I need help figuring something out.
I'm managing email on a server in an inhouse, company
environment. Many users on system, but all are using the
system for company business, so basically we will have very
similar spam vs. ham issues.
I was frustrated because the autolearn Bayes files seemed to
> I wonder what comes next. To my mind, attempts at legislation will prove
> useless. Technology will prove the savior.
My opinion is that both are needed in the long run, and either one alone
will fail. Of course its necessary to use technology to catch spammers in
the act and track them down, bu
Hello All,
Puzzling problem I have here. I use RH 8, Sendmail 8.12.9, Mimedefang 2.33 with SA
2.54 and I recently attempted to start doing RBL checks within SA. SKIP_RBL_CHECKS
(apologize if it is mistyped) is set to 0. For testing purposes, I have tcpdump port
53 running in a terminal sess
Marek Dohojda wrote:
> As most of you know Outlook doesn't forward headers when you forward
> an e-mail (and with newer Outlook 2002+, you can't even resend with
> headers intact). Therefore Outlook is a bad tool in traning SA.
You could try SpamSource:
http://www.daesoft.com/SpamSource/index
This is my setup:
IMAP folders (one for spam, and one for ham) on the SA server for each user.
Set up IMAP accounts for the users in Outlook.
Then drag/move, (don't forward) learning messages to the respective folders.
AJ Willmer
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL
Hi everybody,
I'm going to be leaving for about 2 months very shortly. Jesus Climent
<[EMAIL PROTECTED]> will be maintaining the spamassassin
debian packages while I'm gone.
My woody backports will not be updated for the duration of my absence.
Perhaps someone else would like to do this for the 2
On Fri, 20 Jun 2003, Greg A wrote:
>
> The SA src rpm rebuild for Redhat 8.0 did not work correctly for some reason.
>
> Note: I currently have Spamassassin 2.53 running on the system.
>
What command are you using to try to install them??
On the command line try the following:
"rpm -ivh spama
"Mathew Hendry" <[EMAIL PROTECTED]> writes:
> Is there an easy way to detect fraudulent links like the following from
> a recent scamspam.
>
> href=3D"http://hyperiod.hypermart.net/fraud.html";> face=3DArial=20
> size=3D2>BestBuy.com/fraud_department.html
>
> i.e. both the href and the visible
On Fri, Jun 20, 2003 at 11:44:14PM +0200, Tony Earnshaw wrote:
> So, gentlemen, hat(s) off and on in ever increasing tempo.
Here, here and to the many subscribers to this list giving solid support!
Regards: Jim Ford
--
Spam poison - don't use! ---> [EMAIL PROTECTED] <---
> At Fri Jun 20 11:13:52 2003, Alexander Litvinov wrote:
>> On ðÑÔÎÉÃÁ, 20 éÀÎØ 2003 16:57, Simon Byrnand wrote:
>> > Just wondering if any updates have been done to the nigerian rules for
>> 2.60
>> > ?
>> >
>> > I notice that all the recent ones I've seen lately seem to start with
>> >
>> > "FROM
Hello everyone
I hope this questions hasn't been asked before. If so, me sorry :)
As most of you know Outlook doesn't forward headers when you forward an
e-mail (and with newer Outlook 2002+, you can't even resend with headers
intact). Therefore Outlook is a bad tool in traning SA.
Unfortuante
Looks like the problem is with spamd. Killing the spamd daemon and
substituting spamassassin for spamc in my procmailrc eliminated the error.
Maybe I've found a bug in spamd!
Regards: Jim Ford
--
Spam poison - don't use! ---> [EMAIL PROTECTED] <---
-
Roger wrote:
I'm working with SA 2.55 and amavisd-new and am having trouble getting
SA to a tag Subject header.. Amavisd-new and SA deletes spam
successfully but tagging isn't working.
In your amavisd.conf, what are sa_spam_subject_tag and
sa_spam_modifies_subj set to?
--
At 04:30 PM 6/20/2003 -0500, Roger wrote:
In invoking SA via amavisd-new I don't believe there's anything on amavis'
end thats needs to be changed. Below is a copy of my local.cf - from
looking over the man page this would appear to be enough to rewrite the
subject header - but messages w/ hits
Try using
whitelist_from_rcvd [EMAIL PROTECTED] webmail2.usainteractive.com
It seems that the second argument needs to be a FQDN server name not just
the domain part.
