has any thought been given to formatting the SpamAssassin "grading > information" as a legit attachment rather than simple adding it to the > beginning of the message body as text. Unfortunately, the text added > to the beginning of the message really messes up some of the HT

Re: [SAtalk] Solaris make test fails

2002-05-20 Thread John Horne
On 20-May-2002 at 10:59:00 John Horne wrote: > So, I thought I'd move this up onto one of the central mailhubs. These are > Sun Solaris 8 (sparc) systems. They have perl version 5.6.0 on them; no > razor. The 'perl Makefile.PL' worked okay, as did 'make'. But with 'make > test' I get a whole load

RE: [SAtalk] Spam Grading Information as attachment

2002-05-20 Thread Ed Ames
We are proposing to use SA on our main mail gateways. Unfortunately, users need (want) to know what rules caused a particular message to classify as spam. I agree that keeping the info in the headers is a technically eloquent solution, but it is a human factor thing... Ed... -Original Me

Re: [SAtalk] HTTP_CTRL_CHARS_HOST

2002-05-20 Thread Matt Sergeant
Klaus Heinz wrote: > Matt Sergeant wrote: > >>Klaus Heinz wrote: > > >>> >http://www.05-cray.category.unique.zaam.net^A^T^T^T.co.fr;|https.am2002.goopt.com:8101 >> > >>Mozilla mail Highlights just one detected URL, from the http:// up to >>(but not including) the pipe symbol. That doesn't s

Re: [SAtalk] Solaris make test fails

2002-05-20 Thread John Horne
On 20-May-2002 at 10:59:00 John Horne wrote: > So, I thought I'd move this up onto one of the central mailhubs. These are > Sun Solaris 8 (sparc) systems. They have perl version 5.6.0 on them; no > razor. The 'perl Makefile.PL' worked okay, as did 'make'. But with 'make > test' I get a whole load

Re: [SAtalk] HTTP_CTRL_CHARS_HOST

2002-05-20 Thread Klaus Heinz
Matt Sergeant wrote: > Klaus Heinz wrote: > > >http://www.05-cray.category.unique.zaam.net^A^T^T^T.co.fr;|https.am2002.goopt.com:8101 > Mozilla mail Highlights just one detected URL, from the http:// up to > (but not including) the pipe symbol. That doesn't seem to be what you're > expectin

Re: [SAtalk] Solaris make test fails

2002-05-20 Thread John Horne
On 20-May-2002 at 14:38:53 Bart Schaefer wrote: > On Mon, 20 May 2002, John Horne wrote: > >> I get a whole load of failed tests: > > Are you using the 2.20 release, or the latest SA from CVS? > > There was an errorneous cvs commit over the weekend that damaged one of > the rules files. See b

Re: [SAtalk] Solaris make test fails

2002-05-20 Thread Bart Schaefer
On Mon, 20 May 2002, John Horne wrote: > I get a whole load of failed tests: Are you using the 2.20 release, or the latest SA from CVS? There was an errorneous cvs commit over the weekend that damaged one of the rules files. See bugzilla.spmassassin.org #338 for the correct file. __

[SAtalk] Stormpost? Blank headers?

2002-05-20 Thread Ken Causey
Two questions in this one. First, would it be difficult to add a rule for blank headers? For example Return-Path: <[EMAIL PROTECTED]> X-Sieve: cmu-sieve 2.0 Received: from mail.premiernet.net [205.229.224.233] by localhost with POP3 (fetchmail-5.9.0) for ken@localhost (single-drop); Sun

Re: [SAtalk] SA header field names

2002-05-20 Thread Tony L. Svanstrom
On Mon, 20 May 2002 the voices made j.linn write: > [Newbie Question] > > Is it possible to change the header field name for ther report from SPAM: > to something else e.g. X-SPAM. > > Is it also possible to configure SA to remove some of the default headers > as with "spam_level_stars"? > > If n

[SAtalk] SA header field names

2002-05-20 Thread j.linn
[Newbie Question] Is it possible to change the header field name for ther report from SPAM: to something else e.g. X-SPAM. Is it also possible to configure SA to remove some of the default headers as with "spam_level_stars"? If not where do I patch SA to change "SPAM:" to "X-SPAM:" John Linn

[SAtalk] Re: PostFix/Sendmail & user.prefs ...