On Fri, Jun 20, 2003 at 05:16:48PM -0400, Russ wrote:
> I believe you need to specify the fully quallified path name to
> the dcc binaryie dcc_path /usr/local/bin/dccproc
Nope - no difference. I'm pissed off with it for tonight and going to bed.
I'll get my teeth into its arse again in the mor
Hi!
I'm just installing Spamassassin and Razor on a Linux box. I'm trying to
install Razor first but I keep getting the error:
nextserver: discover0: No Razor Discovery servers available at this time
Does this mean a server is down (been trying a couple of days) or have I
messed up somewhere? I a
On Fri, Jun 20, 2003 at 05:03:18PM -0400, Matt Kettler wrote:
> What happens if you add a # to the dcc_path line to comment it out and run
> spamassassin --lint again?
spamassassin --lint doen't report any errors with the dcc_path line in or
commented out. BTW, I use spamd+spamc and there's no l
SA 2.60-CVS, Postfix 2.0.12, amavisd-new, site-wide rules.
Don't know whether it's posting on this particular list (I suspect so)
or on others. But the spam volume is growing at an enormous rate.
I'm deliberately publishing [EMAIL PROTECTED]; I can kill it dead
tomorrow, should I so wish. But t
The SA src rpm rebuild for Redhat 8.0 did not work correctly for some reason.
Note: I currently have Spamassassin 2.53 running on the system.
I did the following.
*downloaded 2.55 source rpm from link on SA website to VanDinter
*copied to a new directory on the hard disk (any directory ok I
I'm working with SA 2.55 and amavisd-new and am having trouble getting
SA to a tag Subject header.. Amavisd-new and SA deletes spam
successfully but tagging isn't working.
In invoking SA via amavisd-new I don't believe there's anything on
amavis' end thats needs to be changed. Below is a copy
I finally found http://spamassassin.org/doc/Mail_SpamAssassin_Conf.html.
which covers this.
Using whitelist_from will bypass checking based on the from address. To
bypass based on the sending server(and from address) use
whitelist_from_rcvd. To bypass tests for all mail from your use
whitelist
On Fri, Jun 20, 2003 at 01:38:44PM -0700, Patrick Morris wrote:
> If there are no weird characters in that line that didn't translate into
> the e-mail, you're not running the version you think you are. You may
> want to check and make sure you don't have an older copy of SpamAssassin
> install
I believe you need to specify the fully quallified path name to
the dcc binaryie dcc_path /usr/local/bin/dccproc
russ...
- Original Message -
From: "Jim Ford" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, June 20, 2003 3:44 PM
Subject: Re: [SAtalk] Failed to parse line in
On Thu, Jun 19, 2003 at 11:31:28PM +0200, Kai Schaetzl wrote:
> Mike Van Pelt wrote on Thu, 19 Jun 2003 10:30:34 -0700:
>
> > There used to be rules for "forged from {aol,hotmail,yahoo,etc.}"
> > didn't there?
> >
>
> These are *not* "forged AOL". There's nothing which prevents you sending
> wit
At 08:44 PM 6/20/2003 +0100, you wrote:
On Fri, Jun 20, 2003 at 03:04:26PM -0400, Matt Kettler wrote:
> What version of SA are you using? Works fine on my copy of 2.54..
2.55
Here's the start of my ~.spamassassin/user_prefs - looks alright to me!
# SpamAssassin user preferences file. See 'perl
At Fri Jun 20 11:13:52 2003, Alexander Litvinov wrote:
> On ðÑÔÎÉÃÁ, 20 éÀÎØ 2003 16:57, Simon Byrnand wrote:
> > Just wondering if any updates have been done to the nigerian rules for 2.60
> > ?
> >
> > I notice that all the recent ones I've seen lately seem to start with
> >
> > "FROM THE DESK OF
If there are no weird characters in that line that didn't translate into
the e-mail, you're not running the version you think you are. You may
want to check and make sure you don't have an older copy of SpamAssassin
installed in a different place from 2.55.
Jim Ford wrote:
On Fri, Jun 20, 200
On Fri, Jun 20, 2003 at 02:44:29PM -0400, Matt Kettler wrote:
> The fastest way is to fire up the plain command-line version and look at
> the debug output there. You can tell almost immediately if DNS is being
> used this way. (note: sample-spam.txt comes in the SA tarball, but you can
> use a
On Fri, Jun 20, 2003 at 03:04:26PM -0400, Matt Kettler wrote:
> >'Failed to parse line in spamassassin configuration: skipping dcc_path
> >/usr/local/bin'
> What version of SA are you using? Works fine on my copy of 2.54..
2.55
> Are you sure there's not a typo in a previous line? (ie: a missin
Daniel Quinlan wrote:
>> In 2.60, RBL lookups are going to be a *lot* faster. I should do some
>> benchmarks vs. 2.55, but you should notice a very nice improvement.
Simon Byrnand <[EMAIL PROTECTED]> writes:
> I'm curious, what kind of changes are responsible for the improvement ?
>
> Will the
oh.. so its still in there, but as a modified, improved, form -- not
completely taken out.
thats what i thought was posted.
On Friday, June 20, 2003, at 03:11 PM, Daniel Quinlan wrote:
Jonathan Vanasco <[EMAIL PROTECTED]> writes:
Any reason for this, or are we to use custom rules for that?
It
Jonathan Nichols wrote:
> Mathew Hendry wrote:
>> Is there an easy way to detect fraudulent links like the following
>> from a recent scamspam.
>>
>> > href=3D"http://hyperiod.hypermart.net/fraud.html";>> face=3DArial=20 size=3D2>BestBuy.com/fraud_department.html
>
> Wow, that one has changed a
Jonathan Vanasco <[EMAIL PROTECTED]> writes:
> Any reason for this, or are we to use custom rules for that?
It was changed because the old test needed improvement, not on a whim.
Old HTML_WEB_BUGS rule wasn't a very good discriminator between HTML
spam and HTML ham. In other words, it had about
At 05:00 PM 6/20/2003 +0100, Jim Ford wrote:
I've got in my SA user_prefs file 'dcc_path /usr/local/bin', which is where
dccproc lives, but I'm getting:
'Failed to parse line in spamassassin configuration: skipping dcc_path
/usr/local/bin'
What version of SA are you using? Works fine on my copy
Mathew Hendry wrote:
Is there an easy way to detect fraudulent links like the following from
a recent scamspam.
http://hyperiod.hypermart.net/fraud.html";>BestBuy.com/fraud_department.html
Wow, that one has changed already.. it was going to "digitalgamma.com"
when it first came out.
-
At 05:54 PM 6/20/2003 +0100, Jim Ford wrote:
I've now installed Net:DNS, and put 'dns_available test' in my user_prefs.
I've not seen any sign of it working in my maillog yet (I've got the -D
option for spamd), how can I tell if it's working, please?
The fastest way is to fire up the plain command-
Hi Jim,
For example when issuing the following command from the SA source dir
(where the sample spam message is):
# spamassassin -D < sample-spam.txt > out.tx
I get (among a lot of other output) the following lines indicating
Net::DNS is working
debug: is Net::DNS::Resolver available? yes
debug
Is there an easy way to detect fraudulent links like the following from
a recent scamspam.
http://hyperiod.hypermart.net/fraud.html";>BestBuy.com/fraud_department.html
i.e. both the href and the visible text look like URLs, but don't come
anywhere close (I guess that's the tricky part :) to match
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
I'm currently running SA 2.55/procmail and logging procmail to
/var/log/messages where I'm getting the following:
procmail: Extraneous filter-flag ignored
~From [EMAIL PROTECTED] Fri Jun 20 12:00:04 2003
~ Subject: www.linux-works.org 06/20/03:12.00 sy
> "Christopher" == Christopher M Iarocci <[EMAIL PROTECTED]>
> on Fri, 20 Jun 2003 12:55:26 -0400 writes:
>> I've been using Bayes and auto whitelisting for several weeks
>> only, but on a site wide basis (i.e. spamc/spamd triggered from
>> procmail from sendmail).
>>
> I've been using Bayes and auto whitelisting for several weeks
> only, but on a site wide basis (i.e. spamc/spamd triggered from
> procmail from sendmail).
>
> I've been very happy with the bayes learner, but today got a
> pretty bad spam into one of the mailing lists I manage, here are
> some
Hi,tt
I've now installed Net:DNS, and put 'dns_available test' in my user_prefs.
I've not seen any sign of it working in my maillog yet (I've got the -D
option for spamd), how can I tell if it's working, please?
Regards: Jim Ford
--
Spam poison - don't use! ---> [EMAIL PROTECTED] <---
---
I've been using Bayes and auto whitelisting for several weeks
only, but on a site wide basis (i.e. spamc/spamd triggered from
procmail from sendmail).