2002-05-20 Thread Daniel Pittman
On Sat, 18 May 2002, Marc G. Fournier wrote: > On Sat, 18 May 2002, Daniel Pittman wrote: >> On Fri, 17 May 2002, Marc G. Fournier wrote: [...] >> The simple filtering mode of Postfix, using a shell script and piped >> data, can have the SMTP envelope information passed on the command >> line. I

Re: [SAtalk] Spam Tracking

2002-05-20 Thread Michael Stenner
On Mon, May 20, 2002 at 09:35:44AM +0100, Matt Sergeant wrote: > Michael Stenner wrote: > > On Fri, May 17, 2002 at 04:15:34PM -0400, Theo Van Dinter wrote: > >>I would be extremely surprised if two people report different messages > >>that result in the same hash. Although completely possible, i

[SAtalk] Solaris make test fails

2002-05-20 Thread John Horne
Hello, I've been running spamassassin 2.20 on my work redhat (7.0) PC with no problems at all. The make, make test and make install all worked first time. I also had spam mail filtered to a separate mailbox successfully - I run the exim MTA on the PC as well. So, I thought I'd move this up onto

[SAtalk] Install Help, please

2002-05-20 Thread Jonathan Allen
Hi ! I'm trying to install Spam Assassin for the first time, and on doing the 'make' as per the instructions I get: > for f in spamassassin spamd/spamc.pod spamd/spamd spamproxy/spamproxyd >lib/Mail/SpamAssassin.pm lib/Mail/SpamAssassin/Conf.pm >lib/Mail/SpamAssassin/PerMsgStatus.pm lib/Mail/

[SAtalk] Install Help, please

2002-05-20 Thread Jonathan Allen
Hi ! I'm trying to install spamassassin for the first time, and when doing the 'make' I get: > for f in spamassassin spamd/spamc.pod spamd/spamd spamproxy/spamproxyd >lib/Mail/SpamAssassin.pm lib/Mail/SpamAssassin/Conf.pm >lib/Mail/SpamAssassin/PerMsgStatus.pm lib/Mail/SpamAssassin/Persisten

Re: [SAtalk] botched MIME tests?

2002-05-20 Thread Matt Sergeant
Ugh, looks like SourceForge installed a lame text filter that attempts to do virus protection (incorrectly, brokenly)... So my email didn't get through. I snipped the Content-Type lines from my reply this time so it will pass the gateway. Original Message Subject: Mail deliv

[SAtalk] Problems with local.cf

2002-05-20 Thread Patricia Keena
Hi All,   Just a quick question regarding spamassassins local.cf file.  I have edited this file to whitelist all messages to one address in my domain using the following rule:   all_spam_to [EMAIL PROTECTED]   I have also added in a few blacklist rules using the rule:   blacklist_from [EMAIL

Re: [SAtalk] HTTP_CTRL_CHARS_HOST

2002-05-20 Thread Matt Sergeant
Klaus Heinz wrote: > Hi, > > these days I got my first spam mail containing control characters in URLs, > I think from some spammer called Empire Towers. > > Although 20_uri_tests.cf contains the test HTTP_CTRL_CHARS_HOST, it wasn't > triggered by this mail. I got curious because of this and the

Re: [SAtalk] Spam Tracking

2002-05-20 Thread Matt Sergeant
Michael Stenner wrote: > On Fri, May 17, 2002 at 04:15:34PM -0400, Theo Van Dinter wrote: > >>I would be extremely surprised if two people report different messages >>that result in the same hash. Although completely possible, it's also >>very very unlikely. > > > Someone said on this list tha

Re: [SAtalk] botched MIME tests?

2002-05-20 Thread Matt Sergeant
Craig R Hughes wrote: > Matt Sergeant wrote: > > MS> My MIME parser (posted to the dev list) croaks on invalid MIME. In > MS> testing about 30,000 emails it only croaks on spams, so far. > MS> > MS> I just wish I had time to implement it inside SA (it's a big job as > MS> currently SA's mail pars