I've been very happy with the bayes learner, but today got a
pretty bad spam into one of the mailing lists I manage, here are
some of the headers a
On Thu, Jun 19, 2003 at 10:33:48PM -0500, Fuzzy Fox wrote:
> Do you have any proof about that last point? I don't think spammers
> ever examine bounces, or do any sort of management on their lists
> whatsoever. It would simply add to their costs.
Surely it would be a trivial thing for them to d
Hi,
I've got in my SA user_prefs file 'dcc_path /usr/local/bin', which is where
dccproc lives, but I'm getting:
'Failed to parse line in spamassassin configuration: skipping dcc_path
/usr/local/bin'
In my maillog (with the -D option to spamd)
dcc seems to be working because dccproc is later fou
On Fri, Jun 20, 2003 at 09:57:58PM +1200, Simon Byrnand wrote:
> FROM THE DESK OF DR.ANDREW.KAllIBAH
> PAYMASTER GENERAL OF THE FEDERAL REPUBLIC
> OF NIGERIA.
Hey - I've not had that one yet! Why've they left me out? I might email them
to subscribe to their list. I've never had spam from such a h
> 1. The mind warper generation 4 Dimensional Warp Generator # 52 4350a
> series wrist watch with z60 or better memory adapter. If in stock the
> AMD Dimensional Warp Generator module containing the GRC79 induction
> motor, two I80200 warp stabilizers, 256GB of SRAM, and two Analog
> Devices isolin
> We need a vendor who can offer immediate supply.
> I'm offering $5,000 US dollars just for referring a vender which is
> (Actually RELIABLE in providing the below equipment) Contact details
> of vendor required, including name and phone #. If they turn out to be
> reliable in supplying the below
Not right now, but, I'll search my spam archives... They usually say
something like "Re: lo que hablamos..." in the subject line, and have some
little propaganda in the body of the message, or a random code.
Luis Hernán Otegui
Administrador de Red
do you have an example of a dummy message? just curious.
On Friday, June 20, 2003, at 11:24 AM, Luis Hernán Otegui wrote:
Do you have any proof about that last point? I don't think spammers
ever examine bounces, or do any sort of management on their lists
whatsoever. It would simply add to the
> Spammers are stupid, but spamware authors,
> well, on the whole i'd say they're intelligent but
> dysfunctional.
I guess I just have a semi-obsolete view of the world. To me, intelligence
put to bad use isn't necessarily intelligent--it's either sinister or
stupid. It's a bit like the worst-ca
Hi all, I've got in the last week a lot of false positives coming from
addresses at yahoo, such yahoo.com.ar, yahoo.com, and yahoo.es. Apparently
they are listed in osirus, NJABL and other RBLs.
I attach a sample of them. Plus, some of them get heavily scored because of
the ad near the end of th
Do you have any proof about that last point? I don't think spammers
ever examine bounces, or do any sort of management on their lists
whatsoever. It would simply add to their costs.
Well, most spams I get come from my country, Argentina, and the soberane
idiots (aka meta-spammers), tend to verif
I'm running a Mandrake 9.0 machine, with qmail (as installed by LWQ.org) and
SA 2.55 site wide, using Bayes with auto learning enabled. The server is
just a gateway server, which then routes it's filtered email (Thank you VERY
much SpamAssassin!) to a POP server sitting behind it. The server behi
What exactly does a "whitelist_from" directive do? Does it add a
negative score? Or does it cause Spamassassin to ignore that particular
sender? Does "whitelist_from" match against the DNS name that
results from the reverse DNS lookup of the IP of the conecting MTA?
Thanks. -pat
*---
Kent R. Frazier wrote:
> Everything seem to be working fine except for this one problem. I
> receive daily weather forcasts from weather.com and SpamAssassin is
> marking them as spam. I addend weather.com to my whitelist, but it is
> still being marked as spam.
>
> Here is my local.cf file:
>
>
Hi all,
Yesterday, I did a clean reinstall of RedHat 9 and installed
SpamAssassin. I have an updated system via up-to-date. My current
SpamAssassin version is 2.44-11.8.x
Everything seem to be working fine except for this one problem. I
receive daily weather forcasts from weather.com and SpamAss
I just received this email. While clearly an attempt to get people to
send personal information to this spamming scumbag, it is funny.
<-->
Return-Path: <[EMAIL PROTECTED]>
Received: from 143.197.200.1 ([61.146.139.179]) by proton.llu
> -Original Message-
> On Thursday, June 19, 2003, at 06:15 PM, Matthew Thomas wrote:
>
> > Greetings,
> >
> > I recently got SpamAssassin 2.55 running with MIMEDefang.
> I'd like to
> > temporarily (say over a weekend), send mail marked as spam
> to a spam
> > mailbox so that I can m
Any reason for this, or are we to use custom rules for that?
On Thursday, June 19, 2003, at 10:45 PM, Daniel Quinlan wrote:
Jonathan Vanasco <[EMAIL PROTECTED]> writes:
body Image tag with an ID code to identify you
HTML_WEB_BUGS0.542 0.100 0.100 0.100
does that trap
http://b
Kris Deugau wrote on Thu, 19 Jun 2003 17:29:49 -0400:
> uri REALLY_SHORT_PORN_01 /cryingrussians.net/i
>
I just use something like
body REALLY_SHORT_PORN_01 /cryingrussians/i
Is there any advantage of the first format? F.i. speed?
I thought using a body rule might actually help in speed and it
excellent, i didnt think anybody was working on this yet. If there is
anything i can do to help with the project let me know. I am not Larry
Wall, but i can probably help to some degree.
thanks
adam
On Fri, 2003-06-20 at 09:32, Michael Parker wrote:
> On Fri, Jun 20, 2003 at 08:19:08AM -0400, A
On Fri, Jun 20, 2003 at 08:19:08AM -0400, Adam Denenberg wrote:
> All,
>
> I know this has been discussed on the list before, since many people
> run multiple gateways running SA, they have no way to sync their bayes
> DBs. Bayes does not work over NFS due to flock(), thus forcing
> independant
All,
I know this has been discussed on the list before, since many people
run multiple gateways running SA, they have no way to sync their bayes
DBs. Bayes does not work over NFS due to flock(), thus forcing
independant Bayes DB.
So on the list we mostly come to the conclusion that the only
It seems to me catching such spam is the work for bayers filter.
On Пятница, 20 Июнь 2003 16:57, Simon Byrnand wrote:
> Just wondering if any updates have been done to the nigerian rules for 2.60
> ?
>
> I notice that all the recent ones I've seen lately seem to start with
>
> "FROM THE DESK OF" f
Just wondering if any updates have been done to the nigerian rules for 2.60 ?
I notice that all the recent ones I've seen lately seem to start with
"FROM THE DESK OF" for example:
FROM THE DESK OF DR.ANDREW.KAllIBAH
PAYMASTER GENERAL OF THE FEDERAL REPUBLIC
OF NIGERIA.
I might be mistaken but 2
Hi all,
i have a easy question. How can i find out that spamassassin work well
with DCC, razor and rbl ?? I dont know if spamassassin with my
configuration work well with this stuff.
I have Debian Woody with qmail and qmail-scanner.
127 [EMAIL PROTECTED]:qmailscan# cat /etc/default/spamassassi
> hi to all,
>
> I've installed spamassassin 2.54 in redhat 7.3 with a machine specs of
> Intel
> PII 350MHz 128MB, there are trimes that my server loads abnormally
> increases
> when
.you try to post a message to the spamassassin list ? ;-)
Try leaving 'vmstat 5' running in a window and see
On Fri, 2003-06-20 at 06:26, Benjamin A. Shelton wrote:
> >
> >
> >It does. When someone makes something, it is natural instinct for them
> >to want to test it, see if it works.
> >
>
> I would certainly agree with this. However, remember that Microsoft
> recently released a "patch" that "fixed"
Hi Matthew,
>I recently got SpamAssassin 2.55 running with MIMEDefang. I'd like to
>temporarily (say over a weekend), send mail marked as spam to
>a spam mailbox
Here's what I used in /etc/mail/mimedefang-filter to get a seed corpus:
warning: you definitely should check the resulting mailbox be
* Michael P. Carel <[EMAIL PROTECTED]>:
> I've installed spamassassin 2.54 in redhat 7.3 with a machine specs
> of Intel PII 350MHz 128MB, there are times that my server loads
> abnormally increases when spamassassin daemon scanning emails. I used
> to restart the daemon process and the server lo
I read about some problems in conjunction with Spamassassin's autolearn
mechanism.
My questions:
Is it momentary reasonable to use the autolearn mechanism?
Will the data format of the db files be shifted to another format in
spamassassin 2.7 (for example)?
And are there problems in conjunction wi
73 matches
Mail list logo
